@spexcode/spec-cli 0.6.5 → 0.6.7

package/dist/sessions.js

@@ -1,19 +1,19 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, openSync, closeSync, unlinkSync, writeSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, linkSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, unlinkSync } from 'node:fs';
 import { join, dirname, isAbsolute, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { seedWorktreeHostState } from './worktree-sources.js';
 import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, withGitAbortSignal, isGitObjectId } from '@spexcode/spec-core';
 import { loadConfig, loadSpecs, loadSpecsLite } from '@spexcode/spec-core';
-import { adapterLoadedReferenceState, defaultHarness, HARNESSES, sessionIdentityEnvVars, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rendezvousListening, stampRvSock } from './harness.js';
+import { adapterLoadedReferenceState, assertRvSockPath, defaultHarness, HARNESSES, sessionIdentityEnvVars, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rendezvousListening, stampRvSock } from './harness.js';
 import { materialize } from './materialize.js';
 import { mainBranch, mainRoot, gitCommonDir, readConfig, runtimeRoot, treeSlotDir, sessionStoreDir, sessionRecordPath, sessionArtifactPath, listSessionIds, rawLaunchReadinessOriginal, readRecordEntry, readAliasedRecordEntry, readPublicRecordEntry, envSessionId, isSessionLifecycle, isSessionProposal } from '@spexcode/spec-core';
 import { readSessionFiles } from './session-files.js';
 import { readSessionWebs } from './session-web.js';
-import { appendSent, recordStatus, lastHumanSendVia, sentDispatchReceipt, settleSentDispatch } from './session-timeline.js';
-import { drain, enqueue, ensurePendingWhileLocked, owesDelivery, pendingSnapshot, replacePendingWhileLocked, revokePendingFromWhileLocked, revokeSenderDelivery, senderDeliveryRevoked, withDeliveryLocks } from './delivery-queue.js';
+import { acceptMessage, drain, recordStatus, lastHumanSendVia, owesDelivery, pendingMessages } from '@spexcode/session-core';
+import { pendingSnapshot, replacePendingWhileLocked, revokePendingFromWhileLocked, revokeSenderDelivery, withDeliveryLocks, trySessionRecordLockSync, withSessionRecordLock, withSessionRecordLockSync as coreWithSessionRecordLockSync } from '@spexcode/session-core/internal';
 import { stripRefSigil } from './mentions.js';
 import { shQuote } from './sh.js';
 import { assertSessionOwnerSafe, assertSessionStopSafe, ResourceConflict } from './host-resources.js';
@@ -157,12 +157,10 @@ function readPromptFile(id) {
         return null;
     }
 }
-// Persist queued launch input across restarts; consume it once the launch begins.
+// The resolved first-turn payload is authoritative across queue drain and recovery. Adapters that mint native
+// identity keep it until they prove identity + first-turn durability; other adapters consume on submission.
 function writeLaunchFile(id, prompt) {
-    try {
-        writeFileSync(join(storeDir(id), 'launch'), prompt);
-    }
-    catch { /* best-effort; the drainer treats a missing file as nothing-to-launch */ }
+    writeFileSync(join(storeDir(id), 'launch'), prompt);
 }
 function readLaunchFile(id) {
     try {
@@ -244,7 +242,7 @@ export function rawLifecycleStatus(rec) {
     return rec.status === 'queued' && rec.launchOwner ? OWNED_QUEUE_RAW_STATUS : rec.status;
 }
 export function canDrainQueued(rec, authority = backendLaunchAuthority()) {
-    return rec.status === 'queued' && (rec.launchOwner === null || rec.launchOwner === authority);
+    return rec.status === 'queued' && !rec.stopped && (rec.launchOwner === null || rec.launchOwner === authority);
 }
 // typed read of a session's record from the global store (null if it has none — a self-launched session that
 // only ever wrote spec-discipline sentinels has a store dir but no session.json). Goes through layout's
@@ -288,157 +286,18 @@ function readLiveRecord(id) {
         throw new SessionRecordUnusable('retired', rec.session, retired);
     return rec;
 }
-// Cross-process lifecycle serialization. Hooks and operator commands are separate CLI processes, so the
-// in-memory transition tail is only an optimization. This lock covers each read/modify/write or destructive
-// transition across archive/resume/stop/close and hook writers. It lives outside the record directory so close
-// may remove the record while its lock is held. A dead writer's lock is reclaimed; a live writer is waited for
-// with a bounded wall and then fails loudly rather than allowing a stale write to win.
-const recordLockRoot = () => join(runtimeRoot(), '.session-locks');
-const recordLockPath = (id) => join(recordLockRoot(), `${id}.lock`);
-const syncPause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-function acquireRecordLockSync(id, timeoutMs = 30_000) {
-    mkdirSync(recordLockRoot(), { recursive: true });
-    const path = recordLockPath(id), deadline = Date.now() + timeoutMs;
-    for (;;) {
-        try {
-            const fd = openSync(path, 'wx');
-            writeSync(fd, String(process.pid));
-            closeSync(fd);
-            return () => { try {
-                unlinkSync(path);
-            }
-            catch { /* another recovery already removed it */ } };
-        }
-        catch (e) {
-            if (e.code !== 'EEXIST')
-                throw e;
-            let owner = 0;
-            try {
-                owner = Number(readFileSync(path, 'utf8').trim()) || 0;
-            }
-            catch { /* race with creator/releaser */ }
-            if (owner && owner !== process.pid) {
-                try {
-                    process.kill(owner, 0);
-                }
-                catch {
-                    try {
-                        unlinkSync(path);
-                    }
-                    catch { /* race */ }
-                    ;
-                    continue;
-                }
-            }
-            if (Date.now() >= deadline)
-                throw new ResourceConflict(`session ${id}: lifecycle transition lock timed out; refusing a stale write`);
-            syncPause(10);
-        }
-    }
-}
-const abortedOperation = (signal) => signal.reason instanceof Error
-    ? signal.reason
-    : Object.assign(new Error('The operation was aborted'), { name: 'AbortError', code: 'ABORT_ERR' });
-async function recordLockPause(signal) {
-    if (!signal) {
-        await new Promise((resolve) => setTimeout(resolve, 10));
-        return;
-    }
-    if (signal.aborted)
-        throw abortedOperation(signal);
-    await new Promise((resolve, reject) => {
-        const timer = setTimeout(done, 10);
-        const abort = () => { clearTimeout(timer); signal.removeEventListener('abort', abort); reject(abortedOperation(signal)); };
-        function done() { signal.removeEventListener('abort', abort); resolve(); }
-        signal.addEventListener('abort', abort, { once: true });
-    });
-}
-async function acquireRecordLock(id, timeoutMs = 30_000, signal) {
-    mkdirSync(recordLockRoot(), { recursive: true });
-    const path = recordLockPath(id), deadline = Date.now() + timeoutMs;
-    for (;;) {
-        if (signal?.aborted)
-            throw abortedOperation(signal);
-        try {
-            const fd = openSync(path, 'wx');
-            writeSync(fd, String(process.pid));
-            closeSync(fd);
-            return () => { try {
-                unlinkSync(path);
-            }
-            catch { /* another recovery already removed it */ } };
-        }
-        catch (e) {
-            if (e.code !== 'EEXIST')
-                throw e;
-            let owner = 0;
-            try {
-                owner = Number(readFileSync(path, 'utf8').trim()) || 0;
-            }
-            catch { /* race with creator/releaser */ }
-            if (owner && owner !== process.pid) {
-                try {
-                    process.kill(owner, 0);
-                }
-                catch {
-                    try {
-                        unlinkSync(path);
-                    }
-                    catch { /* race */ }
-                    ;
-                    continue;
-                }
-            }
-            if (Date.now() >= deadline)
-                throw new ResourceConflict(`session ${id}: lifecycle transition lock timed out; refusing a stale write`);
-            await recordLockPause(signal);
-        }
-    }
-}
-async function withRecordLock(id, body, signal) {
-    const release = await acquireRecordLock(id, 30_000, signal);
-    try {
-        return await body();
-    }
-    finally {
-        release();
-    }
-}
+const withRecordLock = withSessionRecordLock;
 export function withSessionRecordLockSync(id, body) {
-    const release = acquireRecordLockSync(id);
-    try {
-        return body();
-    }
-    finally {
-        release();
-    }
+    return coreWithSessionRecordLockSync(id, body);
 }
 const withRecordLockSync = withSessionRecordLockSync;
-function tryRecordLockSync(id) {
-    mkdirSync(recordLockRoot(), { recursive: true });
-    const path = recordLockPath(id);
-    try {
-        const fd = openSync(path, 'wx');
-        writeSync(fd, String(process.pid));
-        closeSync(fd);
-        return () => { try {
-            unlinkSync(path);
-        }
-        catch { /* another recovery already removed it */ } };
-    }
-    catch (e) {
-        if (e.code === 'EEXIST')
-            return null;
-        throw e;
-    }
-}
 // Synchronous terminal input is another product turn-entry path. The PTY bridge uses this narrow seam to
 // enqueue input while holding the same durable record lock as archive, so an archive preflight cannot pass idle
 // and then race a just-queued TUI turn.
 export function withSessionInputLock(id, body) {
     // PTY input is synchronous. A single non-blocking open is the only safe barrier: EEXIST rejects this input
     // regardless of owner PID, so a same-process async archive can never be frozen behind Atomics.wait.
-    const release = tryRecordLockSync(id);
+    const release = trySessionRecordLockSync(id);
     if (!release)
         return null;
     try {
@@ -619,7 +478,10 @@ function readWatchEntries(target) {
                 // The former one-source format cannot name an origin. Its child pointer is the only durable witness
                 // that this watcher was installed for parent supervision; every other legacy row is a manual watch.
                 : [watcher === parent ? 'parent' : 'manual'];
-            return sources.length ? [{ watcher, createdAt, sources }] : [];
+            const snapshotPending = entry.snapshotPending;
+            return sources.length ? [{ watcher, createdAt, sources,
+                    ...(sources.includes('parent') && typeof snapshotPending === 'string' && snapshotPending ? { snapshotPending } : {}),
+                }] : [];
         });
     }
     catch {
@@ -642,14 +504,19 @@ function writeWatchEntries(target, entries) {
     writeFileSync(tmp, JSON.stringify(entries, null, 2) + '\n');
     renameSync(tmp, path);
 }
-function addWatchSource(entries, watcher, source) {
+function addWatchSource(entries, watcher, source, deferInitialSnapshot = false) {
     const existing = entries.find((entry) => entry.watcher === watcher);
+    const snapshotPending = deferInitialSnapshot && !existing?.sources.includes('manual') ? randomUUID() : undefined;
     if (!existing)
-        return { entries: [...entries, { watcher, createdAt: new Date().toISOString(), sources: [source] }], added: true };
+        return { entries: [...entries, {
+                    watcher, createdAt: new Date().toISOString(), sources: [source], ...(snapshotPending ? { snapshotPending } : {}),
+                }], added: true };
     if (existing.sources.includes(source))
         return { entries, added: false };
     return {
-        entries: entries.map((entry) => entry === existing ? { ...entry, sources: [...entry.sources, source] } : entry),
+        entries: entries.map((entry) => entry === existing ? {
+            ...entry, sources: [...entry.sources, source], ...(snapshotPending ? { snapshotPending } : {}),
+        } : entry),
         added: true,
     };
 }
@@ -660,7 +527,12 @@ function removeWatchSource(entries, watcher, source) {
             return [entry];
         removed = true;
         const sources = entry.sources.filter((candidate) => candidate !== source);
-        return sources.length ? [{ ...entry, sources }] : [];
+        if (!sources.length)
+            return [];
+        if (source !== 'parent')
+            return [{ ...entry, sources }];
+        const { snapshotPending: _pending, ...withoutParentDebt } = entry;
+        return [{ ...withoutParentDebt, sources }];
     });
     return { entries: next, removed };
 }
@@ -677,8 +549,14 @@ function watchMessage(target) {
     const note = target.note ? ` — ${target.note}` : '';
     return `[spex watch] ${target.session} is ${status}${note}`;
 }
+function shouldDeliverWatchTransition(target, sources) {
+    // @@@watch-delivery-policy - Relationship setup sends current state; manual opts into working changes.
+    return target.status !== 'active' || sources.includes('manual');
+}
 function scheduleWatchNotifications(target) {
-    const watchers = readWatchEntries(target.session).map((entry) => entry.watcher);
+    const watchers = readWatchEntries(target.session)
+        .filter((entry) => !entry.snapshotPending && shouldDeliverWatchTransition(target, entry.sources))
+        .map((entry) => entry.watcher);
     if (!watchers.length)
         return;
     queueMicrotask(() => {
@@ -690,22 +568,130 @@ function scheduleWatchNotifications(target) {
         }
     });
 }
+const watchSnapshotState = (target) => JSON.stringify([target.status, target.proposal, target.note]);
+async function deliverPendingWatchSnapshots(targetId, forceCurrent = true) {
+    const pending = readWatchEntries(targetId).filter((entry) => entry.snapshotPending);
+    for (const original of pending) {
+        const token = original.snapshotPending;
+        let force = forceCurrent;
+        for (;;) {
+            const target = readRecord(targetId);
+            const entry = readWatchEntries(targetId)
+                .find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
+            if (!target || !entry)
+                break;
+            const state = watchSnapshotState(target);
+            const shouldDeliver = force || shouldDeliverWatchTransition(target, entry.sources);
+            if (!shouldDeliver) {
+                let settled = false;
+                await withRecordLock(targetId, async () => {
+                    const current = readRecord(targetId);
+                    const entries = readWatchEntries(targetId);
+                    const pendingEntry = entries.find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
+                    if (!current || !pendingEntry || watchSnapshotState(current) !== state)
+                        return;
+                    const next = entries.map((candidate) => {
+                        if (candidate !== pendingEntry)
+                            return candidate;
+                        const { snapshotPending: _pending, ...cleared } = candidate;
+                        return cleared;
+                    });
+                    writeWatchEntries(targetId, next);
+                    settled = true;
+                });
+                if (settled)
+                    break;
+                force = false;
+                continue;
+            }
+            const identity = `${targetId}\0${entry.watcher}\0${token}\0${state}`;
+            const delivered = await sendText(entry.watcher, watchMessage(target), targetId, {
+                idempotency: {
+                    operation: 'watch-initial-snapshot',
+                    requestDigest: digest(identity),
+                    payloadHash: digest(`watch-initial-snapshot\0${identity}\0${watchMessage(target)}`),
+                },
+                acceptGuard: async () => {
+                    const current = readRecord(targetId);
+                    const stillPending = readWatchEntries(targetId)
+                        .some((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
+                    if (!current || !stillPending || watchSnapshotState(current) !== state)
+                        throw new ResourceConflict('watch initial snapshot changed before acceptance');
+                },
+            });
+            if (!delivered.ok) {
+                if (delivered.error?.includes('watch initial snapshot changed before acceptance'))
+                    continue;
+                console.error(`spex session watch: could not deliver initial ${targetId} state to ${entry.watcher}: ${delivered.error}`);
+                break;
+            }
+            force = false;
+            let settled = false;
+            await withRecordLock(targetId, async () => {
+                const current = readRecord(targetId);
+                const entries = readWatchEntries(targetId);
+                const pendingEntry = entries.find((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
+                if (!current || !pendingEntry) {
+                    settled = true;
+                    return;
+                }
+                const currentState = watchSnapshotState(current);
+                if (currentState !== state && shouldDeliverWatchTransition(current, pendingEntry.sources))
+                    return;
+                const next = entries.map((candidate) => {
+                    if (candidate !== pendingEntry)
+                        return candidate;
+                    const { snapshotPending: _pending, ...cleared } = candidate;
+                    return cleared;
+                });
+                writeWatchEntries(targetId, next);
+                settled = true;
+            });
+            if (settled)
+                break;
+        }
+    }
+}
+async function clearPendingWatchSnapshots(targetId) {
+    await withRecordLock(targetId, async () => {
+        const entries = readWatchEntries(targetId);
+        const next = entries.map((entry) => {
+            if (!entry.snapshotPending)
+                return entry;
+            const { snapshotPending: _pending, ...settled } = entry;
+            return settled;
+        });
+        if (next.some((entry, index) => entry !== entries[index]))
+            writeWatchEntries(targetId, next);
+    });
+}
 export async function subscribeSessionWatch(watcher, targets, source = 'manual') {
     managedWatchRecord(watcher);
     const watched = [];
     for (const target of [...new Set(targets)]) {
         if (target === watcher)
             throw new ResourceConflict('a session cannot watch itself');
-        const targetRecord = managedWatchRecord(target);
+        let targetRecord = null;
+        let added = false;
+        let pending = false;
         withRecordLockSync(target, () => {
+            targetRecord = managedWatchRecord(target);
             const entries = readWatchEntries(target);
-            const next = addWatchSource(entries, watcher, source);
+            const next = addWatchSource(entries, watcher, source, source === 'parent' && targetRecord.status === 'queued');
             if (next.added)
                 writeWatchEntries(target, next.entries);
+            added = next.added;
+            pending = next.entries.some((entry) => entry.watcher === watcher && !!entry.snapshotPending);
         });
-        const delivered = await sendText(watcher, watchMessage(targetRecord), target);
-        if (!delivered.ok)
-            throw new ResourceConflict(`watch established but could not queue ${target}'s current state for ${watcher}: ${delivered.error}`);
+        if (pending) {
+            if (source === 'manual')
+                await deliverPendingWatchSnapshots(target);
+        }
+        else if (source === 'manual' || added) {
+            const delivered = await sendText(watcher, watchMessage(targetRecord), target);
+            if (!delivered.ok)
+                throw new ResourceConflict(`watch established but could not queue ${target}'s current state for ${watcher}: ${delivered.error}`);
+        }
         watched.push(target);
     }
     return { watched };
@@ -827,13 +813,15 @@ export async function reparentSessionRecords(rawChildren, parent) {
             }
         }));
     });
+    const notified = [];
     if (parent)
         for (const child of notify) {
             const delivered = await sendText(parent, watchMessage(child), child.session);
             if (!delivered.ok)
                 throw new ResourceConflict(`reparent committed but could not queue ${child.session}'s current state for ${parent}: ${delivered.error}`);
+            notified.push(child.session);
         }
-    return { children, parent, notified: notify.map((child) => child.session) };
+    return { children, parent, notified };
 }
 // tmux rewrites CONTROL characters in a format string before printing them — 3.6a turns both a tab and a raw
 // 0x1f into `_`, while 3.4 turns a raw 0x1f into the printable escape `\037`. So the field separator is ASKED
@@ -1581,7 +1569,8 @@ export function launchScript(id, tail, harness = HARNESS, cmd) {
     // invocation's own single-quoted segments — the codex `$@`/`$tid` script, the prompt — reach sh verbatim,
     // parsed exactly ONCE, never double-expanded. Each retry attempt rewrites agent.pid with a fresh `$$`.
     const pidPath = join(storeDir(id), 'agent.pid');
-    const born = `sh -c ${shQuote(`printf %s "$$" > ${shQuote(pidPath)}; exec env ${invocation}`)}`;
+    const receiptPath = join(storeDir(id), 'agent.identity.json');
+    const born = `sh -c ${shQuote(`rm -f ${shQuote(receiptPath)}; printf %s "$$" > ${shQuote(pidPath)}; exec env ${invocation}`)}`;
     // Bounded relaunch on a FAST exit: the agent launcher can exit within seconds before the rendezvous socket
     // ever appears. That is enough evidence to retry, but not enough evidence to name the cause. Once the agent
     // has run past LAUNCH_FAST_FAIL_S it has genuinely started; its eventual (much later) exit is a normal
@@ -1686,21 +1675,105 @@ async function withSessionTransition(id, body) {
     }
 }
 let draining = false; // re-entrancy guard: only one drain pass runs at a time (no double-launch)
-// launch a prepared `queued` worktree: feed it its parked launch prompt, flip it to active. Returns false
-// (leaving it queued, to be retried next drain) if the worktree/prompt is gone or the tmux launch threw.
+function noteQueuedLaunchFailureUnlocked(id, error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    const note = `queued launch readiness failed: ${reason}`;
+    console.error(`spex: session ${id}: ${note}`);
+    const rec = readRecord(id);
+    if (rec && rec.note !== note)
+        writeRecord({ ...rec, note });
+}
+function observeQueuedLaunchReadiness(id, harness) {
+    void waitForReady(id, harness)
+        .then(async (readiness) => {
+        if (!readiness) {
+            const committed = !!readRecord(id)?.harnessSessionId;
+            throw new ResourceConflict(harness.launchPayloadProof
+                ? committed
+                    ? 'post-proof adapter liveness did not become ready before launch readiness timed out'
+                    : 'native identity and first-turn rollout proof did not arrive before launch readiness timed out'
+                : 'adapter liveness did not become ready before launch readiness timed out');
+        }
+        let readyToPublish = false;
+        await withRecordLock(id, async () => {
+            const candidate = readRecord(id);
+            if (!candidate)
+                return;
+            const stillReady = await readiness.validate(() => {
+                const current = readRecord(id);
+                return current ? { ...current, runtimeDir: runtimeRoot() } : null;
+            });
+            if (!stillReady)
+                throw new ResourceConflict('launch readiness changed before queued publication');
+            const current = readRecord(id);
+            if (!current)
+                return;
+            if (current.status === 'queued')
+                writeRecord({ ...current, status: 'active', proposal: null, note: null, launchOwner: null });
+            readyToPublish = true;
+        });
+        if (!readyToPublish)
+            return;
+        await deliverPendingWatchSnapshots(id);
+        await drainSession(id);
+    })
+        .catch(async (error) => {
+        try {
+            await withRecordLock(id, async () => noteQueuedLaunchFailureUnlocked(id, error));
+        }
+        catch (recordError) {
+            console.error(`spex: session ${id}: queued launch failure could not be recorded: ${recordError instanceof Error ? recordError.message : String(recordError)}; original failure: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        await clearPendingWatchSnapshots(id);
+    })
+        .finally(() => launching.delete(id));
+}
+// Launch a prepared `queued` worktree. Deterministic blockers retire its creation snapshot debt; a transport
+// attempt that may succeed on the next drain keeps that durable debt for the eventual real outcome.
 async function startQueuedUnlocked(id) {
     if (archiving.has(id))
-        return false;
+        return 'retryable';
     const wt = await findWorktree(id);
     if (!wt)
-        return false;
-    if (archiving.has(id) || wt.rec.archived)
-        return false;
+        return 'blocked';
+    if (archiving.has(id))
+        return 'retryable';
+    if (wt.rec.archived)
+        return 'blocked';
     if (!canDrainQueued(wt.rec))
-        return false;
+        return 'retryable';
+    const h = harnessById(wt.rec.harness || defaultHarness.id);
+    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+        launching.add(id);
+        let readinessOwnsSlot = false;
+        try {
+            try {
+                consumeHarnessLaunchProofUnlocked(id);
+            }
+            catch (error) {
+                noteQueuedLaunchFailureUnlocked(id, error);
+                throw error;
+            }
+            const recovered = readRecord(id) || wt.rec;
+            writeRecord({ ...recovered, status: 'active', proposal: null, note: null, launchOwner: null });
+            observeQueuedLaunchReadiness(id, h);
+            readinessOwnsSlot = true;
+            return 'started';
+        }
+        finally {
+            if (!readinessOwnsSlot)
+                launching.delete(id);
+        }
+    }
     const launchPrompt = readLaunchFile(id);
-    if (launchPrompt == null)
-        return false; // a queued session always has one; if it's gone, don't spin on it
+    if (launchPrompt == null) {
+        const message = `authoritative resolved launch payload is missing for queued session ${id}; refusing to create an empty thread`;
+        if (wt.rec.note !== message) {
+            console.error(`spex: ${message}`);
+            writeRecord({ ...wt.rec, note: message });
+        }
+        return 'blocked';
+    }
     // a queued worktree can go missing while it waits (a human cleaned up, a disk moved). Draining it would open
     // a window that fast-exits and burn the retry budget every tick, so refuse ONCE, loudly, and stamp the reason
     // on the record — the drainer then leaves it alone instead of spinning on a launch that cannot work.
@@ -1710,28 +1783,36 @@ async function startQueuedUnlocked(id) {
             console.error(`spex: not launching queued session ${id}: ${blocked.message}`);
             writeRecord({ ...wt.rec, note: blocked.message });
         }
-        return false;
+        return 'blocked';
     }
     launching.add(id); // hold the slot across the boot window BEFORE we launch, so a concurrent count can't race us
-    const h = harnessById(wt.rec.harness || defaultHarness.id); // launch THIS session's chosen harness (also drives waitForReady below)
+    let readinessOwnsSlot = false;
     try {
-        const sq = shQuote(launchPrompt);
-        await launch(id, wt.path, `${h.sessionIdArg(id)} ${sq}`.trim(), h, launcherCmd(wt.rec));
+        try {
+            const sq = shQuote(launchPrompt);
+            await launch(id, wt.path, `${h.sessionIdArg(id)} ${sq}`.trim(), h, launcherCmd(wt.rec));
+        }
+        catch {
+            return 'retryable'; // launch failed → stays `queued`, with its initial debt, for the next drain tick
+        }
+        // the note this record may carry is the QUEUED state's word (a launch-blocker message stamped above); the
+        // launch just succeeded, so it is spent. Clearing it with the transition is what keeps "a stored note
+        // belongs to the state currently declared" true for every writer — the invariant [[session-label]]'s
+        // headline precedence stands on.
+        const launched = readRecord(id) || wt.rec;
+        writeRecord({ ...launched, status: 'active', proposal: null, note: null, launchOwner: null });
+        if (!h.launchPayloadProof)
+            removeLaunchFile(id);
+        // release the boot-window hold once the socket is up (then isOccupying takes over) or after the bounded
+        // wait — so a launch that never booted reads offline and the drainer reclaims the slot instead of pinning it.
+        observeQueuedLaunchReadiness(id, h);
+        readinessOwnsSlot = true;
+        return 'started';
+    }
+    finally {
+        if (!readinessOwnsSlot)
+            launching.delete(id);
     }
-    catch {
-        launching.delete(id);
-        return false; // launch failed → stays `queued`, retried on the next drain tick
-    }
-    // the note this record may carry is the QUEUED state's word (a launch-blocker message stamped above); the
-    // launch just succeeded, so it is spent. Clearing it with the transition is what keeps "a stored note
-    // belongs to the state currently declared" true for every writer — the invariant [[session-label]]'s
-    // headline precedence stands on.
-    writeRecord({ ...wt.rec, status: 'active', proposal: null, note: null, launchOwner: null });
-    removeLaunchFile(id); // consumed
-    // release the boot-window hold once the socket is up (then isOccupying takes over) or after the bounded
-    // wait — so a launch that never booted reads offline and the drainer reclaims the slot instead of pinning it.
-    void waitForReady(id, h).finally(() => launching.delete(id));
-    return true;
 }
 const startQueued = (id) => withSessionTransition(id, () => withRecordLock(id, () => startQueuedUnlocked(id)));
 async function drainQueueUnlocked() {
@@ -1742,6 +1823,19 @@ async function drainQueueUnlocked() {
         const cap = maxActive(); // read once per drain pass (spexcode.json → env → default); won't shift mid-burst
         for (;;) {
             const [sessions, snap] = await Promise.all([listSessions(), liveSnapshot()]);
+            for (const session of sessions) {
+                const rec = readRecord(session.id);
+                if (!rec || launching.has(session.id) || !readWatchEntries(session.id).some((entry) => entry.snapshotPending))
+                    continue;
+                if (rec.status === 'queued')
+                    continue;
+                if (rec.status === 'active' && !rec.stopped && !rec.archived) {
+                    launching.add(session.id);
+                    observeQueuedLaunchReadiness(session.id, harnessById(rec.harness || defaultHarness.id));
+                    continue;
+                }
+                await deliverPendingWatchSnapshots(session.id, false);
+            }
             // if the liveness probe FAILED (tmux timing out — the overload condition), occupancy is UNKNOWABLE: every
             // session would read window-less and isOccupying would undercount, so the drainer would OVER-launch and pile
             // MORE compute onto an already-thrashing box. Under load, do the safe thing — launch nothing this pass and
@@ -1749,8 +1843,16 @@ async function drainQueueUnlocked() {
             if (snap.probeFailed)
                 break;
             const occupied = sessions.reduce((n, s) => n + (launching.has(s.id) || isOccupying(s, snap) ? 1 : 0), 0);
-            if (occupied >= cap)
+            if (occupied >= cap) {
+                const authority = backendLaunchAuthority();
+                await Promise.all(sessions.filter((session) => {
+                    if (session.status !== 'queued')
+                        return false;
+                    const rec = readRecord(session.id);
+                    return !!rec && canDrainQueued(rec, authority);
+                }).map((session) => deliverPendingWatchSnapshots(session.id)));
                 break;
+            }
             const authority = backendLaunchAuthority();
             const next = sessions.find((s) => {
                 if (s.status !== 'queued' || launching.has(s.id))
@@ -1760,8 +1862,12 @@ async function drainQueueUnlocked() {
             });
             if (!next)
                 break;
-            if (!(await startQueued(next.id)))
+            const started = await startQueued(next.id);
+            if (started !== 'started') {
+                if (started === 'blocked')
+                    await clearPendingWatchSnapshots(next.id);
                 break; // launch failed → stop this pass; a later tick retries
+            }
         }
     }
     finally {
@@ -2491,6 +2597,8 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                 chosen = resolveLauncher(lname);
                 h = harnessById(chosen.harness);
                 pinned = h.baseCmd(chosen.cmd);
+                if (h.ownsRendezvous)
+                    assertRvSockPath(id);
             }
             catch (error) {
                 throw new SessionCreateError('session_create_failed', phase, error instanceof Error ? error.message : String(error), 400);
@@ -2613,6 +2721,12 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                         throw new SessionCreateError('session_create_failed', phase, `refusing session publication: ${gitMismatch}`, 500);
                     throwIfCreateAborted(signal, phase);
                     writeRecord(rec);
+                    if (rec.parent && readRecord(rec.parent)?.governed) {
+                        const watchers = readWatchEntries(id);
+                        const next = addWatchSource(watchers, rec.parent, 'parent', true);
+                        if (next.added)
+                            writeWatchEntries(id, next.entries);
+                    }
                     published = true;
                     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(rec, root);
                     if (receiptFailure)
@@ -2694,7 +2808,7 @@ const SOCKET_READY_TIMEOUT_MS = 30000; // spans launchScript's bounded fast-fail
 // waitForReady (slot-hold + resume) waits through a daemon-race retry
 // instead of returning before a recovering socket
 const SOCKET_POLL_MS = 200;
-async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEOUT_MS) {
+async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEOUT_MS, recordLockHeld = false) {
     const current = () => {
         const stored = readRecord(id);
         const rec = stored && pending
@@ -2703,6 +2817,20 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
         return rec ? { ...rec, runtimeDir: runtimeRoot() } : null;
     };
     const deadline = Date.now() + timeoutMs;
+    if (harness.launchPayloadProof && !current()?.harnessSessionId) {
+        for (;;) {
+            if (existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+                if (recordLockHeld)
+                    consumeHarnessLaunchProofUnlocked(id);
+                else
+                    await withRecordLock(id, async () => consumeHarnessLaunchProofUnlocked(id));
+                break;
+            }
+            if (Date.now() >= deadline)
+                return null;
+            await new Promise((r) => setTimeout(r, SOCKET_POLL_MS));
+        }
+    }
     if (harness.launchReady)
         return harness.launchReady(current, deadline);
     const genericFence = () => ({
@@ -2723,6 +2851,7 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
         await new Promise((r) => setTimeout(r, SOCKET_POLL_MS));
     }
 }
+const restingLifecycle = (status) => status === 'active' || status === 'queued' ? 'idle' : status;
 async function resumeSessionUnlocked(id, opts = {}) {
     const { force = false, guard = true } = opts;
     let wt;
@@ -2759,6 +2888,15 @@ async function resumeSessionUnlocked(id, opts = {}) {
     if (blocked)
         return { ok: false, refused: true, error: blocked.message };
     const h = harnessById(wt.rec.harness || defaultHarness.id);
+    // A prior adapter process may have proven identity + first-turn durability just before its session owner
+    // died. Consume that receipt before choosing a recovery tail, so retry resumes the proven thread instead of
+    // creating another one with the same first prompt.
+    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+        consumeHarnessLaunchProofUnlocked(id);
+        wt = await findWorktree(id);
+        if (!wt)
+            return { ok: false, error: `session ${id} disappeared while recovering native launch proof` };
+    }
     // An archived record is expected to be stopped, but the guard must still inspect physical liveness in case
     // it is a legacy/invariant-violating row. Ignore filing and stale stop metadata for this one safety probe so
     // resume can never kill a live leaf merely because the record was hidden.
@@ -2799,21 +2937,28 @@ async function resumeSessionUnlocked(id, opts = {}) {
     // Archived sessions have no runtime by invariant. Resume first leaves cold storage, then the normal
     // starting -> online launch path recreates the same conversation.
     const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: null }) : wt.rec;
-    const resumed = { ...current, archived: false, coldProof: null, status: current.status === 'active' ? 'idle' : current.status, stopped: false };
+    const resumed = { ...current, archived: false, coldProof: null, status: restingLifecycle(current.status), stopped: false };
     if (force || lv === 'offline') {
+        let resumeTail;
+        try {
+            resumeTail = h.resumeArg(wt.rec, readLaunchFile(id)).trim();
+        }
+        catch (error) {
+            return { ok: false, refused: true, error: error instanceof Error ? error.message : String(error) };
+        }
         await tmuxOk(['kill-session', '-t', id]); // drop a dead/offline pane (or a force-killed live one)
-        await launch(id, wt.path, h.resumeArg(wt.rec).trim(), h, launcherCmd(wt.rec));
+        await launch(id, wt.path, resumeTail, h, launcherCmd(wt.rec));
         let readiness = null;
         let readinessError = '';
         try {
-            readiness = await waitForReady(id, h, resumed);
+            readiness = await waitForReady(id, h, resumed, SOCKET_READY_TIMEOUT_MS, true);
         }
         catch (error) {
             readinessError = error instanceof Error ? error.message : String(error);
         }
         if (!readiness) {
             const failed = readRecord(id) || current;
-            writeRecord({ ...failed, ...preResume, launchReadinessPending: null });
+            writeRecord({ ...failed, ...preResume, harnessSessionId: failed.harnessSessionId, launchReadinessPending: null });
             return {
                 ok: false,
                 refused: true,
@@ -2825,7 +2970,7 @@ async function resumeSessionUnlocked(id, opts = {}) {
             ...latest,
             archived: false,
             coldProof: null,
-            status: latest.status === 'active' ? 'idle' : latest.status,
+            status: restingLifecycle(latest.status),
             stopped: false,
             launchReadinessPending: launchReadinessPending(preResume),
         };
@@ -2856,7 +3001,12 @@ async function resumeSessionUnlocked(id, opts = {}) {
         writeRecord(resumed);
     return { ok: true };
 }
-export const resumeSession = (id, opts = {}) => withSessionTransition(id, () => withRecordLock(id, () => resumeSessionUnlocked(id, opts)));
+export const resumeSession = (id, opts = {}) => withSessionTransition(id, async () => {
+    const result = await withRecordLock(id, () => resumeSessionUnlocked(id, opts));
+    if (result.ok)
+        await drainSession(id);
+    return result;
+});
 export function markState(status, opts = {}) {
     const id = opts.sessionId || ownSessionId();
     if (!id)
@@ -2893,50 +3043,158 @@ export function markHeadlessTurnFailure(sessionId, harness, exitCode) {
     const outcome = /^\d+$/.test(exitCode) ? `exit code ${exitCode}` : `signal ${exitCode}`;
     return markTurnFailure(sessionId, `${harness} turn exited with ${outcome}`);
 }
-export function markHarnessSessionId(sessionId, harnessSessionId) {
+function bindHarnessSessionIdUnlocked(rec, harnessSessionId, generationId = process.env.SPEXCODE_CODEX_GENERATION?.trim()) {
+    const id = rec.session;
+    if (rec.harnessSessionId && rec.harnessSessionId !== harnessSessionId)
+        throw new ResourceConflict(`refusing to replace exact harness thread identity for ${id}; create a new governed session instead`);
+    const codex = rec.harness === 'codex' || rec.harness === 'codex-headless';
+    const root = runtimeRoot();
+    let priorBinding = null;
+    let registrationPrepared = false;
+    if (codex) {
+        const ledger = readCodexGenerationLedger(root);
+        if (ledger.revision > 0 && !generationId)
+            throw new ResourceConflict(`refusing to bind Codex thread ${harnessSessionId}: launch did not provide an exact generation id`);
+        priorBinding = codexGenerationBindingForSession(root, id);
+        if (priorBinding && (!generationId || priorBinding.generationId !== generationId || priorBinding.threadId !== harnessSessionId))
+            throw new ResourceConflict(`refusing to replace exact Codex generation binding for ${id}`);
+        if (generationId && !priorBinding) {
+            prepareCodexGenerationRegistration(root, id, harnessSessionId, generationId);
+            registrationPrepared = true;
+        }
+    }
+    try {
+        writeRecord({ ...rec, harnessSessionId, coldProof: null, adapterRecovery: null });
+    }
+    catch (error) {
+        if (codex && generationId && registrationPrepared) {
+            try {
+                bindCodexGeneration(root, id, harnessSessionId, null);
+            }
+            catch (rollback) {
+                throw new ResourceConflict(`Codex generation binding persisted but session ${id} record write failed and rollback failed: ${rollback instanceof Error ? rollback.message : String(rollback)}`);
+            }
+        }
+        throw error;
+    }
+    if (codex && generationId)
+        commitCodexGenerationRegistration(root, id, harnessSessionId, generationId);
+}
+function readHarnessLaunchProof(id) {
+    try {
+        const proof = JSON.parse(readFileSync(sessionArtifactPath(id, 'launch.proof'), 'utf8'));
+        if (!proof || proof.version !== 1 || typeof proof.sessionId !== 'string'
+            || typeof proof.harnessId !== 'string' || typeof proof.harnessSessionId !== 'string' || !proof.harnessSessionId
+            || typeof proof.launchPayloadHash !== 'string'
+            || (proof.generationId !== null && typeof proof.generationId !== 'string'))
+            throw new Error('invalid receipt shape');
+        return proof;
+    }
+    catch (error) {
+        throw new ResourceConflict(`native launch proof for ${id} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function sameHarnessLaunchProof(left, right) {
+    return left.version === right.version && left.sessionId === right.sessionId && left.harnessId === right.harnessId
+        && left.harnessSessionId === right.harnessSessionId && left.launchPayloadHash === right.launchPayloadHash
+        && left.generationId === right.generationId;
+}
+export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPayload) {
     const id = sessionId || ownSessionId();
     if (!id || !harnessSessionId)
         return false;
-    return withRecordLockSync(id, () => {
-        const rec = readLiveRecord(id);
-        if (!rec)
-            return false;
-        if (rec.harnessSessionId && rec.harnessSessionId !== harnessSessionId)
-            throw new ResourceConflict(`refusing to replace exact harness thread identity for ${id}; create a new governed session instead`);
-        const codex = rec.harness === 'codex' || rec.harness === 'codex-headless';
-        const root = runtimeRoot();
-        let priorBinding = null;
-        let generationId;
-        let registrationPrepared = false;
-        if (codex) {
-            generationId = process.env.SPEXCODE_CODEX_GENERATION?.trim();
-            const ledger = readCodexGenerationLedger(root);
-            if (ledger.revision > 0 && !generationId)
-                throw new ResourceConflict(`refusing to bind Codex thread ${harnessSessionId}: launch did not provide an exact generation id`);
-            priorBinding = codexGenerationBindingForSession(root, id);
-            if (priorBinding && (!generationId || priorBinding.generationId !== generationId || priorBinding.threadId !== harnessSessionId))
-                throw new ResourceConflict(`refusing to replace exact Codex generation binding for ${id}`);
-            if (generationId && !priorBinding) {
-                prepareCodexGenerationRegistration(root, id, harnessSessionId, generationId);
-                registrationPrepared = true;
-            }
-        }
+    const rec = readLiveRecord(id);
+    if (!rec)
+        return false;
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (!harness.launchPayloadProof)
+        throw new ResourceConflict(`harness ${harness.id} does not use native launch-payload proof`);
+    const pending = readLaunchFile(id);
+    if (pending == null)
+        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+    if (pending !== launchPayload)
+        throw new ResourceConflict(`refusing native launch proof for ${id}: first-turn payload differs from the authoritative resolved launch payload`);
+    const generationId = process.env.SPEXCODE_CODEX_GENERATION?.trim() || null;
+    if (rec.harness === 'codex' || rec.harness === 'codex-headless') {
+        const ledger = readCodexGenerationLedger(runtimeRoot());
+        if (ledger.revision > 0 && !generationId)
+            throw new ResourceConflict(`refusing native launch proof for ${id}: launch did not provide an exact Codex generation id`);
+        if (generationId && (!ledger.generations[generationId] || ledger.generations[generationId].state === 'reclaimed'))
+            throw new ResourceConflict(`refusing to bind Codex thread ${harnessSessionId}: generation ${generationId} is absent or reclaimed`);
+    }
+    const proof = {
+        version: 1,
+        sessionId: id,
+        harnessId: harness.id,
+        harnessSessionId,
+        launchPayloadHash: createHash('sha256').update(launchPayload).digest('hex'),
+        generationId,
+    };
+    const path = sessionArtifactPath(id, 'launch.proof');
+    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+    try {
+        linkSync(temp, path);
+        return true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const staged = readHarnessLaunchProof(id);
+        if (sameHarnessLaunchProof(staged, proof))
+            return true;
+        throw new ResourceConflict(`refusing to replace native launch proof for ${id}: the staged session, thread, payload, or generation differs`);
+    }
+    finally {
+        rmSync(temp, { force: true });
+    }
+}
+function consumeHarnessLaunchProofUnlocked(id) {
+    const rec = readLiveRecord(id);
+    if (!rec)
+        return false;
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    const proof = readHarnessLaunchProof(id);
+    if (proof.sessionId !== id || proof.harnessId !== harness.id)
+        throw new ResourceConflict(`native launch proof for ${id} does not match the governed adapter identity`);
+    const pending = readLaunchFile(id);
+    if (pending == null && rec.harnessSessionId !== proof.harnessSessionId)
+        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+    if (pending != null && proof.launchPayloadHash !== createHash('sha256').update(pending).digest('hex'))
+        throw new ResourceConflict(`native launch proof for ${id} does not match the authoritative resolved launch payload`);
+    bindHarnessSessionIdUnlocked(rec, proof.harnessSessionId, proof.generationId || undefined);
+    if (pending != null) {
         try {
-            writeRecord({ ...rec, harnessSessionId, coldProof: null, adapterRecovery: null });
+            rmSync(sessionArtifactPath(id, 'launch'));
         }
         catch (error) {
-            if (codex && generationId && registrationPrepared) {
-                try {
-                    bindCodexGeneration(root, id, harnessSessionId, null);
-                }
-                catch (rollback) {
-                    throw new ResourceConflict(`Codex generation binding persisted but session ${id} record write failed and rollback failed: ${rollback instanceof Error ? rollback.message : String(rollback)}`);
-                }
+            if (error.code !== 'ENOENT') {
+                console.error(`spex: native launch proof committed for ${id}, but launch could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+                return true;
             }
-            throw error;
         }
-        if (codex && generationId)
-            commitCodexGenerationRegistration(root, id, harnessSessionId, generationId);
+    }
+    try {
+        rmSync(sessionArtifactPath(id, 'launch.proof'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            console.error(`spex: native launch proof committed for ${id}, but launch.proof could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return true;
+}
+export function markHarnessSessionId(sessionId, harnessSessionId) {
+    const id = sessionId || ownSessionId();
+    if (!id || !harnessSessionId)
+        return false;
+    return withRecordLockSync(id, () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return false;
+        const harness = harnessById(rec.harness || defaultHarness.id);
+        if (harness.launchPayloadProof)
+            throw new ResourceConflict(`harness ${harness.id} must stage native identity together with authoritative first-turn payload proof`);
+        bindHarnessSessionIdUnlocked(rec, harnessSessionId);
         return true;
     });
 }
@@ -3116,24 +3374,119 @@ export async function mergeSession(id) {
 // then SIGKILL, each bounded. This is also what lets the socket sweep run at all — a still-answering listener
 // is never ours to unlink, so an un-killed agent would otherwise strand its own socket forever.
 // The escalation is IDENTITY-GUARDED: a recorded pid can have been recycled by an unrelated process, so we
-// signal only a pid whose argv still names THIS session. Unidentifiable → we signal nothing and let the
-// adapter's proof-of-death rule leave the transport alone; never a blind kill on a stale number.
+// signal only the immutable pid/start instance whose ownership was witnessed in the exact tmux pane closure.
+// Unidentifiable → we signal nothing and let the adapter's proof-of-death rule leave the transport alone.
 const AGENT_EXIT_GRACE_MS = 3000;
+const SESSION_LEAF_RECEIPT_VERSION = 1;
+const SESSION_LEAF_RECEIPT_KIND = 'session-leaf';
+export function parseSessionLeafReceipt(raw, sessionId) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const row = value;
+    const keys = Object.keys(row).sort();
+    if (keys.join(',') !== 'kind,pid,sessionId,startToken,version')
+        return null;
+    if (row.version !== SESSION_LEAF_RECEIPT_VERSION || row.kind !== SESSION_LEAF_RECEIPT_KIND || row.sessionId !== sessionId)
+        return null;
+    if (!Number.isSafeInteger(row.pid) || row.pid <= 0 || typeof row.startToken !== 'string' || !row.startToken)
+        return null;
+    return row;
+}
+function pidInPaneClosure(pid, panePid, procs) {
+    const seen = new Set();
+    for (let current = pid; current > 0 && !seen.has(current);) {
+        if (current === panePid)
+            return true;
+        seen.add(current);
+        const row = procs.get(current);
+        if (!row || row.ppid === current)
+            return false;
+        current = row.ppid;
+    }
+    return false;
+}
+export function sessionLeafReceiptCandidate(sessionId, pid, panePid, procs, startBefore, startAfter) {
+    if (!panePid)
+        return { ok: false, reason: 'exact target pane PID is unavailable' };
+    if (!procs)
+        return { ok: false, reason: 'process snapshot is unavailable' };
+    if (!startBefore || !startAfter)
+        return { ok: false, reason: 'leaf process-start identity is unreadable' };
+    if (startBefore !== startAfter)
+        return { ok: false, reason: 'leaf process-start identity changed during ancestry observation' };
+    if (!pidInPaneClosure(pid, panePid, procs))
+        return { ok: false, reason: `registered leaf PID ${pid} is not in exact target pane ${panePid} descendant closure` };
+    return {
+        ok: true,
+        receipt: { version: SESSION_LEAF_RECEIPT_VERSION, kind: SESSION_LEAF_RECEIPT_KIND, sessionId, pid, startToken: startAfter },
+    };
+}
+export function sessionLeafReceiptIdentityState(receipt, registeredPid, currentStartToken, liveness) {
+    if (registeredPid == null)
+        return 'registration-missing';
+    if (registeredPid !== receipt.pid)
+        return 'registration-changed';
+    if (liveness === 'unknown')
+        return 'unknown';
+    if (liveness === 'dead')
+        return currentStartToken ? 'unknown' : 'gone';
+    if (!currentStartToken)
+        return 'unknown';
+    return currentStartToken === receipt.startToken ? 'same-live' : 'pid-reused';
+}
+const sessionLeafReceiptPath = (id) => sessionArtifactPath(id, 'agent.identity.json');
+function readSessionLeafReceipt(id) {
+    const path = sessionLeafReceiptPath(id);
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { state: 'missing' };
+        return { state: 'invalid', reason: `leaf birth receipt is unreadable (${error instanceof Error ? error.message : String(error)})` };
+    }
+    const receipt = parseSessionLeafReceipt(raw, id);
+    return receipt ? { state: 'valid', receipt } : { state: 'invalid', reason: 'leaf birth receipt is malformed or names a different session' };
+}
+function writeSessionLeafReceipt(id, receipt) {
+    const path = sessionLeafReceiptPath(id);
+    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temp, `${JSON.stringify(receipt)}\n`, { mode: 0o600 });
+        renameSync(temp, path);
+    }
+    finally {
+        rmSync(temp, { force: true });
+    }
+}
+function clearSessionLeafArtifacts(id) {
+    rmSync(sessionArtifactPath(id, 'agent.pid'), { force: true });
+    pidRegistry.delete(id);
+    rmSync(sessionLeafReceiptPath(id), { force: true });
+}
+const sameSessionLeafReceipt = (left, right) => left.version === right.version && left.kind === right.kind && left.sessionId === right.sessionId
+    && left.pid === right.pid && left.startToken === right.startToken;
 async function killAgentProcess(id, beforeSignal, leaf) {
-    const pid = readAgentPid(sessionArtifactPath(id, 'agent.pid'));
-    if (pid !== leaf.pid)
-        throw new ResourceConflict(`refusing to stop ${id}: session leaf identity changed before signal`);
-    if (!Number.isFinite(pid) || pid <= 0)
-        return;
+    const pid = leaf.pid;
     const startToken = leaf.startToken;
     const alive = () => leafAlive(pid);
     const identityState = () => {
-        if (readAgentPid(sessionArtifactPath(id, 'agent.pid')) !== leaf.pid)
+        const stored = readSessionLeafReceipt(id);
+        if (stored.state !== 'valid' || !sameSessionLeafReceipt(stored.receipt, leaf.receipt))
             return 'changed';
-        const current = processStartToken(pid);
-        if (!current)
-            return alive() ? 'changed' : 'gone';
-        return current === startToken ? 'same' : 'changed';
+        const registered = readAgentPid(sessionArtifactPath(id, 'agent.pid'));
+        const liveness = leafProcessLiveness(pid);
+        const currentStartToken = sessionLeafStartToken(pid);
+        const state = sessionLeafReceiptIdentityState(stored.receipt, Number.isSafeInteger(registered) ? registered : null, currentStartToken, liveness);
+        return state === 'same-live' ? 'same' : state === 'gone' ? 'gone' : 'changed';
     };
     const initialState = identityState();
     if (initialState === 'gone')
@@ -3150,12 +3503,6 @@ async function killAgentProcess(id, beforeSignal, leaf) {
     };
     if (await gone(AGENT_EXIT_GRACE_MS))
         return; // the pane's SIGHUP took it — the normal path
-    const sameAgentInstance = async () => {
-        if (processStartToken(pid) !== startToken)
-            return false;
-        const argv = await pexec('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8' }).then((r) => r.stdout).catch(() => '');
-        return argv.includes(leaf.ownerNeedle) && processStartToken(pid) === startToken;
-    };
     for (const sig of ['SIGTERM', 'SIGKILL']) {
         await beforeSignal();
         const state = identityState();
@@ -3163,8 +3510,6 @@ async function killAgentProcess(id, beforeSignal, leaf) {
             return;
         if (state === 'changed')
             throw new ResourceConflict(`refusing to stop ${id}: session leaf identity changed during escalation`);
-        if (!await sameAgentInstance())
-            throw new ResourceConflict(`refusing to stop ${id}: leaf PID ${pid}@${startToken} no longer proves ownership`);
         try {
             process.kill(pid, sig);
         }
@@ -3174,29 +3519,36 @@ async function killAgentProcess(id, beforeSignal, leaf) {
         if (await gone(sig === 'SIGTERM' ? AGENT_EXIT_GRACE_MS : 1000))
             return;
     }
+    throw new ResourceConflict(`refusing to stop ${id}: exact leaf PID ${pid}@${startToken} remains live after escalation`);
 }
-// @@@ stopAgentProcess - the shared teardown both stop and close begin with, so there is ONE kill path, not
-// two: kill the agent's tmux client, make sure the agent itself actually went with it, drop its boot-window
-// stamp (else a just-launched id lingers in the grace window reading `starting` instead of `offline`), and ask
-// the resolved adapter to sweep its ephemeral runtime transport — in that order, because the adapter only
-// removes a transport whose listener is PROVEN dead.
-// Deliberately does NOT drainQueue — the caller drains once, after it has settled the worktree.
-// @@@ leafAlive - does this pid name a live process? EPERM counts as alive (a process we may not signal is
-// still a process); only ESRCH is absence. Kept local: git.ts carries its own copy for lock reclamation, and
-// collapsing the two is part of the spec/eval unification lane, not of this fix.
-const leafAlive = (pid) => {
+const hostLeafProcessLiveness = (pid) => {
     try {
         process.kill(pid, 0);
-        return true;
+        return 'alive';
     }
     catch (error) {
-        return error?.code !== 'ESRCH';
+        const code = error?.code;
+        if (code === 'ESRCH')
+            return 'dead';
+        if (code === 'EPERM')
+            return 'alive';
+        return 'unknown';
     }
 };
-// One identity seam serves both signal teardown and cold retirement. A PID is only a locator: a live process
-// becomes target-owned when its immutable start identity is readable AND its argv carries the harness-owned
-// native identity. A live PID with a proven different argv is a stale artifact, while malformed/unreadable
-// evidence remains unknown and therefore blocks every destructive path.
+let sessionLeafProcessProbe = {
+    startToken: processStartToken,
+    liveness: hostLeafProcessLiveness,
+};
+export function installSessionLeafProcessProbeForTest(probe) {
+    const previous = sessionLeafProcessProbe;
+    sessionLeafProcessProbe = probe;
+    return () => { sessionLeafProcessProbe = previous; };
+}
+const sessionLeafStartToken = (pid) => sessionLeafProcessProbe.startToken(pid);
+const leafProcessLiveness = (pid) => sessionLeafProcessProbe.liveness(pid);
+const leafAlive = (pid) => leafProcessLiveness(pid) !== 'dead';
+// A retained leaf can mint durable ownership only while its registered PID is in the exact target pane's process
+// closure. The receipt then binds that one immutable process instance across tmux reparenting and crash retry.
 async function inspectSessionLeafIdentity(id, rec) {
     if (harnessById(rec.harness || defaultHarness.id).runtimeOwnership === 'adapter')
         return { state: 'missing' };
@@ -3206,34 +3558,84 @@ async function inspectSessionLeafIdentity(id, rec) {
         raw = readFileSync(path, 'utf8');
     }
     catch (error) {
-        if (error?.code === 'ENOENT')
-            return { state: 'missing' };
+        if (error?.code === 'ENOENT') {
+            const stored = readSessionLeafReceipt(id);
+            if (stored.state === 'invalid')
+                return { state: 'unknown', reason: stored.reason };
+            if (stored.state === 'missing')
+                return { state: 'missing' };
+            const liveness = leafProcessLiveness(stored.receipt.pid);
+            const current = sessionLeafStartToken(stored.receipt.pid);
+            const state = sessionLeafReceiptIdentityState(stored.receipt, stored.receipt.pid, current, liveness);
+            if (state === 'same-live')
+                return { state: 'unknown', pid: stored.receipt.pid, reason: 'leaf birth receipt remains live but agent.pid registration is missing' };
+            if (state === 'unknown')
+                return { state: 'unknown', pid: stored.receipt.pid, reason: 'leaf birth receipt PID is live but its process-start identity is unreadable' };
+            if (state !== 'gone' && state !== 'pid-reused')
+                return { state: 'unknown', pid: stored.receipt.pid, reason: `leaf birth receipt cannot reconcile a missing registration (${state})` };
+            rmSync(sessionLeafReceiptPath(id), { force: true });
+            return { state: 'dead', pid: stored.receipt.pid };
+        }
         return { state: 'unknown', reason: `leaf PID artifact is unreadable (${error instanceof Error ? error.message : String(error)})` };
     }
     const pid = Number(raw.trim());
     if (!Number.isSafeInteger(pid) || pid <= 0)
         return { state: 'unknown', reason: 'leaf PID artifact is malformed' };
-    const startToken = processStartToken(pid);
-    if (!startToken)
-        return leafAlive(pid) ? { state: 'unknown', pid, reason: `leaf PID ${pid} is alive but its process-start identity is unreadable` } : { state: 'dead', pid };
-    const ownerNeedle = harnessById(rec.harness || defaultHarness.id).leafOwnerNeedle?.(rec);
-    if (!ownerNeedle)
-        return { state: 'unknown', pid, reason: `no exact harness identity is registered for leaf PID ${pid}` };
-    let argv;
-    try {
-        argv = (await pexec('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8' })).stdout.trim();
-    }
-    catch {
-        return { state: 'unknown', pid, reason: `leaf PID ${pid} argv identity is unreadable` };
+    const stored = readSessionLeafReceipt(id);
+    if (stored.state === 'invalid')
+        return { state: 'unknown', pid, reason: stored.reason };
+    if (stored.state === 'valid') {
+        const liveness = leafProcessLiveness(pid);
+        const current = sessionLeafStartToken(pid);
+        const state = sessionLeafReceiptIdentityState(stored.receipt, pid, current, liveness);
+        if (state === 'same-live')
+            return { state: 'owned', identity: { pid, startToken: current, receipt: stored.receipt } };
+        if (state === 'gone') {
+            clearSessionLeafArtifacts(id);
+            return { state: 'dead', pid };
+        }
+        if (state === 'pid-reused') {
+            const snap = await liveSnapshot(id);
+            if (snap.probeFailed)
+                return { state: 'unknown', pid, reason: 'target pane state is unreadable while reconciling a retired leaf receipt' };
+            if (snap.windows.has(id))
+                return { state: 'unknown', pid, reason: `leaf birth receipt no longer matches PID ${pid} while the exact target pane remains live` };
+            clearSessionLeafArtifacts(id);
+            return { state: 'dead', pid };
+        }
+        if (state === 'unknown')
+            return { state: 'unknown', pid, reason: `leaf PID ${pid} is live but its process-start identity is unreadable` };
+        return { state: 'unknown', pid, reason: 'leaf birth receipt and agent.pid registration disagree' };
     }
-    if (!argv)
-        return { state: 'unknown', pid, reason: `leaf PID ${pid} argv identity is empty` };
-    const endToken = processStartToken(pid);
-    if (!endToken || endToken !== startToken)
-        return { state: 'unknown', pid, reason: `leaf PID ${pid} process-start identity changed during ownership read` };
-    if (argv.includes(ownerNeedle))
-        return { state: 'owned', identity: { pid, startToken, ownerNeedle } };
-    return { state: 'unrelated', pid, startToken };
+    const snap = await liveSnapshot(id);
+    if (snap.probeFailed)
+        return { state: 'unknown', pid, reason: 'exact target pane is unreadable; leaf birth receipt cannot be minted' };
+    const panePid = snap.windows.get(id)?.panePid ?? null;
+    const startBefore = sessionLeafStartToken(pid);
+    if (!startBefore) {
+        const live = leafProcessLiveness(pid);
+        if (live !== 'dead')
+            return { state: 'unknown', pid, reason: `leaf PID ${pid} process-start identity is unreadable while liveness is ${live}` };
+        clearSessionLeafArtifacts(id);
+        return { state: 'dead', pid };
+    }
+    let procs = null;
+    try {
+        procs = await procSnapshot();
+    }
+    catch { /* fail closed below */ }
+    const startAfter = sessionLeafStartToken(pid);
+    const candidate = sessionLeafReceiptCandidate(id, pid, panePid, procs, startBefore, startAfter);
+    if (!candidate.ok || !candidate.receipt)
+        return { state: 'unknown', pid, reason: candidate.reason || 'leaf birth receipt proof failed' };
+    if (readAgentPid(path) !== pid || sessionLeafStartToken(pid) !== candidate.receipt.startToken)
+        return { state: 'unknown', pid, reason: `leaf PID ${pid} identity changed before receipt commit` };
+    writeSessionLeafReceipt(id, candidate.receipt);
+    const committed = readSessionLeafReceipt(id);
+    if (committed.state !== 'valid' || !sameSessionLeafReceipt(committed.receipt, candidate.receipt)
+        || readAgentPid(path) !== pid || sessionLeafStartToken(pid) !== candidate.receipt.startToken)
+        return { state: 'unknown', pid, reason: `leaf PID ${pid} identity changed while receipt committed` };
+    return { state: 'owned', identity: { pid, startToken: candidate.receipt.startToken, receipt: candidate.receipt } };
 }
 async function assertSessionLeafOwned(id, rec) {
     if (harnessById(rec.harness || defaultHarness.id).runtimeOwnership === 'adapter')
@@ -3248,8 +3650,6 @@ async function assertSessionLeafOwned(id, rec) {
         return null;
     if (observed.state === 'owned')
         return observed.identity;
-    if (observed.state === 'unrelated')
-        throw new ResourceConflict(`refusing to stop ${id}: leaf PID ${observed.pid}@${observed.startToken} does not prove argv ownership`);
     throw new ResourceConflict(`refusing to stop ${id}: ${observed.reason}`);
 }
 async function stopAgentProcess(id, rec, requireCold = false, coldReceipt) {
@@ -3262,12 +3662,20 @@ async function stopAgentProcess(id, rec, requireCold = false, coldReceipt) {
     const harness = harnessById(rec.harness || defaultHarness.id);
     const leaf = await assertSessionLeafOwned(id, rec);
     // Adapter-owned headless sessions may have no live leaf PID, but launch still created an exact tmux session
-    // wrapper. Kill that session-id unconditionally; runtimeOwnership only changes the PID/argv proof, never the
+    // wrapper. Kill that session-id unconditionally; runtimeOwnership only changes the leaf receipt proof, never the
     // exact tmux teardown.
     await tmuxOk(['kill-session', '-t', id]);
     await assertTargetTmuxAbsent(id, 'after kill');
-    if (leaf)
+    if (leaf) {
         await killAgentProcess(id, assertOwned, leaf);
+        const registered = readAgentPid(sessionArtifactPath(id, 'agent.pid'));
+        const liveness = leafProcessLiveness(leaf.pid);
+        const currentStartToken = sessionLeafStartToken(leaf.pid);
+        const finalState = sessionLeafReceiptIdentityState(leaf.receipt, Number.isSafeInteger(registered) ? registered : null, currentStartToken, liveness);
+        if (finalState !== 'gone' && finalState !== 'pid-reused')
+            throw new ResourceConflict(`refusing to stop ${id}: exact leaf teardown remains ${finalState}`);
+        clearSessionLeafArtifacts(id);
+    }
     launchedAt.delete(id);
     await harness.cleanupRuntime(rec);
     if (requireCold) {
@@ -3293,7 +3701,8 @@ async function stopSessionUnlocked(id) {
     const rec = readRecord(id);
     if (rec)
         writeRecord({ ...rec, stopped: true });
-    requestQueueDrain(); // a stop frees a slot — start the next queued session if any
+    if (wt.rec.status !== 'queued')
+        requestQueueDrain(); // a live stop frees a slot; a prepared queue never held one
     return !!wt;
 }
 export const stopSession = (id) => withSessionTransition(id, () => withRecordLock(id, () => stopSessionUnlocked(id)));
@@ -3489,6 +3898,32 @@ async function assertColdRetirementSafe(id, rec) {
             throw new ResourceConflict(`refusing to close archived session ${id}: target adapter collection is not proven cold`);
     }
 }
+async function assertDiscardableWorktree(id, path, branch, kind) {
+    if (existsSync(path)) {
+        const status = await gitTry(['-C', path, 'status', '--porcelain', '--untracked-files=all']);
+        if (!status.ok)
+            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree status is unreadable`);
+        if (status.stdout.trim())
+            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree has dirty work`);
+    }
+    if (branch) {
+        const resolved = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${branch}^{commit}`]);
+        if (resolved.ok) {
+            const count = await gitTry(['-C', mainRoot(), 'rev-list', '--count', `${mainBranch()}..${branch}`]);
+            if (!count.ok)
+                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch ancestry is unreadable`);
+            const ahead = Number(count.stdout.trim());
+            if (!Number.isFinite(ahead) || ahead !== 0)
+                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch is ${Number.isFinite(ahead) ? ahead : 'an unknown number of'} commit(s) ahead`);
+        }
+        else if (resolved.failure !== 'exit') {
+            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch identity is unreadable`);
+        }
+        else if (existsSync(path)) {
+            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree exists but branch ${branch} is missing`);
+        }
+    }
+}
 // A never-launched queue owns only prepared disk state. The transition/record locks around close serialize
 // this check with startQueued: whichever wins decides whether the record is still a queue or has become live.
 // No shared-runtime probe belongs here because a valid prepared row has no adapter thread to look up.
@@ -3511,32 +3946,31 @@ async function assertQueuedRetirementSafe(id, rec, path, branch) {
         const pid = readAgentPid(pidPath);
         throw new ResourceConflict(`refusing to close queued session ${id}: target leaf PID artifact ${Number.isFinite(pid) && pid > 0 ? pid : 'is unreadable'}; never-launched ownership is ambiguous`);
     }
-    if (existsSync(path)) {
-        const status = await gitTry(['-C', path, 'status', '--porcelain', '--untracked-files=all']);
-        if (!status.ok)
-            throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree status is unreadable`);
-        if (status.stdout.trim())
-            throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree has dirty work`);
-    }
-    if (branch) {
-        const resolved = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${branch}^{commit}`]);
-        if (resolved.ok) {
-            const count = await gitTry(['-C', mainRoot(), 'rev-list', '--count', `${mainBranch()}..${branch}`]);
-            if (!count.ok)
-                throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch ancestry is unreadable`);
-            const ahead = Number(count.stdout.trim());
-            if (!Number.isFinite(ahead) || ahead !== 0)
-                throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch is ${Number.isFinite(ahead) ? ahead : 'an unknown number of'} commit(s) ahead`);
-        }
-        else if (resolved.failure !== 'exit') {
-            throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch identity is unreadable`);
-        }
-        else if (existsSync(path)) {
-            throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree exists but branch ${branch} is missing`);
-        }
-    }
+    await assertDiscardableWorktree(id, path, branch, 'prepared');
+}
+// A launch may leave its row active before Codex publishes the native thread binding. This close path owns
+// only the record's dead local launch residue; an unbound app-server peer stays unowned and untouched.
+async function assertUnboundRetirementSafe(id, rec, path, branch) {
+    if (harnessById(rec.harness || defaultHarness.id).exactNativeTargetId(rec) || rec.status === 'queued' || rec.archived)
+        throw new ResourceConflict(`refusing to close unbound session ${id}: it is not an unbound live-record residue`);
+    if (rec.adapterRecovery || rec.launchReadinessPending || launching.has(id) || existsSync(sessionArtifactPath(id, 'launch')))
+        throw new ResourceConflict(`refusing to close unbound session ${id}: launch or recovery is still in progress`);
+    const [snap, socket] = await Promise.all([liveSnapshot(id), rendezvousListening(id)]);
+    if (snap.probeFailed)
+        throw new ResourceConflict(`refusing to close unbound session ${id}: liveness probe failed; local worker absence is unproven`);
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (harness.liveness(rec, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online')
+        throw new ResourceConflict(`refusing to close unbound session ${id}: its adapter still reports a live worker`);
+    if (socket === 'live')
+        throw new ResourceConflict(`refusing to close unbound session ${id}: target rendezvous transport already exists`);
+    if (socket === 'unproven')
+        throw new ResourceConflict(`refusing to close unbound session ${id}: target rendezvous state is ambiguous`);
+    const leaf = await inspectSessionLeafIdentity(id, rec);
+    if (leaf.state !== 'missing' && leaf.state !== 'dead')
+        throw new ResourceConflict(`refusing to close unbound session ${id}: ${leaf.state === 'unknown' ? leaf.reason : 'target leaf identity is live or ambiguous'}`);
+    await assertDiscardableWorktree(id, path, branch, 'unbound');
 }
-async function closeOwnedSessionUnlocked(id, wt, source) {
+async function closeOwnedSessionUnlocked(id, wt, source, unboundRetired = false) {
     const root = mainRoot();
     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(wt.rec, root);
     if (receiptFailure)
@@ -3549,7 +3983,7 @@ async function closeOwnedSessionUnlocked(id, wt, source) {
             await assertColdRetirementSafe(id, wt.rec);
         else if (wt.rec.status === 'queued')
             await assertQueuedRetirementSafe(id, wt.rec, wt.path, wt.branch);
-        else
+        else if (!unboundRetired)
             throw new ResourceConflict(`refusing to close ${id}: target runtime was not cold-retired first`);
     }
     // The marker protects only the destructive half. A failed cold proof must leave a normal, resumable binding.
@@ -3631,28 +4065,38 @@ async function closeSessionUnlocked(id, source) {
     }
     if (!wt)
         return false;
+    let unboundRetired = false;
     if (!retirementReason(wt.rec) && !wt.rec.archived && wt.rec.status !== 'queued') {
-        // A confirmed terminal close may end an exact native turn before cold proof. Ordinary archive deliberately
-        // remains non-destructive while a turn is active; close already means discard this session's work.
         const harness = harnessById(wt.rec.harness || defaultHarness.id);
-        assertSessionOwnerSafe(id, harness.id);
-        const interrupt = harness.interrupt;
-        if (interrupt) {
-            const result = await interrupt({ ...wt.rec, runtimeDir: runtimeRoot() });
-            if (!result.ok)
-                throw new ResourceConflict(`refusing to close ${id}: native interrupt failed (${result.error || 'unknown error'})`);
+        if (!harness.exactNativeTargetId(wt.rec)) {
+            await assertUnboundRetirementSafe(id, wt.rec, wt.path, wt.branch);
+            await tmuxOk(['kill-session', '-t', id]);
+            await assertTargetTmuxAbsent(id, 'after unbound residue retirement');
+            await harness.cleanupRuntime(wt.rec);
+            unboundRetired = true;
+        }
+        else {
+            // A confirmed terminal close may end an exact native turn before cold proof. Ordinary archive deliberately
+            // remains non-destructive while a turn is active; close already means discard this session's work.
+            assertSessionOwnerSafe(id, harness.id);
+            const interrupt = harness.interrupt;
+            if (interrupt) {
+                const result = await interrupt({ ...wt.rec, runtimeDir: runtimeRoot() });
+                if (!result.ok)
+                    throw new ResourceConflict(`refusing to close ${id}: native interrupt failed (${result.error || 'unknown error'})`);
+            }
+            const archived = await archiveSessionUnlocked(id);
+            if (!archived)
+                return false;
+            wt = await findWorktree(id);
+            if (!wt)
+                return false;
         }
-        const archived = await archiveSessionUnlocked(id);
-        if (!archived)
-            return false;
-        wt = await findWorktree(id);
-        if (!wt)
-            return false;
     }
     const target = wt;
     return target.branch
-        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source))
-        : closeOwnedSessionUnlocked(id, target, source);
+        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source, unboundRetired))
+        : closeOwnedSessionUnlocked(id, target, source, unboundRetired);
 }
 export const closeSession = (id, rawSource) => {
     const source = normalizeCloseSource(rawSource);
@@ -4042,13 +4486,18 @@ export function formatTable(sessions, color = true, scope = { kind: 'sessions' }
     });
     return [heading, header, ...rows, statusLegend(color)].join('\n');
 }
-function keyedPendingMessage(receipt, mid, delivery) {
-    return {
-        mid,
-        text: delivery.text,
-        from: delivery.from,
-        dispatch: { operation: receipt.operation, requestDigest: receipt.requestDigest },
-    };
+class StrandedDeliveryError extends Error {
+}
+async function strandedDeliveryError(rec) {
+    const h = harnessById(rec.harness || defaultHarness.id);
+    if (!h.deliveryTransport)
+        return null;
+    const transport = await h.deliveryTransport({ ...rec, runtimeDir: runtimeRoot() });
+    if (transport.kind !== 'unreachable' || agentAlive(rec.session) !== true)
+        return null;
+    const queued = pendingMessages(rec.session).length;
+    const noun = queued === 1 ? 'message is' : 'messages are';
+    return new StrandedDeliveryError(`session ${rec.session} is stranded: ${transport.reason} while its registered agent process is still alive; ${queued} queued ${noun} waiting with no transport to claim them. Use \`spex session send ${rec.session} --keys "<keys>"\` to steer the live tmux pane, then repair the control transport before sending text.`);
 }
 export async function sendText(id, text, from, opts = {}) {
     if (!text)
@@ -4059,52 +4508,39 @@ export async function sendText(id, text, from, opts = {}) {
         // a send either appends before close obtains the fence (and close's revocation voids its debt), or sees
         // the terminal marker before it records anything. Arbitrary legacy `from` values keep working; they just
         // name an otherwise-unused lock until a matching session is closed.
-        await withRecordLocks([id, ...(from ? [from] : [])].sort(), async () => {
-            if (from && senderDeliveryRevoked(from))
-                throw new ResourceConflict(`sender session ${from} is closed; prompt NOT delivered`);
-            const rec = readRecord(id);
-            if (!rec)
-                throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
-            const accept = async () => {
-                if (opts.idempotency) {
-                    const prior = sentDispatchReceipt(id, opts.idempotency.operation, opts.idempotency.requestDigest);
-                    if (prior) {
-                        if (prior.payloadHash !== opts.idempotency.payloadHash) {
-                            const conflict = new ResourceConflict(`idempotency key is already bound to another ${opts.idempotency.operation} payload`);
-                            Object.assign(conflict, { code: 'dispatch_key_reused' });
-                            throw conflict;
-                        }
-                        if (prior.delivery && !prior.delivered) {
-                            ensurePendingWhileLocked(id, keyedPendingMessage(opts.idempotency, prior.mid, prior.delivery));
-                        }
-                        replayed = true;
-                        return;
-                    }
-                }
+        let rec = null;
+        const accepted = await acceptMessage({
+            target: id,
+            text,
+            from,
+            idempotency: opts.idempotency,
+            validate: async () => {
+                rec = readRecord(id);
+                if (!rec)
+                    throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
+            },
+            prepare: async () => {
                 await opts.acceptGuard?.(rec);
+                const stranded = await strandedDeliveryError(rec);
+                if (stranded)
+                    throw stranded;
                 // Composed at ACCEPT time, once: the log keeps the raw conversational text plus the effective reply channel,
                 // the queue keeps the transport form. Composing again at handover would let a later send change the hints on
                 // a message that was already accepted.
                 const prompt = await composeSessionPrompt(text, rec, { from, replyVia: opts.replyVia });
-                const dispatchReceipt = opts.idempotency
-                    ? { ...opts.idempotency, delivery: { text: prompt.text, from: from ?? null } }
-                    : undefined;
-                const appended = appendSent(id, text, from ?? null, prompt.replyVia, dispatchReceipt);
-                enqueue(id, opts.idempotency
-                    ? keyedPendingMessage(opts.idempotency, appended.mid, dispatchReceipt.delivery)
-                    : { mid: appended.mid, text: prompt.text, from: from ?? null });
-            };
-            if (opts.idempotency)
-                await withDeliveryLocks([id], accept);
-            else
-                await accept();
+                return { text: prompt.text, ...(prompt.replyVia ? { replyVia: prompt.replyVia } : {}) };
+            },
         });
+        replayed = accepted.replayed;
     }
     catch (error) {
         const code = error?.code;
+        const detail = error instanceof StrandedDeliveryError
+            ? error.message
+            : `could not append the message to session ${id}'s log: ${error instanceof Error ? error.message : String(error)} — prompt NOT delivered`;
         return {
             ok: false,
-            error: `could not append the message to session ${id}'s log: ${error instanceof Error ? error.message : String(error)} — prompt NOT delivered`,
+            error: detail,
             ...(code ? { code } : {}),
         };
     }
@@ -4125,15 +4561,9 @@ export async function drainSession(id) {
     if (!rec)
         return;
     const h = harnessById(rec.harness || defaultHarness.id);
+    if (h.launchPayloadProof && !rec.harnessSessionId)
+        return;
     await drain(id, async (msg) => {
-        if (msg.dispatch) {
-            const receipt = sentDispatchReceipt(id, msg.dispatch.operation, msg.dispatch.requestDigest);
-            if (!receipt || receipt.mid !== msg.mid || !receipt.delivery
-                || receipt.delivery.text !== msg.text || receipt.delivery.from !== msg.from)
-                return false;
-            if (receipt.delivered)
-                return true;
-        }
         // the pane guard ([[harness-adapter]] deliveryBlockedBy): the ONE pane state where the harness swallows a
         // prompt its channel confirms (claude's sessions panel), checkable only from the pane. Treated as a REFUSAL
         // rather than a skip — the message stays owed and the sweep hands it over once the pane leaves that state.
@@ -4145,8 +4575,6 @@ export async function drainSession(id) {
             catch { /* no pane to consult — let the insert itself decide */ }
         }
         const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.mid }, msg.text);
-        if (delivered.ok && msg.dispatch)
-            settleSentDispatch(id, msg.mid);
         return delivered.ok;
     });
 }