@sentropic/h2a-runtime 0.91.1 → 0.93.0

package/dist/index.js

@@ -18,6 +18,7 @@ import { syncConversation } from "./sync.js";
 import { attachLocalSession, attachPodTmux, capturePane, capturePaneVisible, clearPaneComposer, conductorRunning, currentTmuxSessionName, currentTmuxSessionIs, ensureManagedTmuxProfile, ensureHeadlessTerminal, existingLocalSessionSlugs, fanoutLabels, findLocalSession, killLocalSession, localSessionGatewayEnvStatus, listLocalSessions, listH2aStatusSurfaces, listLocalSessionsWithDiagnostics, localSessionIdle, localSessionPanePid, localSessionName, paneProcessObservation, paneTreeCpuMs, paneWorkerAttribution, paneWorkerAttributionFromView, paneWorkerPid, pasteLiteralBlock, submitPane, installH2aStatusSurface, managedSessionCandidates, parseManagedSessionName, openH2aStatusWindow, persistLaunchContext, readLaunchContext, readFleetProcView, relaunchInSession, resolveAgentPane, resolveAgentPaneForInstance, resolveLocalSession, sessionRelaunchSafety, runLocalCliForeground, sendKeysLiteral, sessionAttached, sessionAttachedCount, setLocalSessionDisplayName, slugify, cleanupHeadlessPromptFile, startH2aWindow, startH2aWindowVerified, startHeadlessSession, startLocalSession, tmuxAvailable, uninstallH2aStatusSurface, } from "./tmux.js";
 import { deliverInitialPrompt, sleepSync, } from "./prompt-delivery.js";
 import { buildLaunchContext } from "./launch-context.js";
+import { attachNativeSession, killNativeSessionTree, nativeHostAvailable, nativePromptDeliveryDeps, nativeSessionLiveness, nativeSessionPid, nativeTreeCpuMs, nativeWorkerPid, resolveSessionHostKind, startNativeH2aSidecar, startNativeHeadlessSession, startNativeSession, } from "./native-host.js";
 import { migrateTmuxNames } from "./tmux-name-migration.js";
 import { projectStatusForH2a } from "./status-projection.js";
 import { buildAgentLaunchArgs, isAgentLaunchEffort, isAgentLaunchProfile, } from "./agent-launch-args.js";
@@ -25,7 +26,7 @@ import { deriveSessionClass } from "./session-class.js";
 import { isRelaunchKillable, planRelaunch, relaunchContinuationPrompt, wakeRelaunchedSession, } from "./relaunch.js";
 import { isHumanFacingSession, legacySessionEvidence, readConversationCustomTitle, readLastLayout, reconcileRunConvIds, restore as restoreLayout, } from "./restore.js";
 import { getLayoutConfig } from "./config.js";
-import { advanceJob, coerceRegistryTool, enroll, enrollFromRun, isLive, listJobs, listLocalForLs, loadRegistry, loadRegistryWithDiagnostics, resolveLocalTmuxSessionForName, tryClaimSlot, withRegistryLock, resolveRegistryPath, } from "./registry.js";
+import { isManagedLocalKind, advanceJob, coerceRegistryTool, enroll, enrollFromRun, isLive, listJobs, listLocalForLs, loadRegistry, loadRegistryWithDiagnostics, probeNativeSession, probeTmuxSession, registryEntriesForNativeTarget, resolveLocalTmuxSessionForName, resolveManagedHost, tryClaimSlot, unreadableRegistryRowsForTarget, withRegistryLock, resolveRegistryPath, } from "./registry.js";
 import { auditSessionLeaseFleet, countLiveSessionLeases, SessionLeaseStore, decideSessionBeat, isSessionLeaseAlive, isSessionLeaseAbandoned, isSessionLeaseDeadBoot, planLeaseSupervision, reclaimProposals, resolveSessionLeasePath, } from "./session-lease.js";
 import { aimdEffectiveCap, assertDelegateEffort, assertSafeName, buildDelegateArgs, buildJobRows, buildRemoteDelegate, buildThrottleResumeArgs, canDelegateAtDepth, childDepthEnvValue, clampDepth, clampRemoteDepthBudget, conductorAdvisory, DEFAULT_MAX_CONCURRENT, DEPTH_ENV, inheritedDepthBudget, isDelegateType, isThrottleResumeDue, jitteredBackoffMs, JOB_ID_ENV, jobDir, planNextStarts, planThrottleStep, readJobResult, THROTTLE_MAX_ATTEMPTS, reconcileRemoteJobs, renderJobsTable, resolveJobCwd, runTrackMirror, sweepStaleJobs, trackItemNewArgs, trackItemRealizeArgs, } from "./delegate.js";
 import { detectThrottle, THROTTLE_TAIL_LINES } from "./throttle-signatures.js";
@@ -68,7 +69,8 @@ import { appendSessionLogEntry, clearBinding, clearExhaustion, enrollAccount, li
 const H2A_RUN_API_VERSION = "h2a.run/v1";
 const H2A_RUNTIME_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 import { CLI_PROFILES, gatewayModeForProfile, profileUsesLlmMeshGateway, } from "./protocol-local.js";
-import { enrollViaFacade, recordFacadeEnrollment, readLlmMeshConfig, startGateway, stopGateway, readGatewayPid, llmMeshLogPath, replaceAnthropicGatewayEnvironment, readLlmMeshSessionEnv, acquireLlmMeshSessionEnv, } from "./llm-mesh.js";
+import { enrollViaFacade, readLlmMeshConfig, startGateway, stopGateway, readGatewayPid, llmMeshLogPath, replaceAnthropicGatewayEnvironment, acquireLlmMeshSessionEnv, updateLlmMeshRoutingConfig, } from "./llm-mesh.js";
+import { describeLlmMeshRoutingConfig, parseLlmMeshRoutingConfig, preferredRoutingConfig, strategyRoutingConfig, } from "./llm-routing-config.js";
 const KNOWN_PROFILE_HELP = `${CLI_PROFILES.join(", ")} (aliases: claude-code, antigravity, gemini-cli, mistralcli)`;
 export const packageName = "@sentropic/h2a-runtime";
 export const H2A_RUNTIME_CLI_API_VERSION = 1;
@@ -792,9 +794,25 @@ export async function startJob(job) {
         }
     }
     // --- LOCAL (P1 path), now also queue-driven. ------------------------------
-    if (!tmuxAvailable()) {
+    // Honor the job's RECORDED host kind (a pending job enqueued before the
+    // native default keeps tmux); jobs without a local kind take the default.
+    const jobHostKind = job.kind === "local-native" || job.kind === "local-tmux"
+        ? job.kind
+        : resolveSessionHostKind({}) === "native"
+            ? "local-native"
+            : "local-tmux";
+    if (jobHostKind === "local-tmux" && !tmuxAvailable()) {
         return { started: false, error: "tmux is not installed locally" };
     }
+    if (jobHostKind === "local-native") {
+        const native = nativeHostAvailable();
+        if (!native.ok) {
+            return {
+                started: false,
+                error: `the native PTY host is unavailable: ${native.reason} (delegate with --tmux to use tmux)`,
+            };
+        }
+    }
     const originCwd = job.originCwd ?? process.cwd();
     let argv;
     try {
@@ -913,12 +931,26 @@ export async function startJob(job) {
     try {
         if (headless) {
             const dir = jobDir(originCwd, job.id);
-            const launched = startHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, undefined, false, "background");
+            if (jobHostKind === "local-native") {
+                const launched = startNativeHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, false, "background");
+                tmuxSession = launched.name;
+                workerPid = nativeWorkerPid(launched.name);
+            }
+            else {
+                const launched = startHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, undefined, false, "background");
+                tmuxSession = launched.name;
+                agentPane = launched.agentPane;
+                workerPid = launched.agentPane
+                    ? localSessionPanePid(launched.agentPane)
+                    : undefined;
+            }
+        }
+        else if (jobHostKind === "local-native") {
+            const launched = startNativeSession(job.tool, argv.command, runCwd, argv.args, job.id, { sessionClass: "background" });
             tmuxSession = launched.name;
-            agentPane = launched.agentPane;
-            workerPid = launched.agentPane
-                ? localSessionPanePid(launched.agentPane)
-                : undefined;
+            workerPid = nativeWorkerPid(launched.name);
+            const h2a = getH2aConfig();
+            startNativeH2aSidecar(tmuxSession, runCwd, h2a.command);
         }
         else {
             const launched = startLocalSession(job.tool, argv.command, runCwd, argv.args, job.id, undefined, { sessionClass: "background", attachedTerminal: true });
@@ -954,7 +986,7 @@ export async function startJob(job) {
     enroll({
         id: job.id,
         tool: job.tool,
-        kind: "local-tmux",
+        kind: jobHostKind,
         cwd: runCwd,
         source: "run",
         sessionClass: "background",
@@ -1156,15 +1188,24 @@ function formatIdle(ms) {
  * (control-plane) are phase 2 — see the TODOs at the call site.
  */
 export function resumeThrottledJob(job) {
-    if (job.kind !== "local-tmux" || job.headless !== true) {
+    if (!isManagedLocalKind(job.kind) || job.headless !== true) {
         return {
             started: false,
             error: "throttle-resume is headless-local only (phase 1)",
         };
     }
-    if (!tmuxAvailable()) {
+    if (job.kind === "local-tmux" && !tmuxAvailable()) {
         return { started: false, error: "tmux is not installed locally" };
     }
+    if (job.kind === "local-native") {
+        const native = nativeHostAvailable();
+        if (!native.ok) {
+            return {
+                started: false,
+                error: `the native PTY host is unavailable: ${native.reason}`,
+            };
+        }
+    }
     const task = job.task ?? "";
     const originCwd = job.originCwd ?? process.cwd();
     // The job's recorded `cwd` IS the runCwd it ran in (the worktree, or the
@@ -1221,11 +1262,18 @@ export function resumeThrottledJob(job) {
     let workerPid;
     try {
         const dir = jobDir(originCwd, job.id);
-        const launched = startHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, undefined, false, "background");
-        tmuxSession = launched.name;
-        workerPid = launched.agentPane
-            ? localSessionPanePid(launched.agentPane)
-            : undefined;
+        if (job.kind === "local-native") {
+            const launched = startNativeHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, false, "background");
+            tmuxSession = launched.name;
+            workerPid = nativeWorkerPid(launched.name);
+        }
+        else {
+            const launched = startHeadlessSession(job.tool, argv.command, runCwd, argv.args, join(dir, "result.json"), join(dir, "output.log"), job.id, undefined, undefined, false, "background");
+            tmuxSession = launched.name;
+            workerPid = launched.agentPane
+                ? localSessionPanePid(launched.agentPane)
+                : undefined;
+        }
     }
     catch (err) {
         return { started: false, error: err.message };
@@ -1258,7 +1306,7 @@ export function resumeThrottledJob(job) {
     enroll({
         id: job.id,
         tool: job.tool,
-        kind: "local-tmux",
+        kind: job.kind,
         cwd: runCwd,
         source: "run",
         sessionClass: "background",
@@ -1414,25 +1462,20 @@ async function injectLlmMeshGatewayEnv(mode = "auto", allowDirectFallback = true
     // A new local CLI session needs its own gateway token so account affinity is
     // keyed by that session's stable identity. The cached token remains useful
     // for callers that do not have a session identity (for example restore).
-    let meshEnv = clientSessionId
-        ? await acquireLlmMeshSessionEnv(undefined, clientSessionId)
-        : readLlmMeshSessionEnv() ?? (await acquireLlmMeshSessionEnv());
+    let meshEnv = await acquireLlmMeshSessionEnv(undefined, clientSessionId);
     if (!meshEnv) {
-        const config = readLlmMeshConfig();
-        if (config?.meshAccounts?.length) {
-            try {
-                const result = await startGateway(config, { clientSessionId });
-                meshEnv = {
-                    ANTHROPIC_BASE_URL: `http://localhost:${result.port}`,
-                    ANTHROPIC_AUTH_TOKEN: result.gatewayToken,
-                    ANTHROPIC_API_KEY: result.gatewayToken,
-                };
-                process.stderr.write(`[h2a] llm-mesh: gateway was stopped; started on ${meshEnv.ANTHROPIC_BASE_URL}\n`);
-            }
-            catch (err) {
-                if (allowDirectFallback) {
-                    process.stderr.write(`[h2a] llm-mesh: gateway env unavailable (${String(err)}); Claude may ask for login.\n`);
-                }
+        const config = readLlmMeshConfig() ?? {};
+        try {
+            const result = await startGateway(config, { clientSessionId });
+            meshEnv = {
+                ANTHROPIC_BASE_URL: `http://localhost:${result.port}`,
+                ANTHROPIC_AUTH_TOKEN: result.gatewayToken,
+            };
+            process.stderr.write(`[h2a] llm-mesh: gateway was stopped; started on ${meshEnv.ANTHROPIC_BASE_URL}\n`);
+        }
+        catch (err) {
+            if (allowDirectFallback) {
+                process.stderr.write(`[h2a] llm-mesh: gateway env unavailable (${String(err)}); Claude may ask for login.\n`);
             }
         }
     }
@@ -1444,7 +1487,11 @@ async function injectLlmMeshGatewayEnv(mode = "auto", allowDirectFallback = true
     }
     const alreadyCurrent = process.env.ANTHROPIC_BASE_URL === meshEnv.ANTHROPIC_BASE_URL &&
         process.env.ANTHROPIC_AUTH_TOKEN === meshEnv.ANTHROPIC_AUTH_TOKEN &&
-        process.env.ANTHROPIC_API_KEY === meshEnv.ANTHROPIC_API_KEY;
+        process.env.ANTHROPIC_API_KEY === undefined;
+    // Claude Code treats ANTHROPIC_API_KEY as a user-supplied third-party key
+    // and interrupts startup with a confirmation modal. The local gateway uses
+    // the documented custom-base-url lane: AUTH_TOKEN only.
+    delete process.env.ANTHROPIC_API_KEY;
     for (const [k, v] of Object.entries(meshEnv))
         process.env[k] = v;
     if (!alreadyCurrent) {
@@ -1468,14 +1515,7 @@ export async function prepareLlmMeshForRestore(opts = {}, context = {
     const mode = opts.mode ?? "auto";
     if (mode !== "gateway" && !context.runtimeEnabled)
         return;
-    const config = context.config;
-    if (!config?.meshAccounts?.length) {
-        if (mode === "gateway") {
-            throw new Error("llm-mesh gateway is required but unavailable: no Cloud Code enrollment; no agent was started");
-        }
-        process.stderr.write("[h2a] llm-mesh: restore config enabled, but no llm-mesh account is enrolled; Claude may ask for login.\n");
-        return;
-    }
+    const config = context.config ?? {};
     const port = config.port ?? 3002;
     const pid = context.gatewayPid;
     if (opts.dryRun) {
@@ -1489,7 +1529,9 @@ export async function prepareLlmMeshForRestore(opts = {}, context = {
         process.stderr.write(`[h2a] llm-mesh: restore context active (${gateway})\n`);
     }
 }
-function registryEntriesForLocalTmuxTarget(target, local, entries = loadRegistry()) {
+function registryEntriesForLocalTmuxTarget(target, local, 
+// No default read: the caller owns the registry READ STATE (F2).
+entries) {
     const parsedTarget = parseManagedSessionName(target);
     const canonicalSlug = local?.slug ?? parsedTarget?.slug ?? target;
     const tmuxSession = local?.name ?? target;
@@ -1515,9 +1557,21 @@ function registryEntriesForLocalTmuxTarget(target, local, entries = loadRegistry
             (e.tmuxSession !== undefined && candidates.includes(e.tmuxSession)));
     });
 }
-function registryEntryForResumeTarget(target, local) {
-    const evidence = legacySessionEvidence(homedir(), local === undefined ? listLocalSessions() : [local]);
-    const matches = registryEntriesForLocalTmuxTarget(target, local).filter((e) => {
+export function registryEntryForResumeTarget(target, local, 
+// No default read: resume performs ONE registry read and hands the same
+// snapshot to this lookup AND the host resolver — an unknown read refuses
+// upstream instead of flattening into "no entry" here (F1/F2).
+entries, evidence = legacySessionEvidence(homedir(), local === undefined ? listLocalSessions() : [local])) {
+    const matches = [
+        ...registryEntriesForLocalTmuxTarget(target, local, entries),
+        // A persisted kind:"local-native" session has no tmux-side identity, so
+        // the (deliberately tmux-scoped) filter above can never return it. This
+        // second leg resolves it by its own persisted identity — without it,
+        // resume falls through to the default-host path and a recorded native
+        // session would be re-created on tmux. The host is then chosen from
+        // entry.kind (never liveness) further down the resume verb.
+        ...registryEntriesForNativeTarget(target, entries),
+    ].filter((e) => {
         // Resume is a human-facing operation, not a promotion path. Share the
         // durable class test with restore so legacy human rows remain resumable,
         // while delegated jobs and explicit background launches stay excluded.
@@ -1537,7 +1591,20 @@ function registryEntryForResumeTarget(target, local) {
  * that names both prefix generations to fall through to a remote session.
  */
 function resolveManagedLocalTarget(target) {
-    const live = resolveLocalSession(target);
+    // CONJUNCTION RULE (F2): "no local session" may only be concluded when
+    // local absence is POSITIVELY known EVERYWHERE — the tmux inventory read
+    // succeeded and has no session, the registry read succeeded and has no
+    // row, and the native probe positively answered dead. ONE unknown
+    // anywhere poisons the conjunction: the result is "unknown", never
+    // "missing" (a destructive caller must refuse, not fall through).
+    const tmuxView = listLocalSessionsWithDiagnostics();
+    if (!tmuxView.known) {
+        return {
+            kind: "unknown",
+            reason: `tmux inventory unavailable${tmuxView.reason ? ` (${tmuxView.reason})` : ""}`,
+        };
+    }
+    const live = resolveLocalSession(target, tmuxView.sessions);
     if (live.kind === "found") {
         return { kind: "found", name: live.session.name, local: live.session };
     }
@@ -1547,13 +1614,40 @@ function resolveManagedLocalTarget(target) {
             names: live.sessions.map((session) => session.name).sort(),
         };
     }
-    const registered = resolveLocalTmuxSessionForName(target, loadRegistry());
+    const registryRead = loadRegistry();
+    if (registryRead.state === "unknown") {
+        // The durable record cannot be read: a local session may exist behind
+        // this name — transported as "unknown", never flattened to "missing".
+        return {
+            kind: "unknown",
+            reason: `registry read failed: ${registryRead.reason}`,
+        };
+    }
+    const registered = resolveLocalTmuxSessionForName(target, registryRead.entries);
     if (registered.kind === "found") {
         return { kind: "found", name: registered.name };
     }
     if (registered.kind === "ambiguous") {
         return { kind: "ambiguous", names: [...registered.names].sort() };
     }
+    // Self-healing for native sessions: the native HOST is the terminal's
+    // source of truth (the tmux-server twin). A registry row lost to a
+    // pre-native h2a write (old validators drop kind:"local-native" rows on
+    // rewrite) must not strand a live session, so probe the host directly.
+    // The probe is 3-state: a FAILED probe is "unknown" (a live native
+    // session cannot be ruled out), never a fall-through to "missing".
+    for (const candidate of [target, localSessionName(slugify(target))]) {
+        const alive = nativeSessionLiveness(candidate);
+        if (alive === true) {
+            return { kind: "found", name: candidate };
+        }
+        if (alive === "unknown") {
+            return {
+                kind: "unknown",
+                reason: `native host probe failed for ${candidate}`,
+            };
+        }
+    }
     return { kind: "missing" };
 }
 function reportAmbiguousLocalTarget(target, action, names) {
@@ -1977,6 +2071,10 @@ export async function main(argv) {
                 }
             }
             finally {
+                // REMOTE identity from THIS pull's own marker record (F1
+                // sorting): the local managed-host resolver has no remote leg —
+                // the session id comes from the marker this flow created and is
+                // stopped as the flow's own completion step, not re-resolved.
                 await stopRemoteSession(marker.remote, session.id, "pull-complete");
             }
             if (!remoteArchive) {
@@ -3399,17 +3497,16 @@ export async function main(argv) {
         .option("--codex [convId]", "resume/enroll a Codex conversation from the current directory; omit convId to let Codex show its selector")
         .option("--last", "with --claude/--codex, resume the last conversation for the current directory instead of showing a selector")
         .option("--attach", "attach after a successful resume, or attach an already-active session")
+        .option("--tmux", "host a BRAND-NEW resumed session in tmux instead of the native PTY host (permanent opt-in; native is only the default). An existing session never re-routes: it always resumes on its recorded host")
         .option("--replace", "replace an existing idle local tmux session without interactive confirmation")
         .option("--llm-gateway", "launch the CLI through the local llm-mesh gateway")
         .option("--gw", "alias for --llm-gateway")
         .option("--no-llm-gateway", "launch without llm-mesh gateway env")
         .option("--no-gw", "alias for --no-llm-gateway")
         .action(async (slug, opts) => {
-        if (!tmuxAvailable()) {
-            process.stderr.write("[h2a] tmux is not installed locally — `h2a resume` needs it (e.g. `sudo apt install tmux`).\n");
-            process.exitCode = 1;
-            return;
-        }
+        // NOTE: tmux availability is checked AFTER host resolution below — a
+        // `--tmux` flag must not block acting on an existing session whose
+        // recorded host does not need tmux at all.
         const explicitProfile = opts.claude !== undefined
             ? "claude"
             : opts.codex !== undefined
@@ -3450,17 +3547,32 @@ export async function main(argv) {
             return;
         }
         const target = slug ?? slugify(process.cwd());
-        const localResolution = resolveLocalSession(target);
-        if (localResolution.kind === "ambiguous") {
-            reportAmbiguousLocalTarget(target, "resume", localResolution.sessions.map((session) => session.name));
+        // PRE-RESOLUTION tmux view — display + registry-lookup input ONLY,
+        // never an act target: every act/attach/kill below derives from
+        // resolveManagedHost's kind + name (F1). The rename makes any act on
+        // it read as what it would be: acting on an unresolved object.
+        const preResolutionTmux = resolveLocalSession(target);
+        if (preResolutionTmux.kind === "ambiguous") {
+            reportAmbiguousLocalTarget(target, "resume", preResolutionTmux.sessions.map((session) => session.name));
             process.exitCode = 1;
             return;
         }
-        const local = localResolution.kind === "found"
-            ? localResolution.session
+        const preResolutionTmuxView = preResolutionTmux.kind === "found"
+            ? preResolutionTmux.session
             : undefined;
-        const displaySlug = local?.slug ?? parseManagedSessionName(target)?.slug ?? target;
-        const registryEntry = registryEntryForResumeTarget(target, local);
+        const displaySlug = preResolutionTmuxView?.slug ??
+            parseManagedSessionName(target)?.slug ??
+            target;
+        // ONE registry read for the whole resume: the entry lookup and the
+        // host resolver consume the SAME snapshot. Resume can kill — an
+        // unreadable registry refuses up front (F2), never "no entry".
+        const registryRead = loadRegistry();
+        if (registryRead.state === "unknown") {
+            process.stderr.write(`[h2a] cannot resume ${displaySlug}: the local registry is unreadable (${registryRead.reason}); refusing a destructive act on an unproven host state.\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const registryEntry = registryEntryForResumeTarget(target, preResolutionTmuxView, registryRead.entries);
         const resolvedConvId = explicitProfile === "claude" && opts.last
             ? localConvStat(process.cwd())?.convId
             : explicitConvId;
@@ -3473,7 +3585,9 @@ export async function main(argv) {
             ? {
                 id: displaySlug,
                 tool: explicitProfile,
-                kind: "local-tmux",
+                kind: (resolveSessionHostKind(opts) === "native"
+                    ? "local-native"
+                    : "local-tmux"),
                 cwd: process.cwd(),
                 label: displaySlug,
                 ...(resolvedConvId ? { convId: resolvedConvId } : {}),
@@ -3483,12 +3597,71 @@ export async function main(argv) {
                 source: "run",
             }
             : registryEntry;
-        const localIdle = local ? localSessionIdle(local.name) : false;
-        if (!entry && local && !localIdle && !opts.replace) {
+        // WHICH host serves this resume — resolved BEFORE ANY act (F1): every
+        // attach/kill/start below derives EXCLUSIVELY from this resolution's
+        // kind + name over the ONE registry snapshot read above. An option
+        // expresses an intent for a NEW session; it must NEVER win over the
+        // recorded host of an EXISTING session. The symmetric resolver
+        // consults BOTH persisted kinds (dual rows fail closed) and probes
+        // only for unrecorded sessions (--tmux stays the permanent opt-in
+        // creation switch — only the DEFAULT is native).
+        // The resolver QUERY: recorded facts for a registry-backed entry; the
+        // OBSERVED live identity (else the requested target) otherwise. A
+        // synthesized explicit-profile entry's tmuxSession is an INTENT (the
+        // canonical name a NEW session would take), not a recorded fact — it
+        // must not hide an existing session living under a legacy name.
+        const hostQuery = entry && !explicitProfile
+            ? (entry.tmuxSession ?? entry.id)
+            : (preResolutionTmuxView?.name ?? target);
+        // The WHOLE read (not just `.entries`, PART A/A2): an unreadable
+        // twin of `hostQuery` must poison this resolution BEFORE any act
+        // below derives from it, never only surface at the pre-kill recheck.
+        const hostResolution = resolveManagedHost(hostQuery, registryRead);
+        if (hostResolution.state === "ambiguous") {
+            process.stderr.write(`[h2a] cannot resume ${displaySlug}: this managed identity is recorded/live on BOTH local hosts (${hostResolution.candidates.join(", ")}); refusing to pick one. Clean up the conflicting registry rows first.\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (hostResolution.state === "unknown") {
+            process.stderr.write(`[h2a] cannot resume ${displaySlug}: local host state is unknown (${hostResolution.reason}); refusing to guess a host.\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const hostIsExisting = hostResolution.state === "recorded" ||
+            hostResolution.state === "discovered";
+        // Liveness ON THE RESOLVED HOST gates the acts below. 3-state: a
+        // probe failure REFUSES (resume can kill) — never absence (F2).
+        const actLiveness = hostIsExisting
+            ? hostResolution.kind === "local-native"
+                ? probeNativeSession(hostResolution.name)
+                : probeTmuxSession(hostResolution.name)
+            : "dead";
+        if (actLiveness === "unknown") {
+            process.stderr.write(`[h2a] cannot resume ${displaySlug}: the resolved local host state is unknown (probe failed); refusing a destructive act on an unproven host.\n`);
+            process.exitCode = 1;
+            return;
+        }
+        // The ONE act target for every effect below (F1): the resolver's
+        // exact kind + name, present only while the session is LIVE there.
+        const liveActTarget = hostIsExisting && actLiveness === "live"
+            ? { kind: hostResolution.kind, name: hostResolution.name }
+            : undefined;
+        // Idle is a TMUX pane concept; a live native session is conservatively
+        // NOT idle (never auto-replaced without an explicit --replace).
+        const actIdle = liveActTarget !== undefined && liveActTarget.kind === "local-tmux"
+            ? localSessionIdle(liveActTarget.name)
+            : false;
+        if (!entry &&
+            liveActTarget &&
+            liveActTarget.kind === "local-tmux" &&
+            !actIdle &&
+            !opts.replace) {
             process.stderr.write(`[h2a] local session ${displaySlug} already exists and does not look idle; no new CLI was started.\n`);
             if (opts.attach || explicitProfile) {
                 process.stderr.write(`[h2a] switching to existing session ${displaySlug}\n`);
-                process.exitCode = attachLocalSession(local.name);
+                // This gate is tmux-scoped (see condition); the attach targets
+                // the RESOLVED exact name (F1).
+                process.exitCode = attachLocalSession(liveActTarget.name);
                 return;
             }
             process.stderr.write(`[h2a] attach: h2a attach ${displaySlug}\n`);
@@ -3497,7 +3670,7 @@ export async function main(argv) {
         }
         if (!entry) {
             process.stderr.write(`[h2a] cannot resume ${displaySlug}: registry has no single local-tmux entry with profile, cwd and convId.\n`);
-            if (local) {
+            if (liveActTarget) {
                 process.stderr.write(`[h2a] local session ${displaySlug} exists but cannot be relaunched without a recorded convId.\n`);
                 process.stderr.write(`[h2a] attach: h2a attach ${displaySlug}\n`);
             }
@@ -3532,12 +3705,47 @@ export async function main(argv) {
             process.exitCode = 1;
             return;
         }
-        if (local && !localIdle && !opts.replace) {
+        if (opts.tmux === true &&
+            hostIsExisting &&
+            hostResolution.kind === "local-native") {
+            process.stderr.write(`[h2a] --tmux ignored for ${displaySlug}: an existing session keeps its recorded host (--tmux only applies to a brand-new session).\n`);
+        }
+        const resumeHost = hostIsExisting
+            ? hostResolution.kind === "local-native"
+                ? "native"
+                : "local-tmux"
+            : resolveSessionHostKind(opts);
+        // Host availability is checked BEFORE any replace/kill step so a live
+        // session can never be destroyed for a launch that cannot happen.
+        if (resumeHost === "native") {
+            const native = nativeHostAvailable();
+            if (!native.ok) {
+                process.stderr.write(`[h2a] the native PTY host is unavailable: ${native.reason}\n` +
+                    (hostIsExisting
+                        ? "[h2a] the session keeps its recorded host; nothing was started.\n"
+                        : "[h2a] pass --tmux to start the new session in tmux instead.\n"));
+                process.exitCode = 1;
+                return;
+            }
+        }
+        else if (!tmuxAvailable()) {
+            process.stderr.write("[h2a] tmux is not installed locally - resuming on the tmux host needs it (e.g. `sudo apt install tmux`).\n");
+            process.exitCode = 1;
+            return;
+        }
+        // A live NATIVE session without --replace deliberately falls PAST
+        // these tmux gates to the start path: startNativeSession ADOPTS the
+        // existing native session (Lot A semantics) — nothing is killed.
+        if (liveActTarget &&
+            liveActTarget.kind === "local-tmux" &&
+            !actIdle &&
+            !opts.replace) {
             const gatewayEnvStatus = explicitProfile === "claude" &&
                 (profile === "claude" || profile === "claude-code") &&
+                liveActTarget.kind === "local-tmux" &&
                 process.env.ANTHROPIC_BASE_URL &&
                 process.env.ANTHROPIC_AUTH_TOKEN
-                ? localSessionGatewayEnvStatus(local.name, {
+                ? localSessionGatewayEnvStatus(liveActTarget.name, {
                     baseUrl: process.env.ANTHROPIC_BASE_URL,
                     authToken: process.env.ANTHROPIC_AUTH_TOKEN,
                 })
@@ -3548,9 +3756,11 @@ export async function main(argv) {
             }
             process.stderr.write(`[h2a] local session ${displaySlug} already exists and does not look idle; no new ${profile} was started.\n`);
             if (opts.attach || explicitProfile) {
-                if (explicitProfile && currentTmuxSessionIs(local.name)) {
-                    gateway = await injectLlmMeshGatewayEnv(effectiveGatewayMode, true, local.name);
-                    persistLaunchContext(local.name, buildLaunchContext({
+                if (explicitProfile &&
+                    liveActTarget.kind === "local-tmux" &&
+                    currentTmuxSessionIs(liveActTarget.name)) {
+                    gateway = await injectLlmMeshGatewayEnv(effectiveGatewayMode, true, liveActTarget.name);
+                    persistLaunchContext(liveActTarget.name, buildLaunchContext({
                         profile,
                         cwd: entry.cwd,
                         label: displaySlug,
@@ -3561,20 +3771,23 @@ export async function main(argv) {
                     return;
                 }
                 process.stderr.write(`[h2a] switching to existing session ${displaySlug}\n`);
-                process.exitCode = attachLocalSession(local.name);
+                // This gate is tmux-scoped (see condition); the attach targets
+                // the RESOLVED exact name (F1).
+                process.exitCode = attachLocalSession(liveActTarget.name);
                 return;
             }
             process.stderr.write(`[h2a] attach: h2a attach ${displaySlug}\n`);
             process.exitCode = 2;
             return;
         }
-        if (local) {
-            if (!localIdle && opts.replace) {
-                process.stderr.write(`[h2a] local session ${displaySlug} does not look idle; --replace will kill tmux session ${local.name} before resuming${entry.convId ? ` ${entry.convId}` : ""}.\n`);
+        if (liveActTarget &&
+            (liveActTarget.kind === "local-tmux" || opts.replace)) {
+            if (!actIdle && opts.replace) {
+                process.stderr.write(`[h2a] local session ${displaySlug} does not look idle; --replace will kill ${liveActTarget.kind} session ${liveActTarget.name} before resuming${entry.convId ? ` ${entry.convId}` : ""}.\n`);
             }
             if (!opts.replace) {
                 process.stderr.write(`[h2a] local session ${displaySlug} already exists.\n`);
-                process.stderr.write(`[h2a] pane appears idle; replacing it will kill tmux session ${local.name} and resume${entry.convId ? ` conversation ${entry.convId}` : ""} in ${entry.cwd}.\n`);
+                process.stderr.write(`[h2a] pane appears idle; replacing it will kill ${liveActTarget.kind} session ${liveActTarget.name} and resume${entry.convId ? ` conversation ${entry.convId}` : ""} in ${entry.cwd}.\n`);
                 process.stderr.write(`[h2a] If another CLI is still writing this conversation, replacing can corrupt the .jsonl.\n`);
                 if (!(await confirmReplace(displaySlug))) {
                     process.stderr.write(`[h2a] takeover requires confirmation.\n`);
@@ -3585,13 +3798,27 @@ export async function main(argv) {
                     return;
                 }
             }
-            const rechecked = findLocalSession(displaySlug);
-            if (!rechecked) {
+            // RECHECK immediately before the kill — the SAME resolver over a
+            // FRESH read (never a tmux-only lookup): the identity must still
+            // resolve to the SAME host + name and still be live there; any
+            // drift (or an unknown) aborts without killing anything.
+            const recheck = resolveManagedHost(hostQuery, loadRegistry());
+            const recheckSameHost = (recheck.state === "recorded" || recheck.state === "discovered") &&
+                recheck.kind === liveActTarget.kind &&
+                recheck.name === liveActTarget.name;
+            const recheckLiveness = recheckSameHost
+                ? liveActTarget.kind === "local-native"
+                    ? probeNativeSession(liveActTarget.name)
+                    : probeTmuxSession(liveActTarget.name)
+                : "unknown";
+            if (!recheckSameHost || recheckLiveness !== "live") {
                 process.stderr.write(`[h2a] local session ${displaySlug} changed state before replace; aborting.\n`);
                 process.exitCode = 1;
                 return;
             }
-            if (!opts.replace && !localSessionIdle(rechecked.name)) {
+            if (!opts.replace &&
+                liveActTarget.kind === "local-tmux" &&
+                !localSessionIdle(liveActTarget.name)) {
                 process.stderr.write(`[h2a] local session ${displaySlug} is no longer idle; aborting.\n`);
                 process.exitCode = 1;
                 return;
@@ -3611,12 +3838,17 @@ export async function main(argv) {
                     return;
                 }
             }
-            if (!killLocalSession(rechecked.name)) {
+            // The kill derives from the RESOLVED kind + name only (F1): a
+            // homonymous session on the OTHER host must never absorb it.
+            const killed = liveActTarget.kind === "local-native"
+                ? killNativeSessionTree(liveActTarget.name)
+                : killLocalSession(liveActTarget.name);
+            if (!killed) {
                 process.stderr.write(`[h2a] local session ${displaySlug} could not be killed; no new ${profile} was started.\n`);
                 process.exitCode = 1;
                 return;
             }
-            process.stderr.write(`[h2a] replaced local session ${displaySlug} (${rechecked.name})\n`);
+            process.stderr.write(`[h2a] replaced local session ${displaySlug} (${liveActTarget.name})\n`);
         }
         else {
             if (entry.convId) {
@@ -3642,11 +3874,18 @@ export async function main(argv) {
                 process.stdin.isTTY === true &&
                 process.stdout.isTTY === true,
         });
-        const { name } = startLocalSession(profile, command, entry.cwd, args, resumeSlug, undefined, { sessionClass, attachedTerminal: true });
+        const { name } = resumeHost === "native"
+            ? startNativeSession(profile, command, entry.cwd, args, resumeSlug, {
+                sessionClass,
+                ...(entry.convId ? { resumeId: entry.convId } : {}),
+            })
+            : startLocalSession(profile, command, entry.cwd, args, resumeSlug, undefined, { sessionClass, attachedTerminal: true });
         enrollFromRun({
             profile,
             slug: resumeSlug,
             tmuxSession: name,
+            // The ACTUAL host that just started the terminal — never a default.
+            hostKind: resumeHost === "native" ? "local-native" : "local-tmux",
             cwd: entry.cwd,
             sessionClass,
             ...(entry.convId ? { convId: entry.convId } : {}),
@@ -3657,7 +3896,10 @@ export async function main(argv) {
             process.stderr.write(`[h2a] gateway active: ${gateway}\n`);
         }
         if (opts.attach) {
-            process.exitCode = attachLocalSession(name);
+            process.exitCode =
+                resumeHost === "native"
+                    ? attachNativeSession(name)
+                    : attachLocalSession(name);
             return;
         }
         process.stderr.write(`[h2a] attach: h2a attach ${resumeSlug}\n`);
@@ -3667,6 +3909,7 @@ export async function main(argv) {
         .description("Start a LOCAL session in tmux (claude/codex/…) in <path> (default: cwd), then attach this terminal by default. h2a applies its embedded scroll-safe tmux profile at launch; no ~/.tmux.conf is required. Manage it with `h2a ls`, `h2a attach <slug>`, and `h2a stop <slug>`. Detach with Ctrl-b d; the session keeps running.")
         .option("--no-attach", "start detached and print the attach command instead (for scripts / fan-out orchestration)")
         .option("--no-attached-terminal", "disable the persistent headless tmux client (legacy compatibility; cannot be used with --prompt-stdin)")
+        .option("--tmux", "host the session in tmux instead of the native PTY host (native is the default; H2A_SESSION_HOST=tmux flips the default fleet-wide)")
         .option("-r, --resume <convId>", "resume a specific conversation in the CLI")
         .option("--force", "start even if the conversation already has a live writer (risk: conversation .jsonl corruption)")
         .option("--name <label>", "tmux session slug + tab label (default: workdir basename); use to keep multiple sessions of one project distinct")
@@ -3725,10 +3968,22 @@ export async function main(argv) {
             process.exitCode = 2;
             return;
         }
-        if (!tmuxAvailable()) {
-            process.stderr.write("[h2a] tmux is not installed locally — `h2a run` needs it (e.g. `sudo apt install tmux`).\n");
-            process.exitCode = 1;
-            return;
+        const sessionHost = resolveSessionHostKind(opts);
+        if (sessionHost === "local-tmux") {
+            if (!tmuxAvailable()) {
+                process.stderr.write("[h2a] tmux is not installed locally — `h2a run --tmux` needs it (e.g. `sudo apt install tmux`).\n");
+                process.exitCode = 1;
+                return;
+            }
+        }
+        else {
+            const native = nativeHostAvailable();
+            if (!native.ok) {
+                process.stderr.write(`[h2a] the native PTY host is unavailable: ${native.reason}\n` +
+                    "[h2a] pass --tmux to host this session in tmux instead.\n");
+                process.exitCode = 1;
+                return;
+            }
         }
         let count = 1;
         if (opts.count !== undefined) {
@@ -3786,7 +4041,37 @@ export async function main(argv) {
         const labels = count > 1
             ? fanoutLabels(opts.name ?? basename(cwd), count)
             : [opts.name];
-        const existingLocalSessions = existingLocalSessionSlugs(labels, cwd);
+        const existingTmuxSlugs = tmuxAvailable()
+            ? existingLocalSessionSlugs(labels, cwd)
+            : [];
+        // Native existence is THREE-state (the resolver's probe vocabulary):
+        // a probe FAILURE is "unknown", never absence. Treating a thrown
+        // probe as "no session" would let `run --tmux --resume` start a tmux
+        // twin over a live-but-unprovable native writer (sol-F3): the same
+        // fail-closed rule as resolveManagedHost's rule 4 applies — refuse
+        // to launch on an unprovable host state.
+        const nativeExistence = labels
+            .map((label) => slugify(label ?? cwd))
+            .map((slug) => ({
+            slug,
+            probe: probeNativeSession(localSessionName(slug)),
+        }));
+        const unknownNativeSlugs = nativeExistence
+            .filter((probed) => probed.probe === "unknown")
+            .map((probed) => probed.slug);
+        if (unknownNativeSlugs.length > 0) {
+            for (const slug of unknownNativeSlugs) {
+                process.stderr.write(`[h2a] cannot start ${slug}: native host state is unknown (the probe failed) — a probe failure is never proof of absence; refusing to risk a second writer (fail closed).\n`);
+            }
+            process.exitCode = 1;
+            return;
+        }
+        const existingNativeSlugs = nativeExistence
+            .filter((probed) => probed.probe === "live")
+            .map((probed) => probed.slug);
+        const existingLocalSessions = [
+            ...new Set([...existingTmuxSlugs, ...existingNativeSlugs]),
+        ];
         if (existingLocalSessions.length > 0) {
             for (const slug of existingLocalSessions) {
                 process.stderr.write(`[h2a] local session ${slug} already exists; no new ${profile} was started.\n`);
@@ -3923,7 +4208,22 @@ export async function main(argv) {
                 mkdirSync(runDir, { recursive: true });
                 outputLog = join(runDir, "output.log");
                 resultJson = join(runDir, "result.json");
-                ({ name, slug, agentPane, promptFile } = startHeadlessSession(profile, command, cwd, args, resultJson, outputLog, label, getTmuxProfileConfig().profile, initialPrompt, structuredLaunch, sessionClass));
+                if (sessionHost === "native") {
+                    ({ name, slug, promptFile } = startNativeHeadlessSession(profile, command, cwd, args, resultJson, outputLog, label, initialPrompt, structuredLaunch, sessionClass));
+                }
+                else {
+                    ({ name, slug, agentPane, promptFile } = startHeadlessSession(profile, command, cwd, args, resultJson, outputLog, label, getTmuxProfileConfig().profile, initialPrompt, structuredLaunch, sessionClass));
+                }
+            }
+            else if (sessionHost === "native") {
+                ({ name, slug } = startNativeSession(profile, command, cwd, args, label, {
+                    ...(opts.resume !== undefined ? { resumeId: opts.resume } : {}),
+                    ...(initialPrompt !== undefined
+                        ? { terminateOnAgentExit: true }
+                        : {}),
+                    ...(structuredLaunch ? { refuseExisting: true } : {}),
+                    sessionClass,
+                }));
             }
             else {
                 ({ name, slug, agentPane } = startLocalSession(profile, command, cwd, args, label, getTmuxProfileConfig().profile, {
@@ -3939,15 +4239,37 @@ export async function main(argv) {
                     sessionClass,
                 }));
             }
-            if (structuredLaunch && !agentPane) {
+            if (structuredLaunch && sessionHost !== "native" && !agentPane) {
                 cleanupHeadlessPromptFile(promptFile);
+                // OWN-CLEANUP, deliberately NOT resolver-derived (F1 sorting):
+                // `name` is the session THIS command just created above, on the
+                // host it chose. Re-resolving could return missing/unknown and
+                // refuse — leaking the partial session it exists to remove.
                 killLocalSession(name);
                 process.stderr.write(`[h2a] could not capture the exact agent pane for ${slug}; the partial session was stopped\n`);
                 process.exitCode = 1;
                 return;
             }
             let h2aSidecarStarted = false;
-            if (h2aSidecar) {
+            if (h2aSidecar && sessionHost === "native") {
+                h2aSidecarStarted = startNativeH2aSidecar(name, cwd, h2a.command, {
+                    ...(structuredLaunch ? { verified: true } : {}),
+                });
+                if (!h2aSidecarStarted && structuredLaunch) {
+                    cleanupHeadlessPromptFile(promptFile);
+                    // OWN-CLEANUP, deliberately NOT resolver-derived (F1 sorting):
+                    // this kills the session THIS command just created on the host
+                    // it chose; the resolver could refuse and leak the partial.
+                    killNativeSessionTree(name);
+                    process.stderr.write(`[h2a] required h2a sidecar failed for ${slug}; the partial session was stopped\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (h2aSidecarStarted) {
+                    process.stderr.write(`[h2a] h2a sidecar session started for ${slug} (${h2a.command})\n`);
+                }
+            }
+            else if (h2aSidecar) {
                 if (structuredLaunch) {
                     try {
                         h2aSidecarStarted = Boolean(await startH2aWindowVerified(name, cwd, h2a.command, agentPane));
@@ -3962,6 +4284,9 @@ export async function main(argv) {
                 }
                 if (!h2aSidecarStarted && structuredLaunch) {
                     cleanupHeadlessPromptFile(promptFile);
+                    // OWN-CLEANUP, deliberately NOT resolver-derived (F1 sorting):
+                    // this kills the session THIS command just created on the host
+                    // it chose; the resolver could refuse and leak the partial.
                     killLocalSession(name);
                     process.stderr.write(`[h2a] required h2a sidecar failed for ${slug}; the partial session was stopped\n`);
                     process.exitCode = 1;
@@ -3978,15 +4303,17 @@ export async function main(argv) {
                 // OBSERVED — brief seen in a real composer, then real work — because
                 // reporting "started" over a lost brief is what left a lane inert
                 // for 33 minutes on 2026-07-28.
-                promptDelivery = deliverInitialPrompt(agentPane, initialPrompt, {
-                    capturePane: capturePaneVisible,
-                    clearComposer: clearPaneComposer,
-                    pasteBlock: pasteLiteralBlock,
-                    submit: submitPane,
-                    cpuMs: paneTreeCpuMs,
-                    sleep: sleepSync,
-                    now: () => Date.now(),
-                });
+                promptDelivery = sessionHost === "native"
+                    ? deliverInitialPrompt(name, initialPrompt, nativePromptDeliveryDeps(sleepSync))
+                    : deliverInitialPrompt(agentPane, initialPrompt, {
+                        capturePane: capturePaneVisible,
+                        clearComposer: clearPaneComposer,
+                        pasteBlock: pasteLiteralBlock,
+                        submit: submitPane,
+                        cpuMs: paneTreeCpuMs,
+                        sleep: sleepSync,
+                        now: () => Date.now(),
+                    });
                 if (promptDelivery.state !== "working") {
                     cleanupHeadlessPromptFile(promptFile);
                     // Only claim the session is gone when the kill actually reported
@@ -3994,7 +4321,12 @@ export async function main(argv) {
                     // same wider-than-its-evidence claim this change exists to remove,
                     // and a surviving partial session is precisely the idle lane the
                     // operator was just told could not happen.
-                    const stopped = killLocalSession(name);
+                    // OWN-CLEANUP, deliberately NOT resolver-derived (F1 sorting):
+                    // `name`/`sessionHost` are the session and host THIS command
+                    // just created; re-resolving could refuse and leak the partial.
+                    const stopped = sessionHost === "native"
+                        ? killNativeSessionTree(name)
+                        : killLocalSession(name);
                     const detail = promptDelivery.state === "submitted-idle"
                         ? `the brief was submitted but the agent never started working ` +
                             `(${Math.round(promptDelivery.cpuDeltaMs)}ms of CPU): it is not "started"`
@@ -4015,13 +4347,25 @@ export async function main(argv) {
                     return;
                 }
             }
-            const pid = agentPane
-                ? localSessionPanePid(agentPane)
-                : undefined;
-            const workerPid = agentPane !== undefined ? paneWorkerPid(agentPane) : undefined;
+            const pid = sessionHost === "native"
+                ? nativeSessionPid(name)
+                : agentPane
+                    ? localSessionPanePid(agentPane)
+                    : undefined;
+            const workerPid = sessionHost === "native"
+                ? nativeWorkerPid(name)
+                : agentPane !== undefined
+                    ? paneWorkerPid(agentPane)
+                    : undefined;
             if (structuredLaunch && pid === undefined) {
                 cleanupHeadlessPromptFile(promptFile);
-                killLocalSession(name);
+                // OWN-CLEANUP, deliberately NOT resolver-derived (F1 sorting):
+                // `name`/`sessionHost` are the session and host THIS command
+                // just created; re-resolving could refuse and leak the partial.
+                if (sessionHost === "native")
+                    killNativeSessionTree(name);
+                else
+                    killLocalSession(name);
                 process.stderr.write(`[h2a] could not verify the agent pane pid for ${slug}; the partial session was stopped\n`);
                 process.exitCode = 1;
                 return;
@@ -4033,6 +4377,8 @@ export async function main(argv) {
                 profile,
                 slug,
                 tmuxSession: name,
+                // The ACTUAL host that just started the terminal — never a default.
+                hostKind: sessionHost === "native" ? "local-native" : "local-tmux",
                 ...(pid !== undefined ? { pid } : {}),
                 ...(workerPid !== undefined ? { workerPid } : {}),
                 cwd,
@@ -4068,6 +4414,7 @@ export async function main(argv) {
                 session: {
                     id: only.slug,
                     tmuxSession: only.name,
+                    host: sessionHost === "native" ? "native" : "tmux",
                     profile,
                     workspace: cwd,
                     mode: opts.headless ? "headless" : "interactive",
@@ -4115,7 +4462,10 @@ export async function main(argv) {
             process.stderr.write(`[h2a] attach with: h2a attach ${only.slug}\n`);
             return;
         }
-        process.exitCode = attachLocalSession(only.name);
+        process.exitCode =
+            sessionHost === "native"
+                ? attachNativeSession(only.name)
+                : attachLocalSession(only.name);
         return;
     });
     // ---------------------------------------------------------------------------
@@ -4125,6 +4475,7 @@ export async function main(argv) {
         .command("delegate <type> <task>")
         .description("Delegate a task to a LIVE agent (claude/codex/agy) in a detached tmux session, primed with <task> (passed as a single argv — never shell-concatenated) and with the h2a side-window so the parent/master dialogue works. Returns a job id. Supervise with `h2a jobs`; drain the queue with `h2a jobs conduct`. `--remote` runs the job CONCURRENTLY in a SCW Pod on the shared RWX volume (subPath per job). Beyond the concurrency cap (default 16) the job is QUEUED (pending) and started by the conductor as slots free.")
         .option("--remote [url]", "run the job in a SCW Pod (concurrent; isolated by a per-job workspace subPath on the shared RWX volume) instead of a local tmux session; optional control-plane URL (default: the configured remote)")
+        .option("--tmux", "host the local job in tmux instead of the native PTY host (native is the default)")
         .option("--cwd <path>", "run the agent in this directory as-is (default: a dedicated git worktree under .h2a/jobs/<id>/wt when cwd is a repo, else cwd). Local only.")
         .option("--name <label>", "job id / tmux slug (letters/digits/_/-; default: <type>-<random>)")
         .option("--headless", "run-once-exit batch mode: claude -p / codex exec, stdout→output.log, write result.json, then END the session (no live agent; agy has no headless mode)")
@@ -4142,6 +4493,12 @@ export async function main(argv) {
             process.exitCode = 1;
             return;
         }
+        // Which local host runs this job's terminal (native default, --tmux
+        // per job, H2A_SESSION_HOST=tmux fleet-wide). Recorded on the job
+        // entry so the conductor honors it at (re)launch time.
+        const delegateLocalHostKind = resolveSessionHostKind(opts) === "native"
+            ? "local-native"
+            : "local-tmux";
         const jobType = type;
         try {
             assertDelegateEffort(jobType, opts.effort);
@@ -4220,7 +4577,7 @@ export async function main(argv) {
             enroll({
                 id: jobId,
                 tool: jobType,
-                kind: isRemote ? "remote" : "local-tmux",
+                kind: isRemote ? "remote" : delegateLocalHostKind,
                 cwd: isRemote ? `job-${jobId}` : process.cwd(),
                 source: isRemote ? "remote" : "run",
                 sessionClass: "background",
@@ -4257,7 +4614,7 @@ export async function main(argv) {
         const claimInput = {
             id: jobId,
             tool: jobType,
-            kind: (isRemote ? "remote" : "local-tmux"),
+            kind: (isRemote ? "remote" : delegateLocalHostKind),
             cwd: isRemote ? `job-${jobId}` : process.cwd(),
             source: (isRemote ? "remote" : "run"),
             sessionClass: "background",
@@ -4306,7 +4663,7 @@ export async function main(argv) {
             {
                 id: jobId,
                 tool: jobType,
-                kind: isRemote ? "remote" : "local-tmux",
+                kind: isRemote ? "remote" : delegateLocalHostKind,
                 cwd: process.cwd(),
                 enrolledAt: new Date().toISOString(),
                 lastSeenAt: new Date().toISOString(),
@@ -4399,7 +4756,13 @@ export async function main(argv) {
     // → the envelope is rejected (fail closed). Used to drop forged cross-job
     // envelopes from the shared RWX inbox before they reach the decision logic.
     const expectedInstanceOf = (jobId, type) => {
-        const job = loadRegistry().find((e) => e.id === jobId && e.role === "job");
+        const read = loadRegistry();
+        // Unknown registry read → undefined → the envelope is REJECTED (the
+        // same fail-closed arm as an unknown job): an unreadable registry never
+        // authenticates anything.
+        const job = read.state === "ok"
+            ? read.entries.find((e) => e.id === jobId && e.role === "job")
+            : undefined;
         if (!job)
             return undefined;
         if (type === "decision.reply")
@@ -5223,10 +5586,11 @@ export async function main(argv) {
         // Enroll + launch via the SAME path delegate uses (task rides argv, never a
         // shell string). Mark processed + record the cooldown timestamp regardless of
         // the spawn result (a failed spawn shouldn't tight-loop a watch).
+        const conductorHostKind = resolveSessionHostKind({}) === "native" ? "local-native" : "local-tmux";
         const launchEntry = {
             id: slug,
             tool: host,
-            kind: "local-tmux",
+            kind: conductorHostKind,
             cwd: process.cwd(),
             enrolledAt: new Date().toISOString(),
             lastSeenAt: new Date().toISOString(),
@@ -5243,7 +5607,7 @@ export async function main(argv) {
         enroll({
             id: slug,
             tool: host,
-            kind: "local-tmux",
+            kind: conductorHostKind,
             cwd: process.cwd(),
             source: "run",
             sessionClass: "background",
@@ -5285,7 +5649,16 @@ export async function main(argv) {
         .option("--confirm", "actually launch (default: dry-run — decide and print what WOULD launch, launch nothing)")
         .option("--watch <minutes>", "loop in the foreground every <minutes> (whole number >= 1); without it, runs a single pass and exits")
         .option("--cooldown <min>", "minimum minutes between launches for the SAME workspace (default 30)")
+        .option("--tmux", "host launched conductors in tmux instead of the native PTY host for this pass")
         .action(async (opts) => {
+        // Per-pass host opt-out rides the fleet valve: every kind decision in
+        // this pass (launch entries, startJob) reads H2A_SESSION_HOST. This
+        // is CREATION intent only — it selects the host of conductors this
+        // pass LAUNCHES; a job whose registry row already records a local
+        // kind keeps that recorded host (startJob honors job.kind first), so
+        // the valve can never re-route an existing session.
+        if (opts.tmux === true)
+            process.env["H2A_SESSION_HOST"] = "tmux";
         const confirm = opts.confirm === true;
         const cooldownMin = opts.cooldown !== undefined ? Number(opts.cooldown) : 30;
         if (!Number.isFinite(cooldownMin) || cooldownMin < 0) {
@@ -5534,13 +5907,110 @@ export async function main(argv) {
         .option("--yes", "confirm --all non-interactively (requires --apply)")
         .option("--include-agents", "with --all, include claude/codex/agy sessions that are excluded by default")
         .action(async (filter, opts) => {
-        if (!tmuxAvailable()) {
-            process.stderr.write("[h2a] tmux is not installed locally\n");
+        if (filter && opts.all) {
+            process.stderr.write("[h2a] relaunch accepts either one exact session name or --all, not both.\n");
             process.exitCode = 1;
             return;
         }
-        if (filter && opts.all) {
-            process.stderr.write("[h2a] relaunch accepts either one exact session name or --all, not both.\n");
+        // Native-PTY sessions: an exact filter whose registry record says
+        // kind:"local-native" is relaunched through the native host (the tmux
+        // inventory below cannot see it). --all sweeps stay tmux-only for now.
+        if (filter) {
+            const relaunchRead = loadRegistry();
+            if (relaunchRead.state === "unknown") {
+                // Relaunch KILLS before it recreates: an unreadable registry
+                // cannot prove which host (if any) owns this exact filter —
+                // refuse instead of falling through to the tmux sweep (F2).
+                process.stderr.write(`[h2a] cannot relaunch ${filter}: the local registry is unreadable (${relaunchRead.reason}); refusing a destructive act on an unproven host state.\n`);
+                process.exitCode = 1;
+                return;
+            }
+            const nativeEntry = relaunchRead.entries.find((e) => e.kind === "local-native" &&
+                !e.endedAt &&
+                (e.id === filter || e.label === filter || e.tmuxSession === filter));
+            const nativeName = nativeEntry?.tmuxSession ??
+                (nativeEntry ? localSessionName(nativeEntry.id) : undefined);
+            const nativeLiveness = nativeEntry && nativeName ? nativeSessionLiveness(nativeName) : false;
+            if (nativeLiveness === "unknown") {
+                // A probe failure is not death: neither the native relaunch (kill)
+                // nor the tmux sweep (which would treat this identity as absent)
+                // may proceed on an unprovable host state.
+                process.stderr.write(`[h2a] cannot relaunch ${filter}: native session ${nativeName} has an unknown host state (probe failed); refusing a destructive act on an unproven host.\n`);
+                process.exitCode = 1;
+                return;
+            }
+            if (nativeEntry && nativeName && nativeLiveness === true) {
+                // F1: the kill target derives from the ONE symmetric resolver over
+                // the same read — never directly from the row lookup above. A
+                // dual-host identity (ambiguous) or an unprovable one refuses here
+                // instead of letting the native leg absorb a contested name. The
+                // WHOLE read (not just `.entries`, PART A/A2): an unreadable twin
+                // of this identity must poison the resolution here too.
+                const hostResolution = resolveManagedHost(nativeEntry.tmuxSession ?? nativeEntry.id, relaunchRead);
+                if ((hostResolution.state !== "recorded" &&
+                    hostResolution.state !== "discovered") ||
+                    hostResolution.kind !== "local-native") {
+                    process.stderr.write(`[h2a] cannot relaunch ${filter}: this managed identity does not resolve to a single native host (resolver: ${hostResolution.state}); refusing a destructive act.\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                const actName = hostResolution.name;
+                const slug = nativeEntry.label ?? nativeEntry.id;
+                if (!opts.apply) {
+                    process.stderr.write(`[h2a] DRY-RUN — would relaunch NATIVE session ${slug} ` +
+                        `(${nativeEntry.tool}${nativeEntry.convId ? ` --resume ${nativeEntry.convId}` : ""} in ${nativeEntry.cwd}). ` +
+                        "Re-run with --apply.\n");
+                    return;
+                }
+                // Safety twin of the pane-CPU probe: a session burning CPU is
+                // WORKING; refuse to kill it without --yes.
+                const cpuBefore = nativeTreeCpuMs(actName);
+                sleepSync(1_500);
+                const cpuAfter = nativeTreeCpuMs(actName);
+                const busy = cpuBefore !== undefined &&
+                    cpuAfter !== undefined &&
+                    cpuAfter - cpuBefore > 300;
+                if (busy && opts.yes !== true) {
+                    process.stderr.write(`[h2a] native session ${slug} is actively working ` +
+                        `(+${Math.round((cpuAfter ?? 0) - (cpuBefore ?? 0))}ms CPU in 1.5s); ` +
+                        "pass --yes to relaunch it anyway.\n");
+                    process.exitCode = 1;
+                    return;
+                }
+                if (!killNativeSessionTree(actName)) {
+                    process.stderr.write(`[h2a] native session ${slug} could not be killed; nothing was relaunched.\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                const profile = nativeEntry.tool;
+                const command = localCliCommand(profile);
+                const useBare = shouldUseClaudeBare(profile);
+                const args = nativeEntry.convId
+                    ? localResumeArgs(profile, nativeEntry.convId, { bare: useBare })
+                    : localStartArgs(profile, { bare: useBare });
+                const relaunched = startNativeSession(profile, command, nativeEntry.cwd, args, slug, {
+                    ...(nativeEntry.convId ? { resumeId: nativeEntry.convId } : {}),
+                    ...(nativeEntry.sessionClass !== undefined
+                        ? { sessionClass: nativeEntry.sessionClass }
+                        : {}),
+                });
+                enrollFromRun({
+                    profile,
+                    slug,
+                    tmuxSession: relaunched.name,
+                    hostKind: "local-native",
+                    ...(relaunched.pid !== undefined ? { pid: relaunched.pid } : {}),
+                    cwd: nativeEntry.cwd,
+                    sessionClass: nativeEntry.sessionClass ?? "human",
+                    ...(nativeEntry.convId ? { convId: nativeEntry.convId } : {}),
+                });
+                process.stderr.write(`[h2a] native session ${slug} relaunched ` +
+                    `(${profile}${nativeEntry.convId ? ` --resume ${nativeEntry.convId}` : ""} in ${nativeEntry.cwd})\n`);
+                return;
+            }
+        }
+        if (!tmuxAvailable()) {
+            process.stderr.write("[h2a] tmux is not installed locally\n");
             process.exitCode = 1;
             return;
         }
@@ -5573,6 +6043,17 @@ export async function main(argv) {
             process.exitCode = 1;
             return;
         }
+        // Non-forced relaunch is non-destructive by design (it only retypes
+        // into idle shells, see below), so an unreadable registry does not
+        // exit 1 here — but `registryEntries` below would be `[]`, and every
+        // session would then read as "no matching registry conversation",
+        // which is a LIE: the truth is the registry couldn't be read at all.
+        // Name the real cause once, up front, and skip the misleading
+        // per-session reasons for this case.
+        if (!forced && !registry.known) {
+            process.stderr.write(`[h2a] registry is unreadable (${registry.reason ?? "no detail"}); cannot determine resumable conversations — relaunch refused for all ${sessions.length} managed session(s)\n`);
+            return;
+        }
         const registryEntries = registry.entries;
         const resolution = forced
             ? reconcileRunConvIds(registryEntries, (cwd, convId) => readConversationCustomTitle(homedir(), cwd, convId))
@@ -5743,7 +6224,18 @@ export async function main(argv) {
                 process.stderr.write(`[h2a] skipped ${action.slug}: liveness identity was unreadable immediately before kill.\n`);
                 continue;
             }
-            if (!killLocalSession(action.name, safety.identity)) {
+            // F1: the kill target must derive from the ONE symmetric resolver —
+            // a same-name identity recorded on the native host (dual) or an
+            // unprovable one must never be absorbed by the tmux sweep.
+            const hostResolution = resolveManagedHost(action.name, registryEntries);
+            if ((hostResolution.state !== "recorded" &&
+                hostResolution.state !== "discovered") ||
+                hostResolution.kind !== "local-tmux" ||
+                hostResolution.name !== action.name) {
+                process.stderr.write(`[h2a] skipped ${action.slug}: ${action.name} does not resolve to a single tmux host (resolver: ${hostResolution.state}); refusing a destructive act.\n`);
+                continue;
+            }
+            if (!killLocalSession(hostResolution.name, safety.identity)) {
                 process.stderr.write(`[h2a] skipped ${action.slug}: tmux session ${action.name} changed or was no longer proven dead immediately before kill.\n`);
                 continue;
             }
@@ -5759,6 +6251,9 @@ export async function main(argv) {
                     profile: action.profile,
                     slug: action.slug,
                     tmuxSession: name,
+                    // startLocalSession above launched a tmux terminal: record the
+                    // ACTUAL host explicitly (the write boundary refuses defaults).
+                    hostKind: "local-tmux",
                     cwd: entry.cwd,
                     sessionClass,
                     convId: action.convId,
@@ -5820,7 +6315,11 @@ export async function main(argv) {
     /** Interactive (claude/codex/agy) local-tmux sessions, optional slug filter. */
     const listInteractiveThrottleSessions = (filter) => {
         const enrolledAtBySlug = new Map();
-        for (const e of loadRegistry()) {
+        // Unknown registry read → empty map (degrade): enrolledAt only refines
+        // the throttle bookkeeping's startedAt; sessions still come from the
+        // live tmux inventory, so nothing is asserted absent.
+        const throttleRead = loadRegistry();
+        for (const e of throttleRead.state === "ok" ? throttleRead.entries : []) {
             if (e.kind === "local-tmux")
                 enrolledAtBySlug.set(e.id, e.enrolledAt);
         }
@@ -5894,7 +6393,11 @@ export async function main(argv) {
         });
         let nudged = 0;
         if (apply) {
-            const leaseIdByTmuxSession = new Map(loadRegistry()
+            // Unknown registry read → empty map (degrade): the nudge then goes
+            // through relaunchInSession instead of the lease-scoped variant; no
+            // session is asserted absent and nothing is killed either way.
+            const leaseRead = loadRegistry();
+            const leaseIdByTmuxSession = new Map((leaseRead.state === "ok" ? leaseRead.entries : [])
                 .filter((entry) => entry.tmuxSession !== undefined)
                 .map((entry) => [entry.tmuxSession, entry.id]));
             for (const r of plan.toResume) {
@@ -6283,6 +6786,13 @@ export async function main(argv) {
                 process.exitCode = 1;
                 return;
             }
+            if (localTarget.kind === "unknown") {
+                // Unknown ≠ missing: falling through to the remote lookup would
+                // attach a REMOTE homonym over an unprovable local session (F2).
+                process.stderr.write(`[h2a] cannot attach ${first}: local session state is unknown (${localTarget.reason}); attach refused (fail closed).\n`);
+                process.exitCode = 1;
+                return;
+            }
             // A session started by `h2a run` is enrolled in the registry as
             // kind:"local-tmux". Trust that durable record even when a transient
             // `tmux list-sessions` miss hides the live session — otherwise a purely
@@ -6298,8 +6808,37 @@ export async function main(argv) {
                     process.exitCode = 1;
                     return;
                 }
+                // WHICH host: the symmetric resolver over BOTH persisted kinds —
+                // a recorded host wins REGARDLESS of the other host's liveness,
+                // probes only DISCOVER a session with no registry row, dual rows
+                // and probe failures fail closed. Liveness then gates the ACT
+                // below; it never re-routes a recorded session.
+                const resolution = resolveManagedHost(localName, loadRegistry());
+                if (resolution.state === "ambiguous") {
+                    process.stderr.write(`[h2a] cannot attach ${first}: this managed identity is recorded/live on BOTH local hosts (${resolution.candidates.join(", ")}); refusing to pick one. Clean up the conflicting registry rows first.\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (resolution.state === "unknown") {
+                    process.stderr.write(`[h2a] cannot attach ${first}: local host state is unknown (${resolution.reason}); attach refused (fail closed).\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (resolution.state === "missing") {
+                    process.stderr.write(`[h2a] no local session "${first}" on either local host (see: h2a ls)\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                // Every act below targets the RESOLVED exact name (F1) — never
+                // the pre-resolution lookup's name.
+                const nativeTarget = resolution.kind === "local-native";
                 if (opts.headlessTerminal) {
-                    const terminal = ensureHeadlessTerminal(localName);
+                    if (nativeTarget) {
+                        process.stderr.write(`[h2a] ${first} is hosted by the native PTY host, which owns a persistent PTY already; --headless-terminal is tmux-only.\n`);
+                        process.exitCode = 1;
+                        return;
+                    }
+                    const terminal = ensureHeadlessTerminal(resolution.name);
                     if (terminal.state === "unavailable") {
                         process.stderr.write(`[h2a] could not attach a persistent terminal to ${first}: ${terminal.reason}\n`);
                         process.exitCode = 1;
@@ -6308,7 +6847,27 @@ export async function main(argv) {
                     process.stderr.write(`[h2a] persistent terminal ${terminal.state} for ${first} (${terminal.attachedClients} attached client(s))\n`);
                     return;
                 }
-                process.exitCode = attachLocalSession(localName);
+                if (nativeTarget) {
+                    // Liveness gates the ACT, not the host choice: attaching to a
+                    // session that is not running is refused on its own host — it
+                    // must never degrade into a tmux attach of the same name. A
+                    // probe FAILURE is not death: it refuses with its own reason.
+                    const nativeState = probeNativeSession(resolution.name);
+                    if (nativeState === "dead") {
+                        process.stderr.write(`[h2a] native session ${first} is not running; attach refused ` +
+                            `(the session stays native — resume it with h2a resume ${first}).\n`);
+                        process.exitCode = 1;
+                        return;
+                    }
+                    if (nativeState === "unknown") {
+                        process.stderr.write(`[h2a] native session ${first}: host state is unknown (probe failed); attach refused (fail closed).\n`);
+                        process.exitCode = 1;
+                        return;
+                    }
+                }
+                process.exitCode = nativeTarget
+                    ? attachNativeSession(resolution.name)
+                    : attachLocalSession(resolution.name);
                 return;
             }
         }
@@ -6490,13 +7049,93 @@ export async function main(argv) {
                 process.exitCode = 1;
                 return;
             }
+            if (localTarget.kind === "unknown") {
+                // Unknown ≠ missing: stop is DESTRUCTIVE — falling through here
+                // would aim the kill at a REMOTE homonym of an unprovable local
+                // session (F2, fail closed).
+                process.stderr.write(`[h2a] cannot stop ${first}: local session state is unknown (${localTarget.reason}); refusing a destructive act on an unproven host state.\n`);
+                process.exitCode = 1;
+                return;
+            }
+            // A3 (PART A guard-before-act, sol-2): the per-identity
+            // unreadable-row guard is evaluated HERE — before EITHER the
+            // found/kill branch below OR the remote-fallthrough — never after
+            // an act. It used to sit ~30 lines below, reachable only past the
+            // found branch's `return`: for a valid row + an unreadable TWIN of
+            // the SAME name, `localTarget.kind` is "found" and the kill ran
+            // before this check was ever consulted (dead code in that mixed
+            // case). resolveManagedHost's own per-identity check (A2, below)
+            // ALSO catches this same identity independently — this is
+            // deliberate defense-in-depth at the one place every branch shares,
+            // not the only place it is caught.
+            // Defense-in-depth ABOVE A2 (the resolver-level per-identity
+            // `unreadable` check in resolveManagedHost). A2's position is
+            // proven by the RESUME/RESTORE wiring tests; STOP additionally
+            // carries THIS guard. Do NOT remove this guard as "redundant"
+            // without first adding a stop test that reddens on A2's position —
+            // otherwise stop's dependency on A2 would become silent.
+            const unreadable = unreadableRegistryRowsForTarget(first);
+            // B3 — this is itself a RE-READ (a TOCTOU window against the first
+            // read inside resolveManagedLocalTarget above): "unknown" must
+            // refuse exactly like the first read did, never re-flatten into
+            // "no unreadable row" and fall through past this guard.
+            if (unreadable === "unknown") {
+                process.stderr.write(`[h2a] cannot stop ${first}: local host state became unknown while resolving this stop — the registry could not be re-read for this identity (fail closed); stop refuses to fall through to a remote session of the same name. Retry once the registry is readable.\n`);
+                process.exitCode = 1;
+                return;
+            }
+            if (unreadable.length > 0) {
+                const unreadableIds = unreadable
+                    .map((row) => (typeof row.id === "string" ? row.id : "<no id>"))
+                    .join(", ");
+                process.stderr.write(`[h2a] cannot stop ${first}: local host state is unknown — an unreadable registry row exists for this identity (row id: ${unreadableIds}) in ${resolveRegistryPath()} (kind absent/unreadable); the row is preserved but cannot be acted on, and stop refuses to fall through to a remote session of the same name (fail closed). Inspect the row before retrying.\n`);
+                process.exitCode = 1;
+                return;
+            }
             if (localTarget.kind === "found") {
-                const ok = killLocalSession(localTarget.name);
-                process.stderr.write(`[h2a] local session ${localTarget.local?.slug ?? first} ${ok ? "killed" : "could not be killed"}\n`);
+                // WHICH host: the symmetric resolver over BOTH persisted kinds —
+                // a recorded host wins REGARDLESS of the other host's liveness
+                // (a persisted tmux row must never let a homonymous live native
+                // process swallow the kill: F2), probes only DISCOVER a session
+                // with no registry row, and dual rows / probe failures FAIL
+                // CLOSED — stop is destructive, so it never guesses a host.
+                const resolution = resolveManagedHost(localTarget.name, loadRegistry());
+                if (resolution.state === "ambiguous") {
+                    process.stderr.write(`[h2a] cannot stop ${first}: this managed identity is recorded/live on BOTH local hosts (${resolution.candidates.join(", ")}); refusing to kill either. Clean up the conflicting registry rows first.\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (resolution.state === "unknown") {
+                    process.stderr.write(`[h2a] cannot stop ${first}: local host state is unknown (${resolution.reason}); refusing a destructive act on an unproven host.\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                if (resolution.state === "missing") {
+                    process.stderr.write(`[h2a] no local session "${first}" on either local host (see: h2a ls)\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                // The kill derives from the RESOLVED kind + name only (F1) —
+                // never the pre-resolution lookup's name.
+                const nativeTarget = resolution.kind === "local-native";
+                const ok = nativeTarget
+                    ? killNativeSessionTree(resolution.name)
+                    : killLocalSession(resolution.name);
+                process.stderr.write(`[h2a] ${nativeTarget ? "native" : "local"} session ${localTarget.local?.slug ?? first} ${ok ? "killed" : "could not be killed"}\n`);
                 if (!ok)
                     process.exitCode = 1;
                 return;
             }
+            // CONJUNCTION RULE (F2): reaching stopRemoteSession below requires
+            // local absence to be POSITIVELY known EVERYWHERE — the tmux
+            // inventory read succeeded with no session AND the registry read
+            // succeeded with no row AND the native probe answered dead (all
+            // enforced by resolveManagedLocalTarget returning "missing", since
+            // any unknown there returns "unknown" and refuses above) AND, last,
+            // no UNREADABLE row exists for this identity (kind absent/invalid,
+            // sol-2, checked above BEFORE this branch is even reached). One
+            // unknown anywhere poisons the conjunction; falling through would
+            // aim a DESTRUCTIVE stop at a REMOTE homonym of the same id.
         }
         const { url, sessionId } = resolveUrlAndSessionId(first, second);
         const result = await stopRemoteSession(url, sessionId, opts.reason);
@@ -6928,26 +7567,68 @@ export async function main(argv) {
             const account = await enrollViaFacade(provider, {
                 ...(opts.configRef ? { configRef: opts.configRef } : {}),
             });
-            recordFacadeEnrollment(account);
-            process.stdout.write(`[h2a] llm-mesh: enrolled ${account.label} ` +
-                `(id: ${account.accountId}, provider: ${account.provider})\n`);
+            process.stdout.write(`[h2a] llm-mesh: enrolled ${account.provider}; ` +
+                "account inventory remains in Sentropic\n");
         }
         catch (error) {
             process.stderr.write(`[h2a] llm-mesh: ${error instanceof Error ? error.message : String(error)}\n`);
             process.exitCode = 1;
         }
     });
+    const llmMeshRouteCommand = llmMeshCommand
+        .command("route")
+        .alias("routing")
+        .description("Show or change the public llm-mesh routing policy");
+    llmMeshRouteCommand
+        .command("show")
+        .description("Show the effective route order, fallback and policy controls")
+        .action(() => {
+        const config = readLlmMeshConfig();
+        process.stdout.write(`${JSON.stringify(describeLlmMeshRoutingConfig(config?.routing), null, 2)}\n`);
+    });
+    llmMeshRouteCommand
+        .command("prefer <transports...>")
+        .description("Prefer transports in order (example: codex cloud-code)")
+        .action((transports) => {
+        const config = readLlmMeshConfig();
+        const routing = preferredRoutingConfig(config?.routing, transports);
+        updateLlmMeshRoutingConfig(routing);
+        process.stdout.write(`[h2a] llm-mesh: preferred route order is ${transports.join(" > ")} ` +
+            "for new affinities\n");
+    });
+    llmMeshRouteCommand
+        .command("strategy <name>")
+        .description("Use last-enrolled or round-robin for new affinities")
+        .action((name) => {
+        if (name !== "last-enrolled" && name !== "round-robin") {
+            throw new Error("strategy must be last-enrolled or round-robin");
+        }
+        const config = readLlmMeshConfig();
+        const routing = strategyRoutingConfig(config?.routing, name);
+        updateLlmMeshRoutingConfig(routing);
+        process.stdout.write(`[h2a] llm-mesh: ${name} routing enabled for new affinities\n`);
+    });
+    llmMeshRouteCommand
+        .command("policy <json>")
+        .description("Validate and install a complete serialized mesh policy/profile config")
+        .action((json) => {
+        const routing = parseLlmMeshRoutingConfig(json);
+        updateLlmMeshRoutingConfig(routing);
+        process.stdout.write("[h2a] llm-mesh: routing policy validated and installed\n");
+    });
+    llmMeshRouteCommand
+        .command("reset")
+        .description("Return new affinities to llm-mesh safe defaults")
+        .action(() => {
+        updateLlmMeshRoutingConfig(undefined);
+        process.stdout.write("[h2a] llm-mesh: routing policy reset to mesh defaults\n");
+    });
     llmMeshCommand
         .command("start")
         .description("Start the local LLM gateway")
         .option("-v, --verbose", "verbose output")
         .action(async (opts) => {
-        const config = readLlmMeshConfig();
-        if (!config || !config.meshAccounts?.length) {
-            process.stderr.write(`[h2a] llm-mesh: no Cloud Code account configured. Run \`h2a llm-mesh enroll cloud-code\` first.\n`);
-            process.exitCode = 1;
-            return;
-        }
+        const config = readLlmMeshConfig() ?? {};
         const existing = readGatewayPid();
         if (existing) {
             setLlmMeshRuntimeConfig({ enabled: true });
@@ -6961,9 +7642,7 @@ export async function main(argv) {
         const port = result.port;
         process.stdout.write(`[h2a] llm-mesh: gateway started (pid ${result.pid}, port ${port})\n`);
         process.stdout.write(`[h2a] llm-mesh: restore config enabled\n`);
-        process.stdout.write(`\nTo use with Claude Code:\n`);
-        process.stdout.write(`  export ANTHROPIC_BASE_URL=http://localhost:${port}\n`);
-        process.stdout.write(`  export ANTHROPIC_AUTH_TOKEN=${result.gatewayToken}\n`);
+        process.stdout.write("[h2a] llm-mesh: use `h2a run claude --gw`; the opaque bearer is not printed\n");
     });
     llmMeshCommand
         .command("enable")
@@ -6996,12 +7675,7 @@ export async function main(argv) {
         .description("Restart only the local LLM gateway; never restarts tmux/Claude sessions")
         .option("-v, --verbose", "verbose output")
         .action(async (opts) => {
-        const config = readLlmMeshConfig();
-        if (!config || !config.meshAccounts?.length) {
-            process.stderr.write(`[h2a] llm-mesh: no Cloud Code account configured. Run \`h2a llm-mesh enroll cloud-code\` first.\n`);
-            process.exitCode = 1;
-            return;
-        }
+        const config = readLlmMeshConfig() ?? {};
         const stopped = stopGateway();
         if (stopped.stopped) {
             process.stdout.write(`[h2a] llm-mesh: stopped gateway (pid ${stopped.pid})\n`);
@@ -7015,10 +7689,7 @@ export async function main(argv) {
         process.stdout.write(`[h2a] llm-mesh: gateway restarted (pid ${result.pid}, port ${result.port})\n`);
         process.stdout.write(`[h2a] llm-mesh: restore config enabled\n`);
         process.stdout.write(`[h2a] llm-mesh: no tmux/Claude session was restarted; active sessions may keep their old gateway token until explicitly relaunched.\n`);
-        process.stdout.write(`\nTo use with new Claude Code processes:\n`);
-        process.stdout.write(`  export ANTHROPIC_BASE_URL=http://localhost:${result.port}\n`);
-        process.stdout.write(`  export ANTHROPIC_AUTH_TOKEN=${result.gatewayToken}\n`);
-        process.stdout.write(`  export ANTHROPIC_API_KEY=${result.gatewayToken}\n`);
+        process.stdout.write("[h2a] llm-mesh: use `h2a run claude --gw`; the opaque bearer is not printed\n");
     });
     llmMeshCommand
         .command("status")
@@ -7035,14 +7706,7 @@ export async function main(argv) {
             process.stdout.write(`[h2a] llm-mesh: stopped\n`);
         }
         process.stdout.write(`  restore/local auto-reactivation: ${runtime.enabled ? "enabled" : "disabled"}\n`);
-        if (config) {
-            for (const acc of config.meshAccounts ?? []) {
-                process.stdout.write(`  account: ${acc.label} (${acc.provider})\n`);
-            }
-        }
-        else {
-            process.stdout.write(`  no config. Run \`h2a llm-mesh enroll cloud-code\` first.\n`);
-        }
+        process.stdout.write("  account inventory: managed by Sentropic llm-mesh\n");
     });
     llmMeshCommand
         .command("logs")