@sayknow-cli/coding-agent 0.3.12 → 0.3.15

package/src/coordinator-mcp/server.ts

@@ -2,7 +2,9 @@ import { randomUUID } from "node:crypto";
 import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { isKnownSinkPeerClosedError } from "@sayknow-cli/utils";
 import { VERSION } from "@sayknow-cli/utils/dirs";
+
 import {
 	COORDINATOR_MCP_PROTOCOL_VERSION,
 	COORDINATOR_MCP_SERVER_NAME,
@@ -11,8 +13,31 @@ import {
 } from "../coordinator/contract";
 import {
 	SKC_COORDINATOR_SESSION_ID_ENV,
+	SKC_COORDINATOR_SESSION_LAUNCH_ID_ENV,
+	SKC_COORDINATOR_SESSION_READINESS_FILE_ENV,
 	SKC_COORDINATOR_SESSION_STATE_FILE_ENV,
+	SKC_TMUX_OWNER_GENERATION_ENV,
+	SKC_TMUX_OWNER_SERVER_KEY_ENV,
+	SKC_TMUX_OWNER_STATE_DIR_ENV,
 } from "../skc-runtime/session-state-sidecar";
+
+import {
+	captureOwnerGenerationBaselineSync,
+	classifyCgroup,
+	isExactScopedBootstrapSuccessReceipt,
+	type OwnerIsolationProbe,
+	ownerProcessStartTime,
+	planTmuxOwnerIsolation,
+	replaceOwnerGenerationSync,
+	type TmuxServerProof,
+} from "../skc-runtime/tmux-owner-isolation";
+import { forceCloseSkcTmuxSession } from "../skc-runtime/tmux-sessions";
+import {
+	type CoordinatorModelProfileLoader,
+	loadCoordinatorModelProfiles,
+	resolveCoordinatorMpreset,
+} from "./model-preset";
+
 import {
 	assertCoordinatorArtifactPath,
 	assertCoordinatorWorkdir,
@@ -21,6 +46,7 @@ import {
 	coordinatorNamespacePath,
 	requireCoordinatorMutation,
 } from "./policy";
+import { createSessionReaper, type ReapableSession, type SessionReaper } from "./session-reaper";
 
 export type { CoordinatorToolName };
 export { COORDINATOR_MCP_PROTOCOL_VERSION, COORDINATOR_MCP_SERVER_NAME, COORDINATOR_MCP_TOOL_NAMES };
@@ -41,11 +67,28 @@ interface JsonRpcResponse {
 	error?: { code: number; message: string; data?: unknown };
 }
 
+function sinkErrorCode(error: unknown): string | undefined {
+	if (error === null || (typeof error !== "object" && typeof error !== "function")) return undefined;
+	try {
+		const code = Reflect.get(error, "code");
+		return typeof code === "string" ? code : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 interface SessionStartInput {
 	cwd: string;
 	prompt?: string;
+	mpreset?: string | null;
 	namespace: { profile: string | null; repo: string | null };
 	worktree: true;
+	sessionId: string;
+	launchId: string;
+	/** Canonical, coordinator-owned immutable readiness marker path. */
+	readinessMarkerFile: string;
+	/** @deprecated Compatibility alias for injected launch providers. */
+	readinessFile: string;
 }
 
 interface SessionRegisterInput {
@@ -79,10 +122,26 @@ interface RuntimeSessionStatePayload extends CoordinatorSessionState {
 	error?: { code: string; message: string; recoverable: boolean } | null;
 }
 
+interface CommandResult {
+	exitCode: number;
+	stdout: string;
+	stderr: string;
+}
+
+type CommandRunner = (command: string[], stdinLine?: string) => Promise<CommandResult>;
+
 interface CoordinatorServices {
 	listSessions?: () => unknown[] | Promise<unknown[]>;
 	startSession?: (input: SessionStartInput) => unknown | Promise<unknown>;
-	commandRunner?: (command: string[]) => Promise<{ exitCode: number; stdout: string; stderr: string }>;
+	commandRunner?: CommandRunner;
+	forceCloseSession?: (
+		sessionName: string,
+		env: NodeJS.ProcessEnv,
+		expectedSessionId?: string,
+		expectedStateFile?: string,
+	) => Promise<unknown>;
+	ownerIsolationProbe?: OwnerIsolationProbe;
+	resolveModelProfiles?: CoordinatorModelProfileLoader;
 }
 
 interface CoordinatorMcpServerOptions {
@@ -92,7 +151,7 @@ interface CoordinatorMcpServerOptions {
 
 interface LegacyHandlerOptions {
 	env?: NodeJS.ProcessEnv;
-	createSession?: () => unknown;
+	createSession?: (input: SessionStartInput) => unknown;
 }
 
 type TurnStatus =
@@ -112,16 +171,28 @@ interface TurnRecord {
 	session_id: string;
 	namespace: { profile: string | null; repo: string | null };
 	status: TurnStatus;
-	prompt: { text: string; created_at: string; source: "mcp" | "question_answer" };
+	prompt: {
+		text: string;
+		created_at: string;
+		source: "mcp" | "question_answer";
+	};
 	delivery: {
 		delivered: boolean;
 		queued: boolean;
 		target: string | null;
 		tmux_keys_sent?: boolean;
 		prompt_acknowledged?: boolean;
-		state?: "queued" | "tmux_keys_sent" | "acknowledged" | "unavailable" | "unacknowledged";
+		state?:
+			| "queued"
+			| "awaiting_runtime_readiness"
+			| "delivering"
+			| "tmux_keys_sent"
+			| "acknowledged"
+			| "unavailable"
+			| "unacknowledged";
 		attempts: Array<{
 			delivered: boolean;
+			attempt_id?: string;
 			created_at: string;
 			reason: string | null;
 			channel?: "tmux_keys" | "runtime_ack";
@@ -138,7 +209,11 @@ interface TurnRecord {
 	};
 	evidence: Array<Record<string, unknown>>;
 	error: { code: string; message: string; recoverable: boolean } | null;
-	liveness: { checked_at: string | null; live: boolean | null; reason: string | null };
+	liveness: {
+		checked_at: string | null;
+		live: boolean | null;
+		reason: string | null;
+	};
 	created_at: string;
 	updated_at: string;
 	started_at: string | null;
@@ -163,18 +238,33 @@ interface CoordinatorSessionState {
 	current_turn_id: string | null;
 	last_turn_id: string | null;
 	updated_at: string;
-	source: "coordinator" | "agent_session_event";
+	source: "coordinator" | "agent_session_event" | "process_postmortem";
+
 	live: boolean | null;
 	reason: string | null;
+	cwd?: string;
+	workdir?: string;
+	session_file?: string | null;
+	owner_generation?: string;
+	event?: string;
+	owner_terminal?: {
+		generation: string;
+		socket_key: string;
+		classification: string;
+		observer: string;
+		observed_at: string;
+	};
 }
 
 type CoordinatorEventKind =
 	| "session.registered"
 	| "session.started"
+	| "session.reaped"
 	| "session.state_changed"
 	| "turn.queued"
 	| "turn.delivering"
 	| "turn.active"
+	| "turn.acknowledged"
 	| "turn.waiting_for_answer"
 	| "turn.completed"
 	| "turn.failed"
@@ -217,6 +307,10 @@ const MISSING_FINAL_RESPONSE_ADVISORY = "completion_missing_final_response";
 const PROMPT_ACK_TIMEOUT_REASON = "runtime_prompt_ack_timeout";
 const DEFAULT_RUNTIME_PROMPT_ACK_TIMEOUT_MS = 10_000;
 const MAX_RUNTIME_PROMPT_ACK_TIMEOUT_MS = 5 * 60 * 1000;
+const RUNTIME_READINESS_TIMEOUT_REASON = "runtime_readiness_timeout";
+const DEFAULT_RUNTIME_READINESS_TIMEOUT_MS = 10_000;
+const MAX_RUNTIME_READINESS_TIMEOUT_MS = 5 * 60 * 1000;
+
 const ACTIVE_TURN_STATUSES = new Set<TurnStatus>(["delivering", "active", "waiting_for_answer", "completing"]);
 const TERMINAL_TURN_STATUSES = new Set<TurnStatus>(["completed", "failed", "cancelled", "superseded"]);
 const TURN_ID_PATTERN = /^turn-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -232,7 +326,12 @@ function textResult(
 	isError = false,
 ): { content: Array<{ type: "text"; text: string }>; isError: boolean } {
 	return {
-		content: [{ type: "text", text: typeof payload === "string" ? payload : JSON.stringify(payload) }],
+		content: [
+			{
+				type: "text",
+				text: typeof payload === "string" ? payload : JSON.stringify(payload),
+			},
+		],
 		isError,
 	};
 }
@@ -242,13 +341,27 @@ function toolSchema(name: CoordinatorToolName): {
 	description: string;
 	inputSchema: Record<string, unknown>;
 } {
-	const allowMutation = { type: "boolean", description: "Required and must be true for mutating tools." };
+	const allowMutation = {
+		type: "boolean",
+		description: "Required and must be true for mutating tools.",
+	};
 	const cwd = {
 		type: "string",
 		description: "Canonicalized SKC worktree or project directory inside configured roots.",
 	};
-	const sessionId = { type: "string", description: "SKC coordinator bridge session id." };
-	const pathField = { type: "string", description: "Artifact path inside configured safe roots." };
+	const sessionId = {
+		type: "string",
+		description: "SKC coordinator bridge session id.",
+	};
+	const pathField = {
+		type: "string",
+		description: "Artifact path inside configured safe roots.",
+	};
+	const mpreset = {
+		type: "string",
+		description:
+			"Optional SKC model profile (`skc --mpreset <profile>`) to authoritatively activate for a fresh session; resolved through the merged built-in/custom profile registry and applied from the first turn. Unknown names are rejected with the available-profile listing.",
+	};
 	const common = { type: "object", properties: {} as Record<string, unknown> };
 	if (name === "skc_coordinator_register_session") {
 		return {
@@ -277,11 +390,36 @@ function toolSchema(name: CoordinatorToolName): {
 			description: "Start a SKC worktree/tmux oriented session through the coordinator bridge.",
 			inputSchema: {
 				type: "object",
-				properties: { cwd, prompt: { type: "string" }, allow_mutation: allowMutation },
+				properties: {
+					cwd,
+					prompt: { type: "string" },
+					mpreset,
+					allow_mutation: allowMutation,
+				},
 				required: ["cwd", "allow_mutation"],
 			},
 		};
 	}
+	if (name === "skc_coordinator_stop_session") {
+		return {
+			name,
+			description:
+				"Reap a coordinator delegate-created (ephemeral) session: terminate its owner via the owner-proof forceCloseSkcTmuxSession, then purge its state files only on verified termination. Never touches non-ephemeral (user-registered) sessions unless force is set AND the force-stop capability is enabled.",
+			inputSchema: {
+				type: "object",
+				properties: {
+					session_id: sessionId,
+					force: {
+						type: "boolean",
+						description: "Reap a non-ephemeral session; requires the SKC_COORDINATOR_MCP_FORCE_STOP capability.",
+					},
+					reason: { type: "string", description: "Optional audit reason recorded on the session.reaped event." },
+					allow_mutation: allowMutation,
+				},
+				required: ["session_id", "allow_mutation"],
+			},
+		};
+	}
 	if (name === "skc_coordinator_send_prompt") {
 		return {
 			name,
@@ -306,7 +444,11 @@ function toolSchema(name: CoordinatorToolName): {
 			description: "Read authoritative durable turn state plus bounded advisory tmux status.",
 			inputSchema: {
 				type: "object",
-				properties: { session_id: sessionId, turn_id: { type: "string" }, lines: { type: "number" } },
+				properties: {
+					session_id: sessionId,
+					turn_id: { type: "string" },
+					lines: { type: "number" },
+				},
 				required: ["turn_id"],
 			},
 		};
@@ -375,7 +517,11 @@ function toolSchema(name: CoordinatorToolName): {
 		return {
 			name,
 			description: "Read one bounded artifact from configured safe roots.",
-			inputSchema: { type: "object", properties: { path: pathField }, required: ["path"] },
+			inputSchema: {
+				type: "object",
+				properties: { path: pathField },
+				required: ["path"],
+			},
 		};
 	}
 	if (name === "skc_coordinator_read_status") {
@@ -389,21 +535,35 @@ function toolSchema(name: CoordinatorToolName): {
 		return {
 			name,
 			description: "Read a bounded structured session tail, not tmux scrollback.",
-			inputSchema: { type: "object", properties: { session_id: sessionId, lines: { type: "number" } } },
+			inputSchema: {
+				type: "object",
+				properties: { session_id: sessionId, lines: { type: "number" } },
+			},
 		};
 	}
 	if (name === "skc_coordinator_list_questions") {
 		return {
 			name,
 			description: "List bounded structured questions for coordinator coordination.",
-			inputSchema: { type: "object", properties: { session_id: sessionId, status: { type: "string" } } },
+			inputSchema: {
+				type: "object",
+				properties: { session_id: sessionId, status: { type: "string" } },
+			},
 		};
 	}
 	if (name === "skc_coordinator_list_artifacts") {
-		return { name, description: "List known safe artifact roots for coordinator coordination.", inputSchema: common };
+		return {
+			name,
+			description: "List known safe artifact roots for coordinator coordination.",
+			inputSchema: common,
+		};
 	}
 	if (name === "skc_coordinator_read_coordination_status") {
-		return { name, description: "Read coordinator coordination reports.", inputSchema: common };
+		return {
+			name,
+			description: "Read coordinator coordination reports.",
+			inputSchema: common,
+		};
 	}
 	if (name === "skc_coordinator_watch_events") {
 		return {
@@ -437,7 +597,10 @@ function toolSchema(name: CoordinatorToolName): {
 						type: "string",
 						description: "Delegated task or objective to run through the selected SKC workflow.",
 					},
-					prompt: { type: "string", description: "Alias for task; accepted when task is absent." },
+					prompt: {
+						type: "string",
+						description: "Alias for task; accepted when task is absent.",
+					},
 					allow_mutation: allowMutation,
 					session_id: {
 						type: "string",
@@ -452,24 +615,38 @@ function toolSchema(name: CoordinatorToolName): {
 						type: "boolean",
 						description: "When reusing a session with an active turn, supersede it before sending.",
 					},
+					mpreset,
 					model: {
 						type: "string",
 						description: "Optional model hint passed in prompt metadata; no provider default is implied.",
 					},
-					await_completion: { type: "boolean", description: "If true, poll the turn until terminal or timeout." },
+					await_completion: {
+						type: "boolean",
+						description: "If true, poll the turn until terminal or timeout.",
+					},
 					timeout_ms: {
 						type: "number",
 						description:
 							"Bounded await timeout in milliseconds, capped at 30 minutes like skc_coordinator_await_turn.",
 					},
-					poll_interval_ms: { type: "number", description: "Bounded await polling interval." },
-					lines: { type: "number", description: "Bounded advisory tail lines returned with await/read payloads." },
+					poll_interval_ms: {
+						type: "number",
+						description: "Bounded await polling interval.",
+					},
+					lines: {
+						type: "number",
+						description: "Bounded advisory tail lines returned with await/read payloads.",
+					},
 				},
 				required: ["cwd", "allow_mutation"],
 			},
 		};
 	}
-	return { name, description: "List known scoped SKC coordinator bridge sessions.", inputSchema: common };
+	return {
+		name,
+		description: "List known scoped SKC coordinator bridge sessions.",
+		inputSchema: common,
+	};
 }
 
 type DelegateWorkflow = "plan" | "execute" | "team";
@@ -535,13 +712,80 @@ function workflowPrompt(
 	].join("\n");
 }
 
+const PRIVATE_SESSION_CONTROL_FIELDS = new Set([
+	"tmux_socket_key",
+	"tmuxSocketKey",
+	"tmux_owner_generation",
+	"tmuxOwnerGeneration",
+	"tmux_owner_state_dir",
+	"tmuxOwnerStateDir",
+	"tmux_owner_server_key",
+	"tmuxOwnerServerKey",
+	"tmux_owner_server_pid",
+	"tmuxOwnerServerPid",
+	"tmux_owner_server_start_time",
+	"tmuxOwnerServerStartTime",
+	"tmux_native_session_id",
+	"tmuxNativeSessionId",
+	"pane_id",
+	"paneId",
+	"socket_key",
+	"socketKey",
+	"owner_generation",
+	"ownerGeneration",
+	"state_dir",
+	"ownerStateDir",
+	"owner_server_key",
+	"ownerServerKey",
+	"owner_server_pid",
+	"ownerServerPid",
+	"owner_server_start_time",
+	"ownerServerStartTime",
+	"owner_terminal",
+	"ownerTerminal",
+	"generation",
+	"server_key",
+	"intent_id",
+	"dedupe_key",
+	"__coordinatorOwnerTransaction",
+]);
+
+function publicSessionProjection(session: Record<string, unknown>): Record<string, unknown> {
+	return Object.fromEntries(Object.entries(session).filter(([key]) => !PRIVATE_SESSION_CONTROL_FIELDS.has(key)));
+}
+
+function publicCoordinatorResponse(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(publicCoordinatorResponse);
+	const record = asRecord(value);
+	if (!record) return value;
+	return Object.fromEntries(
+		Object.entries(publicSessionProjection(record)).map(([key, item]) => [key, publicCoordinatorResponse(item)]),
+	);
+}
+
 function normalizeSession(session: Record<string, unknown>): Record<string, unknown> {
+	const suppliedIds = [session.session_id, session.sessionId, session.name].filter(
+		(value): value is string => typeof value === "string",
+	);
+	if (suppliedIds.length === 0) throw new Error("invalid_session_id");
+	const sessionId = safeExternalId("session", suppliedIds[0]);
+	if (suppliedIds.some(value => value !== sessionId)) throw new Error("session_id_conflict");
 	return {
-		session_id: session.sessionId ?? session.session_id ?? session.name ?? "unknown",
 		...(session.tmuxSession ? { tmux_session: session.tmuxSession } : {}),
+		...(session.tmuxTarget ? { tmux_target: session.tmuxTarget } : {}),
+		...(session.tmuxSocketKey ? { tmux_socket_key: session.tmuxSocketKey } : {}),
+		...(session.tmuxOwnerGeneration ? { tmux_owner_generation: session.tmuxOwnerGeneration } : {}),
+		...(session.tmuxOwnerStateDir ? { tmux_owner_state_dir: session.tmuxOwnerStateDir } : {}),
+		...(session.tmuxOwnerServerKey ? { tmux_owner_server_key: session.tmuxOwnerServerKey } : {}),
+		...(session.tmuxOwnerServerPid ? { tmux_owner_server_pid: session.tmuxOwnerServerPid } : {}),
+		...(session.tmuxOwnerServerStartTime ? { tmux_owner_server_start_time: session.tmuxOwnerServerStartTime } : {}),
+		...(session.tmuxNativeSessionId ? { tmux_native_session_id: session.tmuxNativeSessionId } : {}),
+		...(session.paneId ? { pane_id: session.paneId } : {}),
 		...(session.cwd ? { cwd: session.cwd } : {}),
 		...(session.createdAt ? { created_at: session.createdAt } : {}),
 		...session,
+		session_id: sessionId,
+		sessionId,
 	};
 }
 
@@ -553,15 +797,380 @@ async function canonicalizePath(value: string): Promise<string> {
 	}
 }
 
+interface RuntimeReadinessMarker {
+	schema_version: 1;
+	session_id: string;
+	launch_id: string;
+	state: "ready_for_input";
+	event: "interactive_input_ready";
+	source: "skc_interactive_runtime";
+	ready_for_input: true;
+	created_at: string;
+}
+
+async function readRuntimeReadinessMarker(
+	markerFile: string,
+	sessionId: string,
+	launchId: string,
+	readinessRoot?: string,
+): Promise<RuntimeReadinessMarker | null> {
+	try {
+		const expectedFile = path.resolve(markerFile);
+		if (readinessRoot) {
+			const canonicalRoot = await fs.realpath(readinessRoot);
+			const canonicalParent = await fs.realpath(path.dirname(expectedFile));
+			if (
+				!expectedFile.startsWith(`${canonicalRoot}${path.sep}`) ||
+				!canonicalParent.startsWith(`${canonicalRoot}${path.sep}`)
+			)
+				return null;
+		}
+		const stat = await fs.lstat(expectedFile);
+		if (!stat.isFile() || stat.isSymbolicLink()) return null;
+		const marker = JSON.parse(await fs.readFile(expectedFile, "utf8")) as RuntimeReadinessMarker;
+		return marker.schema_version === 1 &&
+			marker.session_id === sessionId &&
+			marker.launch_id === launchId &&
+			marker.state === "ready_for_input" &&
+			marker.event === "interactive_input_ready" &&
+			marker.source === "skc_interactive_runtime" &&
+			marker.ready_for_input === true &&
+			typeof marker.created_at === "string" &&
+			marker.created_at.length > 0 &&
+			Number.isFinite(Date.parse(marker.created_at))
+			? marker
+			: null;
+	} catch {
+		return null;
+	}
+}
+
+async function waitForRuntimeReadinessMarker(
+	markerFile: string,
+	sessionId: string,
+	launchId: string,
+	readinessRoot: string,
+	timeoutMs: number,
+): Promise<boolean> {
+	const ready = async (): Promise<boolean> =>
+		(await readRuntimeReadinessMarker(markerFile, sessionId, launchId, readinessRoot)) !== null;
+	if (await ready()) return true;
+
+	const markerDir = path.dirname(markerFile);
+	await ensureDir(markerDir);
+	const deadline = Date.now() + Math.max(timeoutMs, 0);
+	let wake = Promise.withResolvers<void>();
+	let watcher: nodeFs.FSWatcher | null = null;
+	try {
+		watcher = nodeFs.watch(markerDir, (_eventType, filename) => {
+			if (filename === path.basename(markerFile)) wake.resolve();
+		});
+		// A marker may be installed between the first read and watch creation.
+		if (await ready()) return true;
+		while (Date.now() < deadline) {
+			const remainingMs = Math.max(1, deadline - Date.now());
+			let timer: NodeJS.Timeout | null = null;
+			const fallback = new Promise<void>(resolve => {
+				timer = setTimeout(resolve, Math.min(50, remainingMs));
+				timer.unref?.();
+			});
+			await Promise.race([wake.promise, fallback]);
+			if (timer) clearTimeout(timer);
+			wake = Promise.withResolvers<void>();
+			if (await ready()) return true;
+		}
+		return false;
+	} finally {
+		watcher?.close();
+	}
+}
+
 async function ensureDir(dir: string): Promise<void> {
 	await fs.mkdir(dir, { recursive: true });
 }
 
+class CoordinatorStateError extends Error {
+	constructor(readonly reason: "invalid" | "unreadable") {
+		super(`coordinator_state_${reason}`);
+	}
+}
+
+const COORDINATOR_SESSION_STATES = new Set<CoordinatorSessionStateValue>([
+	"booting",
+	"ready_for_input",
+	"running",
+	"needs_user_input",
+	"completed",
+	"errored",
+	"stale",
+	"unknown",
+]);
+const COORDINATOR_EVENT_KINDS = new Set<CoordinatorEventKind>([
+	"session.registered",
+	"session.started",
+	"session.reaped",
+	"session.state_changed",
+	"turn.queued",
+	"turn.delivering",
+	"turn.active",
+	"turn.acknowledged",
+	"turn.waiting_for_answer",
+	"turn.completed",
+	"turn.failed",
+	"turn.cancelled",
+	"turn.superseded",
+	"question.opened",
+	"question.answered",
+	"report.written",
+	"tmux.delivery_succeeded",
+	"tmux.delivery_failed",
+	"delegation.started",
+]);
+
+function coordinatorStateError(reason: "invalid" | "unreadable"): CoordinatorStateError {
+	return new CoordinatorStateError(reason);
+}
+
+function isValidCoordinatorSessionState(value: unknown, sessionId: string): value is CoordinatorSessionState {
+	const record = asRecord(value);
+	return (
+		record?.schema_version === 1 &&
+		record.session_id === sessionId &&
+		typeof record.state === "string" &&
+		COORDINATOR_SESSION_STATES.has(record.state as CoordinatorSessionStateValue) &&
+		typeof record.ready_for_input === "boolean" &&
+		record.ready_for_input === (record.state === "ready_for_input" || record.state === "completed") &&
+		(record.current_turn_id === null ||
+			(typeof record.current_turn_id === "string" && TURN_ID_PATTERN.test(record.current_turn_id))) &&
+		(record.last_turn_id === null ||
+			(typeof record.last_turn_id === "string" && TURN_ID_PATTERN.test(record.last_turn_id))) &&
+		typeof record.updated_at === "string" &&
+		Number.isFinite(Date.parse(record.updated_at)) &&
+		(record.source === "coordinator" ||
+			record.source === "agent_session_event" ||
+			record.source === "process_postmortem") &&
+		(record.live === null || typeof record.live === "boolean") &&
+		(record.reason === null || typeof record.reason === "string")
+	);
+}
+
+const MAX_RUNTIME_FINAL_RESPONSE_TEXT_LENGTH = 16_384;
+const MAX_RUNTIME_FINAL_RESPONSE_SOURCE_LENGTH = 256;
+const MAX_RUNTIME_FINAL_RESPONSE_ARTIFACT_PATH_LENGTH = 1_024;
+const MAX_RUNTIME_ERROR_CODE_LENGTH = 128;
+const MAX_RUNTIME_ERROR_MESSAGE_LENGTH = 4_096;
+
+function isBoundedNullableString(value: unknown, maxLength: number): value is string | null {
+	return value === null || (typeof value === "string" && value.length <= maxLength);
+}
+
+function isValidRuntimeFinalResponse(value: unknown): value is CoordinatorFinalResponse {
+	const record = asRecord(value);
+	return (
+		record !== null &&
+		Object.keys(record).every(key => ["text", "format", "source", "artifact_path", "truncated"].includes(key)) &&
+		isBoundedNullableString(record.text, MAX_RUNTIME_FINAL_RESPONSE_TEXT_LENGTH) &&
+		record.format === "markdown" &&
+		(record.source === null ||
+			(typeof record.source === "string" &&
+				record.source.length > 0 &&
+				record.source.length <= MAX_RUNTIME_FINAL_RESPONSE_SOURCE_LENGTH)) &&
+		(record.artifact_path === null ||
+			(typeof record.artifact_path === "string" &&
+				record.artifact_path.length > 0 &&
+				record.artifact_path.length <= MAX_RUNTIME_FINAL_RESPONSE_ARTIFACT_PATH_LENGTH &&
+				!path.isAbsolute(record.artifact_path) &&
+				!record.artifact_path.split(/[\\/]/).includes(".."))) &&
+		typeof record.truncated === "boolean"
+	);
+}
+
+function isValidRuntimeError(value: unknown): value is NonNullable<RuntimeSessionStatePayload["error"]> {
+	const record = asRecord(value);
+	return (
+		record !== null &&
+		Object.keys(record).every(key => ["code", "message", "recoverable"].includes(key)) &&
+		typeof record.code === "string" &&
+		record.code.length > 0 &&
+		record.code.length <= MAX_RUNTIME_ERROR_CODE_LENGTH &&
+		typeof record.message === "string" &&
+		record.message.length > 0 &&
+		record.message.length <= MAX_RUNTIME_ERROR_MESSAGE_LENGTH &&
+		typeof record.recoverable === "boolean"
+	);
+}
+
+function isValidOwnerTerminalRuntimeReceipt(value: unknown, sessionId: string): boolean {
+	const record = asRecord(value);
+	if (!record) return false;
+	const baseKeys = [
+		"generation",
+		"socket_key",
+		"signal",
+		"result",
+		"classification",
+		"observer",
+		"observed_at",
+		"dedupe_key",
+	];
+	const keys = Object.keys(record);
+	if (!keys.every(key => [...baseKeys, "intent_id"].includes(key)) || baseKeys.some(key => !keys.includes(key)))
+		return false;
+	if (
+		!validRuntimeOwnerGeneration(record.generation) ||
+		!validRuntimeOwnerGeneration(record.socket_key) ||
+		typeof record.signal !== "string" ||
+		!["SIGTERM", "SIGHUP", "SIGINT", "SIGKILL", "EXIT", "MANUAL", "UNKNOWN"].includes(record.signal) ||
+		typeof record.result !== "string" ||
+		!record.result ||
+		record.result.length > 64 ||
+		!["expected_operator_shutdown", "unexpected_owner_loss", "non_operator_cleanup"].includes(
+			String(record.classification),
+		) ||
+		!["sidecar", "raw_monitor"].includes(String(record.observer)) ||
+		typeof record.observed_at !== "string" ||
+		!Number.isFinite(Date.parse(record.observed_at)) ||
+		record.dedupe_key !== `owner-loss:${sessionId}:${record.generation}`
+	)
+		return false;
+	if (record.classification === "expected_operator_shutdown")
+		return (
+			record.signal === "SIGTERM" &&
+			record.result === "owner_term_then_session_cleanup" &&
+			typeof record.intent_id === "string" &&
+			record.intent_id.length > 0
+		);
+	if (record.intent_id !== undefined) return false;
+	if (record.classification === "non_operator_cleanup") return record.result === "cleanup";
+	return ["owner_lost", "cleanup", "process_postmortem", "exit", "unknown_terminal"].includes(record.result);
+}
+
+function isValidRuntimeSessionState(value: unknown, sessionId: string): value is RuntimeSessionStatePayload {
+	if (!isValidCoordinatorSessionState(value, sessionId)) return false;
+	const record = asRecord(value);
+	if (!record) return false;
+	const finalResponse = record.final_response;
+	const error = record.error;
+	if (finalResponse !== undefined && !isValidRuntimeFinalResponse(finalResponse)) return false;
+	if (record.source !== "coordinator" && record.live !== (record.state === "running")) return false;
+	if (error !== undefined && error !== null && !isValidRuntimeError(error)) return false;
+	if (record.owner_generation !== undefined && !validRuntimeOwnerGeneration(record.owner_generation)) return false;
+	if (record.source === "coordinator") return finalResponse === undefined && (error === undefined || error === null);
+	if (record.source === "process_postmortem") {
+		if (record.state !== "completed" && record.state !== "errored") return false;
+		if (record.event === "owner_terminal") {
+			if (!isValidOwnerTerminalRuntimeReceipt(record.owner_terminal, sessionId)) return false;
+			const ownerTerminal = asRecord(record.owner_terminal)!;
+			const expected = ownerTerminal.classification === "expected_operator_shutdown";
+			if (
+				record.reason !== ownerTerminal.classification ||
+				record.state !== (expected ? "completed" : "errored") ||
+				(expected
+					? error !== undefined && error !== null
+					: error === undefined ||
+						error === null ||
+						error.code !== ownerTerminal.classification ||
+						error.recoverable !== true)
+			)
+				return false;
+		} else if (record.event === "process_exit") {
+			if (
+				record.owner_terminal !== undefined ||
+				typeof record.exit_kind !== "string" ||
+				record.exit_kind.length === 0 ||
+				record.exit_kind.length > 128 ||
+				(record.exit_code !== null &&
+					(typeof record.exit_code !== "number" || !Number.isSafeInteger(record.exit_code))) ||
+				(record.signal !== null &&
+					record.signal !== "SIGINT" &&
+					record.signal !== "SIGTERM" &&
+					record.signal !== "SIGHUP") ||
+				typeof record.prompt_accepted !== "boolean" ||
+				typeof record.observed_recoverable_worktree_changes !== "boolean" ||
+				(record.worktree_baseline_dirty !== null && typeof record.worktree_baseline_dirty !== "boolean") ||
+				typeof record.worktree_changed_since_baseline !== "boolean"
+			)
+				return false;
+		} else {
+			return false;
+		}
+	}
+	if (record.state === "completed") return error === undefined || error === null;
+	if (record.state === "errored") return error !== undefined && error !== null;
+	return finalResponse === undefined && (error === undefined || error === null);
+}
+
+const PUBLIC_COORDINATOR_ERRORS = new Set([
+	"coordinator_workdir_required",
+	"coordinator_workdir_roots_required",
+	"coordinator_workdir_outside_allowed_roots",
+	"coordinator_artifact_path_required",
+	"coordinator_artifact_roots_required",
+	"coordinator_artifact_outside_allowed_roots",
+	"coordinator_mutation_class_disabled",
+	"coordinator_mutation_call_not_allowed",
+	"invalid_session_id",
+	"invalid_tmux_session",
+	"invalid_tmux_target",
+	"invalid_turn_id",
+	"invalid_question_id",
+	"session_id_conflict",
+	"tmux_session_unavailable",
+	"tmux_target_unavailable",
+	"coordinator_session_command_required",
+	"coordinator_launch_attestation_missing",
+	"coordinator_launch_attestation_mismatch",
+	"coordinator_launch_metadata_missing",
+	"coordinator_readiness_path_invalid",
+	"session_origin_unverified",
+	"coordinator_prompt_buffer_privacy_unverified",
+	"coordinator_tmux_start_failed",
+	"coordinator_tmux_owner_server_unsafe",
+	"coordinator_tmux_owner_server_unverifiable",
+	"coordinator_tmux_owner_server_race",
+	"coordinator_evidence_paths_must_be_array",
+]);
+
+class CoordinatorStartError extends Error {
+	constructor(
+		message: string,
+		readonly cleanupStatus: "cleaned" | "failed" | "unverifiable",
+	) {
+		super(message);
+	}
+}
+
+function publicCleanupStatus(error: unknown): "cleaned" | "failed" | "unverifiable" | undefined {
+	return error instanceof CoordinatorStartError ? error.cleanupStatus : undefined;
+}
+
+function publicCoordinatorError(error: unknown): string {
+	if (error instanceof CoordinatorStateError) return `coordinator_state_${error.reason}`;
+	const message = error instanceof Error ? error.message : "";
+	const normalized = message
+		.replace(/[\u0000-\u001f\u007f]/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+	const code = normalized.split(":", 1)[0];
+	return PUBLIC_COORDINATOR_ERRORS.has(code) ? code : "coordinator_request_failed";
+}
+
+function isExpectedStateAbsence(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
 async function readJsonFile(file: string): Promise<unknown | null> {
+	let content: string;
+	try {
+		content = await fs.readFile(file, "utf8");
+	} catch (error) {
+		if (isExpectedStateAbsence(error)) return null;
+		throw coordinatorStateError("unreadable");
+	}
 	try {
-		return JSON.parse(await fs.readFile(file, "utf8"));
+		return JSON.parse(content);
 	} catch {
-		return null;
+		throw coordinatorStateError("invalid");
 	}
 }
 
@@ -571,15 +1180,16 @@ async function writeJsonFile(file: string, value: unknown): Promise<void> {
 }
 
 async function listJsonFiles(dir: string): Promise<unknown[]> {
+	let entries: string[];
 	try {
-		const entries = await fs.readdir(dir);
-		const values = await Promise.all(
-			entries.filter(entry => entry.endsWith(".json")).map(entry => readJsonFile(path.join(dir, entry))),
-		);
-		return values.filter(value => value !== null);
-	} catch {
-		return [];
+		entries = await fs.readdir(dir);
+	} catch (error) {
+		if (isExpectedStateAbsence(error)) return [];
+		throw coordinatorStateError("unreadable");
 	}
+	return await Promise.all(
+		entries.filter(entry => entry.endsWith(".json")).map(entry => readJsonFile(path.join(dir, entry))),
+	);
 }
 
 const COORDINATOR_STATUS_EVENT_LIMIT = 100;
@@ -667,22 +1277,39 @@ function boundSummary(value: string): string {
 }
 
 async function readLatestEventSeq(namespaceDir: string): Promise<number> {
-	const sequence = asRecord(await readJsonFile(eventSequenceFile(namespaceDir)));
-	const seq = sequence?.seq;
-	if (typeof seq === "number" && Number.isInteger(seq) && seq >= 0) return seq;
-	let latestSeq = 0;
-	for (const event of await readCoordinatorEvents(namespaceDir)) latestSeq = Math.max(latestSeq, event.seq);
-	return latestSeq;
+	const rawSequence = await readJsonFile(eventSequenceFile(namespaceDir));
+	const events = await readCoordinatorEvents(namespaceDir);
+	const journalLatestSeq = events.at(-1)?.seq ?? 0;
+	if (rawSequence === null) return journalLatestSeq;
+	const sequence = asRecord(rawSequence);
+	if (
+		!sequence ||
+		Object.keys(sequence).some(key => key !== "seq" && key !== "updated_at") ||
+		typeof sequence.seq !== "number" ||
+		!Number.isSafeInteger(sequence.seq) ||
+		sequence.seq < 0 ||
+		typeof sequence.updated_at !== "string" ||
+		!Number.isFinite(Date.parse(sequence.updated_at)) ||
+		sequence.seq > journalLatestSeq
+	)
+		throw coordinatorStateError("invalid");
+	return journalLatestSeq;
 }
 
 const eventAppendQueues = new Map<string, Promise<unknown>>();
 
+/** Lock order: namespace transaction lock, then event journal lock. */
+function coordinatorTransactionLockFile(namespaceDir: string): string {
+	return path.join(namespaceDir, "locks", "mutation.lock");
+}
+
+async function withCoordinatorTransaction<T>(namespaceDir: string, operation: () => Promise<T>): Promise<T> {
+	return await withSessionStateLock(coordinatorTransactionLockFile(namespaceDir), operation);
+}
+
 async function appendCoordinatorEvent(namespaceDir: string, input: CoordinatorEventInput): Promise<CoordinatorEvent> {
 	const previous = eventAppendQueues.get(namespaceDir) ?? Promise.resolve();
-	let release!: () => void;
-	const current = new Promise<void>(resolve => {
-		release = resolve;
-	});
+	const { promise: current, resolve: release } = Promise.withResolvers<void>();
 	const queued = previous.then(
 		() => current,
 		() => current,
@@ -691,57 +1318,148 @@ async function appendCoordinatorEvent(namespaceDir: string, input: CoordinatorEv
 
 	await previous.catch(() => undefined);
 	try {
-		const latestSeq = await readLatestEventSeq(namespaceDir);
-		const seq = latestSeq + 1;
-		const timestamp = new Date().toISOString();
-		const event: CoordinatorEvent = {
-			schema_version: 1,
-			seq,
-			id: `event-${seq.toString().padStart(12, "0")}`,
-			timestamp,
-			kind: input.kind,
-			summary: boundSummary(input.summary),
-			...(input.sessionId ? { session_id: input.sessionId } : {}),
-			...(input.turnId ? { turn_id: input.turnId } : {}),
-			...(input.questionId ? { question_id: input.questionId } : {}),
-			...(input.reportId ? { report_id: input.reportId } : {}),
-			...(input.payloadRef ? { payload_ref: input.payloadRef } : {}),
-			...(input.metadata ? { metadata: input.metadata } : {}),
-		};
-		await ensureDir(eventsDir(namespaceDir));
-		await fs.appendFile(eventJournalFile(namespaceDir), `${JSON.stringify(event)}\n`);
-		await writeJsonFile(eventSequenceFile(namespaceDir), { seq, updated_at: timestamp });
-		return event;
+		return await withSessionStateLock(eventJournalFile(namespaceDir), async () => {
+			const latestSeq = await readLatestEventSeq(namespaceDir);
+			const seq = latestSeq + 1;
+			const timestamp = new Date().toISOString();
+			const event: CoordinatorEvent = {
+				schema_version: 1,
+				seq,
+				id: `event-${seq.toString().padStart(12, "0")}`,
+				timestamp,
+				kind: input.kind,
+				summary: boundSummary(input.summary),
+				...(input.sessionId ? { session_id: input.sessionId } : {}),
+				...(input.turnId ? { turn_id: input.turnId } : {}),
+				...(input.questionId ? { question_id: input.questionId } : {}),
+				...(input.reportId ? { report_id: input.reportId } : {}),
+				...(input.payloadRef ? { payload_ref: input.payloadRef } : {}),
+				...(input.metadata ? { metadata: input.metadata } : {}),
+			};
+			await ensureDir(eventsDir(namespaceDir));
+			await fs.appendFile(eventJournalFile(namespaceDir), `${JSON.stringify(event)}\n`);
+			await writeJsonFile(eventSequenceFile(namespaceDir), {
+				seq,
+				updated_at: timestamp,
+			});
+			return event;
+		});
 	} finally {
 		release();
 		if (eventAppendQueues.get(namespaceDir) === queued) eventAppendQueues.delete(namespaceDir);
 	}
 }
 
-function parseCoordinatorEvent(line: string): CoordinatorEvent | null {
+// Per-session mutation lock. Concurrent stdio dispatch (see pumpCoordinatorMcpStream) makes
+// same-session read-modify-write tool calls (notably send_prompt: read active turn → decide →
+// write new turn) interleave, which could persist two "active" turns while only one active-turn
+// pointer survives. Serializing per session — same promise-chain shape as eventAppendQueues —
+// restores the atomicity the former serial read loop provided, without serializing across
+// sessions or blocking long read-only polls (await_turn/watch_events). This is an in-process
+// lock distinct from the file-based withSessionStateLock/withCoordinatorTransaction, so it can
+// never deadlock by nesting inside them.
+const sessionMutationQueues = new Map<string, Promise<unknown>>();
+
+async function withSessionMutation<T>(key: string, fn: () => Promise<T>): Promise<T> {
+	const previous = sessionMutationQueues.get(key) ?? Promise.resolve();
+	const { promise: current, resolve: release } = Promise.withResolvers<void>();
+	const queued = previous.then(
+		() => current,
+		() => current,
+	);
+	sessionMutationQueues.set(key, queued);
+	await previous.catch(() => undefined);
+	try {
+		return await fn();
+	} finally {
+		release();
+		if (sessionMutationQueues.get(key) === queued) sessionMutationQueues.delete(key);
+	}
+}
+
+function parseCoordinatorEvent(line: string): CoordinatorEvent {
+	let event: unknown;
 	try {
-		const event = JSON.parse(line) as CoordinatorEvent;
-		if (typeof event.seq !== "number" || typeof event.kind !== "string") return null;
-		return event;
+		event = JSON.parse(line);
 	} catch {
-		return null;
+		throw coordinatorStateError("invalid");
+	}
+	const record = asRecord(event);
+	const allowed = new Set([
+		"schema_version",
+		"seq",
+		"id",
+		"timestamp",
+		"kind",
+		"session_id",
+		"turn_id",
+		"question_id",
+		"report_id",
+		"summary",
+		"payload_ref",
+		"metadata",
+	]);
+	const metadata = asRecord(record?.metadata);
+	const validMetadata =
+		record?.metadata === undefined && metadata === null
+			? true
+			: metadata !== null &&
+				Object.values(metadata).every(
+					value => value === null || ["string", "number", "boolean"].includes(typeof value),
+				);
+	const validOptionalExternalId = (value: unknown) =>
+		value === undefined || (typeof value === "string" && SAFE_EXTERNAL_ID_PATTERN.test(value));
+	const validPayloadRef =
+		record?.payload_ref === undefined ||
+		(typeof record.payload_ref === "string" &&
+			record.payload_ref.length > 0 &&
+			!path.isAbsolute(record.payload_ref) &&
+			!record.payload_ref.split(/[\\/]/).includes(".."));
+	if (
+		!record ||
+		Object.keys(record).some(key => !allowed.has(key)) ||
+		record.schema_version !== 1 ||
+		typeof record.seq !== "number" ||
+		!Number.isSafeInteger(record.seq) ||
+		record.seq <= 0 ||
+		record.id !== `event-${record.seq.toString().padStart(12, "0")}` ||
+		typeof record.timestamp !== "string" ||
+		!Number.isFinite(Date.parse(record.timestamp)) ||
+		typeof record.kind !== "string" ||
+		!COORDINATOR_EVENT_KINDS.has(record.kind as CoordinatorEventKind) ||
+		typeof record.summary !== "string" ||
+		record.summary.length > 240 ||
+		!validOptionalExternalId(record.session_id) ||
+		(record.turn_id !== undefined && (typeof record.turn_id !== "string" || !TURN_ID_PATTERN.test(record.turn_id))) ||
+		!validOptionalExternalId(record.question_id) ||
+		!validOptionalExternalId(record.report_id) ||
+		!validPayloadRef ||
+		!validMetadata
+	) {
+		throw coordinatorStateError("invalid");
 	}
+	return record as unknown as CoordinatorEvent;
 }
 
 async function readCoordinatorEvents(namespaceDir: string): Promise<CoordinatorEvent[]> {
+	const journalFile = eventJournalFile(namespaceDir);
+	let content: string;
 	try {
-		const content = await fs.readFile(eventJournalFile(namespaceDir), "utf8");
-		return content
-			.split("\n")
-			.map(line => line.trim())
-			.filter(Boolean)
-			.map(parseCoordinatorEvent)
-			.filter((event): event is CoordinatorEvent => event !== null)
-			.sort((left, right) => left.seq - right.seq);
+		content = await fs.readFile(journalFile, "utf8");
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
-		throw error;
+		if (isExpectedStateAbsence(error)) return [];
+		throw coordinatorStateError("unreadable");
+	}
+	const events = content
+		.split("\n")
+		.map(line => line.trim())
+		.filter(Boolean)
+		.map(parseCoordinatorEvent);
+	for (let index = 1; index < events.length; index++) {
+		if (events[index].seq !== events[index - 1].seq + 1) throw coordinatorStateError("invalid");
 	}
+
+	return events;
 }
 
 function boundedEventLimit(value: unknown): number {
@@ -818,6 +1536,33 @@ function safeTmuxTarget(value: unknown): string {
 	return value;
 }
 
+function safeTmuxRuntimeIdentity(value: string): boolean {
+	return value.length > 0 && value.length <= 160 && !/[\s\u0000-\u001f\u007f]/.test(value);
+}
+
+function coordinatorCleanupPredicate(expectedPid: number, nativeSessionId: string, attemptSession: string): string {
+	return `#{&&:#{==:#{pid},${expectedPid}},#{&&:#{==:#{session_id},${nativeSessionId}},#{==:#{session_name},${attemptSession}}}}`;
+}
+
+function parseTmuxNewSessionRecord(
+	stdout: string,
+	sessionName: string,
+): { tmuxTarget: string; paneId: string; nativeSessionId: string } | undefined {
+	const match = /^(\S+) (%\d+) (\$\d+)\n?$/.exec(stdout);
+	if (!match) return undefined;
+	const [tmuxTarget, paneId, nativeSessionId] = match.slice(1);
+	const targetSuffix = tmuxTarget!.slice(`${sessionName}:`.length);
+	if (
+		!tmuxTarget!.startsWith(`${sessionName}:`) ||
+		!/^\d+\.\d+$/.test(targetSuffix) ||
+		!safeTmuxRuntimeIdentity(tmuxTarget!) ||
+		!safeTmuxRuntimeIdentity(paneId!) ||
+		!safeTmuxRuntimeIdentity(nativeSessionId!)
+	)
+		return undefined;
+	return { tmuxTarget: tmuxTarget!, paneId: paneId!, nativeSessionId: nativeSessionId! };
+}
+
 function optionalString(value: unknown): string | null {
 	return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
@@ -846,8 +1591,150 @@ function sessionStateFile(namespaceDir: string, sessionId: string): string {
 	return path.join(namespaceDir, "session-states", `${safeExternalId("session", sessionId)}.json`);
 }
 
+function isTimestamp(value: unknown): value is string {
+	return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+
+function isValidTurnRecord(value: unknown): value is TurnRecord {
+	const turn = asRecord(value);
+	const delivery = asRecord(turn?.delivery);
+	const prompt = asRecord(turn?.prompt);
+	const response = asRecord(turn?.final_response);
+	const liveness = asRecord(turn?.liveness);
+	const namespace = asRecord(turn?.namespace);
+	const statuses: readonly TurnStatus[] = [
+		"queued",
+		"delivering",
+		"active",
+		"waiting_for_answer",
+		"completing",
+		"completed",
+		"failed",
+		"cancelled",
+		"superseded",
+	];
+	if (
+		turn?.schema_version !== 1 ||
+		typeof turn.turn_id !== "string" ||
+		!TURN_ID_PATTERN.test(turn.turn_id) ||
+		typeof turn.session_id !== "string" ||
+		!SAFE_EXTERNAL_ID_PATTERN.test(turn.session_id) ||
+		!namespace ||
+		(namespace.profile !== null && typeof namespace.profile !== "string") ||
+		(namespace.repo !== null && typeof namespace.repo !== "string") ||
+		!statuses.includes(turn.status as TurnStatus)
+	)
+		return false;
+	if (
+		!prompt ||
+		typeof prompt.text !== "string" ||
+		!isTimestamp(prompt.created_at) ||
+		(prompt.source !== "mcp" && prompt.source !== "question_answer")
+	)
+		return false;
+	if (
+		!delivery ||
+		typeof delivery.delivered !== "boolean" ||
+		typeof delivery.queued !== "boolean" ||
+		(delivery.target !== null && typeof delivery.target !== "string") ||
+		(delivery.tmux_keys_sent !== undefined && typeof delivery.tmux_keys_sent !== "boolean") ||
+		(delivery.prompt_acknowledged !== undefined && typeof delivery.prompt_acknowledged !== "boolean") ||
+		(delivery.state !== undefined &&
+			![
+				"queued",
+				"awaiting_runtime_readiness",
+				"delivering",
+				"tmux_keys_sent",
+				"acknowledged",
+				"unavailable",
+				"unacknowledged",
+			].includes(delivery.state as string)) ||
+		!Array.isArray(delivery.attempts) ||
+		!delivery.attempts.every(attempt => {
+			const item = asRecord(attempt);
+			return (
+				item !== null &&
+				typeof item.delivered === "boolean" &&
+				isTimestamp(item.created_at) &&
+				(item.reason === null || typeof item.reason === "string") &&
+				(item.channel === undefined || item.channel === "tmux_keys" || item.channel === "runtime_ack") &&
+				(item.tmux_keys_sent === undefined || typeof item.tmux_keys_sent === "boolean")
+			);
+		})
+	)
+		return false;
+	if (
+		!Array.isArray(turn.question_ids) ||
+		!turn.question_ids.every(id => typeof id === "string" && SAFE_EXTERNAL_ID_PATTERN.test(id)) ||
+		!isValidRuntimeFinalResponse(response) ||
+		!Array.isArray(turn.evidence) ||
+		!turn.evidence.every(item => asRecord(item) !== null) ||
+		(turn.error !== null && !isValidRuntimeError(turn.error))
+	)
+		return false;
+	if (
+		!liveness ||
+		(liveness.checked_at !== null && !isTimestamp(liveness.checked_at)) ||
+		(liveness.live !== null && typeof liveness.live !== "boolean") ||
+		(liveness.reason !== null && typeof liveness.reason !== "string") ||
+		!isTimestamp(turn.created_at) ||
+		!isTimestamp(turn.updated_at) ||
+		(turn.started_at !== null && !isTimestamp(turn.started_at)) ||
+		(turn.completed_at !== null && !isTimestamp(turn.completed_at))
+	)
+		return false;
+	return TERMINAL_TURN_STATUSES.has(turn.status as TurnStatus)
+		? turn.completed_at !== null && (turn.status === "failed" ? turn.error !== null : turn.error === null)
+		: turn.completed_at === null && turn.error === null;
+}
+
+function isValidActiveTurnRecord(
+	value: unknown,
+	sessionId: string,
+): value is {
+	session_id: string;
+	turn_id: string;
+	status: TurnStatus;
+	updated_at: string;
+} {
+	const active = asRecord(value);
+	return (
+		active !== null &&
+		Object.keys(active).every(key => ["session_id", "turn_id", "status", "updated_at"].includes(key)) &&
+		active.session_id === sessionId &&
+		typeof active.turn_id === "string" &&
+		TURN_ID_PATTERN.test(active.turn_id) &&
+		ACTIVE_TURN_STATUSES.has(active.status as TurnStatus) &&
+		isTimestamp(active.updated_at)
+	);
+}
+
 async function readTurnRecord(namespaceDir: string, turnId: unknown): Promise<TurnRecord | null> {
-	return (await readJsonFile(turnFile(namespaceDir, safeTurnId(turnId)))) as TurnRecord | null;
+	const requestedTurnId = safeTurnId(turnId);
+	const value = await readJsonFile(turnFile(namespaceDir, requestedTurnId));
+	if (value === null) return null;
+	if (!isValidTurnRecord(value) || value.turn_id !== requestedTurnId) throw coordinatorStateError("invalid");
+	return value;
+}
+
+async function listTurnRecords(namespaceDir: string): Promise<TurnRecord[]> {
+	let entries: string[];
+	try {
+		entries = await fs.readdir(turnsDir(namespaceDir));
+	} catch (error) {
+		if (isExpectedStateAbsence(error)) return [];
+		throw coordinatorStateError("unreadable");
+	}
+	const records = await Promise.all(
+		entries
+			.filter(entry => entry.endsWith(".json"))
+			.map(async entry => {
+				const turnId = entry.slice(0, -".json".length);
+				if (!TURN_ID_PATTERN.test(turnId)) throw coordinatorStateError("invalid");
+				return await readTurnRecord(namespaceDir, turnId);
+			}),
+	);
+	return records.filter((record): record is TurnRecord => record !== null);
 }
 
 function turnEventKind(status: TurnStatus): CoordinatorEventKind | null {
@@ -863,7 +1750,8 @@ function turnEventKind(status: TurnStatus): CoordinatorEventKind | null {
 }
 
 async function writeTurnRecord(namespaceDir: string, turn: TurnRecord): Promise<void> {
-	const previous = (await readJsonFile(turnFile(namespaceDir, turn.turn_id))) as TurnRecord | null;
+	if (!isValidTurnRecord(turn)) throw coordinatorStateError("invalid");
+	const previous = await readTurnRecord(namespaceDir, turn.turn_id);
 	await writeJsonFile(turnFile(namespaceDir, turn.turn_id), turn);
 	const kind = previous?.status === turn.status ? null : turnEventKind(turn.status);
 	if (kind) {
@@ -883,14 +1771,17 @@ async function writeTurnRecord(namespaceDir: string, turn: TurnRecord): Promise<
 }
 
 async function readActiveTurn(namespaceDir: string, sessionId: string): Promise<TurnRecord | null> {
-	const active = asRecord(await readJsonFile(activeTurnFile(namespaceDir, sessionId)));
-	if (!active || typeof active.turn_id !== "string") return null;
-	const turn = await readTurnRecord(namespaceDir, active.turn_id);
-	if (!turn || turn.session_id !== sessionId || !ACTIVE_TURN_STATUSES.has(turn.status)) return null;
+	const value = await readJsonFile(activeTurnFile(namespaceDir, sessionId));
+	if (value === null) return null;
+	if (!isValidActiveTurnRecord(value, sessionId)) throw coordinatorStateError("invalid");
+	const turn = await readTurnRecord(namespaceDir, value.turn_id);
+	if (!turn || turn.session_id !== sessionId || turn.status !== value.status || !ACTIVE_TURN_STATUSES.has(turn.status))
+		throw coordinatorStateError("invalid");
 	return turn;
 }
 
 async function writeActiveTurn(namespaceDir: string, turn: TurnRecord): Promise<void> {
+	if (!ACTIVE_TURN_STATUSES.has(turn.status)) throw coordinatorStateError("invalid");
 	await writeJsonFile(activeTurnFile(namespaceDir, turn.session_id), {
 		session_id: turn.session_id,
 		turn_id: turn.turn_id,
@@ -900,15 +1791,84 @@ async function writeActiveTurn(namespaceDir: string, turn: TurnRecord): Promise<
 }
 
 async function clearActiveTurn(namespaceDir: string, turn: TurnRecord): Promise<void> {
-	const active = asRecord(await readJsonFile(activeTurnFile(namespaceDir, turn.session_id)));
-	if (active?.turn_id === turn.turn_id) await fs.rm(activeTurnFile(namespaceDir, turn.session_id), { force: true });
+	const value = await readJsonFile(activeTurnFile(namespaceDir, turn.session_id));
+	if (value === null) return;
+	if (!isValidActiveTurnRecord(value, turn.session_id)) throw coordinatorStateError("invalid");
+	if (value.turn_id === turn.turn_id) await fs.rm(activeTurnFile(namespaceDir, turn.session_id), { force: true });
 }
 
 async function readSessionState(namespaceDir: string, sessionId: string): Promise<CoordinatorSessionState | null> {
-	return (await readJsonFile(sessionStateFile(namespaceDir, sessionId))) as CoordinatorSessionState | null;
+	const value = await readJsonFile(sessionStateFile(namespaceDir, sessionId));
+	if (value === null) return null;
+	if (!isValidRuntimeSessionState(value, sessionId)) throw coordinatorStateError("invalid");
+	return value;
 }
 
-async function writeSessionState(
+function validRuntimeOwnerGeneration(value: unknown): value is string {
+	return (
+		typeof value === "string" && value.length > 0 && value.length <= 256 && !/[\s\u0000-\u001f\u007f]/.test(value)
+	);
+}
+
+function runtimeStateMatchesPrivateOwnerGeneration(
+	sessionState: CoordinatorSessionState,
+	session: Record<string, unknown> | null,
+): boolean {
+	const expectedGeneration = session?.tmux_owner_generation ?? session?.tmuxOwnerGeneration;
+	if (expectedGeneration === undefined)
+		return !(sessionState.source === "process_postmortem" && sessionState.event === "owner_terminal");
+	if (!validRuntimeOwnerGeneration(expectedGeneration) || sessionState.owner_generation !== expectedGeneration)
+		return false;
+	if (sessionState.source !== "process_postmortem") return true;
+	if (sessionState.event !== "owner_terminal") return false;
+	const expectedSocketKey = session?.tmux_owner_server_key ?? session?.tmuxOwnerServerKey;
+	return (
+		typeof expectedSocketKey === "string" &&
+		sessionState.owner_terminal?.generation === expectedGeneration &&
+		sessionState.owner_terminal.socket_key === expectedSocketKey
+	);
+}
+
+async function reconcileTerminalRuntimeEvidence(namespaceDir: string, sessionId: string): Promise<boolean> {
+	const sessionState = await readSessionState(namespaceDir, sessionId);
+	if (
+		!sessionState ||
+		sessionState.source === "coordinator" ||
+		(sessionState.state !== "completed" && sessionState.state !== "errored")
+	)
+		return false;
+	const session = asRecord(await readJsonFile(path.join(namespaceDir, "sessions", `${sessionId}.json`)));
+	if (!runtimeStateMatchesPrivateOwnerGeneration(sessionState, session)) return false;
+
+	const activeTurn = await readActiveTurn(namespaceDir, sessionId);
+	if (activeTurn && (sessionState.current_turn_id === null || sessionState.current_turn_id === activeTurn.turn_id)) {
+		await markTurnTerminalFromSessionState(namespaceDir, activeTurn, sessionState);
+	}
+	return true;
+}
+
+async function preflightCoordinatorMutation(
+	namespaceDir: string,
+	sessionId?: string,
+	options: { rejectTerminalRuntimeEvidence?: boolean } = {},
+): Promise<void> {
+	await readLatestEventSeq(namespaceDir);
+	if (!sessionId) return;
+	const [sessionState, session] = await Promise.all([
+		readSessionState(namespaceDir, sessionId),
+		readJsonFile(path.join(namespaceDir, "sessions", `${sessionId}.json`)),
+	]);
+	const sessionRecord = asRecord(session);
+	if (sessionRecord && normalizeSession(sessionRecord).session_id !== sessionId)
+		throw coordinatorStateError("invalid");
+	if (sessionState && sessionState.session_id !== sessionId) throw coordinatorStateError("invalid");
+	await readActiveTurn(namespaceDir, sessionId);
+	const terminalRuntimeEvidence = await reconcileTerminalRuntimeEvidence(namespaceDir, sessionId);
+	if (terminalRuntimeEvidence && options.rejectTerminalRuntimeEvidence !== false)
+		throw coordinatorStateError("invalid");
+}
+
+async function writeSessionStateUnlocked(
 	namespaceDir: string,
 	sessionId: string,
 	state: CoordinatorSessionStateValue,
@@ -921,6 +1881,20 @@ async function writeSessionState(
 	} = {},
 ): Promise<CoordinatorSessionState> {
 	const previous = await readSessionState(namespaceDir, sessionId);
+	if (previous && previous.source !== "coordinator") return previous;
+	const session = asRecord(await readJsonFile(path.join(namespaceDir, "sessions", `${sessionId}.json`)));
+	const previousCwd = typeof previous?.cwd === "string" && previous.cwd.trim() ? previous.cwd : null;
+	const cwd =
+		typeof session?.cwd === "string" && session.cwd.trim()
+			? path.resolve(session.cwd)
+			: previousCwd
+				? path.resolve(previousCwd)
+				: null;
+	if (!cwd) throw coordinatorStateError("invalid");
+	const sessionFile =
+		typeof session?.session_file === "string" && session.session_file.trim()
+			? path.resolve(session.session_file)
+			: null;
 	const payload: CoordinatorSessionState = {
 		schema_version: 1,
 		session_id: sessionId,
@@ -932,6 +1906,9 @@ async function writeSessionState(
 		source: options.source ?? "coordinator",
 		live: options.live ?? previous?.live ?? null,
 		reason: options.reason ?? null,
+		cwd,
+		workdir: cwd,
+		session_file: sessionFile,
 	};
 	await writeJsonFile(sessionStateFile(namespaceDir, sessionId), payload);
 	if (
@@ -959,31 +1936,196 @@ async function writeSessionState(
 	return payload;
 }
 
-function hasTmuxIdentity(session: Record<string, unknown>): boolean {
-	return (
+interface SessionStateLockOwner {
+	pid: number;
+	start_time: string;
+	token: string;
+}
+
+function processStartTime(pid: number): string | null {
+	try {
+		const stat = nodeFs.readFileSync(`/proc/${pid}/stat`, "utf8");
+		const close = stat.lastIndexOf(")");
+		const fields = stat
+			.slice(close + 1)
+			.trim()
+			.split(/\s+/);
+		return fields[19] ?? null;
+	} catch {
+		return null;
+	}
+}
+
+function validLockOwner(value: unknown): value is SessionStateLockOwner {
+	if (!value || typeof value !== "object") return false;
+	const owner = value as Partial<SessionStateLockOwner>;
+	return (
+		typeof owner.pid === "number" &&
+		Number.isSafeInteger(owner.pid) &&
+		owner.pid > 0 &&
+		typeof owner.start_time === "string" &&
+		typeof owner.token === "string" &&
+		owner.token.length > 0
+	);
+}
+
+function lockOwnerIsAlive(value: unknown): boolean {
+	if (!validLockOwner(value)) return false;
+	const owner = value;
+	try {
+		process.kill(owner.pid, 0);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ESRCH") return false;
+		return true;
+	}
+	const currentStartTime = processStartTime(owner.pid);
+	return currentStartTime === null || currentStartTime === owner.start_time;
+}
+
+async function reclaimStaleSessionStateLock(lockFile: string): Promise<void> {
+	let raw: string;
+	try {
+		raw = await fs.readFile(lockFile, "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+		throw error;
+	}
+	let owner: unknown;
+	try {
+		owner = JSON.parse(raw);
+	} catch {
+		owner = null;
+	}
+	if (!validLockOwner(owner)) {
+		const stat = await fs.stat(lockFile);
+		if (Date.now() - stat.mtimeMs < 30_000) return;
+	} else if (lockOwnerIsAlive(owner)) return;
+	try {
+		if ((await fs.readFile(lockFile, "utf8")) === raw) await fs.rm(lockFile);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+}
+
+async function withSessionStateLock<T>(stateFile: string, operation: () => Promise<T>): Promise<T> {
+	const lockFile = `${stateFile}.lock`;
+	const owner: SessionStateLockOwner = {
+		pid: process.pid,
+		start_time: processStartTime(process.pid) ?? "unknown",
+		token: randomUUID(),
+	};
+	await ensureDir(path.dirname(stateFile));
+	for (let attempt = 0; attempt < 12_000; attempt++) {
+		let handle: fs.FileHandle | undefined;
+		try {
+			handle = await fs.open(lockFile, "wx");
+			try {
+				await handle.writeFile(JSON.stringify(owner));
+			} catch (error) {
+				await handle.close().catch(() => undefined);
+				handle = undefined;
+				await fs.rm(lockFile, { force: true }).catch(() => undefined);
+				throw error;
+			}
+			const outcome = await operation().then(
+				value => ({ ok: true as const, value }),
+				error => ({ ok: false as const, error }),
+			);
+			await handle.close();
+			try {
+				if ((await fs.readFile(lockFile, "utf8")) === JSON.stringify(owner)) await fs.rm(lockFile);
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+			}
+			if (!outcome.ok) throw outcome.error;
+			return outcome.value;
+		} catch (error) {
+			if (handle) throw error;
+			if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw coordinatorStateError("unreadable");
+			await reclaimStaleSessionStateLock(lockFile);
+			await Bun.sleep(5);
+		}
+	}
+	throw coordinatorStateError("unreadable");
+}
+
+async function writeSessionState(
+	namespaceDir: string,
+	sessionId: string,
+	state: CoordinatorSessionStateValue,
+	options: {
+		currentTurnId?: string | null;
+		lastTurnId?: string | null;
+		live?: boolean | null;
+		reason?: string | null;
+		source?: CoordinatorSessionState["source"];
+	} = {},
+): Promise<CoordinatorSessionState> {
+	const file = sessionStateFile(namespaceDir, sessionId);
+	return await withSessionStateLock(
+		file,
+		async () => await writeSessionStateUnlocked(namespaceDir, sessionId, state, options),
+	);
+}
+
+function hasTmuxIdentity(session: Record<string, unknown>): boolean {
+	return (
 		(typeof session.tmux_session === "string" && session.tmux_session.length > 0) ||
 		(typeof session.tmuxSession === "string" && session.tmuxSession.length > 0)
 	);
 }
 
+function unavailableSessionReason(turn: TurnRecord, reason: string): string {
+	if (
+		reason === "tmux_session_missing" &&
+		turn.delivery.tmux_keys_sent === true &&
+		turn.delivery.prompt_acknowledged === true
+	) {
+		return "tmux_session_missing_after_prompt_acknowledgement";
+	}
+	return reason;
+}
+
+function unavailableSessionEvidence(turn: TurnRecord, reason: string, timestamp: string): Record<string, unknown>[] {
+	if (reason !== "tmux_session_missing_after_prompt_acknowledgement") return turn.evidence;
+	return [
+		...turn.evidence,
+		{
+			type: reason,
+			message:
+				"The tmux session disappeared after SKC runtime acknowledged the prompt, before any terminal final_response or error was recorded. Treat this as an in-flight vanished session and inspect/restart with recovery evidence rather than resubmitting blindly.",
+			tmux_keys_sent: true,
+			prompt_acknowledged: true,
+			prior_status: turn.status,
+			created_at: timestamp,
+		},
+	];
+}
+
 async function markTurnFailedForUnavailableSession(
 	namespaceDir: string,
 	turn: TurnRecord,
 	reason: string,
 ): Promise<TurnRecord> {
 	const timestamp = new Date().toISOString();
+	const durableReason = unavailableSessionReason(turn, reason);
 	const failed: TurnRecord = {
 		...turn,
 		status: "failed",
 		final_response: {
-			text: `Coordinator session unavailable: ${reason}`,
+			text: `Coordinator session unavailable: ${durableReason}`,
 			format: "markdown",
 			source: "coordinator_liveness",
 			artifact_path: null,
 			truncated: false,
 		},
-		error: { code: "session_unavailable", message: reason, recoverable: true },
-		liveness: { checked_at: timestamp, live: false, reason },
+		evidence: unavailableSessionEvidence(turn, durableReason, timestamp),
+		error: {
+			code: "session_unavailable",
+			message: durableReason,
+			recoverable: true,
+		},
+		liveness: { checked_at: timestamp, live: false, reason: durableReason },
 		updated_at: timestamp,
 		completed_at: timestamp,
 	};
@@ -992,7 +2134,7 @@ async function markTurnFailedForUnavailableSession(
 	await writeSessionState(namespaceDir, failed.session_id, "stale", {
 		lastTurnId: failed.turn_id,
 		live: false,
-		reason,
+		reason: durableReason,
 	});
 	return failed;
 }
@@ -1092,6 +2234,18 @@ async function markTurnAcknowledgedFromRuntimeState(
 	};
 	await writeTurnRecord(namespaceDir, acknowledged);
 	await writeActiveTurn(namespaceDir, acknowledged);
+	await appendCoordinatorEvent(namespaceDir, {
+		kind: "turn.acknowledged",
+		sessionId: acknowledged.session_id,
+		turnId: acknowledged.turn_id,
+		summary: `Turn ${acknowledged.turn_id} was acknowledged by the SKC runtime`,
+		payloadRef: path.relative(namespaceDir, turnFile(namespaceDir, acknowledged.turn_id)),
+		metadata: {
+			status: acknowledged.status,
+			tmux_keys_sent: acknowledged.delivery.tmux_keys_sent ?? null,
+			prompt_acknowledged: true,
+		},
+	});
 	return acknowledged;
 }
 
@@ -1151,7 +2305,11 @@ async function markTurnFailedForUnacknowledgedDelivery(
 				created_at: timestamp,
 			},
 		],
-		liveness: { checked_at: timestamp, live: turn.liveness.live, reason: PROMPT_ACK_TIMEOUT_REASON },
+		liveness: {
+			checked_at: timestamp,
+			live: turn.liveness.live,
+			reason: PROMPT_ACK_TIMEOUT_REASON,
+		},
 		updated_at: timestamp,
 		completed_at: timestamp,
 	};
@@ -1172,6 +2330,16 @@ async function reconcileRuntimeAcknowledgement(
 	ackTimeoutMs: number,
 	options: { failOnTimeout: boolean } = { failOnTimeout: true },
 ): Promise<TurnRecord> {
+	const session = asRecord(await readJsonFile(path.join(namespaceDir, "sessions", `${turn.session_id}.json`)));
+	if (
+		sessionState &&
+		runtimeStateMatchesPrivateOwnerGeneration(sessionState, session) &&
+		sessionState.source !== "coordinator" &&
+		(sessionState.state === "completed" || sessionState.state === "errored") &&
+		(sessionState.current_turn_id === null || sessionState.current_turn_id === turn.turn_id)
+	) {
+		return await markTurnTerminalFromSessionState(namespaceDir, turn, sessionState);
+	}
 	if (sessionState && runtimeStateAcknowledgesTurn(turn, sessionState)) {
 		return await markTurnAcknowledgedFromRuntimeState(namespaceDir, turn, sessionState);
 	}
@@ -1184,6 +2352,27 @@ async function reconcileRuntimeAcknowledgement(
 function shellQuote(value: string): string {
 	return `'${value.replaceAll("'", "'\\''")}'`;
 }
+
+/**
+ * Append an authoritative `--mpreset <profile>` to the coordinator child launch
+ * command so the spawned SKC session activates the selected profile from its
+ * first turn. The profile name is validated against the merged registry before
+ * reaching here; it is still shell-quoted as defense in depth.
+ *
+ * Precedence note: this matches `skc --mpreset <profile>` semantics exactly, so
+ * an explicit model-affecting flag already present in the operator-configured
+ * `sessionCommand` (e.g. a `--model`/`--thinking` baked into the launch command)
+ * follows the same CLI precedence as a direct `skc --mpreset ... --model ...`
+ * invocation. The effective profile recorded on the session is the
+ * coordinator-resolved request, not a child-attested activation receipt; a
+ * cross-process activation receipt is a possible future enhancement and is out
+ * of scope for the per-session selection contract here.
+ */
+export function buildCoordinatorSessionCommand(sessionCommand: string, mpreset: string | null | undefined): string {
+	if (!mpreset) return sessionCommand;
+	return `${sessionCommand} --mpreset ${shellQuote(mpreset)}`;
+}
+
 function makeTurnRecord(
 	config: CoordinatorMcpConfig,
 	sessionId: string,
@@ -1208,7 +2397,13 @@ function makeTurnRecord(
 			attempts: [],
 		},
 		question_ids: [],
-		final_response: { text: null, format: "markdown", source: null, artifact_path: null, truncated: false },
+		final_response: {
+			text: null,
+			format: "markdown",
+			source: null,
+			artifact_path: null,
+			truncated: false,
+		},
 		evidence: [],
 		error: null,
 		liveness: { checked_at: null, live: null, reason: null },
@@ -1230,6 +2425,8 @@ function asTerminalTurnStatus(status: unknown): TurnStatus | null {
 
 export const COORDINATOR_AWAIT_TURN_TIMEOUT_MAX_MS = 30 * 60 * 1000;
 export const COORDINATOR_RUNTIME_PROMPT_ACK_TIMEOUT_MAX_MS = MAX_RUNTIME_PROMPT_ACK_TIMEOUT_MS;
+export const COORDINATOR_RUNTIME_READINESS_TIMEOUT_MAX_MS = MAX_RUNTIME_READINESS_TIMEOUT_MS;
+
 export const COORDINATOR_EVENT_WATCH_TIMEOUT_MAX_MS = 30_000;
 export const COORDINATOR_POLL_INTERVAL_MAX_MS = 10_000;
 
@@ -1248,6 +2445,12 @@ export function boundedRuntimePromptAckTimeoutMs(value: unknown): number {
 		COORDINATOR_RUNTIME_PROMPT_ACK_TIMEOUT_MAX_MS,
 	);
 }
+export function boundedRuntimeReadinessTimeoutMs(value: unknown): number {
+	return Math.min(
+		parsePositiveIntegerMs(value, DEFAULT_RUNTIME_READINESS_TIMEOUT_MS),
+		COORDINATOR_RUNTIME_READINESS_TIMEOUT_MAX_MS,
+	);
+}
 
 export function boundedEventWatchTimeoutMs(value: unknown): number {
 	return Math.min(parsePositiveIntegerMs(value, 1000), COORDINATOR_EVENT_WATCH_TIMEOUT_MAX_MS);
@@ -1256,8 +2459,21 @@ export function boundedEventWatchTimeoutMs(value: unknown): number {
 export function boundedPollIntervalMs(value: unknown): number {
 	return Math.min(Math.max(parsePositiveIntegerMs(value, 100), 10), COORDINATOR_POLL_INTERVAL_MAX_MS);
 }
-async function runCommand(command: string[]): Promise<{ exitCode: number; stdout: string; stderr: string }> {
-	const proc = Bun.spawn(command, { stdout: "pipe", stderr: "pipe" });
+async function runCommand(
+	command: string[],
+	stdinLine?: string,
+): Promise<{ exitCode: number; stdout: string; stderr: string }> {
+	const proc = Bun.spawn(command, {
+		stdin: stdinLine === undefined ? "ignore" : "pipe",
+		stdout: "pipe",
+		stderr: "pipe",
+	});
+	if (stdinLine !== undefined) {
+		const stdin = proc.stdin;
+		if (!stdin) throw new Error("coordinator_command_stdin_unavailable");
+		stdin.write(`${stdinLine}\n`);
+		stdin.end();
+	}
 	const [stdout, stderr, exitCode] = await Promise.all([
 		new Response(proc.stdout).text(),
 		new Response(proc.stderr).text(),
@@ -1266,15 +2482,39 @@ async function runCommand(command: string[]): Promise<{ exitCode: number; stdout
 	return { exitCode, stdout, stderr };
 }
 
-type CommandRunner = (command: string[]) => Promise<{ exitCode: number; stdout: string; stderr: string }>;
-
 async function sendTmuxPromptKeys(
 	target: string,
 	prompt: string,
-	runner: CommandRunner = runCommand,
+	runner: CommandRunner,
+	socketKey: string,
+	proveCurrentServer: () => Promise<boolean>,
 ): Promise<boolean> {
-	const sent = await runner(["tmux", "send-keys", "-t", target, prompt, "C-m", "C-m"]);
-	return sent.exitCode === 0;
+	const runMutation = async (argv: string[]): Promise<CommandResult | null> => {
+		if (!(await proveCurrentServer())) return null;
+		return await runner(argv);
+	};
+	const bufferName = `skc-coordinator-prompt-${randomUUID()}`;
+	const tmux = ["tmux", "-L", socketKey];
+	const zeroize = async (): Promise<boolean> => {
+		for (let attempt = 0; attempt < 2; attempt++) {
+			const cleared = await runMutation([...tmux, "set-buffer", "-b", bufferName, "--", ""]);
+			const deleted =
+				cleared?.exitCode === 0 ? await runMutation([...tmux, "delete-buffer", "-b", bufferName]) : null;
+			if (cleared?.exitCode === 0 && deleted?.exitCode === 0) return true;
+		}
+		return false;
+	};
+	const buffered = await runMutation([...tmux, "set-buffer", "-b", bufferName, "--", prompt]);
+	if (buffered?.exitCode !== 0) return false;
+	const pasted = await runMutation([...tmux, "paste-buffer", "-d", "-b", bufferName, "-t", target]);
+	if (pasted?.exitCode !== 0) {
+		if (!(await zeroize())) throw new Error("coordinator_prompt_buffer_privacy_unverified");
+		return false;
+	}
+	const dismissedAutocomplete = await runMutation([...tmux, "send-keys", "-t", target, "Escape"]);
+	if (dismissedAutocomplete?.exitCode !== 0) return false;
+	const submitted = await runMutation([...tmux, "send-keys", "-t", target, "Enter"]);
+	return submitted?.exitCode === 0;
 }
 
 function boundedLineCount(value: unknown): number {
@@ -1299,7 +2539,10 @@ async function registerExistingTmuxSession(
 	namespaceDir: string,
 	sessionFilePath: string,
 	runner: CommandRunner = runCommand,
-): Promise<{ session: Record<string, unknown>; sessionState: CoordinatorSessionState }> {
+): Promise<{
+	session: Record<string, unknown>;
+	sessionState: CoordinatorSessionState;
+}> {
 	await assertTmuxTargetAvailable(input.tmuxSession, input.tmuxTarget, runner);
 	const existing = asRecord(await readJsonFile(sessionFilePath));
 	if (existing) {
@@ -1325,6 +2568,7 @@ async function registerExistingTmuxSession(
 		authoritative: true,
 		warp_attached: input.warpAttached,
 		source: input.source,
+		origin: "registered",
 		model: input.model,
 	};
 	await writeJsonFile(sessionFilePath, session);
@@ -1335,52 +2579,406 @@ async function registerExistingTmuxSession(
 	return { session, sessionState: state };
 }
 
+async function portableProcessStartTime(pid: number, runner: CommandRunner): Promise<string | null> {
+	const result = await runner(["ps", "-o", "lstart=", "-p", String(pid)]);
+	const startTime = result.stdout.trim();
+	return result.exitCode === 0 &&
+		startTime.length > 0 &&
+		startTime.length <= 160 &&
+		!/[\r\n\u0000-\u001f\u007f]/.test(startTime)
+		? startTime
+		: null;
+}
+
+export async function coordinatorOwnerIsolationProbe(runner: CommandRunner): Promise<OwnerIsolationProbe> {
+	return {
+		readCallerCgroup: async () => await fs.readFile("/proc/self/cgroup", "utf8").catch(() => null),
+		probeServer: async (socketKey): Promise<TmuxServerProof> => {
+			try {
+				const result = await runner(["tmux", "-L", socketKey, "list-sessions", "-F", "#{pid} #{session_name}"]);
+				if (result.exitCode !== 0) {
+					const diagnostic = `${result.stdout}\n${result.stderr}`.slice(0, 512);
+					return /(?:no server running|failed to connect to server|no sessions|error connecting to)/i.test(
+						diagnostic,
+					)
+						? { state: "absent" }
+						: { state: "unverifiable" };
+				}
+				const rows = result.stdout
+					.split("\n")
+					.map(line => line.trim().split(/\s+/, 2))
+					.filter(([pid, name]) => Boolean(pid && name));
+				const pid = Number(rows[0]?.[0]);
+				const sessionNames = rows.map(([, name]) => name as string);
+				if (!Number.isSafeInteger(pid) || pid <= 0 || rows.some(([rowPid]) => Number(rowPid) !== pid))
+					return { state: "unverifiable" };
+				const stat =
+					process.platform === "linux" ? await fs.readFile(`/proc/${pid}/stat`, "utf8").catch(() => null) : null;
+				const startTime =
+					process.platform === "linux"
+						? ownerProcessStartTime(process.platform, stat)
+						: await portableProcessStartTime(pid, runner);
+				if (!startTime) return { state: "unverifiable", pid, sessionNames };
+				if (process.platform !== "linux")
+					return {
+						state: "safe",
+						pid,
+						startTime,
+						sessionNames,
+						cgroup: { classification: "not_applicable" },
+					};
+				const cgroupText = await fs.readFile(`/proc/${pid}/cgroup`, "utf8").catch(() => null);
+				const cgroup = classifyCgroup({ platform: process.platform, cgroupText });
+				return {
+					state:
+						cgroup.classification === "safe"
+							? "safe"
+							: cgroup.classification === "unsafe_service"
+								? "unsafe"
+								: "unverifiable",
+					pid,
+					startTime,
+					sessionNames,
+					cgroup,
+				};
+			} catch {
+				// A transient spawn failure (e.g. EAGAIN under load, or a momentary tmux/ps hiccup)
+				// must not fatally abort the owner-server proof. Surfacing it as an unverifiable state
+				// lets proveCoordinatorOwnerServer's bounded retry loop re-probe once the transient
+				// clears, instead of propagating the throw and failing the entire delegate outright.
+				return { state: "unverifiable" };
+			}
+		},
+	};
+}
+
+async function proveCoordinatorOwnerServer(probe: OwnerIsolationProbe, socketKey: string): Promise<TmuxServerProof> {
+	for (let attempt = 0; attempt < 50; attempt++) {
+		const proof = await probe.probeServer(socketKey);
+		if (proof.state === "unsafe" || (proof.state === "safe" && proof.pid && proof.startTime)) return proof;
+		if (attempt < 49) await Bun.sleep(10);
+	}
+	return { state: "unverifiable" };
+}
+
 async function startTmuxSession(
 	config: CoordinatorMcpConfig,
 	input: SessionStartInput,
 	namespaceDir: string,
 	runner: CommandRunner = runCommand,
+	ownerIsolationProbe?: OwnerIsolationProbe,
 ): Promise<Record<string, unknown>> {
 	if (!config.sessionCommand) throw new Error("coordinator_session_command_required");
-	const sessionName = `skc-coordinator-${randomUUID().slice(0, 8)}`;
+	const sessionName = input.sessionId;
+	const socketKey = `skc-coordinator-${randomUUID().slice(0, 8)}`;
+	const ownerStateDir = namespaceDir;
+	const ownerGeneration = randomUUID();
+	const generationBaseline = captureOwnerGenerationBaselineSync(ownerStateDir, sessionName);
 	const runtimeStateFile = sessionStateFile(namespaceDir, sessionName);
 	const sessionCommand = [
 		"exec env",
 		`${SKC_COORDINATOR_SESSION_STATE_FILE_ENV}=${shellQuote(runtimeStateFile)}`,
 		`${SKC_COORDINATOR_SESSION_ID_ENV}=${shellQuote(sessionName)}`,
-		config.sessionCommand,
+		`${SKC_TMUX_OWNER_GENERATION_ENV}=${shellQuote(ownerGeneration)}`,
+		`${SKC_TMUX_OWNER_STATE_DIR_ENV}=${shellQuote(ownerStateDir)}`,
+		`${SKC_TMUX_OWNER_SERVER_KEY_ENV}=${shellQuote(socketKey)}`,
+		`${SKC_COORDINATOR_SESSION_LAUNCH_ID_ENV}=${shellQuote(input.launchId)}`,
+		`${SKC_COORDINATOR_SESSION_READINESS_FILE_ENV}=${shellQuote(input.readinessMarkerFile)}`,
+		buildCoordinatorSessionCommand(config.sessionCommand, input.mpreset),
 	].join(" ");
-	const started = await runner([
+	const tmuxArgv = [
 		"tmux",
+		"-L",
+		socketKey,
 		"new-session",
 		"-d",
 		"-P",
 		"-F",
-		"#{session_name}:#{window_index}.#{pane_index} #{pane_id}",
+		"#{session_name}:#{window_index}.#{pane_index} #{pane_id} #{session_id}",
 		"-s",
 		sessionName,
 		"-c",
 		input.cwd,
 		sessionCommand,
-	]);
-	if (started.exitCode !== 0) throw new Error(`coordinator_tmux_start_failed:${started.stderr || started.stdout}`);
-	const [tmuxTarget, paneId] = started.stdout.trim().split(/\s+/, 2);
+	];
+	const probe = ownerIsolationProbe ?? (await coordinatorOwnerIsolationProbe(runner));
+	let plan = await planTmuxOwnerIsolation(
+		{
+			schema_version: 1,
+			op: "plan",
+			platform: process.platform,
+			session_id: sessionName,
+			owner_generation: ownerGeneration,
+			baseline: generationBaseline,
+			cwd: input.cwd,
+			state_dir: ownerStateDir,
+			socket_key: socketKey,
+			tmux_argv: tmuxArgv,
+		},
+		probe,
+	);
+	if (!plan.ok) throw new Error(`coordinator_tmux_owner_${plan.code}`);
+	if (plan.execution.mode === "direct" && plan.execution.server_absent_before) {
+		plan = await planTmuxOwnerIsolation(
+			{
+				schema_version: 1,
+				op: "plan",
+				platform: process.platform,
+				session_id: sessionName,
+				owner_generation: ownerGeneration,
+				baseline: generationBaseline,
+				cwd: input.cwd,
+				state_dir: ownerStateDir,
+				socket_key: socketKey,
+				tmux_argv: tmuxArgv,
+			},
+			{
+				...probe,
+				readCallerCgroup: async () => "0::/skc-coordinator-bootstrap.service",
+			},
+		);
+		if (!plan.ok) throw new Error(`coordinator_tmux_owner_${plan.code}`);
+	}
+	const preSpawnProof =
+		plan.execution.mode === "direct" && plan.server_state === "safe"
+			? await proveCoordinatorOwnerServer(probe, socketKey)
+			: null;
+	if (
+		preSpawnProof &&
+		(preSpawnProof.state !== "safe" ||
+			!preSpawnProof.pid ||
+			!preSpawnProof.startTime ||
+			(process.platform === "linux" && preSpawnProof.cgroup?.classification !== "safe"))
+	)
+		throw new Error("coordinator_tmux_owner_server_unverifiable");
+	const started = await runner(
+		plan.execution.argv,
+		plan.execution.mode === "scoped" ? plan.execution.stdin_line : undefined,
+	);
+
+	const rawScopedReceipt =
+		plan.execution.mode === "scoped" && isExactScopedBootstrapSuccessReceipt(started.stdout)
+			? (JSON.parse(started.stdout.trim()) as {
+					native_session_id: string;
+					server_pid: number;
+					server_start_time: string;
+					session_name: string;
+				})
+			: undefined;
+	const scopedReceipt =
+		rawScopedReceipt?.session_name === plan.execution.attempt_session ? rawScopedReceipt : undefined;
+	const directReceipt =
+		plan.execution.mode === "direct"
+			? parseTmuxNewSessionRecord(started.stdout, plan.execution.attempt_session)
+			: undefined;
+	const directNativeSessionId = directReceipt?.nativeSessionId;
+	const spawnedNativeSessionId = scopedReceipt?.native_session_id ?? directNativeSessionId;
+	let expectedServer = scopedReceipt
+		? {
+				pid: scopedReceipt.server_pid,
+				startTime: scopedReceipt.server_start_time,
+			}
+		: preSpawnProof && preSpawnProof.state === "safe" && preSpawnProof.pid && preSpawnProof.startTime
+			? { pid: preSpawnProof.pid, startTime: preSpawnProof.startTime }
+			: undefined;
+	const cleanupFailedAttempt = async (): Promise<"cleaned" | "failed" | "unverifiable"> => {
+		if (!spawnedNativeSessionId || !expectedServer) return "unverifiable";
+		try {
+			const result = await runner([
+				"tmux",
+				"-L",
+				socketKey,
+				"if-shell",
+				"-t",
+				spawnedNativeSessionId,
+				"-F",
+				coordinatorCleanupPredicate(expectedServer.pid, spawnedNativeSessionId, plan.execution.attempt_session),
+				`kill-session -t '${spawnedNativeSessionId}' ; display-message -p __skc_coordinator_cleanup_ok__`,
+				"display-message -p __skc_coordinator_cleanup_refused__",
+			]);
+			if (result.exitCode !== 0) return "failed";
+			return result.stdout.trim() === "__skc_coordinator_cleanup_ok__" ? "cleaned" : "unverifiable";
+		} catch {
+			return "unverifiable";
+		}
+	};
+	const failAfterCleanup = async (reason: string): Promise<never> => {
+		throw new CoordinatorStartError(reason, await cleanupFailedAttempt());
+	};
+	if (started.exitCode !== 0) return await failAfterCleanup("coordinator_tmux_start_failed");
+	const bootstrapReceiptValid = plan.execution.mode !== "scoped" || scopedReceipt !== undefined;
+	const initialProof = await proveCoordinatorOwnerServer(probe, socketKey).catch(error =>
+		failAfterCleanup(error instanceof Error ? error.message : "coordinator_tmux_owner_server_unverifiable"),
+	);
+	if (
+		initialProof.state !== "safe" ||
+		!initialProof.pid ||
+		!initialProof.startTime ||
+		(process.platform === "linux" && initialProof.cgroup?.classification !== "safe")
+	) {
+		return await failAfterCleanup("coordinator_tmux_owner_server_unverifiable");
+	}
+	if (
+		scopedReceipt &&
+		(initialProof.pid !== scopedReceipt.server_pid || initialProof.startTime !== scopedReceipt.server_start_time)
+	) {
+		return await failAfterCleanup("coordinator_tmux_owner_server_race");
+	}
+	if (
+		preSpawnProof &&
+		(initialProof.pid !== preSpawnProof.pid || initialProof.startTime !== preSpawnProof.startTime)
+	) {
+		return await failAfterCleanup("coordinator_tmux_owner_server_race");
+	}
+	if (!expectedServer)
+		expectedServer = {
+			pid: initialProof.pid,
+			startTime: initialProof.startTime,
+		};
+	if (!bootstrapReceiptValid) {
+		return await failAfterCleanup("coordinator_tmux_start_failed");
+	}
+
+	const startRecord = await (async () => {
+		const queried = await runner([
+			"tmux",
+			"-L",
+			socketKey,
+			"display-message",
+			"-p",
+			"-t",
+			sessionName,
+			"#{session_name}:#{window_index}.#{pane_index} #{pane_id} #{session_id}",
+		]);
+		if (queried.exitCode !== 0) throw new Error("coordinator_tmux_start_failed");
+		return queried.stdout.trim();
+	})().catch(error => failAfterCleanup(error instanceof Error ? error.message : "coordinator_tmux_start_failed"));
+	const postLaunchProof = await probe.probeServer(socketKey);
+	if (
+		postLaunchProof.state !== "safe" ||
+		postLaunchProof.pid !== initialProof.pid ||
+		postLaunchProof.startTime !== initialProof.startTime
+	) {
+		return await failAfterCleanup("coordinator_tmux_owner_server_race");
+	}
+	const parsedStartRecord = parseTmuxNewSessionRecord(startRecord, plan.execution.attempt_session);
+	if (!parsedStartRecord) {
+		return await failAfterCleanup("coordinator_tmux_start_failed");
+	}
+	const { tmuxTarget, paneId, nativeSessionId } = parsedStartRecord;
+	if (
+		(scopedReceipt && nativeSessionId !== scopedReceipt.native_session_id) ||
+		(plan.execution.mode === "direct" && nativeSessionId !== directNativeSessionId)
+	) {
+		return await failAfterCleanup("coordinator_tmux_owner_server_race");
+	}
+	const ownerTransaction = {
+		commit: () => replaceOwnerGenerationSync(ownerStateDir, sessionName, ownerGeneration, generationBaseline),
+		rollback: cleanupFailedAttempt,
+	};
 	return {
 		sessionId: sessionName,
 		tmuxSession: sessionName,
-		tmuxTarget: tmuxTarget || sessionName,
+		tmuxTarget,
 		paneId,
+		tmuxNativeSessionId: nativeSessionId,
+		tmuxSocketKey: socketKey,
+		tmuxOwnerGeneration: ownerGeneration,
+		tmuxOwnerStateDir: ownerStateDir,
+		tmuxOwnerServerKey: socketKey,
+		tmuxOwnerServerPid: initialProof.pid,
+		tmuxOwnerServerStartTime: initialProof.startTime,
+
 		cwd: input.cwd,
 		createdAt: new Date().toISOString(),
 		sessionCommand: config.sessionCommand,
+		...(input.mpreset ? { mpreset: input.mpreset } : {}),
 		runtimeStateFile,
+		__coordinatorOwnerTransaction: ownerTransaction,
+		launchId: input.launchId,
+		readinessMarkerFile: input.readinessMarkerFile,
+		readinessFile: input.readinessMarkerFile,
+		origin: "coordinator_created",
+		runtime_readiness_latched: false,
 	};
 }
 
-async function captureTmuxTail(session: Record<string, unknown>, lines: number): Promise<string[]> {
+function hasPrivateTmuxOwnerIdentity(session: Record<string, unknown>): boolean {
+	const socketKey = typeof session.tmux_socket_key === "string" ? session.tmux_socket_key : session.tmuxSocketKey;
+	const serverKey =
+		typeof session.tmux_owner_server_key === "string" ? session.tmux_owner_server_key : session.tmuxOwnerServerKey;
+	const pid = session.tmux_owner_server_pid ?? session.tmuxOwnerServerPid;
+	const startTime = session.tmux_owner_server_start_time ?? session.tmuxOwnerServerStartTime;
+	const nativeSessionId = session.tmux_native_session_id ?? session.tmuxNativeSessionId;
+	const paneId = session.pane_id ?? session.paneId;
+	return (
+		typeof socketKey === "string" &&
+		socketKey.length > 0 &&
+		socketKey === serverKey &&
+		Number.isSafeInteger(pid) &&
+		typeof startTime === "string" &&
+		startTime.length > 0 &&
+		typeof nativeSessionId === "string" &&
+		nativeSessionId.length > 0 &&
+		typeof paneId === "string" &&
+		paneId.length > 0
+	);
+}
+
+async function proveImmutableTmuxTarget(session: Record<string, unknown>, runner: CommandRunner): Promise<boolean> {
+	const target = typeof session.tmux_target === "string" ? session.tmux_target : session.tmuxTarget;
+	const socketKey = typeof session.tmux_socket_key === "string" ? session.tmux_socket_key : session.tmuxSocketKey;
+	const expectedSessionId = session.tmux_native_session_id ?? session.tmuxNativeSessionId;
+	const expectedPaneId = session.pane_id ?? session.paneId;
+	if (
+		typeof target !== "string" ||
+		typeof socketKey !== "string" ||
+		typeof expectedSessionId !== "string" ||
+		typeof expectedPaneId !== "string"
+	)
+		return false;
+	const identity = await runner([
+		"tmux",
+		"-L",
+		socketKey,
+		"display-message",
+		"-p",
+		"-t",
+		target,
+		"#{session_id} #{pane_id}",
+	]);
+	const parts = identity.stdout.trim().split(/\s+/);
+	if (identity.exitCode !== 0) return false;
+	return parts.length === 2 && parts[0] === expectedSessionId && parts[1] === expectedPaneId;
+}
+async function captureTmuxTail(
+	session: Record<string, unknown>,
+	lines: number,
+	runner: CommandRunner = runCommand,
+): Promise<string[]> {
 	const target = typeof session.tmux_target === "string" ? session.tmux_target : session.tmuxTarget;
-	if (typeof target !== "string" || target.length === 0) return [];
-	const captured = await runCommand(["tmux", "capture-pane", "-t", target, "-p", "-S", `-${lines}`]);
+	const socketKey = typeof session.tmux_socket_key === "string" ? session.tmux_socket_key : session.tmuxSocketKey;
+	if (
+		!hasPrivateTmuxOwnerIdentity(session) ||
+		typeof socketKey !== "string" ||
+		socketKey.length === 0 ||
+		typeof target !== "string" ||
+		target.length === 0
+	)
+		return [];
+	const pid = session.tmux_owner_server_pid ?? session.tmuxOwnerServerPid;
+	const startTime = session.tmux_owner_server_start_time ?? session.tmuxOwnerServerStartTime;
+	const probe = await coordinatorOwnerIsolationProbe(runner);
+	const proof = await probe.probeServer(socketKey);
+	if (
+		proof.state !== "safe" ||
+		proof.pid !== pid ||
+		proof.startTime !== startTime ||
+		(process.platform === "linux" && proof.cgroup?.classification !== "safe") ||
+		!(await proveImmutableTmuxTarget(session, runner))
+	)
+		return [];
+	const captured = await runner(["tmux", "-L", socketKey, "capture-pane", "-t", target, "-p", "-S", `-${lines}`]);
 	if (captured.exitCode !== 0) return [];
 	return captured.stdout.split("\n").slice(-lines);
 }
@@ -1389,10 +2987,38 @@ async function sendTmuxPrompt(
 	session: Record<string, unknown>,
 	prompt: string,
 	runner: CommandRunner = runCommand,
+	ownerIsolationProbe?: OwnerIsolationProbe,
 ): Promise<boolean> {
 	const target = typeof session.tmux_target === "string" ? session.tmux_target : session.tmuxTarget;
-	if (typeof target !== "string" || target.length === 0) return false;
-	return await sendTmuxPromptKeys(target, prompt, runner);
+	const socketKey = typeof session.tmux_socket_key === "string" ? session.tmux_socket_key : session.tmuxSocketKey;
+	const serverKey =
+		typeof session.tmux_owner_server_key === "string" ? session.tmux_owner_server_key : session.tmuxOwnerServerKey;
+	const pid = session.tmux_owner_server_pid ?? session.tmuxOwnerServerPid;
+	const startTime = session.tmux_owner_server_start_time ?? session.tmuxOwnerServerStartTime;
+	if (
+		typeof target !== "string" ||
+		target.length === 0 ||
+		typeof socketKey !== "string" ||
+		socketKey.length === 0 ||
+		socketKey !== serverKey ||
+		!Number.isSafeInteger(pid) ||
+		typeof startTime !== "string" ||
+		startTime.length === 0
+	)
+		return false;
+	const paneId = session.pane_id ?? session.paneId;
+	if (typeof paneId !== "string" || !(await proveImmutableTmuxTarget(session, runner))) return false;
+	const probe = ownerIsolationProbe ?? (await coordinatorOwnerIsolationProbe(runner));
+	const proveCurrentServer = async (): Promise<boolean> => {
+		const proof = await probe.probeServer(socketKey);
+		return (
+			proof.state === "safe" &&
+			proof.pid === pid &&
+			proof.startTime === startTime &&
+			(process.platform !== "linux" || proof.cgroup?.classification === "safe")
+		);
+	};
+	return await sendTmuxPromptKeys(paneId, prompt, runner, socketKey, proveCurrentServer);
 }
 
 async function hasTmuxSession(
@@ -1400,8 +3026,16 @@ async function hasTmuxSession(
 	runner: CommandRunner = runCommand,
 ): Promise<boolean | null> {
 	const tmuxSession = typeof session.tmux_session === "string" ? session.tmux_session : session.tmuxSession;
-	if (typeof tmuxSession !== "string" || tmuxSession.length === 0) return null;
-	const checked = await runner(["tmux", "has-session", "-t", tmuxSession]);
+	const socketKey = typeof session.tmux_socket_key === "string" ? session.tmux_socket_key : session.tmuxSocketKey;
+	if (
+		!hasPrivateTmuxOwnerIdentity(session) ||
+		typeof socketKey !== "string" ||
+		socketKey.length === 0 ||
+		typeof tmuxSession !== "string" ||
+		tmuxSession.length === 0
+	)
+		return null;
+	const checked = await runner(["tmux", "-L", socketKey, "has-session", "-t", tmuxSession]);
 	return checked.exitCode === 0;
 }
 
@@ -1436,7 +3070,8 @@ async function inspectTmuxSession(
 	runner: CommandRunner = runCommand,
 ): Promise<Record<string, unknown>> {
 	const live = await hasTmuxSession(session, runner);
-	const tail = live ? await captureTmuxTail(session, lines) : [];
+	const tail = live ? await captureTmuxTail(session, lines, runner) : [];
+
 	return {
 		live,
 		...summarizePaneTail(tail),
@@ -1490,14 +3125,27 @@ async function waitForCoordinatorEvents(namespaceDir: string, timeoutMs: number)
 	};
 	const timer = setTimeout(finish, Math.max(timeoutMs, 0));
 	timer.unref?.();
-	await ensureDir(eventsDir(namespaceDir));
-	try {
-		const watcher = nodeFs.watch(eventsDir(namespaceDir), (_eventType, filename) => {
-			if (filename === "event-journal.jsonl" || filename === "latest-seq.json") finish();
-		});
-		watchers.push(watcher);
-	} catch {
-		// Directory may not exist yet; the timeout remains a bounded fallback.
+	const eventDir = eventsDir(namespaceDir);
+	const watchedDirs = [
+		eventDir,
+		turnsDir(namespaceDir),
+		path.join(namespaceDir, "active-turns"),
+		path.join(namespaceDir, "session-states"),
+	];
+	for (const dir of watchedDirs) {
+		await ensureDir(dir);
+		try {
+			const watcher = nodeFs.watch(dir, (_eventType, filename) => {
+				if (dir === eventDir) {
+					if (filename === "event-journal.jsonl" || filename === "latest-seq.json") finish();
+					return;
+				}
+				if (typeof filename === "string" && filename.endsWith(".json")) finish();
+			});
+			watchers.push(watcher);
+		} catch {
+			// Directory may not be watchable on this platform; the timeout remains a bounded fallback.
+		}
 	}
 	return deferred.promise;
 }
@@ -1538,7 +3186,7 @@ export async function readCoordinatorArtifact(
 	} catch (error) {
 		return {
 			ok: false,
-			reason: (error instanceof Error ? error.message.split(":")[0] : String(error)).replace(/^coordinator_/, ""),
+			reason: publicCoordinatorError(error),
 		};
 	} finally {
 		await handle?.close();
@@ -1552,6 +3200,122 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 	const services = options.services ?? {};
 	const namespaceDir = coordinatorNamespacePath(config);
 	const commandRunner = services.commandRunner ?? runCommand;
+	const loadModelProfiles = services.resolveModelProfiles ?? loadCoordinatorModelProfiles;
+	const readinessTimeoutMs = boundedRuntimeReadinessTimeoutMs(env.SKC_COORDINATOR_MCP_RUNTIME_READINESS_TIMEOUT_MS);
+	async function withSessionTransition<T>(sessionId: string, operation: () => Promise<T>): Promise<T> {
+		return await withSessionMutation(`${namespaceDir}::${sessionId}`, operation);
+	}
+
+	async function startCoordinatorSession(
+		cwd: string,
+		prompt?: string,
+		mpreset?: string | null,
+	): Promise<Record<string, unknown>> {
+		const sessionId = `skc-coordinator-${randomUUID().slice(0, 8)}`;
+		const launchId = randomUUID();
+		const readinessRoot = path.join(namespaceDir, "launch-readiness");
+		const readinessDir = path.join(readinessRoot, sessionId);
+		await ensureDir(readinessDir);
+		const canonicalRoot = await fs.realpath(readinessRoot);
+		const canonicalDir = await fs.realpath(readinessDir);
+		if (!canonicalDir.startsWith(`${canonicalRoot}${path.sep}`))
+			throw new Error("coordinator_readiness_path_invalid");
+		const readinessMarkerFile = path.join(canonicalDir, `${launchId}.json`);
+		const input: SessionStartInput = {
+			cwd,
+			prompt,
+			namespace: config.namespace,
+			mpreset,
+			worktree: true,
+			sessionId,
+			launchId,
+			readinessMarkerFile,
+			readinessFile: readinessMarkerFile,
+		};
+		const started = services.startSession
+			? await services.startSession(input)
+			: await startTmuxSession(config, input, namespaceDir, commandRunner, services.ownerIsolationProbe);
+		const record = asRecord(started);
+		if (!record) throw new Error("coordinator_session_command_required");
+		const attestedSessionId = optionalString(record.sessionId ?? record.session_id);
+		const attestedLaunchId = optionalString(record.launchId ?? record.launch_id);
+		const attestedMarkerFile = optionalString(
+			record.readinessMarkerFile ?? record.readiness_marker_file ?? record.readinessFile ?? record.readiness_file,
+		);
+		if (!attestedSessionId || !attestedLaunchId || !attestedMarkerFile)
+			throw new Error("coordinator_launch_attestation_missing");
+		if (
+			attestedSessionId !== sessionId ||
+			attestedLaunchId !== launchId ||
+			(await canonicalizePath(attestedMarkerFile)) !== readinessMarkerFile
+		)
+			throw new Error("coordinator_launch_attestation_mismatch");
+		return normalizeSession({
+			...record,
+			session_id: sessionId,
+			launch_id: launchId,
+			readiness_marker_file: readinessMarkerFile,
+			readiness_marker_path: readinessMarkerFile,
+			origin: "coordinator_created",
+			runtime_ready_launch_id: null,
+			runtime_ready_at: null,
+			runtime_readiness_latched: false,
+		});
+	}
+
+	function sessionReadinessAuthorityError(
+		reason: "coordinator_launch_metadata_missing" | "session_origin_unverified",
+		session: Record<string, unknown>,
+	): Error {
+		const error = new Error(reason);
+		Object.assign(error, {
+			sessionId: optionalString(session.session_id),
+			action: "Start a new coordinator session or explicitly register the live external tmux session.",
+		});
+		return error;
+	}
+
+	function assertSessionReadinessAuthority(session: Record<string, unknown>): void {
+		if (session.origin === "registered") return;
+		const tmuxTarget = session.tmux_target ?? session.tmuxTarget;
+		if (
+			session.origin == null &&
+			typeof session.registered_at === "string" &&
+			session.registered_at.length > 0 &&
+			session.authoritative === true &&
+			hasTmuxIdentity(session) &&
+			typeof tmuxTarget === "string" &&
+			tmuxTarget.length > 0
+		)
+			return;
+		if (session.origin === "coordinator_created") {
+			const sessionId = optionalString(session.session_id);
+			const launchId = optionalString(session.launch_id);
+			const markerFile = optionalString(session.readiness_marker_file ?? session.readiness_marker_path);
+			if (!sessionId || !launchId || !markerFile) {
+				throw sessionReadinessAuthorityError("coordinator_launch_metadata_missing", session);
+			}
+			return;
+		}
+		throw sessionReadinessAuthorityError("session_origin_unverified", session);
+	}
+
+	async function awaitRuntimeReadiness(session: Record<string, unknown>): Promise<boolean> {
+		assertSessionReadinessAuthority(session);
+		if (session.origin === "registered" || session.origin == null) return true;
+		const sessionId = optionalString(session.session_id);
+		const launchId = optionalString(session.launch_id);
+		const markerFile = optionalString(session.readiness_marker_file ?? session.readiness_marker_path);
+		if (!sessionId || !launchId || !markerFile) throw new Error("coordinator_launch_metadata_missing");
+		if (session.runtime_ready_launch_id === launchId) return true;
+		return await waitForRuntimeReadinessMarker(
+			markerFile,
+			sessionId,
+			launchId,
+			path.join(namespaceDir, "launch-readiness"),
+			readinessTimeoutMs,
+		);
+	}
 
 	async function listSessions(): Promise<unknown[]> {
 		if (!config.namespace.profile || !config.namespace.repo) return [];
@@ -1561,6 +3325,154 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 	function sessionFile(sessionId: unknown): string {
 		return path.join(namespaceDir, "sessions", `${safeExternalId("session", sessionId)}.json`);
 	}
+	const forceCloseSession =
+		services.forceCloseSession ??
+		((name: string, targetEnv: NodeJS.ProcessEnv, expectedSessionId?: string, expectedStateFile?: string) =>
+			forceCloseSkcTmuxSession(name, targetEnv, expectedSessionId, expectedStateFile));
+
+	// Reap a coordinator delegate-created (ephemeral) session. Addresses the #2034 review:
+	//  - terminates via the owner-proof forceCloseSkcTmuxSession (pid + native session_id +
+	//    generation + server_key + start_time verified atomically) — never a raw process.kill,
+	//    so a recycled PID can never signal a foreign process.
+	//  - re-validates ephemeral + no-active-turn AT kill time under a per-session lock, closing
+	//    the select→kill TOCTOU and races with concurrent send_prompt / delegate / stop.
+	//  - purges state files ONLY on verified termination; on failure the record is kept for retry
+	//    and no session.reaped event is emitted (honest audit, no worse leak).
+	async function reapSession(
+		rawId: unknown,
+		opts: { force?: boolean; reason?: string } = {},
+	): Promise<{ ok: boolean; reason?: string; killed: boolean; active_turn_id?: string; detail?: string }> {
+		const id = safeExternalId("session", rawId);
+		return await withSessionMutation(`${namespaceDir}::${id}`, async () => {
+			const record = asRecord(await readJsonFile(sessionFile(id)));
+			if (!record) return { ok: false, reason: "unknown_session", killed: false };
+			if (record.ephemeral !== true && opts.force !== true) {
+				return { ok: false, reason: "not_ephemeral", killed: false };
+			}
+			const activeTurn = await readActiveTurn(namespaceDir, id);
+			if (activeTurn) {
+				return { ok: false, reason: "active_turn", killed: false, active_turn_id: activeTurn.turn_id };
+			}
+			const tmuxSession = optionalString(record.tmux_session) ?? optionalString(record.tmuxSession);
+			let killed = false;
+			if (tmuxSession) {
+				// Production delegate records persist the owner state-file path as `runtimeStateFile`
+				// (see startTmuxSession). Read that so the owner-proof close is actually bound to the
+				// recorded state-file identity; `sessionStateFile` is only a compatibility fallback for
+				// any externally-registered record that used the older key.
+				const expectedStateFile =
+					optionalString(record.runtimeStateFile) ?? optionalString(record.sessionStateFile) ?? undefined;
+				try {
+					await forceCloseSession(tmuxSession, env, undefined, expectedStateFile);
+					killed = true;
+				} catch (err) {
+					return {
+						ok: false,
+						reason: "terminate_failed",
+						detail: err instanceof Error ? err.message : String(err),
+						killed: false,
+					};
+				}
+			}
+			// Purge the session record FIRST so a partial rm failure can never re-list → re-reap →
+			// emit a duplicate session.reaped. `killed` is honest: false when nothing was signalled.
+			await fs.rm(sessionFile(id), { force: true });
+			await appendCoordinatorEvent(namespaceDir, {
+				kind: "session.reaped",
+				sessionId: id,
+				summary: `Session ${id} reaped${opts.reason ? ` (${opts.reason})` : ""}`,
+				metadata: { reason: opts.reason ?? null, force: opts.force === true, killed },
+			});
+			await fs.rm(sessionStateFile(namespaceDir, id), { force: true });
+			await fs.rm(activeTurnFile(namespaceDir, id), { force: true });
+			return { ok: true, killed };
+		});
+	}
+
+	const sessionReaper: SessionReaper = createSessionReaper(
+		{
+			listSessions: async (): Promise<ReapableSession[]> => {
+				const out: ReapableSession[] = [];
+				for (const raw of await listSessions()) {
+					try {
+						const rec = asRecord(raw);
+						if (rec?.ephemeral !== true) continue;
+						const sid = optionalString(rec.session_id);
+						if (!sid) continue;
+						const activeTurn = await readActiveTurn(namespaceDir, sid);
+						const state = await readSessionState(namespaceDir, sid);
+						const stamp = optionalString(state?.updated_at) ?? optionalString(rec.created_at);
+						const lastActivityMs = stamp ? Date.parse(stamp) : 0;
+						out.push({
+							sessionId: sid,
+							ephemeral: true,
+							hasActiveTurn: activeTurn !== null,
+							lastActivityMs: Number.isFinite(lastActivityMs) ? lastActivityMs : 0,
+						});
+					} catch {
+						// A single corrupt session/state file must not abort the whole sweep — skip it.
+					}
+				}
+				return out;
+			},
+			reapSession: async (sid: string): Promise<void> => {
+				await reapSession(sid, { reason: "idle_reaper" });
+			},
+			now: () => Date.now(),
+		},
+		{ idleTtlMs: config.sessionIdleTtlMs, sweepIntervalMs: config.sessionSweepIntervalMs },
+	);
+	async function compensateFailedOwnerStart(
+		session: Record<string, unknown>,
+		ownerTransaction: {
+			rollback?: () => Promise<"cleaned" | "failed" | "unverifiable">;
+		} | null,
+	): Promise<"cleaned" | "failed" | "unverifiable"> {
+		let cleanupStatus: "cleaned" | "failed" | "unverifiable" = "unverifiable";
+		try {
+			cleanupStatus = (await ownerTransaction?.rollback?.()) ?? "unverifiable";
+		} catch {
+			cleanupStatus = "unverifiable";
+		}
+		try {
+			const sessionId = String(session.session_id);
+			const cwd = typeof session.cwd === "string" ? path.resolve(session.cwd) : null;
+			if (!cwd) throw coordinatorStateError("invalid");
+			const state: CoordinatorSessionState = {
+				schema_version: 1,
+				session_id: sessionId,
+				state: "errored",
+				ready_for_input: false,
+				current_turn_id: null,
+				last_turn_id: null,
+				updated_at: new Date().toISOString(),
+				source: "coordinator",
+				live: false,
+				reason: "coordinator_start_rolled_back",
+				cwd,
+				workdir: cwd,
+				session_file: null,
+			};
+			await writeJsonFile(sessionStateFile(namespaceDir, sessionId), state);
+			await fs.rm(sessionFile(sessionId), { force: true });
+			await appendCoordinatorEvent(namespaceDir, {
+				kind: "session.state_changed",
+				sessionId,
+				summary: `Session ${sessionId} start rolled back`,
+				payloadRef: path.relative(namespaceDir, sessionStateFile(namespaceDir, sessionId)),
+				metadata: {
+					state: "errored",
+					ready_for_input: false,
+					live: false,
+					reason: "coordinator_start_rolled_back",
+				},
+			});
+		} catch {
+			return "failed";
+		}
+		return cleanupStatus;
+	}
+
 	async function listQuestions(args: Record<string, unknown>): Promise<unknown[]> {
 		const sessionId = args.session_id == null ? null : safeExternalId("session", args.session_id);
 		const status = typeof args.status === "string" && args.status.length > 0 ? args.status : null;
@@ -1584,11 +3496,12 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		return evidence;
 	}
 
-	async function activateTurn(session: Record<string, unknown>, turn: TurnRecord): Promise<TurnRecord> {
+	async function prepareActiveTurnUnlocked(session: Record<string, unknown>, turn: TurnRecord): Promise<TurnRecord> {
+		const active = await readActiveTurn(namespaceDir, turn.session_id);
+		if (active && active.turn_id !== turn.turn_id) return active;
 		const timestamp = new Date().toISOString();
 		const target = typeof session.tmux_target === "string" ? session.tmux_target : session.tmuxTarget;
-		const live = hasTmuxIdentity(session) ? await hasTmuxSession(session, commandRunner) : null;
-		const pendingTurn: TurnRecord = {
+		const pending: TurnRecord = {
 			...turn,
 			status: "active",
 			delivery: {
@@ -1597,90 +3510,312 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				target: typeof target === "string" ? target : null,
 				tmux_keys_sent: false,
 				prompt_acknowledged: false,
-				state: "queued",
+				state: "awaiting_runtime_readiness",
 				attempts: [
 					{
 						delivered: false,
 						tmux_keys_sent: false,
 						channel: "tmux_keys",
 						created_at: timestamp,
-						reason: "awaiting_tmux_delivery",
+						reason: "awaiting_runtime_readiness",
 					},
 				],
 			},
-			liveness: { checked_at: timestamp, live, reason: live === false ? "tmux_session_missing" : null },
+			liveness: { checked_at: null, live: null, reason: null },
 			started_at: turn.started_at ?? timestamp,
 			updated_at: timestamp,
 		};
-		await writeTurnRecord(namespaceDir, pendingTurn);
-		await writeActiveTurn(namespaceDir, pendingTurn);
-		await writeSessionState(namespaceDir, pendingTurn.session_id, "running", {
-			currentTurnId: pendingTurn.turn_id,
-			live,
-			reason: null,
+		await writeTurnRecord(namespaceDir, pending);
+		await writeActiveTurn(namespaceDir, pending);
+		await writeSessionState(namespaceDir, pending.session_id, "booting", {
+			currentTurnId: pending.turn_id,
+			live: null,
+			reason: "awaiting_runtime_readiness",
 		});
+		return pending;
+	}
 
-		const tmuxKeysSent = await sendTmuxPrompt(session, turn.prompt.text, commandRunner);
-		const deliveredAt = new Date().toISOString();
-		const activeTurn: TurnRecord = {
-			...pendingTurn,
-			delivery: {
-				delivered: false,
-				queued: !tmuxKeysSent,
-				target: typeof target === "string" ? target : null,
-				tmux_keys_sent: tmuxKeysSent,
-				prompt_acknowledged: false,
-				state: tmuxKeysSent ? "tmux_keys_sent" : "unavailable",
-				attempts: [
-					{
+	async function completePreparedTurn(session: Record<string, unknown>, pendingTurn: TurnRecord): Promise<TurnRecord> {
+		const ready = await awaitRuntimeReadiness(session);
+		const observedLive = hasTmuxIdentity(session) ? await hasTmuxSession(session, commandRunner) : null;
+		return await withSessionTransition(pendingTurn.session_id, async () => {
+			const current = await readTurnRecord(namespaceDir, pendingTurn.turn_id);
+			const active = await readActiveTurn(namespaceDir, pendingTurn.session_id);
+			if (
+				!current ||
+				!active ||
+				active.turn_id !== pendingTurn.turn_id ||
+				TERMINAL_TURN_STATUSES.has(current.status) ||
+				current.delivery.state !== "awaiting_runtime_readiness" ||
+				current.delivery.tmux_keys_sent === true
+			)
+				return current ?? pendingTurn;
+			if (!ready) {
+				const completedAt = new Date().toISOString();
+				const message = `SKC runtime did not attest interactive input readiness within ${readinessTimeoutMs}ms.`;
+				const failed: TurnRecord = {
+					...current,
+					status: "failed",
+					delivery: {
+						...current.delivery,
 						delivered: false,
-						tmux_keys_sent: tmuxKeysSent,
-						channel: "tmux_keys",
-						created_at: deliveredAt,
-						reason: tmuxKeysSent ? "awaiting_runtime_ack" : "tmux_delivery_unavailable",
+						queued: false,
+						tmux_keys_sent: false,
+						prompt_acknowledged: false,
+						state: "awaiting_runtime_readiness",
 					},
-				],
-			},
-			updated_at: deliveredAt,
-		};
-		await writeTurnRecord(namespaceDir, activeTurn);
-		await writeActiveTurn(namespaceDir, activeTurn);
-		const sessionState = await readSessionState(namespaceDir, activeTurn.session_id);
-		const runtimeStateAlreadyAcknowledged =
-			sessionState !== null && runtimeStateAcknowledgesTurn(activeTurn, sessionState);
-		const resolvedTurn =
-			runtimeStateAlreadyAcknowledged && sessionState
-				? await markTurnAcknowledgedFromRuntimeState(namespaceDir, activeTurn, sessionState)
-				: activeTurn;
-		if (!runtimeStateAlreadyAcknowledged && !tmuxKeysSent) {
-			await writeSessionState(namespaceDir, activeTurn.session_id, "stale", {
-				currentTurnId: activeTurn.turn_id,
-				live,
-				reason: "tmux_delivery_unavailable",
+					final_response: {
+						text: message,
+						format: "markdown",
+						source: "coordinator_runtime_readiness",
+						artifact_path: null,
+						truncated: false,
+					},
+					error: { code: RUNTIME_READINESS_TIMEOUT_REASON, message, recoverable: true },
+					evidence: [
+						...current.evidence,
+						{
+							type: RUNTIME_READINESS_TIMEOUT_REASON,
+							created_at: completedAt,
+							tmux_keys_sent: false,
+							prompt_acknowledged: false,
+						},
+					],
+					updated_at: completedAt,
+					completed_at: completedAt,
+				};
+				await writeTurnRecord(namespaceDir, failed);
+				await clearActiveTurn(namespaceDir, failed);
+				await writeSessionState(namespaceDir, failed.session_id, "booting", {
+					lastTurnId: failed.turn_id,
+					live: null,
+					reason: RUNTIME_READINESS_TIMEOUT_REASON,
+				});
+				return failed;
+			}
+			const currentSession = asRecord(await readJsonFile(sessionFile(pendingTurn.session_id))) ?? session;
+			if (
+				currentSession.origin === "coordinator_created" &&
+				(currentSession.session_id !== session.session_id ||
+					currentSession.launch_id !== session.launch_id ||
+					currentSession.readiness_marker_file !== session.readiness_marker_file)
+			)
+				return current;
+			const latched =
+				currentSession.origin === "coordinator_created"
+					? {
+							...currentSession,
+							runtime_ready_launch_id: currentSession.launch_id,
+							runtime_ready_at: new Date().toISOString(),
+							runtime_readiness_latched: true,
+						}
+					: currentSession;
+			if (latched !== currentSession) await writeJsonFile(sessionFile(pendingTurn.session_id), latched);
+			const target = typeof latched.tmux_target === "string" ? latched.tmux_target : latched.tmuxTarget;
+			const attemptId = `delivery-${randomUUID()}`;
+			const attemptedAt = new Date().toISOString();
+			const delivering: TurnRecord = {
+				...current,
+				status: "delivering",
+				updated_at: attemptedAt,
+				delivery: {
+					...current.delivery,
+					queued: false,
+					state: "delivering",
+					attempts: [
+						...current.delivery.attempts,
+						{
+							attempt_id: attemptId,
+							delivered: false,
+							tmux_keys_sent: false,
+							channel: "tmux_keys",
+							created_at: attemptedAt,
+							reason: "delivery_attempt",
+						},
+					],
+				},
+			};
+			await writeTurnRecord(namespaceDir, delivering);
+			await writeActiveTurn(namespaceDir, delivering);
+			await writeSessionState(namespaceDir, delivering.session_id, "running", {
+				currentTurnId: delivering.turn_id,
+				live: observedLive,
+				reason: null,
 			});
-		}
-		await appendCoordinatorEvent(namespaceDir, {
-			kind: tmuxKeysSent ? "tmux.delivery_succeeded" : "tmux.delivery_failed",
-			sessionId: activeTurn.session_id,
-			turnId: activeTurn.turn_id,
-			summary: tmuxKeysSent
-				? `Tmux delivery succeeded for turn ${activeTurn.turn_id}`
-				: `Tmux delivery failed for turn ${activeTurn.turn_id}`,
-			payloadRef: path.relative(namespaceDir, turnFile(namespaceDir, activeTurn.turn_id)),
-			metadata: { target: typeof target === "string" ? target : null, live },
+			const tmuxKeysSent = await sendTmuxPrompt(
+				latched,
+				delivering.prompt.text,
+				commandRunner,
+				services.ownerIsolationProbe,
+			);
+			const deliveredAt = new Date().toISOString();
+			const delivered: TurnRecord = {
+				...delivering,
+				status: "active",
+				updated_at: deliveredAt,
+				delivery: {
+					...delivering.delivery,
+					delivered: false,
+					queued: !tmuxKeysSent,
+					tmux_keys_sent: tmuxKeysSent,
+					prompt_acknowledged: false,
+					state: tmuxKeysSent ? "tmux_keys_sent" : "unavailable",
+					attempts: [
+						...delivering.delivery.attempts.slice(0, -1),
+						{
+							attempt_id: attemptId,
+							delivered: false,
+							tmux_keys_sent: tmuxKeysSent,
+							channel: "tmux_keys",
+							created_at: deliveredAt,
+							reason: tmuxKeysSent ? "awaiting_runtime_ack" : "tmux_delivery_unavailable",
+						},
+					],
+				},
+			};
+			await writeTurnRecord(namespaceDir, delivered);
+			await writeActiveTurn(namespaceDir, delivered);
+			await appendCoordinatorEvent(namespaceDir, {
+				kind: tmuxKeysSent ? "tmux.delivery_succeeded" : "tmux.delivery_failed",
+				sessionId: delivered.session_id,
+				turnId: delivered.turn_id,
+				summary: tmuxKeysSent
+					? `Tmux delivery succeeded for turn ${delivered.turn_id}`
+					: `Tmux delivery failed for turn ${delivered.turn_id}`,
+				payloadRef: path.relative(namespaceDir, turnFile(namespaceDir, delivered.turn_id)),
+				metadata: {
+					target: typeof target === "string" ? target : null,
+					live: observedLive,
+					attempt_id: attemptId,
+				},
+			});
+			return delivered;
 		});
-		return resolvedTurn;
 	}
 
-	async function promoteNextQueuedTurn(sessionId: string): Promise<TurnRecord | null> {
+	async function activateTurn(session: Record<string, unknown>, turn: TurnRecord): Promise<TurnRecord> {
+		const pendingTurn = await withSessionTransition(
+			turn.session_id,
+			async () => await prepareActiveTurnUnlocked(session, turn),
+		);
+		if (pendingTurn.turn_id !== turn.turn_id) return pendingTurn;
+		return await completePreparedTurn(session, pendingTurn);
+	}
+
+	async function prepareNextQueuedTurnUnlocked(sessionId: string): Promise<{
+		session: Record<string, unknown>;
+		turn: TurnRecord;
+	} | null> {
 		const session = asRecord(await readJsonFile(sessionFile(sessionId)));
-		if (!session) return null;
-		const queuedTurns = (await listJsonFiles(turnsDir(namespaceDir)))
-			.map(turn => asRecord(turn) as TurnRecord | null)
-			.filter((turn): turn is TurnRecord => turn?.session_id === sessionId && turn.status === "queued")
+		if (!session || (await readActiveTurn(namespaceDir, sessionId))) return null;
+		try {
+			assertSessionReadinessAuthority(session);
+		} catch {
+			return null;
+		}
+		const queuedTurns = (await listTurnRecords(namespaceDir))
+			.filter(turn => turn.session_id === sessionId && turn.status === "queued")
 			.sort((left, right) => left.created_at.localeCompare(right.created_at));
 		const nextTurn = queuedTurns[0];
-		return nextTurn ? await activateTurn(session, nextTurn) : null;
+		if (!nextTurn) return null;
+		return { session, turn: await prepareActiveTurnUnlocked(session, nextTurn) };
+	}
+
+	async function reconcileRuntimeAcknowledgementFenced(
+		turnId: string,
+		sessionState: CoordinatorSessionState | null,
+		failOnTimeout: boolean,
+	): Promise<TurnRecord | null> {
+		const observed = await readTurnRecord(namespaceDir, turnId);
+		if (!observed) return null;
+		const observedTurnId = sessionState?.current_turn_id;
+		return await withSessionTransition(observed.session_id, async () => {
+			const current = await readTurnRecord(namespaceDir, turnId);
+			if (!current || !ACTIVE_TURN_STATUSES.has(current.status)) return current;
+			const currentState = await readSessionState(namespaceDir, current.session_id);
+			const state =
+				sessionState &&
+				sessionState.updated_at === currentState?.updated_at &&
+				observedTurnId === currentState.current_turn_id
+					? sessionState
+					: currentState;
+			return await reconcileRuntimeAcknowledgement(namespaceDir, current, state, promptAckTimeoutMs, {
+				failOnTimeout,
+			});
+		});
+	}
+
+	async function markTurnTerminalFromSessionStateFenced(
+		turnId: string,
+		observedState: CoordinatorSessionState,
+	): Promise<TurnRecord | null> {
+		const observed = await readTurnRecord(namespaceDir, turnId);
+		if (!observed) return null;
+		return await withSessionTransition(observed.session_id, async () => {
+			const current = await readTurnRecord(namespaceDir, turnId);
+			if (!current || !ACTIVE_TURN_STATUSES.has(current.status)) return current;
+			const currentState = await readSessionState(namespaceDir, current.session_id);
+			if (!currentState || currentState.updated_at !== observedState.updated_at) return current;
+			const matchesTurn =
+				currentState.current_turn_id === current.turn_id ||
+				(currentState.state === "errored" &&
+					currentState.source === "agent_session_event" &&
+					currentState.current_turn_id == null);
+			if (!matchesTurn || (currentState.state !== "completed" && currentState.state !== "errored")) return current;
+			return await markTurnTerminalFromSessionState(namespaceDir, current, currentState);
+		});
+	}
+
+	async function markTurnFailedForUnavailableSessionFenced(
+		turnId: string,
+		reason: string,
+	): Promise<TurnRecord | null> {
+		const observed = await readTurnRecord(namespaceDir, turnId);
+		if (!observed) return null;
+		return await withSessionTransition(observed.session_id, async () => {
+			const current = await readTurnRecord(namespaceDir, turnId);
+			if (!current || !ACTIVE_TURN_STATUSES.has(current.status)) return current;
+			return await markTurnFailedForUnavailableSession(namespaceDir, current, reason);
+		});
+	}
+
+	async function preparePromptTurn(
+		session: Record<string, unknown>,
+		prompt: string,
+		options: { force: boolean; queue: boolean; queueWithoutActive?: boolean },
+	): Promise<
+		| { ok: false; activeTurn: TurnRecord }
+		| { ok: true; turn: TurnRecord; priorActiveTurn: TurnRecord | null; queued: boolean }
+	> {
+		const sessionId = safeExternalId("session", session.session_id);
+		const prepared = await withSessionTransition(sessionId, async () => {
+			const activeTurn = await readActiveTurn(namespaceDir, sessionId);
+			if (activeTurn && !options.force && !options.queue) {
+				return { ok: false as const, activeTurn };
+			}
+			if (activeTurn && options.force) {
+				const timestamp = new Date().toISOString();
+				const superseded: TurnRecord = {
+					...activeTurn,
+					status: "superseded",
+					updated_at: timestamp,
+					completed_at: timestamp,
+				};
+				await writeTurnRecord(namespaceDir, superseded);
+				await clearActiveTurn(namespaceDir, superseded);
+			}
+			const shouldQueue =
+				options.queue && !options.force && (activeTurn !== null || options.queueWithoutActive === true);
+			const turn = makeTurnRecord(config, sessionId, prompt, shouldQueue ? "queued" : "active");
+			if (shouldQueue) {
+				await writeTurnRecord(namespaceDir, turn);
+				return { ok: true as const, turn, priorActiveTurn: activeTurn, queued: true };
+			}
+			const pending = await prepareActiveTurnUnlocked(session, turn);
+			return { ok: true as const, turn: pending, priorActiveTurn: activeTurn, queued: false };
+		});
+		if (!prepared.ok || prepared.queued) return prepared;
+		return { ...prepared, turn: await completePreparedTurn(session, prepared.turn) };
 	}
 
 	async function readTurnPayload(
@@ -1697,24 +3832,21 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 		let resolvedTurn = turn;
 		let advisoryStatus: Record<string, unknown> = { live: false };
 		let sessionState = await readSessionState(namespaceDir, turn.session_id);
-		resolvedTurn = await reconcileRuntimeAcknowledgement(
-			namespaceDir,
-			resolvedTurn,
-			sessionState,
-			promptAckTimeoutMs,
-			{ failOnTimeout: false },
-		);
+		resolvedTurn =
+			(await reconcileRuntimeAcknowledgementFenced(resolvedTurn.turn_id, sessionState, false)) ?? resolvedTurn;
 		if (resolvedTurn !== turn) sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 		if (
 			sessionState &&
 			ACTIVE_TURN_STATUSES.has(resolvedTurn.status) &&
+			runtimeStateMatchesPrivateOwnerGeneration(sessionState, session) &&
 			(sessionState.current_turn_id === resolvedTurn.turn_id ||
 				(sessionState.state === "errored" &&
 					sessionState.source === "agent_session_event" &&
 					sessionState.current_turn_id == null)) &&
 			(sessionState.state === "completed" || sessionState.state === "errored")
 		) {
-			resolvedTurn = await markTurnTerminalFromSessionState(namespaceDir, resolvedTurn, sessionState);
+			resolvedTurn =
+				(await markTurnTerminalFromSessionStateFenced(resolvedTurn.turn_id, sessionState)) ?? resolvedTurn;
 			sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 		} else if (
 			sessionState &&
@@ -1726,14 +3858,14 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			session &&
 			hasTmuxIdentity(session)
 		) {
-			resolvedTurn = await markTurnFailedForUnavailableSession(
-				namespaceDir,
-				resolvedTurn,
-				"tmux_delivery_unavailable",
-			);
+			resolvedTurn =
+				(await markTurnFailedForUnavailableSessionFenced(resolvedTurn.turn_id, "tmux_delivery_unavailable")) ??
+				resolvedTurn;
 			sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 		} else if (!session && ACTIVE_TURN_STATUSES.has(resolvedTurn.status)) {
-			resolvedTurn = await markTurnFailedForUnavailableSession(namespaceDir, resolvedTurn, "session_record_missing");
+			resolvedTurn =
+				(await markTurnFailedForUnavailableSessionFenced(resolvedTurn.turn_id, "session_record_missing")) ??
+				resolvedTurn;
 			sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 		} else if (session) {
 			advisoryStatus = await inspectTmuxSession(session, boundedLineCount(lines), commandRunner);
@@ -1742,21 +3874,15 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				hasTmuxIdentity(session) &&
 				advisoryStatus.live === false
 			) {
-				resolvedTurn = await markTurnFailedForUnavailableSession(
-					namespaceDir,
-					resolvedTurn,
-					"tmux_session_missing",
-				);
+				resolvedTurn =
+					(await markTurnFailedForUnavailableSessionFenced(resolvedTurn.turn_id, "tmux_session_missing")) ??
+					resolvedTurn;
 				sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 			}
 		}
 		if (ACTIVE_TURN_STATUSES.has(resolvedTurn.status)) {
-			resolvedTurn = await reconcileRuntimeAcknowledgement(
-				namespaceDir,
-				resolvedTurn,
-				sessionState,
-				promptAckTimeoutMs,
-			);
+			resolvedTurn =
+				(await reconcileRuntimeAcknowledgementFenced(resolvedTurn.turn_id, sessionState, true)) ?? resolvedTurn;
 			if (!ACTIVE_TURN_STATUSES.has(resolvedTurn.status)) {
 				sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
 			}
@@ -1778,51 +3904,59 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 	}
 
 	async function reconcileActiveTurnAcknowledgements(): Promise<void> {
-		const turns = (await listJsonFiles(turnsDir(namespaceDir)))
-			.map(turn => asRecord(turn) as TurnRecord | null)
-			.filter((turn): turn is TurnRecord => turn !== null && ACTIVE_TURN_STATUSES.has(turn.status));
+		await preflightCoordinatorMutation(namespaceDir, undefined, {
+			rejectTerminalRuntimeEvidence: false,
+		});
+
+		const turns = (await listTurnRecords(namespaceDir)).filter(turn => ACTIVE_TURN_STATUSES.has(turn.status));
 		for (const turn of turns) {
 			let sessionState = await readSessionState(namespaceDir, turn.session_id);
-			const resolvedTurn = await reconcileRuntimeAcknowledgement(
-				namespaceDir,
-				turn,
-				sessionState,
-				promptAckTimeoutMs,
-				{ failOnTimeout: false },
-			);
-			if (!ACTIVE_TURN_STATUSES.has(resolvedTurn.status)) continue;
-			if (resolvedTurn !== turn) sessionState = await readSessionState(namespaceDir, resolvedTurn.session_id);
-			const session = asRecord(await readJsonFile(sessionFile(resolvedTurn.session_id)));
 			if (
 				sessionState &&
-				sessionState.current_turn_id === resolvedTurn.turn_id &&
+				(sessionState.state === "completed" || sessionState.state === "errored") &&
+				(sessionState.current_turn_id === turn.turn_id ||
+					(sessionState.state === "errored" &&
+						sessionState.source === "agent_session_event" &&
+						sessionState.current_turn_id == null))
+			) {
+				const terminal = await markTurnTerminalFromSessionStateFenced(turn.turn_id, sessionState);
+				if (!terminal || !ACTIVE_TURN_STATUSES.has(terminal.status)) continue;
+			}
+			const acknowledged = (await reconcileRuntimeAcknowledgementFenced(turn.turn_id, sessionState, false)) ?? turn;
+			if (!ACTIVE_TURN_STATUSES.has(acknowledged.status)) continue;
+			if (acknowledged !== turn) sessionState = await readSessionState(namespaceDir, acknowledged.session_id);
+			const session = asRecord(await readJsonFile(sessionFile(acknowledged.session_id)));
+			if (
+				sessionState &&
+				sessionState.current_turn_id === acknowledged.turn_id &&
 				sessionState.state === "stale" &&
 				sessionState.reason === "tmux_delivery_unavailable" &&
-				resolvedTurn.delivery.state === "unavailable" &&
+				acknowledged.delivery.state === "unavailable" &&
 				session &&
 				hasTmuxIdentity(session)
 			) {
-				await markTurnFailedForUnavailableSession(namespaceDir, resolvedTurn, "tmux_delivery_unavailable");
+				await markTurnFailedForUnavailableSessionFenced(acknowledged.turn_id, "tmux_delivery_unavailable");
 				continue;
 			}
 			if (!session) {
-				await markTurnFailedForUnavailableSession(namespaceDir, resolvedTurn, "session_record_missing");
+				await markTurnFailedForUnavailableSessionFenced(acknowledged.turn_id, "session_record_missing");
 				continue;
 			}
 			if (hasTmuxIdentity(session) && (await hasTmuxSession(session, commandRunner)) === false) {
-				await markTurnFailedForUnavailableSession(namespaceDir, resolvedTurn, "tmux_session_missing");
+				await markTurnFailedForUnavailableSessionFenced(acknowledged.turn_id, "tmux_session_missing");
 				continue;
 			}
-			await reconcileRuntimeAcknowledgement(namespaceDir, resolvedTurn, sessionState, promptAckTimeoutMs);
+			await reconcileRuntimeAcknowledgementFenced(acknowledged.turn_id, sessionState, true);
 		}
 	}
 
-	async function callTool(name: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
+	async function callToolUnlocked(name: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
 		try {
 			if (name === "skc_coordinator_list_sessions") return { ok: true, sessions: await listSessions() };
 			if (name === "skc_coordinator_register_session") {
 				requireCoordinatorMutation(config, "sessions", args);
 				const sessionId = safeExternalId("session", args.session_id);
+				await preflightCoordinatorMutation(namespaceDir, sessionId);
 				const cwd = await assertCoordinatorWorkdir(config, args.cwd);
 				const tmuxSession = safeTmuxSessionName(args.tmux_session);
 				const tmuxTarget = safeTmuxTarget(args.tmux_target);
@@ -1846,7 +3980,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					sessionId,
 					summary: `Session ${sessionId} registered for coordinator control`,
 					payloadRef: path.relative(namespaceDir, sessionFile(sessionId)),
-					metadata: { source: optionalString(args.source) ?? "register_session", visible: args.visible !== false },
+					metadata: {
+						source: optionalString(args.source) ?? "register_session",
+						visible: args.visible !== false,
+					},
 				});
 
 				return {
@@ -1883,7 +4020,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			}
 			if (name === "skc_coordinator_read_tail") {
 				const session = asRecord(await readJsonFile(sessionFile(args.session_id)));
-				return { ok: true, lines: session ? await captureTmuxTail(session, boundedLineCount(args.lines)) : [] };
+				return {
+					ok: true,
+					lines: session ? await captureTmuxTail(session, boundedLineCount(args.lines), commandRunner) : [],
+				};
 			}
 			if (name === "skc_coordinator_list_questions") return { ok: true, questions: await listQuestions(args) };
 			if (name === "skc_coordinator_list_artifacts") return { ok: true, roots: config.allowedRoots };
@@ -1918,23 +4058,31 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 					turns,
 					questions,
 					reports,
-					events: buildCanonicalCoordinatorEvents({ sessionStates, turns, questions, reports }),
+					events: buildCanonicalCoordinatorEvents({
+						sessionStates,
+						turns,
+						questions,
+						reports,
+					}),
 					latest_event_seq: await readLatestEventSeq(namespaceDir),
 					recent_events: eventSummaries(events.slice(-10)),
 				};
 			}
 			if (name === "skc_coordinator_watch_events") {
-				await reconcileActiveTurnAcknowledgements();
+				await withCoordinatorTransaction(namespaceDir, reconcileActiveTurnAcknowledgements);
 				const limit = boundedEventLimit(args.limit);
 				const timeoutMs = boundedEventWatchTimeoutMs(args.timeout_ms);
 				let events = await readCoordinatorEvents(namespaceDir);
 				let matched = filterCoordinatorEvents(events, args, limit);
 				let timedOut = false;
 				if (matched.length === 0 && timeoutMs > 0) {
-					await waitForCoordinatorEvents(namespaceDir, timeoutMs);
-					await reconcileActiveTurnAcknowledgements();
-					events = await readCoordinatorEvents(namespaceDir);
-					matched = filterCoordinatorEvents(events, args, limit);
+					const deadline = Date.now() + timeoutMs;
+					while (matched.length === 0 && Date.now() < deadline) {
+						await waitForCoordinatorEvents(namespaceDir, Math.min(50, Math.max(1, deadline - Date.now())));
+						await withCoordinatorTransaction(namespaceDir, reconcileActiveTurnAcknowledgements);
+						events = await readCoordinatorEvents(namespaceDir);
+						matched = filterCoordinatorEvents(events, args, limit);
+					}
 					timedOut = matched.length === 0;
 				}
 				return {
@@ -1953,6 +4101,17 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				const hasPrompt = typeof args.prompt === "string" && args.prompt.trim().length > 0;
 				const task = hasTask ? String(args.task) : hasPrompt ? String(args.prompt) : null;
 				if (!task) return { ok: false, reason: "task_required" };
+				await preflightCoordinatorMutation(namespaceDir);
+				const mpresetResolution = await resolveCoordinatorMpreset(args.mpreset, loadModelProfiles);
+				if (!mpresetResolution.ok) {
+					return {
+						ok: false,
+						reason: mpresetResolution.reason,
+						mpreset: mpresetResolution.mpreset,
+						available_profiles: mpresetResolution.available_profiles,
+					};
+				}
+
 				const promptAliasIgnored = hasTask && hasPrompt;
 				const mutationRequested = args.allow_mutation === true;
 				const taggedPrompt = workflowPrompt(delegateWorkflow, name, canonicalCwd, task, {
@@ -1964,70 +4123,88 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				let reusedSession = false;
 				if (args.session_id != null) {
 					const sessionId = safeExternalId("session", args.session_id);
+					await preflightCoordinatorMutation(namespaceDir, sessionId);
 					const existing = asRecord(await readJsonFile(sessionFile(sessionId)));
-					if (!existing) return { ok: false, reason: "unknown_session", session_id: sessionId };
+					if (!existing)
+						return {
+							ok: false,
+							reason: "unknown_session",
+							session_id: sessionId,
+						};
 					const storedCwd = typeof existing.cwd === "string" ? existing.cwd : null;
 					const canonicalStored = storedCwd ? await canonicalizePath(storedCwd) : null;
 					const canonicalRequested = await canonicalizePath(canonicalCwd);
 					if (!canonicalStored || canonicalStored !== canonicalRequested) {
-						return { ok: false, reason: "session_cwd_mismatch", session_id: sessionId };
+						return {
+							ok: false,
+							reason: "session_cwd_mismatch",
+							session_id: sessionId,
+						};
+					}
+					if (mpresetResolution.mpreset !== null) {
+						const sessionMpreset = typeof existing.mpreset === "string" ? existing.mpreset : null;
+						if (sessionMpreset !== mpresetResolution.mpreset) {
+							return {
+								ok: false,
+								reason: "mpreset_conflict",
+								session_id: sessionId,
+								session_mpreset: sessionMpreset,
+								requested_mpreset: mpresetResolution.mpreset,
+							};
+						}
 					}
+
 					session = existing;
 					reusedSession = true;
 				} else {
-					const input = {
-						cwd: canonicalCwd,
-						prompt: undefined,
-						namespace: config.namespace,
-						worktree: true as const,
-					};
-					const started = services.startSession
-						? await services.startSession(input)
-						: await startTmuxSession(config, input, namespaceDir, commandRunner);
-					const startedRecord = asRecord(started);
-					if (!startedRecord) throw new Error("coordinator_session_command_required");
-					session = normalizeSession(startedRecord);
-					await writeJsonFile(sessionFile(session.session_id), session);
-					await appendCoordinatorEvent(namespaceDir, {
-						kind: "session.started",
-						sessionId: String(session.session_id),
-						summary: `Session ${String(session.session_id)} started by coordinator delegate`,
-						payloadRef: path.relative(namespaceDir, sessionFile(session.session_id)),
-						metadata: { delegate: true, workflow: delegateWorkflow },
-					});
-					const live = hasTmuxIdentity(session) ? await hasTmuxSession(session, commandRunner) : null;
-					await writeSessionState(namespaceDir, String(session.session_id), "ready_for_input", {
-						live,
-						reason: null,
-					});
+					session = await startCoordinatorSession(canonicalCwd, undefined, mpresetResolution.mpreset);
+					const ownerTransaction = asRecord(session.__coordinatorOwnerTransaction) as {
+						commit?: () => void;
+						rollback?: () => Promise<"cleaned" | "failed" | "unverifiable">;
+					} | null;
+					// Delegate-created sessions are ephemeral: the idle reaper may reclaim them once
+					// idle past the TTL with no active turn. User-registered sessions are never flagged.
+					session.ephemeral = true;
+					try {
+						if (mpresetResolution.mpreset) session.mpreset = mpresetResolution.mpreset;
+						await writeJsonFile(sessionFile(session.session_id), session);
+						await appendCoordinatorEvent(namespaceDir, {
+							kind: "session.started",
+							sessionId: String(session.session_id),
+							summary: `Session ${String(session.session_id)} started by coordinator delegate`,
+							payloadRef: path.relative(namespaceDir, sessionFile(session.session_id)),
+							metadata: { delegate: true, workflow: delegateWorkflow },
+						});
+						await writeSessionState(namespaceDir, String(session.session_id), "booting", {
+							live: null,
+							reason: "awaiting_runtime_readiness",
+						});
+						ownerTransaction?.commit?.();
+					} catch (error) {
+						if (ownerTransaction)
+							throw new CoordinatorStartError(
+								"coordinator_tmux_start_failed",
+								await compensateFailedOwnerStart(session, ownerTransaction),
+							);
+						throw error;
+					}
 				}
 
 				const sessionId = String(session.session_id);
-				const activeTurn = reusedSession ? await readActiveTurn(namespaceDir, sessionId) : null;
-				if (activeTurn && args.force !== true && args.queue !== true) {
+				assertSessionReadinessAuthority(session);
+				const prepared = await preparePromptTurn(session, taggedPrompt, {
+					force: args.force === true,
+					queue: args.queue === true,
+				});
+				if (!prepared.ok) {
 					return {
 						ok: false,
 						reason: "active_turn_exists",
 						session_id: sessionId,
-						active_turn_id: activeTurn.turn_id,
-					};
-				}
-				if (activeTurn && args.force === true) {
-					const timestamp = new Date().toISOString();
-					const superseded = {
-						...activeTurn,
-						status: "superseded" as const,
-						updated_at: timestamp,
-						completed_at: timestamp,
+						active_turn_id: prepared.activeTurn.turn_id,
 					};
-					await writeTurnRecord(namespaceDir, superseded);
-					await clearActiveTurn(namespaceDir, superseded);
 				}
-				const shouldQueue = args.queue === true && args.force !== true && !!activeTurn;
-				const turn = shouldQueue
-					? makeTurnRecord(config, sessionId, taggedPrompt, "queued")
-					: await activateTurn(session, makeTurnRecord(config, sessionId, taggedPrompt, "active"));
-				if (shouldQueue) await writeTurnRecord(namespaceDir, turn);
+				const { turn, priorActiveTurn: activeTurn, queued: shouldQueue } = prepared;
 				await appendCoordinatorEvent(namespaceDir, {
 					kind: "delegation.started",
 					sessionId,
@@ -2098,34 +4275,75 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				}
 				return base;
 			}
+			if (name === "skc_coordinator_stop_session") {
+				requireCoordinatorMutation(config, "sessions", args);
+				const sessionId = safeExternalId("session", args.session_id);
+				const forceRequested = args.force === true;
+				// force is a capability distinct from allow_mutation: reaping a non-ephemeral
+				// (user-registered) session requires SKC_COORDINATOR_MCP_FORCE_STOP to be enabled.
+				if (forceRequested && !config.forceStopEnabled) {
+					return { ok: false, reason: "force_not_authorized", session_id: sessionId, killed: false };
+				}
+				const result = await reapSession(sessionId, {
+					force: forceRequested,
+					reason: optionalString(args.reason) ?? "stop_session",
+				});
+				return {
+					ok: result.ok,
+					session_id: sessionId,
+					killed: result.killed,
+					...(result.reason ? { reason: result.reason } : {}),
+					...(result.active_turn_id ? { active_turn_id: result.active_turn_id } : {}),
+					...(result.detail ? { detail: result.detail } : {}),
+				};
+			}
 			if (name === "skc_coordinator_start_session") {
 				requireCoordinatorMutation(config, "sessions", args);
 				const cwd = await assertCoordinatorWorkdir(config, args.cwd);
-				const input = {
+				await preflightCoordinatorMutation(namespaceDir);
+				const mpresetResolution = await resolveCoordinatorMpreset(args.mpreset, loadModelProfiles);
+				if (!mpresetResolution.ok) {
+					return {
+						ok: false,
+						reason: mpresetResolution.reason,
+						mpreset: mpresetResolution.mpreset,
+						available_profiles: mpresetResolution.available_profiles,
+					};
+				}
+
+				const session = await startCoordinatorSession(
 					cwd,
-					prompt: typeof args.prompt === "string" ? args.prompt : undefined,
-					namespace: config.namespace,
-					worktree: true as const,
-				};
-				const started = services.startSession
-					? await services.startSession(input)
-					: await startTmuxSession(config, input, namespaceDir, commandRunner);
-				const startedRecord = asRecord(started);
-				if (!startedRecord) throw new Error("coordinator_session_command_required");
-				const session = normalizeSession(startedRecord);
-				await writeJsonFile(sessionFile(session.session_id), session);
-				await appendCoordinatorEvent(namespaceDir, {
-					kind: "session.started",
-					sessionId: String(session.session_id),
-					summary: `Session ${String(session.session_id)} started by coordinator`,
-					payloadRef: path.relative(namespaceDir, sessionFile(session.session_id)),
-					metadata: { prompted: typeof args.prompt === "string" && args.prompt.length > 0 },
-				});
-				const live = hasTmuxIdentity(session) ? await hasTmuxSession(session, commandRunner) : null;
-				let sessionState = await writeSessionState(namespaceDir, String(session.session_id), "ready_for_input", {
-					live,
-					reason: null,
-				});
+					typeof args.prompt === "string" ? args.prompt : undefined,
+					mpresetResolution.mpreset,
+				);
+				const ownerTransaction = asRecord(session.__coordinatorOwnerTransaction) as {
+					commit?: () => void;
+					rollback?: () => Promise<"cleaned" | "failed" | "unverifiable">;
+				} | null;
+				let sessionState: CoordinatorSessionState;
+				try {
+					if (mpresetResolution.mpreset) session.mpreset = mpresetResolution.mpreset;
+					await writeJsonFile(sessionFile(session.session_id), session);
+					await appendCoordinatorEvent(namespaceDir, {
+						kind: "session.started",
+						sessionId: String(session.session_id),
+						summary: `Session ${String(session.session_id)} started by coordinator`,
+						payloadRef: path.relative(namespaceDir, sessionFile(session.session_id)),
+						metadata: { prompted: typeof args.prompt === "string" && args.prompt.length > 0 },
+					});
+					sessionState = await writeSessionState(namespaceDir, String(session.session_id), "booting", {
+						live: null,
+						reason: "awaiting_runtime_readiness",
+					});
+					ownerTransaction?.commit?.();
+				} catch (error) {
+					if (ownerTransaction)
+						throw new CoordinatorStartError(
+							"coordinator_tmux_start_failed",
+							await compensateFailedOwnerStart(session, ownerTransaction),
+						);
+					throw error;
+				}
 				if (typeof args.prompt === "string" && args.prompt.length > 0) {
 					const turn = await activateTurn(
 						session,
@@ -2161,36 +4379,28 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			if (name === "skc_coordinator_send_prompt") {
 				requireCoordinatorMutation(config, "sessions", args);
 				const sessionId = safeExternalId("session", args.session_id);
+				await preflightCoordinatorMutation(namespaceDir, sessionId);
 				const session = asRecord(await readJsonFile(sessionFile(sessionId)));
 				if (!session) return { ok: false, reason: "unknown_session", session_id: sessionId };
 				if (typeof args.prompt !== "string" || args.prompt.length === 0)
 					return { ok: false, reason: "prompt_required" };
-				const activeTurn = await readActiveTurn(namespaceDir, sessionId);
-				if (activeTurn && args.force !== true && args.queue !== true) {
+				await readSessionState(namespaceDir, sessionId);
+				await readLatestEventSeq(namespaceDir);
+				assertSessionReadinessAuthority(session);
+				const prepared = await preparePromptTurn(session, args.prompt, {
+					force: args.force === true,
+					queue: args.queue === true,
+					queueWithoutActive: true,
+				});
+				if (!prepared.ok) {
 					return {
 						ok: false,
 						reason: "active_turn_exists",
 						session_id: sessionId,
-						active_turn_id: activeTurn.turn_id,
+						active_turn_id: prepared.activeTurn.turn_id,
 					};
 				}
-				if (activeTurn && args.force === true) {
-					const timestamp = new Date().toISOString();
-					const superseded = {
-						...activeTurn,
-						status: "superseded" as const,
-						updated_at: timestamp,
-						completed_at: timestamp,
-					};
-					await writeTurnRecord(namespaceDir, superseded);
-					await clearActiveTurn(namespaceDir, superseded);
-				}
-				const shouldQueue = args.queue === true && args.force !== true;
-				const turn = shouldQueue
-					? makeTurnRecord(config, sessionId, args.prompt, "queued")
-					: await activateTurn(session, makeTurnRecord(config, sessionId, args.prompt, "active"));
-				if (shouldQueue) await writeTurnRecord(namespaceDir, turn);
-				const recordedTurn = turn;
+				const { turn: recordedTurn, priorActiveTurn: activeTurn, queued: shouldQueue } = prepared;
 				const prompt = {
 					session_id: sessionId,
 					turn_id: recordedTurn.turn_id,
@@ -2224,7 +4434,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				const timeoutMs = boundedAwaitTurnTimeoutMs(args.timeout_ms);
 				const pollIntervalMs = boundedPollIntervalMs(args.poll_interval_ms);
 				const deadline = Date.now() + timeoutMs;
-				let payload = await readTurnPayload(args.turn_id, args.session_id, args.lines);
+				let payload = await withCoordinatorTransaction(
+					namespaceDir,
+					async () => await readTurnPayload(args.turn_id, args.session_id, args.lines),
+				);
 				while (
 					payload.ok === true &&
 					!TERMINAL_TURN_STATUSES.has((payload.turn as TurnRecord).status) &&
@@ -2236,7 +4449,10 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 						payload.turn as TurnRecord,
 						Math.min(pollIntervalMs, remainingMs),
 					);
-					payload = await readTurnPayload(args.turn_id, args.session_id, args.lines);
+					payload = await withCoordinatorTransaction(
+						namespaceDir,
+						async () => await readTurnPayload(args.turn_id, args.session_id, args.lines),
+					);
 				}
 				if (payload.ok === true && !TERMINAL_TURN_STATUSES.has((payload.turn as TurnRecord).status)) {
 					return {
@@ -2261,6 +4477,16 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				if (args.turn_id != null && question.turn_id !== safeTurnId(args.turn_id)) {
 					return { ok: false, reason: "question_turn_mismatch" };
 				}
+				await preflightCoordinatorMutation(namespaceDir);
+				const questionSessionId =
+					typeof question.session_id === "string" ? safeExternalId("session", question.session_id) : null;
+				if (!questionSessionId) throw coordinatorStateError("invalid");
+				await preflightCoordinatorMutation(namespaceDir, questionSessionId);
+				if (typeof question.turn_id === "string") {
+					const referencedTurn = await readTurnRecord(namespaceDir, question.turn_id);
+					if (!referencedTurn || referencedTurn.session_id !== questionSessionId)
+						throw coordinatorStateError("invalid");
+				}
 				const answeredTurnId = typeof question.turn_id === "string" ? question.turn_id : null;
 				const answered = {
 					...question,
@@ -2290,33 +4516,43 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 
 				let turn: TurnRecord | null = null;
 				if (answeredTurnId) {
-					turn = await readTurnRecord(namespaceDir, answeredTurnId);
-					if (turn) {
-						const timestamp = new Date().toISOString();
-						turn = {
-							...turn,
-							status: "active",
-							question_ids: [...new Set([...turn.question_ids, questionId])],
-							updated_at: timestamp,
-						};
-						await writeTurnRecord(namespaceDir, turn);
-						await writeActiveTurn(namespaceDir, turn);
-						await writeSessionState(namespaceDir, turn.session_id, "running", {
-							currentTurnId: turn.turn_id,
-							live: null,
-							reason: null,
+					const observedTurn = await readTurnRecord(namespaceDir, answeredTurnId);
+					if (observedTurn) {
+						turn = await withSessionTransition(observedTurn.session_id, async () => {
+							const current = await readTurnRecord(namespaceDir, answeredTurnId);
+							if (!current || !ACTIVE_TURN_STATUSES.has(current.status)) return current;
+							const timestamp = new Date().toISOString();
+							const answeredTurn: TurnRecord = {
+								...current,
+								status: "active",
+								question_ids: [...new Set([...current.question_ids, questionId])],
+								updated_at: timestamp,
+							};
+							await writeTurnRecord(namespaceDir, answeredTurn);
+							await writeActiveTurn(namespaceDir, answeredTurn);
+							await writeSessionState(namespaceDir, answeredTurn.session_id, "running", {
+								currentTurnId: answeredTurn.turn_id,
+								live: null,
+								reason: null,
+							});
+							const session = asRecord(await readJsonFile(sessionFile(answeredTurn.session_id)));
+							if (session && typeof args.answer === "string") {
+								await sendTmuxPrompt(session, args.answer, commandRunner, services.ownerIsolationProbe);
+							}
+							return answeredTurn;
 						});
-						const session = asRecord(await readJsonFile(sessionFile(turn.session_id)));
-						if (session && typeof args.answer === "string")
-							await sendTmuxPrompt(session, args.answer, commandRunner);
 					}
 				}
 				return { ok: true, question: answered, ...(turn ? { turn } : {}) };
 			}
 			if (name === "skc_coordinator_report_status") {
 				requireCoordinatorMutation(config, "reports", args);
+				await preflightCoordinatorMutation(namespaceDir);
+
 				const evidence = await validateEvidencePaths(args.evidence_paths);
 				const sessionId = args.session_id == null ? null : safeExternalId("session", args.session_id);
+				if (sessionId) await preflightCoordinatorMutation(namespaceDir, sessionId);
+
 				const report = {
 					session_id: sessionId,
 					turn_id: args.turn_id,
@@ -2329,61 +4565,79 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				};
 				let turn: TurnRecord | null = null;
 				let promotedTurn: TurnRecord | null = null;
+				let promotedPreparation: { session: Record<string, unknown>; turn: TurnRecord } | null = null;
 				if (args.turn_id != null) {
 					turn = await readTurnRecord(namespaceDir, args.turn_id);
 					if (!turn) return { ok: false, reason: "unknown_turn" };
 					if (sessionId != null && turn.session_id !== sessionId) {
 						return { ok: false, reason: "turn_session_mismatch" };
 					}
+					await preflightCoordinatorMutation(namespaceDir, turn.session_id);
 					const terminalStatus = asTerminalTurnStatus(args.status);
 					if (terminalStatus) {
-						const timestamp = new Date().toISOString();
-						turn = {
-							...turn,
-							status: terminalStatus,
-							delivery: {
-								...turn.delivery,
-								prompt_acknowledged: true,
-								state: "acknowledged",
-							},
-							final_response: {
-								text:
-									typeof args.summary === "string"
-										? args.summary
-										: typeof args.blocker === "string"
-											? args.blocker
-											: null,
-								format: "markdown",
-								source: "report_status",
-								artifact_path: null,
-								truncated: false,
-							},
-							evidence,
-							error:
-								terminalStatus === "failed"
-									? {
-											code: "reported_failure",
-											message:
-												typeof args.blocker === "string" ? args.blocker : String(args.summary ?? "failed"),
-											recoverable: true,
-										}
-									: null,
-							updated_at: timestamp,
-							completed_at: timestamp,
-						};
-						await writeTurnRecord(namespaceDir, turn);
-						await clearActiveTurn(namespaceDir, turn);
-						await writeSessionState(
-							namespaceDir,
-							turn.session_id,
-							terminalStatus === "failed" ? "errored" : "completed",
-							{
-								lastTurnId: turn.turn_id,
-								live: null,
-								reason: terminalStatus === "failed" ? "reported_failure" : null,
-							},
-						);
-						promotedTurn = await promoteNextQueuedTurn(turn.session_id);
+						const transition = await withSessionTransition(turn.session_id, async () => {
+							const current = await readTurnRecord(namespaceDir, turn?.turn_id);
+							if (!current || TERMINAL_TURN_STATUSES.has(current.status)) {
+								return { turn: current, promotion: null };
+							}
+							const timestamp = new Date().toISOString();
+							const terminalTurn: TurnRecord = {
+								...current,
+								status: terminalStatus,
+								delivery: {
+									...current.delivery,
+									prompt_acknowledged: true,
+									state: "acknowledged",
+								},
+								final_response: {
+									text:
+										typeof args.summary === "string"
+											? args.summary
+											: typeof args.blocker === "string"
+												? args.blocker
+												: null,
+									format: "markdown",
+									source: "report_status",
+									artifact_path: null,
+									truncated: false,
+								},
+								evidence,
+								error:
+									terminalStatus === "failed"
+										? {
+												code: "reported_failure",
+												message:
+													typeof args.blocker === "string"
+														? args.blocker
+														: String(args.summary ?? "failed"),
+												recoverable: true,
+											}
+										: null,
+								updated_at: timestamp,
+								completed_at: timestamp,
+							};
+							await writeTurnRecord(namespaceDir, terminalTurn);
+							await clearActiveTurn(namespaceDir, terminalTurn);
+							await writeSessionState(
+								namespaceDir,
+								terminalTurn.session_id,
+								terminalStatus === "failed" ? "errored" : "completed",
+								{
+									lastTurnId: terminalTurn.turn_id,
+									live: null,
+									reason: terminalStatus === "failed" ? "reported_failure" : null,
+								},
+							);
+							return {
+								turn: terminalTurn,
+								promotion: await prepareNextQueuedTurnUnlocked(terminalTurn.session_id),
+							};
+						});
+						turn = transition.turn;
+						promotedPreparation = transition.promotion;
+						if (promotedPreparation) {
+							promotedTurn = await completePreparedTurn(promotedPreparation.session, promotedPreparation.turn);
+						}
 					}
 				}
 				const reportId = `report-${Date.now()}`;
@@ -2399,21 +4653,60 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 							? args.summary
 							: `Report ${String(args.status ?? "unknown")} written`,
 					payloadRef: path.relative(namespaceDir, reportPath),
-					metadata: { status: typeof args.status === "string" ? args.status : null },
+					metadata: {
+						status: typeof args.status === "string" ? args.status : null,
+					},
 				});
 				return {
 					ok: true,
 					report,
-					...(turn ? { turn, session_state: await readSessionState(namespaceDir, turn.session_id) } : {}),
+					...(turn
+						? {
+								turn,
+								session_state: await readSessionState(namespaceDir, turn.session_id),
+							}
+						: {}),
 					...(promotedTurn ? { promoted_turn: promotedTurn } : {}),
 				};
 			}
 			return { ok: false, reason: "unknown_tool", tool: name };
 		} catch (error) {
-			return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+			const failure = error as { sessionId?: unknown; action?: unknown };
+			return {
+				ok: false,
+				reason: publicCoordinatorError(error),
+				...(publicCleanupStatus(error) ? { cleanup_status: publicCleanupStatus(error) } : {}),
+				...(typeof failure.sessionId === "string" ? { session_id: failure.sessionId } : {}),
+				...(typeof failure.action === "string" ? { action: failure.action } : {}),
+			};
 		}
 	}
 
+	async function callToolInternal(name: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
+		try {
+			if (
+				name === "skc_coordinator_await_turn" ||
+				name === "skc_coordinator_watch_events" ||
+				(name === "skc_coordinator_start_session" && typeof args.prompt === "string" && args.prompt.length > 0) ||
+				name === "skc_coordinator_send_prompt" ||
+				workflowForDelegateTool(name) !== null
+			) {
+				return await callToolUnlocked(name, args);
+			}
+			return await withCoordinatorTransaction(namespaceDir, async () => await callToolUnlocked(name, args));
+		} catch (error) {
+			return {
+				ok: false,
+				reason: publicCoordinatorError(error),
+				...(publicCleanupStatus(error) ? { cleanup_status: publicCleanupStatus(error) } : {}),
+			};
+		}
+	}
+
+	async function callTool(name: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
+		return publicCoordinatorResponse(await callToolInternal(name, args)) as Record<string, unknown>;
+	}
+
 	async function handleJsonRpc(request: JsonRpcRequest): Promise<JsonRpcResponse> {
 		const id = request.id ?? null;
 		if (request.method === "initialize") {
@@ -2427,8 +4720,15 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				},
 			};
 		}
+		if (request.method === "ping") {
+			return { jsonrpc: "2.0", id, result: {} };
+		}
 		if (request.method === "tools/list") {
-			return { jsonrpc: "2.0", id, result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) } };
+			return {
+				jsonrpc: "2.0",
+				id,
+				result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) },
+			};
 		}
 		if (request.method === "prompts/list") {
 			return { jsonrpc: "2.0", id, result: { prompts: [] } };
@@ -2437,17 +4737,31 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 			return { jsonrpc: "2.0", id, result: { resources: [] } };
 		}
 		if (request.method === "tools/call") {
-			const params = (request.params ?? {}) as { name?: string; arguments?: Record<string, unknown> };
+			const params = (request.params ?? {}) as {
+				name?: string;
+				arguments?: Record<string, unknown>;
+			};
 			const payload = await callTool(params.name ?? "", params.arguments ?? {});
-			return { jsonrpc: "2.0", id, result: textResult(payload, payload.ok === false) };
+			return {
+				jsonrpc: "2.0",
+				id,
+				result: textResult(payload, payload.ok === false),
+			};
 		}
-		return { jsonrpc: "2.0", id, error: { code: -32601, message: `unknown_method:${request.method}` } };
+		return {
+			jsonrpc: "2.0",
+			id,
+			error: { code: -32601, message: `unknown_method:${request.method}` },
+		};
 	}
 
-	return { config, callTool, handleJsonRpc, handle: handleJsonRpc };
+	return { config, callTool, handleJsonRpc, handle: handleJsonRpc, reapSession, sessionReaper };
 }
 
-function legacyToolResult(payload: unknown): { content: Array<{ type: "text"; text: string }>; isError: boolean } {
+function legacyToolResult(payload: unknown): {
+	content: Array<{ type: "text"; text: string }>;
+	isError: boolean;
+} {
 	const failed = typeof payload === "object" && payload !== null && (payload as { ok?: unknown }).ok === false;
 	return textResult(payload, failed);
 }
@@ -2468,13 +4782,21 @@ export async function handleCoordinatorMcpRequest(
 		};
 	}
 	if (request.method === "tools/list") {
-		return { jsonrpc: "2.0", id: request.id ?? null, result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) } };
+		return {
+			jsonrpc: "2.0",
+			id: request.id ?? null,
+			result: { tools: COORDINATOR_MCP_TOOL_NAMES.map(toolSchema) },
+		};
 	}
 	if (request.method === "prompts/list") {
 		return { jsonrpc: "2.0", id: request.id ?? null, result: { prompts: [] } };
 	}
 	if (request.method === "resources/list") {
-		return { jsonrpc: "2.0", id: request.id ?? null, result: { resources: [] } };
+		return {
+			jsonrpc: "2.0",
+			id: request.id ?? null,
+			result: { resources: [] },
+		};
 	}
 	if (request.method !== "tools/call")
 		return {
@@ -2482,11 +4804,14 @@ export async function handleCoordinatorMcpRequest(
 			id: request.id ?? null,
 			error: { code: -32601, message: `unknown_method:${request.method}` },
 		};
-	const params = (request.params ?? {}) as { name?: string; arguments?: Record<string, unknown> };
+	const params = (request.params ?? {}) as {
+		name?: string;
+		arguments?: Record<string, unknown>;
+	};
 	const args = params.arguments ?? {};
 	const server = createCoordinatorMcpServer({
 		env: options.env ?? process.env,
-		services: options.createSession ? { startSession: () => options.createSession?.() } : undefined,
+		services: options.createSession ? { startSession: input => options.createSession?.(input) } : undefined,
 	});
 	return {
 		jsonrpc: "2.0",
@@ -2495,23 +4820,226 @@ export async function handleCoordinatorMcpRequest(
 	};
 }
 
-export async function runCoordinatorMcpStdio(options: CoordinatorMcpServerOptions = {}): Promise<void> {
-	const server = createCoordinatorMcpServer(options);
+export interface PumpCoordinatorOptions {
+	/** Max concurrent in-flight *data* (non-control) handlers. Control frames (ping) bypass this. */
+	maxDataConcurrency?: number;
+	/** Max data requests queued waiting for a slot before overflow is rejected as server_busy. */
+	maxQueueDepth?: number;
+	/** Bounded wait for in-flight handlers/writes to settle after input ends. */
+	drainTimeoutMs?: number;
+}
+
+/**
+ * Pump a newline-delimited JSON-RPC stream with BOUNDED concurrent dispatch.
+ *
+ * A long-running tool call (e.g. skc_coordinator_await_turn, which polls for
+ * minutes) must not block the read loop from answering keepalive pings on the
+ * same stdio channel. But naive unbounded concurrency reintroduces its own
+ * hazards, so this pump enforces the safety envelope the coordinator needs:
+ *
+ *  - Control frames (ping) bypass the data-concurrency cap → keepalive is always
+ *    answerable even while data handlers saturate.
+ *  - Data handlers are capped at `maxDataConcurrency`; excess is queued up to
+ *    `maxQueueDepth`, then rejected as `server_busy` (bounded memory / fanout).
+ *  - A coded local `EPIPE` terminalizes writer and dispatch together; other
+ *    writer faults reject the pump without poisoning the serialized write chain.
+ *  - On EOF or a closed peer the pump drains already-running handlers (bounded
+ *    by `drainTimeoutMs`) and never promotes queued work.
+ *  - Byte chunks are decoded with a streaming decoder so multibyte characters
+ *    split across chunks are not corrupted.
+ */
+export async function pumpCoordinatorMcpStream(
+	handleJsonRpc: (request: JsonRpcRequest) => Promise<JsonRpcResponse>,
+	input: AsyncIterable<string | Uint8Array>,
+	writeLine: (line: string) => void | Promise<void>,
+	options: PumpCoordinatorOptions = {},
+): Promise<void> {
+	const maxDataConcurrency = Math.max(1, options.maxDataConcurrency ?? 32);
+	const maxQueueDepth = Math.max(0, options.maxQueueDepth ?? 256);
+	const drainTimeoutMs = Math.max(1, options.drainTimeoutMs ?? 30_000);
+
+	let writerState: "open" | "terminalizing" | "closed" = "open";
+	let draining = false;
+	let writeChain: Promise<void> = Promise.resolve();
+	const inFlight = new Set<Promise<void>>();
+	let activeData = 0;
+	const dataQueue: JsonRpcRequest[] = [];
+	const peerClosed = Promise.withResolvers<void>();
+	const writerFailure = Promise.withResolvers<never>();
+	void writerFailure.promise.catch(() => {});
+	const inputIterator = input[Symbol.asyncIterator]();
+	let inputDetached = false;
+	let fatalWriterFailure: { value: unknown } | undefined;
+
+	const detachInput = (): void => {
+		if (inputDetached) return;
+		inputDetached = true;
+		const detached = inputIterator.return?.();
+		if (detached) void detached.catch(() => {});
+	};
+	const terminalizePeer = (): void => {
+		if (writerState !== "open") return;
+		writerState = "terminalizing";
+		draining = true;
+		dataQueue.length = 0;
+		detachInput();
+		peerClosed.resolve();
+	};
+	const failWriter = (failure: unknown): void => {
+		if (writerState === "closed") return;
+		writerState = "closed";
+		draining = true;
+		dataQueue.length = 0;
+		detachInput();
+		fatalWriterFailure = { value: failure };
+
+		writerFailure.reject(failure);
+	};
+	const isExpectedPeerClosure = (failure: unknown): boolean =>
+		isKnownSinkPeerClosedError(failure) && sinkErrorCode(failure) === "EPIPE";
+
+	const emit = (response: JsonRpcResponse): Promise<void> => {
+		writeChain = writeChain.then(async () => {
+			if (writerState !== "open") return;
+			try {
+				await writeLine(`${JSON.stringify(response)}\n`);
+			} catch (failure) {
+				if (isExpectedPeerClosure(failure)) terminalizePeer();
+				else failWriter(failure);
+			}
+		});
+		return writeChain;
+	};
+
+	const launch = (request: JsonRpcRequest, control: boolean): void => {
+		const task = (async () => {
+			let response: JsonRpcResponse;
+			try {
+				response = await handleJsonRpc(request);
+			} catch (failure) {
+				response = {
+					jsonrpc: "2.0",
+					id: request.id ?? null,
+					error: { code: -32603, message: publicCoordinatorError(failure) },
+				};
+			}
+			await emit(response);
+			if (!control) {
+				activeData -= 1;
+				if (!draining && writerState === "open") {
+					const next = dataQueue.shift();
+					if (next) {
+						activeData += 1;
+						launch(next, false);
+					}
+				}
+			}
+		})();
+		inFlight.add(task);
+		void task.finally(() => inFlight.delete(task));
+	};
+
+	const dispatch = (request: JsonRpcRequest): void => {
+		if (writerState !== "open") return;
+		// Notifications (no id) get no response; the coordinator has no side-effecting ones.
+		if (request.id === undefined || request.id === null) return;
+		if (request.method === "ping") {
+			launch(request, true); // control frame: bypass the data cap
+			return;
+		}
+		if (activeData < maxDataConcurrency) {
+			activeData += 1;
+			launch(request, false);
+			return;
+		}
+		if (dataQueue.length < maxQueueDepth) {
+			dataQueue.push(request);
+			return;
+		}
+		void emit({
+			jsonrpc: "2.0",
+			id: request.id,
+			error: { code: -32000, message: "server_busy: coordinator request queue is full" },
+		});
+	};
+
+	const drainInFlightAndWrites = async (): Promise<void> => {
+		let timer: NodeJS.Timeout | undefined;
+		const timeout = new Promise<"timed_out">(resolve => {
+			timer = setTimeout(() => resolve("timed_out"), drainTimeoutMs);
+			(timer as { unref?: () => void }).unref?.();
+		});
+		const drain = async (): Promise<"drained"> => {
+			while (true) {
+				if (inFlight.size > 0) await Promise.allSettled([...inFlight]);
+				const writes = writeChain;
+				await writes;
+				if (inFlight.size === 0 && writes === writeChain) return "drained";
+			}
+		};
+		try {
+			if ((await Promise.race([drain(), timeout])) === "timed_out") {
+				writerState = "closed";
+				draining = true;
+				dataQueue.length = 0;
+				detachInput();
+			}
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	};
+
+	const decoder = new TextDecoder();
 	let buffer = "";
-	for await (const chunk of process.stdin) {
-		buffer += chunk.toString();
-		let newline = buffer.indexOf("\n");
-		while (newline >= 0) {
-			const line = buffer.slice(0, newline).trim();
-			buffer = buffer.slice(newline + 1);
-			if (line.length > 0) {
-				const request = JSON.parse(line) as JsonRpcRequest;
-				if (request.id !== undefined && request.id !== null) {
-					const response = await server.handleJsonRpc(request);
-					process.stdout.write(`${JSON.stringify(response)}\n`);
+	let inputFailure: unknown;
+	try {
+		while (writerState === "open") {
+			const next = await Promise.race([inputIterator.next(), peerClosed.promise, writerFailure.promise]);
+			if (!next || next.done) break;
+			buffer += typeof next.value === "string" ? next.value : decoder.decode(next.value, { stream: true });
+			let newline = buffer.indexOf("\n");
+			while (newline >= 0 && writerState === "open") {
+				const line = buffer.slice(0, newline).trim();
+				buffer = buffer.slice(newline + 1);
+				if (line.length > 0) {
+					let request: JsonRpcRequest | null = null;
+					try {
+						request = JSON.parse(line) as JsonRpcRequest;
+					} catch {
+						request = null; // ignore malformed frames rather than crashing the loop
+					}
+					if (request) dispatch(request);
 				}
+				newline = buffer.indexOf("\n");
 			}
-			newline = buffer.indexOf("\n");
 		}
+	} catch (failure) {
+		inputFailure = failure;
+	}
+
+	// Input EOF or a closed peer stops promotion. One deadline bounds both the
+	// active handlers and the serialized writes they have already queued.
+	draining = true;
+	dataQueue.length = 0;
+	await drainInFlightAndWrites();
+	if (fatalWriterFailure) throw fatalWriterFailure.value;
+	if (inputFailure !== undefined) throw inputFailure;
+	writerState = "closed";
+}
+
+export async function runCoordinatorMcpStdio(options: CoordinatorMcpServerOptions = {}): Promise<void> {
+	const server = createCoordinatorMcpServer(options);
+	server.sessionReaper.start(); // background idle-reap of ephemeral delegate sessions
+	try {
+		await pumpCoordinatorMcpStream(
+			request => server.handleJsonRpc(request),
+			process.stdin,
+			line =>
+				new Promise<void>((resolve, reject) => {
+					process.stdout.write(line, err => (err ? reject(err) : resolve()));
+				}),
+		);
+	} finally {
+		server.sessionReaper.stop();
 	}
 }