botmux 3.10.0 → 3.11.0

package/dist/core/worker-pool.js

@@ -7,7 +7,7 @@ import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { readFileSync, readdirSync, mkdirSync, existsSync, realpathSync, unlinkSync } from 'node:fs';
 import { atomicWriteFileSync } from '../utils/atomic-write.js';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { ensureSkills, ensureAskSkill, ensurePluginSkills, ensureWhiteboardSkill, removeGlobalBotmuxSkills } from '../skills/installer.js';
 import { shouldInstallGlobalSkills } from '../skills/injection-mode.js';
 import { whiteboardEnabled } from '../services/whiteboard-store.js';
@@ -20,12 +20,12 @@ import * as sessionStore from '../services/session-store.js';
 import * as asyncTriggerStore from '../services/async-trigger-store.js';
 import { markMessageListenerRunPreviewFailed, markMessageListenerRunPreviewReplied, markMessageListenerRunPreviewRunning, } from '../services/message-listener-run-preview-store.js';
 import { persistStreamCardState, rememberLastCliInput } from './session-manager.js';
-import { fallbackTurnId, isSubstituteTurn } from './reply-target.js';
+import { fallbackTurnId, frozenReplyContextForTurn, isSubstituteTurn } from './reply-target.js';
 import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, getMessageChatId, MessageWithdrawnError } from '../im/lark/client.js';
 import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildTuiPromptFailedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { codexServiceTierBadge } from '../services/codex-service-tier.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
-import { hashUrlForLog, cancelRiffTaskById } from '../adapters/backend/riff-backend.js';
+import { hashUrlForLog } from '../adapters/backend/riff-backend.js';
 import { logger } from '../utils/logger.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
 import { resolveCliRuntime, runtimeInstallationKey, runtimePathOverride, snapshotCliRuntime, } from '../adapters/cli/runtime.js';
@@ -44,7 +44,8 @@ import { ZmxBackend } from '../adapters/backend/zmx-backend.js';
 import { backendSupportsWebTerminal } from '../adapters/backend/capabilities.js';
 import { sandboxEnabled } from '../adapters/backend/sandbox.js';
 import { isStrongManagedHerdrAgentName, managedHerdrAgentName, } from '../adapters/backend/session-backend-selector.js';
-import { isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
+import { isRiffBackendSession, isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
+import { withBotTurnMutation } from './bot-turn-mutation-gate.js';
 import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, resolveUsageDisplay } from '../bot-registry.js';
 import { RestartCoordinator } from './restart-coordinator.js';
 import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
@@ -55,6 +56,11 @@ const DAEMON_BOOT_ID = randomUUID();
 const restartCoordinator = new RestartCoordinator();
 const lifecycleRetiringWorkers = new WeakMap();
 const transferRetiringWorkers = new WeakSet();
+/** 在完整 Worker 模块加载前接住首条 IPC，避免冷启动耗时被误判为投递失败。 */
+function workerForkExecArgv() {
+    const preloadPath = join(__dirname, '..', 'worker-ipc-preload.js');
+    return [...process.execArgv, '--import', pathToFileURL(preloadPath).href];
+}
 function trackLifecycleRetirement(ds, worker) {
     let workers = lifecycleRetiringWorkers.get(ds);
     if (!workers) {
@@ -163,15 +169,37 @@ export function getDaemonReplyCardUsageSnapshot(ds, effectiveCliId) {
  * boundaries (turn end / idle); intra-turn ticks leave it false to ride the
  * reader's reparse throttle and stay off the disk. */
 export function getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, opts) {
+    // Runtime identity is derived from in-memory fields only, so it is available
+    // without reading the transcript. The disk read (getDaemonSessionUsageSnapshot)
+    // is deferred until we know usage will actually render — a footer/off bot must
+    // not pay a per-tick transcript parse just to throw the tokens away.
+    const runtimeModel = ds.activeModel?.trim() || ds.session.model?.trim();
+    const reasoningEffort = ds.activeReasoningEffort?.trim()
+        || ds.session.reasoningEffort?.trim();
     try {
         if (resolveUsageDisplay(ds.larkAppId) !== 'streaming') {
-            return { context: null, tokens: null };
+            return {
+                context: null,
+                tokens: null,
+                ...(runtimeModel ? { model: runtimeModel } : {}),
+                ...(reasoningEffort ? { reasoningEffort } : {}),
+            };
         }
     }
     catch {
         // Missing runtime config → default 'streaming' → show usage (best-effort).
     }
-    return getDaemonSessionUsageSnapshot(ds, effectiveCliId, { fresh: opts?.fresh ?? false });
+    const snapshot = getDaemonSessionUsageSnapshot(ds, effectiveCliId, { fresh: opts?.fresh ?? false });
+    // Model comes only from an explicitly-wired executor runtime (TRAE/Codex set
+    // ds.activeModel from their rollout settings) or the user-configured launch
+    // model — never snapshot.tokens.model. That field is the RAW transcript model
+    // and for relay-style CLIs is an internal routing code (e.g. `ark/relay-code`)
+    // that must not surface on a user card.
+    return {
+        ...snapshot,
+        ...(runtimeModel ? { model: runtimeModel } : {}),
+        ...(reasoningEffort ? { reasoningEffort } : {}),
+    };
 }
 import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { dashboardEventBus } from './dashboard-events.js';
@@ -182,7 +210,9 @@ import { emitSessionLifecycleHook, emitSessionStateTransitionHook } from '../ser
 import { anchorUsageForDaemonSession, recordOwnershipForDaemonSession, recordUsageForDaemonSession, reconcileUsageForDaemonSession } from '../services/usage-ledger.js';
 import { isStructuredBridgeAdoptCli } from '../services/structured-bridge-clis.js';
 import { ensureGatewayEntry } from './plugins/mcp/gateway-installer.js';
-import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, isDocNativeSession, larkTransportEnabled } from './types.js';
+import { appendAcceptedCodexAppDispatch, cancelCodexAppDispatch, committedCodexAppSequence, hasUnsettledCodexAppDispatch, prepareCodexAppDispatch, retryPreparedCodexAppDispatch, retainFreshCodexAppGeneration, settleCodexAppDispatch, } from '../utils/codex-app-dispatch-ledger.js';
+import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, isDocNativeSession, larkTransportEnabled, riffRetirementAdmissionPhase, } from './types.js';
+import { hasProtectedSessionMutationOwnership } from './session-mutation-guard.js';
 import { DONE_REACTION_EMOJI_TYPE } from './pending-response.js';
 import { buildTerminalUrl } from './terminal-url.js';
 import { prependBotmuxBin, resolveBotmuxWrapperBinDir } from './botmux-wrapper.js';
@@ -203,6 +233,9 @@ import { buildBotmuxLarkNativeSessionTitle, extractBotmuxLarkNativeSessionTitleP
 import { acknowledgeSessionReady } from './session-ready-handshake.js';
 import { recordDispatchInputCommit } from './dispatch.js';
 import { sendWorkerIpc } from './worker-ipc.js';
+import { cleanupExplicitSessionBacking } from './explicit-session-backing-cleanup.js';
+import { RIFF_ADMISSION_RESTORE_TIMEOUT_MS } from './shutdown-budgets.js';
+import { managedOriginCapabilityPath, replaceManagedOriginCapabilityFile, } from './managed-origin-capability.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const WORKER_SIGTERM_BACKSTOP_MS = 2_000;
@@ -273,6 +306,7 @@ function requireCallbacks() {
 // daemon registers its Map here at boot. Helpers below return a snapshot or
 // linear-scan by sessionId.
 let activeSessionsRegistry;
+const pendingRiffWorkerCloses = new Map();
 export function setActiveSessionsRegistry(m) {
     activeSessionsRegistry = m;
 }
@@ -449,6 +483,38 @@ function flushPendingLocalCliOpenReadinessPatch(ds) {
     ds.pendingLocalCliButtonRefresh = undefined;
     scheduleLocalCliOpenReadinessPatch(ds);
 }
+/** PATCH the live card when the executor reports a different active runtime.
+ * Runtime identity stays attached to the streaming usage line. */
+function scheduleActiveRuntimePatch(ds) {
+    if (ds.session.vcMeetingReceiver || streamingCardDisabled(ds) || ds.suppressRecoveryCard) {
+        ds.pendingActiveRuntimeCardRefresh = undefined;
+        return;
+    }
+    if (ds.streamCardNonce && ds.parkedStreamCardNonce === ds.streamCardNonce) {
+        ds.pendingActiveRuntimeCardRefresh = undefined;
+        return;
+    }
+    if (ds.streamCardId === CARD_POSTING_SENTINEL) {
+        ds.pendingActiveRuntimeCardRefresh = true;
+        return;
+    }
+    if (!ds.streamCardId || !workerHasInitialized(ds)) {
+        ds.pendingActiveRuntimeCardRefresh = undefined;
+        return;
+    }
+    ds.pendingActiveRuntimeCardRefresh = undefined;
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const status = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || sessionCliDisplayName(ds, botCfg), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
+    scheduleCardPatch(ds, cardJson);
+}
+function flushPendingActiveRuntimePatch(ds) {
+    if (!ds.pendingActiveRuntimeCardRefresh)
+        return;
+    ds.pendingActiveRuntimeCardRefresh = undefined;
+    scheduleActiveRuntimePatch(ds);
+}
 /** PATCH a live card when rollout settings change, even if the PTY is static. */
 function scheduleCodexServiceTierPatch(ds) {
     if (ds.session.vcMeetingReceiver || streamingCardDisabled(ds) || ds.suppressRecoveryCard) {
@@ -977,6 +1043,7 @@ export async function postFreshStreamingCard(ds, sessionReply) {
         recallFrozenCards(ds);
         flushPendingLocalCliOpenReadinessPatch(ds);
         flushPendingRiffUrlPatch(ds);
+        flushPendingActiveRuntimePatch(ds);
         flushPendingCodexServiceTierPatch(ds);
         // Manual /card during a working turn lands a live card whose subsequent
         // screen_updates are working→working (no status edge) — arm the periodic
@@ -991,6 +1058,7 @@ export async function postFreshStreamingCard(ds, sessionReply) {
         ds.streamCardPending = prevPending;
         flushPendingLocalCliOpenReadinessPatch(ds);
         flushPendingRiffUrlPatch(ds);
+        flushPendingActiveRuntimePatch(ds);
         flushPendingCodexServiceTierPatch(ds);
         // Rolled back to the prior card identity — re-sync so a restored still-live
         // working card keeps (or resumes) its refresh rather than losing the timer.
@@ -1335,6 +1403,31 @@ function flushCardPatch(ds) {
         }
     });
 }
+/** Root withdrawal is not an explicit abandon boundary. Preserve a Codex App
+ * owner (including its live worker) while any durable FIFO entry is unsettled;
+ * only ledger-empty sessions retain the historical stale-root auto-close. */
+async function closeWithdrawnSessionIfLedgerEmpty(ds, context) {
+    if (hasProtectedSessionMutationOwnership(ds)) {
+        logger.warn(`[${tag(ds)}] ${context}; preserving session because Codex App dispatch is unsettled`);
+        return false;
+    }
+    logger.warn(`[${tag(ds)}] ${context}; closing ledger-empty stale session`);
+    // The callback routes through the authoritative async closeSession helper;
+    // never pre-kill a worker before that helper settles its backend boundary.
+    try {
+        const closed = await requireCallbacks().closeSession(ds);
+        if (closed === false) {
+            logger.warn(`[${tag(ds)}] ${context}; authoritative close failed, session retained for retry`);
+            return false;
+        }
+        return true;
+    }
+    catch (err) {
+        logger.warn(`[${tag(ds)}] ${context}; authoritative close threw, session retained for retry: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
 // ─── Restart rate-limiting ──────────────────────────────────────────────────
 export const restartCounts = new Map();
 // ─── Skills installation ────────────────────────────────────────────────────
@@ -1519,7 +1612,18 @@ export function ensureClaudeFolderTrust(workingDir, stateJsonPath = join(homedir
     }
 }
 // ─── Kill worker ────────────────────────────────────────────────────────────
-export function killWorker(ds) {
+export function killWorker(ds, opts = {}) {
+    const closeFrozenType = ds.initConfig?.backendType ?? ds.session.backendType;
+    if (ds.worker && !ds.worker.killed
+        && closeFrozenType === 'riff'
+        && !opts.riffCloseCommitRequestId) {
+        // A generic synchronous retirement cannot safely detach Riff. An accepted
+        // create/follow-up may still be waiting for the task id that becomes the
+        // only durable lineage anchor.
+        logger.error(`[${tag(ds)}] Refused unprepared live Riff worker retirement; `
+            + 'preserving worker and remote-task lineage');
+        return;
+    }
     restartCoordinator.cancelSession(ds.session.sessionId);
     clearUsageLimitState(ds);
     ds.workerReady = false;
@@ -1543,12 +1647,28 @@ export function killWorker(ds) {
         // session would leave an orphaned CLI running in tmux that still replies.
         // Destroy the backing session directly here so /close always terminates it.
         destroyOrphanedBackingSession(ds);
+        if (opts.riffCloseCommitRequestId
+            && ds.riffCloseState?.requestId === opts.riffCloseCommitRequestId) {
+            ds.riffCloseState = undefined;
+        }
         return;
     }
     try {
-        ds.worker.send({ type: 'close' });
+        if (opts.riffCloseCommitRequestId) {
+            ds.worker.send({
+                type: 'close_commit',
+                requestId: opts.riffCloseCommitRequestId,
+            });
+        }
+        else {
+            ds.worker.send({ type: 'close' });
+        }
     }
     catch { /* IPC already closed */ }
+    if (opts.riffCloseCommitRequestId
+        && ds.riffCloseState?.requestId === opts.riffCloseCommitRequestId) {
+        ds.riffCloseState = undefined;
+    }
     const w = ds.worker;
     trackLifecycleRetirement(ds, w);
     armCloseFence(ds, w);
@@ -1556,7 +1676,6 @@ export function killWorker(ds) {
     // 外层 race 8s）。默认 2s SIGTERM backstop 会在取消发出前掐死进程，已关闭话题
     // 的远端任务照跑——冻结为 riff 的会话放宽到 24s（层级：destroy 20s < worker 22s
     // < SIGTERM 24s < SIGKILL 29s；正常路径 worker 自行 exit，不会等满）。
-    const closeFrozenType = ds.initConfig?.backendType ?? ds.session.backendType;
     armWorkerKillBackstop(w, tag(ds), closeFrozenType === 'riff' ? 24_000 : WORKER_SIGTERM_BACKSTOP_MS);
     ds.worker = null;
     ds.workerPort = null;
@@ -1840,24 +1959,15 @@ function destroyOrphanedBackingSession(ds) {
     if (ds.initConfig?.adoptMode || ds.adoptedFrom)
         return;
     reclaimParkedCrashDiagnostic(ds);
-    // riff：worker 已死时 /close 仍要取消持久化血缘指向的远端任务——否则已关闭
-    // 话题的远端 agent 继续拿着注入凭证发消息。fire-and-forget（内部有界+重试）。
+    // Riff cancellation is asynchronous and cannot be made safe from this
+    // synchronous best-effort helper. The authoritative closeSession path awaits
+    // cancellation before publishing the closed row and retains lineage on
+    // failure.
     const frozenType = ds.initConfig?.backendType ?? ds.session.backendType;
     if (frozenType === 'riff') {
-        const taskId = ds.session.riffParentTaskId;
-        if (taskId) {
-            try {
-                const riffCfg = getBot(ds.larkAppId).config.riff;
-                if (riffCfg?.baseUrl) {
-                    void cancelRiffTaskById(riffCfg, taskId).then((ok) => {
-                        if (ok)
-                            logger.info(`[${tag(ds)}] killWorker: orphan riff task ${taskId} cancelled`);
-                    });
-                }
-            }
-            catch { /* bot deregistered — nothing to cancel with */ }
-            ds.session.riffParentTaskId = undefined;
-            sessionStore.updateSession(ds.session);
+        if (ds.session.riffParentTaskId) {
+            logger.warn(`[${tag(ds)}] worker-less Riff teardown requires awaited explicit close; `
+                + `retaining task ${ds.session.riffParentTaskId} for retry`);
         }
         return;
     }
@@ -1872,6 +1982,266 @@ function destroyOrphanedBackingSession(ds) {
         logger.warn(`[${tag(ds)}] killWorker: failed to destroy orphaned ${backendType} backing session: ${err}`);
     }
 }
+async function abortLiveRiffWorkerClose(ds, requestId, opts = {}) {
+    if (ds.riffCloseState?.requestId !== requestId)
+        return false;
+    const worker = ds.worker;
+    if (!worker || worker.killed) {
+        if (opts.allowAbsentAfterProvenRestore) {
+            ds.riffCloseState = undefined;
+            return true;
+        }
+        ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+        return false;
+    }
+    const restored = await new Promise(resolve => {
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            worker.removeListener?.('message', onMessage);
+            worker.removeListener?.('exit', onExit);
+            resolve(result);
+        };
+        const onMessage = (raw) => {
+            const msg = raw;
+            if (msg?.type !== 'close_abort_result' || msg.requestId !== requestId)
+                return;
+            if (ds.worker !== worker) {
+                finish({ ok: false, error: 'stale_worker_generation' });
+                return;
+            }
+            finish({ ok: msg.ok, ...(msg.error ? { error: msg.error } : {}) });
+        };
+        const onExit = () => finish({
+            ok: false,
+            error: 'worker_exited_before_close_abort_result',
+        });
+        const timer = setTimeout(() => finish({ ok: false, error: 'close_abort_result_timeout' }), RIFF_ADMISSION_RESTORE_TIMEOUT_MS);
+        timer.unref?.();
+        worker.on?.('message', onMessage);
+        worker.once?.('exit', onExit);
+        try {
+            worker.send({ type: 'close_abort', requestId });
+        }
+        catch (err) {
+            finish({ ok: false, error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    if (restored.ok && ds.riffCloseState?.requestId === requestId) {
+        ds.riffCloseState = undefined;
+        return true;
+    }
+    if (opts.allowAbsentAfterProvenRestore
+        && ds.riffCloseState?.requestId === requestId) {
+        ds.riffCloseState = undefined;
+        return true;
+    }
+    if (ds.riffCloseState?.requestId === requestId) {
+        ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+    }
+    logger.warn(`[${tag(ds)}] Riff close abort was not acknowledged (${restored.error ?? 'unknown'}); `
+        + 'retaining admission fence pending explicit lineage reconciliation');
+    return false;
+}
+async function prepareLiveRiffWorkerClose(ds) {
+    const worker = ds.worker;
+    if (!worker || worker.killed) {
+        return { ok: false, error: 'riff_worker_close_failed', retryable: true };
+    }
+    if (ds.riffCloseState || ds.riffShutdownState) {
+        return {
+            ok: false,
+            error: 'riff_worker_close_failed',
+            retryable: true,
+            ...((ds.riffCloseState?.taskId ?? ds.riffShutdownState?.taskId)
+                ? { taskId: (ds.riffCloseState?.taskId ?? ds.riffShutdownState?.taskId) }
+                : {}),
+        };
+    }
+    const requestId = randomUUID();
+    ds.riffCloseState = {
+        phase: 'preparing',
+        requestId,
+        ...(ds.session.riffParentTaskId ? { taskId: ds.session.riffParentTaskId } : {}),
+    };
+    let matchedCloseResult = false;
+    const result = await new Promise((resolve) => {
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            worker.removeListener?.('exit', onExit);
+            pendingRiffWorkerCloses.delete(requestId);
+            resolve(value);
+        };
+        const onExit = () => finish({
+            ok: false,
+            error: 'worker_exited_before_close_result',
+        });
+        const timer = setTimeout(() => finish({ ok: false, error: 'worker_close_result_timeout' }), 23_000);
+        timer.unref?.();
+        worker.once?.('exit', onExit);
+        pendingRiffWorkerCloses.set(requestId, {
+            sessionId: ds.session.sessionId,
+            worker,
+            resolve: value => {
+                matchedCloseResult = true;
+                finish(value);
+            },
+        });
+        try {
+            worker.send({ type: 'close', requestId });
+        }
+        catch (err) {
+            finish({ ok: false, error: err instanceof Error ? err.message : String(err) });
+        }
+    });
+    const taskId = result.taskId ?? ds.session.riffParentTaskId;
+    if (result.taskId) {
+        ds.session.riffParentTaskId = result.taskId;
+        try {
+            sessionStore.updateSession(ds.session);
+        }
+        catch (err) {
+            await abortLiveRiffWorkerClose(ds, requestId);
+            logger.error(`[${tag(ds)}] Riff close lineage persistence failed; close aborted: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'riff_durable_close_failed',
+                retryable: true,
+                taskId: result.taskId,
+            };
+        }
+    }
+    if (!result.ok) {
+        await abortLiveRiffWorkerClose(ds, requestId, {
+            allowAbsentAfterProvenRestore: matchedCloseResult,
+        });
+        logger.warn(`[${tag(ds)}] Riff worker close prepare failed: ${result.error ?? 'unknown'}; `
+            + `session remains active${taskId ? ` (task ${taskId})` : ''}`);
+        return {
+            ok: false,
+            error: 'riff_worker_close_failed',
+            retryable: true,
+            ...(taskId ? { taskId } : {}),
+        };
+    }
+    ds.riffCloseState = {
+        phase: 'prepared',
+        requestId,
+        ...(taskId ? { taskId } : {}),
+    };
+    logger.info(`[${tag(ds)}] Riff worker close prepared and remote task cancellation confirmed`);
+    return { ok: true, ...(taskId ? { taskId } : {}) };
+}
+/** Await remote cancellation for any Riff owner before its durable row is
+ * closed. Live workers use prepare/commit; worker-less rows cancel their exact
+ * persisted task through current authoritative bot config. */
+async function prepareRiffExplicitClose(ds, stored) {
+    const session = ds?.session ?? stored;
+    if (!session)
+        return { ok: true };
+    const backendType = ds?.initConfig?.backendType ?? session.backendType;
+    const taskId = session.riffParentTaskId;
+    if (ds?.riffShutdownState) {
+        const fencedTaskId = Object.prototype.hasOwnProperty.call(ds.riffShutdownState, 'taskId')
+            ? ds.riffShutdownState.taskId
+            : taskId;
+        return {
+            ok: false,
+            error: 'riff_shutdown_fence_in_progress',
+            retryable: true,
+            ...(typeof fencedTaskId === 'string' && fencedTaskId ? { taskId: fencedTaskId } : {}),
+        };
+    }
+    if (ds?.riffCloseState) {
+        return {
+            ok: false,
+            error: 'riff_close_reconciliation_required',
+            retryable: true,
+            ...(ds.riffCloseState.taskId ? { taskId: ds.riffCloseState.taskId } : {}),
+        };
+    }
+    if (backendType !== 'riff')
+        return { ok: true };
+    if (ds?.initConfig?.adoptMode || ds?.adoptedFrom || session.adoptedFrom)
+        return { ok: true };
+    if (ds?.worker && !ds.worker.killed) {
+        if (!stored || stored.status !== 'active') {
+            return {
+                ok: false,
+                error: 'riff_row_inconsistent',
+                retryable: true,
+                ...(taskId ? { taskId } : {}),
+            };
+        }
+        return prepareLiveRiffWorkerClose(ds);
+    }
+    const durableBefore = sessionStore.getSession(session.sessionId);
+    if (ds && durableBefore
+        && ds.session.riffParentTaskId !== durableBefore.riffParentTaskId) {
+        const authoritativeTaskId = durableBefore.riffParentTaskId ?? ds.session.riffParentTaskId;
+        logger.warn(`[${tag(ds)}] explicit close refused before cancellation: runtime/durable Riff lineage differs `
+            + `(${ds.session.riffParentTaskId ?? 'none'}/${durableBefore.riffParentTaskId ?? 'none'})`);
+        return {
+            ok: false,
+            error: 'riff_task_changed',
+            retryable: true,
+            ...(authoritativeTaskId ? { taskId: authoritativeTaskId } : {}),
+        };
+    }
+    if (!taskId)
+        return { ok: true };
+    let riffConfig;
+    const larkAppId = ds?.larkAppId ?? session.larkAppId;
+    try {
+        if (larkAppId)
+            riffConfig = getBot(larkAppId).config.riff;
+    }
+    catch { /* bot removed */ }
+    const cleanup = await cleanupExplicitSessionBacking({
+        sessionId: session.sessionId,
+        backendType,
+        riffParentTaskId: taskId,
+        riffConfig,
+    });
+    const closeLabel = ds ? tag(ds) : session.sessionId.slice(0, 8);
+    if (!cleanup.ok) {
+        logger.warn(`[${closeLabel}] explicit close refused: ${cleanup.kind}; `
+            + `Riff task ${taskId} remains active and retryable`);
+        return {
+            ok: false,
+            error: cleanup.kind === 'riff_config_missing' ? 'riff_config_missing' : 'riff_cancel_failed',
+            retryable: true,
+            taskId,
+        };
+    }
+    if (cleanup.kind !== 'cancelled_riff')
+        return { ok: true };
+    const latest = sessionStore.getSession(session.sessionId);
+    const latestTaskId = latest?.riffParentTaskId;
+    const runtimeTaskId = ds?.session.riffParentTaskId;
+    if (!latest || latest.status !== 'active' || latestTaskId !== cleanup.taskId
+        || (ds && runtimeTaskId !== cleanup.taskId)) {
+        logger.warn(`[${closeLabel}] explicit close cancelled stale Riff task ${cleanup.taskId}, `
+            + `but runtime/durable lineage or status changed to `
+            + `${runtimeTaskId ?? 'none'}/${latestTaskId ?? 'none'}/${latest?.status ?? 'missing'}; retry required`);
+        return {
+            ok: false,
+            error: 'riff_task_changed',
+            retryable: true,
+            taskId: latestTaskId ?? runtimeTaskId ?? cleanup.taskId,
+        };
+    }
+    logger.info(`[${closeLabel}] Riff task ${cleanup.taskId} cancellation prepared for explicit close`);
+    return { ok: true, taskId: cleanup.taskId };
+}
 /**
  * Reclaim a session's parked crash-diagnostic shell (`bmx-diag-<sid>`) and its
  * captured `.ansi` file. The worker normally tears these down itself (killCli /
@@ -1893,6 +2263,10 @@ function reclaimParkedCrashDiagnostic(ds) {
     catch { /* absent — benign */ }
 }
 export function suspendWorker(ds, reason = 'suspended_idle') {
+    if (hasProtectedSessionMutationOwnership(ds)) {
+        logger.warn(`[${tag(ds)}] Refused worker suspend (${reason}) while Codex App dispatch ownership is non-empty`);
+        return false;
+    }
     if (isSessionTransferring(ds)) {
         logger.warn(`[${tag(ds)}] Suspend refused while routing transfer is in progress`);
         return false;
@@ -2154,14 +2528,6 @@ function teardownAuthoritativePersistentBackingBeforeCloseImpl(target, closeWins
 export function teardownAuthoritativePersistentBackingBeforeClose(target) {
     teardownAuthoritativePersistentBackingBeforeCloseImpl(target, false);
 }
-/**
- * Idempotent close: kill worker if alive, mark Session status='closed' + closedAt,
- * publish session.exited (if a live worker was killed) and session.update
- * (if the persistence row transitioned to closed).
- *
- * Calling this on an unknown sessionId, an already-closed session, or a session
- * whose worker died asynchronously must still resolve with `{ ok: true }`.
- */
 export async function closeSession(sessionId) {
     const ds = findActiveBySessionId(sessionId);
     const stored = sessionStore.getOwnedSession(sessionId);
@@ -2171,10 +2537,11 @@ export async function closeSession(sessionId) {
     if (teardownTarget) {
         teardownAuthoritativePersistentBackingBeforeCloseImpl(teardownTarget, true);
     }
+    const isOwnedRiffClose = !ds?.initConfig?.adoptMode
+        && !ds?.adoptedFrom
+        && !stored?.adoptedFrom
+        && (ds?.initConfig?.backendType ?? ds?.session.backendType ?? stored?.backendType) === 'riff';
     let killedLive = false;
-    // 会话关闭即可回收其崩溃重启计数；否则每个曾崩溃过的 session 会在 daemon
-    // 生命周期内永久占位（restartCounts 此前无任何 delete）。
-    restartCounts.delete(sessionId);
     const hadLiveWorker = !!ds?.worker && !ds.worker.killed;
     const closeWorkerGeneration = ds ? closeFenceGeneration(ds) : undefined;
     // Snapshot ownership + transition state before mutating the live object:
@@ -2183,6 +2550,26 @@ export async function closeSession(sessionId) {
     const wasOpen = !!stored && stored.status !== 'closed';
     const storedHadDocCommentTargets = Object.keys(stored?.docCommentTargets ?? {}).length > 0;
     const docReactionTargets = collectDocCommentReactionTargets(ds, stored);
+    if (ds) {
+        // Usage ledger: flush the final delta before the worker goes away (a
+        // crash/limited turn may never have reached an idle edge).
+        recordUsageForDaemonSession(ds);
+    }
+    // Riff owns a remote credential-bearing process. Prove cancellation before
+    // mutating routing, transient capabilities, or the durable row. Non-Riff
+    // closes retain master's synchronous state-transition path.
+    const prepared = isOwnedRiffClose
+        ? await prepareRiffExplicitClose(ds, stored)
+        : { ok: true };
+    if (!prepared.ok) {
+        return { ...prepared, alreadyClosed: false };
+    }
+    const preparedRiffRequestId = ds?.riffCloseState?.phase === 'prepared'
+        ? ds.riffCloseState.requestId
+        : undefined;
+    // 会话关闭即可回收其崩溃重启计数；否则每个曾崩溃过的 session 会在 daemon
+    // 生命周期内永久占位（restartCounts 此前无任何 delete）。
+    restartCounts.delete(sessionId);
     // Per-turn comment routes are transient capabilities. Clear them from both
     // live and owner-scoped persisted objects inside the synchronous close
     // critical section, before any best-effort Lark cleanup can yield.
@@ -2192,30 +2579,33 @@ export async function closeSession(sessionId) {
     if (stored && !wasOpen && storedHadDocCommentTargets) {
         sessionStore.updateSession(stored);
     }
-    if (ds) {
-        // Usage ledger: flush the final delta before the worker goes away (a
-        // crash/limited turn may never have reached an idle edge).
-        recordUsageForDaemonSession(ds);
-        killWorker(ds);
-        const activeKey = activeSessionKey(ds);
-        if (activeSessionsRegistry?.get(activeKey) === ds) {
-            activeSessionsRegistry.delete(activeKey);
-        }
-        // Mark the captured object too. Async message/card paths may already hold a
-        // reference to `ds`; deleting only the registry entry would not stop one of
-        // those continuations from re-forking the closed session after its await.
-        ds.session.status = 'closed';
-        ds.session.closedAt ??= new Date().toISOString();
-        killedLive = true;
-    }
     // Mutations are bot-owner scoped. getSession() has a read-only cross-file
     // fallback for agent CLI discovery, so it must not authorize close.
     if (wasOpen) {
-        if (!ds && stored)
+        if (!ds && stored && !isOwnedRiffClose)
             destroyUnregisteredPersistentBacking(stored);
-        sessionStore.closeSession(sessionId, {
-            cleanupBridgeMarkers: !hadLiveWorker,
-        });
+        try {
+            sessionStore.closeSession(sessionId, {
+                cleanupBridgeMarkers: !hadLiveWorker,
+                ...(isOwnedRiffClose ? { clearRiffParentTaskId: true } : {}),
+            });
+        }
+        catch (err) {
+            if (!isOwnedRiffClose)
+                throw err;
+            if (ds && preparedRiffRequestId) {
+                await abortLiveRiffWorkerClose(ds, preparedRiffRequestId);
+            }
+            logger.error(`[${sessionId.slice(0, 8)}] Durable session close failed after Riff prepare; `
+                + `worker admission restored: ${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                alreadyClosed: false,
+                error: 'riff_durable_close_failed',
+                retryable: true,
+                ...(prepared.taskId ? { taskId: prepared.taskId } : {}),
+            };
+        }
         const after = sessionStore.getOwnedSession(sessionId);
         if (ds) {
             ds.session.status = 'closed';
@@ -2223,6 +2613,23 @@ export async function closeSession(sessionId) {
         }
     }
     if (ds) {
+        killWorker(ds, {
+            ...(preparedRiffRequestId ? { riffCloseCommitRequestId: preparedRiffRequestId } : {}),
+        });
+        // A transferred/restored exact object may remain under more than one alias.
+        // Remove only identity matches, never a same-key successor.
+        if (activeSessionsRegistry) {
+            for (const [registeredKey, candidate] of activeSessionsRegistry) {
+                if (candidate === ds)
+                    activeSessionsRegistry.delete(registeredKey);
+            }
+        }
+        // Mark the captured object too. Async message/card paths may already hold a
+        // reference to `ds`; deleting only the registry entry would not stop one of
+        // those continuations from re-forking the closed session after its await.
+        ds.session.status = 'closed';
+        ds.session.closedAt ??= new Date().toISOString();
+        killedLive = true;
         if (!ds.exitEventEmitted) {
             ds.exitEventEmitted = true;
             dashboardEventBus.publish({
@@ -2327,23 +2734,62 @@ export function destroyUnregisteredPersistentBacking(session, kill = killPersist
         return false;
     }
 }
-/**
- * Compare-and-set an entry on an active-sessions Map. A different current
- * occupant always wins; callers must roll back the rejected incoming row.
- * Replaces bare `activeSessions.set(key, ds)` at sites where a silent overwrite
- * would leak the prior entry's worker + leave its store row stuck active.
- *
- * The Map is passed explicitly so callers operate on the same instance they
- * already hold (restoreActiveSessions takes the daemon's Map as a parameter;
- * transferSession reaches it through `activeSessionsRegistry`). In production
- * both refer to the same object — the daemon registers its Map at boot — but
- * decoupling avoids module-state assumptions in tests.
- *
- * Registration is compare-and-set: a different current occupant always wins.
- * The caller owns rollback of its rejected incoming row. This is deliberately
- * non-destructive because the occupant may be a fresh live session created
- * while an older async restore/create continuation was in flight.
- */
+const activeSessionKeyLocks = new WeakMap();
+/** Serialize asynchronous ownership decisions for one registry key. Ordinary
+ * bot turn admissions are intentionally concurrent, so a read/await/set helper
+ * is not a CAS unless every contender shares this lock. */
+export async function withActiveSessionKeyLock(map, key, action) {
+    let locks = activeSessionKeyLocks.get(map);
+    if (!locks) {
+        locks = new Map();
+        activeSessionKeyLocks.set(map, locks);
+    }
+    const previous = locks.get(key) ?? Promise.resolve();
+    let release;
+    const hold = new Promise(resolve => { release = resolve; });
+    const tail = previous.catch(() => { }).then(() => hold);
+    locks.set(key, tail);
+    await previous.catch(() => { });
+    try {
+        return await action();
+    }
+    finally {
+        release();
+        if (locks.get(key) === tail)
+            locks.delete(key);
+    }
+}
+async function closeUnregisteredCollisionLoser(map, loser) {
+    // Operate on exact object identity in the caller's registry. Looking up by
+    // session id through the daemon-global registry can conflate a non-global
+    // restore map (or a stale duplicate object) with an unrelated canonical
+    // owner and close the wrong generation.
+    const sameIdDifferentOwner = [...map.values()].some(candidate => candidate !== loser && candidate.session.sessionId === loser.session.sessionId)
+        || (!!activeSessionsRegistry && activeSessionsRegistry !== map
+            && [...activeSessionsRegistry.values()].some(candidate => candidate !== loser && candidate.session.sessionId === loser.session.sessionId));
+    if (sameIdDifferentOwner) {
+        logger.error(`[setActiveSessionSafe] refusing persistence close for ambiguous session id `
+            + `${loser.session.sessionId}; preserving every owner`);
+        return { ok: false, error: 'ambiguous_session_id' };
+    }
+    const stored = sessionStore.getSession(loser.session.sessionId);
+    try {
+        if (stored?.status !== 'closed') {
+            sessionStore.closeSession(loser.session.sessionId);
+        }
+    }
+    catch (err) {
+        logger.error(`[setActiveSessionSafe] durable loser close failed for ${loser.session.sessionId}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+        return { ok: false, error: 'durable_close_failed' };
+    }
+    killWorker(loser);
+    for (const [registeredKey, candidate] of map) {
+        if (candidate === loser)
+            map.delete(registeredKey);
+    }
+    return { ok: true };
+}
 function removeInactiveRegistration(map, key, ds) {
     if (ds.session.status === 'active')
         return false;
@@ -2385,6 +2831,22 @@ export function findQuarantinedRoutingConflict(key, larkAppId, candidateSessionI
         return undefined;
     }
 }
+/** Clear a durable quarantine marker once a live owner has claimed the route.
+ * Runtime ownership (the Map + lock) is authoritative for this process even if
+ * the persistence write fails; a later update or restore attempt converges the
+ * stale on-disk marker. */
+function clearRestoreQuarantineMarker(ds) {
+    if (!ds.session.restoreQuarantinedAt)
+        return;
+    delete ds.session.restoreQuarantinedAt;
+    try {
+        sessionStore.updateSession(ds.session);
+    }
+    catch (err) {
+        logger.warn(`[${tag(ds)}] Registered quarantined session but could not clear its persisted marker: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 /**
  * Synchronous registration gate for creation paths that previously used a
  * bare Map.set(). A daemon close can update the shared Session object while
@@ -2407,23 +2869,115 @@ export function setActiveSessionIfActive(map, key, ds) {
         return false;
     }
     map.set(key, ds);
-    if (ds.session.restoreQuarantinedAt) {
-        delete ds.session.restoreQuarantinedAt;
-        try {
-            sessionStore.updateSession(ds.session);
-        }
-        catch (err) {
-            // Runtime ownership is now authoritative and the Map prevents duplicates
-            // for this process. Keep running; a later persistence update (or the next
-            // restore attempt) will converge the stale on-disk marker.
-            logger.warn(`[${tag(ds)}] Registered quarantined session but could not clear its persisted marker: `
-                + `${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
+    clearRestoreQuarantineMarker(ds);
     return true;
 }
 export async function setActiveSessionSafe(map, key, ds) {
-    return setActiveSessionIfActive(map, key, ds);
+    const canonicalKey = activeSessionKey(ds);
+    if (canonicalKey !== key) {
+        throw new Error(`refusing noncanonical active-session registration: requested=${key} canonical=${canonicalKey}`);
+    }
+    return withActiveSessionKeyLock(map, key, async () => {
+        // Reboot-resume guard (master): a daemon close can flip the shared Session
+        // to a non-active status while an async creator/restore awaited Lark/project
+        // metadata. Never publish that now-inactive row back into the live map; drop
+        // only our exact stale object so a newer owner of the same key is untouched.
+        if (ds.session.status !== 'active') {
+            if (map.get(key) === ds)
+                map.delete(key);
+            logger.warn(`[setActiveSessionSafe] refusing to register inactive session `
+                + `${ds.session.sessionId.substring(0, 8)} (status=${ds.session.status})`);
+            return {
+                accepted: false,
+                reason: 'inactive_incoming',
+                keptSessionId: ds.session.sessionId,
+                preservedIncomingSessionId: ds.session.sessionId,
+            };
+        }
+        const prev = map.get(key);
+        if (prev && prev !== ds) {
+            if (prev.session.sessionId === ds.session.sessionId) {
+                logger.error(`[setActiveSessionSafe] refusing collision between distinct owners of session id `
+                    + `${prev.session.sessionId}; preserving both objects and the durable row`);
+                return {
+                    accepted: false,
+                    reason: 'cleanup_failed',
+                    keptSessionId: prev.session.sessionId,
+                    preservedIncomingSessionId: ds.session.sessionId,
+                    cleanupSessionId: prev.session.sessionId,
+                    error: 'ambiguous_session_id',
+                };
+            }
+            const prevPending = hasProtectedSessionMutationOwnership(prev);
+            const incomingPending = hasProtectedSessionMutationOwnership(ds);
+            if (prevPending && incomingPending) {
+                logger.error(`[setActiveSessionSafe] refusing collision between two unsettled Codex App owners `
+                    + `${prev.session.sessionId} and ${ds.session.sessionId}; preserving both rows/panes`);
+                return {
+                    accepted: false,
+                    reason: 'both_pending',
+                    keptSessionId: prev.session.sessionId,
+                    preservedIncomingSessionId: ds.session.sessionId,
+                };
+            }
+            if (prevPending) {
+                logger.warn(`[setActiveSessionSafe] keeping unsettled owner ${prev.session.sessionId.substring(0, 8)}; `
+                    + `closing ledger-empty incoming ${ds.session.sessionId.substring(0, 8)}`);
+                const cleanup = await closeUnregisteredCollisionLoser(map, ds);
+                if (!cleanup.ok) {
+                    return {
+                        accepted: false,
+                        reason: 'cleanup_failed',
+                        keptSessionId: prev.session.sessionId,
+                        preservedIncomingSessionId: ds.session.sessionId,
+                        cleanupSessionId: ds.session.sessionId,
+                        error: cleanup.error,
+                    };
+                }
+                return {
+                    accepted: false,
+                    reason: 'kept_pending_owner',
+                    keptSessionId: prev.session.sessionId,
+                    closedIncomingSessionId: ds.session.sessionId,
+                };
+            }
+            logger.warn(`[setActiveSessionSafe] key already occupied by ${prev.session.sessionId.substring(0, 8)} ` +
+                `(worker=${prev.worker ? 'live' : 'null'}); closing it before set`);
+            const cleanup = await closeUnregisteredCollisionLoser(map, prev);
+            if (!cleanup.ok) {
+                return {
+                    accepted: false,
+                    reason: 'cleanup_failed',
+                    keptSessionId: prev.session.sessionId,
+                    preservedIncomingSessionId: ds.session.sessionId,
+                    cleanupSessionId: prev.session.sessionId,
+                    error: cleanup.error,
+                };
+            }
+        }
+        // Reboot-resume guard (master): a durable quarantine reservation for this
+        // route (an inconclusive exact-backend teardown) must block a second runtime
+        // beside a possibly-live persistent target, even after the in-memory prev
+        // occupant above was closed. Closed rows never match, so an operator close
+        // immediately releases the route.
+        const quarantined = findQuarantinedRoutingConflict(key, ds.larkAppId, ds.session.sessionId);
+        if (quarantined) {
+            logger.warn(`[setActiveSessionSafe] refusing to occupy routing key reserved by quarantined session `
+                + `${quarantined.sessionId.substring(0, 8)}`);
+            return {
+                accepted: false,
+                reason: 'quarantine_reserved',
+                keptSessionId: quarantined.sessionId,
+                preservedIncomingSessionId: ds.session.sessionId,
+            };
+        }
+        map.set(key, ds);
+        clearRestoreQuarantineMarker(ds);
+        return {
+            accepted: true,
+            ...(prev && prev !== ds ? { closedSessionId: prev.session.sessionId } : {}),
+        };
+    });
 }
 /**
  * Roll back a freshly-created row rejected by the registration CAS, then read
@@ -2857,8 +3411,18 @@ targetScope, opts) {
     if (targetChatType !== 'group' && targetChatType !== 'p2p') {
         return { ok: false, error: 'target_chat_type_unsupported' };
     }
+    const initial = findActiveBySessionId(sessionId);
+    if (!initial)
+        return { ok: false, error: 'session_not_active' };
+    if (!opts?.mutationHeld) {
+        // Transfer rewrites both the source and target routing identities and may
+        // await scratch cleanup.  Drain every admitted turn for this bot first so
+        // no source prompt can become durable mid-transfer and no target creator
+        // can slip into the cleanup window.
+        return withBotTurnMutation(initial.larkAppId, () => transferSession(sessionId, targetChatId, targetRootMessageId, targetChatType, targetScope, { ...opts, mutationHeld: true }));
+    }
     const ds = findActiveBySessionId(sessionId);
-    if (!ds)
+    if (!ds || ds.session.status !== 'active')
         return { ok: false, error: 'session_not_active' };
     const sourceSession = ds.session;
     const sourceLifecycleIdentity = JSON.stringify({
@@ -2875,6 +3439,9 @@ targetScope, opts) {
     });
     if (ds.session.vcMeetingReceiver)
         return { ok: false, error: 'vc_receiver_not_relayable' };
+    if (hasProtectedSessionMutationOwnership(ds)) {
+        return { ok: false, error: 'codex_app_dispatch_pending' };
+    }
     // Anchor-based identity. A thread-scope session in the SAME chat (different
     // root) is a legitimate cross-topic move, so we refuse only when the target
     // anchor equals the source anchor (relaying a session onto itself). Replaces
@@ -3002,7 +3569,11 @@ targetScope, opts) {
                     continue;
                 if (sessionAnchorId(existing) !== targetAnchor)
                     continue;
-                if (isDisposableCommandScratch(existing)) {
+                // A durable dispatch ledger / activation journal makes the occupant a
+                // real conflict even when it currently has no worker; only a proven
+                // ledger-empty command scratch may be retired.
+                if (isDisposableCommandScratch(existing)
+                    && !hasProtectedSessionMutationOwnership(existing)) {
                     scratchesToClose.push(existing.session.sessionId);
                     continue;
                 }
@@ -3012,12 +3583,43 @@ targetScope, opts) {
         for (const sid of scratchesToClose) {
             await closeSession(sid);
         }
+        // A partially hydrated daemon can have an active target row absent from the
+        // runtime map. Durable ownership makes that row a real conflict even when it
+        // has worker:null and no legacy CLI markers; only proven ledger-empty
+        // scratch rows may be retired.
+        const runtimeIds = new Set(activeSessionsRegistry
+            ? [...activeSessionsRegistry.values()].map(item => item.session.sessionId)
+            : []);
+        const persistedTargetConflicts = sessionStore.listSessions().filter(item => item.sessionId !== ds.session.sessionId
+            && item.status === 'active'
+            && (!item.larkAppId || item.larkAppId === ds.larkAppId)
+            && !item.vcMeetingReceiver
+            && (item.scope === 'chat' ? item.chatId : item.rootMessageId) === targetAnchor
+            && !runtimeIds.has(item.sessionId));
+        if (persistedTargetConflicts.some(item => hasProtectedSessionMutationOwnership(item)
+            || !!item.cliId
+            || !!item.lastCliInput
+            || item.queued === true)) {
+            return { ok: false, error: 'target_chat_has_session' };
+        }
+        for (const scratch of persistedTargetConflicts) {
+            await closeSession(scratch.sessionId);
+        }
         const postScratchStateError = validateAfterAwait();
         if (postScratchStateError)
             return postScratchStateError;
         const tagPrefix = sessionId.substring(0, 8);
         const oldAnchor = sessionAnchorId(ds);
         const oldChatId = ds.chatId;
+        const oldStreamCardId = ds.streamCardId;
+        const oldCurrentImageKey = ds.currentImageKey;
+        // Scratch/store cleanup above awaited. A fresh source turn may have been
+        // admitted during that window; recheck the durable dispatch ledger in the
+        // same synchronous section that precedes the destructive detach so transfer
+        // never abandons newly durable work.
+        if (hasProtectedSessionMutationOwnership(ds)) {
+            return { ok: false, error: 'codex_app_dispatch_pending' };
+        }
         // Detach only the worker/observer. Persistent backends and Riff keep the
         // owned CLI/task alive so the replacement can reattach below. PTY cannot
         // survive a worker exit and therefore retains its historical cold-resume.
@@ -3420,6 +4022,28 @@ function resolvesToHome(p) {
         return p === homedir();
     }
 }
+export function codexAppCleanInputAcceptedForSession(ds) {
+    try {
+        const botCfg = getBot(ds.larkAppId).config;
+        const effectiveCliId = ds.session.cliId ?? botCfg.cliId;
+        return effectiveCliId === 'codex-app'
+            && botCfg.codexAppCleanInput === true
+            && !ds.adoptedFrom;
+    }
+    catch {
+        // Admission metadata is optional for every other CLI. If bot config is
+        // temporarily unavailable, fail closed instead of leaking a clean sidecar.
+        return false;
+    }
+}
+function cloneFrozenCodexAppInput(input, turnId) {
+    if (!input)
+        return undefined;
+    const cloned = structuredClone(input);
+    if (turnId && !cloned.clientUserMessageId)
+        cloned.clientUserMessageId = turnId;
+    return cloned;
+}
 function canForkRegisteredSession(ds) {
     const key = activeSessionKey(ds);
     const registered = activeSessionsRegistry ? activeSessionsRegistry.get(key) : ds;
@@ -3435,60 +4059,647 @@ function canForkRegisteredSession(ds) {
 function codexAppInputForSession(ds, input, turnId) {
     if (!input)
         return undefined;
+    if (!codexAppCleanInputAcceptedForSession(ds))
+        return undefined;
+    return cloneFrozenCodexAppInput(input, turnId);
+}
+function codexAppDeliverySinkForTurn(ds, turnId, dispatchAttempt) {
+    const armedThrough = ds.suppressedFinalOutputTurns?.get(turnId);
+    if (dispatchAttempt !== undefined
+        && armedThrough !== undefined
+        && dispatchAttempt <= armedThrough)
+        return 'suppressed';
+    if (ds.session.docCommentTargets?.[turnId] || ds.docCommentTurns?.has(turnId)) {
+        return 'doc_comment';
+    }
+    if (ds.pendingWaitPromises?.has(turnId))
+        return 'http_wait';
+    if (ds.asyncTriggerResults?.has(turnId))
+        return 'http_async';
+    return 'lark';
+}
+/** A recovered transient/non-IM sink has no safe provider to replay into.
+ * Treat it as consumed so the runner can advance, but never fall through to a
+ * Lark card. Doc-comment replay also fails closed: chunk posting has no durable
+ * per-chunk effect journal yet, so blind crash replay could duplicate comments. */
+function codexAppDeliveryMustFailClosed(ds, entry) {
+    const sink = entry.deliverySink
+        ?? (ds.session.docCommentTargets?.[entry.turnId]
+            ? 'doc_comment'
+            : ds.chatId.startsWith('http_wait_')
+                ? 'http_wait'
+                : ds.chatId.startsWith('http_async_')
+                    ? 'http_async'
+                    : 'lark');
+    if (sink === 'suppressed')
+        return true;
+    if (sink === 'doc_comment')
+        return !ds.docCommentTurns?.has(entry.turnId);
+    if (sink === 'http_wait')
+        return !ds.pendingWaitPromises?.has(entry.turnId);
+    if (sink === 'http_async')
+        return !ds.asyncTriggerResults?.has(entry.turnId);
+    return false;
+}
+function acceptCodexAppDispatch(ds, payload, turnId, dispatchAttempt, vcMeetingImTurnOrigin, opts = {}) {
     const botCfg = getBot(ds.larkAppId).config;
     const effectiveCliId = ds.session.cliId ?? botCfg.cliId;
-    if (effectiveCliId !== 'codex-app' || botCfg.codexAppCleanInput !== true || ds.adoptedFrom)
+    if (effectiveCliId !== 'codex-app' || !turnId)
         return undefined;
-    return turnId && !input.clientUserMessageId
-        ? { ...input, clientUserMessageId: turnId }
-        : input;
-}
-/** Send one normal (non-raw) worker turn while applying the per-bot Codex App
- * clean-input gate at message acceptance time. This freezes the sidecar onto
- * the IPC item, so later config flips do not mutate an already queued turn. */
-export function sendWorkerInput(ds, payload, turnId, opts = {}) {
-    const transferGate = transferInputGates.get(ds);
-    if ((!ds.worker || ds.worker.killed) && !transferGate)
-        return false;
-    const normalized = typeof payload === 'string' ? { content: payload } : payload;
-    const codexAppInput = codexAppInputForSession(ds, normalized.codexAppInput, turnId);
-    let nativeSessionTitlePrompt;
-    let nativeSessionTitle;
-    if (ds.session.nativeSessionTitleAwaitingContent && !ds.session.nativeSessionTitleUserDefined && !ds.adoptedFrom) {
-        const bot = getBot(ds.larkAppId);
-        const effectiveCliId = ds.session.cliId ?? bot.config.cliId;
-        if (effectiveCliId === 'codex') {
-            nativeSessionTitlePrompt = extractBotmuxLarkNativeSessionTitlePrompt(normalized.codexAppInput?.text ?? normalized.content, bot.botName ? [{ name: bot.botName }] : undefined);
-            if (nativeSessionTitlePrompt) {
-                nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(nativeSessionTitlePrompt);
-                ds.session.nativeSessionTitle = nativeSessionTitle;
-                ds.session.nativeSessionTitleAwaitingContent = undefined;
-                if (ds.initConfig) {
-                    ds.initConfig.nativeSessionTitle = nativeSessionTitle;
-                    ds.initConfig.nativeSessionTitlePrompt = nativeSessionTitlePrompt;
-                }
-                sessionStore.updateSession(ds.session);
-            }
+    const dispatchId = randomUUID();
+    const priorLedger = ds.session.codexAppDispatchLedger;
+    ds.session.codexAppDispatchLedger = appendAcceptedCodexAppDispatch(ds.session.codexAppDispatchLedger ?? [], {
+        dispatchId,
+        turnId,
+        ...(payload.queuedActivationToken
+            ? { queuedActivationToken: payload.queuedActivationToken }
+            : {}),
+        ...(payload.replyTurnId ? { replyTurnId: payload.replyTurnId } : {}),
+        ...(payload.replyTarget ? { replyTarget: payload.replyTarget } : {}),
+        ...(payload.quoteTargetId ? { quoteTargetId: payload.quoteTargetId } : {}),
+        ...(payload.replyTargetSenderOpenId
+            ? { replyTargetSenderOpenId: payload.replyTargetSenderOpenId }
+            : {}),
+        ...(payload.replyTargetSenderIsBot !== undefined
+            ? { replyTargetSenderIsBot: payload.replyTargetSenderIsBot }
+            : {}),
+        deliverySink: codexAppDeliverySinkForTurn(ds, turnId, dispatchAttempt),
+        ...(payload.codexAppSteerable ? { codexAppSteerable: true } : {}),
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+        content: payload.content,
+        ...(payload.codexAppInput ? { codexAppInput: payload.codexAppInput } : {}),
+        ...(vcMeetingImTurnOrigin ? { vcMeetingImTurnOrigin } : {}),
+    });
+    if (opts.persist !== false) {
+        try {
+            sessionStore.updateSession(ds.session);
+        }
+        catch (err) {
+            ds.session.codexAppDispatchLedger = priorLedger;
+            throw err;
         }
     }
-    const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, turnId);
+    return dispatchId;
+}
+function rollbackAcceptedCodexAppDispatch(ds, dispatchId, turnId, dispatchAttempt) {
+    if (!dispatchId || !turnId)
+        return;
+    const cancelled = cancelCodexAppDispatch(ds.session.codexAppDispatchLedger ?? [], {
+        dispatchId,
+        turnId,
+        ...(dispatchAttempt !== undefined ? { dispatchAttempt } : {}),
+    });
+    if (!cancelled.ok)
+        return;
+    const priorLedger = ds.session.codexAppDispatchLedger;
+    ds.session.codexAppDispatchLedger = cancelled.ledger;
+    try {
+        sessionStore.updateSession(ds.session);
+        if (!hasUnsettledCodexAppDispatch(ds.session.codexAppDispatchLedger)) {
+            void Promise.resolve(callbacks?.onCodexAppLedgerDrained?.(ds)).catch(err => {
+                logger.error(`[${ds.session.sessionId.slice(0, 8)}] post-rollback ledger-drain cleanup failed: `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            });
+        }
+    }
+    catch {
+        ds.session.codexAppDispatchLedger = priorLedger;
+    }
+}
+function snapshotQueuedActivationJournal(session) {
+    return {
+        queuedActivationPending: session.queuedActivationPending,
+        queuedActivationToken: session.queuedActivationToken,
+        queuedActivationInput: session.queuedActivationInput,
+        queuedActivationTurnId: session.queuedActivationTurnId,
+        queuedActivationDispatchAttempt: session.queuedActivationDispatchAttempt,
+        queuedActivationResume: session.queuedActivationResume,
+        queuedPrompt: session.queuedPrompt,
+        queuedCodexAppText: session.queuedCodexAppText,
+        queuedCodexAppMessageContext: session.queuedCodexAppMessageContext,
+        pendingRepoSetup: session.pendingRepoSetup
+            ? structuredClone(session.pendingRepoSetup)
+            : undefined,
+    };
+}
+function restoreQueuedActivationJournal(session, snapshot) {
+    Object.assign(session, snapshot);
+}
+function clearQueuedActivationJournal(session) {
+    session.queuedActivationPending = undefined;
+    session.queuedActivationToken = undefined;
+    session.queuedActivationInput = undefined;
+    session.queuedActivationTurnId = undefined;
+    session.queuedActivationDispatchAttempt = undefined;
+    session.queuedActivationResume = undefined;
+    session.queuedPrompt = undefined;
+    session.queuedCodexAppText = undefined;
+    session.queuedCodexAppMessageContext = undefined;
+    session.pendingRepoSetup = undefined;
+}
+/** A worker disappeared before the exact activation ACK. Re-park non-Codex
+ * work from the retained exact input; ACK loss may duplicate, but N can never
+ * be silently replaced by a later inbound turn in the same daemon lifetime. */
+function reparkUnsubmittedQueuedActivation(ds, reason) {
+    if (!ds.session.queuedActivationPending
+        || !ds.session.queuedActivationToken
+        || ds.session.cliId === 'codex-app')
+        return false;
+    ds.session.queued = true;
+    ds.session.queuedActivationPending = undefined;
+    ds.session.queuedActivationToken = undefined;
+    ds.initialStartPending = false;
+    ds.initialStartClaimToken = undefined;
+    ds.pendingPrompt ??= ds.session.queuedPrompt;
+    try {
+        sessionStore.updateSession(ds.session);
+    }
+    catch (err) {
+        // Memory remains explicitly parked while the old durable marker still
+        // provides restart recovery on disk.
+        logger.error(`[${tag(ds)}] Failed to persist queued activation re-park after ${reason}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+    }
+    logger.warn(`[${tag(ds)}] Re-parked unacknowledged queued activation after ${reason}`);
+    return true;
+}
+/** The opening activation was ACKed, but one of the turns held behind its
+ * runtime reservation was not accepted before that worker exited. Promote the
+ * exact FIFO head into a new durable queued activation so the next inbound or
+ * Dashboard activation reforks it before every remaining tail item. */
+function reparkQueuedActivationFollowUpTail(ds, reason) {
+    if (!ds.initialStartPending || ds.session.queuedActivationPending)
+        return false;
+    const next = ds.pendingQueuedActivationFollowUps?.[0];
+    if (!next)
+        return false;
+    const matchingCodexEntries = ds.session.cliId === 'codex-app'
+        ? (ds.session.codexAppDispatchLedger ?? []).filter(entry => (entry.state === 'accepted' || entry.state === 'prepared')
+            && entry.turnId === next.turnId
+            && entry.dispatchAttempt === next.dispatchAttempt)
+        : [];
+    if (matchingCodexEntries.length > 1) {
+        logger.error(`[${tag(ds)}] Cannot re-park queued follow-up after ${reason}: `
+            + `${matchingCodexEntries.length} Codex entries match turn ${next.turnId}`);
+        return false;
+    }
+    const retainedCodexEntry = matchingCodexEntries[0];
+    const retainedCodexToken = retainedCodexEntry
+        ? (retainedCodexEntry.queuedActivationToken ?? randomUUID())
+        : undefined;
+    // A failed daemon→worker IPC normally rolls its newly accepted Codex entry
+    // back. If that rollback persistence itself failed, the durable FIFO remains
+    // authoritative: recover it through a tokened ACK journal instead of
+    // creating an invalid queued+unsettled hybrid.
+    ds.session.queued = !retainedCodexEntry;
+    ds.session.queuedPrompt = next.cliInput.content;
+    ds.session.queuedCodexAppText = next.cliInput.codexAppInput?.text;
+    ds.session.queuedCodexAppMessageContext = undefined;
+    ds.session.queuedActivationInput = next.cliInput;
+    ds.session.queuedActivationTurnId = next.turnId;
+    ds.session.queuedActivationDispatchAttempt = next.dispatchAttempt;
+    ds.session.queuedActivationPending = retainedCodexEntry ? true : undefined;
+    ds.session.queuedActivationToken = retainedCodexToken;
+    if (retainedCodexEntry && retainedCodexToken) {
+        retainedCodexEntry.queuedActivationToken = retainedCodexToken;
+    }
+    ds.pendingQueuedActivationFollowUps.shift();
+    if (ds.pendingQueuedActivationFollowUps.length === 0) {
+        ds.pendingQueuedActivationFollowUps = undefined;
+    }
+    ds.pendingPrompt = next.cliInput.content;
+    ds.initialStartPending = false;
+    ds.initialStartClaimToken = undefined;
+    try {
+        sessionStore.updateSession(ds.session);
+    }
+    catch (err) {
+        // Keep the exact head parked in memory. The caller has already fenced the
+        // dead worker, so a later inbound can safely retry this owner even if the
+        // durable projection is temporarily unavailable.
+        logger.error(`[${tag(ds)}] Failed to persist queued follow-up re-park after ${reason}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+    }
+    logger.warn(`[${tag(ds)}] Re-parked unaccepted queued activation follow-up after ${reason}`);
+    return true;
+}
+export const __testOnly_reparkQueuedActivationFollowUpTail = reparkQueuedActivationFollowUpTail;
+/** Compensate only the durable mutations made before a worker accepts its init
+ * IPC. This is one synchronous call stack, so removing the exact dispatch that
+ * this fork appended cannot race a later worker transition or damage the FIFO
+ * that existed before the attempt. Persist the queued payload and ledger in one
+ * write so a daemon crash cannot observe only half of the compensation. */
+function rollbackWorkerForkPreInit(ds, queuedSnapshot, acceptedDispatch) {
+    const exactActivationInput = ds.session.queuedActivationInput;
+    const exactActivationTurnId = ds.session.queuedActivationTurnId;
+    const exactActivationDispatchAttempt = ds.session.queuedActivationDispatchAttempt;
+    const exactActivationResume = ds.session.queuedActivationResume;
+    let changed = false;
+    if (acceptedDispatch) {
+        const cancelled = cancelCodexAppDispatch(ds.session.codexAppDispatchLedger ?? [], acceptedDispatch);
+        if (!cancelled.ok) {
+            throw new Error(`failed to cancel pre-init Codex App dispatch: ${cancelled.error}`);
+        }
+        ds.session.codexAppDispatchLedger = cancelled.ledger;
+        changed = true;
+    }
+    if (queuedSnapshot) {
+        ds.session.queued = queuedSnapshot.queued;
+        restoreQueuedActivationJournal(ds.session, queuedSnapshot);
+        // The activation may have folded a triggering group reply into the final
+        // init payload. Retain that exact retry body even though the in-flight
+        // marker/token are rolled back with the fenced child.
+        ds.session.queuedActivationPending = undefined;
+        ds.session.queuedActivationToken = undefined;
+        ds.session.queuedActivationInput = exactActivationInput;
+        ds.session.queuedActivationTurnId = exactActivationTurnId;
+        ds.session.queuedActivationDispatchAttempt = exactActivationDispatchAttempt;
+        ds.session.queuedActivationResume = exactActivationResume;
+        ds.initialStartPending = queuedSnapshot.initialStartPending;
+        changed = true;
+    }
+    if (changed)
+        sessionStore.updateSession(ds.session);
+}
+/** Send one normal (non-raw) worker turn while applying the per-bot Codex App
+ * clean-input gate at message acceptance time. This freezes the sidecar onto
+ * the IPC item, so later config flips do not mutate an already queued turn. */
+export function sendWorkerInput(ds, payload, turnId, opts = {}) {
+    const riffRetirementPhase = riffRetirementAdmissionPhase(ds);
+    if (riffRetirementPhase) {
+        logger.warn(`[${tag(ds)}] Rejected turn ${turnId ?? '?'} while Riff retirement fence is ${riffRetirementPhase}`);
+        void callbacks?.sessionReply(sessionAnchorId(ds), tr('worker.riff_close_in_progress', undefined, localeForBot(ds.larkAppId)), 'text', ds.larkAppId, turnId).catch(err => {
+            logger.warn(`[${tag(ds)}] Failed to notify rejected Riff close-race turn: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+        });
+        return false;
+    }
+    const transferGate = transferInputGates.get(ds);
+    if ((!ds.worker || ds.worker.killed) && !transferGate)
+        return false;
+    const normalized = typeof payload === 'string' ? { content: payload } : payload;
+    const effectiveCliId = ds.session.cliId ?? getBot(ds.larkAppId).config.cliId;
+    const effectiveTurnId = turnId ?? (effectiveCliId === 'codex-app'
+        ? `codex-app-dispatch-${randomUUID()}`
+        : undefined);
+    const replyTurnId = turnId ? undefined : ds.currentReplyTarget?.turnId;
+    const routingTurnId = turnId ?? replyTurnId;
+    const replyContext = frozenReplyContextForTurn(ds, routingTurnId);
+    const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, routingTurnId);
+    let nativeSessionTitlePrompt;
+    let nativeSessionTitle;
+    if (ds.session.nativeSessionTitleAwaitingContent && !ds.session.nativeSessionTitleUserDefined && !ds.adoptedFrom) {
+        const bot = getBot(ds.larkAppId);
+        if (effectiveCliId === 'codex') {
+            nativeSessionTitlePrompt = extractBotmuxLarkNativeSessionTitlePrompt(normalized.codexAppInput?.text ?? normalized.content, bot.botName ? [{ name: bot.botName }] : undefined);
+            if (nativeSessionTitlePrompt) {
+                nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(nativeSessionTitlePrompt);
+                ds.session.nativeSessionTitle = nativeSessionTitle;
+                ds.session.nativeSessionTitleAwaitingContent = undefined;
+                if (ds.initConfig) {
+                    ds.initConfig.nativeSessionTitle = nativeSessionTitle;
+                    ds.initConfig.nativeSessionTitlePrompt = nativeSessionTitlePrompt;
+                }
+                sessionStore.updateSession(ds.session);
+            }
+        }
+    }
+    if (hasQueuedActivationAdmissionGate(ds)) {
+        const queuedTurnId = effectiveTurnId
+            ?? routingTurnId
+            ?? `queued-activation-followup-${randomUUID()}`;
+        try {
+            admitQueuedActivationTail(ds, {
+                userPrompt: normalized.content,
+                cliInput: {
+                    content: normalized.content,
+                    ...(normalized.codexAppInput
+                        ? { codexAppInput: normalized.codexAppInput }
+                        : {}),
+                    // R4-B1: freeze the admission-time steer authorization into the queued
+                    // tail's frozen payload so promote/repark/restore COPY it verbatim
+                    // (admission computed once; never re-inferred downstream).
+                    ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
+                },
+                turnId: queuedTurnId,
+                ...(opts.dispatchAttempt !== undefined
+                    ? { dispatchAttempt: opts.dispatchAttempt }
+                    : {}),
+            });
+            logger.info(`[${tag(ds)}] Staged turn ${queuedTurnId} behind queued activation ACK`);
+            return true;
+        }
+        catch (err) {
+            logger.error(`[${tag(ds)}] Failed to durably stage turn ${queuedTurnId} behind activation: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    const codexAppInput = codexAppInputForSession(ds, normalized.codexAppInput, effectiveTurnId);
+    const codexAppDispatchId = acceptCodexAppDispatch(ds, {
+        content: normalized.content,
+        ...(codexAppInput ? { codexAppInput } : {}),
+        ...(replyTurnId ? { replyTurnId } : {}),
+        replyTarget: replyContext.target,
+        ...(replyContext.quoteTargetId ? { quoteTargetId: replyContext.quoteTargetId } : {}),
+        ...(replyContext.replyTargetSenderOpenId
+            ? { replyTargetSenderOpenId: replyContext.replyTargetSenderOpenId }
+            : {}),
+        ...(replyContext.replyTargetSenderIsBot !== undefined
+            ? { replyTargetSenderIsBot: replyContext.replyTargetSenderIsBot }
+            : {}),
+        ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
+    }, effectiveTurnId, opts.dispatchAttempt, vcMeetingImTurnOrigin);
+    // Route through sendWorkerSessionInput so an in-flight routing transfer
+    // buffers this turn instead of dropping it (master's transfer input gate),
+    // while preserving PR #597's accepted-dispatch ledger + reply-context wiring.
     const message = {
         type: 'message',
         content: normalized.content,
         ...(codexAppInput ? { codexAppInput } : {}),
         ...(nativeSessionTitle ? { nativeSessionTitle } : {}),
         ...(nativeSessionTitlePrompt ? { nativeSessionTitlePrompt } : {}),
-        ...(turnId ? { turnId } : {}),
+        ...(effectiveTurnId ? { turnId: effectiveTurnId } : {}),
+        ...(replyTurnId ? { replyTurnId } : {}),
         ...(opts.dispatchAttempt !== undefined ? { dispatchAttempt: opts.dispatchAttempt } : {}),
+        ...(codexAppDispatchId ? { codexAppDispatchId } : {}),
+        ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
         ...(vcMeetingImTurnOrigin
             ? { vcMeetingImTurnOrigin }
             : {}),
     };
-    if (!transferGate && shouldTrackOrdinaryImDelivery(ds, message)) {
-        return sendOrdinaryImDeliveryTracked(ds, message);
+    // #597: the accept-ledger entry is already appended above; if the IPC send
+    // fails (returns false or throws) we MUST roll it back or the dispatch ledger
+    // keeps a phantom accepted turn. master's ordinary-IM-delivery tracking runs
+    // inside the same protected send so a tracked delivery still rolls back.
+    const performSend = () => {
+        if (!transferGate && shouldTrackOrdinaryImDelivery(ds, message)) {
+            return sendOrdinaryImDeliveryTracked(ds, message);
+        }
+        return sendWorkerSessionInput(ds, message);
+    };
+    try {
+        if (!performSend()) {
+            rollbackAcceptedCodexAppDispatch(ds, codexAppDispatchId, effectiveTurnId, opts.dispatchAttempt);
+            return false;
+        }
     }
-    return sendWorkerSessionInput(ds, message);
+    catch {
+        rollbackAcceptedCodexAppDispatch(ds, codexAppDispatchId, effectiveTurnId, opts.dispatchAttempt);
+        return false;
+    }
+    return true;
 }
+/** Promote the oldest durable activation successor into a fresh tokened
+ * journal and (for Codex App) its single accepted-ledger owner in one store
+ * update, then hand it to the current worker. The tail is never shifted merely
+ * because ChildProcess.send returned: the promoted journal survives until the
+ * adapter ACK carrying this token arrives. */
+export function promoteQueuedActivationTail(ds, opts = {}) {
+    if (ds.session.queuedActivationPending)
+        return true;
+    if (opts.send !== false
+        && (!ds.worker || ds.worker.killed))
+        return false;
+    const ordered = [...(ds.session.queuedActivationTail ?? [])]
+        .sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
+    const head = ordered[0];
+    if (!head)
+        return false;
+    const priorJournal = snapshotQueuedActivationJournal(ds.session);
+    const priorTail = ds.session.queuedActivationTail?.map(entry => ({
+        ...entry,
+        cliInput: {
+            ...entry.cliInput,
+            ...(entry.cliInput.codexAppInput
+                ? { codexAppInput: structuredClone(entry.cliInput.codexAppInput) }
+                : {}),
+        },
+    }));
+    const priorLedger = ds.session.codexAppDispatchLedger?.map(entry => ({ ...entry }));
+    const priorPendingPrompt = ds.pendingPrompt;
+    const token = randomUUID();
+    const replyContext = frozenReplyContextForTurn(ds, head.turnId);
+    // The tail entry crossed its admission boundary with the clean-input gate
+    // already frozen. Do not re-run that immediate bot-config gate at promotion:
+    // a true→false toggle between N+1 admission and N's ACK would otherwise
+    // discard N+1's exact sidecar/hidden context. Only fill the deterministic id
+    // for legacy entries persisted before admission began stamping it.
+    const codexAppInput = cloneFrozenCodexAppInput(head.cliInput.codexAppInput, head.turnId);
+    const exactInput = {
+        content: head.cliInput.content,
+        ...(codexAppInput ? { codexAppInput } : {}),
+        // R5-B1-2: preserve the frozen steer authorization onto the promoted
+        // queuedActivationInput so the ensuing fork/accept-ledger COPY (below) sees
+        // it. Only `=== true`; a missing/false tail head stays forced-serial.
+        ...(head.cliInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+    };
+    const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, head.turnId);
+    ds.session.queued = false;
+    ds.session.queuedActivationPending = true;
+    ds.session.queuedActivationToken = token;
+    ds.session.queuedActivationInput = exactInput;
+    ds.session.queuedActivationTurnId = head.turnId;
+    ds.session.queuedActivationDispatchAttempt = head.dispatchAttempt;
+    ds.session.queuedActivationResume = ds.hasHistory;
+    ds.session.queuedActivationTail = ordered.slice(1);
+    if (ds.session.queuedActivationTail.length === 0) {
+        ds.session.queuedActivationTail = undefined;
+    }
+    ds.pendingPrompt = exactInput.content;
+    ds.initialStartPending = true;
+    let codexAppDispatchId;
+    try {
+        codexAppDispatchId = acceptCodexAppDispatch(ds, {
+            content: exactInput.content,
+            ...(codexAppInput ? { codexAppInput } : {}),
+            queuedActivationToken: token,
+            replyTarget: replyContext.target,
+            ...(replyContext.quoteTargetId ? { quoteTargetId: replyContext.quoteTargetId } : {}),
+            ...(replyContext.replyTargetSenderOpenId
+                ? { replyTargetSenderOpenId: replyContext.replyTargetSenderOpenId }
+                : {}),
+            ...(replyContext.replyTargetSenderIsBot !== undefined
+                ? { replyTargetSenderIsBot: replyContext.replyTargetSenderIsBot }
+                : {}),
+            // R4-B1: COPY the frozen steer authorization from the promoted tail
+            // entry's payload onto the accept-ledger (admission computed once; never
+            // re-inferred at promote time).
+            ...(exactInput.codexAppSteerable ? { codexAppSteerable: true } : {}),
+        }, head.turnId, head.dispatchAttempt, vcMeetingImTurnOrigin, { persist: false });
+        sessionStore.updateSession(ds.session);
+    }
+    catch (err) {
+        restoreQueuedActivationJournal(ds.session, priorJournal);
+        ds.session.queuedActivationTail = priorTail;
+        ds.session.codexAppDispatchLedger = priorLedger;
+        ds.pendingPrompt = priorPendingPrompt;
+        logger.error(`[${tag(ds)}] Failed to atomically promote queued activation tail ${head.id}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+    if (opts.send === false)
+        return true;
+    try {
+        ds.worker.send({
+            type: 'message',
+            content: exactInput.content,
+            ...(codexAppInput ? { codexAppInput } : {}),
+            turnId: head.turnId,
+            ...(head.dispatchAttempt !== undefined
+                ? { dispatchAttempt: head.dispatchAttempt }
+                : {}),
+            ...(codexAppDispatchId ? { codexAppDispatchId } : {}),
+            // R6-B2: COPY the frozen steer authorization onto the live-worker IPC — the
+            // last hop. Without it a promoted N+1 reaches a live worker with the daemon
+            // ledger head steerable=true but the worker reservation false, so a
+            // legitimate superseded settlement would be wrongly rejected.
+            ...(exactInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+            queuedActivationToken: token,
+            ...(vcMeetingImTurnOrigin ? { vcMeetingImTurnOrigin } : {}),
+        });
+    }
+    catch (err) {
+        // Durable ownership already moved to the journal (and Codex ledger). Never
+        // append another owner on retry; fence this IPC generation and let recovery
+        // replay the exact tokened head.
+        logger.error(`[${tag(ds)}] Worker IPC rejected promoted activation ${head.id}; retaining journal: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+        try {
+            ds.worker.kill();
+        }
+        catch { /* exit/error path will fence runtime */ }
+    }
+    return true;
+}
+/** Reserve arrival order synchronously, before any caller-specific prompt
+ * rendering may await. Gaps are harmless; reusing an order after a failed
+ * durable admission would not be. */
+export function reserveQueuedActivationTailAdmission(ds) {
+    const order = (ds.session.queuedActivationTailNextOrder ?? 0) + 1;
+    ds.session.queuedActivationTailNextOrder = order;
+    return {
+        id: randomUUID(),
+        order,
+        codexAppInputAccepted: codexAppCleanInputAcceptedForSession(ds),
+    };
+}
+/** Admit one exact successor behind a queued activation. The response boundary
+ * is the session-store write: callers must not report acceptance or use live
+ * worker IPC unless this returns. `reservation` lets routes reserve FIFO order
+ * before asynchronous prompt construction without duplicating persistence
+ * logic. */
+export function admitQueuedActivationTail(ds, entry, reservation = reserveQueuedActivationTailAdmission(ds), opts = {}) {
+    const acceptedCodexAppInput = opts.codexAppInputGateFrozen === true
+        ? cloneFrozenCodexAppInput(entry.cliInput.codexAppInput, entry.turnId)
+        : reservation.codexAppInputAccepted === true
+            ? cloneFrozenCodexAppInput(entry.cliInput.codexAppInput, entry.turnId)
+            : undefined;
+    const admitted = {
+        id: reservation.id,
+        order: reservation.order,
+        ...entry,
+        cliInput: {
+            content: entry.cliInput.content,
+            ...(acceptedCodexAppInput ? { codexAppInput: acceptedCodexAppInput } : {}),
+            // R5-B1-2: preserve the frozen steer authorization across the tail rebuild
+            // (only `=== true`, never truthy). Dropping it here silently un-authorized
+            // every queued/opening turn — the strip point that defeated the R4 fix.
+            ...(entry.cliInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+        },
+    };
+    const priorTail = ds.session.queuedActivationTail;
+    const next = [...(priorTail ?? [])];
+    if (!next.some(candidate => candidate.id === admitted.id))
+        next.push(admitted);
+    next.sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
+    ds.session.queuedActivationTail = next;
+    try {
+        sessionStore.updateSession(ds.session);
+    }
+    catch (err) {
+        ds.session.queuedActivationTail = priorTail;
+        throw err;
+    }
+    return admitted;
+}
+/** True while a live worker's opening activation still owns submission order.
+ * Every ingress that sees this state must use admitQueuedActivationTail rather
+ * than ordinary worker IPC. */
+export function hasQueuedActivationAdmissionGate(ds) {
+    return ds.session.queuedActivationPending === true
+        || (ds.session.queuedActivationTail?.length ?? 0) > 0
+        || (ds.queuedActivationTailAdmissionsOutstanding ?? 0) > 0
+        || ds.queuedActivationTailReleasePending !== undefined
+        || (ds.initialStartPending === true
+            && ds.session.queuedActivationInput !== undefined);
+}
+/** Central quarantine decision for one fork boundary — the SINGLE authority that
+ * keeps a restore-time "tail-only quarantine" from being forked incorrectly.
+ *
+ * A quarantined owner (see restoreActiveSessions) has an old activation-tail head
+ * that failed to promote transiently: the head sits un-promoted in the tail with
+ * the admission gate held (worker:null). The invariant across EVERY fork boundary
+ * (restore reattach, IM inbound refork, web-terminal lazy wake, and any future
+ * one) is enforced here so callers cannot each miss it:
+ *
+ *  - Not quarantined → pass the caller's args through unchanged.
+ *  - Quarantined + NON-empty prompt → REFUSE (`fork:false`). forkWorker cannot
+ *    verify the caller durably staged this turn behind the old head, so letting
+ *    it through could overtake the head. The inbound path must durable-admit the
+ *    turn into the tail first, then blank-recover (empty prompt) through here.
+ *  - Quarantined + empty prompt → retry the old head's promotion. On failure keep
+ *    the flag/gate/worker:null and REFUSE (a blank fork would leave a live worker
+ *    beside an unpromoted tail and permanently wedge the FIFO gate). On success,
+ *    clear the flag and rewrite the fork to recover the PROMOTED OLD HEAD (never
+ *    the caller's turn): Codex App recovers through its ledger with an empty
+ *    prompt; a non-Codex CLI resubmits the exact `queuedActivationInput` with the
+ *    persisted resume/turn/attempt — mirroring the daemon activation-recovery fork.
+ *
+ * Extracted (and exported) so the orchestration can be unit-tested without a real
+ * tmux/worker: mock `promoteQueuedActivationTail` and assert refuse vs. recover
+ * args, then that forkWorker applies them.
+ */
+export function resolveQuarantinedForkPlan(ds, promptInput, resumeOrTurnId) {
+    if (!ds.quarantinedActivationTailPromotion) {
+        return { fork: true, promptInput, resumeOrTurnId };
+    }
+    const content = typeof promptInput === 'string' ? promptInput : promptInput.content;
+    if (content.length > 0) {
+        logger.warn(`[${tag(ds)}] Refused non-empty fork of a quarantined tail-only owner; `
+            + `caller must durable-admit the turn behind the old head, then blank-recover`);
+        return { fork: false, promptInput, resumeOrTurnId };
+    }
+    if (!promoteQueuedActivationTail(ds, { send: false })) {
+        logger.warn(`[${tag(ds)}] Quarantined activation-tail promotion still failing at fork boundary; `
+            + `keeping worker:null quarantined owner (no fork) to avoid a live worker beside an unpromoted tail`);
+        return { fork: false, promptInput, resumeOrTurnId };
+    }
+    ds.quarantinedActivationTailPromotion = undefined;
+    // Promotion succeeded: the old head is now the tokened queued activation. Fork
+    // THAT, exactly like the daemon's queuedActivation recovery — Codex App through
+    // its dispatch ledger (empty prompt), non-Codex by resubmitting the exact input.
+    const recoverThroughCodexLedger = (ds.session.cliId ?? getBot(ds.larkAppId).config.cliId) === 'codex-app';
+    return {
+        fork: true,
+        promptInput: recoverThroughCodexLedger ? '' : (ds.session.queuedActivationInput ?? ''),
+        resumeOrTurnId: {
+            resume: ds.session.queuedActivationResume ?? ds.hasHistory,
+            turnId: ds.session.queuedActivationTurnId,
+            dispatchAttempt: ds.session.queuedActivationDispatchAttempt,
+        },
+    };
+}
+/**
+ * Fork (or re-attach) a worker for `ds`.
+ *
+ * Returns `false` ONLY when a quarantined tail-only owner's promotion could not
+ * be recovered at this fork boundary (see resolveQuarantinedForkPlan): the caller
+ * MUST treat the session as still worker-less (no live worker was started) and
+ * leave the admission gate held. Every other outcome — forked, re-attached,
+ * staged behind an ACK, routed through a live owner, or spawn-deferred during
+ * device isolation — returns `true`.
+ */
 export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const gatedPrompt = typeof promptInput === 'string' ? { content: promptInput } : promptInput;
     const transferGate = transferInputGates.get(ds);
@@ -3506,6 +4717,11 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                 ...(gatedDispatchAttempt !== undefined
                     ? { dispatchAttempt: gatedDispatchAttempt }
                     : {}),
+                // R6-B3 (transfer-gate sibling): sendWorkerInput reads steer
+                // authorization from OPTS, not the payload. A steerable opening/refork
+                // rerouted through the transfer gate must carry the flag here too, or it
+                // silently downgrades true → false like the direct-route branch did.
+                ...(gatedPrompt.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
             });
         }
         else {
@@ -3519,7 +4735,10 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                 }
             });
         }
-        return;
+        // Buffered/deferred behind the routing transfer: no live worker started
+        // now, but the turn is durably staged, so this is not the quarantine
+        // refusal that boolean-false signals to callers.
+        return true;
     }
     // Device enrollment briefly freezes every daemon before the one-way host
     // marker is installed and legacy local CLIs are torn down. Do this before
@@ -3532,34 +4751,34 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         }
     })) {
         logger.info(`[${tag(ds)}] worker spawn deferred during device credential activation`);
-        return;
+        return true;
     }
+    // Central quarantine guard — the single source of truth for the tail-only
+    // restore quarantine invariant (documented on resolveQuarantinedForkPlan). Runs
+    // before ANY prompt derivation or session mutation so a refusal is side-effect
+    // free, and so a recovered plan rewrites the prompt/resume args used below.
+    const quarantinePlan = resolveQuarantinedForkPlan(ds, promptInput, resumeOrTurnId);
+    if (!quarantinePlan.fork)
+        return false;
+    promptInput = quarantinePlan.promptInput;
+    resumeOrTurnId = quarantinePlan.resumeOrTurnId;
+    // Refuse a closed or superseded session before any mutation (master guard).
     if (!canForkRegisteredSession(ds))
-        return;
-    const cb = requireCallbacks();
-    const bot = getBot(ds.larkAppId);
-    const botCfg = bot.config;
+        return false;
     const promptPayload = typeof promptInput === 'string' ? { content: promptInput } : promptInput;
     const prompt = promptPayload.content;
-    // 不变式：一旦真正起 CLI，会话就不再是「待办池(queued)」parked 态。无论由哪条
-    // 路径触发（激活按钮 / 拖到进行中 / 群里来消息抢先起会话），都在此清掉 queued
-    // 标记并落盘——否则重启后会被当 parked 恢复成 hasHistory:false 而丢掉真历史。
-    if (ds.session.queued) {
-        ds.session.queued = false;
-        ds.session.queuedPrompt = undefined;
-        ds.session.queuedCodexAppText = undefined;
-        ds.session.queuedCodexAppMessageContext = undefined;
-        sessionStore.updateSession(ds.session);
-    }
-    // worker.js lives in the same directory as daemon.js (src/)
-    const workerPath = join(__dirname, '..', 'worker.js');
-    const t = tag(ds);
-    ds.localProcessAttestation = undefined;
-    ds.workerReady = false;
+    // R4-B1: the frozen steer authorization rides on the CliTurnPayload (computed
+    // once by the daemon at admission, COPIED here). A bare-string promptInput or a
+    // system/recovery opening carries no flag ⇒ forced serial. Never re-inferred.
+    const initCodexAppSteerable = typeof promptInput === 'object'
+        && promptInput !== null
+        && promptInput.codexAppSteerable === true;
     let resume = false;
     let initTurnId;
     let initDispatchAttempt;
     let restartAttemptId;
+    let initCodexAppInputGateFrozen = promptInput === ds.session.queuedActivationInput;
+    let initAtMostOnce;
     if (typeof resumeOrTurnId === 'string') {
         initTurnId = resumeOrTurnId;
     }
@@ -3568,406 +4787,728 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         initTurnId = resumeOrTurnId.turnId;
         initDispatchAttempt = resumeOrTurnId.dispatchAttempt;
         restartAttemptId = resumeOrTurnId.restartAttemptId;
+        initCodexAppInputGateFrozen ||= resumeOrTurnId.codexAppInputGateFrozen === true;
+        initAtMostOnce = resumeOrTurnId.atMostOnce;
     }
     else {
         resume = resumeOrTurnId;
     }
-    // Per-turn authority is never inferred from mutable session state. Human
-    // message routes pass their accepted Lark message id explicitly; restore,
-    // scheduler, card retry and other system starts stay unattributed. Falling
-    // back to currentReplyTarget here would let a later system prompt reuse an
-    // older human turn after a worker replacement.
-    const initAttributionTurnId = initTurnId;
-    // A fork() whose cwd no longer exists emits an unhandled 'error' (spawn
-    // ENOENT) that crashes the WHOLE daemon (→ pm2 crash-loop). Fall back to
-    // home so a stale session workingDir can never take the daemon down.
-    const rawCwd = cb.getSessionWorkingDir(ds);
-    const cwd = rawCwd && existsSync(rawCwd) ? rawCwd : homedir();
-    if (cwd !== rawCwd)
-        logger.warn(`[${t}] workingDir "${rawCwd}" does not exist — falling back to ${cwd}`);
-    // Materialise the resolved launch dir on the live session. getSessionWorkingDir()
-    // falls back to the bot-default workingDir, but the usage ledger and dashboard read
-    // `ds.workingDir ?? s.workingDir` RAW (without that fallback). A session that inherits
-    // the bot-default workingDir — i.e. one never pinned via /repo or /cd — therefore leaves
-    // ds.workingDir undefined, so getSessionTokenUsage() is handed cwd=undefined, cannot
-    // locate the CLI transcript, and the session's token usage silently never records.
-    // Pinning the resolved cwd here (it equals what the worker actually forked into) closes
-    // that gap without touching the persisted session.workingDir "unset = follow default"
-    // semantics: this is re-derived on every fork/restore.
-    ds.workingDir = cwd;
-    // Also persist the effective launch dir onto the SESSION record so a sibling
-    // bot @-ed into the same anchor can inherit it (inherit-peer reads the
-    // persisted session.workingDir cross-process, even across daemons). Without
-    // this, a session running on the bot-default/fallback dir leaves
-    // session.workingDir empty and is invisible to cross-bot same-dir inheritance.
-    // Only FILL IN a missing workingDir (default/fallback-spawned sessions) — never
-    // overwrite an already-pinned value (oncall/repo-card sessions keep their stored
-    // form). Persist only a genuinely-resolved dir, never the homedir() crash-fallback
-    // (cwd !== rawCwd → a transiently-missing dir can't pin to ~). Also exclude a
-    // LEGITIMATELY-resolved homedir: a bot whose workingDir is unset/`~` resolves to
-    // $HOME, and pinning that would let a sibling bot inherit $HOME (launch in the home
-    // dir with no repo context) instead of getting its own repo card. Compared via
-    // realpath so a symlinked/aliased $HOME is excluded too, not just the literal string.
-    if (!ds.session.workingDir && cwd === rawCwd && !resolvesToHome(cwd)) {
-        ds.session.workingDir = cwd;
-        sessionStore.updateSession(ds.session);
-    }
-    // Sandbox decision is RECORDED ON THE SESSION at creation and reused on
-    // restore — so toggling the live bot flag never retroactively (un)sandboxes a
-    // historical session. A brand-new session (resume=false) with no recorded
-    // decision adopts the live bot flag; a restore (resume=true) with no recorded
-    // decision predates the sandbox feature → stays NOT sandboxed.
-    if (ds.session.sandbox === undefined) {
-        if (!resume) {
-            ds.session.sandbox = botCfg.sandbox === true;
-            ds.session.sandboxPaths = botCfg.sandboxPaths;
-            ds.session.sandboxHidePaths = botCfg.sandboxHidePaths ?? [];
-            ds.session.sandboxReadonlyPaths = botCfg.sandboxReadonlyPaths ?? [];
-            ds.session.sandboxNetwork = botCfg.sandboxNetwork !== false;
+    if (ds.session.queuedActivationPending && ds.session.queuedActivationResume !== undefined) {
+        resume = ds.session.queuedActivationResume;
+    }
+    // Central double-fork guard. A live worker with durable ownership must never
+    // be killed and replaced: empty reforks are rejected, while a real follow-up
+    // is appended through the existing worker's ordinary durable FIFO. Keep this
+    // before queued/cwd/sandbox mutations so a rejected refork is side-effect free.
+    if (ds.worker && !ds.worker.killed
+        && hasProtectedSessionMutationOwnership(ds)) {
+        if (prompt.length === 0) {
+            logger.warn(`[${tag(ds)}] Refused empty worker refork while durable activation ownership is non-empty`);
+            return true;
         }
-        else {
-            ds.session.sandbox = false;
-            ds.session.sandboxHidePaths = [];
-            ds.session.sandboxReadonlyPaths = [];
-            ds.session.sandboxNetwork = true;
+        if (hasQueuedActivationAdmissionGate(ds)) {
+            const turnId = initTurnId
+                ?? ds.currentReplyTarget?.turnId
+                ?? `queued-activation-followup-${randomUUID()}`;
+            admitQueuedActivationTail(ds, {
+                userPrompt: prompt,
+                cliInput: {
+                    content: prompt,
+                    ...(promptPayload.codexAppInput
+                        ? { codexAppInput: promptPayload.codexAppInput }
+                        : {}),
+                    // R5-B1-2: preserve the frozen steer authorization on the double-fork
+                    // staged tail entry (only `=== true`).
+                    ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+                },
+                turnId,
+                ...(initDispatchAttempt !== undefined
+                    ? { dispatchAttempt: initDispatchAttempt }
+                    : {}),
+            });
+            logger.info(`[${tag(ds)}] Staged double-fork prompt behind queued activation ACK `
+                + `(turn=${turnId})`);
+            return true;
         }
-        sessionStore.updateSession(ds.session);
+        const routed = sendWorkerInput(ds, promptPayload, initTurnId, {
+            ...(initDispatchAttempt !== undefined ? { dispatchAttempt: initDispatchAttempt } : {}),
+            // R6-B3: sendWorkerInput reads steer authorization from OPTS (not the
+            // payload), so the direct-route double-fork (protected ownership, no
+            // activation gate — e.g. only an unsettled ledger) must pass it through
+            // opts too. The gate branch above already admits with the flag; this
+            // sibling branch would otherwise silently downgrade true → false.
+            ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+        });
+        logger[routed ? 'info' : 'warn'](`[${tag(ds)}] ${routed ? 'Routed' : 'Failed to route'} double-fork prompt through existing durable owner`);
+        return true;
     }
-    // Reserve and durably publish the replacement lifetime before killing an
-    // existing worker. A failed reservation leaves the old worker untouched;
-    // a successful reservation immediately invalidates any late old-worker ACK.
-    const workerGeneration = reserveWorkerGeneration(ds);
-    // Guard against double-fork: if a worker is already running, kill it first
-    if (ds.worker && !ds.worker.killed) {
-        const replacedWorker = ds.worker;
-        logger.warn(`[${t}] Worker already running (pid: ${replacedWorker.pid}), killing before re-fork`);
-        trackLifecycleRetirement(ds, replacedWorker);
+    const cb = requireCallbacks();
+    const bot = getBot(ds.larkAppId);
+    const botCfg = bot.config;
+    // A bare /repo placeholder (and a non-Codex empty group-join setup) owns no
+    // model turn. Starting its CLI with an empty prompt must not mint a queued
+    // activation token: the worker has nothing to submit and could never ACK it.
+    // Real raw openings and clean Codex sidecars remain tokened.
+    if (ds.session.queued
+        && ds.session.pendingRepoSetup
+        && prompt.length === 0
+        && !promptPayload.codexAppInput
+        && !ds.pendingRawInput
+        && (ds.session.queuedActivationTail?.length ?? 0) === 0) {
+        const priorJournal = snapshotQueuedActivationJournal(ds.session);
+        ds.session.queued = false;
+        clearQueuedActivationJournal(ds.session);
         try {
-            replacedWorker.send({ type: 'close' });
+            sessionStore.updateSession(ds.session);
         }
-        catch { /* ignore */ }
-        try {
-            replacedWorker.kill();
+        catch (err) {
+            ds.session.queued = true;
+            restoreQueuedActivationJournal(ds.session, priorJournal);
+            throw err;
         }
-        catch { /* ignore */ }
-        ds.worker = null;
-        ds.workerReady = false;
-        ds.workerPort = null;
-        ds.workerToken = null;
-        ds.workerViewToken = null;
-        ds.managedTurnOrigin = undefined;
-    }
-    // Re-establishing a worker ends the cold-resume-suspended state: clear the
-    // persisted marker so a future restart no longer treats this session's
-    // backing as a deliberate-missing (a genuine later zombie must still close).
-    if (ds.session.suspendedColdResume) {
-        ds.session.suspendedColdResume = undefined;
-        sessionStore.updateSession(ds.session);
     }
-    // Re-establishing a worker also reclaims any crash-diagnostic shell a prior
-    // worker left parked but couldn't clean (hard-killed while parked, daemon
-    // still alive → next message reforks here). The fresh CLI spawns under the
-    // real bmx-<sid>; without this, bmx-diag-<sid> + its .ansi file would leak.
-    if (!ds.initConfig?.adoptMode && !ds.adoptedFrom)
-        reclaimParkedCrashDiagnostic(ds);
-    const agentCfg = sessionAgentConfig(ds, botCfg);
-    ensureCliEnv(agentCfg.cliId, agentCfg.cliPathOverride);
-    let nativeSessionTitle;
-    let nativeSessionTitlePrompt;
-    if (agentCfg.cliId === 'codex' && !ds.adoptedFrom) {
-        const isFreshNativeSession = !resume && !ds.session.cliSessionId;
-        const titlePrompt = extractBotmuxLarkNativeSessionTitlePrompt(promptPayload.codexAppInput?.text ?? prompt, bot.botName ? [{ name: bot.botName }] : undefined);
-        if (isFreshNativeSession && !ds.session.nativeSessionTitleUserDefined) {
-            ds.session.nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(titlePrompt ? ds.session.title : undefined, bot.botName ? [{ name: bot.botName }] : undefined, ds.chatType === 'group' ? ds.session.chatDisplayName : undefined);
-            ds.session.nativeSessionTitleAwaitingContent = titlePrompt ? undefined : true;
-            nativeSessionTitlePrompt = titlePrompt;
+    const queuedForkSnapshot = ds.session.queued
+        ? {
+            queued: true,
+            queuedPrompt: ds.session.queuedPrompt,
+            queuedCodexAppText: ds.session.queuedCodexAppText,
+            queuedCodexAppMessageContext: ds.session.queuedCodexAppMessageContext,
+            queuedActivationPending: ds.session.queuedActivationPending,
+            queuedActivationToken: ds.session.queuedActivationToken,
+            queuedActivationInput: ds.session.queuedActivationInput,
+            queuedActivationTurnId: ds.session.queuedActivationTurnId,
+            queuedActivationDispatchAttempt: ds.session.queuedActivationDispatchAttempt,
+            queuedActivationResume: ds.session.queuedActivationResume,
+            initialStartPending: ds.initialStartPending,
+        }
+        : undefined;
+    let acceptedForkDispatch;
+    let spawnedWorker;
+    let worker;
+    let startupState;
+    let initMsg;
+    let agentCfg;
+    const t = tag(ds);
+    ds.localProcessAttestation = undefined;
+    try {
+        // worker.js lives in the same directory as daemon.js (src/)
+        const workerPath = join(__dirname, '..', 'worker.js');
+        // Per-turn authority is never inferred from mutable session state. Human
+        // message routes pass their accepted Lark message id explicitly; restore,
+        // scheduler, card retry and other system starts stay unattributed. Falling
+        // back to currentReplyTarget here would let a later system prompt reuse an
+        // older human turn after a worker replacement.
+        let initAttributionTurnId = initTurnId
+            ?? (queuedForkSnapshot ? ds.session.pendingRepoSetup?.turnId : undefined);
+        // Reply routing is frozen only from the same explicitly accepted turn. A
+        // system prompt must not borrow an older mutable currentReplyTarget.
+        const initReplyTurnId = initTurnId;
+        const initReplyContext = prompt.length > 0
+            ? frozenReplyContextForTurn(ds, initReplyTurnId)
+            : undefined;
+        // A fork() whose cwd no longer exists emits an unhandled 'error' (spawn
+        // ENOENT) that crashes the WHOLE daemon (→ pm2 crash-loop). Fall back to
+        // home so a stale session workingDir can never take the daemon down.
+        const rawCwd = cb.getSessionWorkingDir(ds);
+        const cwd = rawCwd && existsSync(rawCwd) ? rawCwd : homedir();
+        if (cwd !== rawCwd)
+            logger.warn(`[${t}] workingDir "${rawCwd}" does not exist — falling back to ${cwd}`);
+        // Materialise the resolved launch dir on the live session. getSessionWorkingDir()
+        // falls back to the bot-default workingDir, but the usage ledger and dashboard read
+        // `ds.workingDir ?? s.workingDir` RAW (without that fallback). A session that inherits
+        // the bot-default workingDir — i.e. one never pinned via /repo or /cd — therefore leaves
+        // ds.workingDir undefined, so getSessionTokenUsage() is handed cwd=undefined, cannot
+        // locate the CLI transcript, and the session's token usage silently never records.
+        // Pinning the resolved cwd here (it equals what the worker actually forked into) closes
+        // that gap without touching the persisted session.workingDir "unset = follow default"
+        // semantics: this is re-derived on every fork/restore.
+        ds.workingDir = cwd;
+        // Also persist the effective launch dir onto the SESSION record so a sibling
+        // bot @-ed into the same anchor can inherit it (inherit-peer reads the
+        // persisted session.workingDir cross-process, even across daemons). Without
+        // this, a session running on the bot-default/fallback dir leaves
+        // session.workingDir empty and is invisible to cross-bot same-dir inheritance.
+        // Only FILL IN a missing workingDir (default/fallback-spawned sessions) — never
+        // overwrite an already-pinned value (oncall/repo-card sessions keep their stored
+        // form). Persist only a genuinely-resolved dir, never the homedir() crash-fallback
+        // (cwd !== rawCwd → a transiently-missing dir can't pin to ~). Also exclude a
+        // LEGITIMATELY-resolved homedir: a bot whose workingDir is unset/`~` resolves to
+        // $HOME, and pinning that would let a sibling bot inherit $HOME (launch in the home
+        // dir with no repo context) instead of getting its own repo card. Compared via
+        // realpath so a symlinked/aliased $HOME is excluded too, not just the literal string.
+        if (!ds.session.workingDir && cwd === rawCwd && !resolvesToHome(cwd)) {
+            ds.session.workingDir = cwd;
             sessionStore.updateSession(ds.session);
         }
-        else if (ds.session.nativeSessionTitleAwaitingContent
-            && !ds.session.nativeSessionTitleUserDefined
-            && titlePrompt) {
-            ds.session.nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(titlePrompt);
-            ds.session.nativeSessionTitleAwaitingContent = undefined;
-            nativeSessionTitlePrompt = titlePrompt;
+        // Sandbox decision is RECORDED ON THE SESSION at creation and reused on
+        // restore — so toggling the live bot flag never retroactively (un)sandboxes a
+        // historical session. A brand-new session (resume=false) with no recorded
+        // decision adopts the live bot flag; a restore (resume=true) with no recorded
+        // decision predates the sandbox feature → stays NOT sandboxed.
+        if (ds.session.sandbox === undefined) {
+            if (!resume) {
+                ds.session.sandbox = botCfg.sandbox === true;
+                ds.session.sandboxPaths = botCfg.sandboxPaths;
+                ds.session.sandboxHidePaths = botCfg.sandboxHidePaths ?? [];
+                ds.session.sandboxReadonlyPaths = botCfg.sandboxReadonlyPaths ?? [];
+                ds.session.sandboxNetwork = botCfg.sandboxNetwork !== false;
+            }
+            else {
+                ds.session.sandbox = false;
+                ds.session.sandboxHidePaths = [];
+                ds.session.sandboxReadonlyPaths = [];
+                ds.session.sandboxNetwork = true;
+            }
             sessionStore.updateSession(ds.session);
         }
-        else if (isFreshNativeSession && !ds.session.nativeSessionTitle) {
-            ds.session.nativeSessionTitle = ds.session.title;
+        // Reserve and durably publish the replacement lifetime before killing an
+        // existing worker. A failed reservation leaves the old worker untouched;
+        // a successful reservation immediately invalidates any late old-worker ACK.
+        const workerGeneration = reserveWorkerGeneration(ds);
+        // Guard against double-fork: if a worker is already running, kill it first
+        if (ds.worker && !ds.worker.killed) {
+            const replacedWorker = ds.worker;
+            logger.warn(`[${t}] Worker already running (pid: ${replacedWorker.pid}), killing before re-fork`);
+            trackLifecycleRetirement(ds, replacedWorker);
+            try {
+                replacedWorker.send({ type: 'close' });
+            }
+            catch { /* ignore */ }
+            try {
+                replacedWorker.kill();
+            }
+            catch { /* ignore */ }
+            ds.worker = null;
+            ds.workerReady = false;
+            ds.workerPort = null;
+            ds.workerToken = null;
+            ds.workerViewToken = null;
+            ds.managedTurnOrigin = undefined;
+        }
+        // Re-establishing a worker ends the cold-resume-suspended state: clear the
+        // persisted marker so a future restart no longer treats this session's
+        // backing as a deliberate-missing (a genuine later zombie must still close).
+        if (ds.session.suspendedColdResume) {
+            ds.session.suspendedColdResume = undefined;
             sessionStore.updateSession(ds.session);
         }
-        if (isFreshNativeSession
-            || (resume && !!ds.session.cliSessionId && !!ds.session.nativeSessionTitle)
-            || (resume
-                && !!ds.session.nativeSessionTitleAwaitingContent
-                && !!ds.session.nativeSessionTitle)
-            || (!!nativeSessionTitlePrompt && !!ds.session.nativeSessionTitle)) {
-            nativeSessionTitle = ds.session.nativeSessionTitle;
-        }
-    }
-    // Claude Code blocks on the interactive folder-trust dialog the first time
-    // it runs in an untrusted workingDir; pre-accept it so the spawn doesn't hang.
-    // Seed CLI (Claude Code fork) has the same dialog — drive both off the
-    // adapter's claude-family fields, writing to each variant's own .claude.json
-    // (`~/.claude.json` for claude, `.claude-runtime/.claude.json` for seed).
-    const familyAdapter = createCliAdapterSync(agentCfg.cliId, agentCfg.cliPathOverride);
-    if (familyAdapter.claudeStateJsonPath)
-        ensureClaudeFolderTrust(cwd, familyAdapter.claudeStateJsonPath);
-    // Prepend the botmux wrapper bin dir to PATH so CLIs can call `botmux send` etc.
-    // Single source of truth (resolveBotmuxWrapperBinDir): core-only → dedicated
-    // `<SESSION_DATA_DIR>/bin` (not the shared ~/.botmux/bin), matching where the
-    // daemon WROTE the wrapper — else the worker PATH would miss it or a same-HOME
-    // fleet wrapper would shadow it (codex P1).
-    const botmuxBinDir = resolveBotmuxWrapperBinDir(process.env);
-    const pathWithBotmux = prependBotmuxBin(botmuxBinDir, process.env.PATH);
-    const forkEnv = workerForkEnv(process.env);
-    const worker = fork(workerPath, [], {
-        windowsHide: true,
-        stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-        cwd,
-        env: {
-            ...forkEnv,
-            PATH: pathWithBotmux,
-            CLAUDECODE: undefined,
-            BOTMUX: '1', // Marker so user scripts/skills can detect a botmux-spawned CLI
-            SESSION_DATA_DIR: config.session.dataDir,
-            BOTMUX_SESSION_ID: ds.session.sessionId,
-            LARK_APP_ID: botCfg.larkAppId,
-            // Withhold the real secret from the worker's own CLI env for a no-transport
-            // session (apiOnly bot or HTTP virtual chat). SEPARATE leak from the
-            // init-message larkAppSecret — the spawned CLI env carries it directly from
-            // botCfg. Empty it here too so no secret reaches the worker/sandbox.
-            LARK_APP_SECRET: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
-        },
-    });
-    const startupState = {
-        ready: false, failureNotified: false,
-        initTurnId: initAttributionTurnId,
-        initDispatchAttempt,
-    };
-    // A fork-level failure (spawn ENOENT, etc.) emits 'error'; without a handler
-    // the unhandled event crashes the daemon. It also happens before worker IPC
-    // exists, so this daemon-side branch must be the user-visible fallback.
-    worker.on('error', (err) => {
-        const reason = err?.message ?? String(err);
-        logger.error(`[${t}] Worker fork error: ${reason}`);
-        if (startupState.failureNotified)
-            return;
-        startupState.failureNotified = true;
-        emitSessionLifecycleHook(ds, 'session.requires_attention', {
-            reason: 'worker_fork_error',
-            message: reason,
+        // Re-establishing a worker also reclaims any crash-diagnostic shell a prior
+        // worker left parked but couldn't clean (hard-killed while parked, daemon
+        // still alive → next message reforks here). The fresh CLI spawns under the
+        // real bmx-<sid>; without this, bmx-diag-<sid> + its .ansi file would leak.
+        if (!ds.initConfig?.adoptMode && !ds.adoptedFrom)
+            reclaimParkedCrashDiagnostic(ds);
+        agentCfg = sessionAgentConfig(ds, botCfg);
+        if (!initTurnId && prompt.length > 0 && agentCfg.cliId === 'codex-app') {
+            initAttributionTurnId = `codex-app-dispatch-${randomUUID()}`;
+        }
+        ensureCliEnv(agentCfg.cliId, agentCfg.cliPathOverride);
+        let nativeSessionTitle;
+        let nativeSessionTitlePrompt;
+        if (agentCfg.cliId === 'codex' && !ds.adoptedFrom) {
+            const isFreshNativeSession = !resume && !ds.session.cliSessionId;
+            const titlePrompt = extractBotmuxLarkNativeSessionTitlePrompt(promptPayload.codexAppInput?.text ?? prompt, bot.botName ? [{ name: bot.botName }] : undefined);
+            if (isFreshNativeSession && !ds.session.nativeSessionTitleUserDefined) {
+                ds.session.nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(titlePrompt ? ds.session.title : undefined, bot.botName ? [{ name: bot.botName }] : undefined, ds.chatType === 'group' ? ds.session.chatDisplayName : undefined);
+                ds.session.nativeSessionTitleAwaitingContent = titlePrompt ? undefined : true;
+                nativeSessionTitlePrompt = titlePrompt;
+                sessionStore.updateSession(ds.session);
+            }
+            else if (ds.session.nativeSessionTitleAwaitingContent
+                && !ds.session.nativeSessionTitleUserDefined
+                && titlePrompt) {
+                ds.session.nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(titlePrompt);
+                ds.session.nativeSessionTitleAwaitingContent = undefined;
+                nativeSessionTitlePrompt = titlePrompt;
+                sessionStore.updateSession(ds.session);
+            }
+            else if (isFreshNativeSession && !ds.session.nativeSessionTitle) {
+                ds.session.nativeSessionTitle = ds.session.title;
+                sessionStore.updateSession(ds.session);
+            }
+            if (isFreshNativeSession
+                || (resume && !!ds.session.cliSessionId && !!ds.session.nativeSessionTitle)
+                || (resume
+                    && !!ds.session.nativeSessionTitleAwaitingContent
+                    && !!ds.session.nativeSessionTitle)
+                || (!!nativeSessionTitlePrompt && !!ds.session.nativeSessionTitle)) {
+                nativeSessionTitle = ds.session.nativeSessionTitle;
+            }
+        }
+        // Claude Code blocks on the interactive folder-trust dialog the first time
+        // it runs in an untrusted workingDir; pre-accept it so the spawn doesn't hang.
+        // Seed CLI (Claude Code fork) has the same dialog — drive both off the
+        // adapter's claude-family fields, writing to each variant's own .claude.json
+        // (`~/.claude.json` for claude, `.claude-runtime/.claude.json` for seed).
+        const familyAdapter = createCliAdapterSync(agentCfg.cliId, agentCfg.cliPathOverride);
+        if (familyAdapter.claudeStateJsonPath)
+            ensureClaudeFolderTrust(cwd, familyAdapter.claudeStateJsonPath);
+        const resolvedBackendType = resolvePairedSpawnBackendType(agentCfg.cliId, ds.session.backendType, botCfg.backendType, config.daemon.backendType);
+        if (ds.session.cliId !== agentCfg.cliId || ds.session.backendType !== resolvedBackendType) {
+            ds.session.cliId = agentCfg.cliId;
+            ds.session.backendType = resolvedBackendType;
+            sessionStore.updateSession(ds.session);
+        }
+        // Prepend the botmux wrapper bin dir to PATH so CLIs can call `botmux send` etc.
+        // Single source of truth (resolveBotmuxWrapperBinDir): core-only → dedicated
+        // `<SESSION_DATA_DIR>/bin` (not the shared ~/.botmux/bin), matching where the
+        // daemon WROTE the wrapper — else the worker PATH would miss it or a same-HOME
+        // fleet wrapper would shadow it (codex P1).
+        const botmuxBinDir = resolveBotmuxWrapperBinDir(process.env);
+        const pathWithBotmux = prependBotmuxBin(botmuxBinDir, process.env.PATH);
+        const forkEnv = workerForkEnv(process.env);
+        // Dequeue only after every earlier launch-preparation write has finished.
+        // The exact input remains journaled until the worker confirms its adapter
+        // submission boundary; daemon send/ready are intentionally too early.
+        const recoveredActivationLedgerEntry = ds.session.queuedActivationPending
+            ? [...(ds.session.codexAppDispatchLedger ?? [])]
+                .reverse()
+                .find(entry => entry.state === 'accepted' || entry.state === 'prepared')
+            : undefined;
+        const queuedActivationToken = queuedForkSnapshot
+            ? randomUUID()
+            : ds.session.queuedActivationPending
+                ? (ds.session.queuedActivationToken
+                    ?? recoveredActivationLedgerEntry?.queuedActivationToken
+                    ?? randomUUID())
+                : undefined;
+        if (queuedForkSnapshot) {
+            ds.session.queued = false;
+            ds.session.queuedActivationPending = true;
+            ds.session.queuedActivationToken = queuedActivationToken;
+            ds.session.queuedActivationResume = resume;
+            ds.initialStartPending = true;
+        }
+        else if (ds.session.queuedActivationPending && queuedActivationToken) {
+            // Migrate journals written before the token/ACK protocol. The queued
+            // activation is the newest unsettled FIFO entry; stamp the same token onto
+            // both journal and entry before the recovery worker can submit it.
+            let migrated = ds.session.queuedActivationToken !== queuedActivationToken;
+            ds.session.queuedActivationToken = queuedActivationToken;
+            ds.initialStartPending = true;
+            if (recoveredActivationLedgerEntry
+                && recoveredActivationLedgerEntry.queuedActivationToken !== queuedActivationToken) {
+                recoveredActivationLedgerEntry.queuedActivationToken = queuedActivationToken;
+                migrated = true;
+            }
+            if (migrated)
+                sessionStore.updateSession(ds.session);
+        }
+        // Snapshot the prior durable FIFO before accepting this fork's new prompt.
+        // A pure reattach receives the full snapshot; a refork carrying N+1 restores
+        // old N first and reserves N+1 through the normal worker write path.
+        const codexAppRecoveredDispatches = agentCfg.cliId === 'codex-app'
+            ? (ds.session.codexAppDispatchLedger ?? []).map(entry => ({ ...entry }))
+            : [];
+        const promptCodexAppInput = initCodexAppInputGateFrozen
+            ? cloneFrozenCodexAppInput(promptPayload.codexAppInput, initAttributionTurnId)
+            : codexAppInputForSession(ds, promptPayload.codexAppInput, initAttributionTurnId);
+        if (queuedForkSnapshot) {
+            ds.session.queuedActivationInput = {
+                content: prompt,
+                ...(promptCodexAppInput ? { codexAppInput: promptCodexAppInput } : {}),
+                // R4-B1: preserve the frozen steer authorization when re-parking N+1 behind
+                // a recovery fork (COPY, never re-infer).
+                ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+            };
+            ds.session.queuedActivationTurnId = initAttributionTurnId;
+            ds.session.queuedActivationDispatchAttempt = initDispatchAttempt;
+        }
+        const initVcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, initTurnId ?? initReplyTurnId);
+        const codexAppDispatchId = prompt.length > 0
+            ? acceptCodexAppDispatch(ds, {
+                content: prompt,
+                ...(promptCodexAppInput ? { codexAppInput: promptCodexAppInput } : {}),
+                ...(queuedActivationToken ? { queuedActivationToken } : {}),
+                ...(initReplyTurnId ? { replyTurnId: initReplyTurnId } : {}),
+                ...(initReplyContext ? {
+                    replyTarget: initReplyContext.target,
+                    ...(initReplyContext.quoteTargetId
+                        ? { quoteTargetId: initReplyContext.quoteTargetId }
+                        : {}),
+                    ...(initReplyContext.replyTargetSenderOpenId
+                        ? { replyTargetSenderOpenId: initReplyContext.replyTargetSenderOpenId }
+                        : {}),
+                    ...(initReplyContext.replyTargetSenderIsBot !== undefined
+                        ? { replyTargetSenderIsBot: initReplyContext.replyTargetSenderIsBot }
+                        : {}),
+                } : {}),
+                // R4-B1: COPY the frozen steer authorization onto the fork's
+                // accept-ledger entry so a recovered/opening first turn is steerable
+                // exactly as the daemon admitted it (admission computed once; COPIED).
+                ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+            }, initAttributionTurnId, initDispatchAttempt, initVcMeetingImTurnOrigin)
+            : undefined;
+        if (codexAppDispatchId && initAttributionTurnId) {
+            acceptedForkDispatch = {
+                dispatchId: codexAppDispatchId,
+                turnId: initAttributionTurnId,
+                ...(initDispatchAttempt !== undefined
+                    ? { dispatchAttempt: initDispatchAttempt }
+                    : {}),
+            };
+        }
+        if (queuedForkSnapshot && !codexAppDispatchId) {
+            sessionStore.updateSession(ds.session);
+        }
+        worker = fork(workerPath, [], {
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+            execArgv: workerForkExecArgv(),
+            cwd,
+            env: {
+                ...forkEnv,
+                PATH: pathWithBotmux,
+                CLAUDECODE: undefined,
+                BOTMUX: '1', // Marker so user scripts/skills can detect a botmux-spawned CLI
+                SESSION_DATA_DIR: config.session.dataDir,
+                BOTMUX_SESSION_ID: ds.session.sessionId,
+                LARK_APP_ID: botCfg.larkAppId,
+                // Withhold the real secret from the worker's own CLI env for a no-transport
+                // session (apiOnly bot or HTTP virtual chat). SEPARATE leak from the
+                // init-message larkAppSecret — the spawned CLI env carries it directly from
+                // botCfg. Empty it here too so no secret reaches the worker/sandbox.
+                LARK_APP_SECRET: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
+            },
         });
-        // A dedicated VC receiver and a silent schedule have no auxiliary Lark
-        // output channel. Keep lifecycle/dashboard state above, but never leak a
-        // fork diagnostic into the chat.
-        if (ds.session.vcMeetingReceiver || isSilentScheduledTurn(ds, initAttributionTurnId)) {
-            logger.info(`[${t}] Managed/silent fork failure kept out of auxiliary Lark UI `
-                + `turn=${initAttributionTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`);
-            return;
+        spawnedWorker = worker;
+        startupState = {
+            ready: false, failureNotified: false,
+            initTurnId: initAttributionTurnId,
+            initDispatchAttempt,
+        };
+        // A fork-level failure (spawn ENOENT, etc.) emits 'error'; without a handler
+        // the unhandled event crashes the daemon. It also happens before worker IPC
+        // exists, so this daemon-side branch must be the user-visible fallback.
+        worker.on('error', (err) => {
+            const reason = err?.message ?? String(err);
+            logger.error(`[${t}] Worker fork error: ${reason}`);
+            if (ds.worker === worker) {
+                if (ds.session.queuedActivationPending) {
+                    // The durable opening journal remains authoritative until the adapter
+                    // proves submission. A failed child must release only its runtime
+                    // claim so the next generation can replay that exact head.
+                    ds.initialStartPending = false;
+                    ds.initialStartClaimToken = undefined;
+                }
+                else {
+                    reparkQueuedActivationFollowUpTail(ds, 'worker error during activation follow-up handoff');
+                }
+                const retainExactRetirementGeneration = ds.riffShutdownState !== undefined
+                    || ds.riffCloseState !== undefined;
+                if (!retainExactRetirementGeneration) {
+                    ds.worker = null;
+                    ds.workerPort = null;
+                    ds.workerToken = null;
+                    ds.workerViewToken = null;
+                    ds.managedTurnOrigin = undefined;
+                    ds.riffCloseState = undefined;
+                }
+                // The retirement coordinator owns a prepared generation. Keep the exact
+                // ChildProcess pointer until exit so it can decide whether abort/commit
+                // was durably verified.
+                try {
+                    worker.kill();
+                }
+                catch { /* best-effort failed-child fence */ }
+            }
+            if (startupState.failureNotified)
+                return;
+            startupState.failureNotified = true;
+            emitSessionLifecycleHook(ds, 'session.requires_attention', {
+                reason: 'worker_fork_error',
+                message: reason,
+            });
+            // A dedicated VC receiver and a silent schedule have no auxiliary Lark
+            // output channel. Keep lifecycle/dashboard state above, but never leak a
+            // fork diagnostic into the chat.
+            if (ds.session.vcMeetingReceiver || isSilentScheduledTurn(ds, initAttributionTurnId)) {
+                logger.info(`[${t}] Managed/silent fork failure kept out of auxiliary Lark UI `
+                    + `turn=${initAttributionTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`);
+                return;
+            }
+            const cliName = sessionCliDisplayName(ds, botCfg);
+            const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
+            void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initAttributionTurnId), ds.session.vcMeetingReceiver
+                ? { sourceSessionId: ds.session.sessionId }
+                : undefined).catch(replyErr => logger.error(`[${t}] Failed to deliver worker fork error to Lark: ${replyErr}`));
+        });
+        // Pipe worker stdout/stderr to daemon logger.
+        // Both go through logger.info → daemon.log (not error.log). Worker stderr
+        // is NOT necessarily an error: CLI adapters (claude, codex, etc.) write
+        // progress, version banners, deprecation warnings, etc. there. The line
+        // is still visible (tagged `:err`) for triage. Real worker faults arrive
+        // separately via the IPC `Worker error` branch and stay as logger.error.
+        worker.stdout?.on('data', (data) => {
+            for (const line of data.toString().split('\n')) {
+                const trimmed = line.trim();
+                if (trimmed)
+                    logger.info(`[${t}:out] ${trimmed}`);
+            }
+        });
+        worker.stderr?.on('data', (data) => {
+            for (const line of data.toString().split('\n')) {
+                logWorkerStderr(t, line.trim());
+            }
+        });
+        // Send init config — use per-bot settings
+        const runtimeIdentity = runtimeBuildIdentity();
+        initMsg = {
+            type: 'init',
+            sessionId: ds.session.sessionId,
+            chatId: ds.chatId,
+            chatType: ds.chatType,
+            rootMessageId: sessionAnchorId(ds),
+            workingDir: cwd,
+            cliId: agentCfg.cliId,
+            cliRuntime: agentCfg.cliRuntime,
+            cliPathOverride: agentCfg.cliPathOverride,
+            wrapperCli: agentCfg.wrapperCli,
+            launchShell: botCfg.launchShell,
+            model: agentCfg.model,
+            reasoningEffort: agentCfg.reasoningEffort,
+            disableCliBypass: botCfg.disableCliBypass === true,
+            codexRpcInput: botCfg.codexRpcInput === true || config.codexRpcInputDefault,
+            // Startup commands run on every fresh spawn (incl. resume) so session-only
+            // settings like `/effort ultracode` are re-established. Adopt sessions are
+            // observed, not driven — forkAdoptWorker intentionally omits this.
+            startupCommands: botCfg.startupCommands,
+            // Per-bot env (bots.json `env`) — injected into the CLI process only (e.g.
+            // ANTHROPIC_BASE_URL/AUTH_TOKEN for a GLM/3rd-party bot). Adopt sessions are
+            // observed, not driven, so forkAdoptWorker intentionally omits it.
+            env: botCfg.env,
+            // Use the decision recorded on the session (above), NOT the live bot flag, so
+            // historical sessions never get retroactively sandboxed on restart.
+            sandbox: ds.session.sandbox === true,
+            sandboxPaths: ds.session.sandboxPaths ?? botCfg.sandboxPaths,
+            sandboxHidePaths: ds.session.sandboxHidePaths ?? [],
+            sandboxReadonlyPaths: ds.session.sandboxReadonlyPaths ?? [],
+            sandboxNetwork: ds.session.sandboxNetwork !== false,
+            // Per-bot local read isolation (enforced worker-side; the worker gates it).
+            // Sibling data needs no app-id enumeration: per-bot dirs are denied wholesale
+            // and per-bot session files by filename pattern (see buildV2DenyPaths).
+            // HARD credential boundary for a no-transport session (apiOnly bot OR HTTP
+            // virtual chat): force read isolation so the CLI physically cannot read the
+            // full bots.json / sibling BOT_HOME / send-cred / lark-cli store — a model
+            // that deletes/forges the ancestry marker or bypasses the CLI still cannot
+            // build ANY (sibling) Lark client. The pid-marker gate is only friendly
+            // early-reject; THIS is the fail-closed boundary. Reuses the existing unified
+            // fs-policy (mac+Linux fail-closed); a backend that can't isolate locally
+            // refuses to spawn rather than leak creds.
+            readIsolation: botCfg.readIsolation === true
+                || !larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }),
+            readDenyExtraPaths: botCfg.readDenyExtraPaths ?? [],
+            // Identifies THIS daemon lifetime. Stamped onto isolated panes so the worker
+            // can tell a suspend→resume reattach (same boot id, still isolated) from a
+            // stale pane surviving a daemon restart (different id → kill + cold-spawn).
+            daemonBootId: DAEMON_BOOT_ID,
+            // Freeze-once: an already-running session keeps the backend stamped at spawn
+            // (ds.session.backendType) even if the bot's live `backendType` changed since —
+            // otherwise a cold-resume/refork would re-derive from live config and strand
+            // the real persistent pane (the stamp is written below; restore reads it via
+            // getSessionPersistentBackendType). A brand-new session (no stamp) resolves
+            // from live config, so a dashboard backend switch only affects NEW sessions.
+            backendType: resolvePairedSpawnBackendType(agentCfg.cliId, ds.session.backendType, botCfg.backendType, config.daemon.backendType),
+            // Shared Herdr is not derivable from sessionId: preserve the exact host +
+            // managed-agent affinity across daemon/worker replacement.
+            persistentBackendTarget: ds.session.persistentBackendTarget,
+            backendConfig: botCfg.riff,
+            riffParentTaskId: ds.session.riffParentTaskId,
+            riffRepoDirs: ds.session.riffRepoDirs,
+            deferredScheduleRun: ds.session.deferredScheduleRun,
+            ...(nativeSessionTitle ? { nativeSessionTitle } : {}),
+            ...(nativeSessionTitlePrompt ? { nativeSessionTitlePrompt } : {}),
+            prompt,
+            ...(promptCodexAppInput ? { promptCodexAppInput } : {}),
+            ...(queuedActivationToken ? { queuedActivationToken } : {}),
+            resume,
+            // One-shot native fork intent (see Session.pendingForkSession). Only the
+            // child's FIRST spawn resumes the SOURCE transcript (cliSessionId still
+            // points at the parent's CLI id here) while forking forward into a new id;
+            // the worker clears the marker + persists the child's own new id, so a
+            // later refork resumes the child normally (pendingForkSession=false).
+            forkSession: ds.session.pendingForkSession === true,
+            cliSessionId: ds.session.cliSessionId,
+            ownerOpenId: ds.ownerOpenId,
+            webPort: ds.session.webPort,
+            larkAppId: botCfg.larkAppId,
+            // Freeze on the session transport capability: a no-transport session
+            // (apiOnly bot OR HTTP virtual chat) must not even RECEIVE the real secret —
+            // withholding it removes the capability rather than gating a tamperable flag
+            // the sandboxed agent could flip. The worker then physically cannot dial
+            // Feishu (uploader/cred-write are also skipped downstream on the same test).
+            larkAppSecret: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
+            apiOnly: botCfg.apiOnly,
+            // Freeze the ACTUAL loaded bots-config path (getLoadedConfigPath) so a
+            // no-transport worker's fs-policy denies it from a HOST-owned fact, not a
+            // guess off BOTS_CONFIG env (which the agent could see/forge). When it lives
+            // outside every botmux authority root, buildFsPolicy fails the spawn closed
+            // rather than silently masking an arbitrary parent dir (codex P1). Omitted
+            // from forkAdoptWorker below — its observe branch returns before fs-policy.
+            loadedBotsConfigPath: getLoadedConfigPath(),
+            brand: normalizeBrand(botCfg.brand),
+            botName: bot.botName,
+            botOpenId: bot.botOpenId,
+            locale: botLocale(botCfg),
+            turnId: initAttributionTurnId,
+            ...(initReplyTurnId ? { replyTurnId: initReplyTurnId } : {}),
+            dispatchAttempt: initDispatchAttempt,
+            ...(codexAppDispatchId ? { codexAppDispatchId } : {}),
+            // R4-B1: COPY the frozen steer authorization onto the first-turn init so the
+            // worker can fold follow-ups into this opening turn (canSteer requires the
+            // group root to be steerable). System/recovery openings carry no flag.
+            ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+            ...(codexAppRecoveredDispatches.length > 0
+                ? { codexAppRecoveredDispatches }
+                : {}),
+            ...((ds.session.codexAppGenerationCommits?.length ?? 0) > 0
+                ? { codexAppGenerationCommits: ds.session.codexAppGenerationCommits }
+                : {}),
+            // At-most-once (idempotency lease): ride the flag on the init message so the
+            // worker tags the keyed init prompt no-replay (codex #776 round-7 #1).
+            ...(initAtMostOnce ? { atMostOnce: true } : {}),
+            vcMeetingImTurnOrigin: initVcMeetingImTurnOrigin,
+            pluginBindings: botCfg.plugins,
+            skillPolicy: botCfg.skills,
+            ...(runtimeIdentity.status === 'known'
+                ? { runnerBuildId: runtimeIdentity.id }
+                : {}),
+            ...(ds.session.runnerBuildId ? { persistedRunnerBuildId: ds.session.runnerBuildId } : {}),
+            ...(restartAttemptId ? { restartAttemptId } : {}),
+        };
+        // A persisted port from an older ZMX implementation must never revive the
+        // removed Web TUI or get forwarded as a preferred listen port. The worker
+        // will signal lifecycle readiness with port=0 instead.
+        if (!backendSupportsWebTerminal(initMsg.backendType)) {
+            initMsg.webPort = undefined;
+            if (ds.session.webPort !== undefined) {
+                ds.session.webPort = undefined;
+                sessionStore.updateSession(ds.session);
+            }
         }
-        const cliName = sessionCliDisplayName(ds, botCfg);
-        const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
-        void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initAttributionTurnId), ds.session.vcMeetingReceiver
-            ? { sourceSessionId: ds.session.sessionId }
-            : undefined).catch(replyErr => logger.error(`[${t}] Failed to deliver worker fork error to Lark: ${replyErr}`));
-    });
-    // Pipe worker stdout/stderr to daemon logger.
-    // Both go through logger.info → daemon.log (not error.log). Worker stderr
-    // is NOT necessarily an error: CLI adapters (claude, codex, etc.) write
-    // progress, version banners, deprecation warnings, etc. there. The line
-    // is still visible (tagged `:err`) for triage. Real worker faults arrive
-    // separately via the IPC `Worker error` branch and stay as logger.error.
-    worker.stdout?.on('data', (data) => {
-        for (const line of data.toString().split('\n')) {
-            const trimmed = line.trim();
-            if (trimmed)
-                logger.info(`[${t}:out] ${trimmed}`);
+        ds.initConfig = initMsg;
+        // Stamp cliId on the persisted session so the dashboard can show a CLI badge
+        // even after the session is closed. Do this before installing worker handlers:
+        // a fast worker can emit `ready` immediately after init, and card rendering
+        // must see the session-level CLI identity rather than the bot default.
+        if (ds.session.cliId !== agentCfg.cliId) {
+            ds.session.cliId = agentCfg.cliId;
+            sessionStore.updateSession(ds.session);
+        }
+        // Stamp the resolved backend on the persisted session. Since PTY退役, the
+        // worker no longer silently downgrades an unavailable backend (it hard-gates
+        // instead), so the requested backend here IS the effective one for any
+        // session that actually runs. Restore reads this back (see
+        // getSessionPersistentBackendType) so an upgraded daemon doesn't re-derive a
+        // session's backend from the now-always-tmux default and misclassify a legacy
+        // PTY session as a tmux zombie.
+        if (ds.session.backendType !== initMsg.backendType) {
+            ds.session.backendType = initMsg.backendType;
+            sessionStore.updateSession(ds.session);
+        }
+        // Use shared handler for IPC messages and exit
+        setupWorkerHandlers(ds, worker, startupState, workerGeneration);
+        ds.worker = worker;
+        if (shouldTrackOrdinaryImDelivery(ds, initMsg)) {
+            sendOrdinaryImDeliveryTracked(ds, initMsg);
+        }
+        else {
+            worker.send(initMsg);
+        }
+        ds.spawnedAt = Date.now();
+        // master: per-runtime-key CLI version (the init send already happened above via
+        // the tracked-delivery if/else — do NOT re-send initMsg here).
+        ds.cliVersion = getCurrentCliVersion(runtimeInstallationKey({
+            cliId: agentCfg.cliId,
+            cliRuntime: agentCfg.cliRuntime,
+            cliPathOverride: agentCfg.cliPathOverride,
+        }));
+        // #597: init has been dispatched. A later child 'error' event is ambiguous
+        // (init may already be executing), so only synchronous failures before this
+        // point are safe to compensate; clear the pre-init compensation handle.
+        spawnedWorker = undefined;
+    }
+    catch (err) {
+        if (ds.worker === spawnedWorker) {
+            ds.worker = null;
+            ds.workerPort = null;
+            ds.workerToken = null;
+            ds.workerViewToken = null;
         }
-    });
-    worker.stderr?.on('data', (data) => {
-        for (const line of data.toString().split('\n')) {
-            logWorkerStderr(t, line.trim());
+        if (spawnedWorker) {
+            try {
+                spawnedWorker.kill();
+            }
+            catch { /* best-effort pre-init child fence */ }
         }
-    });
-    // Send init config — use per-bot settings
-    const promptCodexAppInput = codexAppInputForSession(ds, promptPayload.codexAppInput, initAttributionTurnId);
-    const runtimeIdentity = runtimeBuildIdentity();
-    const initMsg = {
-        type: 'init',
-        sessionId: ds.session.sessionId,
-        chatId: ds.chatId,
-        chatType: ds.chatType,
-        rootMessageId: sessionAnchorId(ds),
-        workingDir: cwd,
-        cliId: agentCfg.cliId,
-        cliRuntime: agentCfg.cliRuntime,
-        cliPathOverride: agentCfg.cliPathOverride,
-        wrapperCli: agentCfg.wrapperCli,
-        launchShell: botCfg.launchShell,
-        model: agentCfg.model,
-        reasoningEffort: agentCfg.reasoningEffort,
-        disableCliBypass: botCfg.disableCliBypass === true,
-        codexRpcInput: botCfg.codexRpcInput === true || config.codexRpcInputDefault,
-        // Startup commands run on every fresh spawn (incl. resume) so session-only
-        // settings like `/effort ultracode` are re-established. Adopt sessions are
-        // observed, not driven — forkAdoptWorker intentionally omits this.
-        startupCommands: botCfg.startupCommands,
-        // Per-bot env (bots.json `env`) — injected into the CLI process only (e.g.
-        // ANTHROPIC_BASE_URL/AUTH_TOKEN for a GLM/3rd-party bot). Adopt sessions are
-        // observed, not driven, so forkAdoptWorker intentionally omits it.
-        env: botCfg.env,
-        // Use the decision recorded on the session (above), NOT the live bot flag, so
-        // historical sessions never get retroactively sandboxed on restart.
-        sandbox: ds.session.sandbox === true,
-        sandboxPaths: ds.session.sandboxPaths ?? botCfg.sandboxPaths,
-        sandboxHidePaths: ds.session.sandboxHidePaths ?? [],
-        sandboxReadonlyPaths: ds.session.sandboxReadonlyPaths ?? [],
-        sandboxNetwork: ds.session.sandboxNetwork !== false,
-        // Per-bot local read isolation (enforced worker-side; the worker gates it).
-        // Sibling data needs no app-id enumeration: per-bot dirs are denied wholesale
-        // and per-bot session files by filename pattern (see buildV2DenyPaths).
-        // HARD credential boundary for a no-transport session (apiOnly bot OR HTTP
-        // virtual chat): force read isolation so the CLI physically cannot read the
-        // full bots.json / sibling BOT_HOME / send-cred / lark-cli store — a model
-        // that deletes/forges the ancestry marker or bypasses the CLI still cannot
-        // build ANY (sibling) Lark client. The pid-marker gate is only friendly
-        // early-reject; THIS is the fail-closed boundary. Reuses the existing unified
-        // fs-policy (mac+Linux fail-closed); a backend that can't isolate locally
-        // refuses to spawn rather than leak creds.
-        readIsolation: botCfg.readIsolation === true
-            || !larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }),
-        readDenyExtraPaths: botCfg.readDenyExtraPaths ?? [],
-        // Identifies THIS daemon lifetime. Stamped onto isolated panes so the worker
-        // can tell a suspend→resume reattach (same boot id, still isolated) from a
-        // stale pane surviving a daemon restart (different id → kill + cold-spawn).
-        daemonBootId: DAEMON_BOOT_ID,
-        // Freeze-once: an already-running session keeps the backend stamped at spawn
-        // (ds.session.backendType) even if the bot's live `backendType` changed since —
-        // otherwise a cold-resume/refork would re-derive from live config and strand
-        // the real persistent pane (the stamp is written below; restore reads it via
-        // getSessionPersistentBackendType). A brand-new session (no stamp) resolves
-        // from live config, so a dashboard backend switch only affects NEW sessions.
-        backendType: resolvePairedSpawnBackendType(agentCfg.cliId, ds.session.backendType, botCfg.backendType, config.daemon.backendType),
-        // Shared Herdr is not derivable from sessionId: preserve the exact host +
-        // managed-agent affinity across daemon/worker replacement.
-        persistentBackendTarget: ds.session.persistentBackendTarget,
-        backendConfig: botCfg.riff,
-        riffParentTaskId: ds.session.riffParentTaskId,
-        riffRepoDirs: ds.session.riffRepoDirs,
-        deferredScheduleRun: ds.session.deferredScheduleRun,
-        ...(nativeSessionTitle ? { nativeSessionTitle } : {}),
-        ...(nativeSessionTitlePrompt ? { nativeSessionTitlePrompt } : {}),
-        prompt,
-        ...(promptCodexAppInput ? { promptCodexAppInput } : {}),
-        resume,
-        // One-shot native fork intent (see Session.pendingForkSession). Only the
-        // child's FIRST spawn resumes the SOURCE transcript (cliSessionId still
-        // points at the parent's CLI id here) while forking forward into a new id;
-        // the worker clears the marker + persists the child's own new id, so a
-        // later refork resumes the child normally (pendingForkSession=false).
-        forkSession: ds.session.pendingForkSession === true,
-        cliSessionId: ds.session.cliSessionId,
-        ownerOpenId: ds.ownerOpenId,
-        webPort: ds.session.webPort,
-        larkAppId: botCfg.larkAppId,
-        // Freeze on the session transport capability: a no-transport session
-        // (apiOnly bot OR HTTP virtual chat) must not even RECEIVE the real secret —
-        // withholding it removes the capability rather than gating a tamperable flag
-        // the sandboxed agent could flip. The worker then physically cannot dial
-        // Feishu (uploader/cred-write are also skipped downstream on the same test).
-        larkAppSecret: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
-        apiOnly: botCfg.apiOnly,
-        // Freeze the ACTUAL loaded bots-config path (getLoadedConfigPath) so a
-        // no-transport worker's fs-policy denies it from a HOST-owned fact, not a
-        // guess off BOTS_CONFIG env (which the agent could see/forge). When it lives
-        // outside every botmux authority root, buildFsPolicy fails the spawn closed
-        // rather than silently masking an arbitrary parent dir (codex P1). Omitted
-        // from forkAdoptWorker below — its observe branch returns before fs-policy.
-        loadedBotsConfigPath: getLoadedConfigPath(),
-        brand: normalizeBrand(botCfg.brand),
-        botName: bot.botName,
-        botOpenId: bot.botOpenId,
-        locale: botLocale(botCfg),
-        turnId: initAttributionTurnId,
-        dispatchAttempt: initDispatchAttempt,
-        vcMeetingImTurnOrigin: resolveVcMeetingImTurnOrigin(ds.session, initAttributionTurnId),
-        pluginBindings: botCfg.plugins,
-        skillPolicy: botCfg.skills,
-        ...(runtimeIdentity.status === 'known'
-            ? { runnerBuildId: runtimeIdentity.id }
-            : {}),
-        ...(ds.session.runnerBuildId ? { persistedRunnerBuildId: ds.session.runnerBuildId } : {}),
-        ...(restartAttemptId ? { restartAttemptId } : {}),
-    };
-    // A persisted port from an older ZMX implementation must never revive the
-    // removed Web TUI or get forwarded as a preferred listen port. The worker
-    // will signal lifecycle readiness with port=0 instead.
-    if (!backendSupportsWebTerminal(initMsg.backendType)) {
-        initMsg.webPort = undefined;
-        if (ds.session.webPort !== undefined) {
-            ds.session.webPort = undefined;
-            sessionStore.updateSession(ds.session);
+        try {
+            rollbackWorkerForkPreInit(ds, queuedForkSnapshot, acceptedForkDispatch);
         }
+        catch (rollbackErr) {
+            logger.error(`[${tag(ds)}] Worker pre-init failure could not durably restore queued/FIFO state: `
+                + `${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`);
+            throw new AggregateError([err, rollbackErr], `Worker pre-init failed and durable rollback failed for ${ds.session.sessionId}`);
+        }
+        throw err;
     }
     ds.initConfig = initMsg;
-    // Stamp cliId on the persisted session so the dashboard can show a CLI badge
-    // even after the session is closed. Do this before installing worker handlers:
-    // a fast worker can emit `ready` immediately after init, and card rendering
-    // must see the session-level CLI identity rather than the bot default.
-    if (ds.session.cliId !== agentCfg.cliId) {
-        ds.session.cliId = agentCfg.cliId;
-        sessionStore.updateSession(ds.session);
-    }
-    // Stamp the resolved backend on the persisted session. Since PTY退役, the
-    // worker no longer silently downgrades an unavailable backend (it hard-gates
-    // instead), so the requested backend here IS the effective one for any
-    // session that actually runs. Restore reads this back (see
-    // getSessionPersistentBackendType) so an upgraded daemon doesn't re-derive a
-    // session's backend from the now-always-tmux default and misclassify a legacy
-    // PTY session as a tmux zombie.
-    if (ds.session.backendType !== initMsg.backendType) {
-        ds.session.backendType = initMsg.backendType;
-        sessionStore.updateSession(ds.session);
-    }
-    // Use shared handler for IPC messages and exit
-    setupWorkerHandlers(ds, worker, startupState, workerGeneration);
-    ds.worker = worker;
-    if (shouldTrackOrdinaryImDelivery(ds, initMsg)) {
-        sendOrdinaryImDeliveryTracked(ds, initMsg);
+    try {
+        sessionStore.updateSessionPid(ds.session.sessionId, worker.pid ?? null);
     }
-    else {
-        worker.send(initMsg);
+    catch (err) {
+        // Init may already be executing. PID bookkeeping failure must not turn an
+        // accepted activation into a retryable error or orphan the attached child.
+        logger.error(`[${t}] Failed to persist attached worker pid: ${err instanceof Error ? err.message : String(err)}`);
     }
-    ds.spawnedAt = Date.now();
-    ds.cliVersion = getCurrentCliVersion(runtimeInstallationKey({
-        cliId: agentCfg.cliId,
-        cliRuntime: agentCfg.cliRuntime,
-        cliPathOverride: agentCfg.cliPathOverride,
-    }));
-    sessionStore.updateSessionPid(ds.session.sessionId, worker.pid ?? null);
     logger.info(`[${t}] Worker forked (pid: ${worker.pid}, active: ${cb.getActiveCount()})`);
     // Reset the exit-emit flag for the freshly spawned worker so a subsequent
     // exit publishes again (the previous lifecycle's flag would otherwise mask it).
     ds.exitEventEmitted = false;
     // Notify dashboard SSE subscribers a new session is live.
-    dashboardEventBus.publish({
-        type: 'session.spawned',
-        body: { session: composeRowFromActive(ds) },
-    });
-    cb.enforceLiveSessionCap?.();
-    emitSessionLifecycleHook(ds, 'session.start', {
-        reason: resume ? 'resume' : 'worker_spawn',
-        pid: worker.pid ?? null,
-    });
+    try {
+        dashboardEventBus.publish({
+            type: 'session.spawned',
+            body: { session: composeRowFromActive(ds) },
+        });
+    }
+    catch (err) {
+        logger.error(`[${t}] Failed to publish attached worker state: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        cb.enforceLiveSessionCap?.();
+    }
+    catch (err) {
+        logger.error(`[${t}] Failed to enforce live-session cap after attach: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        emitSessionLifecycleHook(ds, 'session.start', {
+            reason: resume ? 'resume' : 'worker_spawn',
+            pid: worker.pid ?? null,
+        });
+    }
+    catch (err) {
+        logger.error(`[${t}] Failed to emit attached worker lifecycle hook: ${err instanceof Error ? err.message : String(err)}`);
+    }
     // Usage ledger: fresh spawns anchor the baseline so pre-existing transcript
     // history is never billed. Restores reconcile instead — an in-flight turn
     // may have completed inside tmux while the daemon was down, and that work
     // was submitted by botmux (anchoring would swallow it).
-    if (resume)
-        reconcileUsageForDaemonSession(ds);
-    else
-        anchorUsageForDaemonSession(ds);
-    recordOwnershipForDaemonSession(ds);
+    try {
+        if (resume)
+            reconcileUsageForDaemonSession(ds);
+        else
+            anchorUsageForDaemonSession(ds);
+    }
+    catch (err) {
+        logger.error(`[${t}] Failed to initialize attached worker usage state: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        recordOwnershipForDaemonSession(ds);
+    }
+    catch (err) {
+        logger.error(`[${t}] Failed to record attached worker ownership: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return true;
 }
 // ─── Shared worker IPC handler ──────────────────────────────────────────────
 /**
@@ -4064,6 +5605,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     // Codex badge before a role switch starts a non-Codex worker.
     ds.codexServiceTier = undefined;
     ds.pendingCodexTierCardRefresh = undefined;
+    // Active runtime is likewise authority of this exact worker generation. The
+    // new worker republishes it via active_runtime after re-reading the rollout;
+    // clear it here so the window between respawn and that first observation
+    // cannot leave a stale model/effort tail on the card.
+    ds.activeModel = undefined;
+    ds.activeReasoningEffort = undefined;
+    ds.pendingActiveRuntimeCardRefresh = undefined;
     const handlerSession = ds.session;
     const handlerAnchor = sessionAnchorId(ds);
     const handlerLarkAppId = ds.larkAppId;
@@ -4266,6 +5814,67 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 };
                 break;
             }
+            case 'queued_activation_submitted': {
+                if (ds.worker !== worker || msg.sessionId !== ds.session.sessionId)
+                    break;
+                if (!ds.session.queuedActivationPending
+                    || !ds.session.queuedActivationToken
+                    || ds.session.queuedActivationToken !== msg.activationToken) {
+                    logger.warn(`[${t}] Ignored stale queued activation ACK ${msg.activationToken.substring(0, 8)}`);
+                    break;
+                }
+                const releaseReservation = async (attempt) => {
+                    if (ds.worker !== worker || !ds.initialStartPending)
+                        return;
+                    try {
+                        if (cb.onQueuedActivationSubmitted) {
+                            const released = await cb.onQueuedActivationSubmitted(ds, msg.activationToken);
+                            if (released === false && ds.worker === worker && ds.initialStartPending) {
+                                const delayMs = Math.min(100 * (2 ** Math.min(attempt, 6)), 5_000);
+                                logger.warn(`[${t}] Queued activation follow-up was not accepted (attempt ${attempt + 1}); `
+                                    + `retrying in ${delayMs}ms`);
+                                const timer = setTimeout(() => { void releaseReservation(attempt + 1); }, delayMs);
+                                timer.unref?.();
+                            }
+                        }
+                        else {
+                            ds.initialStartPending = false;
+                            ds.initialStartClaimToken = undefined;
+                        }
+                    }
+                    catch (err) {
+                        logger.error(`[${t}] Queued activation follow-up release failed unexpectedly; `
+                            + `delivery was not retried because acceptance is unknown: `
+                            + `${err instanceof Error ? err.message : String(err)}`);
+                    }
+                };
+                const journal = snapshotQueuedActivationJournal(ds.session);
+                const persistActivationAck = async (attempt) => {
+                    if (ds.worker !== worker
+                        || !ds.session.queuedActivationPending
+                        || ds.session.queuedActivationToken !== msg.activationToken)
+                        return;
+                    clearQueuedActivationJournal(ds.session);
+                    try {
+                        sessionStore.updateSession(ds.session);
+                    }
+                    catch (err) {
+                        restoreQueuedActivationJournal(ds.session, journal);
+                        const delayMs = Math.min(100 * (2 ** Math.min(attempt, 6)), 5_000);
+                        logger.error(`[${t}] Failed to persist queued activation ACK; retained journal and `
+                            + `will retry in ${delayMs}ms: ${err instanceof Error ? err.message : String(err)}`);
+                        const timer = setTimeout(() => { void persistActivationAck(attempt + 1); }, delayMs);
+                        timer.unref?.();
+                        return;
+                    }
+                    // Crossing the adapter boundary means this session now owns CLI
+                    // history even if the worker dies before it can publish a session id.
+                    ds.hasHistory = true;
+                    await releaseReservation(0);
+                };
+                await persistActivationAck(0);
+                break;
+            }
             case 'ready': {
                 if (!ownsLifecycleMutation()) {
                     logger.warn(`[${t}] Ignored ready from stale/transferring worker generation`);
@@ -4468,6 +6077,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     recallFrozenCards(ds);
                     flushPendingLocalCliOpenReadinessPatch(ds);
                     flushPendingRiffUrlPatch(ds);
+                    flushPendingActiveRuntimePatch(ds);
                     flushPendingCodexServiceTierPatch(ds);
                     // Fresh ready POST: if this turn is already `working` (e.g. relay
                     // resume where the CLI kept running), arm here — same authorized arm
@@ -4478,9 +6088,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     if (!ownsLifecycleMutation())
                         break;
                     if (err instanceof MessageWithdrawnError) {
-                        logger.warn(`[${t}] Root message withdrawn, closing stale session`);
-                        killWorker(ds);
-                        cb.closeSession(ds);
+                        await closeWithdrawnSessionIfLedgerEmpty(ds, 'Root message withdrawn while creating worker-ready card');
                         break;
                     }
                     logger.warn(`[${t}] Failed to send streaming card, falling back to static card: ${err}`);
@@ -4513,9 +6121,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         if (!ownsLifecycleMutation())
                             break;
                         if (fallbackErr instanceof MessageWithdrawnError) {
-                            logger.warn(`[${t}] Root message withdrawn, closing stale session`);
-                            killWorker(ds);
-                            cb.closeSession(ds);
+                            await closeWithdrawnSessionIfLedgerEmpty(ds, 'Root message withdrawn while creating fallback worker-ready card');
                             break;
                         }
                         throw fallbackErr;
@@ -4556,10 +6162,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     sendWorkerSessionInput(ds, {
                         type: 'raw_input',
                         content: rawInput,
-                        ...(rawTurnId ? { turnId: rawTurnId } : {}),
+                        ...((ds.session.queuedActivationTurnId ?? rawTurnId)
+                            ? { turnId: ds.session.queuedActivationTurnId ?? rawTurnId }
+                            : {}),
                         followUpContent: followUp?.cliInput,
                         ...(followUp?.turnId ? { followUpTurnId: followUp.turnId } : {}),
                         ...(followUpCodexAppInput ? { followUpCodexAppInput } : {}),
+                        ...(ds.session.queuedActivationToken
+                            ? { queuedActivationToken: ds.session.queuedActivationToken }
+                            : {}),
                     });
                     logger.info(`[${t}] Sent pending raw input after prompt_ready: ${rawInput.substring(0, 80)}${followUp ? ` (+follow-up ${followUp.cliInput.length} chars)` : ''}`);
                     if (followUp)
@@ -4638,6 +6249,24 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 sessionStore.updateSession(ds.session);
                 break;
             }
+            case 'active_runtime': {
+                if (ds.worker !== worker
+                    || ds.workerGeneration !== workerGeneration
+                    || ds.session.workerGeneration !== workerGeneration) {
+                    logger.warn(`[${t}] Ignored active_runtime from stale worker generation`);
+                    break;
+                }
+                const model = msg.model?.trim() || undefined;
+                const reasoningEffort = msg.reasoningEffort?.trim() || undefined;
+                if (ds.activeModel === model
+                    && ds.activeReasoningEffort === reasoningEffort) {
+                    break;
+                }
+                ds.activeModel = model;
+                ds.activeReasoningEffort = reasoningEffort;
+                scheduleActiveRuntimePatch(ds);
+                break;
+            }
             case 'codex_service_tier': {
                 if (ds.worker !== worker
                     || ds.workerGeneration !== workerGeneration
@@ -4648,6 +6277,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 ds.codexServiceTier = effectiveCliId === 'codex'
                     ? (msg.snapshot ?? undefined)
                     : undefined;
+                // Model/effort now flow through the active_runtime channel (Codex
+                // publishes them from every turn_context, same as TRAE), so this
+                // handler is scoped to the ⚡ service-tier badge only and must NOT
+                // also write activeModel/activeReasoningEffort — doing so would race
+                // the active_runtime writer and, since thread_settings_applied is not
+                // emitted in many sessions, could clobber the good value with a stale
+                // one.
                 scheduleCodexServiceTierPatch(ds);
                 break;
             }
@@ -4783,6 +6419,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         recallFrozenCards(ds);
                         flushPendingLocalCliOpenReadinessPatch(ds);
                         flushPendingRiffUrlPatch(ds);
+                        flushPendingActiveRuntimePatch(ds);
                         flushPendingCodexServiceTierPatch(ds);
                         // New-turn POST is the FIRST working screen_update of the turn —
                         // the else (same-turn PATCH) branch never runs for it, so arm the
@@ -4790,18 +6427,17 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // the POSTING sentinel). syncUsageRefreshTimer re-checks state.
                         syncUsageRefreshTimer(ds);
                     })
-                        .catch(err => {
+                        .catch(async (err) => {
                         if (!ownsLifecycleMutation())
                             return;
                         if (err instanceof MessageWithdrawnError) {
-                            logger.warn(`[${t}] Root message withdrawn, closing stale session`);
-                            killWorker(ds);
-                            cb.closeSession(ds);
+                            await closeWithdrawnSessionIfLedgerEmpty(ds, 'Root message withdrawn while creating streaming card');
                             return;
                         }
                         logger.debug(`[${t}] Failed to create streaming card: ${err}`);
                         ds.streamCardId = undefined;
                         clearPendingLocalCliOpenReadinessPatch(ds);
+                        ds.pendingActiveRuntimeCardRefresh = undefined;
                         ds.pendingCodexTierCardRefresh = undefined;
                         persistStreamCardState(ds);
                     });
@@ -5202,6 +6838,30 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     }
                     break;
                 }
+                // Riff is a remote lineage-owning backend, not a local CLI process.
+                // The worker intentionally refuses restart because tearing it down can
+                // destroy or orphan the remote sandbox. Stop before crash-loop
+                // accounting and tell the user how to recover, rather than logging an
+                // "auto-restart" whose IPC is guaranteed to be a no-op.
+                if (isRiffBackendSession(ds)) {
+                    const retirementPhase = riffRetirementAdmissionPhase(ds);
+                    logger.warn(`[${t}] Riff backend exited; automatic restart is unsupported`
+                        + (retirementPhase ? ` (${retirementPhase})` : ''));
+                    // Explicit /close and daemon shutdown already own the user-visible
+                    // lifecycle. Only an unexpected backend exit needs recovery guidance.
+                    if (!retirementPhase && !suppressExitUi) {
+                        try {
+                            await scopedReply(tr('cmd.restart.riff_unsupported', undefined, loc), 'text', undefined);
+                        }
+                        catch (replyErr) {
+                            if (replyErr instanceof MessageWithdrawnError) {
+                                logger.warn(`[${t}] Root message withdrawn, closing stale session`);
+                                cb.closeSession(ds);
+                            }
+                        }
+                    }
+                    break;
+                }
                 // Rate-limit auto-restart to prevent crash loops
                 const key = ds.session.sessionId;
                 const rc = restartCounts.get(key) ?? { count: 0, lastAt: 0 };
@@ -5266,8 +6926,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         }
                         catch (replyErr) {
                             if (replyErr instanceof MessageWithdrawnError && ownsLifecycleMutation()) {
-                                logger.warn(`[${t}] Root message withdrawn, closing stale session`);
-                                cb.closeSession(ds);
+                                await closeWithdrawnSessionIfLedgerEmpty(ds, 'Root message withdrawn while sending crash diagnostic');
                             }
                         }
                     }
@@ -5279,7 +6938,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (ds.worker && !ds.worker.killed) {
                     logger.info(`[${t}] Auto-restarting ${sessionCliDisplayName(ds, botCfg)}...`);
                     ds.workerReady = false;
-                    ds.worker.send({ type: 'restart', env: latestPerBotEnvForRestart(ds) });
+                    ds.worker.send({ type: 'restart', reason: 'cli_crash', env: latestPerBotEnvForRestart(ds) });
                 }
                 break;
             }
@@ -5317,8 +6976,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (msg.taskId === null) {
                     // follow-up 血缘断裂：清掉持久化锚点，否则 daemon 重启会复活已判坏的 parent。
                     if (ds.session.riffParentTaskId) {
+                        const priorTaskId = ds.session.riffParentTaskId;
                         ds.session.riffParentTaskId = undefined;
-                        sessionStore.updateSession(ds.session);
+                        try {
+                            sessionStore.updateSession(ds.session);
+                        }
+                        catch (err) {
+                            ds.session.riffParentTaskId = priorTaskId;
+                            logger.error(`[${t}] Failed to clear Riff lineage: ${err instanceof Error ? err.message : String(err)}`);
+                        }
                     }
                     break;
                 }
@@ -5329,7 +6995,32 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // next message continues the riff conversation in the warm sandbox
                 // instead of cold-booting a context-less fresh task (4-5 min).
                 ds.session.riffParentTaskId = msg.taskId;
-                sessionStore.updateSession(ds.session);
+                try {
+                    sessionStore.updateSession(ds.session);
+                }
+                catch (err) {
+                    // Retain the newest runtime lineage. A close_result or later task-id
+                    // event retries persistence; reverting here would make a follow-up
+                    // target the stale parent while the worker owns the new child.
+                    logger.error(`[${t}] Failed to persist Riff lineage ${msg.taskId}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                break;
+            }
+            case 'close_result': {
+                const pending = pendingRiffWorkerCloses.get(msg.requestId);
+                if (!pending
+                    || pending.worker !== worker
+                    || pending.sessionId !== ds.session.sessionId
+                    || ds.worker !== worker) {
+                    logger.warn(`[${t}] Ignored stale/unmatched Riff close result ${msg.requestId}`);
+                    break;
+                }
+                pendingRiffWorkerCloses.delete(msg.requestId);
+                pending.resolve({
+                    ok: msg.ok,
+                    ...(msg.taskId ? { taskId: msg.taskId } : {}),
+                    ...(msg.error ? { error: msg.error } : {}),
+                });
                 break;
             }
             case 'deferred_topic_materialized': {
@@ -5507,8 +7198,41 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     logger.warn(`[${t}] Dropped managed_turn_origin with mismatched sessionId`);
                     break;
                 }
+                // macOS uses one stable per-session pathname visible inside Seatbelt.
+                // Only the daemon handler for the CURRENT ChildProcess generation may
+                // replace it. Stale workers can still emit IPC, but the identity guard
+                // above drops them before filesystem mutation, so they cannot overwrite
+                // a successor capability (or unlink it during teardown).
+                if (process.platform === 'darwin' && msg.originChannelId) {
+                    if (!/^[a-f0-9]{64}$/.test(msg.originChannelId)) {
+                        ds.managedTurnOrigin = undefined;
+                        logger.error(`[${t}] Refused managed origin publication with an invalid pane channel`);
+                        break;
+                    }
+                    try {
+                        const ipcPort = Number(process.env.BOTMUX_DAEMON_IPC_PORT);
+                        replaceManagedOriginCapabilityFile(managedOriginCapabilityPath(config.session.dataDir, msg.sessionId, msg.originChannelId), JSON.stringify({
+                            sessionId: msg.sessionId,
+                            channelId: msg.originChannelId,
+                            capability: msg.capability,
+                            ...(Number.isSafeInteger(ipcPort) && ipcPort > 0 && ipcPort <= 65_535
+                                ? { ipcPort }
+                                : {}),
+                            ...(msg.turnId ? { turnId: msg.turnId } : {}),
+                            ...(msg.dispatchAttempt !== undefined
+                                ? { dispatchAttempt: msg.dispatchAttempt }
+                                : {}),
+                        }));
+                    }
+                    catch (err) {
+                        ds.managedTurnOrigin = undefined;
+                        logger.error(`[${t}] Failed to publish daemon-owned managed origin capability: ${err instanceof Error ? err.message : String(err)}`);
+                        break;
+                    }
+                }
                 ds.managedTurnOrigin = {
                     capability: msg.capability,
+                    ...(msg.originChannelId ? { originChannelId: msg.originChannelId } : {}),
                     ...(msg.turnId ? { turnId: msg.turnId } : {}),
                     ...(msg.dispatchAttempt !== undefined
                         ? { dispatchAttempt: msg.dispatchAttempt }
@@ -5533,6 +7257,12 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     logger.warn(`[${t}] Ignored stale managed turn origin revoke after capability rotation`);
                     break;
                 }
+                if (msg.originChannelId
+                    && ds.managedTurnOrigin?.originChannelId
+                    && ds.managedTurnOrigin.originChannelId !== msg.originChannelId) {
+                    logger.warn(`[${t}] Ignored managed_turn_origin_revoked for a different pane channel`);
+                    break;
+                }
                 if (!msg.capability && ds.managedTurnOrigin
                     && (ds.managedTurnOrigin.turnId !== msg.turnId
                         || ds.managedTurnOrigin.dispatchAttempt !== msg.dispatchAttempt)) {
@@ -5542,11 +7272,252 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 ds.managedTurnOrigin = undefined;
                 break;
             }
+            case 'codex_app_dispatch_transition': {
+                const acknowledge = (ok, error) => {
+                    try {
+                        worker.send({
+                            type: 'codex_app_dispatch_persisted',
+                            requestId: msg.requestId,
+                            ok,
+                            ...(error ? { error } : {}),
+                        });
+                    }
+                    catch { /* worker exit makes the prepared/final state replayable */ }
+                };
+                if (ds.worker !== worker) {
+                    acknowledge(false, 'stale_worker_generation');
+                    break;
+                }
+                if (msg.sessionId !== ds.session.sessionId) {
+                    acknowledge(false, 'session_mismatch');
+                    break;
+                }
+                const ledger = ds.session.codexAppDispatchLedger ?? [];
+                let next;
+                if (msg.operation === 'submit') {
+                    if (msg.entries.length !== 1) {
+                        acknowledge(false, 'submit_requires_one_entry');
+                        break;
+                    }
+                    next = prepareCodexAppDispatch(ledger, msg.entries[0]);
+                }
+                else if (msg.operation === 'retry') {
+                    if (msg.entries.length !== 1) {
+                        acknowledge(false, 'retry_requires_one_entry');
+                        break;
+                    }
+                    next = retryPreparedCodexAppDispatch(ledger, msg.entries[0]);
+                }
+                else {
+                    if (msg.entries.length !== 1) {
+                        acknowledge(false, 'cancel_requires_one_entry');
+                        break;
+                    }
+                    next = cancelCodexAppDispatch(ledger, msg.entries[0]);
+                }
+                if (!next.ok) {
+                    acknowledge(false, next.error);
+                    break;
+                }
+                const priorLedger = ds.session.codexAppDispatchLedger;
+                ds.session.codexAppDispatchLedger = next.ledger;
+                let persisted = false;
+                try {
+                    sessionStore.updateSession(ds.session);
+                    persisted = true;
+                    acknowledge(true);
+                }
+                catch (err) {
+                    ds.session.codexAppDispatchLedger = priorLedger;
+                    acknowledge(false, err?.message ?? 'session_store_write_failed');
+                }
+                if (persisted && !hasUnsettledCodexAppDispatch(ds.session.codexAppDispatchLedger)) {
+                    try {
+                        await cb.onCodexAppLedgerDrained?.(ds);
+                    }
+                    catch (err) {
+                        logger.error(`[${t}] post-drain cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
+                break;
+            }
+            case 'codex_app_generation_active': {
+                if (ds.worker !== worker || msg.sessionId !== ds.session.sessionId)
+                    break;
+                if (!msg.fresh)
+                    break;
+                const priorCommits = ds.session.codexAppGenerationCommits;
+                ds.session.codexAppGenerationCommits = retainFreshCodexAppGeneration(ds.session.codexAppGenerationCommits ?? [], msg.generation);
+                try {
+                    sessionStore.updateSession(ds.session);
+                }
+                catch (err) {
+                    ds.session.codexAppGenerationCommits = priorCommits;
+                    logger.error(`[${t}] Failed to persist fresh Codex App generation: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                break;
+            }
             case 'session_close_ready': {
                 resolveCloseFence(msg.sessionId, workerGeneration);
                 break;
             }
             case 'final_output': {
+                if (msg.codexAppSettlement) {
+                    const settlement = msg.codexAppSettlement;
+                    const acknowledge = (ok, error) => {
+                        try {
+                            worker.send({
+                                type: 'codex_app_dispatch_persisted',
+                                requestId: settlement.requestId,
+                                ok,
+                                ...(error ? { error } : {}),
+                            });
+                        }
+                        catch { /* runner keeps the final unacknowledged for replacement */ }
+                    };
+                    if (ds.worker !== worker) {
+                        acknowledge(false, 'stale_worker_generation');
+                        break;
+                    }
+                    if (msg.sessionId !== ds.session.sessionId) {
+                        acknowledge(false, 'session_mismatch');
+                        break;
+                    }
+                    if (committedCodexAppSequence(ds.session.codexAppGenerationCommits ?? [], settlement.generation, settlement.seq)) {
+                        acknowledge(true);
+                        if (!hasUnsettledCodexAppDispatch(ds.session.codexAppDispatchLedger)) {
+                            try {
+                                await cb.onCodexAppLedgerDrained?.(ds);
+                            }
+                            catch (err) {
+                                logger.error(`[${t}] post-drain cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+                            }
+                        }
+                        break;
+                    }
+                    const identity = {
+                        dispatchId: settlement.dispatchId,
+                        turnId: msg.turnId,
+                        ...(msg.dispatchAttempt !== undefined
+                            ? { dispatchAttempt: msg.dispatchAttempt }
+                            : {}),
+                    };
+                    const preview = settleCodexAppDispatch(ds.session.codexAppDispatchLedger ?? [], ds.session.codexAppGenerationCommits ?? [], identity, settlement.generation, settlement.seq);
+                    if (!preview.ok) {
+                        acknowledge(false, preview.error);
+                        break;
+                    }
+                    // R4/R5-B4 defense-in-depth: a `steer_superseded` settlement silently
+                    // advances the FIFO without delivering, so it is ONLY legitimate for a
+                    // genuine plain-Lark steerable head that STILL has a successor. Reject
+                    // (ACK=false, no pop, no receiver completion, no mutation) BEFORE the
+                    // commit block below if the settled entry is not steerable, not an
+                    // explicit Lark sink, belongs to a VC / durable-receiver / special
+                    // channel, or is the SOLE remaining head. R5: `deliverySink` must be
+                    // exactly 'lark' — admission always writes both sink and steerable
+                    // together, so "steerable=true + sink missing" can only be a
+                    // mixed/corrupt/legacy ledger and must fail closed, not be treated as
+                    // safe Lark. And a lone forged superseded (no successor) must never
+                    // silently commit the only head — the real final would then find no
+                    // pending turn. preview.ledger is the post-settle remainder.
+                    if (msg.disposition === 'steer_superseded') {
+                        const entry = preview.settledEntry;
+                        const supersededHeadOk = entry.codexAppSteerable === true
+                            && entry.deliverySink === 'lark'
+                            && entry.vcMeetingImTurnOrigin === undefined
+                            && ds.session.vcMeetingReceiver === undefined
+                            && preview.ledger.length > 0;
+                        if (!supersededHeadOk) {
+                            logger.warn(`[${t}] Rejected steer_superseded for non-steerable/special/last head `
+                                + `(turn ${msg.turnId.substring(0, 8)}, sink=${entry.deliverySink ?? 'legacy'}, `
+                                + `steerable=${entry.codexAppSteerable === true}, successors=${preview.ledger.length})`);
+                            acknowledge(false, 'superseded_head_not_plain_lark_steerable_with_successor');
+                            break;
+                        }
+                    }
+                    const key = `${ds.session.sessionId}:${settlement.generation}:${settlement.seq}`;
+                    let inFlight = codexAppFinalSettlementInFlight.get(key);
+                    if (!inFlight) {
+                        inFlight = (async () => {
+                            const unavailableSinkFailClosed = codexAppDeliveryMustFailClosed(ds, preview.settledEntry);
+                            const deliverySuppressed = msg.suppressDelivery === true
+                                || managedFinalOutputSuppressed(msg.turnId, msg.dispatchAttempt)
+                                || unavailableSinkFailClosed;
+                            if (unavailableSinkFailClosed
+                                && preview.settledEntry.deliverySink !== 'suppressed'
+                                && msg.suppressDelivery !== true) {
+                                logger.warn(`[${t}] Codex App recovery suppressed unavailable `
+                                    + `${preview.settledEntry.deliverySink ?? 'legacy non-Lark'} sink `
+                                    + `(turn ${msg.turnId.substring(0, 8)})`);
+                            }
+                            const alreadyDelivered = ds.lastBridgeEmittedUuid === finalOutputDedupeKey(ds, msg);
+                            const owned = deliverySuppressed || !msg.content.trim() || alreadyDelivered
+                                ? true
+                                : await new Promise(resolve => {
+                                    deliverFinalOutput(ds, msg, t, 0, resolve, () => ds.worker === worker
+                                        && ds.session.sessionId === msg.sessionId, preview.settledEntry.replyTarget);
+                                });
+                            if (!owned)
+                                return false;
+                            // Re-read after the asynchronous external delivery. A concurrent
+                            // replacement may already have committed this signed sequence;
+                            // that is idempotent success, never a second FIFO pop.
+                            if (committedCodexAppSequence(ds.session.codexAppGenerationCommits ?? [], settlement.generation, settlement.seq))
+                                return true;
+                            const committed = settleCodexAppDispatch(ds.session.codexAppDispatchLedger ?? [], ds.session.codexAppGenerationCommits ?? [], identity, settlement.generation, settlement.seq);
+                            if (!committed.ok)
+                                return false;
+                            if (msg.dispatchAttempt !== undefined) {
+                                try {
+                                    // Durable receivers must not depend on the worker surviving
+                                    // the daemon ACK long enough to emit a later terminal IPC.
+                                    // Persist the exact completed attempt first; the worker's
+                                    // ordered duplicate terminal remains idempotent.
+                                    await cb.onTurnTerminal?.(ds, {
+                                        type: 'turn_terminal',
+                                        sessionId: ds.session.sessionId,
+                                        turnId: msg.turnId,
+                                        dispatchAttempt: msg.dispatchAttempt,
+                                        status: 'completed',
+                                    }, { workerGeneration });
+                                }
+                                catch (err) {
+                                    logger.error(`[${t}] Failed to persist Codex App settlement terminal: ${err instanceof Error ? err.message : String(err)}`);
+                                    return false;
+                                }
+                            }
+                            const priorLedger = ds.session.codexAppDispatchLedger;
+                            const priorCommits = ds.session.codexAppGenerationCommits;
+                            ds.session.codexAppDispatchLedger = committed.ledger;
+                            ds.session.codexAppGenerationCommits = committed.commits;
+                            try {
+                                // One atomic sessions-file replacement owns both the exact FIFO
+                                // pop and cumulative runner ACK boundary. Only after this write
+                                // may the worker acknowledge final-end to the runner.
+                                sessionStore.updateSession(ds.session);
+                                return true;
+                            }
+                            catch (err) {
+                                ds.session.codexAppDispatchLedger = priorLedger;
+                                ds.session.codexAppGenerationCommits = priorCommits;
+                                logger.error(`[${t}] Failed to persist Codex App final settlement: ${err instanceof Error ? err.message : String(err)}`);
+                                return false;
+                            }
+                        })().finally(() => codexAppFinalSettlementInFlight.delete(key));
+                        codexAppFinalSettlementInFlight.set(key, inFlight);
+                    }
+                    const persisted = await inFlight;
+                    acknowledge(persisted, persisted ? undefined : 'final_settlement_failed');
+                    if (persisted && !hasUnsettledCodexAppDispatch(ds.session.codexAppDispatchLedger)) {
+                        try {
+                            await cb.onCodexAppLedgerDrained?.(ds);
+                        }
+                        catch (err) {
+                            logger.error(`[${t}] post-drain cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
+                    break;
+                }
                 // Adopt-bridge: worker harvested the assistant turn from Claude Code's
                 // transcript JSONL and forwarded it to us. Dedup with a session-scoped
                 // key so a re-drain can't re-send the same answer or cross-suppress
@@ -5586,7 +7557,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (msg.turnId.startsWith('mlrp_turn_')) {
                     markMessageListenerRunPreviewRunning(msg.turnId);
                 }
-                deliverFinalOutput(ds, msg, t, 0, ownsLifecycleMutation);
+                deliverFinalOutput(ds, msg, t, 0, undefined, ownsLifecycleMutation);
                 break;
             }
             case 'adopt_preamble': {
@@ -5648,13 +7619,29 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         // old worker's exit fires AFTER the new worker has been assigned.
         if (ds.worker === worker) {
             restartCoordinator.failSession(ds.session.sessionId);
+            if (ds.session.queuedActivationPending) {
+                // Journal ownership is backend-independent. The next worker replays
+                // this exact head with queuedActivationResume before durable tail N+1.
+                ds.initialStartPending = false;
+                ds.initialStartClaimToken = undefined;
+            }
+            else {
+                reparkQueuedActivationFollowUpTail(ds, 'worker exit during activation follow-up handoff');
+            }
             ds.worker = null;
             ds.workerReady = false;
             ds.workerPort = null;
             // Dead worker generation — stop the periodic usage refresh immediately
             // instead of waiting a tick for it to self-clear on !workerHasInitialized.
             clearUsageRefreshTimer(ds);
+            ds.workerToken = null;
+            ds.workerViewToken = null;
             ds.managedTurnOrigin = undefined;
+            if (ds.riffCloseState) {
+                ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+            }
+            // Do not clear riffShutdownState here. Only the shutdown coordinator can
+            // release a generation after lineage persistence or admission restore.
             // This worker generation is gone. Invalidate any stuck-warning card it
             // posted so a late click cannot inject keys into a replacement worker.
             invalidateStuckWarning(ds, 'worker_exit');
@@ -5710,6 +7697,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
 }
 // ─── Bridge final-output delivery (with retry) ──────────────────────────────
 const FINAL_OUTPUT_RETRY_BACKOFF_MS = [0, 5000, 15000]; // immediate, +5s, +15s
+const codexAppFinalSettlementInFlight = new Map();
 function finalOutputDedupeKey(ds, msg) {
     return `${msg.sessionId ?? ds.session.sessionId}:${msg.lastUuid || msg.turnId}`;
 }
@@ -5784,14 +7772,16 @@ async function finishTurnReactions(ds) {
         }
     }
 }
-/** Deliver a bridge `final_output` to Lark. The worker emits each turn
- *  exactly once (it pops the turn off its queue at emit time), so the
- *  daemon owns retries on transient failures. After 3 attempts we log
+/** Deliver a bridge `final_output` to Lark. The current worker generation pops
+ *  the turn at emit time, while replacement recovery may replay it with the
+ *  same provider key; the daemon owns bounded transient retries. After 3 attempts we log
  *  and give up — the user's answer is lost; better than leaking memory
  *  via an unbounded retry loop. */
-function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, frozenUsage) {
-    if (!stillCurrent())
+function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () => true, frozenReplyTarget, frozenUsage) {
+    if (!isStillOwned()) {
+        onComplete?.(false);
         return;
+    }
     let cardUsage = frozenUsage;
     const managedReceiver = !!ds.session.vcMeetingReceiver;
     // Wait Mode / HTTP Sync Override:
@@ -5804,6 +7794,7 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
         waitPromise.resolve(msg.content);
         ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
         logger.info(`[${t}] Intercepted final_output for Wait Mode HTTP request (turn ${msg.turnId.substring(0, 8)})`);
+        onComplete?.(true);
         return;
     }
     const asyncResult = managedReceiver ? undefined : ds.asyncTriggerResults?.get(msg.turnId);
@@ -5818,8 +7809,14 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
         // (with content + usage) after a daemon restart drops the in-memory Map.
         // Stamp the owning bot for cross-bot isolation.
         asyncTriggerStore.recordCompleted(ds.session.sessionId, msg.turnId, msg.content, completedAt, ds.larkAppId, msg.usage);
+        // This idempotent async turn produced its terminal output — clear the
+        // worker-exit convergence stamp so a later graceful exit of this generation
+        // is not retro-failed (codex #776 round-6 finding #1).
+        if (ds.idempotentAsyncTurn?.triggerId === msg.turnId)
+            ds.idempotentAsyncTurn = undefined;
         ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
         logger.info(`[${t}] Captured final_output for Async HTTP request (turn ${msg.turnId.substring(0, 8)})`);
+        onComplete?.(true);
         return;
     }
     const cb = requireCallbacks();
@@ -5828,13 +7825,17 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
         ? { ...opts, sourceSessionId: ds.session.sessionId }
         : opts);
     setTimeout(async () => {
-        if (!stillCurrent())
+        if (!isStillOwned()) {
+            logger.info(`[${t}] Bridge final_output abandoned — worker/session ownership changed`);
+            onComplete?.(false);
             return;
+        }
         // Guard: if the user closed the session (or it was torn down for any
         // other reason) between attempts, don't post a stale final answer to
         // a closed thread.
         if (ds.session.status === 'closed') {
             logger.info(`[${t}] Bridge final_output abandoned — session closed (turn ${msg.turnId.substring(0, 8)})`);
+            onComplete?.(true);
             return;
         }
         try {
@@ -5846,11 +7847,15 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 // （模型没显式 botmux send），默认 @ 回原评论人，仅首块加。
                 const chunks = chunkCommentText(msg.content);
                 for (let i = 0; i < chunks.length; i++) {
-                    if (!stillCurrent())
+                    if (!isStillOwned()) {
+                        onComplete?.(false);
                         return;
+                    }
                     await replyToDocComment(ds.larkAppId, { fileToken: docTurn.fileToken, fileType: docTurn.fileType }, docTurn.commentId, chunks[i], i === 0 ? docTurn.replyToOpenId : undefined);
-                    if (!stillCurrent())
+                    if (!isStillOwned()) {
+                        onComplete?.(false);
                         return;
+                    }
                 }
                 // The user-visible reply is committed. Consume the route and dedupe
                 // marker BEFORE best-effort reaction cleanup: a missing/expired
@@ -5866,6 +7871,7 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                     }
                 }
                 logger.info(`[${t}] doc-comment final_output → posted ${chunks.length} comment(s) on file=${docTurn.fileToken.slice(0, 12)} (turn ${msg.turnId.substring(0, 8)})`);
+                onComplete?.(true);
                 return;
             }
             // A doc-native session has a virtual `doc:<token>` chat anchor, not a
@@ -5876,6 +7882,7 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.error(`[${t}] Suppressed doc-native final_output without comment target ` +
                     `(turn ${msg.turnId.substring(0, 8)})`);
+                onComplete?.(true);
                 return;
             }
             // Wrap the model's reply in the same card chrome `botmux send` uses
@@ -5906,6 +7913,7 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.warn(`[${t}] VC final_output lost current membership authority `
                     + `(${managedDecision.errorCode}) turn=${msg.turnId.substring(0, 8)}`);
+                onComplete?.(true);
                 return;
             }
             const revalidateManagedSend = () => {
@@ -6019,10 +8027,23 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 }, proposedOutput)
                 : undefined;
             const preparedListenerReply = preparedImReply ?? preparedDeliveryReply;
+            // Codex App final settlement is delivery-before-commit. If the daemon
+            // dies after Lark accepts the reply but before the FIFO/sequence commit,
+            // the replacement must retry with the same provider key. Keep the key
+            // dispatch-stable (not generation/seq-stable), so the user-visible Lark
+            // message is idempotent across crash reconciliation. The existing
+            // outbound-hook contract remains unchanged; it is a separate best-effort
+            // side effect and is not covered by the provider UUID.
+            const codexAppSettlementReply = msg.codexAppSettlement
+                ? {
+                    uuid: `ca_${msg.codexAppSettlement.dispatchId}`.slice(0, 50),
+                }
+                : undefined;
             if (preparedListenerReply?.kind === 'conflict') {
                 ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.error(`[${t}] VC listener fallback suppressed (${preparedListenerReply.reason}) `
                     + `turn=${msg.turnId.substring(0, 8)}: ${preparedListenerReply.detail}`);
+                onComplete?.(true);
                 return;
             }
             const canonicalOutput = preparedListenerReply?.canonicalOutput ?? proposedOutput;
@@ -6062,13 +8083,18 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.info(`[${t}] VC listener fallback replayed existing provider result `
                     + `(turn ${msg.turnId.substring(0, 8)})`);
+                onComplete?.(true);
                 return;
             }
             // Always deliver the answer as a fresh message — never PATCH a card in
             // place. message.patch is silent (no Feishu notification / unread), which
             // used to swallow the answer; a brand-new message always pings.
             revalidateManagedSend();
-            const messageId = await scopedReply(canonicalOutput.content, canonicalOutput.msgType, msg.turnId, preparedListenerReply
+            if (!isStillOwned()) {
+                onComplete?.(false);
+                return;
+            }
+            const deliveryReplyOptions = preparedListenerReply
                 ? {
                     uuid: preparedListenerReply.providerKey,
                     quoteMessageId: canonicalOutput.quoteTargetId,
@@ -6084,9 +8110,14 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                         }
                         : {}),
                 }
-                : undefined);
-            if (!stillCurrent())
+                : codexAppSettlementReply;
+            const messageId = await scopedReply(canonicalOutput.content, canonicalOutput.msgType, msg.replyTurnId ?? msg.turnId, frozenReplyTarget && !managedReceiver
+                ? { ...deliveryReplyOptions, replyTarget: frozenReplyTarget }
+                : deliveryReplyOptions);
+            if (!isStillOwned()) {
+                onComplete?.(true);
                 return;
+            }
             recordPrimaryOutput(messageId);
             if (msg.turnId.startsWith('mlrp_turn_')) {
                 markMessageListenerRunPreviewReplied(msg.turnId, {
@@ -6099,16 +8130,24 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
             }
             ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
             logger.info(`[${t}] Bridge final_output forwarded (turn ${msg.turnId.substring(0, 8)}, ${msg.content.length} chars, kind=${msg.kind ?? 'bridge'}, attempt ${attempt + 1})`);
+            onComplete?.(true);
         }
         catch (err) {
-            if (!stillCurrent())
+            if (!isStillOwned()) {
+                onComplete?.(false);
                 return;
+            }
             if (err instanceof MessageWithdrawnError) {
-                // Root message gone — no point retrying. Mark as emitted so any
-                // duplicate IPC is correctly deduped, and tear the session down.
-                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
-                logger.warn(`[${t}] Root message withdrawn while forwarding final_output, closing session`);
-                cb.closeSession(ds);
+                // Withdrawal is permanent for this target, but it is not explicit
+                // abandon. Keep an unsettled FIFO owner recoverable; only ledger-empty
+                // sessions may commit the dedupe marker and auto-close.
+                if (await closeWithdrawnSessionIfLedgerEmpty(ds, 'Root message withdrawn while forwarding final_output')) {
+                    ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
+                    onComplete?.(true);
+                }
+                else {
+                    onComplete?.(false);
+                }
                 return;
             }
             const next = attempt + 1;
@@ -6122,10 +8161,11 @@ function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, froz
                 }
                 // Don't commit the dedup marker — leave room for any future
                 // retransmit (e.g. daemon restart that re-fires the IPC).
+                onComplete?.(false);
                 return;
             }
             logger.warn(`[${t}] Bridge final_output attempt ${next} failed (${err.message}); retrying in ${FINAL_OUTPUT_RETRY_BACKOFF_MS[next]}ms`);
-            deliverFinalOutput(ds, msg, t, next, stillCurrent, cardUsage);
+            deliverFinalOutput(ds, msg, t, next, onComplete, isStillOwned, frozenReplyTarget, cardUsage);
         }
     }, FINAL_OUTPUT_RETRY_BACKOFF_MS[attempt] ?? 0);
 }
@@ -6272,6 +8312,7 @@ export function forkAdoptWorker(ds, opts) {
     const worker = fork(workerPath, [], {
         windowsHide: true,
         stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
+        execArgv: workerForkExecArgv(),
         cwd: adoptCwd,
         env: {
             ...forkEnv,
@@ -6694,6 +8735,11 @@ function cleanupPersistentBackendSessions(backendType, activeSessions_, runtimeS
     }
     catch { /* first run */ }
     const currentCliId = config.daemon.cliId;
+    // Codex App sessions with an unsettled dispatch ledger must reconcile before
+    // any CLI-change sweep tears their backing pane down.
+    const unsettledNames = new Set(activeSessions_
+        .filter(hasProtectedSessionMutationOwnership)
+        .map(session => backend.sessionName(session.sessionId)));
     const belongsToBackend = (session) => session.backendType === backendType ||
         (session.backendType === undefined && backendType === 'tmux');
     const activeNames = new Set([...activeSessions_, ...runtimeSessionRows]
@@ -6822,6 +8868,10 @@ function cleanupPersistentBackendSessions(backendType, activeSessions_, runtimeS
         logger.info(`CLI_ID changed (${lastCliId} → ${currentCliId}), killing all ${backendType} sessions`);
         // Legacy per-topic hosts are still enumerable by bmx-* name.
         for (const name of backend.listBotmuxSessions()) {
+            if (unsettledNames.has(name)) {
+                logger.warn(`Preserving ${backendType} ${name}: unsettled Codex App dispatch must reconcile first`);
+                continue;
+            }
             // A dispatcher-created runtime session already runs the current CLI.
             // Never let the stale last-cli marker tear it down during restore.
             if (runtimeNames.has(name))