@love-moon/conductor-cli 0.10.0 → 0.11.1

package/src/daemon.js

@@ -24,6 +24,13 @@ import {
   resolveConductorConfigPath,
   resolveConductorHome,
 } from "./conductor-paths.js";
+import {
+  deleteFireSessionRecord,
+  pruneFireSessionRecords,
+  readFireSessionRecord,
+  resolveFireSessionRegistryDir,
+  writeFireSessionRecord,
+} from "./fire-session-registry.js";
 import { createAiManagerHandlers, handleAiManagerRequest } from "./ai-manager-handlers.js";
 import {
   CUSTOM_COMMANDS_CAPABILITY,
@@ -35,9 +42,16 @@ import {
   createRemoteExecHandlers,
   handleRemoteExecRequest,
 } from "./remote-exec-handlers.js";
+import {
+  UPDATE_DAEMON_CAPABILITY,
+  createDaemonUpdateHandlers,
+  handleUpdateDaemonRequest,
+  resolveDaemonUpdatePaths,
+} from "./daemon-update.js";
 import { resolveResumeContext } from "./fire/resume.js";
 import {
   filterRuntimeSupportedAllowCliList,
+  inferBuiltInRuntimeBackendFromCommand,
   listAdvertisedBackends,
   resolveConfiguredRuntimeBackend,
   isBuiltInRuntimeBackend,
@@ -46,6 +60,7 @@ import {
   normalizeRuntimeBackendAlias,
   normalizeRuntimeBackendName,
 } from "./runtime-backends.js";
+import { resolveClaudeCommandForRoot } from "@love-moon/ai-sdk";
 import {
   PACKAGE_NAME,
   buildUpgradeCommand,
@@ -67,7 +82,31 @@ import {
   maskErrorForLogs,
   redactSecretsForLogs,
 } from "./handoff-log-mask.js";
+import {
+  DAEMON_LOCK_FILE_NAME,
+  FORCE_KILL_UNKNOWN_OWNER_ENV_VAR,
+  buildDaemonInstanceIdentity,
+  compareDaemonLockIdentity,
+  describeDaemonLockOwner,
+  describeForceRestartRefusal,
+  parseDaemonLockState,
+  serializeDaemonLock,
+} from "./daemon-lock.js";
 import { StringDecoder } from "node:string_decoder";
+import {
+  MAX_GUEST_DAEMONS,
+  buildGuestConfigYaml,
+  buildGuestEnv,
+  filterGuestCapabilities,
+  isGuestAiManagerActionAllowed,
+  isGuestRestartAllowed,
+  isPathInsideGuestRoot,
+  nextRestartDelayMs,
+  reconcileGuests,
+  startOrphanWatchdog,
+  resolveGuestPaths,
+  writeGuestConfig,
+} from "./guest-daemon.js";
 
 dotenv.config();
 
@@ -76,6 +115,11 @@ const __dirname = path.dirname(__filename);
 const PACKAGE_ROOT = path.join(__dirname, "..");
 const moduleRequire = createRequire(import.meta.url);
 const CLI_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-fire.js");
+// RFC 0035: the launcher a guest daemon child is spawned with. Same binary as
+// the host daemon, so guests always match the installed version and there is
+// no second update path to keep in sync.
+const DAEMON_LAUNCHER_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-daemon.js");
+const DAEMON_UPDATE_SCRIPT_PATH = path.resolve(PACKAGE_ROOT, "bin", "conductor-daemon-update.js");
 const CLI_VERSION = (() => {
   try {
     return JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf-8")).version;
@@ -493,6 +537,18 @@ export function ensureNodePtySpawnHelperExecutable(deps = {}) {
   return { helperPath, updated: true };
 }
 
+// A tool-preset PTY task runs the configured allow_cli_list command through a
+// login shell, bypassing ai-sdk entirely. claude refuses to start as root with
+// `--dangerously-skip-permissions`, so rewrite the command the same way the
+// ai-sdk session rewrites its permission mode — one shared root check, so the
+// two paths cannot drift.
+export function resolvePtyToolPresetCommand(cliCommand, env = process.env) {
+  if (inferBuiltInRuntimeBackendFromCommand(cliCommand) !== "claude") {
+    return cliCommand;
+  }
+  return resolveClaudeCommandForRoot(cliCommand, env);
+}
+
 export function isSafeTaskWorktreeRoot(projectWorkspacePath, worktreeRoot) {
   const normalizedWorkspacePath =
     typeof projectWorkspacePath === "string" ? projectWorkspacePath.trim() : "";
@@ -675,6 +731,12 @@ function parseTaskWorktreeLaunchConfig(launchConfig) {
     projectRepoRoot,
     projectWorkspacePath,
     projectRelativePath,
+    // Reuse-only members (reviewers in a multi-agent group) share the owner's
+    // worktree but must never run `git worktree add` themselves.
+    worktreeReuseOnly: normalizeBooleanFlag(
+      normalizedLaunchConfig.worktreeReuseOnly ??
+        normalizedLaunchConfig.worktree_reuse_only,
+    ),
   };
 }
 
@@ -772,6 +834,106 @@ function buildPtyTaskEnv(baseEnv = process.env, launchEnv = {}) {
   };
 }
 
+// Module-level so the PTY launch wiring is directly testable: the tool-preset
+// branch has to hand the *child's* env to the root check, and that seam is
+// exactly where a bug hid before (the check read the daemon's own process.env,
+// silently ignoring a per-task IS_SANDBOX=1 opt-out).
+export function buildPtyLaunchSpec(launchConfig, fallbackCwd, deps = {}) {
+  const allowCliList = deps.allowCliList || {};
+  const supportedBackends = Array.isArray(deps.supportedBackends) ? deps.supportedBackends : [];
+  const existsSyncFn = deps.existsSync || fs.existsSync;
+  const baseEnv = deps.baseEnv || process.env;
+  const log = typeof deps.log === "function" ? deps.log : () => {};
+  const normalizedLaunchConfig = normalizeLaunchConfig(launchConfig);
+  const entrypointType =
+    normalizeOptionalString(normalizedLaunchConfig.entrypoint_type) ||
+    normalizeOptionalString(normalizedLaunchConfig.entrypointType) ||
+    (normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
+    normalizeOptionalString(normalizedLaunchConfig.toolPreset)
+      ? "tool_preset"
+      : "shell");
+  const preferredShell = resolveDefaultPtyShell({
+    explicitShell: normalizedLaunchConfig.shell,
+    envShell: process.env.SHELL,
+    comspec: process.env.COMSPEC,
+    platform: process.platform,
+    existsSync: existsSyncFn,
+  });
+  const cwd =
+    normalizeOptionalString(normalizedLaunchConfig.cwd) ||
+    fallbackCwd;
+  const env = normalizeTerminalEnv(normalizedLaunchConfig.env);
+  const cols = normalizePositiveInt(
+    normalizedLaunchConfig.cols ?? normalizedLaunchConfig.columns,
+    DEFAULT_TERMINAL_COLS,
+  );
+  const rows = normalizePositiveInt(
+    normalizedLaunchConfig.rows,
+    DEFAULT_TERMINAL_ROWS,
+  );
+
+  if (entrypointType === "tool_preset") {
+    const toolPreset =
+      normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
+      normalizeOptionalString(normalizedLaunchConfig.toolPreset) ||
+      supportedBackends[0] ||
+      "codex";
+    const cliCommand = allowCliList[toolPreset];
+    if (!cliCommand) {
+      throw new Error(`Unsupported tool preset: ${toolPreset}`);
+    }
+    const launchCommand = resolvePtyToolPresetCommand(cliCommand, buildPtyTaskEnv(baseEnv, env));
+    if (launchCommand !== cliCommand) {
+      log(`[pty] Adjusted ${toolPreset} command for root: ${launchCommand}`);
+    }
+    return {
+      entrypointType,
+      toolPreset,
+      command: preferredShell,
+      args: ["-lc", launchCommand],
+      shell: preferredShell,
+      cwd,
+      env,
+      cols,
+      rows,
+    };
+  }
+
+  if (entrypointType === "custom") {
+    const command = normalizeOptionalString(normalizedLaunchConfig.command);
+    if (!command) {
+      throw new Error("launch_config.command is required for custom entrypoint");
+    }
+    const args = Array.isArray(normalizedLaunchConfig.args)
+      ? normalizedLaunchConfig.args.filter((value) => typeof value === "string")
+      : [];
+    return {
+      entrypointType,
+      toolPreset: null,
+      command,
+      args,
+      shell: preferredShell,
+      cwd,
+      env,
+      cols,
+      rows,
+    };
+  }
+
+  return {
+    entrypointType: "shell",
+    toolPreset: null,
+    command: preferredShell,
+    args: ["-l"],
+    shell: preferredShell,
+    cwd,
+    env,
+    cols,
+    rows,
+  };
+}
+
+
 export function startDaemon(config = {}, deps = {}) {
   const exitFn = deps.exit || process.exit;
   const killFn = deps.kill || process.kill;
@@ -881,6 +1043,24 @@ export function startDaemon(config = {}, deps = {}) {
   // warning and silently fall back to direct spawn rather than failing every
   // create_task with ENOENT.
   const FIRE_TMUX_MODE_ENABLED = getFireTmuxModeEnabled(userConfig);
+  // RFC 0035: a guest daemon runs on someone else's machine as a different
+  // account. It keeps the ordinary daemon code path but drops the capabilities
+  // that would mutate state the machine's OWNER depends on.
+  const IS_GUEST_DAEMON =
+    userConfig.conductor_guest === true ||
+    fileConfig?.conductorGuest === true ||
+    Boolean(normalizeOptionalString(process.env.CONDUCTOR_GUEST_SHARE_ID));
+  // Only set when the share carries an explicit `workspaceRoot`, i.e. the owner
+  // deliberately scoped where the guest should work. Absent that, a guest binds
+  // projects wherever any other daemon could -- inventing a confinement the
+  // owner never asked for would make the guest gratuitously less capable, and
+  // it was never a security boundary anyway (the grantee's agent runs a shell).
+  const GUEST_ROOT = normalizeOptionalString(process.env.CONDUCTOR_GUEST_ROOT);
+  // A guest resolves `remote_exec` from its own config exactly like any other
+  // daemon. It is not withheld: the grantee already has a shell here through
+  // AI tasks and `pty_task`'s custom entrypoint, so blocking the scriptable
+  // path would cost function without removing reach (RFC 0034 makes the same
+  // argument). An owner who wants it off can set `remote_exec: false`.
   const remoteExecEnabled = getRemoteExecEnabled(userConfig);
 
   // Get allow_cli_list from config
@@ -911,6 +1091,17 @@ export function startDaemon(config = {}, deps = {}) {
       readFileSync: deps.readFileSync || fs.readFileSync,
     }));
   const skipPidLockCheck = parseBooleanEnv(process.env.CONDUCTOR_TUI_DEBUG);
+  // Fingerprint of *this* daemon instance, persisted into daemon.pid so that a
+  // later `--force` can tell "restart myself" apart from "kill whoever happens
+  // to hold the lock". WORKSPACE_ROOT defaults to $HOME/ws, so unrelated
+  // instances collide on the same lock file by default.
+  const daemonInstanceIdentity = buildDaemonInstanceIdentity({
+    conductorHome: materializedConductorPathEnv.CONDUCTOR_HOME,
+    configPath: effectiveConfigPath,
+    workspaceRoot: WORKSPACE_ROOT,
+    daemonName: AGENT_NAME,
+    backendUrl: BACKEND_HTTP,
+  });
   const lockHandoffToken =
     normalizeOptionalString(config.LOCK_HANDOFF_TOKEN) ||
     normalizeOptionalString(process.env.CONDUCTOR_LOCK_HANDOFF_TOKEN);
@@ -1010,6 +1201,16 @@ export function startDaemon(config = {}, deps = {}) {
     log("Fire tmux mode enabled: each Fire process will run in a detached tmux session");
   }
 
+  // Shared by every Fire tmux session name. Also the discriminator that lets
+  // startup adoption tell our sessions apart from the user's own tmux work.
+  const FIRE_TMUX_SESSION_NAMESPACE = "conductor-fire-";
+
+  // Where the per-session hand-off records live. See fire-session-registry.js
+  // for why a fresh daemon cannot reconstruct them from the session alone.
+  const FIRE_SESSION_REGISTRY_DIR = resolveFireSessionRegistryDir(
+    materializedConductorPathEnv.CONDUCTOR_HOME,
+  );
+
   // Single-quote a value so it can be embedded inside a `bash -c '...'`
   // command. Embedded single-quotes are escaped via the standard `'\\''`
   // sequence.
@@ -1034,7 +1235,7 @@ export function startDaemon(config = {}, deps = {}) {
       .replace(/[^a-zA-Z0-9_-]/g, "_")
       .replace(/^_+|_+$/g, "")
       .slice(0, 32) || "task";
-    return `conductor-fire-${safe}-`;
+    return `${FIRE_TMUX_SESSION_NAMESPACE}${safe}-`;
   }
 
   // Build a unique tmux session name for a Fire spawn.
@@ -1577,7 +1778,14 @@ export function startDaemon(config = {}, deps = {}) {
     // would be misread as "died hard" — reporting every clean finish as
     // KILLED. Staying silent restores the old blind spot for this task only,
     // which is strictly better than manufacturing a wrong cause of death.
-    if (!record.logPath) {
+    //
+    // The one exception is a Fire adopted without a hand-off record. There
+    // the silence is not a blind spot we are preserving but one we would be
+    // creating: nothing else watches an adopted session, so staying quiet
+    // parks the task at `running` forever. Speak, and let the backend
+    // pre-check below stop us from downgrading a status fire already
+    // published for itself.
+    if (!record.logPath && !record.adoptedWithoutMetadata) {
       logError(
         `Cannot classify the end of task ${taskId}: no log path on the active record, so no exit marker exists`,
       );
@@ -1590,7 +1798,7 @@ export function startDaemon(config = {}, deps = {}) {
     // that absence as "no exit marker" would report a green task as KILLED
     // with an invented "killed or OOM" cause. An empty-but-present file is
     // different: the fire really did die before writing anything.
-    if (readLogFileSize(record.logPath) === null) {
+    if (!record.adoptedWithoutMetadata && readLogFileSize(record.logPath) === null) {
       logError(
         `Cannot classify the end of task ${taskId}: log file ${record.logPath} is missing, ` +
           `so the absence of an exit marker proves nothing`,
@@ -1598,7 +1806,9 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
-    const rawTail = readLogTailRaw(record.logPath, { minOffset: record.logStartOffset || 0 });
+    const rawTail = record.adoptedWithoutMetadata
+      ? ""
+      : readLogTailRaw(record.logPath, { minOffset: record.logStartOffset || 0 });
     // Search the file for the marker rather than hoping it is still inside
     // the tail window — see `findFireExitCode` for why a shared log makes the
     // tail unreliable. The tail is still what feeds the human-readable
@@ -1622,8 +1832,9 @@ export function startDaemon(config = {}, deps = {}) {
     // `latest_status_summary` with a word that says nothing. Naming *how* we
     // found out keeps the event worth its row: it tells the next reader that
     // fire never published its own status.
-    const baseSummary =
-      exitCode === null
+    const baseSummary = record.adoptedWithoutMetadata
+      ? "fire tmux session ended; it was adopted from a previous daemon without a hand-off record, so the exit could not be classified"
+      : exitCode === null
         ? "fire tmux session disappeared without an exit marker (killed or OOM)"
         : exitCode === 0
           ? "completed; detected by the daemon after the tmux session ended (fire never reported it)"
@@ -1634,6 +1845,19 @@ export function startDaemon(config = {}, deps = {}) {
     // Ask the backend before overwriting anything: fire normally reports its
     // own terminal status and we must not downgrade a success.
     const backendStatus = await fetchBackendTaskStatus(taskId);
+    // For a record adopted without metadata there is no exit marker to read,
+    // so the verdict below is unconditionally KILLED and this probe is the
+    // ONLY thing standing between a task that finished cleanly and a
+    // fabricated failure. `fetchBackendTaskStatus` returns null both for "not
+    // terminal" and for "could not ask", so a backend blip during a daemon
+    // upgrade would mark a green task killed. Require a real answer.
+    if (!backendStatus && record.adoptedWithoutMetadata) {
+      logError(
+        `Cannot classify the end of adopted task ${taskId}: the backend did not answer, ` +
+          `and without a hand-off record its exit code is unknowable. Staying silent.`,
+      );
+      return;
+    }
     if (backendStatus && TERMINAL_BACKEND_TASK_STATUSES.has(backendStatus)) {
       log(
         `Tmux session ${record.tmuxSession} for task ${taskId} ended; backend already ${backendStatus}, no report needed`,
@@ -1748,6 +1972,7 @@ export function startDaemon(config = {}, deps = {}) {
           record.stopForceKillTimer = null;
         }
         activeTaskProcesses.delete(taskId);
+        forgetFireSessionRecord(record);
         // Report *after* dropping the local entry so a slow backend round
         // trip can't make a concurrent stop_task wait on us.
         await reportDeadTmuxSessionStatus(taskId, record);
@@ -1779,22 +2004,27 @@ export function startDaemon(config = {}, deps = {}) {
     }
   }
 
-  // List every tmux session name visible to the current user. Returns `[]`
-  // on any spawn error, non-zero exit, or timeout (e.g. tmux not available
-  // or the server not running). Subject to TMUX_PROBE_TIMEOUT_MS.
+  // List every tmux session name visible to the current user.
+  //
+  // Returns `{ sessions, conclusive }`. The flag is not decoration: "tmux says
+  // there are no sessions" and "we could not ask tmux" are the same empty
+  // array, and callers that kill on the strength of an empty list would turn
+  // one flaky probe into a mass kill of live Fires — the very regression the
+  // adoption path exists to prevent. `probeTmuxSession` draws the same
+  // distinction for the same reason. Subject to TMUX_PROBE_TIMEOUT_MS.
   function listAllTmuxSessions() {
     return new Promise((resolve) => {
       let settled = false;
       let stdout = "";
       let timer = null;
-      const settle = (lines) => {
+      const settle = (lines, conclusive) => {
         if (settled) return;
         settled = true;
         if (timer) {
           clearTimeout(timer);
           timer = null;
         }
-        resolve(lines);
+        resolve({ sessions: lines, conclusive });
       };
       try {
         const probe = spawnFn("tmux", ["list-sessions", "-F", "#{session_name}"], {
@@ -1812,14 +2042,16 @@ export function startDaemon(config = {}, deps = {}) {
                 .split("\n")
                 .map((s) => s.trim())
                 .filter(Boolean),
+              true,
             );
           } else {
-            // Non-zero exit usually means "no server running" or "no
-            // sessions" — both fine, just return empty.
-            settle([]);
+            // Non-zero exit means "no server running" / "no sessions". tmux
+            // answered, so this is a real, conclusive empty list.
+            settle([], true);
           }
         });
-        probe.on("error", () => settle([]));
+        // Could not run tmux at all — no information either way.
+        probe.on("error", () => settle([], false));
         timer = setTimeout(() => {
           try {
             if (typeof probe.kill === "function") {
@@ -1829,13 +2061,13 @@ export function startDaemon(config = {}, deps = {}) {
             // ignore; we already settled
           }
           logError(`tmux list-sessions probe timed out after ${TMUX_PROBE_TIMEOUT_MS}ms`);
-          settle([]);
+          settle([], false);
         }, TMUX_PROBE_TIMEOUT_MS);
         if (typeof timer.unref === "function") {
           timer.unref();
         }
       } catch {
-        settle([]);
+        settle([], false);
       }
     });
   }
@@ -1850,17 +2082,288 @@ export function startDaemon(config = {}, deps = {}) {
   async function killTmuxSessionsForDeletedTask(taskId) {
     if (!FIRE_TMUX_MODE_ACTIVE || !taskId) return 0;
     const prefix = buildFireTmuxSessionPrefix(taskId);
-    const sessions = await listAllTmuxSessions();
+    const { sessions } = await listAllTmuxSessions();
     let killed = 0;
     for (const name of sessions) {
       if (name.startsWith(prefix)) {
         log(`Killing orphaned tmux session ${name} for deleted task ${taskId}`);
         killFireTmuxSession(name);
+        forgetFireSessionRecord({ tmuxSession: name });
         killed += 1;
       }
     }
     return killed;
   }
+
+  // --- tmux Fire hand-off across daemon restarts ---------------------------
+  //
+  // Shutdown in tmux mode deliberately leaves Fires running, but a fresh
+  // daemon starts with an empty `activeTaskProcesses` by definition. Both
+  // stale-task sweeps decide "this task is dead" from that map alone, so
+  // without the adoption path below every survivor of the hand-off is
+  // PATCHed to `killed` seconds after the new daemon connects — destroying
+  // the exact work the hand-off exists to preserve. Regression history:
+  // 2026-07-23, 2026-07-31, 2026-08-31.
+
+  // Persist what a successor daemon needs to adopt this session. Best-effort:
+  // failing here costs post-restart fidelity, never the running Fire.
+  function rememberFireSessionRecord(taskId, record) {
+    if (!FIRE_TMUX_MODE_ACTIVE || !record?.tmuxSession) return;
+    try {
+      writeFireSessionRecord(FIRE_SESSION_REGISTRY_DIR, {
+        taskId,
+        projectId: record.projectId,
+        tmuxSession: record.tmuxSession,
+        logPath: record.logPath,
+        logStartOffset: record.logStartOffset,
+        exitMarkerToken: record.exitMarkerToken,
+        spawnedAtMs: record.spawnedAtMs,
+        daemonName: AGENT_NAME,
+      });
+    } catch (error) {
+      logError(
+        `Failed to persist tmux hand-off record for task ${taskId}: ${error?.message || error}`,
+      );
+    }
+  }
+
+  // Drop the hand-off record once the session it describes is provably gone.
+  // `pruneFireSessionRecords` at startup is the backstop for the paths that
+  // never get to run (SIGKILL, power loss).
+  function forgetFireSessionRecord(record) {
+    if (!record?.tmuxSession) return;
+    try {
+      deleteFireSessionRecord(FIRE_SESSION_REGISTRY_DIR, record.tmuxSession);
+    } catch {
+      // best effort; the startup prune will collect it
+    }
+  }
+
+  function readFireSessionRecordSafe(sessionName) {
+    try {
+      return readFireSessionRecord(FIRE_SESSION_REGISTRY_DIR, sessionName);
+    } catch {
+      return null;
+    }
+  }
+
+  // A session can outlive the Fire inside it (a wrapper shell that never
+  // exited, a pane held open by `remain-on-exit`). Adopting one of those is
+  // worse than killing it: the reaper only ever speaks when a session
+  // disappears, so the task would sit at `running` with nobody left to report
+  // its death. The hand-off record's exit marker is the only evidence that
+  // distinguishes the two, which is why this can only be checked for sessions
+  // we have a record for. Returns the fire's exit code, or null when it is
+  // still running (or when we cannot tell).
+  function readAdoptedFireExitCode(sidecar) {
+    if (!sidecar?.logPath || !sidecar?.exitMarkerToken) return null;
+    return findFireExitCode(sidecar.logPath, {
+      minOffset: sidecar.logStartOffset,
+      markerToken: sidecar.exitMarkerToken,
+    });
+  }
+
+  // `FIRE_TMUX_MODE_ACTIVE` is a one-shot startup snapshot (`tmux -V` via
+  // spawnSync). If that probe failed transiently — fork pressure, a PATH blip
+  // — this process spends its ENTIRE life believing tmux is absent, so both
+  // stale sweeps would skip the tmux lookup entirely and kill every Fire the
+  // previous daemon left in a tmux server that is running perfectly well.
+  // That is the same mass kill by a different door.
+  //
+  // Re-probe before killing. We deliberately do NOT adopt in this state: this
+  // process spawns fires directly and never started the tmux liveness reaper,
+  // so an adopted record would have no watcher. Declining to destroy is
+  // enough — the next restart with a healthy probe adopts them properly.
+  function tmuxFiresMayExistUnseen() {
+    return FIRE_TMUX_MODE_ENABLED && !FIRE_TMUX_MODE_ACTIVE && isTmuxAvailable();
+  }
+
+  // Sessions already identified as orphaned shells and killed. `tmux
+  // kill-session` is asynchronous, so a sweep running moments later still
+  // sees the name in `list-sessions` — and by then the hand-off record is
+  // gone, which would make it look like a live Fire with no metadata and put
+  // the task straight back to `running`.
+  const retiredOrphanFireSessions = new Set();
+
+  // Shared by both adoption entry points: kill the shell, drop the record and
+  // report "not alive" so the caller falls through to its normal dead-task
+  // handling.
+  function retireOrphanedFireSession(sessionName, taskId, exitCode) {
+    retiredOrphanFireSessions.add(sessionName);
+    log(
+      `Tmux session ${sessionName} outlived its Fire for task ${taskId} ` +
+        `(exit marker code=${exitCode}); killing the orphaned shell`,
+    );
+    killFireTmuxSession(sessionName);
+    forgetFireSessionRecord({ tmuxSession: sessionName });
+  }
+
+  // Build an `activeTaskProcesses` entry for a tmux session this daemon did
+  // not spawn. `child` is deliberately absent: the `tmux new-session` client
+  // belonged to the previous daemon and exited long ago.
+  //
+  // This is the one record shape where a truthy `child` does NOT mean "a fire
+  // is running here" — so any code asking that question must go through
+  // `recordHasLiveFire`, never `record.child`. Getting it wrong is not
+  // cosmetic: the restart/create gates read as "nothing running" and spawn a
+  // second fire into a worktree that already has one.
+  function buildAdoptedTmuxRecord({ sessionName, projectId, sidecar }) {
+    return {
+      child: null,
+      projectId: sidecar?.projectId || String(projectId || ""),
+      logPath: sidecar?.logPath || "",
+      logStartOffset: Number(sidecar?.logStartOffset) || 0,
+      exitMarkerToken: sidecar?.exitMarkerToken || "",
+      // Without a record we have no real spawn time. Anchoring at "now" costs
+      // one reaper grace period of delay and is far safer than a 0, which
+      // would make the record instantly reapable.
+      spawnedAtMs: Number(sidecar?.spawnedAtMs) || Date.now(),
+      stopForceKillTimer: null,
+      managedByFireBridge: true,
+      tmuxSession: sessionName,
+      tmuxMode: true,
+      adopted: true,
+      // No record => no logPath and no marker nonce, so the reaper cannot
+      // classify this fire's exit from evidence. Flagged so it reports an
+      // honest KILLED instead of taking the "cannot classify" silent exit,
+      // which would strand the task at `running` with nobody left to speak
+      // for it.
+      adoptedWithoutMetadata: !sidecar,
+    };
+  }
+
+  // Adopt the live tmux Fire belonging to `task`, if there is one. Returns
+  // true when the task must NOT be treated as stale. Called from both kill
+  // paths, which is also the only place a session whose hand-off record is
+  // missing can be adopted at all: the task id is not recoverable from a
+  // session name, but the backend just told us which ids to look for.
+  function adoptLiveTmuxFireForTask(task, sessionNames) {
+    const taskId = String(task?.id || "");
+    if (!taskId) return false;
+    if (activeTaskProcesses.has(taskId) || activePtySessions.has(taskId)) return true;
+    if (!FIRE_TMUX_MODE_ACTIVE) return false;
+    const prefix = buildFireTmuxSessionPrefix(taskId);
+    const candidates = (sessionNames || []).filter(
+      (name) => name.startsWith(prefix) && !retiredOrphanFireSessions.has(name),
+    );
+    if (candidates.length === 0) return false;
+    // Session names truncate the task id to 32 chars, so a record could in
+    // principle have been filed for a different task sharing that prefix.
+    // Trust it only when it names the task we are actually rescuing.
+    const recordFor = (name) => {
+      const stored = readFireSessionRecordSafe(name);
+      return stored && stored.taskId === taskId ? stored : null;
+    };
+    // With more than one candidate (an abandoned session left beside a
+    // respawn) prefer the one we have a record for: adopting blind would pick
+    // by tmux's list order and could watch the wrong session's exit marker.
+    const sessionName = candidates.find((name) => recordFor(name)) || candidates[0];
+    const sidecar = recordFor(sessionName);
+    const exitCode = readAdoptedFireExitCode(sidecar);
+    if (exitCode !== null) {
+      retireOrphanedFireSession(sessionName, taskId, exitCode);
+      return false;
+    }
+    activeTaskProcesses.set(
+      taskId,
+      buildAdoptedTmuxRecord({ sessionName, projectId: task?.project_id, sidecar }),
+    );
+    log(
+      `Task ${taskId} still has a live tmux Fire (session=${sessionName}); adopted instead of killed` +
+        (sidecar ? "" : " — no hand-off record, so its exit can only be classified as killed"),
+    );
+    return true;
+  }
+
+  // Resolves once the startup adoption pass has finished. Both stale sweeps
+  // await it so they can never judge a task before its Fire has had the
+  // chance to be reclaimed.
+  let adoptOrphanedTmuxFiresPromise = null;
+
+  // Startup pass: adopt every Fire session the previous daemon left behind,
+  // then discard hand-off records whose session is gone.
+  async function adoptOrphanedTmuxFires() {
+    if (!FIRE_TMUX_MODE_ACTIVE) return 0;
+    const { sessions, conclusive } = await listAllTmuxSessions();
+    if (!conclusive) {
+      // We could not ask tmux. Adopting nothing is survivable — both stale
+      // sweeps re-probe and adopt whatever they find. Pruning is not: the
+      // prune below deletes every record whose session is absent from this
+      // list, so running it on a blind listing would wipe the
+      // `exitMarkerToken`s of every live Fire on the host, permanently
+      // downgrading them all to `adoptedWithoutMetadata`.
+      logError(
+        "Could not list tmux sessions for Fire adoption; adopting nothing and keeping every hand-off record",
+      );
+      return 0;
+    }
+
+    let adopted = 0;
+    for (const sessionName of sessions) {
+      if (!sessionName.startsWith(FIRE_TMUX_SESSION_NAMESPACE)) continue;
+      if (retiredOrphanFireSessions.has(sessionName)) continue;
+      const sidecar = readFireSessionRecordSafe(sessionName);
+      // No record: we cannot learn the task id from the session name (it is
+      // truncated to 32 chars). Leave it — the kill paths adopt it later,
+      // once the backend supplies the id.
+      if (!sidecar) continue;
+
+      if (pendingTaskStarts.has(sidecar.taskId)) {
+        // A `create_task` for this task is mid-flight and will install its own
+        // record when the spawn completes. Adopting now just gets overwritten
+        // moments later, which is how a session ends up orphaned with its
+        // record still on disk.
+        continue;
+      }
+
+      const tracked = activeTaskProcesses.get(sidecar.taskId);
+      if (tracked) {
+        // A `create_task`/`restart_task` redelivered into the adoption window
+        // can spawn a second session for the same task before we get here.
+        // Keeping both records is the dangerous part: on the NEXT restart
+        // adoption would pick between them by tmux's arbitrary list order and
+        // could end up watching the abandoned session's exit marker while the
+        // live fire's death goes unreported. Drop the loser's record so the
+        // task has exactly one, and say so loudly — two fires in one worktree
+        // is a real problem, just not one we can safely resolve by killing.
+        if (tracked.tmuxSession !== sessionName) {
+          logError(
+            `Task ${sidecar.taskId} has a second tmux session ${sessionName} besides the tracked ` +
+              `${tracked.tmuxSession || "(none)"}; discarding its hand-off record. Two fires may be ` +
+              `sharing one worktree — inspect and kill the stale session manually.`,
+          );
+          forgetFireSessionRecord({ tmuxSession: sessionName });
+        }
+        continue;
+      }
+
+      const exitCode = readAdoptedFireExitCode(sidecar);
+      if (exitCode !== null) {
+        retireOrphanedFireSession(sessionName, sidecar.taskId, exitCode);
+        continue;
+      }
+
+      activeTaskProcesses.set(
+        sidecar.taskId,
+        buildAdoptedTmuxRecord({ sessionName, projectId: sidecar.projectId, sidecar }),
+      );
+      adopted += 1;
+      log(
+        `Adopted tmux Fire task ${sidecar.taskId} (session=${sessionName}) left running by a previous daemon`,
+      );
+    }
+
+    try {
+      pruneFireSessionRecords(FIRE_SESSION_REGISTRY_DIR, sessions);
+    } catch (error) {
+      logError(`Failed to prune tmux hand-off records: ${error?.message || error}`);
+    }
+
+    if (adopted > 0) {
+      log(`Adopted ${adopted} tmux Fire task(s) from a previous daemon`);
+    }
+    return adopted;
+  }
   // -------------------------------------------------------------------------
 
   function buildTaskWorktreeRoot(projectWorkspacePath, worktreeBranch) {
@@ -2453,6 +2956,79 @@ export function startDaemon(config = {}, deps = {}) {
     });
   }
 
+  // In-flight worktree preparations keyed on the on-disk root. Group members
+  // (worker + reviewers) start almost simultaneously and would otherwise all
+  // pass the `.git` existence check below and race on `git worktree add -b`
+  // for the same branch: one wins and the losers fail with
+  // "Failed to prepare git worktree". Serializing per root also benefits the
+  // pre-existing fork/branch sharing path.
+  const taskWorktreePreparations = new Map();
+
+  // Readiness marker, written by the owner only after the worktree is FULLY
+  // prepared. `.git` alone is not a readiness signal: it appears the moment
+  // `git worktree add` returns, while submodules and symlinks are still
+  // pending. An owner that dies in between (e.g. submodule sync hits its
+  // timeout) would otherwise leave `.git` behind and let reuse-only members
+  // walk into a half-built directory.
+  //
+  // It lives NEXT TO the worktree, not inside it: an untracked file inside
+  // would make `git status --porcelain` report the worktree as dirty and block
+  // non-forced cleanup.
+  function taskWorktreeReadyMarkerPath(worktreeRoot) {
+    return `${worktreeRoot}.ready`;
+  }
+
+  function removeTaskWorktreeReadyMarker(worktreeRoot) {
+    const markerPath = taskWorktreeReadyMarkerPath(worktreeRoot);
+    if (!existsSyncFn(markerPath)) {
+      return;
+    }
+    try {
+      unlinkSyncFn(markerPath);
+    } catch (error) {
+      if (error?.code !== "ENOENT") {
+        logError(
+          `[worktree] failed to clear ready marker for ${worktreeRoot}: ${error?.message || error}`,
+        );
+      }
+    }
+  }
+
+  // Both must hold. Requiring `.git` too means a marker left behind by a
+  // worktree that was removed outside our cleanup path cannot fake readiness.
+  function isTaskWorktreeReady(worktreeRoot, gitMarkerPath) {
+    return (
+      existsSyncFn(gitMarkerPath) &&
+      existsSyncFn(taskWorktreeReadyMarkerPath(worktreeRoot))
+    );
+  }
+
+  async function waitForSharedTaskWorktree({ taskId, worktreeRoot, gitMarkerPath }) {
+    const deadline = Date.now() + TASK_WORKTREE_REUSE_WAIT_TIMEOUT_MS;
+    for (;;) {
+      // When the owner is preparing in this same daemon process we await the
+      // whole preparation (worktree add + submodules + symlinks). Polling the
+      // marker additionally covers an owner that already finished, or one
+      // running in a different process.
+      const inflight = taskWorktreePreparations.get(worktreeRoot);
+      if (inflight) {
+        await inflight;
+      }
+      if (isTaskWorktreeReady(worktreeRoot, gitMarkerPath)) {
+        return;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Timed out waiting for shared git worktree ${worktreeRoot} for ${taskId}. ` +
+            `Its owner task may have failed midway through preparation.`,
+        );
+      }
+      await new Promise((resolve) =>
+        setTimeout(resolve, TASK_WORKTREE_REUSE_POLL_INTERVAL_MS),
+      );
+    }
+  }
+
   async function ensureTaskWorktree({ taskId, projectId, launchConfig }) {
     const worktreeConfig = parseTaskWorktreeLaunchConfig(launchConfig);
     if (!worktreeConfig) {
@@ -2465,7 +3041,50 @@ export function startDaemon(config = {}, deps = {}) {
     );
     const finalCwd = resolveTaskWorktreeCwd(worktreeRoot, worktreeConfig.projectRelativePath);
     const gitMarkerPath = path.join(worktreeRoot, ".git");
+
+    if (worktreeConfig.worktreeReuseOnly) {
+      await waitForSharedTaskWorktree({ taskId, worktreeRoot, gitMarkerPath });
+      mkdirSyncFn(finalCwd, { recursive: true });
+      return finalCwd;
+    }
+
+    const inflight = taskWorktreePreparations.get(worktreeRoot);
+    if (inflight) {
+      await inflight;
+    }
+    // Prepare when we are the first owner here, or when the preparation we
+    // waited on did not leave a fully-prepared worktree (then we take over).
+    if (!inflight || !isTaskWorktreeReady(worktreeRoot, gitMarkerPath)) {
+      const preparation = prepareTaskWorktree({
+        taskId,
+        worktreeConfig,
+        worktreeRoot,
+        gitMarkerPath,
+        finalCwd,
+      });
+      // Waiters must never inherit our rejection; they re-check `.git` instead.
+      taskWorktreePreparations.set(worktreeRoot, preparation.catch(() => {}));
+      try {
+        await preparation;
+      } finally {
+        taskWorktreePreparations.delete(worktreeRoot);
+      }
+    }
+    return finalCwd;
+  }
+
+  async function prepareTaskWorktree({
+    taskId,
+    worktreeConfig,
+    worktreeRoot,
+    gitMarkerPath,
+    finalCwd,
+  }) {
     if (!existsSyncFn(gitMarkerPath)) {
+      // A worktree removed outside our cleanup path can leave a stale marker
+      // behind. Clear it before recreating, so a reuse-only member cannot read
+      // "ready" while `git worktree add` is still running.
+      removeTaskWorktreeReadyMarker(worktreeRoot);
       const { syncBranch } = readProjectWorktreeSettings(worktreeConfig.projectWorkspacePath);
       if (syncBranch) {
         try {
@@ -2563,7 +3182,8 @@ export function startDaemon(config = {}, deps = {}) {
       projectWorkspacePath: worktreeConfig.projectWorkspacePath,
       finalCwd,
     });
-    return finalCwd;
+    // Publish readiness last: every step above has to have succeeded.
+    writeFileSyncFn(taskWorktreeReadyMarkerPath(worktreeRoot), "");
   }
 
   const RTC_MODULE_CANDIDATES = resolveRtcModuleCandidates(process.env.CONDUCTOR_PTY_RTC_MODULES);
@@ -2596,6 +3216,17 @@ export function startDaemon(config = {}, deps = {}) {
     process.env.CONDUCTOR_WORKTREE_SUBMODULE_SYNC_TIMEOUT_MS,
     120_000,
   );
+  // A reuse-only member waits for the owner to create the shared worktree.
+  // The bound has to cover a cold clone's submodule sync, hence the generous
+  // default; it only ever elapses when the owner never starts or hard-fails.
+  const TASK_WORKTREE_REUSE_WAIT_TIMEOUT_MS = parsePositiveInt(
+    process.env.CONDUCTOR_WORKTREE_REUSE_WAIT_TIMEOUT_MS,
+    180_000,
+  );
+  const TASK_WORKTREE_REUSE_POLL_INTERVAL_MS = parsePositiveInt(
+    process.env.CONDUCTOR_WORKTREE_REUSE_POLL_INTERVAL_MS,
+    250,
+  );
   const SHUTDOWN_STATUS_REPORT_TIMEOUT_MS = parsePositiveInt(
     process.env.CONDUCTOR_SHUTDOWN_STATUS_REPORT_TIMEOUT_MS,
     1000,
@@ -2637,36 +3268,7 @@ export function startDaemon(config = {}, deps = {}) {
     DEFAULT_TERMINAL_RESUME_SNAPSHOT_MAX_BYTES,
   );
 
-  const readLockState = () => {
-    const raw = String(readFileSyncFn(LOCK_FILE, "utf-8") || "").trim();
-    if (!raw) {
-      return null;
-    }
-
-    const pid = Number.parseInt(raw, 10);
-    if (!Number.isNaN(pid) && pid > 0) {
-      return {
-        pid,
-        handoffFromPid: null,
-        handoffToken: null,
-        handoffExpiresAt: null,
-      };
-    }
-
-    try {
-      const parsed = JSON.parse(raw);
-      const parsedPid = normalizePositiveInt(parsed?.pid, null);
-      const parsedHandoffFromPid = normalizePositiveInt(parsed?.handoff_from_pid, null);
-      return {
-        pid: parsedPid ?? parsedHandoffFromPid,
-        handoffFromPid: parsedHandoffFromPid,
-        handoffToken: normalizeOptionalString(parsed?.handoff_token),
-        handoffExpiresAt: normalizePositiveInt(parsed?.handoff_expires_at, null),
-      };
-    } catch {
-      return null;
-    }
-  };
+  const readLockState = () => parseDaemonLockState(readFileSyncFn(LOCK_FILE, "utf-8"));
 
   const hasMatchingLockHandoff = (lockState) => {
     if (!lockState || !lockHandoffToken || !lockHandoffFromPid) {
@@ -2705,7 +3307,7 @@ export function startDaemon(config = {}, deps = {}) {
     return exitAndReturn(1);
   }
 
-  const LOCK_FILE = path.join(WORKSPACE_ROOT, "daemon.pid");
+  const LOCK_FILE = path.join(WORKSPACE_ROOT, DAEMON_LOCK_FILE_NAME);
   try {
     if (skipPidLockCheck) {
       log("CONDUCTOR_TUI_DEBUG enabled; skipping daemon PID lock enforcement");
@@ -2722,6 +3324,21 @@ export function startDaemon(config = {}, deps = {}) {
               const alive = isProcessAlive(pid);
               if (alive) {
                 if (config.FORCE) {
+                  const forceRefusal = describeForceRestartRefusal({
+                    lockState,
+                    identity: daemonInstanceIdentity,
+                    lockFile: LOCK_FILE,
+                    env: process.env,
+                  });
+                  if (forceRefusal) {
+                    logError(forceRefusal);
+                    return exitAndReturn(1);
+                  }
+                  if (compareDaemonLockIdentity(lockState, daemonInstanceIdentity) === "unknown") {
+                    log(
+                      `${FORCE_KILL_UNKNOWN_OWNER_ENV_VAR} is set: stopping PID ${pid} even though the lock file carries no instance identity`,
+                    );
+                  }
                   log(`Force enabled: stopping existing daemon PID ${pid}`);
                   let alreadyExited = false;
                   try {
@@ -2763,7 +3380,9 @@ export function startDaemon(config = {}, deps = {}) {
                     unlinkSyncFn(LOCK_FILE);
                   }
                 } else {
-                  logError(`Daemon already running with PID ${pid}`);
+                  logError(
+                    `Daemon already running with PID ${pid} — ${describeDaemonLockOwner(lockState)}. Use --force to restart it.`,
+                  );
                   return exitAndReturn(1);
                 }
               } else {
@@ -2784,7 +3403,10 @@ export function startDaemon(config = {}, deps = {}) {
           unlinkSyncFn(LOCK_FILE);
         }
       }
-      writeFileSyncFn(LOCK_FILE, process.pid.toString());
+      writeFileSyncFn(
+        LOCK_FILE,
+        serializeDaemonLock({ pid: process.pid, identity: daemonInstanceIdentity }),
+      );
     }
   } catch (err) {
     logError("Failed to acquire lock:", err);
@@ -2811,13 +3433,15 @@ export function startDaemon(config = {}, deps = {}) {
     if (skipPidLockCheck) {
       return;
     }
+    // Keeps the instance identity attached while the handoff window is open so
+    // an unrelated instance racing a `--force` during a restart still sees who
+    // owns the lock.
     writeFileSyncFn(
       LOCK_FILE,
-      JSON.stringify({
+      serializeDaemonLock({
         pid: handoffFromPid,
-        handoff_from_pid: handoffFromPid,
-        handoff_token: handoffToken,
-        handoff_expires_at: handoffExpiresAt,
+        identity: daemonInstanceIdentity,
+        handoff: { handoffFromPid, handoffToken, handoffExpiresAt },
       }),
     );
   };
@@ -2895,6 +3519,18 @@ export function startDaemon(config = {}, deps = {}) {
     removeProcessListener("unhandledRejection", onUnhandledRejection);
   };
 
+  // RFC 0035: never leave guest daemons orphaned. They are children of this
+  // process, so without this they would survive the host daemon and keep
+  // serving a share the owner believes is stopped.
+  const stopGuestsOnExit = () => {
+    try {
+      stopAllGuestDaemons("host daemon exiting");
+    } catch {
+      // best effort during shutdown
+    }
+  };
+  process.on("exit", stopGuestsOnExit);
+
   process.on("exit", cleanupLock);
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
@@ -3022,11 +3658,13 @@ export function startDaemon(config = {}, deps = {}) {
   };
   const advertisedCapabilities = [
     "project_path_validation",
+    "project_path_create",
     "project_agents_registry",
     "restart_daemon",
     "refresh_session_inplace",
     "task_attachments_v1",
     CUSTOM_COMMANDS_CAPABILITY,
+    UPDATE_DAEMON_CAPABILITY,
   ];
   if (remoteExecEnabled) {
     advertisedCapabilities.push(REMOTE_EXEC_CAPABILITY);
@@ -3036,11 +3674,67 @@ export function startDaemon(config = {}, deps = {}) {
   if (ptyTaskCapabilityEnabled) {
     advertisedCapabilities.push("pty_task", "terminal_snapshot");
   }
-  if (advertisedCapabilities.length > 0) {
-    extraHeaders["x-conductor-capabilities"] = advertisedCapabilities.join(",");
+  // RFC 0035: strip capabilities a guest must never offer. `ai_manager` stays
+  // advertised on purpose -- the grantee needs to see how much AI quota is left
+  // on the borrowed machine -- but its `switch_account` action is refused at
+  // dispatch, because that one rewrites `~/.codex/auth.json` and would change
+  // the machine owner's own active account.
+  const effectiveCapabilities = IS_GUEST_DAEMON
+    ? filterGuestCapabilities(advertisedCapabilities)
+    : advertisedCapabilities;
+  if (IS_GUEST_DAEMON) {
+    log(
+      `[guest] Running as a shared guest daemon; capabilities=${effectiveCapabilities.join(",")}` +
+        (GUEST_ROOT ? `, root=${GUEST_ROOT}` : "")
+    );
+    // If the host daemon is SIGKILLed, nothing else would stop this process.
+    startOrphanWatchdog({
+      onOrphaned: () => {
+        logError("[guest] Host daemon is gone; shutting down to avoid an orphaned share");
+        exitAndReturn(0);
+      },
+    });
+  }
+  if (effectiveCapabilities.length > 0) {
+    extraHeaders["x-conductor-capabilities"] = effectiveCapabilities.join(",");
+  }
+  // Built-in "Update Daemon" is a global `npm install -g` followed by a
+  // restart. Refuse up front — with a reason the UI can show — wherever that
+  // is the wrong way to upgrade this install.
+  function resolveDaemonUpdateRefusal() {
+    if (IS_GUEST_DAEMON) {
+      return "a shared guest daemon cannot install a new CLI version on the host machine";
+    }
+    if (installMethod === "homebrew") {
+      return `conductor was installed with Homebrew; run \`${buildUpgradeCommand({ env: process.env })}\` on ${AGENT_NAME} instead`;
+    }
+    if (!autoUpdateSupportedInstall) {
+      return `conductor runs from ${installedPackageRoot}, which is not a global install; upgrade it the same way it was installed`;
+    }
+    return null;
   }
-  const aiManagerHandlers = createAiManagerHandlers({ configPath: effectiveConfigPath });
+
+  const aiManagerHandlers = (deps.createAiManagerHandlers || createAiManagerHandlers)({ configPath: effectiveConfigPath });
   const customCommandHandlers = createCustomCommandHandlers({ configPath: effectiveConfigPath });
+  const daemonUpdatePaths = resolveDaemonUpdatePaths(process.env);
+  const daemonUpdateHandlers = createDaemonUpdateHandlers({
+    statusPath: daemonUpdatePaths.statusPath,
+    logPath: daemonUpdatePaths.logPath,
+    updaterScript: DAEMON_UPDATE_SCRIPT_PATH,
+    refuseReason: resolveDaemonUpdateRefusal(),
+    env: { ...process.env, ...materializedConductorPathEnv },
+    updaterParams: {
+      packageRoot: installedPackageRoot,
+      launcherScript: restartLauncherScript,
+      launcherArgs: restartLauncherArgs,
+      versionCheckScript,
+      versionCheckArgs,
+      daemonPid: process.pid,
+      lockFile: LOCK_FILE,
+      daemonLogPath: resolveDaemonLogPaths().logPath,
+      currentVersion: cliVersion,
+    },
+  });
   const remoteExecHandlers = remoteExecEnabled
     ? createRemoteExecHandlers({ defaultWorkspace: homeDir })
     : null;
@@ -3169,10 +3863,26 @@ export function startDaemon(config = {}, deps = {}) {
     log(`Daemon Name: ${AGENT_NAME}`);
     log(`Supported Backends: ${SUPPORTED_BACKENDS.join(", ")}`);
 
+    // Reclaim the Fires the previous daemon left running. Started here rather
+    // than awaited: connecting must not wait on a wedged tmux server. Both
+    // stale sweeps await `adoptOrphanedTmuxFiresPromise` before judging
+    // anything, which is the ordering that actually matters — they decide
+    // liveness from `activeTaskProcesses`, so a survivor not yet adopted when
+    // they run is a survivor that gets killed.
+    adoptOrphanedTmuxFiresPromise = adoptOrphanedTmuxFires().catch((error) => {
+      logError(`adoptOrphanedTmuxFires failed: ${error?.message || error}`);
+    });
+
     client.connect().catch((err) => {
       logError(`Failed to connect: ${err}`);
     });
 
+    // RFC 0035: keep one child daemon per accepted share. A guest never
+    // supervises anything itself, or a share chain could nest.
+    if (!IS_GUEST_DAEMON) {
+      void reconcileGuestDaemons();
+    }
+
     if (!AUTO_UPDATE_ENABLED && autoUpdateSupportedInstall === false) {
       if (installMethod === "homebrew") {
         log(`[auto-update] Disabled for Homebrew install; use ${buildUpgradeCommand({ env: process.env })}`);
@@ -3183,6 +3893,9 @@ export function startDaemon(config = {}, deps = {}) {
 
     const runMaintenanceTick = async () => {
       void runDaemonWatchdog();
+      if (!IS_GUEST_DAEMON) {
+        void reconcileGuestDaemons();
+      }
       try {
         await checkForUpdate();
       } catch {
@@ -3683,6 +4396,165 @@ export function startDaemon(config = {}, deps = {}) {
     await restartDaemonProcess("auto-update");
   }
 
+  // ---------------------------------------------------------------------
+  // RFC 0035: guest daemon supervision.
+  //
+  // For each share the backend reports as active, run one child
+  // `conductor daemon` that authenticates as the grantee. The child is an
+  // ordinary daemon in every respect; what makes it a guest is its isolated
+  // CONDUCTOR_HOME/CONDUCTOR_WS and the grantee's scoped token.
+  // ---------------------------------------------------------------------
+  /** shareId -> { child, guestHost, restartTimer, stopping } */
+  const guestDaemons = new Map();
+  // Failure counts must outlive the entry they describe. The restart path
+  // deletes the entry and re-asks the backend (so a share revoked during
+  // backoff stays dead), which means a per-entry counter resets to 0 on every
+  // respawn and the exponential backoff degrades into a permanent 10s loop.
+  const guestFailureCounts = new Map();
+  let guestReconcileInFlight = false;
+
+  function stopGuestDaemon(shareId, reason) {
+    const entry = guestDaemons.get(shareId);
+    if (!entry) return;
+    entry.stopping = true;
+    if (entry.restartTimer) clearTimeout(entry.restartTimer);
+    guestDaemons.delete(shareId);
+    guestFailureCounts.delete(shareId);
+    if (entry.child && entry.child.exitCode === null && !entry.child.killed) {
+      log(`[guest] Stopping guest ${entry.guestHost} (${reason})`);
+      try {
+        entry.child.kill("SIGTERM");
+      } catch {
+        // already gone
+      }
+    }
+  }
+
+  function stopAllGuestDaemons(reason) {
+    for (const shareId of [...guestDaemons.keys()]) {
+      stopGuestDaemon(shareId, reason);
+    }
+  }
+
+  function spawnGuestDaemon(share) {
+    const paths = resolveGuestPaths(share.id, share.workspaceRoot, homeDir);
+    try {
+      writeGuestConfig(
+        paths,
+        buildGuestConfigYaml({
+          agentToken: share.agentToken,
+          backendUrl: BACKEND_HTTP,
+          guestHost: share.guestHost,
+          workspace: paths.workspace,
+          allowCliList: RAW_ALLOW_CLI_LIST,
+        })
+      );
+    } catch (error) {
+      logError(`[guest] Failed to materialize config for ${share.guestHost}: ${error?.message || error}`);
+      return;
+    }
+
+    const env = buildGuestEnv(process.env, paths, {
+      shareId: share.id,
+      explicitRoot: Boolean(share.workspaceRoot),
+    });
+    const child = spawn(
+      process.execPath,
+      [DAEMON_LAUNCHER_PATH, "--config-file", paths.configPath],
+      { env, stdio: "ignore", detached: false }
+    );
+
+    const entry = {
+      child,
+      guestHost: share.guestHost,
+      restartTimer: null,
+      stopping: false,
+    };
+    guestDaemons.set(share.id, entry);
+    log(`[guest] Started guest ${share.guestHost} for ${share.granteeLabel || "grantee"} (pid=${child.pid})`);
+
+    child.on("exit", (code, signal) => {
+      const current = guestDaemons.get(share.id);
+      // Either we asked it to stop, or a newer entry already replaced it.
+      if (!current || current.child !== child || current.stopping) return;
+      const failures = (guestFailureCounts.get(share.id) || 0) + 1;
+      guestFailureCounts.set(share.id, failures);
+      const delay = nextRestartDelayMs(failures);
+      log(
+        `[guest] Guest ${share.guestHost} exited (code=${code}, signal=${signal}); ` +
+          `restarting in ${Math.round(delay / 1000)}s (failure ${failures})`
+      );
+      current.restartTimer = setTimeout(() => {
+        // Don't resurrect from a stale timer: re-check with the backend
+        // instead, so a share revoked while we were backing off stays dead.
+        guestDaemons.delete(share.id);
+        void reconcileGuestDaemons();
+      }, delay);
+      if (typeof current.restartTimer.unref === "function") current.restartTimer.unref();
+    });
+
+    child.on("error", (error) => {
+      // Node emits `error` without `exit` for e.g. ENOENT. Without this the
+      // entry would sit in the map forever: reconcile counts it as running, so
+      // it is never retried and never started.
+      logError(`[guest] Guest ${share.guestHost} failed to spawn: ${error?.message || error}`);
+      const current = guestDaemons.get(share.id);
+      if (!current || current.child !== child || current.stopping) return;
+      const failures = (guestFailureCounts.get(share.id) || 0) + 1;
+      guestFailureCounts.set(share.id, failures);
+      guestDaemons.delete(share.id);
+      const timer = setTimeout(() => void reconcileGuestDaemons(), nextRestartDelayMs(failures));
+      if (typeof timer.unref === "function") timer.unref();
+    });
+  }
+
+  async function fetchActiveShares() {
+    const url = `${BACKEND_HTTP}/api/daemon-shares/mine?daemonHost=${encodeURIComponent(AGENT_NAME)}`;
+    // Without a deadline a hung backend pins `guestReconcileInFlight` for
+    // undici's 300s default, and nothing else clears it -- the supervisor goes
+    // silently deaf for five minutes.
+    const response = await fetch(url, {
+      headers: { Authorization: `Bearer ${AGENT_TOKEN}` },
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) {
+      // A backend that predates this feature returns 404; that is not an error
+      // worth logging on every maintenance tick.
+      if (response.status === 404) return null;
+      throw new Error(`HTTP ${response.status}`);
+    }
+    const body = await response.json();
+    return Array.isArray(body?.shares) ? body.shares : [];
+  }
+
+  async function reconcileGuestDaemons() {
+    if (guestReconcileInFlight || daemonShuttingDown) return;
+    guestReconcileInFlight = true;
+    try {
+      const shares = await fetchActiveShares();
+      if (shares === null) return;
+      const running = new Set(guestDaemons.keys());
+      const { start, stop, skipped } = reconcileGuests(shares, running, MAX_GUEST_DAEMONS);
+      for (const shareId of stop) {
+        stopGuestDaemon(shareId, "share no longer active");
+      }
+      for (const share of start) {
+        spawnGuestDaemon(share);
+      }
+      if (skipped > 0) {
+        // Never drop guests silently -- a share that looks accepted in the UI
+        // but never runs is the hardest kind of bug to report.
+        log(
+          `[guest] ${skipped} share(s) not started: at the ${MAX_GUEST_DAEMONS}-guest limit for this daemon`
+        );
+      }
+    } catch (error) {
+      logError(`[guest] Failed to reconcile guest daemons: ${error?.message || error}`);
+    } finally {
+      guestReconcileInFlight = false;
+    }
+  }
+
   async function handleRestartDaemon(payload) {
     const requestId = payload?.request_id ? String(payload.request_id) : "";
     const targetVersionRaw = payload?.target_version
@@ -3708,6 +4580,22 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: a versioned restart runs a *global* `npm install -g`, which
+    // would swap the CLI binary out from under the machine owner's own daemon
+    // and every one of their fire processes. A guest may restart itself, but
+    // it may not change the machine's installed version.
+    if (IS_GUEST_DAEMON && !isGuestRestartAllowed(payload)) {
+      log(
+        `[restart_daemon] Refused (${requestId}): guest daemons cannot install version ${targetVersionRaw}`
+      );
+      sendAgentCommandAck({
+        requestId,
+        eventType: "restart_daemon",
+        accepted: false,
+      }).catch(() => {});
+      return;
+    }
+
     autoUpdateInProgress = true;
     try {
       log(
@@ -3768,6 +4656,8 @@ export function startDaemon(config = {}, deps = {}) {
 
   async function recoverStaleTasks() {
     try {
+      // Never judge a task before startup adoption has had its say.
+      await adoptOrphanedTmuxFiresPromise;
       const response = await fetchFn(`${BACKEND_HTTP}/api/tasks`, {
         method: "GET",
         headers: {
@@ -3800,8 +4690,48 @@ export function startDaemon(config = {}, deps = {}) {
         return;
       }
 
+      // Startup is the main case the tmux hand-off exists for: the previous
+      // daemon deliberately left its Fires running and this fresh process has
+      // an empty `activeTaskProcesses` by definition, so "not in memory"
+      // proves nothing here. `adoptOrphanedTmuxFires` has already claimed
+      // every session with a hand-off record; this second pass catches the
+      // ones without a record, which only become identifiable now that the
+      // backend has told us which task ids to look for.
+      if (tmuxFiresMayExistUnseen()) {
+        logError(
+          `tmux is reachable but this daemon started without tmux mode active; skipping stale ` +
+            `recovery for ${staleTasks.length} task(s) rather than killing Fires it cannot see`,
+        );
+        return;
+      }
+      const tmuxSessions = FIRE_TMUX_MODE_ACTIVE ? await listAllTmuxSessions() : null;
+      if (tmuxSessions && !tmuxSessions.conclusive) {
+        // An unanswerable `tmux list-sessions` is not evidence that nothing is
+        // running — and this is the one sweep with no second chance, since it
+        // runs once per process. Killing on a blind probe is precisely how a
+        // single wedged tmux server reproduces the 2026-08-31 mass kill.
+        logError(
+          `Could not list tmux sessions; skipping stale recovery for ${staleTasks.length} task(s) rather than killing on a blind probe`,
+        );
+        return;
+      }
+      const deadTasks = staleTasks.filter((task) => {
+        // A spawn already in flight has no record yet either; killing it
+        // would shoot down a Fire this daemon is in the middle of starting.
+        if (pendingTaskStarts.has(String(task?.id || ""))) return false;
+        return !adoptLiveTmuxFireForTask(task, tmuxSessions?.sessions || []);
+      });
+
+      if (deadTasks.length === 0) {
+        return;
+      }
+
+      // Count what the backend actually accepted, not what we attempted: a
+      // 409/500 leaves the task running, and reporting it as recovered has
+      // repeatedly sent readers of this log looking in the wrong place.
+      let killedCount = 0;
       await Promise.all(
-        staleTasks.map(async (task) => {
+        deadTasks.map(async (task) => {
           const taskId = task?.id;
           if (!taskId) return;
           const patchResp = await fetchFn(`${BACKEND_HTTP}/api/tasks/${taskId}`, {
@@ -3816,12 +4746,13 @@ export function startDaemon(config = {}, deps = {}) {
           if (!patchResp.ok) {
             logError(`Failed to mark stale task ${taskId} as killed: HTTP ${patchResp.status}`);
           } else {
+            killedCount += 1;
             markBackendHttpSuccess();
           }
         }),
       );
 
-      log(`Recovered ${staleTasks.length} stale task(s) to killed`);
+      log(`Recovered ${killedCount}/${deadTasks.length} stale task(s) to killed`);
     } catch (error) {
       logError(`recoverStaleTasks error: ${error?.message || error}`);
     }
@@ -3833,6 +4764,7 @@ export function startDaemon(config = {}, deps = {}) {
 
   async function reconcileAssignedTasks() {
     try {
+      await adoptOrphanedTmuxFiresPromise;
       const response = await fetchFn(`${BACKEND_HTTP}/api/tasks`, {
         method: "GET",
         headers: {
@@ -3867,10 +4799,36 @@ export function startDaemon(config = {}, deps = {}) {
       });
 
       let killedCount = 0;
+      // Shutdown deliberately leaves tmux-detached Fires running, and a ws
+      // reconnect does not repopulate `activeTaskProcesses`, so this map
+      // under-reports what is still alive on this host. Ask tmux.
+      if (assigned.length && tmuxFiresMayExistUnseen()) {
+        logError(
+          `tmux is reachable but this daemon started without tmux mode active; skipping reconcile ` +
+            `for ${assigned.length} assigned task(s)`,
+        );
+        return;
+      }
+      const tmuxSessions =
+        FIRE_TMUX_MODE_ACTIVE && assigned.length ? await listAllTmuxSessions() : null;
+      if (tmuxSessions && !tmuxSessions.conclusive) {
+        // Same rule as the startup sweep. Here we do get another chance on the
+        // next reconnect, which is all the more reason not to guess.
+        logError(
+          `Could not list tmux sessions; skipping reconcile for ${assigned.length} assigned task(s)`,
+        );
+        return;
+      }
       for (const task of assigned) {
         const taskId = String(task?.id || "");
         if (!taskId) continue;
-        if (localTaskIds.has(taskId)) {
+        if (localTaskIds.has(taskId) || pendingTaskStarts.has(taskId)) {
+          continue;
+        }
+        // Adopts on the spot rather than merely skipping: a survivor that
+        // dodges the kill but gains no watcher would sit at `running`
+        // forever, because nothing else reports a tmux Fire's death.
+        if (adoptLiveTmuxFireForTask(task, tmuxSessions?.sessions || [])) {
           continue;
         }
         const patchResp = await fetchFn(`${BACKEND_HTTP}/api/tasks/${taskId}`, {
@@ -3906,7 +4864,12 @@ export function startDaemon(config = {}, deps = {}) {
   // half-close). Fires raise their own ws to backend independently — this is
   // the daemon's *own* belief about which tasks it is hosting. The backend
   // arbitrates between this push and the persisted task state.
-  function pushAgentAliveTasks(reason) {
+  async function pushAgentAliveTasks(reason) {
+    // Adoption may still be running when the ws handshake completes. This is
+    // the only channel that revokes a `killed_reason=daemon_disconnected`
+    // flag, so pushing before the adopted tasks are in the map would leave
+    // them showing as killed in the UI even though this daemon rescued them.
+    await adoptOrphanedTmuxFiresPromise;
     const aliveTaskIds = getActiveTaskIds();
     if (aliveTaskIds.length === 0) {
       return Promise.resolve();
@@ -4315,89 +5278,12 @@ export function startDaemon(config = {}, deps = {}) {
   }
 
   function resolvePtyLaunchSpec(launchConfig, fallbackCwd) {
-    const normalizedLaunchConfig = normalizeLaunchConfig(launchConfig);
-    const entrypointType =
-      normalizeOptionalString(normalizedLaunchConfig.entrypoint_type) ||
-      normalizeOptionalString(normalizedLaunchConfig.entrypointType) ||
-      (normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
-      normalizeOptionalString(normalizedLaunchConfig.toolPreset)
-        ? "tool_preset"
-        : "shell");
-    const preferredShell = resolveDefaultPtyShell({
-      explicitShell: normalizedLaunchConfig.shell,
-      envShell: process.env.SHELL,
-      comspec: process.env.COMSPEC,
-      platform: process.platform,
+    return buildPtyLaunchSpec(launchConfig, fallbackCwd, {
+      allowCliList: ALLOW_CLI_LIST,
+      supportedBackends: SUPPORTED_BACKENDS,
       existsSync: existsSyncFn,
+      log,
     });
-    const cwd =
-      normalizeOptionalString(normalizedLaunchConfig.cwd) ||
-      fallbackCwd;
-    const env = normalizeTerminalEnv(normalizedLaunchConfig.env);
-    const cols = normalizePositiveInt(
-      normalizedLaunchConfig.cols ?? normalizedLaunchConfig.columns,
-      DEFAULT_TERMINAL_COLS,
-    );
-    const rows = normalizePositiveInt(
-      normalizedLaunchConfig.rows,
-      DEFAULT_TERMINAL_ROWS,
-    );
-
-    if (entrypointType === "tool_preset") {
-      const toolPreset =
-        normalizeOptionalString(normalizedLaunchConfig.tool_preset) ||
-        normalizeOptionalString(normalizedLaunchConfig.toolPreset) ||
-        SUPPORTED_BACKENDS[0] ||
-        "codex";
-      const cliCommand = ALLOW_CLI_LIST[toolPreset];
-      if (!cliCommand) {
-        throw new Error(`Unsupported tool preset: ${toolPreset}`);
-      }
-      return {
-        entrypointType,
-        toolPreset,
-        command: preferredShell,
-        args: ["-lc", cliCommand],
-        shell: preferredShell,
-        cwd,
-        env,
-        cols,
-        rows,
-      };
-    }
-
-    if (entrypointType === "custom") {
-      const command = normalizeOptionalString(normalizedLaunchConfig.command);
-      if (!command) {
-        throw new Error("launch_config.command is required for custom entrypoint");
-      }
-      const args = Array.isArray(normalizedLaunchConfig.args)
-        ? normalizedLaunchConfig.args.filter((value) => typeof value === "string")
-        : [];
-      return {
-        entrypointType,
-        toolPreset: null,
-        command,
-        args,
-        shell: preferredShell,
-        cwd,
-        env,
-        cols,
-        rows,
-      };
-    }
-
-    return {
-      entrypointType: "shell",
-      toolPreset: null,
-      command: preferredShell,
-      args: ["-l"],
-      shell: preferredShell,
-      cwd,
-      env,
-      cols,
-      rows,
-    };
   }
 
   function getTerminalChunkByteLength(data) {
@@ -4913,6 +5799,10 @@ export function startDaemon(config = {}, deps = {}) {
           { cwd: worktreeConfig.projectRepoRoot },
         );
       }
+      // The marker lives outside the worktree, so `git worktree remove` does
+      // not take it with the directory. Leaving it behind would let a worktree
+      // later recreated on this path look ready before it is prepared.
+      removeTaskWorktreeReadyMarker(worktreeRoot);
 
       await reportTaskWorktreeCleanupResult({
         requestId,
@@ -5284,6 +6174,26 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
     if (event.type === "ai_manager_request") {
+      // RFC 0035: reads are fine and genuinely useful to a guest (it needs to
+      // know how much quota the borrowed machine has left). `switch_account` is
+      // not: `AiManager` resolves the codex auth path from `homedir()`, so a
+      // guest switching accounts renames over `~/.codex/auth.json` and changes
+      // the machine owner's own daemon, running fires, and interactive `codex`.
+      const aiAction = event.payload?.action;
+      if (IS_GUEST_DAEMON && !isGuestAiManagerActionAllowed(aiAction)) {
+        log(`[guest] Refused ai_manager action '${aiAction}' on a shared daemon`);
+        client
+          .send({
+            type: "ai_manager_response",
+            payload: {
+              request_id: event.payload?.request_id,
+              error: "Account switching is disabled on a shared daemon",
+              error_code: "guest_forbidden",
+            },
+          })
+          .catch(() => {});
+        return;
+      }
       handleAiManagerRequest(client, aiManagerHandlers, event.payload).catch((error) => {
         logError(`Unhandled ai_manager_request failure: ${error?.message || error}`);
       });
@@ -5332,6 +6242,14 @@ export function startDaemon(config = {}, deps = {}) {
         logError(`Unhandled restart_daemon failure: ${error?.message || error}`);
       });
     }
+    if (event.type === "update_daemon_request") {
+      if (event?.payload?.action === "start") {
+        log(`[update_daemon] Update requested (current=${cliVersion}); log: ${daemonUpdatePaths.logPath}`);
+      }
+      handleUpdateDaemonRequest(client, daemonUpdateHandlers, event.payload).catch((error) => {
+        logError(`Unhandled update_daemon_request failure: ${error?.message || error}`);
+      });
+    }
   }
 
   function markWatchdogHealthy(signal, at = Date.now()) {
@@ -5406,6 +6324,7 @@ export function startDaemon(config = {}, deps = {}) {
   async function handleValidateProjectPath(payload) {
     const requestId = payload?.request_id ? String(payload.request_id).trim() : "";
     const rawWorkspacePath = payload?.workspace_path ? String(payload.workspace_path).trim() : "";
+    const createIfMissing = payload?.create_if_missing === true;
     const validatedAt = new Date().toISOString();
 
     if (!requestId || !rawWorkspacePath) {
@@ -5413,6 +6332,27 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: keep a guest inside the directory its owner set aside. This is
+    // misuse prevention, not a security boundary -- the guest's AI agent runs a
+    // shell and can reach anything the OS user can. It matters because neither
+    // handler is otherwise bounded: this one will `mkdirSync(recursive)` any
+    // absolute path it is handed.
+    if (IS_GUEST_DAEMON && GUEST_ROOT && !isPathInsideGuestRoot(rawWorkspacePath, GUEST_ROOT)) {
+      await client.sendJson({
+        type: "project_path_validated",
+        payload: {
+          request_id: requestId,
+          daemon_host: AGENT_NAME,
+          workspace_path: rawWorkspacePath,
+          error: `Path is outside the shared workspace root (${GUEST_ROOT})`,
+          error_code: "outside_guest_root",
+          validated_at: new Date().toISOString(),
+        },
+      });
+      return;
+    }
+
+
     let result = {
       workspacePath: null,
       repoRoot: null,
@@ -5429,7 +6369,22 @@ export function startDaemon(config = {}, deps = {}) {
 
     try {
       const resolvedPath = path.resolve(rawWorkspacePath);
-      if (!existsSyncFn(resolvedPath)) {
+      let createError = null;
+      if (createIfMissing && !existsSyncFn(resolvedPath)) {
+        try {
+          mkdirSyncFn(resolvedPath, { recursive: true });
+          log(`Created workspace path on request: ${resolvedPath}`);
+        } catch (error) {
+          createError = error;
+        }
+      }
+      if (createError) {
+        result = {
+          ...result,
+          error: `Failed to create workspace path on daemon ${AGENT_NAME}: ${createError?.message || createError}`,
+          errorCode: "workspace_create_failed",
+        };
+      } else if (!existsSyncFn(resolvedPath)) {
         result = {
           ...result,
           error: `Workspace path does not exist on daemon ${AGENT_NAME}: ${rawWorkspacePath}`,
@@ -5522,6 +6477,27 @@ export function startDaemon(config = {}, deps = {}) {
       return;
     }
 
+    // RFC 0035: keep a guest inside the directory its owner set aside. This is
+    // misuse prevention, not a security boundary -- the guest's AI agent runs a
+    // shell and can reach anything the OS user can. It matters because neither
+    // handler is otherwise bounded: this one will `mkdirSync(recursive)` any
+    // absolute path it is handed.
+    if (IS_GUEST_DAEMON && GUEST_ROOT && !isPathInsideGuestRoot(rawWorkspacePath, GUEST_ROOT)) {
+      await client.sendJson({
+        type: "project_agents_resolved",
+        payload: {
+          request_id: requestId,
+          daemon_host: AGENT_NAME,
+          workspace_path: rawWorkspacePath,
+          error: `Path is outside the shared workspace root (${GUEST_ROOT})`,
+          error_code: "outside_guest_root",
+          resolved_at: new Date().toISOString(),
+        },
+      });
+      return;
+    }
+
+
     let result = {
       workspacePath: null,
       agents: [],
@@ -5641,6 +6617,7 @@ export function startDaemon(config = {}, deps = {}) {
       }
 
       activeTaskProcesses.delete(taskId);
+      forgetFireSessionRecord(processRecord);
       return true;
     }
 
@@ -5715,6 +6692,15 @@ export function startDaemon(config = {}, deps = {}) {
     return Boolean(record?.forceDaemonTerminalStatusReport) || !Boolean(record?.managedByFireBridge);
   }
 
+  // "Does this record stand for a live fire?" `child` alone is not the answer:
+  // an ADOPTED tmux record has none — the `tmux new-session` client belonged
+  // to the daemon that spawned it — while the fire it points at is very much
+  // alive. Every already-active gate must ask this instead, or it will spawn
+  // a second fire into a worktree that already has one.
+  function recordHasLiveFire(record) {
+    return Boolean(record?.child) || Boolean(record?.tmuxMode && record?.tmuxSession);
+  }
+
   // RFC 0029: confirm that a task the backend believes is dead is actually
   // still hosting a live fire on this daemon. The check is intentionally
   // conservative:
@@ -5813,6 +6799,7 @@ export function startDaemon(config = {}, deps = {}) {
             entry.stopForceKillTimer = null;
           }
           activeTaskProcesses.delete(taskId);
+          forgetFireSessionRecord(entry);
         }
         entry = undefined;
       }
@@ -5870,7 +6857,12 @@ export function startDaemon(config = {}, deps = {}) {
 
     const processRecord = activeTaskProcesses.get(taskId);
     const ptyRecord = activePtySessions.get(taskId);
-    if ((!processRecord || !processRecord.child) && !ptyRecord) {
+    // `recordHasLiveFire`, not `child`: an adopted tmux record has no child,
+    // and reading it as "nothing to stop" would report the task KILLED to the
+    // backend while leaving the fire running in its session, still writing to
+    // the worktree. Nothing would ever notice — the reaper only speaks when a
+    // session disappears.
+    if (!recordHasLiveFire(processRecord) && !ptyRecord) {
       log(`Stop requested for task ${taskId}, but no active process found`);
       sendStopAck(false);
       // "Nothing to stop" IS the terminal answer, and the server cannot infer
@@ -6248,9 +7240,12 @@ export function startDaemon(config = {}, deps = {}) {
     }
 
     const existingTaskRecord = activeTaskProcesses.get(taskId);
-    if (existingTaskRecord?.child || pendingTaskStarts.has(taskId)) {
+    if (recordHasLiveFire(existingTaskRecord) || pendingTaskStarts.has(taskId)) {
       log(
-        `Duplicate create_task ignored for ${taskId}: task already active (pid=${existingTaskRecord?.child?.pid ?? "unknown"})`,
+        `Duplicate create_task ignored for ${taskId}: task already active (` +
+          `${existingTaskRecord?.tmuxSession
+            ? `tmux=${existingTaskRecord.tmuxSession}`
+            : `pid=${existingTaskRecord?.child?.pid ?? "unknown"}`})`,
       );
       sendAgentCommandAck({
         requestId,
@@ -6454,7 +7449,7 @@ export function startDaemon(config = {}, deps = {}) {
       const outputCapture = createChildOutputCapture({ logPath, logStartOffset });
       const spawnedAtMs = Date.now();
 
-      activeTaskProcesses.set(taskId, {
+      const activeProcessRecord = {
         child,
         projectId,
         logPath,
@@ -6472,7 +7467,12 @@ export function startDaemon(config = {}, deps = {}) {
         managedByFireBridge: true,
         tmuxSession: tmuxSession || null,
         tmuxMode: Boolean(tmuxSession),
-      });
+      };
+      activeTaskProcesses.set(taskId, activeProcessRecord);
+      // Mirror the parts of the record that only exist in this process's
+      // memory, so a successor daemon can adopt this Fire instead of
+      // mistaking the hand-off for a dead task.
+      rememberFireSessionRecord(taskId, activeProcessRecord);
 
       client
         .sendJson({
@@ -6578,6 +7578,7 @@ export function startDaemon(config = {}, deps = {}) {
           clearTimeout(active.stopForceKillTimer);
         }
         activeTaskProcesses.delete(taskId);
+        forgetFireSessionRecord(active);
         const suppressExitStatusReport = suppressedExitStatusReports.has(taskId);
         suppressedExitStatusReports.delete(taskId);
         if (logStream) {
@@ -6768,12 +7769,17 @@ export function startDaemon(config = {}, deps = {}) {
           activeTarget.stopForceKillTimer = null;
         }
         activeTaskProcesses.delete(normalizedTargetTaskId);
+        forgetFireSessionRecord(activeTarget);
         activeTarget = undefined;
       }
     }
 
+    // The probe above already cleared the record if the session was
+    // conclusively gone, so a surviving tmuxMode entry means a live session.
+    const targetHasLiveFire = recordHasLiveFire(activeTarget);
+
     if (isRefreshSessionInplace) {
-      if (!activeTarget?.child) {
+      if (!targetHasLiveFire) {
         reportRestartFailure({
           taskId: normalizedTargetTaskId,
           projectId: normalizedProjectId,
@@ -6784,7 +7790,7 @@ export function startDaemon(config = {}, deps = {}) {
         });
         return;
       }
-    } else if (activeTarget?.child) {
+    } else if (targetHasLiveFire) {
       // tmux-mode failures point at the tmux session, not a meaningless pid.
       const description = activeTarget.tmuxMode
         ? `task already active in tmux session ${activeTarget.tmuxSession || "(unknown)"} — stop the task before restarting`
@@ -7169,6 +8175,9 @@ export function startDaemon(config = {}, deps = {}) {
       tmuxMode: Boolean(tmuxSession),
     };
     activeTaskProcesses.set(normalizedTargetTaskId, activeProcessRecord);
+    // See the create_task path: this is the only copy of `exitMarkerToken`
+    // that survives the current process.
+    rememberFireSessionRecord(normalizedTargetTaskId, activeProcessRecord);
 
     // In tmux mode the Fire process writes directly to logPath via shell
     // redirection inside the tmux session, so the daemon does not pipe
@@ -7259,6 +8268,7 @@ export function startDaemon(config = {}, deps = {}) {
         clearTimeout(active.stopForceKillTimer);
       }
       activeTaskProcesses.delete(normalizedTargetTaskId);
+      forgetFireSessionRecord(active);
       const suppressExitStatusReport = suppressedExitStatusReports.has(normalizedTargetTaskId);
       suppressedExitStatusReports.delete(normalizedTargetTaskId);
       if (logStream) {