@spexcode/spec-cli 0.6.6 → 0.6.8

package/dist/sessions.js

@@ -1,31 +1,87 @@
-import { execFile, spawn } from 'node:child_process';
+import { execFile, execFileSync, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, linkSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, renameSync, linkSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import { join, dirname, isAbsolute, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { rm as rmAsync, readdir as readdirAsync } from 'node:fs/promises';
 import { seedWorktreeHostState } from './worktree-sources.js';
-import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, withGitAbortSignal, isGitObjectId } from '@spexcode/spec-core';
+import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, parseStatPath, withGitAbortSignal, isGitObjectId } from '@spexcode/spec-core';
 import { loadConfig, loadSpecs, loadSpecsLite } from '@spexcode/spec-core';
 import { adapterLoadedReferenceState, assertRvSockPath, defaultHarness, HARNESSES, sessionIdentityEnvVars, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rendezvousListening, stampRvSock } from './harness.js';
 import { materialize } from './materialize.js';
 import { mainBranch, mainRoot, gitCommonDir, readConfig, runtimeRoot, treeSlotDir, sessionStoreDir, sessionRecordPath, sessionArtifactPath, listSessionIds, rawLaunchReadinessOriginal, readRecordEntry, readAliasedRecordEntry, readPublicRecordEntry, envSessionId, isSessionLifecycle, isSessionProposal } from '@spexcode/spec-core';
 import { readSessionFiles } from './session-files.js';
 import { readSessionWebs } from './session-web.js';
-import { acceptMessage, drain, recordStatus, lastHumanSendVia, owesDelivery, pendingMessages } from '@spexcode/session-core';
-import { pendingSnapshot, replacePendingWhileLocked, revokePendingFromWhileLocked, revokeSenderDelivery, withDeliveryLocks, trySessionRecordLockSync, withSessionRecordLock, withSessionRecordLockSync as coreWithSessionRecordLockSync } from '@spexcode/session-core/internal';
+import { acquireFreshSessionApplicationForCreate, configuredSessionApplicationIfCutover, initializeFreshSessionApplication, releaseFreshSessionApplicationForCreate, sessionApplicationCutoverState, setSessionApplicationCommitWake } from './session-application.js';
+import { jsonMigrationFencePath } from '@spexcode/session-application';
+import { withDeliveryLocks } from './delivery-lock.js';
+import { withSessionRecordLock, withSessionRecordLockSync as coreWithSessionRecordLockSync } from './session-record-lock.js';
 import { stripRefSigil } from './mentions.js';
 import { shQuote } from './sh.js';
 import { assertSessionOwnerSafe, assertSessionStopSafe, ResourceConflict } from './host-resources.js';
 import { processStartToken } from '@spexcode/spec-core';
-import { bindCodexGeneration, codexGenerationBindingForSession, commitCodexGenerationRegistration, prepareCodexGenerationClose, prepareCodexGenerationRegistration, readCodexGenerationLedger } from './codex-runtime-generations.js';
+import { bindCodexGeneration, codexGenerationBindingForSession, commitCodexGenerationRegistration, prepareCodexGenerationRegistration, readCodexGenerationLedger } from './codex-runtime-generations.js';
 import { cliEntrypointArgs } from './tsx-bin.js';
+import { lastHumanSendVia, recordStatus } from './session-timeline.js';
 const pexec = promisify(execFile);
 export const TMUX_SOCK = process.env.SPEXCODE_TMUX || 'spexcode';
 const DEFER_FOOTPRINT_REFRESH = { SPEXCODE_DEFER_FOOTPRINT_REFRESH: 'session-create' };
 const HARNESS = defaultHarness;
 const COLS = 120, ROWS = 32;
 const DEFAULT_MAX_ACTIVE = 8;
+const worktreeTrashDir = (root) => join(root, '.worktrees', '.trash');
+const pendingTrashDeletes = [];
+let trashDeleteRunning = false;
+let trashDeleteScheduled = false;
+async function drainWorktreeTrash() {
+    while (pendingTrashDeletes.length) {
+        const path = pendingTrashDeletes.shift();
+        try {
+            await rmAsync(path, { recursive: true, force: true });
+            if (existsSync(path))
+                throw new Error('path remains after recursive removal');
+        }
+        catch (error) {
+            console.error(`spex: deferred worktree deletion failed for ${path}; retained for next backend startup: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+    trashDeleteRunning = false;
+}
+function queueWorktreeTrash(path) {
+    pendingTrashDeletes.push(path);
+    if (trashDeleteRunning || trashDeleteScheduled)
+        return;
+    trashDeleteScheduled = true;
+    setImmediate(() => {
+        trashDeleteScheduled = false;
+        trashDeleteRunning = true;
+        void drainWorktreeTrash();
+    });
+}
+/** Start the one process-local serial reaper and resume any crash leftovers. */
+export function startWorktreeTrashReaper() {
+    const dir = worktreeTrashDir(mainRoot());
+    readdirAsync(dir, { withFileTypes: true }).then((entries) => {
+        for (const entry of entries)
+            queueWorktreeTrash(join(dir, entry.name));
+    }).catch((error) => {
+        if (error?.code !== 'ENOENT')
+            console.error(`spex: deferred worktree trash cleanup failed for ${dir}; retrying next startup: ${error instanceof Error ? error.message : error}`);
+    });
+}
+function moveWorktreeToTrash(root, path) {
+    const worktrees = resolve(join(root, '.worktrees'));
+    const source = resolve(path);
+    // Session creation uses <root>/.worktrees/<name>. Keep an adjacent trash for legacy/manual records whose
+    // recorded path predates that layout; the normal product path always lands in the governed .worktrees/.trash.
+    const parent = dirname(source);
+    const dir = parent === worktrees ? worktreeTrashDir(root) : join(parent, '.trash');
+    mkdirSync(dir, { recursive: true });
+    const target = join(dir, `wt-${Date.now()}-${randomUUID().slice(0, 12)}`);
+    renameSync(source, target);
+    return target;
+}
 function maxActive() {
     let v;
     try {
@@ -47,7 +103,7 @@ function maxActive() {
 // propagated when set, because the session inherits the tmux SERVER's env (not the backend's), so without this
 // an overridden home would silently leak the session's hook-state + codex-trust to the default ~/.spexcode /
 // ~/.codex. Deterministic: the session's store = the backend's store, never the ambient env's.
-const rvEnv = (id, harness = HARNESS) => {
+const rvEnv = (id, harness = HARNESS, nativeStartToken) => {
     // SPEXCODE_SESSION_ID is the governed record id, and it is the SESSION'S OWN — so the launch STRIPS every
     // session-identity variable it may have inherited (the pane inherits the tmux SERVER's env, which may carry
     // a foreign session's ids from whoever started it) before setting this one. Identity is established HERE,
@@ -65,9 +121,15 @@ const rvEnv = (id, harness = HARNESS) => {
         `SPEXCODE_SESSION_ID=${id}`,
         `SPEXCODE_SESSION_IDENTITY_VARS=${shQuote(sessionIdentityEnvVars().join(','))}`,
         `SPEXCODE_PROJECT_ROOT=${shQuote(mainRoot())}`,
+        ...(nativeStartToken ? [`SPEXCODE_NATIVE_START_TOKEN=${shQuote(nativeStartToken)}`] : []),
         ...harness.launchEnv(id), ...homeVars].join(' ');
 };
 const PROPOSAL_STATUS = { merge: 'review', nothing: 'done', close: 'close-pending' };
+// Awaiting is the durable lifecycle row; its proposal selects the user-facing display status. Keep this
+// projection in the session package so backend reconciliation and offline client reads cannot drift apart.
+export function displayStatusForProposal(proposal) {
+    return PROPOSAL_STATUS[proposal ?? 'nothing'];
+}
 function normalizeCloseSource(raw) {
     if (raw == null)
         return { kind: 'user' };
@@ -80,64 +142,6 @@ function normalizeCloseSource(raw) {
         return { kind: 'unverified-session-claim', id: source.id.trim() };
     throw new ResourceConflict('refusing session close: source must be user or an unverified session claim');
 }
-function appendCloseLedger(id, rec, source) {
-    const path = join(runtimeRoot(), 'session-close-ledger.ndjson');
-    const event = {
-        version: 1,
-        action: 'close-authorized',
-        at: new Date().toISOString(),
-        source,
-        target: {
-            id,
-            harness: rec.harness,
-            thread: rec.harnessSessionId,
-            worktree: rec.worktreePath,
-            branch: rec.branch,
-        },
-    };
-    appendFileSync(path, `${JSON.stringify(event)}\n`);
-}
-export function findSessionClosure(selector) {
-    const query = stripRefSigil(selector).trim();
-    if (!query)
-        return null;
-    const path = join(runtimeRoot(), 'session-close-ledger.ndjson');
-    let text;
-    try {
-        text = readFileSync(path, 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-    const matches = new Map();
-    for (const line of text.split('\n')) {
-        if (!line.trim())
-            continue;
-        let event;
-        try {
-            event = JSON.parse(line);
-        }
-        catch {
-            throw new ResourceConflict('session close history is unreadable');
-        }
-        if (!event || typeof event !== 'object' || event.action !== 'close-authorized')
-            continue;
-        const target = event.target;
-        const id = target && typeof target === 'object' ? target.id : undefined;
-        const closedAt = event.at;
-        if (typeof id !== 'string' || !id || typeof closedAt !== 'string' || !closedAt)
-            throw new ResourceConflict('session close history is malformed');
-        if (id === query || id.startsWith(query))
-            matches.set(id, { id, closedAt });
-    }
-    if (!matches.size)
-        return null;
-    if (matches.size > 1)
-        throw new ResourceConflict(`close history for ${query} is ambiguous: ${[...matches.keys()].map((id) => id.slice(0, 8)).join(', ')}`);
-    return [...matches.values()][0];
-}
 function storeDir(id) { const d = sessionStoreDir(id); mkdirSync(d, { recursive: true }); return d; }
 function writePromptFile(id, prompt) {
     try {
@@ -245,19 +249,57 @@ export function canDrainQueued(rec, authority = backendLaunchAuthority()) {
     return rec.status === 'queued' && !rec.stopped && (rec.launchOwner === null || rec.launchOwner === authority);
 }
 // typed read of a session's record from the global store (null if it has none — a self-launched session that
-// only ever wrote spec-discipline sentinels has a store dir but no session.json). Goes through layout's
+// only ever wrote spec-discipline sentinels has a store dir but no runtime.json). Goes through layout's
 // readAliasedRawRecord (the seam that owns the path + the codex-thread-id alias), then validates the loose
 // on-disk fields into the typed shape — so a codex hook resolving by its thread id reaches the real record.
 function readRecord(id) {
     const entry = readAliasedRecordEntry(id);
-    if (entry.kind === 'absent')
-        return null;
+    if (entry.kind === 'absent') {
+        // A migrated session may retain its canonical application row after an envelope was removed or never
+        // materialized. Lifecycle hooks must still reach that row; do not turn missing runtime metadata into a
+        // silent "not governed" result. The minimal projection deliberately carries no guessed resource identity.
+        const application = configuredSessionApplicationIfCutover();
+        const state = application?.readState(id);
+        if (!state)
+            return null;
+        return {
+            session: id,
+            governed: true,
+            worktreePath: '', branch: null, node: null, title: null, name: null, parent: state.parentSessionId,
+            status: state.status,
+            proposal: isSessionProposal(state.proposal) ? state.proposal : null,
+            merges: 0, note: state.note, sortKey: null, createdAt: state.updatedAtMs,
+            harness: 'claude', harnessSessionId: null, runtimeStartToken: null,
+            stopped: false, archived: false, closedAt: null, coldProof: null, adapterRecovery: null,
+            launcher: null, launchCmd: null, launchOwner: null, launchReadinessStartedAt: null,
+            createRequestId: null, createPayloadHash: null, zcodeChildSessionIds: [], base: null,
+            diffComments: [], launchReadinessPending: null,
+        };
+    }
     if (entry.kind === 'corrupt')
         throw new SessionRecordUnusable('corrupt', id, corruptReason(entry));
     try {
-        return fromRaw(entry.raw);
+        const record = fromRaw(entry.raw);
+        // After cutover, runtime.json is only the runtime/worktree envelope. Lifecycle is owned by the
+        // session application. Overlaying here keeps every internal caller on the same fact instead of
+        // letting a stale JSON snapshot steer a launch, close, or hook decision.
+        const application = configuredSessionApplicationIfCutover();
+        if (!application || !record.governed)
+            return record;
+        const state = application.readState(record.session);
+        if (!state)
+            throw new ResourceConflict(`session ${record.session} has no canonical application state after JSON cutover`);
+        return {
+            ...record,
+            status: state.status,
+            proposal: isSessionProposal(state.proposal) ? state.proposal : null,
+            note: state.note,
+            parent: state.parentSessionId,
+        };
     }
     catch (error) {
+        if (error instanceof ResourceConflict)
+            throw error;
         throw new SessionRecordUnusable('corrupt', id, `session record is unreadable: ${sessionRecordPath(id)} — ${error instanceof Error ? error.message : String(error)}. The file is kept as-is; nothing will rewrite it.`);
     }
 }
@@ -275,7 +317,9 @@ const corruptReason = (e) => `session record is unreadable: ${e.path} — ${e.er
 function retirementReason(rec) {
     if (!rec.worktreePath || existsSync(rec.worktreePath))
         return null;
-    return `session ${rec.session.slice(0, 8)} is retired: its worktree ${rec.worktreePath} no longer exists, so it cannot work, be marked active/idle, or be relaunched. Close it (\`spex session close <id>\`) to drop the record.`;
+    if (rec.archived)
+        return `session ${rec.session.slice(0, 8)} is closed and read-only: its worktree ${rec.worktreePath} no longer exists`;
+    return `session ${rec.session.slice(0, 8)} is retired: its worktree ${rec.worktreePath} no longer exists, so it cannot work, be marked active/idle, or be relaunched`;
 }
 function readLiveRecord(id) {
     const rec = readRecord(id);
@@ -291,22 +335,6 @@ export function withSessionRecordLockSync(id, body) {
     return coreWithSessionRecordLockSync(id, body);
 }
 const withRecordLockSync = withSessionRecordLockSync;
-// Synchronous terminal input is another product turn-entry path. The PTY bridge uses this narrow seam to
-// enqueue input while holding the same durable record lock as archive, so an archive preflight cannot pass idle
-// and then race a just-queued TUI turn.
-export function withSessionInputLock(id, body) {
-    // PTY input is synchronous. A single non-blocking open is the only safe barrier: EEXIST rejects this input
-    // regardless of owner PID, so a same-process async archive can never be frozen behind Atomics.wait.
-    const release = trySessionRecordLockSync(id);
-    if (!release)
-        return null;
-    try {
-        return body();
-    }
-    finally {
-        release();
-    }
-}
 const COLD_PROOF_VERSION = 'cold-v1';
 function coldProofFor(rec) {
     const adapter = harnessById(rec.harness || defaultHarness.id).id;
@@ -332,6 +360,9 @@ export function fromRaw(raw) {
     if (pendingRaw && !pendingStatus)
         throw new Error(`session '${raw.session_id}' launch readiness original has invalid lifecycle '${pendingRaw.status}'`);
     const pendingProposal = pendingRaw && isSessionProposal(pendingRaw.proposal) ? pendingRaw.proposal : null;
+    if (raw.closed_at != null && raw.closed_at !== ''
+        && (typeof raw.closed_at !== 'string' || !Number.isFinite(Date.parse(raw.closed_at))))
+        throw new Error(`session '${raw.session_id}' has invalid closed_at`);
     if (pendingRaw?.proposal && !pendingProposal)
         throw new Error(`session '${raw.session_id}' launch readiness original has invalid proposal '${pendingRaw.proposal}'`);
     const zcodeChildSessionIds = raw.zcode_child_session_ids ?? [];
@@ -339,6 +370,18 @@ export function fromRaw(raw) {
         || zcodeChildSessionIds.some((id) => typeof id !== 'string' || !id || id.trim() !== id)
         || new Set(zcodeChildSessionIds).size !== zcodeChildSessionIds.length)
         throw new Error(`session '${raw.session_id}' has invalid zcode_child_session_ids`);
+    const diffComments = raw.diff_comments ?? [];
+    if (!Array.isArray(diffComments) || diffComments.some((comment) => !comment || typeof comment !== 'object'))
+        throw new Error(`session '${raw.session_id}' has invalid diff_comments`);
+    const parsedDiffComments = diffComments.map((comment) => {
+        const c = comment;
+        if (!c.id || typeof c.id !== 'string' || typeof c.file_path !== 'string' || !c.file_path
+            || !Number.isInteger(c.line_start) || c.line_start < 1 || !Number.isInteger(c.line_end) || c.line_end < c.line_start
+            || typeof c.body !== 'string' || !c.body.trim() || typeof c.diff_identity !== 'string'
+            || !(c.sent_at === null || typeof c.sent_at === 'string'))
+            throw new Error(`session '${raw.session_id}' has invalid diff comment`);
+        return { id: c.id, filePath: c.file_path, lineStart: c.line_start, lineEnd: c.line_end, body: c.body, diffIdentity: c.diff_identity, sentAt: c.sent_at };
+    });
     return {
         session: raw.session_id, governed: !!raw.governed, worktreePath: raw.worktree_path || '', branch: raw.branch || null,
         node: raw.node || null, title: raw.title || null, name: raw.name || null, parent: raw.parent || null,
@@ -346,23 +389,30 @@ export function fromRaw(raw) {
         note: raw.note || null, sortKey, createdAt: Number(raw.createdAt) || 0,
         harness: raw.harness || 'claude', // records written before the harness field default to claude
         harnessSessionId: raw.harness_session_id || null,
+        runtimeStartToken: raw.runtime_start_token || null,
         stopped: !!raw.stopped, // records written before explicit stop tracking were not stopped
-        archived: !!raw.archived, // records written before archive → absent → not shelved
+        archived: !!raw.archived, // records written before close retention → absent → working
+        closedAt: typeof raw.closed_at === 'string' && raw.closed_at ? raw.closed_at : null,
         coldProof: raw.cold_proof || null, // legacy archived rows have no proof and remain visible until re-archived
         adapterRecovery: raw.adapter_recovery || null,
         launcher: raw.launcher || null, // records written before launchers → null → old-record fallback
         launchCmd: raw.launch_cmd || null, // records written before the pin → null → fall back to launcher name / ambient
         launchOwner: launchOwner || null,
+        launchReadinessStartedAt: Number.isFinite(Number(raw.launch_readiness_started_at))
+            ? Number(raw.launch_readiness_started_at) : null,
         createRequestId: raw.create_request_id || null,
         createPayloadHash: raw.create_payload_hash || null,
         zcodeChildSessionIds: [...zcodeChildSessionIds],
         base: raw.base || null, // records written before pinned bases → null → the source-of-truth branch
+        forkCommit: raw.fork_commit || null, // records written before the fork commit → null → recovered from the branch reflog
+        diffComments: parsedDiffComments,
         launchReadinessPending: pendingRaw ? {
             version: 1,
             startedAt: raw.launch_readiness_pending.startedAt,
             original: {
                 status: pendingStatus, proposal: pendingProposal, note: pendingRaw.note || null,
                 stopped: pendingRaw.stopped, archived: pendingRaw.archived,
+                closedAt: pendingRaw.closed_at || null,
                 coldProof: pendingRaw.cold_proof || null, adapterRecovery: pendingRaw.adapter_recovery || null,
             },
         } : null,
@@ -382,6 +432,7 @@ function launchReadinessPending(original) {
             note: original.note,
             stopped: original.stopped,
             archived: original.archived,
+            closedAt: original.closedAt,
             coldProof: original.coldProof ?? null,
             adapterRecovery: original.adapterRecovery ?? null,
         },
@@ -392,12 +443,42 @@ function restoreLaunchReadinessOriginal(rec) {
     return original ? { ...rec, ...original, launchReadinessPending: null } : rec;
 }
 // Rebuild the full disk projection so retired keys disappear on the next write.
+function assertLegacyJsonWritesAllowed() {
+    const fence = jsonMigrationFencePath(join(runtimeRoot(), 'sessions'));
+    if (existsSync(fence) && !configuredSessionApplicationIfCutover()) {
+        throw new ResourceConflict(`legacy JSON session store is fenced for one-time migration: ${fence}`);
+    }
+}
 function writeRecord(rec) {
+    assertLegacyJsonWritesAllowed();
+    const application = configuredSessionApplicationIfCutover();
+    // The JSON file is runtime/worktree metadata after cutover, not a lifecycle store. Once the canonical row
+    // exists, omit the four old lifecycle keys entirely; retaining them would leave a second apparent fact for
+    // readers and tempt a future path to trust the wrong writer. New records still need the legacy shape until
+    // their canonical row is created, and non-governed external runtime records keep their own contract.
+    const envelope = application && rec.governed ? readAliasedRecordEntry(rec.session) : null;
+    const canonicalMetadataOnly = envelope?.kind === 'ok' && rec.governed && !!application;
+    const lifecycle = { status: rawLifecycleStatus(rec), proposal: rec.proposal, note: rec.note, parent: rec.parent };
+    // A queued legacy envelope may still carry its lease until this metadata rewrite. The lease is an
+    // operational launch claim, not a lifecycle fact, so preserve only that field while the typed record clears it.
+    const envelopeLaunchOwner = envelope?.kind === 'ok'
+        ? envelope.raw.launch_owner?.trim() || null
+        : null;
     let previous = null;
     try {
         previous = readRecord(rec.session);
     }
     catch { /* a new or damaged record has no prior transition */ }
+    const metadataChanged = !previous || [
+        'governed', 'worktreePath', 'branch', 'node', 'title', 'name', 'merges', 'sortKey', 'createdAt',
+        'harness', 'harnessSessionId', 'runtimeStartToken', 'stopped', 'archived', 'closedAt', 'coldProof',
+        'adapterRecovery', 'launcher', 'launchCmd', 'launchOwner', 'launchReadinessStartedAt', 'createRequestId',
+        'createPayloadHash', 'zcodeChildSessionIds', 'base', 'forkCommit', 'diffComments', 'launchReadinessPending',
+    ].some((key) => JSON.stringify(previous[key]) !== JSON.stringify(rec[key]));
+    // Once a canonical row exists, a lifecycle-only write is already complete when the application transition
+    // commits. Rewriting runtime.json here would recreate a second, stale status/proposal/note authority.
+    if (canonicalMetadataOnly && previous && !metadataChanged)
+        return;
     const obj = {
         session_id: rec.session,
         governed: rec.governed,
@@ -406,28 +487,37 @@ function writeRecord(rec) {
         node: rec.node ?? '',
         title: rec.title ?? '',
         name: rec.name ?? '',
-        parent: rec.parent ?? '',
-        status: rawLifecycleStatus(rec),
-        proposal: rec.proposal ?? '',
         merges: rec.merges,
-        note: rec.note ?? '',
         sortkey: rec.sortKey ?? '',
         createdAt: rec.createdAt,
         harness: rec.harness || 'claude',
         harness_session_id: rec.harnessSessionId ?? '',
         stopped: rec.stopped,
         archived: rec.archived,
+        // Pre-field records stay byte-shape compatible until a real close publishes the timestamp. In particular,
+        // a failed resume must be able to restore an old working record without inventing an empty metadata key.
+        ...(rec.closedAt ? { closed_at: rec.closedAt } : {}),
         cold_proof: rec.coldProof ?? '',
         adapter_recovery: rec.adapterRecovery ?? '',
         launcher: rec.launcher ?? '',
         launch_cmd: rec.launchCmd ?? '',
-        launch_owner: rec.status === 'queued' ? rec.launchOwner ?? '' : '',
+        launch_owner: (lifecycle.status === 'queued' || lifecycle.status === OWNED_QUEUE_RAW_STATUS)
+            ? rec.launchOwner ?? envelopeLaunchOwner ?? '' : '',
+        ...(rec.launchReadinessStartedAt ? { launch_readiness_started_at: rec.launchReadinessStartedAt } : {}),
+        ...(rec.runtimeStartToken ? { runtime_start_token: rec.runtimeStartToken } : {}),
         create_request_id: rec.createRequestId ?? '',
         create_payload_hash: rec.createPayloadHash ?? '',
         ...(rec.zcodeChildSessionIds?.length ? { zcode_child_session_ids: rec.zcodeChildSessionIds } : {}),
         // Written only when the creator pinned one: an unpinned record keeps its exact legacy bytes, so a
         // restore-the-frozen-record path stays byte-identical instead of silently gaining a key.
         ...(rec.base ? { base: rec.base } : {}),
+        // The commit `git worktree add` actually started from, written on every create since it was introduced.
+        // Conditional like `base` above, so a record written before it keeps its exact legacy bytes.
+        ...(rec.forkCommit ? { fork_commit: rec.forkCommit } : {}),
+        ...((rec.diffComments ?? []).length ? { diff_comments: (rec.diffComments ?? []).map((comment) => ({
+                id: comment.id, file_path: comment.filePath, line_start: comment.lineStart, line_end: comment.lineEnd,
+                body: comment.body, diff_identity: comment.diffIdentity, sent_at: comment.sentAt,
+            })) } : {}),
         launch_readiness_pending: rec.launchReadinessPending ? {
             version: 1,
             startedAt: rec.launchReadinessPending.startedAt,
@@ -437,104 +527,62 @@ function writeRecord(rec) {
                 note: rec.launchReadinessPending.original.note ?? '',
                 stopped: rec.launchReadinessPending.original.stopped,
                 archived: rec.launchReadinessPending.original.archived,
+                closed_at: rec.launchReadinessPending.original.closedAt,
                 cold_proof: rec.launchReadinessPending.original.coldProof ?? '',
                 adapter_recovery: rec.launchReadinessPending.original.adapterRecovery ?? '',
             },
         } : '',
+        ...(canonicalMetadataOnly ? {} : {
+            parent: lifecycle.parent ?? '',
+            status: lifecycle.status,
+            proposal: lifecycle.proposal ?? '',
+            note: lifecycle.note ?? '',
+        }),
     };
     const dir = sessionStoreDir(rec.session);
     mkdirSync(dir, { recursive: true });
     const path = sessionRecordPath(rec.session);
-    const tmp = join(dir, `.session.json.${process.pid}.tmp`);
+    const tmp = join(dir, `.runtime.json.${process.pid}.tmp`);
     writeFileSync(tmp, JSON.stringify(obj, null, 2) + '\n');
     renameSync(tmp, path); // atomic within the dir: a concurrent reader sees the old record or the new one
     const previousPublic = previous ? publicRecord(previous) : null;
     const nextPublic = publicRecord(rec);
-    if (rec.governed && previousPublic && (previousPublic.status !== nextPublic.status
+    if (!application && rec.governed && previousPublic && (previousPublic.status !== nextPublic.status
         || previousPublic.proposal !== nextPublic.proposal || previousPublic.note !== nextPublic.note)) {
         recordStatus(rec.session, nextPublic.status, nextPublic.proposal, nextPublic.note);
         scheduleWatchNotifications(rec);
     }
 }
-const watchPath = (target) => sessionArtifactPath(target, 'watchers.json');
-function readWatchEntries(target) {
-    try {
-        const raw = JSON.parse(readFileSync(watchPath(target), 'utf8'));
-        if (!Array.isArray(raw))
-            return [];
-        const parent = readRecord(target)?.parent ?? '';
-        const seen = new Set();
-        return raw.flatMap((entry) => {
-            if (!entry || typeof entry !== 'object')
-                return [];
-            const watcher = entry.watcher;
-            const createdAt = entry.createdAt;
-            if (!watcher || typeof watcher !== 'string' || typeof createdAt !== 'string' || seen.has(watcher))
-                return [];
-            seen.add(watcher);
-            const rawSources = entry.sources;
-            const sources = Array.isArray(rawSources)
-                ? [...new Set(rawSources.filter((source) => source === 'manual' || source === 'parent'))]
-                // The former one-source format cannot name an origin. Its child pointer is the only durable witness
-                // that this watcher was installed for parent supervision; every other legacy row is a manual watch.
-                : [watcher === parent ? 'parent' : 'manual'];
-            const snapshotPending = entry.snapshotPending;
-            return sources.length ? [{ watcher, createdAt, sources,
-                    ...(sources.includes('parent') && typeof snapshotPending === 'string' && snapshotPending ? { snapshotPending } : {}),
-                }] : [];
-        });
-    }
-    catch {
+function canonicalWatchEntries(target) {
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        return null;
+    if (!application.readState(target))
         return [];
-    }
-}
-function writeWatchEntries(target, entries) {
-    const path = watchPath(target);
-    if (!entries.length) {
-        try {
-            unlinkSync(path);
+    const seen = new Map();
+    for (const edge of application.topology.parents(target)) {
+        if (edge.relationType !== 'parent' && !edge.relationType.startsWith('watch'))
+            continue;
+        const source = edge.relationType === 'parent' || edge.relationType === 'watch:parent' ? 'parent' : 'manual';
+        const current = seen.get(edge.fromSessionId);
+        if (current) {
+            if (!current.sources.includes(source))
+                current.sources.push(source);
+            continue;
         }
-        catch { /* already absent */ }
-        ;
-        return;
+        seen.set(edge.fromSessionId, {
+            watcher: edge.fromSessionId,
+            createdAt: new Date(edge.createdAtMs).toISOString(),
+            sources: [source],
+        });
     }
-    const dir = sessionStoreDir(target);
-    mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `.watchers.json.${process.pid}.tmp`);
-    writeFileSync(tmp, JSON.stringify(entries, null, 2) + '\n');
-    renameSync(tmp, path);
-}
-function addWatchSource(entries, watcher, source, deferInitialSnapshot = false) {
-    const existing = entries.find((entry) => entry.watcher === watcher);
-    const snapshotPending = deferInitialSnapshot && !existing?.sources.includes('manual') ? randomUUID() : undefined;
-    if (!existing)
-        return { entries: [...entries, {
-                    watcher, createdAt: new Date().toISOString(), sources: [source], ...(snapshotPending ? { snapshotPending } : {}),
-                }], added: true };
-    if (existing.sources.includes(source))
-        return { entries, added: false };
-    return {
-        entries: entries.map((entry) => entry === existing ? {
-            ...entry, sources: [...entry.sources, source], ...(snapshotPending ? { snapshotPending } : {}),
-        } : entry),
-        added: true,
-    };
+    return [...seen.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.watcher.localeCompare(b.watcher));
 }
-function removeWatchSource(entries, watcher, source) {
-    let removed = false;
-    const next = entries.flatMap((entry) => {
-        if (entry.watcher !== watcher || !entry.sources.includes(source))
-            return [entry];
-        removed = true;
-        const sources = entry.sources.filter((candidate) => candidate !== source);
-        if (!sources.length)
-            return [];
-        if (source !== 'parent')
-            return [{ ...entry, sources }];
-        const { snapshotPending: _pending, ...withoutParentDebt } = entry;
-        return [{ ...withoutParentDebt, sources }];
-    });
-    return { entries: next, removed };
+function readWatchEntries(target) {
+    const canonical = canonicalWatchEntries(target);
+    if (canonical)
+        return canonical;
+    throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
 }
 function managedWatchRecord(id) {
     const rec = readRecord(id);
@@ -544,7 +592,7 @@ function managedWatchRecord(id) {
 }
 function watchMessage(target) {
     const status = target.status === 'awaiting'
-        ? PROPOSAL_STATUS[target.proposal ?? 'nothing']
+        ? displayStatusForProposal(target.proposal)
         : target.status === 'active' ? 'working' : target.status;
     const note = target.note ? ` — ${target.note}` : '';
     return `[spex watch] ${target.session} is ${status}${note}`;
@@ -555,180 +603,81 @@ function shouldDeliverWatchTransition(target, sources) {
 }
 function scheduleWatchNotifications(target) {
     const watchers = readWatchEntries(target.session)
-        .filter((entry) => !entry.snapshotPending && shouldDeliverWatchTransition(target, entry.sources))
+        .filter((entry) => shouldDeliverWatchTransition(target, entry.sources))
         .map((entry) => entry.watcher);
     if (!watchers.length)
         return;
     queueMicrotask(() => {
         for (const watcher of watchers) {
-            void sendText(watcher, watchMessage(target), target.session).then((result) => {
+            void sendText(watcher, watchMessage(target), target.session, { allowStranded: true }).then((result) => {
                 if (!result.ok)
                     console.error(`spex session watch: could not deliver ${target.session} state to ${watcher}: ${result.error}`);
             });
         }
     });
 }
-const watchSnapshotState = (target) => JSON.stringify([target.status, target.proposal, target.note]);
-async function deliverPendingWatchSnapshots(targetId, forceCurrent = true) {
-    const pending = readWatchEntries(targetId).filter((entry) => entry.snapshotPending);
-    for (const original of pending) {
-        const token = original.snapshotPending;
-        let force = forceCurrent;
-        for (;;) {
-            const target = readRecord(targetId);
-            const entry = readWatchEntries(targetId)
-                .find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
-            if (!target || !entry)
-                break;
-            const state = watchSnapshotState(target);
-            const shouldDeliver = force || shouldDeliverWatchTransition(target, entry.sources);
-            if (!shouldDeliver) {
-                let settled = false;
-                await withRecordLock(targetId, async () => {
-                    const current = readRecord(targetId);
-                    const entries = readWatchEntries(targetId);
-                    const pendingEntry = entries.find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
-                    if (!current || !pendingEntry || watchSnapshotState(current) !== state)
-                        return;
-                    const next = entries.map((candidate) => {
-                        if (candidate !== pendingEntry)
-                            return candidate;
-                        const { snapshotPending: _pending, ...cleared } = candidate;
-                        return cleared;
-                    });
-                    writeWatchEntries(targetId, next);
-                    settled = true;
-                });
-                if (settled)
-                    break;
-                force = false;
-                continue;
-            }
-            const identity = `${targetId}\0${entry.watcher}\0${token}\0${state}`;
-            const delivered = await sendText(entry.watcher, watchMessage(target), targetId, {
-                idempotency: {
-                    operation: 'watch-initial-snapshot',
-                    requestDigest: digest(identity),
-                    payloadHash: digest(`watch-initial-snapshot\0${identity}\0${watchMessage(target)}`),
-                },
-                acceptGuard: async () => {
-                    const current = readRecord(targetId);
-                    const stillPending = readWatchEntries(targetId)
-                        .some((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
-                    if (!current || !stillPending || watchSnapshotState(current) !== state)
-                        throw new ResourceConflict('watch initial snapshot changed before acceptance');
-                },
-            });
-            if (!delivered.ok) {
-                if (delivered.error?.includes('watch initial snapshot changed before acceptance'))
-                    continue;
-                console.error(`spex session watch: could not deliver initial ${targetId} state to ${entry.watcher}: ${delivered.error}`);
-                break;
-            }
-            force = false;
-            let settled = false;
-            await withRecordLock(targetId, async () => {
-                const current = readRecord(targetId);
-                const entries = readWatchEntries(targetId);
-                const pendingEntry = entries.find((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
-                if (!current || !pendingEntry) {
-                    settled = true;
-                    return;
-                }
-                const currentState = watchSnapshotState(current);
-                if (currentState !== state && shouldDeliverWatchTransition(current, pendingEntry.sources))
-                    return;
-                const next = entries.map((candidate) => {
-                    if (candidate !== pendingEntry)
-                        return candidate;
-                    const { snapshotPending: _pending, ...cleared } = candidate;
-                    return cleared;
-                });
-                writeWatchEntries(targetId, next);
-                settled = true;
-            });
-            if (settled)
-                break;
-        }
-    }
-}
-async function clearPendingWatchSnapshots(targetId) {
-    await withRecordLock(targetId, async () => {
-        const entries = readWatchEntries(targetId);
-        const next = entries.map((entry) => {
-            if (!entry.snapshotPending)
-                return entry;
-            const { snapshotPending: _pending, ...settled } = entry;
-            return settled;
-        });
-        if (next.some((entry, index) => entry !== entries[index]))
-            writeWatchEntries(targetId, next);
-    });
-}
 export async function subscribeSessionWatch(watcher, targets, source = 'manual') {
     managedWatchRecord(watcher);
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
     const watched = [];
+    const channel = source === 'parent' ? 'watch:parent' : 'watch:manual';
     for (const target of [...new Set(targets)]) {
         if (target === watcher)
             throw new ResourceConflict('a session cannot watch itself');
-        let targetRecord = null;
-        let added = false;
-        let pending = false;
-        withRecordLockSync(target, () => {
-            targetRecord = managedWatchRecord(target);
-            const entries = readWatchEntries(target);
-            const next = addWatchSource(entries, watcher, source, source === 'parent' && targetRecord.status === 'queued');
-            if (next.added)
-                writeWatchEntries(target, next.entries);
-            added = next.added;
-            pending = next.entries.some((entry) => entry.watcher === watcher && !!entry.snapshotPending);
-        });
-        if (pending) {
-            if (source === 'manual')
-                await deliverPendingWatchSnapshots(target);
+        const targetRecord = managedWatchRecord(target);
+        try {
+            application.attachWatcher(watcher, target, channel);
         }
-        else if (source === 'manual' || added) {
-            const delivered = await sendText(watcher, watchMessage(targetRecord), target);
-            if (!delivered.ok)
-                throw new ResourceConflict(`watch established but could not queue ${target}'s current state for ${watcher}: ${delivered.error}`);
+        catch (error) {
+            if (!(error instanceof Error) || !/already exists|duplicate|active topology edge/i.test(error.message))
+                throw error;
         }
+        const message = watchMessage(targetRecord);
+        application.enqueueMessage(watcher, {
+            kind: 'session.prompt.v1',
+            body: Buffer.from(message, 'utf8'),
+            senderSessionId: target,
+            idempotencyKey: digest(`watch-initial-snapshot\0${watcher}\0${target}\0${source}\0${message}`),
+        });
         watched.push(target);
     }
     return { watched };
 }
 export function listSessionWatches(watcher) {
     managedWatchRecord(watcher);
-    const watches = [];
-    for (const target of listSessionIds()) {
-        const entries = readWatchEntries(target);
-        const active = entries.filter((entry) => {
-            try {
-                return !!readRecord(entry.watcher)?.governed;
-            }
-            catch {
-                return false;
-            }
-        });
-        if (active.length !== entries.length)
-            writeWatchEntries(target, active);
-        for (const entry of active)
-            if (entry.watcher === watcher)
-                watches.push({ target, createdAt: entry.createdAt });
-    }
-    return watches.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.target.localeCompare(b.target));
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
+    // `listWatchers` defaults to the bare `watch` channel. Canonical policy stores the source
+    // (`watch:parent`/`watch:manual`) in the relation type, so listing must inspect every watch
+    // channel or a valid parent watch appears to have disappeared.
+    const edges = ['watch', 'watch:parent', 'watch:manual']
+        .flatMap(channel => application.listWatchers(watcher, channel))
+        .filter((edge, index, all) => all.findIndex(other => other.toSessionId === edge.toSessionId) === index);
+    return edges
+        .map(edge => ({ target: edge.toSessionId, createdAt: new Date(edge.createdAtMs).toISOString() }))
+        .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.target.localeCompare(b.target));
 }
 export function cancelSessionWatch(watcher, targets) {
     managedWatchRecord(watcher);
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
     let cancelled = 0;
     for (const target of [...new Set(targets)]) {
-        withRecordLockSync(target, () => {
-            const entries = readWatchEntries(target);
-            const next = removeWatchSource(entries, watcher, 'manual');
-            if (next.removed) {
-                writeWatchEntries(target, next.entries);
+        for (const channel of ['watch:manual', 'watch']) {
+            try {
+                application.detachWatcher(watcher, target, channel);
                 cancelled++;
+                break;
             }
-        });
+            catch (error) {
+                if (!(error instanceof Error) || !/does not exist|unknown/i.test(error.message))
+                    throw error;
+            }
+        }
     }
     return cancelled;
 }
@@ -762,65 +711,65 @@ function assertReparentable(children, parent, records) {
 }
 export async function reparentSessionRecords(rawChildren, parent) {
     const children = [...new Set(rawChildren)].sort();
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy reparent path');
     const notify = [];
     await withRecordLock('session-reparent-transaction', async () => {
-        // Read former supervisors only after the transaction fence: a concurrent reparent may change exactly
-        // this relation, and its real sender lock is part of the next transaction's outgoing-message boundary.
         const before = new Map(children.map((id) => [id, managedWatchRecord(id)]));
         assertReparentable(children, parent, before);
         const formerParents = [...new Set([...before.values()].flatMap((record) => record.parent ? [record.parent] : []))];
         await withRecordLocks([...children, ...formerParents].sort(), () => withDeliveryLocks(children, async () => {
             const current = new Map(children.map((id) => [id, managedWatchRecord(id)]));
             assertReparentable(children, parent, current);
-            const snapshots = children.map((id) => ({ id, record: current.get(id), watchers: readWatchEntries(id), pending: pendingSnapshot(id) }));
-            try {
-                for (const snapshot of snapshots) {
-                    const { record, watchers } = snapshot;
-                    const hadNewParent = !!parent && watchers.some((entry) => entry.watcher === parent && entry.sources.includes('parent'));
-                    const withoutFormerParent = record.parent
-                        ? removeWatchSource(watchers, record.parent, 'parent').entries
-                        : watchers;
-                    const nextWatchers = parent
-                        ? addWatchSource(withoutFormerParent, parent, 'parent').entries
-                        : withoutFormerParent;
-                    if (nextWatchers !== watchers)
-                        writeWatchEntries(snapshot.id, nextWatchers);
-                    if (record.parent !== parent)
-                        writeRecord({ ...record, parent });
-                    if (parent && (record.parent !== parent || !hadNewParent))
-                        notify.push({ ...record, parent });
-                }
-                for (const snapshot of snapshots) {
-                    if (snapshot.record.parent && snapshot.record.parent !== parent)
-                        revokePendingFromWhileLocked(snapshot.id, snapshot.record.parent);
+            for (const [id, record] of current) {
+                const state = application.readState(id);
+                if (!state)
+                    throw new ResourceConflict(`session ${id} has no canonical application state during reparent`);
+                if (state.parentSessionId !== record.parent) {
+                    throw new ResourceConflict(`session ${id} canonical/record parent mismatch: record=${record.parent ?? 'null'} canonical=${state.parentSessionId ?? 'null'}`);
                 }
             }
-            catch (error) {
-                let rollbackFailure = null;
-                for (const snapshot of [...snapshots].reverse()) {
+            for (const [id, record] of current) {
+                if (record.parent === parent)
+                    continue;
+                const change = application.transitionSession(id, { parentSessionId: parent, reason: 'reparent' });
+                if (record.parent) {
+                    try {
+                        application.detachWatcher(record.parent, id, 'watch:parent');
+                    }
+                    catch (error) {
+                        if (!(error instanceof Error) || !/does not exist|unknown/i.test(error.message))
+                            throw error;
+                    }
+                    for (const message of application.readPendingMessages(id)) {
+                        if (message.senderSessionId === record.parent)
+                            application.dequeuePendingMessage(id, message.messageId);
+                    }
+                }
+                if (parent) {
                     try {
-                        replacePendingWhileLocked(snapshot.id, snapshot.pending);
-                        writeWatchEntries(snapshot.id, snapshot.watchers);
-                        writeRecord(snapshot.record);
+                        application.attachWatcher(parent, id, 'watch:parent');
                     }
-                    catch (rollback) {
-                        rollbackFailure ??= rollback;
+                    catch (error) {
+                        if (!(error instanceof Error) || !/already exists|duplicate|active topology edge/i.test(error.message))
+                            throw error;
                     }
+                    // The transition above published to the OLD watcher set. The new supervisor learns the child's current
+                    // state here, keyed by that transition's own event so a retried rewrite never sends it twice.
+                    const moved = { ...record, parent };
+                    application.enqueueMessage(parent, {
+                        kind: 'session.prompt.v1',
+                        body: Buffer.from(watchMessage(moved), 'utf8'),
+                        senderSessionId: id,
+                        idempotencyKey: digest(`reparent-snapshot\0${change.event.eventId}`),
+                    });
+                    notify.push(moved);
                 }
-                const detail = error instanceof Error ? error.message : String(error);
-                const rollbackDetail = rollbackFailure instanceof Error ? `; rollback also failed: ${rollbackFailure.message}` : '';
-                throw new ResourceConflict(`reparent did not commit: ${detail}${rollbackDetail}`);
             }
         }));
     });
-    const notified = [];
-    if (parent)
-        for (const child of notify) {
-            const delivered = await sendText(parent, watchMessage(child), child.session);
-            if (!delivered.ok)
-                throw new ResourceConflict(`reparent committed but could not queue ${child.session}'s current state for ${parent}: ${delivered.error}`);
-            notified.push(child.session);
-        }
+    const notified = notify.map((child) => child.session);
     return { children, parent, notified };
 }
 // tmux rewrites CONTROL characters in a format string before printing them — 3.6a turns both a tab and a raw
@@ -1083,18 +1032,18 @@ export function liveness(rec, snap) {
         return 'unknown';
     return 'offline';
 }
-function reconcile(rec, snap) {
+function reconcile(rec, snap, residentLiveness) {
     // record integrity outranks both axes: a session whose worktree is gone has no work to be in any state
     // about. It reads `retired` — a terminal, human-closable row, never a lifecycle a hook can write back over.
-    if (retirementReason(rec))
-        return 'retired';
     if (rec.archived)
         return 'offline';
+    if (retirementReason(rec))
+        return 'retired';
     if (rec.status === 'awaiting')
-        return PROPOSAL_STATUS[rec.proposal || 'nothing'];
+        return displayStatusForProposal(rec.proposal);
     if (rec.status !== 'active' && rec.status !== 'idle')
         return rec.status; // parked | error | asking | queued (no tmux yet)
-    const lv = liveness(rec, snap);
+    const lv = residentLiveness ?? liveness(rec, snap);
     if (lv !== 'online')
         return lv; // 'offline' | 'starting' | 'unknown'
     return rec.status === 'idle' ? 'idle' : 'working';
@@ -1119,13 +1068,26 @@ export function reviewIdentity(id) {
         label: deriveLabel({ id, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch }),
     };
 }
+export function sessionHookState(id) {
+    const rec = readRecord(id);
+    if (!rec)
+        return null;
+    const application = configuredSessionApplicationIfCutover();
+    const state = application?.readState(id);
+    return {
+        governed: rec.governed,
+        status: (state?.status ?? rec.status),
+        proposal: (state?.proposal || rec.proposal || null),
+        note: state?.note ?? (rec.note || null),
+    };
+}
 function corruptSession(id, entry) {
     const label = `${id.slice(0, 8)} (unreadable record)`;
     return {
         id, node: null, branch: null, path: '', label, title: label, raw: { name: null, title: null },
         parent: null, harness: defaultHarness.id, capabilities: { headless: false }, launcher: null,
         lifecycle: 'active', proposal: null, merges: 0, status: 'corrupt', liveness: 'unknown',
-        note: corruptReason(entry), archived: false, prompt: null, promptPreview: null, created: 0,
+        note: corruptReason(entry), archived: false, closedAt: null, prompt: null, promptPreview: null, created: 0,
         activity: null, sortKey: null, archiveHazard: null, files: [], web: [],
     };
 }
@@ -1138,7 +1100,7 @@ export function toSession(rec, status, lv, activity = null) {
     const pp = prompt ? oneLinePreview(prompt) : null;
     const parts = { id: rec.session, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch, activity: act, note: rec.note, promptPreview: pp };
     const harness = harnessById(rec.harness || defaultHarness.id);
-    return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), title: deriveTitle(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, archived: rec.archived, archiveHazard: null, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey, files: readSessionFiles(rec.session), web: readSessionWebs(rec.session), ...(rec.zcodeChildSessionIds?.length ? { zcodeChildSessionIds: [...rec.zcodeChildSessionIds] } : {}) };
+    return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), title: deriveTitle(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, archived: rec.archived, closedAt: rec.archived ? rec.closedAt : null, archiveHazard: null, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey, files: readSessionFiles(rec.session), web: readSessionWebs(rec.session), ...(rec.zcodeChildSessionIds?.length ? { zcodeChildSessionIds: [...rec.zcodeChildSessionIds] } : {}) };
 }
 // @@@zcode child identity - ZCode owns the child id and SpexCode owns the session record. The writer accepts
 // only their exact declared pair; names, worktrees, branches, and timestamps are deliberately not candidates.
@@ -1197,6 +1159,44 @@ export async function sessionPrompt(id) {
         throw e;
     }
 }
+// The archive overlay has no reader for the session model. Keep this projection separate from listSessions so
+// opening it skips the live tmux census, resident adapter probes, and files/web reads, and carries no full prompt bytes.
+export async function listArchivedSessionIndex(probe) {
+    const rows = [];
+    for (const id of listSessionIds()) {
+        let entry;
+        try {
+            entry = readPublicRecordEntry(id);
+        }
+        catch {
+            continue;
+        }
+        if (entry.kind !== 'ok')
+            continue;
+        const rec = fromRaw(entry.raw);
+        if (!rec.governed || !rec.archived)
+            continue;
+        const parts = {
+            id: rec.session, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch,
+            activity: null, note: rec.note, promptPreview: null,
+        };
+        // Name and note are ahead of the prompt in deriveTitle's precedence. Avoid touching the prompt artifact
+        // unless both are absent; only then can its preview change the visible title.
+        if (!rec.name && !rec.note?.trim()) {
+            probe && (probe.promptReads = (probe.promptReads || 0) + 1);
+            const prompt = readPromptFile(id);
+            parts.promptPreview = prompt ? oneLinePreview(prompt) : null;
+        }
+        rows.push({
+            id: rec.session,
+            title: deriveTitle(parts),
+            label: deriveLabel(parts),
+            closedAt: rec.closedAt,
+            node: rec.node,
+        });
+    }
+    return rows;
+}
 // Preserve rows through a transient record-read failure; prune after the store entry disappears.
 const lastKnownSession = new Map();
 // A BOARD row carries the launch ask only as its one-line preview. The full text is served by the
@@ -1222,9 +1222,23 @@ export async function listSessions(includeArchived = false) {
         }
         catch { /* guardSession below preserves the last-known row for a transient read failure */ }
     }
-    // Only archived adapter records need the resident-ID join. If there are none, this read path performs zero
-    // control-plane probes; resources still owns the full turn/read probe for its detailed report.
-    const censusRecords = [...snapshots.values()].flatMap(({ entry, rec }) => entry.kind === 'ok' && entry.liveness === null && rec && rec.governed && rec.archived && rec.harnessSessionId
+    const canonical = configuredSessionApplicationIfCutover();
+    const canonicalStates = new Map();
+    if (canonical) {
+        for (const [id, snapshot] of snapshots) {
+            if (!snapshot.rec?.governed)
+                continue;
+            const state = canonical.readState(id);
+            if (!state)
+                throw new ResourceConflict(`session ${id} has no canonical application state after JSON cutover`);
+            canonicalStates.set(id, state);
+        }
+    }
+    // Adapter-owned records have no pane witness. Join one project-wide resident-ID census to every exact
+    // bound target, including live rows; otherwise a dead shared app-server could leave a stale headless record
+    // online indefinitely. The descriptor probe remains one-per-generation, not one RPC per session.
+    const censusRecords = [...snapshots.values()].flatMap(({ entry, rec }) => entry.kind === 'ok' && rec && rec.governed
+        && rec.harnessSessionId && harnessById(rec.harness || defaultHarness.id).runtimeOwnership === 'adapter'
         ? [{ ...rec, harness: rec.harness || defaultHarness.id }]
         : []);
     const residentCensus = censusRecords.length ? await adapterLoadedReferenceState(censusRecords) : new Map();
@@ -1263,35 +1277,43 @@ export async function listSessions(includeArchived = false) {
             lastKnownSession.delete(id);
             return null;
         } // no record, or a self-launched (non-board) one
+        const projectedRecord = canonicalRecordProjection(rec, canonicalStates.get(id));
         // A forced public liveness comes only from the shared record projection. Do not let live process/thread
         // evidence punch through it (including archive hazard repair).
         if (entry.kind === 'ok' && entry.liveness === 'offline') {
-            const pending = boardRow(toSession(rec, 'offline', 'offline'));
+            const pending = boardRow(toSession(projectedRecord, 'offline', 'offline'));
             lastKnownSession.set(id, pending);
             return pending;
         }
         // the pane title → headline activity, gated by THIS session's harness ([[harness-adapter]]): claude's title
         // is its task self-summary (used); codex's is the cwd folder name (refused → headline falls to the prompt).
         const activity = paneActivity(harnessById(rec.harness || defaultHarness.id), snap.titles.get(id));
-        const sessionHarness = harnessById(rec.harness || defaultHarness.id);
-        const resident = rec.harnessSessionId
-            ? residentCensus.get(`${rec.harness || defaultHarness.id}:${rec.harnessSessionId}`)
+        const sessionHarness = harnessById(projectedRecord.harness || defaultHarness.id);
+        const resident = projectedRecord.harnessSessionId
+            ? residentCensus.get(`${projectedRecord.harness || defaultHarness.id}:${projectedRecord.harnessSessionId}`)
             : undefined;
-        const residentRequired = sessionHarness.runtimeOwnership === 'adapter' && !!rec.harnessSessionId && !!sessionHarness.sharedRuntimes?.(runtimeRoot()).length;
-        const physical = rec.archived
+        const residentRequired = sessionHarness.runtimeOwnership === 'adapter' && !!projectedRecord.harnessSessionId && !!sessionHarness.sharedRuntimes?.(runtimeRoot()).length;
+        const physical = projectedRecord.archived
             ? (sessionHarness.runtimeOwnership === 'adapter'
                 ? (resident && !resident.healthy ? 'unknown' : resident?.loaded ? 'online' : snap.windows.has(id) ? 'online' : 'offline')
-                : liveness({ ...rec, archived: false, stopped: false }, snap))
+                : liveness({ ...projectedRecord, archived: false, stopped: false }, snap))
             : null;
         // Only a physically-offline record projects as archived. A legacy archived+live/unknown record is exposed
         // as ordinary working-set state with its real liveness/status and one backend-owned hazard marker. A
         // missing durable cold proof is also legacy: leaf liveness alone cannot prove a Codex loaded thread was
         // unloaded, so it remains visible until an explicit archive repair.
-        const cleanCold = rec.archived && !changedDuringCensus.has(id) && hasValidColdProof(rec) && physical === 'offline' && (!residentRequired || resident?.healthy === true);
-        const projected = rec.archived && !cleanCold ? { ...rec, archived: false, stopped: false } : rec;
-        const projectedLv = projected === rec ? liveness(rec, snap) : physical;
-        const s = boardRow(toSession(projected, reconcile(projected, snap), projectedLv, activity));
-        if (projected !== rec)
+        const cleanCold = projectedRecord.archived && !changedDuringCensus.has(id) && hasValidColdProof(projectedRecord) && physical === 'offline' && (!residentRequired || resident?.healthy === true);
+        const projected = projectedRecord.archived && !cleanCold ? { ...projectedRecord, archived: false, stopped: false } : projectedRecord;
+        const projectedLv = projected === projectedRecord
+            ? sessionHarness.runtimeOwnership === 'adapter'
+                ? adapterResidentLiveness(projectedRecord, resident)
+                : liveness(projectedRecord, snap)
+            : physical;
+        const s = boardRow(toSession(projected, reconcile(projected, snap, projectedLv), projectedLv, activity));
+        // Canonical projection deliberately creates a fresh object for every governed row. That identity change is not
+        // an archive failure: a hazard belongs only to a record that was actually archived and then had its cold proof
+        // rejected. Otherwise every live row would inherit the missing-cold-witness message after cutover.
+        if (projectedRecord.archived && !cleanCold)
             s.archiveHazard = changedDuringCensus.has(id)
                 ? 'archived runtime hazard: record changed while adapter residency was being reconciled; retry exact archive'
                 : hasValidColdProof(rec)
@@ -1308,7 +1330,7 @@ export async function listSessions(includeArchived = false) {
         lastKnownSession.set(id, s);
         return s;
     }, () => {
-        // DEGRADED: the record dir still exists but reading session.json failed transiently. NEVER drop a live
+        // DEGRADED: the record dir still exists but reading runtime.json failed transiently. NEVER drop a live
         // session — serve its last-known row. (No last-known means a first sighting raced a failure; nothing to
         // show yet, and it reappears on the next build.)
         return lastKnownSession.get(id) ?? null;
@@ -1552,6 +1574,10 @@ export function launchPreflight(rec) {
 }
 // @@@ launch quoting - single-quote a string for a POSIX shell, `'` → `'\''`. Used to nest the whole agent
 // invocation inside the birth-registration `sh -c '…'` wrapper without any segment double-expanding.
+// 后端把这条命令输入交互式 shell，脚本路径必须作为一个 shell 参数传递。
+export function launchShellCommand(file) {
+    return `bash ${shQuote(file)}`;
+}
 export function launchScript(id, tail, harness = HARNESS, cmd) {
     const file = join(storeDir(id), 'launch.sh');
     // NO --append-system-prompt / --settings: the contract + hooks are materialized into the worktree at
@@ -1559,7 +1585,7 @@ export function launchScript(id, tail, harness = HARNESS, cmd) {
     // agent. The launch line is just the rendezvous env + the harness command + the session-id/spec-pointer/prompt tail.
     // `cmd` is the session's persisted launcher command ([[launcher-select]]); when set it OVERRIDES the harness's
     // ambient default so resume reuses the same auth. Undefined is only for old records before launch_cmd existed.
-    const invocation = `${rvEnv(id, harness)} ${harness.launchCmd(id, runtimeRoot(), cmd)} ${tail}`;
+    const invocation = `${rvEnv(id, harness, readRecord(id)?.runtimeStartToken)} ${harness.launchCmd(id, runtimeRoot(), cmd)} ${tail}`;
     // @@@ birth registration - record the AGENT's real pid BEFORE exec, the anchor of the 100ms hot death tier
     // ([[state]]). Each attempt runs `sh -c '<pid-write>; exec env <invocation>'`: the sh writes its own `$$` to
     // agent.pid, then `exec env` REPLACES that sh in place — so the pid persists down the whole command chain
@@ -1613,7 +1639,7 @@ export function launchScript(id, tail, harness = HARNESS, cmd) {
             // -t "$TMUX_PANE" names THIS pane explicitly (tmux still resolves the server from $TMUX), so the capture
             // can never land on a neighbouring pane; run outside tmux the call fails, nothing matches, and the plain
             // bounded retry stands.
-            `  if tmux capture-pane -p -S -400 -t "\${TMUX_PANE:-}" 2>/dev/null | sed -n "/$__spex_mark/,\\$p" | grep -Eq ${shQuote(fatal)}; then`,
+            `  if tmux capture-pane -p -S -400 -t "\${TMUX_PANE:-.}" 2>/dev/null | sed -n "/$__spex_mark/,\\$p" | grep -Eq ${shQuote(fatal)}; then`,
             `    printf '[spex launch] attempt %s exited in %ss (rc=%s) - the launcher reported a failure retrying cannot fix (see above); not retrying\\n' "$__spex_try" "$(( SECONDS - __spex_t0 ))" "$__spex_rc" >&2`,
             `    exit $__spex_rc`,
             `  fi`,
@@ -1634,7 +1660,8 @@ async function launch(id, path, tail, harness = HARNESS, cmd) {
     if (harness.ownsRendezvous)
         stampRvSock(id);
     await tmux(['new-session', '-d', '-s', id, '-x', String(COLS), '-y', String(ROWS), '-c', path]);
-    await tmux(['send-keys', '-t', id, '-l', '--', `bash ${launchScript(id, tail, harness, cmd)}`]);
+    const file = launchScript(id, tail, harness, cmd);
+    await tmux(['send-keys', '-t', id, '-l', '--', launchShellCommand(file)]);
     await tmux(['send-keys', '-t', id, 'Enter']);
     launchedAt.set(id, Date.now()); // stamp the boot window so reconcile reads 'starting', not 'offline', until the socket is up
 }
@@ -1642,10 +1669,9 @@ const OCCUPIES_SLOT = new Set(['working', 'parked', 'starting']); // starting's
 function isOccupying(s, snap) {
     if (!OCCUPIES_SLOT.has(s.status))
         return false; // waiting-on-human / proposed / queued / dead → free
-    const rec = readRecord(s.id);
-    if (!rec)
-        return false;
-    return harnessById(rec.harness || defaultHarness.id).liveness(rec, snap.windows.has(rec.session), runtimeRoot(), snap.windows.get(rec.session), snap.sockets.has(rec.session)) === 'online';
+    // `listSessions` already joined the adapter resident census and projected the resulting liveness. Re-reading
+    // the harness here would resurrect the old record-backed codex-headless shortcut and disagree with the row.
+    return s.liveness === 'online';
 }
 // sessions we've JUST launched whose agent hasn't come online yet. During that boot window reconcile reads them
 // `offline` (the adapter's online-signal not up yet) and isOccupying would miss them, so the drainer would
@@ -1675,23 +1701,167 @@ async function withSessionTransition(id, body) {
     }
 }
 let draining = false; // re-entrancy guard: only one drain pass runs at a time (no double-launch)
-function noteQueuedLaunchFailureUnlocked(id, error) {
+// A native receipt is bound before the readiness fence validates it. Suppress only that immediate wake so
+// queued prompts cannot drain during the candidate window; the successful publication path drains normally.
+const readinessWakeSuppressed = new Set();
+function noteQueuedLaunchFailureUnlocked(id, error, terminal = true, label, live = false) {
     const reason = error instanceof Error ? error.message : String(error);
-    const note = `queued launch readiness failed: ${reason}`;
+    const note = `${label ?? (terminal ? 'queued launch readiness failed' : 'launch readiness warning')}: ${reason}`;
     console.error(`spex: session ${id}: ${note}`);
     const rec = readRecord(id);
-    if (rec && rec.note !== note)
-        writeRecord({ ...rec, note });
+    if (rec && !retirementReason(rec) && (rec.note !== note
+        || (terminal && (rec.status !== 'error' || !rec.stopped || rec.launchReadinessStartedAt != null))
+        || (!terminal && live && (rec.status === 'error' || rec.stopped)))) {
+        // Readiness failure is terminal for this launch attempt. Keep the exact reason on the record,
+        // publish an offline/error transition, and clear every durable/in-memory ownership marker so close
+        // and a later explicit resume have an honest starting point.
+        if (terminal) {
+            publishCanonicalLifecycle(rec, 'error', null, note);
+            writeRecord({ ...rec, status: 'error', proposal: null, stopped: true, note, launchOwner: null, launchReadinessStartedAt: null });
+        }
+        else {
+            const status = live && (rec.status === 'error' || rec.stopped) ? 'active' : rec.status;
+            const stopped = live ? false : rec.stopped;
+            const restored = { ...rec, status, stopped, note, launchOwner: null, launchReadinessStartedAt: null };
+            // A live post-receipt timeout is a diagnostic, not a new parent-watch transition. If an older failed
+            // attempt already published `error`, however, the canonical row must be repaired to the live status or
+            // the JSON write below would leave the sole lifecycle authority disagreeing with the runtime witness.
+            // Publish even when status is unchanged: the warning note is canonical too. Active recipients exclude
+            // the parent, so this diagnostic cannot manufacture a parent-watch transition.
+            publishCanonicalLifecycle(restored, status, restored.proposal, note);
+            writeRecord(restored);
+        }
+    }
 }
-function observeQueuedLaunchReadiness(id, harness) {
-    void waitForReady(id, harness)
+function clearReadinessResidueUnlocked(rec, clearDiagnostic) {
+    const application = configuredSessionApplicationIfCutover();
+    const next = {
+        ...rec,
+        status: 'active',
+        stopped: false,
+        note: clearDiagnostic ? null : rec.note,
+        launchReadinessStartedAt: null,
+    };
+    if (application?.readState(rec.session) && (clearDiagnostic || rec.status !== 'active' || rec.stopped)) {
+        application.transitionSession(rec.session, {
+            status: 'active',
+            proposal: rec.proposal,
+            note: next.note,
+            parentSessionId: rec.parent,
+            recipientSessionIds: [],
+        });
+    }
+    writeRecord(next);
+}
+export function canonicalWatchRecipients(application, sessionId, status) {
+    const recipients = new Set();
+    for (const edge of application.topology.parents(sessionId)) {
+        // The canonical topology stores the structural parent edge as the durable parent-watch source. Older
+        // migrated rows may also have an explicit watch:parent edge; both represent the same policy source.
+        if (edge.relationType !== 'parent' && !edge.relationType.startsWith('watch'))
+            continue;
+        if (status === 'active' && (edge.relationType === 'parent' || edge.relationType === 'watch:parent'))
+            continue;
+        recipients.add(edge.fromSessionId);
+    }
+    return [...recipients];
+}
+export function sessionHasPendingDelivery(id, application = configuredSessionApplicationIfCutover() ?? null) {
+    if (!application)
+        throw new ResourceConflict(`session application is unavailable for ${id}`);
+    const runtime = application.resolveRuntime?.(id, 'spex-governed');
+    if (runtime === null)
+        return false;
+    try {
+        return application.readPendingMessages(id).length > 0;
+    }
+    catch (error) {
+        // A legacy record can outlive its migrated protocol address. It has no canonical queue to drain;
+        // treating that address as owed makes the supervisor retry the same impossible lookup forever.
+        if (error?.code === 'PROTOCOL_SESSION_UNKNOWN'
+            || /unknown protocol address/i.test(error instanceof Error ? error.message : String(error)))
+            return false;
+        throw error;
+    }
+}
+export function canonicalRecordProjection(rec, canonical) {
+    // The application row is the only lifecycle fact after cutover. A JSON status is historical envelope data,
+    // so it must not win merely because it says waiting/error/archived while the canonical row says otherwise.
+    if (!canonical) {
+        return rec;
+    }
+    return {
+        ...rec,
+        status: canonical.status,
+        proposal: canonical.proposal,
+        note: canonical.note,
+        parent: canonical.parentSessionId,
+    };
+}
+function publishCanonicalLifecycle(rec, status, proposal, note) {
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        return;
+    if (!application.readState(rec.session)) {
+        application.createSession({ sessionId: rec.session, status, proposal, note, parentSessionId: rec.parent });
+        if (rec.parent)
+            application.attachWatcher(rec.parent, rec.session, 'watch:parent');
+        return;
+    }
+    application.transitionSession(rec.session, {
+        status,
+        proposal,
+        note,
+        parentSessionId: rec.parent,
+        recipientSessionIds: canonicalWatchRecipients(application, rec.session, status),
+    });
+}
+async function launchReadinessWitnessAlive(id, harness, current) {
+    if (harness.runtimeOwnership === 'adapter') {
+        const state = await adapterRuntimeLiveness({ ...current, stopped: false, archived: false });
+        return state === 'online';
+    }
+    if (agentAlive(id) === true)
+        return true;
+    try {
+        const snap = await liveSnapshot(id);
+        return harness.liveness(current, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online';
+    }
+    catch {
+        return false;
+    }
+}
+export function adapterResidentLiveness(rec, resident) {
+    if (rec.stopped || rec.archived)
+        return 'offline';
+    if (!rec.harnessSessionId)
+        return 'offline';
+    if (!resident)
+        return 'unknown';
+    if (!resident.healthy)
+        return 'unknown';
+    return resident.loaded ? 'online' : 'offline';
+}
+async function adapterRuntimeLiveness(rec) {
+    if (rec.stopped || rec.archived)
+        return 'offline';
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (harness.runtimeOwnership !== 'adapter')
+        return liveness(rec, await liveSnapshot());
+    if (!rec.harnessSessionId)
+        return 'offline';
+    const states = await adapterLoadedReferenceState([{ ...rec, harness: harness.id }], runtimeRoot());
+    return adapterResidentLiveness(rec, states.get(`${harness.id}:${rec.harnessSessionId}`));
+}
+function observeQueuedLaunchReadiness(id, harness, timeoutMs = SOCKET_READY_TIMEOUT_MS) {
+    void waitForReady(id, harness, undefined, timeoutMs)
         .then(async (readiness) => {
         if (!readiness) {
             const committed = !!readRecord(id)?.harnessSessionId;
             throw new ResourceConflict(harness.launchPayloadProof
                 ? committed
-                    ? 'post-proof adapter liveness did not become ready before launch readiness timed out'
-                    : 'native identity and first-turn rollout proof did not arrive before launch readiness timed out'
+                    ? 'post-receipt adapter liveness did not become ready before launch readiness timed out'
+                    : 'native identity and first-turn rollout receipt did not arrive before launch readiness timed out'
                 : 'adapter liveness did not become ready before launch readiness timed out');
         }
         let readyToPublish = false;
@@ -1708,23 +1878,35 @@ function observeQueuedLaunchReadiness(id, harness) {
             const current = readRecord(id);
             if (!current)
                 return;
-            if (current.status === 'queued')
-                writeRecord({ ...current, status: 'active', proposal: null, note: null, launchOwner: null });
+            if (current.status === 'queued') {
+                publishCanonicalLifecycle(current, 'active', null, null);
+                writeRecord({ ...current, status: 'active', proposal: null, note: null, launchOwner: null, launchReadinessStartedAt: null });
+            }
+            else if (current.launchReadinessStartedAt != null)
+                writeRecord({ ...current, launchReadinessStartedAt: null });
             readyToPublish = true;
         });
         if (!readyToPublish)
             return;
-        await deliverPendingWatchSnapshots(id);
         await drainSession(id);
     })
         .catch(async (error) => {
+        const reason = error instanceof Error ? error.message : String(error);
+        const timedOut = /timed out|did not become ready/i.test(reason);
+        let live = false;
+        let terminal = timedOut;
         try {
-            await withRecordLock(id, async () => noteQueuedLaunchFailureUnlocked(id, error));
+            await withRecordLock(id, async () => {
+                const current = readRecord(id);
+                if (timedOut && current)
+                    live = await launchReadinessWitnessAlive(id, harness, current);
+                terminal = timedOut && !live;
+                noteQueuedLaunchFailureUnlocked(id, error, terminal, live ? 'launch readiness warning' : undefined, live);
+            });
         }
         catch (recordError) {
-            console.error(`spex: session ${id}: queued launch failure could not be recorded: ${recordError instanceof Error ? recordError.message : String(recordError)}; original failure: ${error instanceof Error ? error.message : String(error)}`);
+            console.error(`spex: session ${id}: queued launch failure could not be recorded: ${recordError instanceof Error ? recordError.message : String(recordError)}; original failure: ${reason}`);
         }
-        await clearPendingWatchSnapshots(id);
     })
         .finally(() => launching.delete(id));
 }
@@ -1743,7 +1925,7 @@ async function startQueuedUnlocked(id) {
     if (!canDrainQueued(wt.rec))
         return 'retryable';
     const h = harnessById(wt.rec.harness || defaultHarness.id);
-    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+    if (h.launchPayloadProof && hasReadableLaunchReceipt(id)) {
         launching.add(id);
         let readinessOwnsSlot = false;
         try {
@@ -1751,11 +1933,13 @@ async function startQueuedUnlocked(id) {
                 consumeHarnessLaunchProofUnlocked(id);
             }
             catch (error) {
-                noteQueuedLaunchFailureUnlocked(id, error);
+                noteQueuedLaunchFailureUnlocked(id, error, false);
                 throw error;
             }
             const recovered = readRecord(id) || wt.rec;
-            writeRecord({ ...recovered, status: 'active', proposal: null, note: null, launchOwner: null });
+            const readinessStartedAt = Date.now();
+            publishCanonicalLifecycle(recovered, 'active', null, null);
+            writeRecord({ ...recovered, status: 'active', proposal: null, note: null, launchOwner: null, launchReadinessStartedAt: readinessStartedAt });
             observeQueuedLaunchReadiness(id, h);
             readinessOwnsSlot = true;
             return 'started';
@@ -1788,11 +1972,17 @@ async function startQueuedUnlocked(id) {
     launching.add(id); // hold the slot across the boot window BEFORE we launch, so a concurrent count can't race us
     let readinessOwnsSlot = false;
     try {
+        const readinessStartedAt = Date.now();
+        const stamped = readRecord(id) || wt.rec;
+        writeRecord({ ...stamped, launchReadinessStartedAt: readinessStartedAt });
         try {
             const sq = shQuote(launchPrompt);
             await launch(id, wt.path, `${h.sessionIdArg(id)} ${sq}`.trim(), h, launcherCmd(wt.rec));
         }
         catch {
+            const failedLaunch = readRecord(id);
+            if (failedLaunch)
+                writeRecord({ ...failedLaunch, launchReadinessStartedAt: null });
             return 'retryable'; // launch failed → stays `queued`, with its initial debt, for the next drain tick
         }
         // the note this record may carry is the QUEUED state's word (a launch-blocker message stamped above); the
@@ -1800,7 +1990,8 @@ async function startQueuedUnlocked(id) {
         // belongs to the state currently declared" true for every writer — the invariant [[session-label]]'s
         // headline precedence stands on.
         const launched = readRecord(id) || wt.rec;
-        writeRecord({ ...launched, status: 'active', proposal: null, note: null, launchOwner: null });
+        publishCanonicalLifecycle(launched, 'active', null, null);
+        writeRecord({ ...launched, status: 'active', proposal: null, note: null, launchOwner: null, launchReadinessStartedAt: readinessStartedAt });
         if (!h.launchPayloadProof)
             removeLaunchFile(id);
         // release the boot-window hold once the socket is up (then isOccupying takes over) or after the bounded
@@ -1825,16 +2016,60 @@ async function drainQueueUnlocked() {
             const [sessions, snap] = await Promise.all([listSessions(), liveSnapshot()]);
             for (const session of sessions) {
                 const rec = readRecord(session.id);
-                if (!rec || launching.has(session.id) || !readWatchEntries(session.id).some((entry) => entry.snapshotPending))
+                if (!rec || launching.has(session.id))
                     continue;
-                if (rec.status === 'queued')
+                // Older timed-out rows predate the durable readiness timestamp. Reconcile their recorded failure
+                // before any queue/watch work so a backend restart cannot resurrect the old active/limbo projection.
+                if (rec.status !== 'queued' && /^queued launch readiness failed:/.test(rec.note || '')) {
+                    const priorReason = (rec.note || '').replace(/^queued launch readiness failed:\s*/, '') || 'launch readiness timed out';
+                    const harness = harnessById(rec.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, rec);
+                    if (live) {
+                        await withRecordLock(session.id, async () => {
+                            const current = readRecord(session.id);
+                            if (current && !current.archived && !current.stopped)
+                                clearReadinessResidueUnlocked(current, true);
+                        });
+                        continue;
+                    }
+                    await withRecordLock(session.id, async () => noteQueuedLaunchFailureUnlocked(session.id, priorReason, !live, live ? 'launch readiness warning' : undefined, live));
                     continue;
-                if (rec.status === 'active' && !rec.stopped && !rec.archived) {
+                }
+                // A pre-fix active row may still carry the authoritative launch artifact without a timestamp. Its
+                // mtime is the only durable age witness available; seed the new field so the same bounded recovery
+                // rule applies on this and later restarts.
+                if (rec.status === 'active' && !rec.stopped && existsSync(sessionArtifactPath(session.id, 'launch')) && rec.launchReadinessStartedAt == null) {
+                    const harness = harnessById(rec.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, rec);
+                    if (!live) {
+                        let startedAt = Date.now();
+                        try {
+                            startedAt = statSync(sessionArtifactPath(session.id, 'launch')).mtimeMs;
+                        }
+                        catch { /* race: observer below will fail loud */ }
+                        writeRecord({ ...rec, launchReadinessStartedAt: startedAt });
+                    }
+                }
+                const refreshed = readRecord(session.id) || rec;
+                if (refreshed.launchReadinessStartedAt && !refreshed.stopped && !refreshed.archived) {
+                    const harness = harnessById(refreshed.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, refreshed);
+                    if (live) {
+                        await withRecordLock(session.id, async () => {
+                            const current = readRecord(session.id);
+                            if (current && !current.archived && !current.stopped) {
+                                clearReadinessResidueUnlocked(current, /^launch readiness warning:/.test(current.note || ''));
+                            }
+                        });
+                        continue;
+                    }
                     launching.add(session.id);
-                    observeQueuedLaunchReadiness(session.id, harnessById(rec.harness || defaultHarness.id));
+                    const remaining = Math.max(0, SOCKET_READY_TIMEOUT_MS - (Date.now() - refreshed.launchReadinessStartedAt));
+                    observeQueuedLaunchReadiness(session.id, harness, remaining);
                     continue;
                 }
-                await deliverPendingWatchSnapshots(session.id, false);
+                if (rec.status === 'queued')
+                    continue;
             }
             // if the liveness probe FAILED (tmux timing out — the overload condition), occupancy is UNKNOWABLE: every
             // session would read window-less and isOccupying would undercount, so the drainer would OVER-launch and pile
@@ -1844,13 +2079,6 @@ async function drainQueueUnlocked() {
                 break;
             const occupied = sessions.reduce((n, s) => n + (launching.has(s.id) || isOccupying(s, snap) ? 1 : 0), 0);
             if (occupied >= cap) {
-                const authority = backendLaunchAuthority();
-                await Promise.all(sessions.filter((session) => {
-                    if (session.status !== 'queued')
-                        return false;
-                    const rec = readRecord(session.id);
-                    return !!rec && canDrainQueued(rec, authority);
-                }).map((session) => deliverPendingWatchSnapshots(session.id)));
                 break;
             }
             const authority = backendLaunchAuthority();
@@ -1864,8 +2092,6 @@ async function drainQueueUnlocked() {
                 break;
             const started = await startQueued(next.id);
             if (started !== 'started') {
-                if (started === 'blocked')
-                    await clearPendingWatchSnapshots(next.id);
                 break; // launch failed → stop this pass; a later tick retries
             }
         }
@@ -1880,6 +2106,18 @@ const requestQueueDrain = () => {
         console.error(`spex: queue drain failed: ${error instanceof Error ? error.message : String(error)}`);
     });
 };
+// Canonical state commits already own the durable recipient queue. This is only the post-commit wake that hands
+// each queued recipient to its existing runtime; a failed or absent runtime leaves the message pending for retry.
+setSessionApplicationCommitWake((recipients) => {
+    const wakeRecipients = recipients.filter(recipient => !readinessWakeSuppressed.has(recipient));
+    queueMicrotask(() => {
+        for (const recipient of wakeRecipients) {
+            void drainSession(recipient).catch((error) => {
+                console.error(`spex: canonical delivery wake failed for ${recipient}: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+    });
+});
 let supervisingQueue = false;
 export function superviseQueue(intervalMs = 3000) {
     if (supervisingQueue)
@@ -1907,22 +2145,28 @@ export function superviseDelivery(intervalMs = 2000) {
     supervisingDelivery = true;
     const tick = async () => {
         try {
+            const application = configuredSessionApplicationIfCutover();
             for (const id of listSessionIds()) {
-                if (!owesDelivery(id))
+                if (!sessionHasPendingDelivery(id, application))
                     continue;
                 try {
                     await drainSession(id);
                 }
-                catch { /* an adapter that refused stays owed; next tick retries */ }
+                catch (error) {
+                    console.error(`spex: delivery retry failed for ${id}: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
         }
-        catch { /* transient store read; next tick retries */ }
+        catch (error) {
+            console.error(`spex: delivery retry sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
         setTimeout(tick, intervalMs).unref();
     };
     void tick();
 }
 const turnFailureObservers = new Map();
 let supervisingTurnFailures = false;
+let startingTurnFailureObserver = false;
 const TURN_FAILURE_OBSERVER_STABLE_MS = 5000;
 export function turnFailureNote(harness, failure) {
     const message = failure.message.replace(/\s+/g, ' ').trim().slice(0, 500) || 'turn failed';
@@ -1953,7 +2197,10 @@ export function reconcileTurnFailureObservers() {
         catch {
             continue;
         }
-        if (!rec?.governed || rec.stopped || rec.archived || !rec.harnessSessionId)
+        // Native turn failure observation is for an executing turn, not a durable roster census. Asking, awaiting,
+        // and parked records have no turn to observe; subscribing them creates one expensive app-server resume per
+        // idle record and lets stale observers accumulate after a backend restart.
+        if (!rec?.governed || rec.stopped || rec.archived || rec.status !== 'active' || !rec.harnessSessionId)
             continue;
         const harness = harnessById(rec.harness || defaultHarness.id);
         if (!harness.observeTurnFailures)
@@ -1977,11 +2224,16 @@ export function reconcileTurnFailureObservers() {
             }
             continue;
         }
+        // Codex thread/resume is an expensive native subscription under load. Admit one observer at a time so a
+        // backend restart cannot fan out N concurrent history reconciliations and exhaust CPU/RSS before any can settle.
+        if (startingTurnFailureObserver)
+            continue;
         if (state && now < state.retryAt)
             continue;
         state ??= { fingerprint: target.fingerprint, subscription: null, startedAt: 0, failures: 0, retryAt: 0, lastReason: null };
         state.startedAt = now;
         turnFailureObservers.set(id, state);
+        startingTurnFailureObserver = true;
         try {
             const subscription = target.harness.observeTurnFailures({
                 session: id,
@@ -2000,7 +2252,12 @@ export function reconcileTurnFailureObservers() {
                 }
             });
             state.subscription = subscription;
+            if (subscription.ready)
+                void subscription.ready.then(() => { startingTurnFailureObserver = false; }, () => { startingTurnFailureObserver = false; });
+            else
+                startingTurnFailureObserver = false;
             void subscription.closed.then((reason) => {
+                startingTurnFailureObserver = false;
                 if (turnFailureObservers.get(id) !== state)
                     return;
                 if (reason)
@@ -2010,6 +2267,7 @@ export function reconcileTurnFailureObservers() {
             });
         }
         catch (error) {
+            startingTurnFailureObserver = false;
             deferTurnFailureObserver(id, target.harness.id, state, error instanceof Error ? error.message : String(error));
         }
     }
@@ -2150,6 +2408,13 @@ export async function sessionCreateRequest(body, options = {}) {
     if (input.base !== undefined && typeof input.base !== 'string')
         return { status: 400, error: 'session-create base must be a string' };
     const base = typeof input.base === 'string' && input.base.trim() ? input.base.trim() : null;
+    const cutoverState = sessionApplicationCutoverState();
+    if (cutoverState === 'fenced')
+        return { status: 409, error: 'legacy JSON session store is fenced for one-time migration', code: 'session_create_failed', phase: 'request' };
+    if (cutoverState === 'migration-required')
+        return { status: 409, error: 'legacy JSON session store must be migrated before creating sessions', code: 'session_create_failed', phase: 'request' };
+    if (cutoverState === 'ambiguous')
+        return { status: 409, error: 'session database exists without a migration marker', code: 'session_create_failed', phase: 'request' };
     let key;
     try {
         key = normalizeCreateKey(options.requestKey);
@@ -2164,6 +2429,23 @@ export async function sessionCreateRequest(body, options = {}) {
     // immutable creation input because it publishes the record's existing display override. `base` joins them
     // for the same reason and with the same shape: absent, it must not perturb an existing receipt's bytes.
     const payloadHash = digest(JSON.stringify({ prompt, parent, launcher: launcher ?? null, ...(name ? { name } : {}), ...(base ? { base } : {}) }));
+    let freshStoreOwned = false;
+    let freshStoreCommitted = false;
+    try {
+        const acquired = acquireFreshSessionApplicationForCreate();
+        freshStoreOwned = acquired.owned;
+    }
+    catch (error) {
+        return { status: 409, error: error instanceof Error ? error.message : String(error), code: 'session_create_failed', phase: 'request' };
+    }
+    try {
+        assertLegacyJsonWritesAllowed();
+    }
+    catch (error) {
+        releaseFreshSessionApplicationForCreate(freshStoreOwned, false);
+        const message = error instanceof Error ? error.message : String(error);
+        return { status: 409, error: message, code: 'session_create_failed', phase: 'request' };
+    }
     const controller = new AbortController();
     const cancel = () => controller.abort(new SessionCreateError('session_create_cancelled', 'request', 'session creation caller disconnected', 408));
     if (options.signal?.aborted)
@@ -2176,6 +2458,8 @@ export async function sessionCreateRequest(body, options = {}) {
     try {
         try {
             const session = await prepareSession(prompt, parent, launcher, name, { id, requestDigest, payloadHash, base, signal: controller.signal });
+            await options.onPublished?.(session);
+            freshStoreCommitted = true;
             traceSessionCreate(id, requestDigest, 'request', 'finish');
             return { status: 201, session };
         }
@@ -2189,6 +2473,7 @@ export async function sessionCreateRequest(body, options = {}) {
         }
     }
     finally {
+        releaseFreshSessionApplicationForCreate(freshStoreOwned, freshStoreCommitted);
         clearTimeout(timer);
         options.signal?.removeEventListener('abort', cancel);
     }
@@ -2244,7 +2529,7 @@ export async function createSession(prompt, launcher, name, base) {
     const refused = await probeSessionCreateAuthority(target);
     if (refused) {
         console.error('spex: no backend reachable — launching in-process (caller env owns auth, no concurrency cap)');
-        const fallback = await sessionCreateRequest(body, { requestKey });
+        const fallback = await sessionCreateRequest(body, { requestKey, onPublished: projectCreatedSession });
         if (fallback.status === 201)
             return fallback.session;
         const error = new Error(`${fallback.code || 'session_create_failed'}: ${fallback.error}`);
@@ -2284,6 +2569,27 @@ export async function createSession(prompt, launcher, name, base) {
     }
     return await res.json();
 }
+export function projectCreatedSession(session) {
+    const application = initializeFreshSessionApplication();
+    try {
+        application.createSession({
+            sessionId: session.id,
+            status: session.lifecycle,
+            parentSessionId: session.parent,
+            proposal: session.proposal,
+            note: session.note,
+        });
+        if (session.parent)
+            application.attachWatcher(session.parent, session.id, 'watch:parent');
+    }
+    catch (error) {
+        const state = application.readState(session.id);
+        const sameProjection = state?.status === session.lifecycle
+            && state.parentSessionId === (session.parent ?? null);
+        if (!sameProjection)
+            throw error;
+    }
+}
 export function spawnerClause(p) {
     if (!p?.worktreePath)
         return '';
@@ -2545,7 +2851,7 @@ function existingCreateReceipt(rec) {
     const h = harnessById(rec.harness || defaultHarness.id);
     if (rec.status === 'queued')
         return toSession(rec, 'queued', 'offline');
-    const status = rec.status === 'active' ? 'working' : rec.status === 'awaiting' ? PROPOSAL_STATUS[rec.proposal ?? 'nothing'] : rec.status;
+    const status = rec.status === 'active' ? 'working' : rec.status === 'awaiting' ? displayStatusForProposal(rec.proposal) : rec.status;
     return toSession(rec, status, rec.stopped ? 'offline' : h.headless ? 'online' : 'starting');
 }
 async function proveSessionCandidate(path, branch, signal) {
@@ -2695,13 +3001,21 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                     traceSessionCreate(id, requestDigest, phase, 'start', 'seed-worktree-host-state');
                     seedWorktreeHostState(root, path);
                     traceSessionCreate(id, requestDigest, phase, 'finish', 'seed-worktree-host-state');
+                    // The branch ref right after `worktree add` IS the fork point. Record it: it is the only thing that
+                    // later separates "this branch never authored a commit" from "its commits landed in the base", and
+                    // git ancestry alone cannot tell those apart. A read that fails leaves it null — the diff reader
+                    // recovers the same commit from the branch's creation reflog entry.
+                    const forkResolved = await withGitAbortSignal(signal, () => gitTry(['-C', root, 'rev-parse', '--verify', `refs/heads/${branch}^{commit}`]));
+                    const forkCommit = forkResolved.ok && isGitObjectId(root, forkResolved.stdout.trim()) ? forkResolved.stdout.trim() : null;
                     let rec = {
                         session: id, governed: true, worktreePath: path, branch,
                         node: ref || null, title, name, parent: parent && parent !== id ? parent : null,
                         status: 'queued', proposal: null, merges: 0, note: null, sortKey: null, createdAt: Date.now(),
-                        harness: h.id, harnessSessionId: null, stopped: false, archived: false, coldProof: null, adapterRecovery: null, launcher: chosen.name,
+                        harness: h.id, harnessSessionId: null, runtimeStartToken: randomUUID(), stopped: false, archived: false, closedAt: null, coldProof: null, adapterRecovery: null, launcher: chosen.name,
                         launchCmd: pinned, launchOwner: backendLaunchAuthority(), createRequestId: requestDigest, createPayloadHash: payloadHash,
+                        diffComments: [],
                         ...(base ? { base } : {}),
+                        ...(forkCommit ? { forkCommit } : {}),
                     };
                     owned.store = true;
                     const dir = storeDir(id);
@@ -2720,13 +3034,8 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                     if (gitMismatch)
                         throw new SessionCreateError('session_create_failed', phase, `refusing session publication: ${gitMismatch}`, 500);
                     throwIfCreateAborted(signal, phase);
+                    publishCanonicalLifecycle(rec, rec.status, rec.proposal, rec.note);
                     writeRecord(rec);
-                    if (rec.parent && readRecord(rec.parent)?.governed) {
-                        const watchers = readWatchEntries(id);
-                        const next = addWatchSource(watchers, rec.parent, 'parent', true);
-                        if (next.added)
-                            writeWatchEntries(id, next.entries);
-                    }
                     published = true;
                     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(rec, root);
                     if (receiptFailure)
@@ -2819,11 +3128,26 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
     const deadline = Date.now() + timeoutMs;
     if (harness.launchPayloadProof && !current()?.harnessSessionId) {
         for (;;) {
-            if (existsSync(sessionArtifactPath(id, 'launch.proof'))) {
-                if (recordLockHeld)
-                    consumeHarnessLaunchProofUnlocked(id);
+            if (hasReadableLaunchReceipt(id)) {
+                if (recordLockHeld) {
+                    readinessWakeSuppressed.add(id);
+                    try {
+                        consumeHarnessLaunchProofUnlocked(id);
+                    }
+                    finally {
+                        readinessWakeSuppressed.delete(id);
+                    }
+                }
                 else
-                    await withRecordLock(id, async () => consumeHarnessLaunchProofUnlocked(id));
+                    await withRecordLock(id, async () => {
+                        readinessWakeSuppressed.add(id);
+                        try {
+                            consumeHarnessLaunchProofUnlocked(id);
+                        }
+                        finally {
+                            readinessWakeSuppressed.delete(id);
+                        }
+                    });
                 break;
             }
             if (Date.now() >= deadline)
@@ -2851,7 +3175,57 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
         await new Promise((r) => setTimeout(r, SOCKET_POLL_MS));
     }
 }
-const restingLifecycle = (status) => status === 'active' || status === 'queued' ? 'idle' : status;
+// An explicit successful resume is a new runtime attempt. A prior terminal launch/turn error must not
+// survive that handoff as current lifecycle truth; waiting declarations remain waiting declarations.
+const restingLifecycle = (status) => status === 'active' || status === 'queued' || status === 'error' ? 'idle' : status;
+const resumeNote = (status, note) => status === 'error' ? null : note;
+const archiveRef = (id) => `refs/spex-archive/${id}`;
+function archiveWorktreeState(id, path) {
+    const root = mainRoot();
+    try {
+        const parent = git(['-C', path, 'rev-parse', 'HEAD']).trim();
+        git(['-C', path, 'add', '-A']);
+        const tree = git(['-C', path, 'write-tree']).trim();
+        const commit = git(['-C', path, '-c', 'user.name=SpexCode', '-c', 'user.email=spexcode@localhost', 'commit-tree', tree, '-p', parent, '-m', `spex close archive ${id}`]).trim();
+        if (!/^[0-9a-f]{40,64}$/.test(commit))
+            throw new Error('archive commit was malformed');
+        git(['-C', root, 'update-ref', archiveRef(id), commit]);
+        const stored = git(['-C', root, 'rev-parse', '--verify', `${archiveRef(id)}^{commit}`]).trim();
+        if (stored !== commit)
+            throw new Error('archive ref publication was not verified');
+        return commit;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.split('\n')[0] : String(error);
+        throw new ResourceConflict(`refusing to close ${id}: could not publish ${archiveRef(id)}${detail ? ` - ${detail}` : ''}`);
+    }
+}
+async function restoreArchivedWorktree(id, rec) {
+    if (existsSync(rec.worktreePath))
+        return;
+    if (!rec.branch)
+        throw new ResourceConflict(`session ${id} has no branch to restore its archived worktree`);
+    const ref = archiveRef(id);
+    const archive = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${ref}^{commit}`]);
+    const start = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `refs/heads/${rec.branch}^{commit}`]);
+    if (!start.ok)
+        throw new ResourceConflict(`session ${id} branch ${rec.branch} is missing`);
+    await gitTry(['-C', mainRoot(), 'worktree', 'add', rec.worktreePath, rec.branch]).then((result) => {
+        if (!result.ok)
+            throw new ResourceConflict(`git worktree add failed: ${result.stderr.trim() || result.failure}`);
+    });
+    if (!archive.ok)
+        return;
+    const patch = git(['-C', mainRoot(), 'diff', '--binary', `${rec.branch}..${ref}`]);
+    if (!patch)
+        return;
+    try {
+        execFileSync('git', ['-C', rec.worktreePath, 'apply', '--binary', '-'], { input: patch, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    }
+    catch (error) {
+        throw new ResourceConflict(`session ${id} archived changes could not be restored: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 async function resumeSessionUnlocked(id, opts = {}) {
     const { force = false, guard = true } = opts;
     let wt;
@@ -2865,6 +3239,17 @@ async function resumeSessionUnlocked(id, opts = {}) {
     }
     if (!wt)
         return { ok: false, error: `no such session ${id}` };
+    if (wt.rec.archived && retirementReason(wt.rec)) {
+        try {
+            await restoreArchivedWorktree(id, wt.rec);
+            wt = await findWorktree(id);
+            if (!wt)
+                return { ok: false, error: `session ${id} disappeared while restoring its archived worktree` };
+        }
+        catch (error) {
+            return { ok: false, refused: true, error: `session ${id}: archived worktree restore failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     // A process that died while validating left an internal candidate behind. This record lock proves no live
     // resume still owns it. Restore the frozen public original before doing any transport work and require an
     // explicit retry; stale runtime evidence is never adopted into a fresh launch attempt.
@@ -2891,19 +3276,19 @@ async function resumeSessionUnlocked(id, opts = {}) {
     // A prior adapter process may have proven identity + first-turn durability just before its session owner
     // died. Consume that receipt before choosing a recovery tail, so retry resumes the proven thread instead of
     // creating another one with the same first prompt.
-    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+    if (h.launchPayloadProof && hasReadableLaunchReceipt(id)) {
         consumeHarnessLaunchProofUnlocked(id);
         wt = await findWorktree(id);
         if (!wt)
-            return { ok: false, error: `session ${id} disappeared while recovering native launch proof` };
+            return { ok: false, error: `session ${id} disappeared while recovering native launch receipt` };
     }
     // An archived record is expected to be stopped, but the guard must still inspect physical liveness in case
     // it is a legacy/invariant-violating row. Ignore filing and stale stop metadata for this one safety probe so
     // resume can never kill a live leaf merely because the record was hidden.
     const probeRec = wt.rec.archived ? { ...wt.rec, archived: false, stopped: false } : wt.rec;
-    const resumeSnap = await liveSnapshot();
+    const resumeSnap = h.runtimeOwnership === 'adapter' ? null : await liveSnapshot();
     const lv = h.runtimeOwnership === 'adapter'
-        ? (resumeSnap.windows.has(id) ? 'online' : 'offline')
+        ? await adapterRuntimeLiveness(probeRec)
         : liveness(probeRec, resumeSnap); // FRESH, honest liveness (listener-verified)
     if (guard && !force && lv === 'online')
         return { ok: false, refused: true, error: `session ${id} is ALIVE — refusing to relaunch, which would kill a live worker mid-work. To steer it, send it a message; use force only for a genuinely wedged (but alive) process.` };
@@ -2914,7 +3299,7 @@ async function resumeSessionUnlocked(id, opts = {}) {
         const recovery = await h.restoreRuntime?.(wt.rec);
         if (recovery && !recovery.ok)
             return { ok: false, refused: true, error: `session ${id}: recovery required before resume — ${recovery.reason}` };
-        writeRecord({ ...(readRecord(id) || wt.rec), adapterRecovery: null, coldProof: null, archived: false, stopped: true });
+        writeRecord({ ...(readRecord(id) || wt.rec), adapterRecovery: null, coldProof: null, archived: false, closedAt: null, stopped: true });
         wt = await findWorktree(id);
         if (!wt)
             return { ok: false, error: `session ${id} disappeared during adapter recovery` };
@@ -2923,8 +3308,8 @@ async function resumeSessionUnlocked(id, opts = {}) {
         // Make the durable row visible/offline before any adapter unarchive or launch RPC. Any later failure leaves
         // a retryable unarchived record rather than archived:true with a newly loaded target thread.
         const pendingRecovery = wt.rec.adapterRecovery || 'restore-runtime-pending';
-        writeRecord({ ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery });
-        const visible = readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery };
+        writeRecord({ ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery });
+        const visible = readRecord(id) || { ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery };
         const restored = await h.restoreRuntime?.(visible);
         if (restored && !restored.ok)
             return { ok: false, refused: true, error: `session ${id}: ${restored.reason}` };
@@ -2936,8 +3321,16 @@ async function resumeSessionUnlocked(id, opts = {}) {
     // fall through to a metadata-only no-op.
     // Archived sessions have no runtime by invariant. Resume first leaves cold storage, then the normal
     // starting -> online launch path recreates the same conversation.
-    const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: null }) : wt.rec;
-    const resumed = { ...current, archived: false, coldProof: null, status: restingLifecycle(current.status), stopped: false };
+    const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: null }) : wt.rec;
+    const resumed = {
+        ...current,
+        archived: false,
+        closedAt: null,
+        coldProof: null,
+        status: restingLifecycle(current.status),
+        note: resumeNote(current.status, current.note),
+        stopped: false,
+    };
     if (force || lv === 'offline') {
         let resumeTail;
         try {
@@ -2969,8 +3362,10 @@ async function resumeSessionUnlocked(id, opts = {}) {
         const candidate = {
             ...latest,
             archived: false,
+            closedAt: null,
             coldProof: null,
             status: restingLifecycle(latest.status),
+            note: resumeNote(latest.status, latest.note),
             stopped: false,
             launchReadinessPending: launchReadinessPending(preResume),
         };
@@ -2994,11 +3389,19 @@ async function resumeSessionUnlocked(id, opts = {}) {
                 error: `session ${id}: launch readiness changed across the pending publication${readinessError ? ` - ${readinessError}` : ''}; the session remains stopped and can be retried`,
             };
         }
-        const published = readRecord(id) || candidate;
+        // `readRecord` projects the still-public pre-resume lifecycle while the candidate fence is pending.
+        // Carrying that stale projection into the final publish used to leave queued/error rows unchanged in
+        // SQLite even though the runtime envelope had crossed readiness. Publish the candidate lifecycle while
+        // retaining the latest non-lifecycle envelope fields.
+        const latestPublished = readRecord(id) || candidate;
+        const published = { ...latestPublished, status: candidate.status, proposal: candidate.proposal, note: candidate.note };
+        publishCanonicalLifecycle(published, candidate.status, candidate.proposal, candidate.note);
         writeRecord({ ...published, launchReadinessPending: null });
     }
-    else
+    else {
+        publishCanonicalLifecycle(current, resumed.status, resumed.proposal, resumed.note);
         writeRecord(resumed);
+    }
     return { ok: true };
 }
 export const resumeSession = (id, opts = {}) => withSessionTransition(id, async () => {
@@ -3012,9 +3415,28 @@ export function markState(status, opts = {}) {
     if (!id)
         return false;
     return withRecordLockSync(id, () => {
+        const raw = readRecord(id);
+        if (raw?.archived)
+            throw new ResourceConflict(`refusing lifecycle change for closed session ${id}: it is read-only; resume it before changing state`);
         const rec = readLiveRecord(id);
-        if (!rec)
+        if (!rec?.governed)
             return false;
+        const application = configuredSessionApplicationIfCutover();
+        if (application) {
+            const proposal = status === 'awaiting' ? (opts.proposal ?? 'nothing') : null;
+            const note = opts.note ?? null;
+            const current = application.readState(id);
+            if (current && current.status === status && current.proposal === proposal && current.note === note)
+                return true;
+            const recipients = canonicalWatchRecipients(application, id, status);
+            application.transitionSession(id, {
+                status,
+                proposal,
+                note,
+                recipientSessionIds: recipients,
+            });
+            return true;
+        }
         const proposal = status === 'awaiting' ? (opts.proposal ?? 'nothing') : null;
         writeRecord({
             ...rec, status,
@@ -3024,15 +3446,40 @@ export function markState(status, opts = {}) {
         return true;
     });
 }
+// A human prompt is the explicit re-entry from a waiting turn; runtime liveness is not.
+export function markHumanPromptActive(sessionId) {
+    try {
+        const rec = readRecord(sessionId);
+        const canonical = sessionHookState(sessionId);
+        // The canonical lifecycle decides whether this record is writable. Any real human re-entry can
+        // resume a waiting declaration, including an `awaiting` close/merge proposal; the old envelope
+        // status is only migration metadata and must never veto the re-entry.
+        if (!rec || !canonical || rec.archived || retirementReason(rec))
+            return false;
+        return markState('active', { sessionId });
+    }
+    catch (error) {
+        // The message/PTY write is already accepted; a raced close or unreadable record must not turn it into a false send failure.
+        console.error(`spex: could not publish human-input activity for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}
 export const markDone = (proposal = 'nothing', sessionId, note) => markState('awaiting', { proposal, note, sessionId });
-export const markError = (sessionId) => markState('error', { sessionId });
 export function markTurnFailure(sessionId, note) {
     if (!sessionId)
         return false;
     return withRecordLockSync(sessionId, () => {
         const rec = readLiveRecord(sessionId);
-        if (!rec || rec.status !== 'active' || rec.stopped || rec.archived)
+        if (!rec?.governed || rec.status !== 'active' || rec.stopped || rec.archived)
             return false;
+        const application = configuredSessionApplicationIfCutover();
+        if (application) {
+            application.transitionSession(sessionId, {
+                status: 'error', proposal: null, note,
+                recipientSessionIds: canonicalWatchRecipients(application, sessionId, 'error'),
+            });
+            return true;
+        }
         writeRecord({ ...rec, status: 'error', proposal: null, note });
         return true;
     });
@@ -3063,8 +3510,22 @@ function bindHarnessSessionIdUnlocked(rec, harnessSessionId, generationId = proc
             registrationPrepared = true;
         }
     }
+    const application = configuredSessionApplicationIfCutover();
+    const nativeStartToken = rec.runtimeStartToken || process.env.SPEXCODE_NATIVE_START_TOKEN?.trim();
+    if (application && !nativeStartToken)
+        throw new ResourceConflict(`refusing to bind runtime for ${id}: native start token is missing`);
     try {
         writeRecord({ ...rec, harnessSessionId, coldProof: null, adapterRecovery: null });
+        if (application) {
+            if (!nativeStartToken)
+                throw new ResourceConflict(`refusing to bind runtime for ${id}: native start token is missing`);
+            application.bindRuntime(id, {
+                namespace: 'spex-governed',
+                runtimeKind: rec.harness || defaultHarness.id,
+                nativeSessionId: harnessSessionId,
+                nativeStartToken,
+            });
+        }
     }
     catch (error) {
         if (codex && generationId && registrationPrepared) {
@@ -3080,9 +3541,26 @@ function bindHarnessSessionIdUnlocked(rec, harnessSessionId, generationId = proc
     if (codex && generationId)
         commitCodexGenerationRegistration(root, id, harnessSessionId, generationId);
 }
-function readHarnessLaunchProof(id) {
+const NATIVE_LAUNCH_RECEIPT_FILE = 'launch.receipt';
+const LEGACY_NATIVE_LAUNCH_RECEIPT_FILE = 'launch.proof'; // dead-words-ok: one-release reader preserves staged receipts created before the protocol rename
+function launchReceiptPath(id) {
+    return sessionArtifactPath(id, NATIVE_LAUNCH_RECEIPT_FILE);
+}
+function readableLaunchReceiptPath(id) {
+    const current = launchReceiptPath(id);
+    if (existsSync(current))
+        return current;
+    const legacy = sessionArtifactPath(id, LEGACY_NATIVE_LAUNCH_RECEIPT_FILE);
+    return existsSync(legacy) ? legacy : null;
+}
+function hasReadableLaunchReceipt(id) {
+    return readableLaunchReceiptPath(id) !== null;
+}
+function readHarnessLaunchProof(id, path = readableLaunchReceiptPath(id)) {
+    if (!path)
+        throw new ResourceConflict(`native launch receipt for ${id} is missing`);
     try {
-        const proof = JSON.parse(readFileSync(sessionArtifactPath(id, 'launch.proof'), 'utf8'));
+        const proof = JSON.parse(readFileSync(path, 'utf8'));
         if (!proof || proof.version !== 1 || typeof proof.sessionId !== 'string'
             || typeof proof.harnessId !== 'string' || typeof proof.harnessSessionId !== 'string' || !proof.harnessSessionId
             || typeof proof.launchPayloadHash !== 'string'
@@ -3091,7 +3569,7 @@ function readHarnessLaunchProof(id) {
         return proof;
     }
     catch (error) {
-        throw new ResourceConflict(`native launch proof for ${id} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+        throw new ResourceConflict(`native launch receipt for ${id} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
 function sameHarnessLaunchProof(left, right) {
@@ -3099,6 +3577,32 @@ function sameHarnessLaunchProof(left, right) {
         && left.harnessSessionId === right.harnessSessionId && left.launchPayloadHash === right.launchPayloadHash
         && left.generationId === right.generationId;
 }
+// A native launch can be proven just before its visible TUI exits. A shell-level retry must be able to ask
+// for that exact target without replaying the first prompt. This read-only resolver accepts either side of the
+// proof-consumption boundary: the durable record after identity binding, or the staged receipt while the record
+// lock has not consumed it yet. Any mismatch remains a loud resource conflict; returning null means no proof has
+// been established and a fresh first-turn attempt is still allowed.
+export function existingHarnessLaunchTarget(id) {
+    const rec = readLiveRecord(id);
+    if (!rec)
+        return null;
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (!harness.launchPayloadProof)
+        return null;
+    const receiptPath = readableLaunchReceiptPath(id);
+    if (receiptPath) {
+        const proof = readHarnessLaunchProof(id, receiptPath);
+        if (proof.sessionId !== id || proof.harnessId !== harness.id)
+            throw new ResourceConflict(`native launch receipt for ${id} does not match the governed adapter identity`);
+        const pending = readLaunchFile(id);
+        if (pending != null && proof.launchPayloadHash !== createHash('sha256').update(pending).digest('hex'))
+            throw new ResourceConflict(`native launch receipt for ${id} does not match the authoritative resolved launch payload`);
+        if (rec.harnessSessionId && rec.harnessSessionId !== proof.harnessSessionId)
+            throw new ResourceConflict(`refusing to replace exact harness thread identity for ${id}; staged launch receipt differs from the record`);
+        return proof.harnessSessionId;
+    }
+    return rec.harnessSessionId || null;
+}
 export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPayload) {
     const id = sessionId || ownSessionId();
     if (!id || !harnessSessionId)
@@ -3108,17 +3612,17 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
         return false;
     const harness = harnessById(rec.harness || defaultHarness.id);
     if (!harness.launchPayloadProof)
-        throw new ResourceConflict(`harness ${harness.id} does not use native launch-payload proof`);
+        throw new ResourceConflict(`harness ${harness.id} does not use native launch-payload receipts`);
     const pending = readLaunchFile(id);
     if (pending == null)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: authoritative resolved launch payload is missing`);
     if (pending !== launchPayload)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: first-turn payload differs from the authoritative resolved launch payload`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: first-turn payload differs from the authoritative resolved launch payload`);
     const generationId = process.env.SPEXCODE_CODEX_GENERATION?.trim() || null;
     if (rec.harness === 'codex' || rec.harness === 'codex-headless') {
         const ledger = readCodexGenerationLedger(runtimeRoot());
         if (ledger.revision > 0 && !generationId)
-            throw new ResourceConflict(`refusing native launch proof for ${id}: launch did not provide an exact Codex generation id`);
+            throw new ResourceConflict(`refusing native launch receipt for ${id}: launch did not provide an exact Codex generation id`);
         if (generationId && (!ledger.generations[generationId] || ledger.generations[generationId].state === 'reclaimed'))
             throw new ResourceConflict(`refusing to bind Codex thread ${harnessSessionId}: generation ${generationId} is absent or reclaimed`);
     }
@@ -3130,7 +3634,14 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
         launchPayloadHash: createHash('sha256').update(launchPayload).digest('hex'),
         generationId,
     };
-    const path = sessionArtifactPath(id, 'launch.proof');
+    const existingPath = readableLaunchReceiptPath(id);
+    if (existingPath) {
+        const staged = readHarnessLaunchProof(id, existingPath);
+        if (sameHarnessLaunchProof(staged, proof))
+            return true;
+        throw new ResourceConflict(`refusing to replace native launch receipt for ${id}: the staged session, thread, payload, or generation differs`);
+    }
+    const path = launchReceiptPath(id);
     const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     writeFileSync(temp, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
     try {
@@ -3140,10 +3651,10 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
     catch (error) {
         if (error.code !== 'EEXIST')
             throw error;
-        const staged = readHarnessLaunchProof(id);
+        const staged = readHarnessLaunchProof(id, path);
         if (sameHarnessLaunchProof(staged, proof))
             return true;
-        throw new ResourceConflict(`refusing to replace native launch proof for ${id}: the staged session, thread, payload, or generation differs`);
+        throw new ResourceConflict(`refusing to replace native launch receipt for ${id}: the staged session, thread, payload, or generation differs`);
     }
     finally {
         rmSync(temp, { force: true });
@@ -3154,14 +3665,15 @@ function consumeHarnessLaunchProofUnlocked(id) {
     if (!rec)
         return false;
     const harness = harnessById(rec.harness || defaultHarness.id);
-    const proof = readHarnessLaunchProof(id);
+    const receiptPath = readableLaunchReceiptPath(id);
+    const proof = readHarnessLaunchProof(id, receiptPath);
     if (proof.sessionId !== id || proof.harnessId !== harness.id)
-        throw new ResourceConflict(`native launch proof for ${id} does not match the governed adapter identity`);
+        throw new ResourceConflict(`native launch receipt for ${id} does not match the governed adapter identity`);
     const pending = readLaunchFile(id);
     if (pending == null && rec.harnessSessionId !== proof.harnessSessionId)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: authoritative resolved launch payload is missing`);
     if (pending != null && proof.launchPayloadHash !== createHash('sha256').update(pending).digest('hex'))
-        throw new ResourceConflict(`native launch proof for ${id} does not match the authoritative resolved launch payload`);
+        throw new ResourceConflict(`native launch receipt for ${id} does not match the authoritative resolved launch payload`);
     bindHarnessSessionIdUnlocked(rec, proof.harnessSessionId, proof.generationId || undefined);
     if (pending != null) {
         try {
@@ -3169,17 +3681,18 @@ function consumeHarnessLaunchProofUnlocked(id) {
         }
         catch (error) {
             if (error.code !== 'ENOENT') {
-                console.error(`spex: native launch proof committed for ${id}, but launch could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+                console.error(`spex: native launch receipt committed for ${id}, but launch could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
                 return true;
             }
         }
     }
     try {
-        rmSync(sessionArtifactPath(id, 'launch.proof'));
+        if (receiptPath)
+            rmSync(receiptPath);
     }
     catch (error) {
         if (error.code !== 'ENOENT')
-            console.error(`spex: native launch proof committed for ${id}, but launch.proof could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+            console.error(`spex: native launch receipt committed for ${id}, but the receipt could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
     }
     return true;
 }
@@ -3193,7 +3706,7 @@ export function markHarnessSessionId(sessionId, harnessSessionId) {
             return false;
         const harness = harnessById(rec.harness || defaultHarness.id);
         if (harness.launchPayloadProof)
-            throw new ResourceConflict(`harness ${harness.id} must stage native identity together with authoritative first-turn payload proof`);
+            throw new ResourceConflict(`harness ${harness.id} must stage native identity together with an authoritative first-turn payload receipt`);
         bindHarnessSessionIdUnlocked(rec, harnessSessionId);
         return true;
     });
@@ -3204,9 +3717,13 @@ export function markIdle(sessionId) {
         return false;
     return withRecordLockSync(id, () => {
         const rec = readLiveRecord(id);
-        if (!rec || rec.status !== 'active')
-            return false; // active-only: never clobber a declaration
-        writeRecord({ ...rec, status: 'idle' });
+        if (!rec?.governed || rec.status !== 'active')
+            return false; // managed active-only: never clobber a declaration
+        publishCanonicalLifecycle(rec, 'idle', null, null);
+        // After cutover the JSON file is only the runtime/worktree envelope. Do not mirror this inferred
+        // lifecycle transition into it: doing so creates a second, stale-looking status surface for hooks.
+        if (!configuredSessionApplicationIfCutover())
+            writeRecord({ ...rec, status: 'idle' });
         return true;
     });
 }
@@ -3244,6 +3761,265 @@ function porcelainPath(line) {
         p = p.slice(arrow + 4);
     return p;
 }
+export function commitUrlForRemote(remote, commit) {
+    const raw = remote.trim();
+    let host = '', path = '';
+    try {
+        const url = new URL(raw);
+        if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'ssh:') {
+            host = url.host;
+            path = url.pathname;
+        }
+    }
+    catch {
+        const scp = /^(?:[^@/]+@)?([^:/]+):(.+)$/.exec(raw);
+        if (scp)
+            [, host, path] = scp;
+    }
+    path = path.replace(/^\/+|\/+$/g, '').replace(/\.git$/, '');
+    if (!host || !path)
+        return null;
+    const commitPath = host.toLowerCase().includes('gitlab') ? '-/commit' : 'commit';
+    return `https://${host}/${path}/${commitPath}/${commit}`;
+}
+// The branch diff is a proof over commits, not over a working directory: refs and objects are shared with
+// the main checkout, so a session whose worktree directory is gone (landed and cleaned, or reaped) keeps a
+// provable diff for as long as its branch ref survives. Anchor git at the live worktree when it exists and
+// at the main checkout otherwise; only a branch whose ref is gone everywhere is honestly unavailable, and
+// that refusal is a structured conflict (409 {error, code}) — never a raw git ENOENT turned into a 500.
+async function diffAnchorRoot(wt) {
+    if (!wt.branch)
+        throw new ResourceConflict(`session ${wt.rec.session} has no branch to diff`, 'diff-unavailable');
+    if (wt.path && existsSync(wt.path))
+        return wt.path;
+    const main = mainRoot();
+    const proven = await gitTry(['-C', main, 'rev-parse', '--verify', `refs/heads/${wt.branch}^{commit}`]);
+    if (proven.ok)
+        return main;
+    throw new ResourceConflict(`session ${wt.rec.session} has no worktree on disk and its branch ${wt.branch} no longer exists`, 'diff-unavailable');
+}
+// @@@ forkCommitOf - the commit the branch was created at, from the most authoritative source that has it.
+// The record carries it for every session created since it was introduced. Older records recover the same
+// commit from the branch ref's OLDEST reflog entry, which is where git itself wrote the `worktree add` start
+// point. Neither available (reflog pruned, or a branch adopted from outside this flow) → null, and the caller
+// falls back to what ancestry alone can prove.
+async function forkCommitOf(root, wt) {
+    if (wt.rec.forkCommit && isGitObjectId(root, wt.rec.forkCommit))
+        return wt.rec.forkCommit;
+    if (!wt.branch)
+        return null;
+    const log = await gitTry(['-C', root, 'reflog', 'show', '--no-abbrev', '--format=%H', `refs/heads/${wt.branch}`]);
+    if (!log.ok)
+        return null;
+    const entries = log.stdout.split('\n').map((line) => line.trim()).filter(Boolean);
+    const created = entries[entries.length - 1];
+    return created && isGitObjectId(root, created) ? created : null;
+}
+async function diffHeadPair(root, wt) {
+    if (!wt.branch)
+        throw new ResourceConflict(`session ${wt.rec.session} has no branch to diff`, 'diff-unavailable');
+    const baseRef = wt.rec.base || mainBranch();
+    const [headOut, baseOut] = await Promise.all([
+        gitTry(['-C', root, 'rev-parse', '--verify', `refs/heads/${wt.branch}^{commit}`]),
+        gitTry(['-C', root, 'rev-parse', '--verify', `${baseRef}^{commit}`]),
+    ]);
+    const head = headOut.ok ? headOut.stdout.trim() : '', resolvedBase = baseOut.ok ? baseOut.stdout.trim() : '';
+    if (!head || !resolvedBase || !isGitObjectId(root, head) || !isGitObjectId(root, resolvedBase))
+        throw new ResourceConflict(`session ${wt.rec.session} diff heads are unproven`, 'diff-unavailable');
+    const mergeBaseOut = await gitTry(['-C', root, 'merge-base', resolvedBase, head]);
+    const mergeBase = mergeBaseOut.ok ? mergeBaseOut.stdout.trim() : '';
+    if (!mergeBase || !isGitObjectId(root, mergeBase))
+        throw new ResourceConflict(`session ${wt.rec.session} diff merge-base is unproven`, 'diff-unavailable');
+    const [ancestor, remote, forkCommit] = await Promise.all([
+        gitTry(['-C', root, 'merge-base', '--is-ancestor', head, resolvedBase]),
+        gitTry(['-C', root, 'remote', 'get-url', 'origin']),
+        forkCommitOf(root, wt),
+    ]);
+    // A branch that never authored a commit is ALSO an ancestor of its base, so ancestry must be asked second.
+    // Without a fork commit the only provable form of "authored nothing" is a head that is still the base head.
+    const authoredNothing = forkCommit ? head === forkCommit : head === resolvedBase;
+    return {
+        branch: wt.branch, baseRef, base: resolvedBase, head, mergeBase,
+        branchState: authoredNothing ? 'no-commits' : ancestor.ok ? 'merged' : 'open',
+        commitUrl: remote.ok ? commitUrlForRemote(remote.stdout, head) : null,
+    };
+}
+// @@@ workingFiles - the session's uncommitted changes, enumerated from ONE porcelain status plus ONE numstat.
+// Untracked files count their own lines rather than spawning a git child each: the metadata call stays two
+// processes however dirty the tree is, and nothing here touches the index — an `--intent-to-add` would mutate
+// the worktree a live agent is working in.
+const WORKING_STATUS = { '??': 'untracked', A: 'added', D: 'deleted', R: 'renamed', C: 'copied', T: 'type-changed' };
+async function workingFiles(root) {
+    const [statusOut, numstatOut] = await Promise.all([
+        gitA(['-C', root, '-c', 'core.quotePath=false', 'status', '--porcelain', '--untracked-files=all']),
+        gitA(['-C', root, '-c', 'core.quotePath=false', 'diff', '--numstat', '-M', 'HEAD']),
+    ]);
+    const counts = new Map();
+    for (const line of numstatOut.split('\n')) {
+        const m = line.match(/^(-|\d+)\t(-|\d+)\t(.+)$/);
+        if (!m)
+            continue;
+        const { to } = parseStatPath(m[3]);
+        counts.set(to, { additions: m[1] === '-' ? 0 : +m[1], deletions: m[2] === '-' ? 0 : +m[2] });
+    }
+    const files = [];
+    for (const line of statusOut.split('\n')) {
+        if (!line.trim())
+            continue;
+        const code = line.slice(0, 2);
+        const path = porcelainPath(line);
+        const arrow = line.indexOf(' -> ');
+        const oldPath = arrow >= 0 ? line.slice(3, arrow) : '';
+        const letter = code.trim().replace(/[^A-Z?]/g, '').slice(0, 1) || 'M';
+        const status = WORKING_STATUS[code === '??' ? '??' : letter] ?? 'modified';
+        files.push({
+            path,
+            ...(oldPath && oldPath !== path ? { oldPath } : {}),
+            status,
+            ...(counts.get(path) ?? (code === '??' ? untrackedCounts(join(root, path)) : { additions: 0, deletions: 0 })),
+        });
+    }
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+}
+// An untracked file is entirely new, so its addition count is its line count. A NUL byte means git would
+// print `-`/`-` for a binary blob; report the same nothing rather than a line count of bytes.
+function untrackedCounts(absolute) {
+    try {
+        const body = readFileSync(absolute);
+        if (body.includes(0))
+            return { additions: 0, deletions: 0 };
+        const text = body.toString('utf8');
+        return { additions: text.length ? text.replace(/\n$/, '').split('\n').length : 0, deletions: 0 };
+    }
+    catch {
+        return { additions: 0, deletions: 0 };
+    }
+}
+async function workingPatch(root, file, untracked) {
+    if (untracked) {
+        // --no-index against /dev/null renders a whole new file as one addition hunk. It exits 1 when the two
+        // sides differ, which is the normal case here, so the patch is read off stdout rather than off `ok`.
+        const out = await gitTry(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', '--no-index', '--', '/dev/null', file.path]);
+        return out.stdout;
+    }
+    return gitA(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', 'HEAD', '--', ...(file.oldPath ? [file.oldPath, file.path] : [file.path])]);
+}
+// A working file's identity must move when its CONTENT moves, or a stale editor and a stale comment anchor
+// would survive an edit. Size and mtime are what change on every write, and they cost one stat.
+function workingIdentity(root, file) {
+    let stamp = 'gone';
+    try {
+        const s = statSync(join(root, file.path));
+        stamp = `${s.size}:${s.mtimeMs}`;
+    }
+    catch { /* deleted in the worktree */ }
+    return createHash('sha256').update(`working\0${file.path}\0${file.oldPath || ''}\0${stamp}`).digest('hex');
+}
+export async function sessionDiff(id, filePath, offset = 0, limit = 120_000, scope = 'branch') {
+    const wt = await findWorktree(id);
+    if (!wt)
+        return null;
+    const root = await diffAnchorRoot(wt);
+    const pair = await diffHeadPair(root, wt);
+    // The working tree is the session's OWN directory or it is not knowable. `root` falls back to the main
+    // checkout once the worktree is gone ([[diff-document]]), and that checkout's dirty files belong to whoever
+    // is working there — never to this session.
+    const liveRoot = wt.path && existsSync(wt.path) ? wt.path : null;
+    const window = (patch) => patch.slice(offset, offset + limit);
+    // A per-file fetch names its scope, so only that scope is enumerated: opening one file in a worktree with a
+    // hundred dirty paths must not re-walk the other scope's git reads.
+    const branch = scope === 'branch' || !filePath ? await mergeBaseDiff(root, pair.base, pair.head) : [];
+    const branchSelected = scope === 'branch' && filePath ? branch.filter((file) => file.path === filePath || file.oldPath === filePath) : (filePath ? [] : branch);
+    const files = await Promise.all(branchSelected.map(async (file) => {
+        const identity = createHash('sha256').update(`${pair.mergeBase}\0${pair.head}\0${file.path}\0${file.oldPath || ''}`).digest('hex');
+        if (!filePath)
+            return { ...file, patch: '', diffIdentity: identity };
+        const patch = await gitA(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', pair.mergeBase, pair.head, '--', ...(file.oldPath ? [file.oldPath, file.path] : [file.path])]);
+        return { ...file, patch: window(patch), diffIdentity: identity };
+    }));
+    const dirty = liveRoot && (scope === 'working' || !filePath) ? await workingFiles(liveRoot) : [];
+    const workingSelected = scope === 'working' && filePath ? dirty.filter((file) => file.path === filePath || file.oldPath === filePath) : (filePath ? [] : dirty);
+    const working = await Promise.all(workingSelected.map(async (file) => {
+        const identity = workingIdentity(liveRoot, file);
+        if (!filePath)
+            return { ...file, patch: '', diffIdentity: identity };
+        const patch = await workingPatch(liveRoot, file, file.status === 'untracked');
+        return { ...file, patch: window(patch), diffIdentity: identity };
+    }));
+    return {
+        id, scope: 'branch', ...pair, files,
+        working: { readable: !!liveRoot, files: working },
+        comments: wt.rec.diffComments ?? [],
+    };
+}
+export async function saveDiffComment(id, input) {
+    const body = input.body.trim();
+    if (!input.filePath || !body || !Number.isInteger(input.lineStart) || input.lineStart < 1 || !Number.isInteger(input.lineEnd) || input.lineEnd < input.lineStart || !input.diffIdentity)
+        throw new ResourceConflict('diff comment needs a file, line range, body, and diff identity');
+    return withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const comment = { id: input.id || randomUUID(), filePath: input.filePath, lineStart: input.lineStart, lineEnd: input.lineEnd, body, diffIdentity: input.diffIdentity, sentAt: null };
+        const comments = (rec.diffComments ?? []).filter((candidate) => candidate.id !== comment.id);
+        writeRecord({ ...rec, diffComments: [...comments, comment] });
+        return comment;
+    });
+}
+// A review conversation you can only append to is not a conversation. Saving, editing and sending all
+// existed; nothing could take a row back, so a comment filed on the wrong line — or a probe left by a
+// measurement — stayed on the record forever. Retract is the same shape as the other two `retract` verbs
+// this product already has ([[session-files]], eval): it removes the row under the record lock and says
+// which one it removed. Already-DELIVERED text is not recalled — the agent read it — so this retracts the
+// record's row, never the message that was sent.
+export async function retractDiffComment(id, commentId) {
+    if (!commentId)
+        throw new ResourceConflict('retracting a diff comment needs its id');
+    return withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const comments = rec.diffComments ?? [];
+        const removed = comments.find((comment) => comment.id === commentId);
+        if (!removed)
+            return null;
+        writeRecord({ ...rec, diffComments: comments.filter((comment) => comment.id !== commentId) });
+        return removed;
+    });
+}
+export async function sendDiffComments(id, ids) {
+    const selected = await withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const wanted = ids?.length ? new Set(ids) : null;
+        return (rec.diffComments ?? []).filter((comment) => !comment.sentAt && (!wanted || wanted.has(comment.id)));
+    });
+    if (!selected)
+        return { ok: false, error: `no such session ${id}` };
+    if (!selected.length)
+        return { ok: false, error: 'no unsent diff comments' };
+    const text = ['Review comments on the branch diff:', ...selected.map((comment) => {
+            const lines = comment.lineStart === comment.lineEnd ? `L${comment.lineStart}` : `L${comment.lineStart}-L${comment.lineEnd}`;
+            return `- ${comment.filePath}:${lines}\n  ${comment.body.replace(/\n/g, '\n  ')}`;
+        })].join('\n');
+    const sent = await sendText(id, text);
+    if (!sent.ok)
+        return { ok: false, error: sent.error || 'could not send diff comments' };
+    const sentAt = new Date().toISOString();
+    await withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return;
+        const selectedById = new Map(selected.map((comment) => [comment.id, comment]));
+        writeRecord({ ...rec, diffComments: (rec.diffComments ?? []).map((comment) => {
+                const before = selectedById.get(comment.id);
+                const unchanged = before && !comment.sentAt && comment.body === before.body && comment.diffIdentity === before.diffIdentity;
+                return unchanged ? { ...comment, sentAt } : comment;
+            }) });
+    });
+    return { ok: true, sentAt, count: selected.length };
+}
 async function reviewHeadPair(root, branch, base) {
     const branchRef = `refs/heads/${branch}`, baseRef = `refs/heads/${base}`;
     const output = await gitA(['-C', root, 'for-each-ref', '--sort=refname', '--format=%(refname)%00%(objectname)', branchRef, baseRef]);
@@ -3350,16 +4126,7 @@ export async function mergeSession(id) {
         return { dispatched: false, reason: 'no such mergeable session' };
     const r = await sendText(id, MERGE_PROMPT, undefined, {
         deferDrain: true,
-        acceptGuard: async (rec) => {
-            if (!rec.governed || rec.status !== 'awaiting' || rec.proposal !== 'merge') {
-                const error = new ResourceConflict(`session ${id} is not a governed awaiting merge proposal`);
-                Object.assign(error, { code: 'session_merge_not_proposed' });
-                throw error;
-            }
-        },
     });
-    if (r.code === 'session_merge_not_proposed')
-        return { dispatched: false, reason: r.error || 'merge dispatch refused', code: r.code, status: 409 };
     if (!r.ok)
         return { dispatched: false, reason: r.error || 'could not dispatch merge prompt' };
     await resumeSession(id, { guard: false });
@@ -3627,7 +4394,7 @@ async function inspectSessionLeafIdentity(id, rec) {
     const startAfter = sessionLeafStartToken(pid);
     const candidate = sessionLeafReceiptCandidate(id, pid, panePid, procs, startBefore, startAfter);
     if (!candidate.ok || !candidate.receipt)
-        return { state: 'unknown', pid, reason: candidate.reason || 'leaf birth receipt proof failed' };
+        return { state: 'unknown', pid, reason: candidate.reason || 'leaf birth receipt validation failed' };
     if (readAgentPid(path) !== pid || sessionLeafStartToken(pid) !== candidate.receipt.startToken)
         return { state: 'unknown', pid, reason: `leaf PID ${pid} identity changed before receipt commit` };
     writeSessionLeafReceipt(id, candidate.receipt);
@@ -3681,7 +4448,7 @@ async function stopAgentProcess(id, rec, requireCold = false, coldReceipt) {
     if (requireCold) {
         const cold = await harness.coldRuntime?.(rec, coldReceipt);
         if (cold && !cold.ok)
-            throw new ResourceConflict(`refusing to archive ${id}: ${cold.reason}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${cold.reason}`);
     }
 }
 async function stopSessionUnlocked(id) {
@@ -3706,25 +4473,23 @@ async function stopSessionUnlocked(id) {
     return !!wt;
 }
 export const stopSession = (id) => withSessionTransition(id, () => withRecordLock(id, () => stopSessionUnlocked(id)));
-async function archiveSessionUnlocked(id, on = true) {
+async function coldStopSessionUnlocked(id) {
     let wt;
     try {
         wt = await findWorktree(id);
     }
     catch (e) {
         if (e instanceof SessionRecordUnusable)
-            throw new ResourceConflict(`refusing to archive ${id}: ${e.message}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${e.message}`);
         throw e;
     }
     if (!wt)
         return false;
-    if (!on)
-        throw new ResourceConflict('unarchive is not a record-only transition; use resume to restore the runtime');
     if (wt.rec.status === 'queued')
-        throw new ResourceConflict(`refusing to archive ${id}: queued sessions have only a prepared launch prompt; resume/startQueued is their lifecycle`);
+        throw new ResourceConflict(`refusing to close ${id}: queued sessions have only a prepared launch prompt; close handles their prepared tree directly`);
     const retired = retirementReason(wt.rec);
     if (retired)
-        throw new ResourceConflict(`refusing to archive ${id}: ${retired}`);
+        throw new ResourceConflict(`refusing to close ${id}: ${retired}`);
     archiving.add(id);
     try {
         const h = harnessById(wt.rec.harness || defaultHarness.id);
@@ -3738,12 +4503,12 @@ async function archiveSessionUnlocked(id, on = true) {
         if (wt.rec.archived && hasValidColdProof(wt.rec)) {
             const proofSnap = await liveSnapshot(id);
             if (proofSnap.probeFailed)
-                throw new ResourceConflict(`refusing to re-archive ${id}: liveness probe failed; the exact leaf may have respawned`);
+                throw new ResourceConflict(`refusing to close ${id}: liveness probe failed; the exact leaf may have respawned`);
             const proofLv = h.runtimeOwnership === 'adapter'
                 ? (proofSnap.windows.has(id) ? 'online' : 'offline')
                 : liveness({ ...wt.rec, archived: false, stopped: false }, proofSnap);
             if (proofLv === 'unknown' || proofLv === 'starting')
-                throw new ResourceConflict(`refusing to re-archive ${id}: session liveness is ${proofLv}; exact cold state is unproven`);
+                throw new ResourceConflict(`refusing to close ${id}: session liveness is ${proofLv}; exact cold state is unproven`);
             if (proofLv === 'offline') {
                 // A deliberately stopped shared control plane is a valid empty resident census. A durable proof plus
                 // an adapter-owned root-absent fact is the only idempotent short-circuit; a live root still has to prove
@@ -3768,28 +4533,25 @@ async function archiveSessionUnlocked(id, on = true) {
                 }
             }
         }
-        // Legacy/respawned archives are made visible before repair. Any refusal below therefore leaves an unarchived
-        // row instead of relying on a hidden bit while a runtime proof is missing.
+        // Legacy/respawned closed rows are probed as ordinary runtime records, but the durable archived bit is kept
+        // untouched until the new close publication succeeds.
         if (wt.rec.archived) {
-            writeRecord({ ...wt.rec, archived: false, coldProof: null });
-            wt = await findWorktree(id);
-            if (!wt)
-                return false;
+            wt = { ...wt, rec: { ...wt.rec, archived: false, coldProof: null } };
         }
         const snap = await liveSnapshot(id);
         if (snap.probeFailed)
-            throw new ResourceConflict(`refusing to archive ${id}: liveness probe failed; the leaf may still be live`);
+            throw new ResourceConflict(`refusing to close ${id}: liveness probe failed; the leaf may still be live`);
         const lv = h.runtimeOwnership === 'adapter'
             ? 'offline'
             : liveness({ ...wt.rec, archived: false, stopped: false }, snap);
         if (lv === 'unknown' || lv === 'starting')
-            throw new ResourceConflict(`refusing to archive ${id}: session liveness is ${lv}; exact leaf ownership is unproven`);
+            throw new ResourceConflict(`refusing to close ${id}: session liveness is ${lv}; exact leaf ownership is unproven`);
         // The adapter guard runs BEFORE any tmux/process signal. Active/unknown native turns and ambiguous descendant
         // ownership refuse here; a verified adapter receipt carries an exact subtree through to coldRuntime's commit.
         assertSessionOwnerSafe(id, h.id);
         const preflight = await h.coldPreflight?.({ ...wt.rec, archived: false, stopped: lv === 'offline' });
         if (preflight && !preflight.ok)
-            throw new ResourceConflict(`refusing to archive ${id}: ${preflight.reason}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${preflight.reason}`);
         // Even a proven-offline leaf can leave a stale rendezvous/socket or adapter artifact. Reuse the same exact
         // teardown seam with the explicit stopped marker so cleanupRuntime gets its ownership check and no second
         // cleanup primitive is invented.
@@ -3801,12 +4563,12 @@ async function archiveSessionUnlocked(id, on = true) {
             coldCommitted = true;
             const latest = readRecord(id);
             if (!latest)
-                throw new ResourceConflict(`refusing to archive ${id}: session record disappeared before filing`);
+                throw new ResourceConflict(`refusing to close ${id}: session record disappeared before archive-ref publication`);
             // The leaf identity kill and adapter cold proof established process/transport absence. Record-backed
             // adapters intentionally project online until the archive write, so display liveness is not physical
             // evidence here. A target pane appearing after the stop proof is the remaining shared runtime witness.
             await assertTargetTmuxAbsent(id, 'before archive filing');
-            writeRecord({ ...latest, archived: true, stopped: true, coldProof: coldProofFor(latest), adapterRecovery: null });
+            writeRecord({ ...latest, stopped: true, coldProof: coldProofFor(latest), adapterRecovery: null });
         }
         catch (error) {
             if (coldCommitted) {
@@ -3832,102 +4594,10 @@ async function archiveSessionUnlocked(id, on = true) {
         archiving.delete(id);
     }
 }
-export const archiveSession = (id, on = true) => {
-    if (!on)
-        return archiveSessionUnarchive(id);
-    return withSessionTransition(id, () => withRecordLock(id, () => archiveSessionUnlocked(id, on)));
-};
-async function archiveSessionUnarchive(id) {
-    const wt = await findWorktree(id);
-    if (!wt)
-        return false;
-    if (!wt.rec.archived)
-        return true;
-    const resumed = await resumeSession(id);
-    if (!resumed.ok)
-        throw new ResourceConflict(resumed.error || `refusing to resume ${id}`);
-    return true;
-}
-// @@@ cold retirement - archive already returned the target's runtime, so closing a proven-cold row must not
-// re-enter the live stop guard and make unrelated shared-root references prove ownership again. Verify only
-// that the target-bound cold proof is still current and that no target PID/window/socket/thread has reappeared.
-// This is read-only: no signal, adapter mutation, or shared-root cleanup belongs on the cold path.
-async function assertColdRetirementSafe(id, rec) {
-    if (!rec.archived || !rec.stopped || !hasValidColdProof(rec))
-        throw new ResourceConflict(`refusing to close archived session ${id}: target-bound cold witness is missing or stale`);
-    if (rec.adapterRecovery)
-        throw new ResourceConflict(`refusing to close archived session ${id}: adapter recovery is pending (${rec.adapterRecovery})`);
-    const [snap, socket] = await Promise.all([liveSnapshot(id), rendezvousListening(id)]);
-    if (snap.probeFailed)
-        throw new ResourceConflict(`refusing to close archived session ${id}: liveness probe failed; target runtime absence is unproven`);
-    if (snap.windows.has(id))
-        throw new ResourceConflict(`refusing to close archived session ${id}: target tmux window has reappeared`);
-    if (socket === 'live')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous transport has reappeared`);
-    if (socket === 'unproven')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous state is ambiguous`);
-    const leaf = await inspectSessionLeafIdentity(id, rec);
-    if (leaf.state === 'owned')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target leaf PID ${leaf.identity.pid} is live or recycled; ownership is ambiguous`);
-    if (leaf.state === 'unknown')
-        throw new ResourceConflict(`refusing to close archived session ${id}: ${leaf.reason}; ownership is ambiguous`);
-    const harness = harnessById(rec.harness || defaultHarness.id);
-    if (harness.coldRetirementPreflight) {
-        const proof = await harness.coldRetirementPreflight(rec);
-        if (!proof.ok)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`);
-        return;
-    }
-    const descriptors = harness.sharedRuntimes?.(runtimeRoot()) ?? [];
-    let everySharedRootAbsent = descriptors.length > 0;
-    for (const descriptor of descriptors) {
-        const resident = descriptor.residency
-            ? await descriptor.residency()
-            : await descriptor.probe().then((probe) => ({ healthy: probe.healthy, referenceIds: probe.references.map((reference) => reference.referenceId), error: probe.error }));
-        if (!resident.healthy)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${resident.error || `${descriptor.label} resident census is unhealthy`}`);
-        if (rec.harnessSessionId && resident.referenceIds.includes(rec.harnessSessionId))
-            throw new ResourceConflict(`refusing to close archived session ${id}: target adapter thread ${rec.harnessSessionId} is loaded`);
-        everySharedRootAbsent = everySharedRootAbsent && resident.rootAbsent === true;
-    }
-    if (harness.coldPreflight && !everySharedRootAbsent) {
-        const proof = await harness.coldPreflight(rec);
-        if (!proof.ok)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`);
-        if (!proof.alreadyCold)
-            throw new ResourceConflict(`refusing to close archived session ${id}: target adapter collection is not proven cold`);
-    }
-}
-async function assertDiscardableWorktree(id, path, branch, kind) {
-    if (existsSync(path)) {
-        const status = await gitTry(['-C', path, 'status', '--porcelain', '--untracked-files=all']);
-        if (!status.ok)
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree status is unreadable`);
-        if (status.stdout.trim())
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree has dirty work`);
-    }
-    if (branch) {
-        const resolved = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${branch}^{commit}`]);
-        if (resolved.ok) {
-            const count = await gitTry(['-C', mainRoot(), 'rev-list', '--count', `${mainBranch()}..${branch}`]);
-            if (!count.ok)
-                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch ancestry is unreadable`);
-            const ahead = Number(count.stdout.trim());
-            if (!Number.isFinite(ahead) || ahead !== 0)
-                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch is ${Number.isFinite(ahead) ? ahead : 'an unknown number of'} commit(s) ahead`);
-        }
-        else if (resolved.failure !== 'exit') {
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch identity is unreadable`);
-        }
-        else if (existsSync(path)) {
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree exists but branch ${branch} is missing`);
-        }
-    }
-}
 // A never-launched queue owns only prepared disk state. The transition/record locks around close serialize
 // this check with startQueued: whichever wins decides whether the record is still a queue or has become live.
 // No shared-runtime probe belongs here because a valid prepared row has no adapter thread to look up.
-async function assertQueuedRetirementSafe(id, rec, path, branch) {
+async function assertQueuedCloseSafe(id, rec) {
     if (rec.status !== 'queued' || rec.harnessSessionId)
         throw new ResourceConflict(`refusing to close queued session ${id}: the record has a target thread or is no longer queued`);
     if (rec.adapterRecovery || launching.has(id))
@@ -3946,14 +4616,20 @@ async function assertQueuedRetirementSafe(id, rec, path, branch) {
         const pid = readAgentPid(pidPath);
         throw new ResourceConflict(`refusing to close queued session ${id}: target leaf PID artifact ${Number.isFinite(pid) && pid > 0 ? pid : 'is unreadable'}; never-launched ownership is ambiguous`);
     }
-    await assertDiscardableWorktree(id, path, branch, 'prepared');
+    // close preserves the prepared tree's dirty state in refs/spex-archive/<id>; cleanliness is not a
+    // precondition for the soft terminal transition.
 }
 // A launch may leave its row active before Codex publishes the native thread binding. This close path owns
 // only the record's dead local launch residue; an unbound app-server peer stays unowned and untouched.
-async function assertUnboundRetirementSafe(id, rec, path, branch) {
+async function assertUnboundCloseSafe(id, rec) {
     if (harnessById(rec.harness || defaultHarness.id).exactNativeTargetId(rec) || rec.status === 'queued' || rec.archived)
         throw new ResourceConflict(`refusing to close unbound session ${id}: it is not an unbound live-record residue`);
-    if (rec.adapterRecovery || rec.launchReadinessPending || launching.has(id) || existsSync(sessionArtifactPath(id, 'launch')))
+    const failureStamped = /^queued launch readiness failed:/.test(rec.note || '') || rec.status === 'error' || rec.stopped;
+    const readinessStartedAt = rec.launchReadinessStartedAt ?? rec.launchReadinessPending?.startedAt ?? null;
+    const readinessInProgress = !failureStamped && (readinessStartedAt != null
+        ? Date.now() - readinessStartedAt < SOCKET_READY_TIMEOUT_MS
+        : launching.has(id));
+    if (rec.adapterRecovery || readinessInProgress)
         throw new ResourceConflict(`refusing to close unbound session ${id}: launch or recovery is still in progress`);
     const [snap, socket] = await Promise.all([liveSnapshot(id), rendezvousListening(id)]);
     if (snap.probeFailed)
@@ -3968,55 +4644,45 @@ async function assertUnboundRetirementSafe(id, rec, path, branch) {
     const leaf = await inspectSessionLeafIdentity(id, rec);
     if (leaf.state !== 'missing' && leaf.state !== 'dead')
         throw new ResourceConflict(`refusing to close unbound session ${id}: ${leaf.state === 'unknown' ? leaf.reason : 'target leaf identity is live or ambiguous'}`);
-    await assertDiscardableWorktree(id, path, branch, 'unbound');
 }
-async function closeOwnedSessionUnlocked(id, wt, source, unboundRetired = false) {
+async function closeOwnedSessionUnlocked(id, wt, _source, unboundStopped = false) {
     const root = mainRoot();
     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(wt.rec, root);
     if (receiptFailure)
-        throw new ResourceConflict(`refusing destructive close for ${id}: ${receiptFailure}; public record and resources remain the authority fence`);
-    const closesCodexBinding = (wt.rec.harness === 'codex' || wt.rec.harness === 'codex-headless') && !!wt.rec.harnessSessionId;
-    const retired = !wt.rec.archived && !!retirementReason(wt.rec);
-    // A retired row has already lost its worktree; close is its explicit record-only terminal cleanup.
-    if (!retired) {
-        if (wt.rec.archived)
-            await assertColdRetirementSafe(id, wt.rec);
-        else if (wt.rec.status === 'queued')
-            await assertQueuedRetirementSafe(id, wt.rec, wt.path, wt.branch);
-        else if (!unboundRetired)
-            throw new ResourceConflict(`refusing to close ${id}: target runtime was not cold-retired first`);
-    }
-    // The marker protects only the destructive half. A failed cold proof must leave a normal, resumable binding.
-    if (closesCodexBinding)
-        prepareCodexGenerationClose(runtimeRoot(), id, wt.rec.harnessSessionId);
-    appendCloseLedger(id, wt.rec, source);
+        throw new ResourceConflict(`refusing close for ${id}: ${receiptFailure}; public record and resources remain the authority fence`);
+    const retired = !!retirementReason(wt.rec);
+    if (!retired && wt.rec.status === 'queued')
+        await assertQueuedCloseSafe(id, wt.rec);
+    if (!retired && !unboundStopped && wt.rec.status !== 'queued') {
+        await coldStopSessionUnlocked(id);
+        wt = (await findWorktree(id)) || wt;
+    }
+    // The archive ref is published before any worktree removal. A failed ref write leaves the complete
+    // worktree and record in place for retry.
+    if (!retired && existsSync(wt.path))
+        archiveWorktreeState(id, wt.path);
+    const latest = readRecord(id);
+    if (!latest)
+        throw new ResourceConflict(`refusing to finish close for ${id}: session record disappeared before publication`);
+    writeRecord({
+        ...latest,
+        archived: true,
+        closedAt: latest.closedAt || new Date().toISOString(),
+        stopped: true,
+        coldProof: latest.coldProof || coldProofFor(latest),
+        adapterRecovery: null,
+    });
     let slot = null;
     try {
-        slot = treeSlotDir(wt.path);
+        slot = existsSync(wt.path) ? treeSlotDir(wt.path) : null;
     }
     catch { /* tree already unresolvable — nothing to key the slot by */ }
-    // a retired session's worktree/branch are already gone; removing them is a no-op to skip, not a failure.
     if (existsSync(wt.path)) {
-        const removed = await gitTry(['-C', root, 'worktree', 'remove', '--force', wt.path]);
-        if (!removed.ok)
-            throw new ResourceConflict(`refusing to finish close for ${id}: worktree removal failed`);
-        if (existsSync(wt.path))
-            throw new ResourceConflict(`refusing to finish close for ${id}: worktree remains after removal`);
-    }
-    if (wt.branch) {
-        const branchRef = `refs/heads/${wt.branch}`;
-        const present = await gitTry(['-C', root, 'rev-parse', '--verify', '--quiet', branchRef]);
-        if (present.ok) {
-            const removed = await gitTry(['-C', root, 'branch', '-D', wt.branch]);
-            if (!removed.ok)
-                throw new ResourceConflict(`refusing to finish close for ${id}: branch removal failed`);
-            const remaining = await gitTry(['-C', root, 'rev-parse', '--verify', '--quiet', branchRef]);
-            if (remaining.ok || remaining.failure !== 'exit')
-                throw new ResourceConflict(`refusing to finish close for ${id}: branch remains or its removal is unproven`);
-        }
-        else if (present.failure !== 'exit') {
-            throw new ResourceConflict(`refusing to finish close for ${id}: branch presence is unreadable`);
-        }
+        const trashed = moveWorktreeToTrash(root, wt.path);
+        const pruned = await gitTry(['-C', root, 'worktree', 'prune']);
+        if (!pruned.ok)
+            console.error(`spex: deferred worktree ${id} was renamed to ${trashed}, but git worktree prune failed: ${pruned.stderr.trim() || pruned.failure}`);
+        queueWorktreeTrash(trashed);
     }
     if (slot) {
         try {
@@ -4024,20 +4690,6 @@ async function closeOwnedSessionUnlocked(id, wt, source, unboundRetired = false)
         }
         catch { /* best-effort GC */ }
     }
-    try {
-        rmSync(sessionStoreDir(id), { recursive: true, force: true });
-    }
-    catch (error) {
-        throw new ResourceConflict(`refusing to finish close for ${id}: session record/prompt removal failed (${error instanceof Error ? error.message : String(error)})`);
-    }
-    if (existsSync(sessionStoreDir(id)))
-        throw new ResourceConflict(`refusing to finish close for ${id}: session record removal failed`);
-    // The close still owns this sender's record lock. Marking after its store is gone lets any send already
-    // admitted finish before close returns, while every later send and every retry sweep sees terminal output.
-    revokeSenderDelivery(id);
-    if (closesCodexBinding && wt.rec.harnessSessionId) {
-        bindCodexGeneration(runtimeRoot(), id, wt.rec.harnessSessionId, null);
-    }
     requestQueueDrain(); // a close frees a slot — start the next queued session if any
     return true;
 }
@@ -4053,7 +4705,7 @@ async function closeSessionUnlocked(id, source) {
         const runtime = sessionStoreDir(id);
         const evidence = quarantined
             ? `Original bytes were copied to ${quarantined}`
-            : `Original bytes remain at ${join(runtime, 'session.json')}; no quarantine copy could be made`;
+            : `Original bytes remain at ${join(runtime, 'runtime.json')}; no quarantine copy could be made`;
         let guard = 'no readable session record proves the adapter or leaf owner';
         try {
             await stopAgentProcess(id, null);
@@ -4061,42 +4713,29 @@ async function closeSessionUnlocked(id, source) {
         catch (error) {
             guard = error instanceof Error ? error.message : String(error);
         }
-        throw new SessionRecordUnusable('corrupt', id, `refusing destructive close for ${id}: the unreadable record proves no adapter, leaf, worktree, or branch owner (${guard}). ${evidence}. Runtime remains at ${runtime}; worktree and branch ownership is unknown and was not touched; no process signal or deletion was attempted.`);
+        throw new SessionRecordUnusable('corrupt', id, `refusing close for ${id}: the unreadable record proves no adapter, leaf, worktree, or branch owner (${guard}). ${evidence}. Runtime remains at ${runtime}; worktree and branch ownership is unknown and was not touched; no process signal or deletion was attempted.`);
     }
     if (!wt)
         return false;
-    let unboundRetired = false;
+    let unboundStopped = false;
     if (!retirementReason(wt.rec) && !wt.rec.archived && wt.rec.status !== 'queued') {
         const harness = harnessById(wt.rec.harness || defaultHarness.id);
         if (!harness.exactNativeTargetId(wt.rec)) {
-            await assertUnboundRetirementSafe(id, wt.rec, wt.path, wt.branch);
+            await assertUnboundCloseSafe(id, wt.rec);
             await tmuxOk(['kill-session', '-t', id]);
-            await assertTargetTmuxAbsent(id, 'after unbound residue retirement');
+            await assertTargetTmuxAbsent(id, 'after unbound residue close');
             await harness.cleanupRuntime(wt.rec);
-            unboundRetired = true;
+            unboundStopped = true;
         }
         else {
-            // A confirmed terminal close may end an exact native turn before cold proof. Ordinary archive deliberately
-            // remains non-destructive while a turn is active; close already means discard this session's work.
-            assertSessionOwnerSafe(id, harness.id);
-            const interrupt = harness.interrupt;
-            if (interrupt) {
-                const result = await interrupt({ ...wt.rec, runtimeDir: runtimeRoot() });
-                if (!result.ok)
-                    throw new ResourceConflict(`refusing to close ${id}: native interrupt failed (${result.error || 'unknown error'})`);
-            }
-            const archived = await archiveSessionUnlocked(id);
-            if (!archived)
-                return false;
-            wt = await findWorktree(id);
-            if (!wt)
-                return false;
+            // closeOwnedSessionUnlocked performs the one exact cold-stop proof immediately before archive-ref
+            // publication. Keeping that seam in one place prevents a second adapter mutation on retry.
         }
     }
     const target = wt;
     return target.branch
-        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source, unboundRetired))
-        : closeOwnedSessionUnlocked(id, target, source, unboundRetired);
+        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source, unboundStopped))
+        : closeOwnedSessionUnlocked(id, target, source, unboundStopped);
 }
 export const closeSession = (id, rawSource) => {
     const source = normalizeCloseSource(rawSource);
@@ -4229,7 +4868,7 @@ export async function quarantineCorruptRecord(id, rawWitness) {
         const git = await proveQuarantineGitAbsent(id, witness);
         const adapter = await proveQuarantineAdapter(id, witness);
         const bundle = join(quarantineRoot(id), `${observedAt.replace(/[:.]/g, '-')}-${randomUUID()}`);
-        const stored = join(bundle, 'session.json');
+        const stored = join(bundle, 'runtime.json');
         const provenance = join(bundle, 'provenance.json');
         const audit = {
             version: 1,
@@ -4279,10 +4918,10 @@ export async function restoreQuarantinedRecord(id) {
                 throw new ResourceConflict(`refusing to restore ${id}: no quarantine bundle exists`);
             throw new ResourceConflict(`refusing to restore ${id}: quarantine bundle inventory is unreadable`);
         }
-        const bundle = bundles.map((name) => join(quarantineRoot(id), name)).find((path) => existsSync(join(path, 'session.json')) && existsSync(join(path, 'provenance.json')));
+        const bundle = bundles.map((name) => join(quarantineRoot(id), name)).find((path) => existsSync(join(path, 'runtime.json')) && existsSync(join(path, 'provenance.json')));
         if (!bundle)
             throw new ResourceConflict(`refusing to restore ${id}: no complete quarantine bundle exists`);
-        const stored = join(bundle, 'session.json');
+        const stored = join(bundle, 'runtime.json');
         let provenance;
         try {
             provenance = JSON.parse(readFileSync(join(bundle, 'provenance.json'), 'utf8'));
@@ -4486,6 +5125,7 @@ export function formatTable(sessions, color = true, scope = { kind: 'sessions' }
     });
     return [heading, header, ...rows, statusLegend(color)].join('\n');
 }
+export const EMPTY_PROMPT_ERROR = 'empty prompt — nothing to dispatch';
 class StrandedDeliveryError extends Error {
 }
 async function strandedDeliveryError(rec) {
@@ -4495,88 +5135,166 @@ async function strandedDeliveryError(rec) {
     const transport = await h.deliveryTransport({ ...rec, runtimeDir: runtimeRoot() });
     if (transport.kind !== 'unreachable' || agentAlive(rec.session) !== true)
         return null;
-    const queued = pendingMessages(rec.session).length;
+    const application = configuredSessionApplicationIfCutover();
+    const queued = application?.readPendingMessages(rec.session).length ?? 0;
     const noun = queued === 1 ? 'message is' : 'messages are';
     return new StrandedDeliveryError(`session ${rec.session} is stranded: ${transport.reason} while its registered agent process is still alive; ${queued} queued ${noun} waiting with no transport to claim them. Use \`spex session send ${rec.session} --keys "<keys>"\` to steer the live tmux pane, then repair the control transport before sending text.`);
 }
 export async function sendText(id, text, from, opts = {}) {
-    if (!text)
-        return { ok: false, error: 'empty prompt — nothing to dispatch' };
-    let replayed = false;
-    try {
-        // Taking a declared sender's record lock makes close a real outgoing fence even across backend processes:
-        // a send either appends before close obtains the fence (and close's revocation voids its debt), or sees
-        // the terminal marker before it records anything. Arbitrary legacy `from` values keep working; they just
-        // name an otherwise-unused lock until a matching session is closed.
-        let rec = null;
-        const accepted = await acceptMessage({
-            target: id,
-            text,
-            from,
-            idempotency: opts.idempotency,
-            validate: async () => {
-                rec = readRecord(id);
-                if (!rec)
-                    throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
-            },
-            prepare: async () => {
-                await opts.acceptGuard?.(rec);
-                const stranded = await strandedDeliveryError(rec);
-                if (stranded)
-                    throw stranded;
-                // Composed at ACCEPT time, once: the log keeps the raw conversational text plus the effective reply channel,
-                // the queue keeps the transport form. Composing again at handover would let a later send change the hints on
-                // a message that was already accepted.
-                const prompt = await composeSessionPrompt(text, rec, { from, replyVia: opts.replyVia });
-                return { text: prompt.text, ...(prompt.replyVia ? { replyVia: prompt.replyVia } : {}) };
-            },
-        });
-        replayed = accepted.replayed;
-    }
-    catch (error) {
-        const code = error?.code;
-        const detail = error instanceof StrandedDeliveryError
-            ? error.message
-            : `could not append the message to session ${id}'s log: ${error instanceof Error ? error.message : String(error)} — prompt NOT delivered`;
+    if (!text.trim())
+        return { ok: false, error: EMPTY_PROMPT_ERROR };
+    const application = configuredSessionApplicationIfCutover();
+    if (application) {
+        let message;
+        let replayed = false;
+        try {
+            const rec = readRecord(id);
+            if (!rec)
+                throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
+            await opts.acceptGuard?.(rec);
+            const prompt = await composeSessionPrompt(text, rec, { from, replyVia: opts.replyVia });
+            const idempotencyKey = opts.idempotency?.requestDigest ?? (opts.deliveryKey?.trim() || null);
+            const existing = idempotencyKey
+                ? application.readMessageHistory(id).find(message => message.idempotencyKey === idempotencyKey)
+                : undefined;
+            message = existing ?? application.enqueueConversationMessage(id, {
+                kind: 'session.prompt.v1',
+                body: Buffer.from(prompt.text, 'utf8'),
+                senderSessionId: from ?? null,
+                idempotencyKey,
+            }, { text, from: from ?? null, ...(prompt.replyVia ? { replyVia: prompt.replyVia } : {}) });
+            replayed = !!existing;
+        }
+        catch (error) {
+            return { ok: false, error: `could not append the message to session ${id}'s application queue: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        // Acceptance and handover are separate boundaries. A committed SQLite message remains a successful
+        // command even when the runtime is currently unbound; binding/resume is the explicit event that makes
+        // the durable debt drainable. Reporting the post-commit refusal as an append failure made command-box
+        // callers show a false error despite the prompt already being safely queued.
+        if (!opts.deferDrain) {
+            try {
+                await drainSession(id);
+            }
+            catch (error) {
+                if (!(error instanceof ResourceConflict) || !/no bound spex-governed runtime/u.test(error.message))
+                    throw error;
+            }
+        }
+        const pending = application.readPendingMessages(id).some(candidate => candidate.messageId === message.messageId);
+        // Queue acceptance is not runtime activity. A prompt remains owed while the adapter is unbound,
+        // restarting, or refusing the insert; only the handoff that removes this exact message may re-enter
+        // a waiting session as active. This keeps a queued command from painting a dead pane as working.
+        if (!from && !pending)
+            markHumanPromptActive(id);
+        // @@@ a deferred drain measured NOTHING, and must not be reported as a refusal.
+        // `pending` is read microseconds after the enqueue with no await in between, so when the drain was
+        // deferred it is answering "did I skip the handover" — always yes — rather than "did the adapter refuse".
+        // Reporting that as `queued` made every first Command Box send claim the transport was still owed while
+        // the prompt was in fact in the agent's pane milliseconds later, and the claim was UNCONDITIONAL: no
+        // transport state, harness, or runtime binding could change it. Name the deferral instead, so the one
+        // caller that defers can say "accepted, handover in flight" and the callers that DO drain keep a
+        // `queued` that still means what it says.
         return {
-            ok: false,
-            error: detail,
-            ...(code ? { code } : {}),
+            ok: true,
+            delivery: opts.deferDrain ? 'deferred' : pending ? 'queued' : 'accepted',
+            ...(opts.idempotency || opts.deliveryKey ? { replayed } : {}),
         };
     }
-    // Awaited, not fire-and-forget: an unawaited insert can lose its race with a short-lived caller's exit,
-    // costing that send its same-turn arrival. Draining HERE rather than leaving it to the sweep is what puts
-    // the text in a live agent's current turn instead of up to one tick later.
-    if (!opts.deferDrain)
-        await drainSession(id);
-    return { ok: true, ...(opts.idempotency ? { replayed } : {}) };
+    throw new ResourceConflict('session application is unavailable; refusing the legacy delivery path');
 }
 // @@@ drainSession - hand over what this session is owed, as ordinary prompts. Safe to call from anywhere and
 // at any time: the queue's own lock serializes concurrent passes, and an empty queue costs one existsSync.
 // The retry sweep in `serve` calls this for the sessions whose queues an earlier pass could not empty.
 export async function drainSession(id) {
-    if (!owesDelivery(id))
-        return;
-    const rec = readRecord(id);
-    if (!rec)
-        return;
-    const h = harnessById(rec.harness || defaultHarness.id);
-    if (h.launchPayloadProof && !rec.harnessSessionId)
-        return;
-    await drain(id, async (msg) => {
-        // the pane guard ([[harness-adapter]] deliveryBlockedBy): the ONE pane state where the harness swallows a
-        // prompt its channel confirms (claude's sessions panel), checkable only from the pane. Treated as a REFUSAL
-        // rather than a skip — the message stays owed and the sweep hands it over once the pane leaves that state.
-        if (h.deliveryBlockedBy) {
-            try {
-                if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
-                    return false;
+    const application = configuredSessionApplicationIfCutover();
+    if (application) {
+        const rec = readRecord(id);
+        if (!rec)
+            return;
+        // An empty canonical queue is a successful no-op. Do not turn a resume with no owed prompt into a
+        // runtime-binding error; require a bound adapter only when there is a message that must be handed over.
+        if (application.readPendingMessages(id).length === 0)
+            return;
+        const h = harnessById(rec.harness || defaultHarness.id);
+        const binding = application.resolveRuntime(id, 'spex-governed');
+        if (!binding || binding.status !== 'bound') {
+            // Leaf adapters own their per-session controller and can deliver without a shared native identity.
+            // Preserve the governed transport while that identity is absent, then acknowledge the same canonical
+            // queue directly. Shared adapter runtimes (Codex) remain fail-closed until their exact binding exists.
+            const leafWithoutNativeIdentity = !rec.harnessSessionId && (rec.harness === 'claude' || h.runtimeOwnership === 'leaf');
+            if (leafWithoutNativeIdentity) {
+                await withDeliveryLocks([id], async () => {
+                    for (;;) {
+                        const pending = application.readPendingMessages(id);
+                        const msg = pending[0];
+                        if (!msg)
+                            return;
+                        const text = canonicalMessageText(msg, rec);
+                        if (h.deliveryBlockedBy) {
+                            try {
+                                if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
+                                    return;
+                            }
+                            catch { /* no pane to consult — let the adapter decide */ }
+                        }
+                        const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.messageId }, text);
+                        if (!delivered.ok)
+                            return;
+                        const removed = application.dequeuePendingMessage(id, msg.messageId);
+                        if (!removed || removed.messageId !== msg.messageId)
+                            throw new ResourceConflict(`canonical queue head changed while delivering ${id}`);
+                    }
+                });
+                return;
             }
-            catch { /* no pane to consult — let the insert itself decide */ }
+            throw new ResourceConflict(`canonical delivery for ${id} remains pending: no bound spex-governed runtime`);
         }
-        const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.mid }, msg.text);
-        return delivered.ok;
-    });
+        await withDeliveryLocks([id], async () => {
+            for (;;) {
+                const pending = application.readPendingMessages(id);
+                const msg = pending[0];
+                if (!msg)
+                    return;
+                const text = canonicalMessageText(msg, rec);
+                if (h.deliveryBlockedBy) {
+                    try {
+                        if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
+                            return;
+                    }
+                    catch { /* no pane to consult — let the adapter decide */ }
+                }
+                const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.messageId }, text);
+                if (!delivered.ok)
+                    return;
+                const removed = application.dequeueForRuntime(id, 'spex-governed', binding.bindingGeneration, msg.messageId);
+                if (!removed || removed.messageId !== msg.messageId)
+                    throw new ResourceConflict(`canonical queue head changed while delivering ${id}`);
+            }
+        });
+        return;
+    }
+    throw new ResourceConflict('session application is unavailable; refusing the legacy delivery path');
+}
+// `recipient` is the session this text is delivered TO; a state message speaks about its `sessionId`, the
+// watched subject, and the notice must name that subject — never the reader of the notice.
+export function canonicalMessageText(message, recipient) {
+    if (message.kind === 'session.prompt.v1')
+        return Buffer.from(message.body).toString('utf8');
+    if (message.kind === 'session.state.changed.v1') {
+        try {
+            const change = JSON.parse(Buffer.from(message.body).toString('utf8'));
+            if (typeof change.sessionId !== 'string' || !change.sessionId)
+                throw new ResourceConflict(`canonical state message delivered to ${recipient.session} names no subject session`);
+            return watchMessage({ ...recipient, session: change.sessionId, status: (change.status ?? recipient.status), proposal: change.proposal ?? null, note: change.note ?? null, parent: change.parentSessionId ?? null });
+        }
+        catch (error) {
+            if (error instanceof ResourceConflict)
+                throw error;
+            throw new ResourceConflict(`canonical state message for ${recipient.session} is not valid JSON`);
+        }
+    }
+    throw new ResourceConflict(`canonical message kind ${message.kind} cannot be delivered as session text`);
 }
 // Hard interrupt is adapter-native control, distinct from stop's process teardown. A harness without a
 // confirmed native primitive refuses loudly; there is no signal/PTY fallback that could target the wrong turn.
@@ -4650,7 +5368,7 @@ function rawKeyArgs(id, key) {
 // (browser + server + send-keys all parallel) and scramble the sequence; a single serialised batch cannot.
 // An unknown token is skipped without dropping the rest; false only if the tmux session is gone or nothing sent.
 export async function rawKey(id, key) {
-    return withRecordLock(id, async () => {
+    const sent = await withRecordLock(id, async () => {
         const list = (Array.isArray(key) ? key : [key]).filter((k) => typeof k === 'string' && k.length > 0);
         if (list.length === 0 || !(await alive(id)))
             return false;
@@ -4664,4 +5382,7 @@ export async function rawKey(id, key) {
         }
         return sent;
     });
+    // Raw-key remote control is transport fallback, not a lifecycle event. Freshness belongs to the
+    // harness turn hooks or a successfully handed-over durable prompt; navigation keys cannot forge working.
+    return sent;
 }