botmux 3.15.0 → 3.16.0

package/dist/core/worker-pool.js

@@ -8,25 +8,35 @@ import { homedir } from 'node:os';
 import { readFileSync, readdirSync, mkdirSync, existsSync, realpathSync, unlinkSync } from 'node:fs';
 import { atomicWriteFileSync } from '../utils/atomic-write.js';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { ensureSkills, ensureAskSkill, ensurePluginSkills, ensureWhiteboardSkill, removeGlobalBotmuxSkills } from '../skills/installer.js';
+import { ensureSkills, ensureAskSkill, ensurePluginSkills, ensureWhiteboardSkill, ensureWorkflowSkills, removeGlobalBotmuxSkills } from '../skills/installer.js';
 import { shouldInstallGlobalSkills } from '../skills/injection-mode.js';
 import { whiteboardEnabled } from '../services/whiteboard-store.js';
 import { cliSupportsNativeUsage } from '../services/transcript-resolver.js';
 import { cleanupTraexAskHooks, installHook } from '../adapters/hook-installer.js';
 import { hookCommandFor } from '../adapters/hook-command.js';
-import { randomBytes, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { mayRestoreWriteAdmission } from '../adapters/backend/destroy-result.js';
 import { config } from '../config.js';
+import { isWorkflowFeatureEnabled } from '../global-config.js';
 import * as sessionStore from '../services/session-store.js';
 import * as asyncTriggerStore from '../services/async-trigger-store.js';
 import { markMessageListenerRunPreviewFailed, markMessageListenerRunPreviewReplied, markMessageListenerRunPreviewRunning, } from '../services/message-listener-run-preview-store.js';
 import { persistStreamCardState, rememberLastCliInput } from './session-manager.js';
-import { fallbackTurnId, frozenReplyContextForTurn, isSubstituteTurn } from './reply-target.js';
+import { resolveSessionLaunchModel } from './session-model.js';
+import { fallbackTurnId, frozenReplyContextForTurn, isSubstituteTurn, rehomeReplyTargetState, replyTargetKey } from './reply-target.js';
 import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, getMessageChatId, MessageWithdrawnError } from '../im/lark/client.js';
 import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildTuiPromptFailedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { codexServiceTierBadge } from '../services/codex-service-tier.js';
-import { codexModelSupportsReasoningEffort, isCodexReasoningCliId } from '../services/codex-reasoning-effort.js';
+import { cliModelSupportsReasoningEffort, isConfigurableReasoningCliId } from '../services/codex-reasoning-effort.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
 import { hashUrlForLog } from '../adapters/backend/riff-backend.js';
+import { cancelMojoSessionById } from '../adapters/backend/mojo-backend.js';
+import { cleanupMojoIsolatedWorkspace } from '../adapters/backend/mojo-isolated-workspace.js';
+import { hasUnprovenContainment } from './mojo-containment.js';
+import { MOJO_EXPLICIT_CLOSE_RESULT_TIMEOUT_MS } from '../adapters/backend/mojo-budgets.js';
+import { buildEffectiveMojoConfig, diffMojoSessionIdentity, MOJO_IDENTITY_KEYS, pickMojoLivePatch, isMojoRemoteGone, mojoUnprovableEnvKeys, pickMojoSessionIdentity, } from '../adapters/backend/mojo-types.js';
+import { sanitizePerBotEnv } from './per-bot-env.js';
+import { closeResidualClause } from './close-residual.js';
 import { logger } from '../utils/logger.js';
 import { createCliAdapterSync } from '../adapters/cli/registry.js';
 import { resolveCliRuntime, runtimeInstallationKey, runtimePathOverride, snapshotCliRuntime, } from '../adapters/cli/runtime.js';
@@ -45,8 +55,10 @@ import { ZmxBackend } from '../adapters/backend/zmx-backend.js';
 import { backendSupportsWebTerminal } from '../adapters/backend/capabilities.js';
 import { sandboxEnabled } from '../adapters/backend/sandbox.js';
 import { isStrongManagedHerdrAgentName, managedHerdrAgentName, } from '../adapters/backend/session-backend-selector.js';
-import { isRiffBackendSession, isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
+import { isRemoteBackendSession, isRemoteBackendType, isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
 import { withBotTurnMutation } from './bot-turn-mutation-gate.js';
+import { recordQuarantinedLauncherEnvKeys } from './mojo-launcher-env-quarantine.js';
+import { freezeMojoIdentityForSession } from './mojo-session-identity.js';
 import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, getLoadedConfigProvenance, resolveUsageDisplay } from '../bot-registry.js';
 import { RestartCoordinator } from './restart-coordinator.js';
 import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
@@ -64,6 +76,12 @@ function workerForkExecArgv() {
     const preloadPath = join(__dirname, '..', 'worker-ipc-preload.js');
     return [...process.execArgv, '--import', pathToFileURL(preloadPath).href];
 }
+/** Secondary index of the same retirements by session id: the WeakMap above is
+ *  keyed by ds OBJECT and not iterable, but the VC fence's producer-liveness
+ *  gate must find a dying process after the registry entry (and possibly the
+ *  ds reference itself) is gone. Entries release on worker exit, so the map
+ *  stays bounded by in-flight retirements. */
+const lifecycleRetiringBySessionId = new Map();
 function trackLifecycleRetirement(ds, worker) {
     let workers = lifecycleRetiringWorkers.get(ds);
     if (!workers) {
@@ -73,19 +91,85 @@ function trackLifecycleRetirement(ds, worker) {
     if (workers.has(worker))
         return;
     workers.add(worker);
+    const sessionId = ds.session.sessionId;
+    let byId = lifecycleRetiringBySessionId.get(sessionId);
+    if (!byId) {
+        byId = new Set();
+        lifecycleRetiringBySessionId.set(sessionId, byId);
+    }
+    byId.add(worker);
     const release = () => {
         const current = lifecycleRetiringWorkers.get(ds);
         current?.delete(worker);
         if (current?.size === 0)
             lifecycleRetiringWorkers.delete(ds);
+        const currentById = lifecycleRetiringBySessionId.get(sessionId);
+        currentById?.delete(worker);
+        if (currentById?.size === 0)
+            lifecycleRetiringBySessionId.delete(sessionId);
     };
     worker.once('exit', release);
 }
+/**
+ * Retiring worker processes for a session id — for liveness gates that outlive
+ * the registry entry. A collision loser (or any process-only retirement) is
+ * deleted from the registry while its process is still dying; a VC fence armed
+ * in that window would otherwise find no ds, skip its producer-liveness gate,
+ * and clear on pane probes alone (fifth-round review, A1 residual).
+ */
+export function retiringWorkersForSession(sessionId) {
+    return [...(lifecycleRetiringBySessionId.get(sessionId) ?? [])];
+}
 function clearLifecycleRetirement(ds, worker) {
     const workers = lifecycleRetiringWorkers.get(ds);
     workers?.delete(worker);
     if (workers?.size === 0)
         lifecycleRetiringWorkers.delete(ds);
+    const byId = lifecycleRetiringBySessionId.get(ds.session.sessionId);
+    byId?.delete(worker);
+    if (byId?.size === 0)
+        lifecycleRetiringBySessionId.delete(ds.session.sessionId);
+}
+/**
+ * Start a new worker generation's launcher-env ledger.
+ *
+ * The previous generation's keys are PARKED, never dropped — and deliberately
+ * WITHOUT consulting whether that worker has exited.
+ *
+ * A worker exit does not prove the dangerous process is gone, and the dangerous
+ * env acts on the mojo CLI *child*, not on the worker that parents it:
+ *   - `MojoBackend.kill()` sends a bare `SIGTERM`, nulls its handle and reports
+ *     `exitCb(0)` immediately — no SIGKILL escalation, no wait. A child that
+ *     traps/ignores TERM, or is slow, survives it.
+ *   - the worker's close path then runs `killCli()` and `process.exit(0)` without
+ *     awaiting the child, so worker exit can precede child death.
+ *   - a mojo child may also have detached descendants, so even a per-PID exit
+ *     proof would not cover the process tree.
+ * `PATH`-substituted launchers and `LD_PRELOAD` hooks live in exactly that child,
+ * which is what holds the activated device credential.
+ *
+ * So the ledger is monotonic for the life of this DaemonSession: it disappears
+ * only when the session ends or the daemon restarts (it is in-memory), never on
+ * an exit signal we cannot verify. A stricter alternative — escalating to SIGKILL
+ * and waiting for process-GROUP quiescence before releasing — is the only way to
+ * make release sound, and is deliberately out of scope here: it needs new
+ * teardown machinery and would still have to cover descendants, whereas monotonic
+ * retention is fail-closed by construction.
+ *
+ * Cost: a session that was ever handed a dangerous launcher env stays
+ * unprovable until it ends. That is an availability trade, not a credential leak.
+ *
+ * Exported so the behavioural guards can assert this directly — deleting the
+ * three call sites used to leave every test green.
+ */
+export function startNewGenerationEnvLedger(ds, initEnv) {
+    const parked = new Set([
+        ...(ds.mojoRetiringUnprovableEnvKeys ?? []),
+        ...(ds.mojoAppliedUnprovableEnvKeys ?? []),
+    ]);
+    ds.mojoRetiringUnprovableEnvKeys = parked.size > 0 ? [...parked] : undefined;
+    ds.mojoAppliedUnprovableEnvKeys = undefined;
+    rememberAppliedUnprovableEnvKeys(ds, initEnv);
 }
 /** Symmetric lifecycle fence: relay must not start while another operation is
  * still restarting, spawning, suspending, or closing this worker generation. */
@@ -104,7 +188,7 @@ function daemonCardLocalHomeLinkMode(ds) {
     // worker after riff reconciliation; fall back to persisted session metadata
     // while restoring sessions that do not yet have an initConfig.
     const backendType = ds.initConfig?.backendType ?? ds.session.backendType;
-    return backendType === 'riff'
+    return (backendType !== undefined && isRemoteBackendType(backendType))
         || ds.session.sandbox === true
         || ds.initConfig?.readIsolation === true
         || sandboxEnabled()
@@ -193,21 +277,25 @@ export function getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, opts) {
         // Missing runtime config → default 'streaming' → show usage (best-effort).
     }
     const snapshot = getDaemonSessionUsageSnapshot(ds, effectiveCliId, { fresh: opts?.fresh ?? false });
-    // Model comes only from an explicitly-wired executor runtime (TRAE/Codex set
-    // ds.activeModel from their rollout settings) or the user-configured launch
-    // model — never snapshot.tokens.model. That field is the RAW transcript model
-    // and for relay-style CLIs is an internal routing code (e.g. `ark/relay-code`)
-    // that must not surface on a user card.
+    // Model normally comes from an explicitly-wired executor runtime (TRAE/Codex
+    // set ds.activeModel) or launch config. Grok's native snapshot is the one
+    // exception: its signals.json exposes a stable user-facing primaryModelId.
+    // We still never surface snapshot.tokens.model, which can be an internal
+    // routing code for Relay-family CLIs (e.g. `ark/relay-code`).
+    const grokModel = effectiveCliId === 'grok' ? snapshot.model?.trim() : undefined;
+    const grokReasoningEffort = effectiveCliId === 'grok' ? snapshot.reasoningEffort?.trim() : undefined;
     return {
         ...snapshot,
-        ...(runtimeModel ? { model: runtimeModel } : {}),
-        ...(reasoningEffort ? { reasoningEffort } : {}),
+        ...(runtimeModel ? { model: runtimeModel } : grokModel ? { model: grokModel } : {}),
+        ...(reasoningEffort ? { reasoningEffort } : grokReasoningEffort ? { reasoningEffort: grokReasoningEffort } : {}),
     };
 }
 import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { dashboardEventBus } from './dashboard-events.js';
+import { publishSessionPreviewCleared, takeSessionPreviewTarget, } from './session-preview-registry.js';
 import { composeRowFromActive, composeRowFromClosed } from './dashboard-rows.js';
 import { publishAttentionPatch, publishClosedSessionPatch } from './session-activity.js';
+import { attachOrdinaryTurnRecovery, beginOrdinaryTurnRecovery, cancelOrdinaryTurnRecoveryForUserInput as cancelOrdinaryRecoveryForUserInput, disposeOrdinaryTurnRecovery, handleOrdinaryTurnRecoveryTerminal, ordinaryTurnRecoveryHandlesTerminal, requireOrdinaryTurnRecoveryAttention, } from '../services/ordinary-turn-recovery.js';
 import { knownBotOpenIdsFromCrossRef } from '../utils/bot-routing.js';
 import { emitSessionLifecycleHook, emitSessionStateTransitionHook } from '../services/session-lifecycle-hooks.js';
 import { anchorUsageForDaemonSession, recordOwnershipForDaemonSession, recordUsageForDaemonSession, reconcileUsageForDaemonSession } from '../services/usage-ledger.js';
@@ -215,7 +303,7 @@ import { isStructuredBridgeAdoptCli } from '../services/structured-bridge-clis.j
 import { ensureGatewayEntry } from './plugins/mcp/gateway-installer.js';
 import { readPeerCrossRef } from '../services/peer-cross-ref-store.js';
 import { appendAcceptedCodexAppDispatch, cancelCodexAppDispatch, committedCodexAppSequence, hasUnsettledCodexAppDispatch, prepareCodexAppDispatch, retryPreparedCodexAppDispatch, retainFreshCodexAppGeneration, settleCodexAppDispatch, } from '../utils/codex-app-dispatch-ledger.js';
-import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, isDocNativeSession, larkTransportEnabled, riffRetirementAdmissionPhase, } from './types.js';
+import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, isDocNativeSession, larkTransportEnabled, remoteRetirementAdmissionPhase, } from './types.js';
 import { hasProtectedSessionMutationOwnership } from './session-mutation-guard.js';
 import { DONE_REACTION_EMOJI_TYPE } from './pending-response.js';
 import { buildTerminalUrl } from './terminal-url.js';
@@ -238,7 +326,7 @@ import { acknowledgeSessionReady } from './session-ready-handshake.js';
 import { recordDispatchInputCommit } from './dispatch.js';
 import { sendWorkerIpc } from './worker-ipc.js';
 import { cleanupExplicitSessionBacking } from './explicit-session-backing-cleanup.js';
-import { RIFF_ADMISSION_RESTORE_TIMEOUT_MS } from './shutdown-budgets.js';
+import { REMOTE_ADMISSION_RESTORE_TIMEOUT_MS } from './shutdown-budgets.js';
 import { managedOriginCapabilityPath, replaceManagedOriginCapabilityFile, } from './managed-origin-capability.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -314,7 +402,7 @@ function requireCallbacks() {
 // daemon registers its Map here at boot. Helpers below return a snapshot or
 // linear-scan by sessionId.
 let activeSessionsRegistry;
-const pendingRiffWorkerCloses = new Map();
+const pendingRemoteWorkerCloses = new Map();
 export function setActiveSessionsRegistry(m) {
     activeSessionsRegistry = m;
 }
@@ -695,6 +783,99 @@ function tag(ds) {
 function sessionCliId(ds, botCfg) {
     return ds.session.cliId ?? botCfg.cliId;
 }
+function ordinaryTurnRecoveryEligible(ds, botCfg = getBot(ds.larkAppId).config) {
+    return sessionCliId(ds, botCfg) === 'claude-code'
+        && ds.session.status === 'active'
+        && !ds.adoptedFrom
+        && !ds.session.adoptedFrom
+        && ds.initConfig?.adoptMode !== true
+        && !ds.session.vcMeetingReceiver
+        && larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly });
+}
+function ordinaryTurnRecoveryStillOwnsSession(ds) {
+    if (ds.session.status !== 'active')
+        return false;
+    if (!activeSessionsRegistry)
+        return true;
+    return activeSessionsRegistry.get(sessionKey(sessionAnchorId(ds), ds.larkAppId)) === ds;
+}
+function ordinaryTurnRecoveryWarning(state, locale) {
+    if (state.status === 'exhausted' && state.continuationsStarted >= 2) {
+        return tr('worker.ordinary_recovery_exhausted', undefined, locale);
+    }
+    if (state.lastErrorCode === 'recovery_enqueue_failed') {
+        return tr('worker.ordinary_recovery_enqueue_failed', undefined, locale);
+    }
+    if (state.lastErrorCode === 'recovery_delivery_failed') {
+        return tr('worker.ordinary_recovery_delivery_failed', undefined, locale);
+    }
+    if (state.lastErrorCode === 'recovery_dispatch_interrupted') {
+        return tr('worker.ordinary_recovery_dispatch_interrupted', undefined, locale);
+    }
+    return tr('worker.ordinary_recovery_non_retryable', undefined, locale);
+}
+/** Attach the crash-safe timer owner for one eligible ordinary Claude/Lark
+ * session. Session state is persisted; this runtime registry only owns timers. */
+export function ensureOrdinaryTurnRecoveryAttached(ds, botCfg = getBot(ds.larkAppId).config) {
+    if (!ordinaryTurnRecoveryEligible(ds, botCfg)) {
+        disposeOrdinaryTurnRecovery(ds.session);
+        return false;
+    }
+    attachOrdinaryTurnRecovery(ds.session, {
+        schedule: (delayMs, run) => {
+            const timer = setTimeout(run, delayMs);
+            timer.unref?.();
+            return timer;
+        },
+        cancel: timer => clearTimeout(timer),
+        persist: () => sessionStore.updateSession(ds.session),
+        enqueue: (dispatch) => {
+            if (!ordinaryTurnRecoveryEligible(ds) || !ordinaryTurnRecoveryStillOwnsSession(ds))
+                return false;
+            try {
+                if (!ds.worker || ds.worker.killed || ds.worker.connected === false) {
+                    return forkWorker(ds, dispatch.prompt, {
+                        resume: true,
+                        turnId: dispatch.turnId,
+                    });
+                }
+                return sendWorkerInput(ds, dispatch.prompt, dispatch.turnId);
+            }
+            catch (err) {
+                logger.error(`[${tag(ds)}] Failed to enqueue ordinary-turn recovery `
+                    + `${dispatch.continuation}: ${err instanceof Error ? err.message : String(err)}`);
+                return false;
+            }
+        },
+        warn: state => {
+            const warning = ordinaryTurnRecoveryWarning(state, localeForBot(ds.larkAppId));
+            ds.agentAttention = {
+                kind: 'blocked',
+                reason: warning,
+                at: state.alertSentAt ?? Date.now(),
+            };
+            publishAttentionPatch(ds);
+            emitSessionLifecycleHook(ds, 'session.requires_attention', {
+                reason: 'ordinary_turn_recovery_exhausted',
+                errorCode: state.lastErrorCode,
+                logicalTurnId: state.logicalTurnId,
+            });
+            void requireCallbacks().sessionReply(sessionAnchorId(ds), warning, 'text', ds.larkAppId, state.logicalTurnId).catch(err => logger.error(`[${tag(ds)}] Failed to deliver ordinary-turn recovery warning: `
+                + `${err instanceof Error ? err.message : String(err)}`));
+        },
+    });
+    const restored = ds.session.ordinaryTurnRecovery;
+    if (restored?.alertSentAt
+        && (restored.status === 'exhausted' || restored.status === 'attention_required')) {
+        ds.agentAttention = {
+            kind: 'blocked',
+            reason: ordinaryTurnRecoveryWarning(restored, localeForBot(ds.larkAppId)),
+            at: restored.alertSentAt,
+        };
+        publishAttentionPatch(ds);
+    }
+    return true;
+}
 function sessionRuntimeDisplayName(ds, botCfg) {
     const liveRuntime = botCfg
         ? botCfg.cliRuntime
@@ -713,13 +894,47 @@ function storedSessionCliDisplayName(ds) {
         return getCliDisplayName((ds.session.cliId ?? ds.initConfig?.cliId ?? 'claude-code'));
     }
 }
+/**
+ * Keep `session.model` — the record of what this session was last LAUNCHED with —
+ * in sync with the model just resolved for a (re)spawn.
+ *
+ * The record is never the launch source of truth (see resolveSessionLaunchModel);
+ * it exists so the CLI-mismatch fallback has something to fall back ON after the
+ * bot switches CLI: a session pinned to the old CLI would otherwise lose its
+ * model and drop to the CLI default. Not every entry point that hot-swaps
+ * `bot.config.cliId` (`/botconfig set cli`, the config card) runs the dashboard's
+ * closeCliMismatchedSessionsForBot sweep, so such sessions do survive to respawn.
+ *
+ * MUST be called from every path that resolves a launch model — daemon refork
+ * AND the in-worker respawns (restart IPC / crash-park retry) — or the record
+ * silently keeps an older model and a later CLI switch resurrects it.
+ *
+ * A per-trigger override is deliberately NOT recorded: it is one-shot by
+ * contract, and persisting it is exactly the mistake the frozen model was.
+ */
+function recordLaunchModel(ds, model) {
+    if (ds.spawnModelOverride)
+        return;
+    if (ds.session.model === model)
+        return;
+    ds.session.model = model; // undefined clears a stale record
+    sessionStore.updateSession(ds.session);
+}
 function sessionAgentConfig(ds, botCfg) {
-    // Freeze the agent launch config (cli / runtime / cliPath / wrapper / model) onto the
+    // Freeze the agent launch config (cli / runtime / cliPath / wrapper) onto the
     // session the first time a worker forks, so later bot-level edits never
     // retroactively change a live session — same discipline as `sandbox`.
     //
+    // `model` is deliberately NOT part of the frozen set (see the return below):
+    // swapping the CLI *distribution* under a live conversation is what this
+    // freeze protects against (a `ttadk codex` wrapper degrading to bare `codex`
+    // loses its gateway), whereas the model is an explicit, human-chosen bot
+    // setting whose whole point is to take effect. Freezing it made a long
+    // session ignore the model configured in the dashboard forever, i.e. an
+    // inherited default silently outranked a later explicit choice.
+    //
     // Gated on `agentFrozen`, NOT on `resume`: a session created before these
-    // fields existed has `cliId` stamped historically but no frozen wrapper/model,
+    // fields existed has `cliId` stamped historically but no frozen wrapper,
     // yet it was launching off the live bot config — so its first post-upgrade
     // resume must back-fill the still-missing fields from botCfg to keep launching
     // identically (e.g. a `ttadk codex` wrapper bot must not silently drop to bare
@@ -745,8 +960,7 @@ function sessionAgentConfig(ds, botCfg) {
             ?? runtimePathOverride(runtime)
             ?? botCfg.cliPathOverride;
         ds.session.wrapperCli = ds.session.wrapperCli ?? botCfg.wrapperCli;
-        ds.session.model = ds.session.model ?? botCfg.model;
-        ds.session.reasoningEffort = isCodexReasoningCliId(ds.session.cliId)
+        ds.session.reasoningEffort = isConfigurableReasoningCliId(ds.session.cliId)
             ? ds.session.reasoningEffort ?? botCfg.reasoningEffort
             : undefined;
         ds.session.agentFrozen = true;
@@ -780,8 +994,13 @@ function sessionAgentConfig(ds, botCfg) {
         if (repaired)
             sessionStore.updateSession(ds.session);
     }
+    // Resolved at EVERY spawn, resume included — see resolveSessionLaunchModel.
+    const model = resolveSessionLaunchModel(ds, botCfg);
+    recordLaunchModel(ds, model);
+    // Effort is frozen per session, but whether it is *supported* depends on the
+    // model this spawn actually uses — which is resolved live above, not frozen.
     if (ds.session.reasoningEffort
-        && !codexModelSupportsReasoningEffort(ds.session.model, ds.session.reasoningEffort)) {
+        && !cliModelSupportsReasoningEffort(ds.session.cliId, model, ds.session.reasoningEffort)) {
         ds.session.reasoningEffort = undefined;
         sessionStore.updateSession(ds.session);
     }
@@ -790,10 +1009,206 @@ function sessionAgentConfig(ds, botCfg) {
         cliRuntime: ds.session.cliRuntime,
         cliPathOverride: ds.session.cliPathOverride,
         wrapperCli: ds.session.wrapperCli,
-        model: ds.session.model,
+        model,
         reasoningEffort: ds.session.reasoningEffort,
     };
 }
+export { freezeMojoIdentityForSession } from './mojo-session-identity.js';
+/**
+ * Freeze the control-plane identity of every restored mojo session at daemon
+ * startup, instead of waiting for each one's next worker fork.
+ *
+ * The lazy path left a window: after a restart but before a session was next
+ * woken, an operator could change the bot's endpoint/workspace, and the session
+ * would then adopt THAT as its "original" identity — pairing a remote lineage
+ * created on tenant A with tenant B. Migrating during restore closes it, because
+ * restore runs before the dispatcher can deliver a message.
+ *
+ * A legacy row that already holds a remote lineage cannot be migrated safely (no
+ * record of its original control plane), so sessionMojoConfig drops that lineage;
+ * this pass reuses the same helper so both entry points behave identically.
+ */
+export function migrateMojoSessionIdentities(activeSessions) {
+    let migrated = 0;
+    for (const ds of activeSessions.values()) {
+        const backendType = ds.initConfig?.backendType ?? ds.session.backendType;
+        if (backendType !== 'mojo')
+            continue;
+        if (ds.session.mojoIdentity)
+            continue;
+        let botCfg;
+        try {
+            botCfg = getBot(ds.larkAppId).config;
+        }
+        catch {
+            // Bot deregistered — no config to freeze from. Leave the row untouched so a
+            // later re-registration can migrate it.
+            continue;
+        }
+        void botCfg;
+        freezeMojoIdentityForSession(ds.session, ds.larkAppId);
+        migrated += 1;
+    }
+    if (migrated > 0) {
+        logger.info(`[mojo] froze the control-plane identity of ${migrated} restored session(s)`);
+    }
+}
+/**
+ * READ-ONLY frozen launch identity, for teardown paths that must not mutate the
+ * session (sessionAgentConfig freezes and writes to the session store).
+ *
+ * Reads the values frozen at session creation, exactly like a live spawn would.
+ * Only a legacy session that was never frozen (`agentFrozen` unset) falls back to
+ * the live bot config, mirroring sessionAgentConfig's back-fill.
+ *
+ * This matters for cancelling an orphaned remote session: the remote session was
+ * created through THIS session's wrapper/binary, so cancelling it through a
+ * wrapper the bot gained later can hit the wrong gateway or tenant. And because
+ * `agentFrozen=true` with `wrapperCli=undefined` explicitly means "frozen as
+ * no-wrapper", inheriting a later-added wrapper would break that contract.
+ */
+function frozenSessionLaunchIdentity(ds, botCfg) {
+    if (ds.session.agentFrozen) {
+        return {
+            cliPathOverride: ds.session.cliPathOverride,
+            wrapperCli: ds.session.wrapperCli,
+        };
+    }
+    // Legacy, never frozen: it was launching off the live bot config, so that is
+    // the faithful reconstruction.
+    return {
+        cliPathOverride: ds.session.cliPathOverride ?? botCfg.cliPathOverride,
+        wrapperCli: ds.session.wrapperCli ?? botCfg.wrapperCli,
+    };
+}
+/**
+ * Resolve the mojo config a session must run on, freezing its control-plane
+ * identity the first time and honouring that snapshot forever after.
+ *
+ * Split by purpose:
+ *   - identity (cloud / localDaemon / baseUrl / ppeEnv / workspaceId / agentId)
+ *     comes from the FROZEN snapshot. A live edit must not move an existing
+ *     session between execution modes or tenants — a cold resume would continue,
+ *     and `/close` would cancel, against an endpoint that never created it.
+ *   - credentials (jwt / jwtEnv / env) and behaviour knobs (stream /
+ *     systemPrompt / idleTimeoutSec) stay LIVE, so a rotated token takes effect
+ *     and no plaintext JWT is persisted into session state.
+ *
+ * `freeze` is false on read-only paths (workerless cancel) so teardown never
+ * mutates session state; a session that predates this field then simply runs on
+ * live config, exactly as it did before.
+ */
+/**
+ * Resolve the mojo config a session must run on, plus whether its remote lineage
+ * may still be used.
+ *
+ * Returns an explicit state rather than a bare config, because "we have a config"
+ * and "this lineage is safe to resume/cancel" are different questions and
+ * conflating them is what let a cancel reach the wrong tenant:
+ *   - `usable`      — identity is frozen (or freshly frozen); lineage is trusted
+ *   - `quarantined` — legacy row with a remote lineage but no frozen identity.
+ *                     Nothing records which control plane holds it, so it must not
+ *                     be resumed or cancelled automatically.
+ *   - `none`        — legacy row with no lineage at all; nothing at risk.
+ *
+ * Identity (cloud / localDaemon / baseUrl / ppeEnv / workspaceId / agentId) comes
+ * from the FROZEN snapshot; credentials (jwt / jwtEnv / env) and behaviour knobs
+ * stay LIVE so a rotated token takes effect and no plaintext JWT is persisted.
+ *
+ * `freeze` is false on read-only paths (workerless cancel) so teardown never
+ * mutates session state.
+ */
+export function sessionMojoConfig(ds, botCfg, opts) {
+    const live = botCfg.mojo ?? {};
+    const liveIdentity = pickMojoSessionIdentity(live);
+    if (!ds.session.mojoIdentity) {
+        // Legacy row, never frozen. Delegate to the shared helper rather than
+        // duplicating the freeze/quarantine rules — two copies of this had already
+        // started to drift. `undefined` means "predates this field"; an empty object
+        // means "frozen with nothing configured", which is why the helper persists
+        // `{}` instead of skipping it.
+        if (opts.freeze) {
+            freezeMojoIdentityForSession(ds.session, ds.larkAppId);
+        }
+        else if (ds.session.riffParentTaskId) {
+            // Read-only path (teardown): the row still has an unverifiable lineage and
+            // we must not write, so report it without mutating.
+            return { config: live, lineage: 'quarantined' };
+        }
+        // Fall through: the helper may have frozen an identity just now, so re-derive
+        // the answer from the (possibly updated) row below.
+    }
+    if (!ds.session.mojoIdentity) {
+        // Still unfrozen — the bot was deregistered, so there is nothing to freeze
+        // from. Behave as before: usable only if there is no lineage at risk.
+        return {
+            config: live,
+            lineage: ds.session.riffParentTaskId ? 'quarantined' : 'none',
+        };
+    }
+    const frozen = ds.session.mojoIdentity;
+    const drift = diffMojoSessionIdentity(frozen, liveIdentity);
+    if (drift.length > 0) {
+        // Loud on purpose: the operator changed the control plane and this session is
+        // deliberately NOT following, which is otherwise invisible.
+        logger.warn(`[${tag(ds)}] mojo control-plane config changed after session creation; `
+            + `keeping the frozen identity (${drift.join(', ')}). `
+            + 'Start a new session to use the new configuration.');
+    }
+    // Live credentials/behaviour, frozen identity.
+    const merged = { ...live };
+    for (const key of MOJO_IDENTITY_KEYS) {
+        const value = frozen[key];
+        if (value === undefined)
+            delete merged[key];
+        else
+            merged[key] = value;
+    }
+    // Upgrade guard (review F1): an identity frozen by a pre-host-default build
+    // recorded "localDaemon unset" while double-unset still MEANT the cloud
+    // sandbox. Resuming it through the new default would silently flip the
+    // session cloud→host — the exact transition the freeze exists to prevent,
+    // and the drift log stays silent because frozen and live are both `{}`.
+    // Pin those rows to the legacy behaviour; a new session adopts the new
+    // default and gets stamped mojoIdentityHostDefault by the freeze helper.
+    if (frozen.localDaemon === undefined
+        && ds.session.mojoIdentityHostDefault !== true) {
+        merged.localDaemon = false;
+        logger.warn(`[${tag(ds)}] mojo identity predates the host-execution default; pinning `
+            + 'localDaemon=false (legacy sandbox behaviour) for this session. '
+            + 'Close and reopen the session to adopt the new default.');
+        // A daemon-log line alone leaves the USER staring at a session where tools
+        // and replies silently fail (observed live: the operator retried a pinned
+        // session twice believing the new build was broken). Queue the in-chat
+        // notice; the next turn with a reply context delivers it once.
+        if (ds.session.mojoLegacyPinNoticePending === undefined) {
+            ds.session.mojoLegacyPinNoticePending = true;
+            // Best-effort persistence: sessionMojoConfig sits on paths that MUST
+            // survive an unwritable store (the workerless orphan-cancel chain is
+            // explicitly tested for it). A failed save only costs notice dedupe
+            // across a restart — the in-memory flag still delivers this run.
+            try {
+                sessionStore.updateSession(ds.session);
+            }
+            catch (err) {
+                logger.warn(`[${tag(ds)}] could not persist the mojo legacy-pin notice flag `
+                    + `(will still deliver this run): ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    // Quarantine is bound to a specific ID, not to the session.
+    //
+    // Once an identity is frozen, any lineage created AFTERWARDS was created on that
+    // known control plane and is therefore trustworthy. Treating the session as
+    // permanently quarantined meant a new session could never be cancelled after its
+    // worker died — it kept consuming cloud sandbox time and holding credentials.
+    // The parked id remains as an audit record only.
+    const active = ds.session.riffParentTaskId;
+    const lineage = active === undefined
+        ? 'none'
+        : (active === ds.session.mojoQuarantinedLineage ? 'quarantined' : 'usable');
+    return { config: merged, lineage };
+}
 function loadKnownBotOpenIdsForApp(larkAppId) {
     const dataDir = config.session.dataDir;
     const crossRef = readPeerCrossRef(dataDir, larkAppId);
@@ -928,6 +1343,20 @@ function logWorkerStderr(t, line) {
 // Prevents duplicate card POSTs when multiple screen_updates arrive before
 // the first POST returns a real message_id.
 export const CARD_POSTING_SENTINEL = '__posting__';
+/**
+ * Freeze the destination used by one streaming-card POST before dispatch.
+ * A POST may await the Lark API while another turn replaces
+ * `currentReplyTarget`; callers must commit this captured key rather than
+ * re-reading mutable session state after the request resolves.
+ */
+function captureStreamingCardReplyTarget(ds, turnId) {
+    const effectiveTurnId = fallbackTurnId(ds, turnId);
+    const replyContext = frozenReplyContextForTurn(ds, effectiveTurnId);
+    return {
+        turnId: effectiveTurnId,
+        replyTargetKey: replyTargetKey(replyContext.target),
+    };
+}
 /**
  * Move the current streaming card into `frozenCards` without freezing it
  * cosmetically. The next successful card POST will sweep it via
@@ -954,6 +1383,7 @@ export function parkStreamCard(ds) {
         ds.frozenCards = loadFrozenCards(ds.session.sessionId);
     ds.frozenCards.set(ds.streamCardNonce, {
         messageId: ds.streamCardId,
+        replyTargetKey: ds.streamCardReplyTargetKey,
         content: ds.lastScreenContent ?? '',
         title: ds.currentTurnTitle ?? '',
         displayMode: ds.displayMode ?? 'hidden',
@@ -966,9 +1396,12 @@ export function parkStreamCard(ds) {
     saveFrozenCards(ds.session.sessionId, ds.frozenCards);
 }
 /**
- * Delete previously-frozen streaming cards from Lark and clear the cache.
+ * Delete previously-frozen streaming cards from the live card's visible Lark
+ * destination and clear those entries from the cache.
  * Called whenever a new streaming card becomes the active one — old turns'
- * cards just add visual clutter when scrolling thread history.
+ * cards just add visual clutter when scrolling that destination's history.
+ * A chat-scope session may answer in several Lark topics; cards from another
+ * topic remain frozen until a successor is posted in that same topic.
  *
  * Lazy-loads `frozenCards` from disk if the in-memory Map is missing
  * (post daemon-restart). Best-effort delete; failures (already withdrawn,
@@ -988,10 +1421,17 @@ export function recallFrozenCards(ds) {
     const activeId = ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL
         ? ds.streamCardId
         : undefined;
+    const activeReplyTargetKey = ds.streamCardReplyTargetKey;
     const targets = [];
     for (const [nonce, fc] of [...ds.frozenCards.entries()]) {
         if (activeId && fc.messageId === activeId)
             continue;
+        // Legacy sessions have no destination key. Preserve the old sweep-all
+        // behavior only while the live card is also legacy. Once a new card has an
+        // exact destination, fail safe: never withdraw an unattributed card that
+        // may be visible in another topic.
+        if (activeReplyTargetKey && fc.replyTargetKey !== activeReplyTargetKey)
+            continue;
         targets.push(fc.messageId);
         ds.frozenCards.delete(nonce);
     }
@@ -1003,6 +1443,41 @@ export function recallFrozenCards(ds) {
     }
     logger.info(`[${tag(ds)}] Recalled ${targets.length} previous streaming card(s)`);
 }
+/** The first visible state for a newly accepted turn.
+ *
+ * `starting` is a process/session lifecycle state. A live Grok worker that
+ * accepts another turn is already past startup, so surface the turn as working
+ * immediately. The worker's structured lifecycle gate will later publish the
+ * authoritative terminal state from updates.jsonl.
+ */
+export function turnStartingCardStatus(ds, effectiveCliId) {
+    if (ds.usageLimit)
+        return 'limited';
+    if (effectiveCliId === 'grok' && workerHasInitialized(ds))
+        return 'working';
+    return 'starting';
+}
+/** Incremented for every worker status observation, including same-value edges.
+ * A screen update can land while the Feishu starting-card POST is in flight;
+ * the revision lets the POST completion distinguish that from the pre-turn
+ * cached idle state and immediately reconcile the newly-created card. */
+function bumpStreamCardStatusRevision(ds) {
+    ds.streamCardStatusRevision = (ds.streamCardStatusRevision ?? 0) + 1;
+}
+/** Re-render a just-created starting card when a newer worker status arrived
+ * during its POST. The turn id is forwarded to scheduleCardPatch so a late
+ * patch from turn N cannot overwrite turn N+1's card. */
+function reconcilePostedStartingCard(ds, turnId, revisionAtPost) {
+    if ((ds.streamCardStatusRevision ?? 0) === revisionAtPost)
+        return;
+    if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || ds.streamCardPending)
+        return;
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const status = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? turnStartingCardStatus(ds, effectiveCliId));
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || sessionCliDisplayName(ds, botCfg), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, { fresh: status === 'idle' }), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
+    scheduleCardPatch(ds, cardJson, turnId);
+}
 /**
  * Post the current turn's starting card as soon as the daemon accepts the
  * inbound message. Terminal redraw is deliberately not part of this trigger:
@@ -1016,7 +1491,7 @@ export function recallFrozenCards(ds) {
 export async function postTurnStartingCard(ds, sessionReply, turnId) {
     if (!ds.streamCardPending || ds.streamCardPendingTurnId !== turnId)
         return false;
-    if (riffRetirementAdmissionPhase(ds))
+    if (remoteRetirementAdmissionPhase(ds))
         return false;
     if (ds.streamCardId === CARD_POSTING_SENTINEL)
         return false;
@@ -1035,12 +1510,15 @@ export async function postTurnStartingCard(ds, sessionReply, turnId) {
     const effectiveCliId = sessionCliId(ds, botCfg);
     const previousCardId = ds.streamCardId;
     const previousNonce = ds.streamCardNonce;
+    const previousReplyTargetKey = ds.streamCardReplyTargetKey;
+    const cardReplyTarget = captureStreamingCardReplyTarget(ds, turnId);
     // A newer turn may have arrived while the previous turn's POST was still in
     // flight, so beginNewTurn could not park that sentinel. Park the now-live
     // predecessor here before replacing its identity.
     parkStreamCard(ds);
     const nonce = randomBytes(4).toString('hex');
-    const status = ds.usageLimit ? 'limited' : 'starting';
+    const status = turnStartingCardStatus(ds, effectiveCliId);
+    const statusRevisionAtPost = ds.streamCardStatusRevision ?? 0;
     const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || sessionCliDisplayName(ds, botCfg), '', status, effectiveCliId, ds.displayMode ?? 'hidden', nonce, undefined, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
     ds.streamCardNonce = nonce;
     ds.streamCardId = CARD_POSTING_SENTINEL;
@@ -1052,17 +1530,18 @@ export async function postTurnStartingCard(ds, sessionReply, turnId) {
         && ds.streamCardId === CARD_POSTING_SENTINEL
         && ds.streamCardNonce === nonce
         && (!activeSessionsRegistry || activeSessionsRegistry.get(registryKeyAtPost) === ds);
-    const stillOwnsPost = () => ownsPostIdentity() && riffRetirementAdmissionPhase(ds) === null;
+    const stillOwnsPost = () => ownsPostIdentity() && remoteRetirementAdmissionPhase(ds) === null;
     const restorePrePostIdentityForRetirement = () => {
-        if (riffRetirementAdmissionPhase(ds) === null || !ownsPostIdentity())
+        if (remoteRetirementAdmissionPhase(ds) === null || !ownsPostIdentity())
             return false;
         ds.streamCardId = previousCardId;
         ds.streamCardNonce = previousNonce;
+        ds.streamCardReplyTargetKey = previousReplyTargetKey;
         persistStreamCardState(ds);
         return true;
     };
     try {
-        const messageId = await sessionReply(anchorAtPost, cardJson, 'interactive', larkAppIdAtPost, turnId);
+        const messageId = await sessionReply(anchorAtPost, cardJson, 'interactive', larkAppIdAtPost, cardReplyTarget.turnId);
         if (!stillOwnsPost()) {
             void deleteMessage(larkAppIdAtPost, messageId).catch(() => { });
             restorePrePostIdentityForRetirement();
@@ -1070,6 +1549,7 @@ export async function postTurnStartingCard(ds, sessionReply, turnId) {
             return false;
         }
         ds.streamCardId = messageId;
+        ds.streamCardReplyTargetKey = cardReplyTarget.replyTargetKey;
         ds.parkedStreamCardNonce = undefined;
         const superseded = (ds.streamCardTurnGeneration ?? 0) !== generation;
         if (!superseded) {
@@ -1083,6 +1563,7 @@ export async function postTurnStartingCard(ds, sessionReply, turnId) {
         flushPendingActiveRuntimePatch(ds);
         flushPendingCodexServiceTierPatch(ds);
         syncUsageRefreshTimer(ds);
+        reconcilePostedStartingCard(ds, turnId, statusRevisionAtPost);
         logger.info(`[${tag(ds)}] Posted starting card for turn ${turnId.substring(0, 12)}`);
         if (superseded && ds.streamCardPendingTurnId) {
             void postTurnStartingCard(ds, sessionReply, ds.streamCardPendingTurnId);
@@ -1097,6 +1578,7 @@ export async function postTurnStartingCard(ds, sessionReply, turnId) {
         }
         ds.streamCardId = previousCardId;
         ds.streamCardNonce = previousNonce;
+        ds.streamCardReplyTargetKey = previousReplyTargetKey;
         persistStreamCardState(ds);
         logger.warn(`[${tag(ds)}] Failed to post starting card for turn ${turnId.substring(0, 12)}: ${err}`);
         if ((ds.streamCardTurnGeneration ?? 0) !== generation && ds.streamCardPendingTurnId) {
@@ -1138,12 +1620,15 @@ export async function postFreshStreamingCard(ds, sessionReply) {
     // together so a failed /card leaves no orphaned nonce/pending state).
     const prevCardId = ds.streamCardId;
     const prevNonce = ds.streamCardNonce;
+    const prevReplyTargetKey = ds.streamCardReplyTargetKey;
     const prevPending = ds.streamCardPending;
+    const cardReplyTarget = captureStreamingCardReplyTarget(ds);
     ds.streamCardNonce = randomBytes(4).toString('hex');
     const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, title, ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
     ds.streamCardId = CARD_POSTING_SENTINEL;
     try {
-        ds.streamCardId = await sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId, ds.currentReplyTarget?.turnId);
+        ds.streamCardId = await sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId, cardReplyTarget.turnId);
+        ds.streamCardReplyTargetKey = cardReplyTarget.replyTargetKey;
         // This card is now the live one for the current turn. Clear the new-turn
         // pending flag so the next screen_update PATCHes it instead of POSTing a
         // duplicate (the gate above only suppresses cards when disabled+unforced;
@@ -1166,6 +1651,7 @@ export async function postFreshStreamingCard(ds, sessionReply) {
     catch (err) {
         ds.streamCardId = prevCardId;
         ds.streamCardNonce = prevNonce;
+        ds.streamCardReplyTargetKey = prevReplyTargetKey;
         ds.streamCardPending = prevPending;
         flushPendingLocalCliOpenReadinessPatch(ds);
         flushPendingRiffUrlPatch(ds);
@@ -1585,6 +2071,9 @@ export function ensureCliSkills(cliId, cliPathOverride) {
         const pluginSkillsDir = join(adapter.pluginDir, 'skills');
         // 白板 skill 每次 spawn 重新评估（跟随运行时开关），不进 once-cache。
         ensureWhiteboardSkill(cliId, pluginSkillsDir, whiteboardEnabled());
+        // Workflow skill 家族同理：跟随机器级 workflow 开关，每次 spawn 重新评估，
+        // 关闭时删除已装的三个 skill，下一个会话即生效。
+        ensureWorkflowSkills(cliId, pluginSkillsDir, isWorkflowFeatureEnabled());
         if (skillsInstalledCliIds.has(cliId))
             return;
         ensurePluginSkills(cliId, adapter.pluginDir);
@@ -1624,6 +2113,9 @@ export function ensureCliSkills(cliId, cliPathOverride) {
     //    立刻不再看到 botmux 技能，无需等 daemon 重启。只动 `botmux-` 命名空间，
     //    绝不碰用户自定义 skill。
     ensureWhiteboardSkill(cliId, skillsDir, globalInstall && whiteboardEnabled());
+    // Workflow skill 家族：仅 global 模式落全局盘，且跟随机器级 workflow 开关。
+    // 非 global（prompt/off）由上面的 removeGlobalBotmuxSkills 前缀清理兜底。
+    ensureWorkflowSkills(cliId, skillsDir, globalInstall && isWorkflowFeatureEnabled());
     if (!globalInstall && skillsDir)
         removeGlobalBotmuxSkills(skillsDir);
     if (skillsInstalledCliIds.has(cliId))
@@ -1744,15 +2236,39 @@ export function ensureClaudeFolderTrust(workingDir, stateJsonPath = join(homedir
     }
 }
 // ─── Kill worker ────────────────────────────────────────────────────────────
+/**
+ * Retire a session's worker (and, worker-less, its orphaned backing session).
+ *
+ * CONTRACT FOR REMOTE BACKENDS (riff / mojo): a LIVE remote worker is refused
+ * unless the call carries the prepare/commit `remoteCloseCommitRequestId` —
+ * the function RETURNS WITHOUT RETIRING and the worker keeps running. Callers
+ * must not assume success. Today that refusal is absorbed differently per
+ * call site:
+ *   - /cd (IM + dashboard) rejects remote sessions BEFORE repinning, so this
+ *     refusal is never reached from there;
+ *   - the explicit-close path always carries the commit requestId;
+ *   - crash-loop, collision-loser, VC restore/upgrade and device-isolation
+ *     sweeps still call this best-effort and, for a live remote worker, keep
+ *     the generation alive with its lineage intact (fail-safe: never a silent
+ *     remote cancel). A caller that needs the worker GONE must go through
+ *     prepare/commit or the shutdown-detach flow — not this function.
+ */
 export function killWorker(ds, opts = {}) {
     const closeFrozenType = ds.initConfig?.backendType ?? ds.session.backendType;
     if (ds.worker && !ds.worker.killed
-        && closeFrozenType === 'riff'
-        && !opts.riffCloseCommitRequestId) {
-        // A generic synchronous retirement cannot safely detach Riff. An accepted
-        // create/follow-up may still be waiting for the task id that becomes the
-        // only durable lineage anchor.
-        logger.error(`[${tag(ds)}] Refused unprepared live Riff worker retirement; `
+        && closeFrozenType !== undefined
+        && isRemoteBackendType(closeFrozenType)
+        && !opts.remoteCloseCommitRequestId) {
+        // A generic synchronous retirement cannot safely detach ANY remote backend,
+        // not just Riff. An accepted create/follow-up may still be waiting for the
+        // task id that becomes the only durable lineage anchor — and for Mojo the
+        // worker's legacy close path used to answer a request-less `close` with
+        // `mojo session cancel`, so every generic retirement (/cd cold restart,
+        // crash-loop, collision loser, restore/upgrade) silently and irreversibly
+        // cancelled the remote session with no close_result to carry the outcome.
+        // Only the prepare/commit flow (remoteCloseCommitRequestId) may retire a
+        // live remote worker.
+        logger.error(`[${tag(ds)}] Refused unprepared live ${closeFrozenType} worker retirement; `
             + 'preserving worker and remote-task lineage');
         return;
     }
@@ -1778,18 +2294,20 @@ export function killWorker(ds, opts = {}) {
         // lazy-restore keep the CLI alive for later resume), so /close on such a
         // session would leave an orphaned CLI running in tmux that still replies.
         // Destroy the backing session directly here so /close always terminates it.
-        destroyOrphanedBackingSession(ds);
-        if (opts.riffCloseCommitRequestId
-            && ds.riffCloseState?.requestId === opts.riffCloseCommitRequestId) {
-            ds.riffCloseState = undefined;
+        destroyOrphanedBackingSession(ds, {
+            ...(opts.mojoCancelAlreadyProven ? { skipRemoteCancel: true } : {}),
+        });
+        if (opts.remoteCloseCommitRequestId
+            && ds.remoteCloseState?.requestId === opts.remoteCloseCommitRequestId) {
+            ds.remoteCloseState = undefined;
         }
         return;
     }
     try {
-        if (opts.riffCloseCommitRequestId) {
+        if (opts.remoteCloseCommitRequestId) {
             ds.worker.send({
                 type: 'close_commit',
-                requestId: opts.riffCloseCommitRequestId,
+                requestId: opts.remoteCloseCommitRequestId,
             });
         }
         else {
@@ -1797,9 +2315,9 @@ export function killWorker(ds, opts = {}) {
         }
     }
     catch { /* IPC already closed */ }
-    if (opts.riffCloseCommitRequestId
-        && ds.riffCloseState?.requestId === opts.riffCloseCommitRequestId) {
-        ds.riffCloseState = undefined;
+    if (opts.remoteCloseCommitRequestId
+        && ds.remoteCloseState?.requestId === opts.remoteCloseCommitRequestId) {
+        ds.remoteCloseState = undefined;
     }
     const w = ds.worker;
     trackLifecycleRetirement(ds, w);
@@ -1808,7 +2326,51 @@ export function killWorker(ds, opts = {}) {
     // 外层 race 8s）。默认 2s SIGTERM backstop 会在取消发出前掐死进程，已关闭话题
     // 的远端任务照跑——冻结为 riff 的会话放宽到 24s（层级：destroy 20s < worker 22s
     // < SIGTERM 24s < SIGKILL 29s；正常路径 worker 自行 exit，不会等满）。
-    armWorkerKillBackstop(w, tag(ds), closeFrozenType === 'riff' ? 24_000 : WORKER_SIGTERM_BACKSTOP_MS);
+    // mojo needs the same grace: destroySession() shells out to
+    // `mojo session cancel` (CLI timeout up to 60s) and waits for an in-flight
+    // turn to publish its lineage first, so 2s kills it before the cancel lands.
+    const closeNeedsRemoteGrace = closeFrozenType !== undefined
+        && isRemoteBackendType(closeFrozenType);
+    armWorkerKillBackstop(w, tag(ds), closeNeedsRemoteGrace ? 24_000 : WORKER_SIGTERM_BACKSTOP_MS);
+    ds.worker = null;
+    ds.workerPort = null;
+    ds.workerToken = null;
+    ds.workerViewToken = null;
+}
+/**
+ * Retire the worker PROCESS only — no close semantics of any kind.
+ *
+ * No `close` IPC (a request-less remote close is refused by the worker, and a
+ * local one would destroy the backing session), no remote cancel, lineage and
+ * containment handles intact. SIGTERM is sent immediately (the worker's
+ * handler runs killCli() — for mojo that is backend.kill(), which by contract
+ * never cancels the remote session) and armWorkerKillBackstop guarantees
+ * SIGKILL if it wedges.
+ *
+ * For callers that must make a worker generation DIE while its logical/remote
+ * state lives on: the collision loser (its registry entry is deleted right
+ * after, so a refused killWorker left a live credential-carrying worker
+ * unreachable — the P0-new orphan shape) and the VC runtime-lease fence
+ * (which must prove the local producer process dead before admitting replay).
+ */
+export function retireWorkerProcessOnly(ds, reason) {
+    restartCoordinator.cancelSession(ds.session.sessionId);
+    clearUsageLimitState(ds);
+    ds.workerReady = false;
+    clearUsageRefreshTimer(ds);
+    ds.localProcessAttestation = undefined;
+    ds.managedTurnOrigin = undefined;
+    invalidateStuckWarning(ds, reason);
+    invalidateTuiPrompt(ds, reason);
+    const w = ds.worker;
+    if (w && !w.killed) {
+        trackLifecycleRetirement(ds, w);
+        try {
+            w.kill('SIGTERM');
+        }
+        catch { /* already gone */ }
+        armWorkerKillBackstop(w, tag(ds));
+    }
     ds.worker = null;
     ds.workerPort = null;
     ds.workerToken = null;
@@ -2040,12 +2602,118 @@ function destroyLivePaneBeforeRestart(ds) {
  * ANTHROPIC_BASE_URL/TOKEN）后 /restart 并不会生效（只有 refork 路径生效）。
  * 三分态返回：对象 = 最新 env；null = 明确清空（dashboard 已删）；
  * undefined = 取不到（bot 已注销等异常），让 worker 保持快照不动（=旧行为）。
- * 只热更 env 一个字段：sandbox/backendType 是刻意 freeze-once 的设计（见
+ * 只热更 env / model 两个字段：sandbox/backendType 是刻意 freeze-once 的设计（见
  * forkWorker init 注释），cliId 换 CLI 会踩 resume transcript 对齐，均不带。
  */
 export function latestPerBotEnvForRestart(ds) {
+    // Two failure modes that must NOT be conflated. The old single try/catch
+    // swallowed both, so a quarantine write failure silently returned `undefined`
+    // (restart proceeds, risk unrecorded) — the exact fail-open this ledger exists
+    // to prevent.
+    let env;
     try {
-        return getBot(ds.larkAppId).config.env ?? null;
+        env = getBot(ds.larkAppId).config.env ?? null;
+    }
+    catch {
+        // Bot deregistered: nothing to hot-update. Keep the worker's snapshot (legacy
+        // behaviour) — this is a benign, expected state.
+        return undefined;
+    }
+    // Record what this generation is being handed BEFORE the restart is sent.
+    //
+    // This is the single choke point all four restart senders share (dashboard-ipc
+    // operator + working-dir, requestSessionRestart, cli_crash auto-restart), so
+    // recording here cannot be missed by adding a fifth caller — which is exactly
+    // how the device-isolation proof lost track of the env the running child had
+    // actually been given.
+    //
+    // Accumulate, never replace: the restart may fail or be coalesced, so a later
+    // clean env is not evidence that the dangerous child is gone.
+    //
+    // Any throw here propagates on purpose: the caller must not send a restart while
+    // believing a risk was recorded when it was not.
+    rememberAppliedUnprovableEnvKeys(ds, env ?? undefined);
+    return env;
+}
+/**
+ * Fold the unprovable keys of an env payload into the generation's ledger.
+ *
+ * Names only — the values can be credentials, and the proof only inspects names.
+ * Exported for the restart-timeline tests, which must be able to assert the
+ * ledger itself rather than infer it from a classifier result.
+ */
+export function rememberAppliedUnprovableEnvKeys(ds, env) {
+    // MOJO ONLY. This choke point is shared by every backend's restart, so an
+    // ungated call quarantined codex/tmux sessions as "mojo" forever: a bot with
+    // LD_PRELOAD in bots.json env poisoned unrelated backends (cross-backend
+    // contamination + permanent unprovability). The ledger exists solely to answer
+    // "could a hooked MOJO client still be running", so only mojo may write to it.
+    if (!isMojoSession(ds))
+        return;
+    // BOTH env layers. `mojoUnprovableEnvKeys` is fed the top-level per-bot env AND
+    // the mojo block's own env: they are peers (see the `init` message), the mojo
+    // block wins the merge, and a dangerous key living only in `mojo.env` used to be
+    // recorded nowhere — so it survived a daemon restart as "clean".
+    const mojoBlockEnv = sessionMojoBlockEnv(ds);
+    const keys = mojoUnprovableEnvKeys({ env: { ...(env ?? {}), ...mojoBlockEnv } });
+    if (keys.length === 0)
+        return;
+    const merged = new Set([...(ds.mojoAppliedUnprovableEnvKeys ?? []), ...keys]);
+    ds.mojoAppliedUnprovableEnvKeys = [...merged];
+    // Also persist, because the in-memory ledger cannot answer the question after
+    // a daemon restart or an explicit /close: the SIGTERM-ed mojo child (and any
+    // detached descendants) can outlive both, while still holding an activated
+    // credential. The durable record is keyed by session id and never retracted.
+    const sessionId = ds.session?.sessionId;
+    if (!sessionId) {
+        // Cannot key the durable record without a session id. Never swallow this:
+        // keeping the risk in memory only is the fail-open direction, and this branch
+        // should be unreachable for a real DaemonSession.
+        throw new Error('[mojo-quarantine] refusing to lose an unprovable launcher env: session id missing'
+            + ` (keys: ${keys.join(', ')})`);
+    }
+    // Deliberately NOT wrapped in try/catch: a failed persist means the daemon
+    // cannot prove this host is clean, and swallowing it would hand back a false
+    // "recorded" to every restart sender.
+    recordQuarantinedLauncherEnvKeys(sessionId, keys);
+}
+/** Is this session frozen onto the mojo backend? Prefers the live worker stamp. */
+function isMojoSession(ds) {
+    return (ds.initConfig?.backendType ?? ds.session?.backendType) === 'mojo';
+}
+/**
+ * The mojo block's own `env`, from whichever layer the next turn will actually
+ * use: the config frozen onto the live worker, else the live bot config.
+ */
+function sessionMojoBlockEnv(ds) {
+    const fromInit = ds.initConfig?.backendConfig?.env;
+    if (fromInit)
+        return fromInit;
+    try {
+        return getBot(ds.larkAppId).config.mojo?.env ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Live-worker /restart 携带的最新模型（与 env 同一条通道、同一套三分态）。
+ *
+ * model 不进冻结集合、每次 spawn 按当前 bot 配置解析（见 resolveSessionLaunchModel），
+ * 但 `/restart`、dashboard 重启、CLI 崩溃自动重启这三条路**不 refork**：worker 收到
+ * restart 后用旧 `lastInitConfig` 原地 respawn。不捎带的话，改完模型再重启起来的还是
+ * 旧模型——正是「改配置对存量会话生效」要修的那件事。
+ * 三分态：字符串 = 用它；null = 明确不传模型（bot 未配 / 已清空）；
+ * undefined = 取不到（bot 已注销等异常），让 worker 保持快照不动（=旧行为）。
+ */
+export function latestModelForRespawn(ds) {
+    try {
+        const model = resolveSessionLaunchModel(ds, getBot(ds.larkAppId).config);
+        // An in-worker respawn IS a launch, so the rule-3 record must converge here
+        // too — otherwise `/restart` starts B while the record still says A, and a
+        // later CLI hot-switch pulls A back out of the record.
+        recordLaunchModel(ds, model);
+        return model ?? null;
     }
     catch {
         return undefined;
@@ -2060,7 +2728,7 @@ export function requestSessionRestart(ds, observer) {
     return restartCoordinator.request(ds.session.sessionId, observer, attemptId => {
         if (ds.worker && !ds.worker.killed) {
             ds.workerReady = false;
-            ds.worker.send({ type: 'restart', attemptId, env: latestPerBotEnvForRestart(ds) });
+            ds.worker.send({ type: 'restart', attemptId, env: latestPerBotEnvForRestart(ds), model: latestModelForRespawn(ds) });
             return;
         }
         // No live worker but the persistent pane may still be alive (e.g. after a
@@ -2087,7 +2755,69 @@ export function __testOnly_resetRestartCoordinator() {
  * false worker-side too), so killing it would violate the bridge invariant of
  * leaving the user's own CLI untouched.
  */
-function destroyOrphanedBackingSession(ds) {
+/**
+ * Build the launch config for cancelling a mojo session's remote lineage, or say
+ * why it must not be attempted.
+ *
+ * Shared by the best-effort killWorker teardown and the awaited explicit-close
+ * path so the two cannot cancel through DIFFERENT configs — the launch identity
+ * and control plane decide which tenant the cancel reaches, so a second copy of
+ * these rules drifting would silently cancel against the wrong endpoint.
+ */
+function resolveMojoCancelLaunch(ds, remoteId, label) {
+    let botCfg;
+    try {
+        botCfg = getBot(ds.larkAppId).config;
+    }
+    catch {
+        // Bot deregistered — nothing to cancel WITH. The caller decides what that
+        // means; the explicit-close path treats it as a RETRYABLE refusal, because
+        // re-registering the bot restores exactly the config this needs.
+        logger.warn(`[${tag(ds)}] ${label}: cannot cancel mojo session ${remoteId} — bot `
+            + `${ds.larkAppId} is deregistered. Lineage retained for manual cleanup.`);
+        return { ok: false, reason: 'bot_gone' };
+    }
+    // mojo needs no baseUrl gate — the CLI resolves its own endpoint, and an absent
+    // `mojo` config block is a valid setup.
+    //
+    // Build the SAME effective config the worker would (shared helper): a bare
+    // `botCfg.mojo` carries neither the pinned binary (cliPathOverride) nor the
+    // per-bot env holding the JWT, so a bot that ran fine on a custom path/identity
+    // would fail to cancel here — the remote session then keeps burning cloud
+    // sandbox time while still holding injected credentials.
+    //
+    // The launch IDENTITY (binary + wrapper) must come from the values FROZEN on the
+    // session, not from live bot config: the remote session was created through
+    // those, so cancelling through a wrapper the bot gained afterwards can reach the
+    // wrong gateway/tenant. Session cwd is not persisted for a dead worker, so that
+    // one falls back to the bot's configured working dir.
+    const frozenLaunch = frozenSessionLaunchIdentity(ds, botCfg);
+    // freeze:false — teardown must not mutate session state. Cancel has to reach the
+    // endpoint/tenant that CREATED the remote session, so the frozen control plane
+    // matters here as much as the frozen binary.
+    const frozenMojo = sessionMojoConfig(ds, botCfg, { freeze: false });
+    // A quarantined lineage must NOT be cancelled: nothing records which control
+    // plane holds it, so cancelling through the current config could reach a
+    // different tenant. Callers capture `remoteId` BEFORE this call, so clearing the
+    // field would not have stopped it — the explicit state is what makes the refusal
+    // reliable.
+    if (frozenMojo.lineage === 'quarantined') {
+        logger.warn(`[${tag(ds)}] ${label}: NOT cancelling mojo session ${remoteId} — `
+            + 'its control plane is unverifiable (quarantined). It is preserved on the '
+            + 'session for manual cleanup.');
+        return { ok: false, reason: 'quarantined' };
+    }
+    return {
+        ok: true,
+        launchCfg: buildEffectiveMojoConfig(frozenMojo.config, {
+            cliPathOverride: frozenLaunch.cliPathOverride,
+            workingDir: ds.session.workingDir ?? botCfg.defaultWorkingDir ?? botCfg.workingDir,
+            env: botCfg.env ? sanitizePerBotEnv(botCfg.env) : undefined,
+            wrapperCli: frozenLaunch.wrapperCli,
+        }),
+    };
+}
+function destroyOrphanedBackingSession(ds, opts = {}) {
     if (ds.initConfig?.adoptMode || ds.adoptedFrom)
         return;
     reclaimParkedCrashDiagnostic(ds);
@@ -2103,6 +2833,54 @@ function destroyOrphanedBackingSession(ds) {
         }
         return;
     }
+    if (frozenType === 'mojo') {
+        // Remote backends persist their lineage in the same field riff uses.
+        const remoteId = ds.session.riffParentTaskId;
+        if (!remoteId || opts.skipRemoteCancel)
+            return;
+        const resolved = resolveMojoCancelLaunch(ds, remoteId, 'killWorker');
+        if (!resolved.ok)
+            return;
+        // Best-effort ONLY. The authoritative /close path (prepareMojoExplicitClose)
+        // awaits the same cancellation before publishing the closed row; this branch
+        // exists for the killWorker callers that are not an explicit close (crash
+        // retirement, transfer teardown), where there is no result to report to.
+        //
+        // Clear the lineage ONLY once the remote session is really gone. This used to
+        // clear unconditionally right after firing, so a failed cancel erased the only
+        // id — the exact leak master's riff change above calls out.
+        void cancelMojoSessionById(resolved.launchCfg, remoteId).then((outcome) => {
+            // Structured outcome, not a boolean — `if (!outcome)` would be always-false
+            // and silently treat every failure as a success (an object is truthy).
+            if (!isMojoRemoteGone(outcome)) {
+                logger.warn(`[${tag(ds)}] killWorker: orphan mojo session ${remoteId} NOT cancelled; `
+                    + 'retaining the lineage — note nothing retries this automatically, so an '
+                    + 'explicit /close (which DOES await the cancel) or manual cleanup is required');
+                return;
+            }
+            logger.info(`[${tag(ds)}] killWorker: orphan mojo session ${remoteId} cancelled`);
+            ds.session.riffParentTaskId = undefined;
+            sessionStore.updateSession(ds.session);
+        }).catch((err) => {
+            // Defence in depth for a FIRE-AND-FORGET promise. This helper is
+            // synchronous, so there is no caller to reject to: an escaping rejection
+            // becomes an unhandledRejection, and the daemon installs no handler for
+            // those (only worker.ts does), so Node v22 terminates the process --
+            // taking down every OTHER session this daemon serves. The awaited call
+            // site already guards itself the same way; tmux-pipe-backend.ts documents
+            // a real incident of exactly this shape.
+            //
+            // Reachable, not theoretical: cancelMojoSessionById constructs a backend
+            // before its own try block, so an unreadable containment store throws out
+            // of it rather than returning the structured failure its type promises.
+            // sessionStore.updateSession above can throw for the same reason (a failed
+            // save). Both must degrade to a retained lineage, never to a crash.
+            logger.error(`[${tag(ds)}] killWorker: orphan mojo cancel for ${remoteId} threw; `
+                + `retaining the lineage for explicit /close or manual cleanup: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+        });
+        return;
+    }
     const backendType = getSessionPersistentBackendType(ds);
     if (!backendType)
         return;
@@ -2114,16 +2892,16 @@ function destroyOrphanedBackingSession(ds) {
         logger.warn(`[${tag(ds)}] killWorker: failed to destroy orphaned ${backendType} backing session: ${err}`);
     }
 }
-async function abortLiveRiffWorkerClose(ds, requestId, opts = {}) {
-    if (ds.riffCloseState?.requestId !== requestId)
+async function abortLiveRemoteWorkerClose(ds, requestId, opts = {}) {
+    if (ds.remoteCloseState?.requestId !== requestId)
         return false;
     const worker = ds.worker;
     if (!worker || worker.killed) {
         if (opts.allowAbsentAfterProvenRestore) {
-            ds.riffCloseState = undefined;
+            ds.remoteCloseState = undefined;
             return true;
         }
-        ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+        ds.remoteCloseState = { ...ds.remoteCloseState, phase: 'uncertain' };
         return false;
     }
     const restored = await new Promise(resolve => {
@@ -2145,13 +2923,23 @@ async function abortLiveRiffWorkerClose(ds, requestId, opts = {}) {
                 finish({ ok: false, error: 'stale_worker_generation' });
                 return;
             }
-            finish({ ok: msg.ok, ...(msg.error ? { error: msg.error } : {}) });
+            // `ok` says the abort was HANDLED; `admissionRestored` says whether writes
+            // actually came back. A backend holding a latched fence answers ok:true /
+            // admissionRestored:false, and inferring restoration from `ok` journalled a
+            // cleared fence while write() kept returning false. Absent means `ok`
+            // (legacy backends, riff).
+            finish({
+                ok: msg.ok,
+                admissionRestored: msg.admissionRestored ?? msg.ok,
+                ...(msg.fenceReason ? { fenceReason: msg.fenceReason } : {}),
+                ...(msg.error ? { error: msg.error } : {}),
+            });
         };
         const onExit = () => finish({
             ok: false,
             error: 'worker_exited_before_close_abort_result',
         });
-        const timer = setTimeout(() => finish({ ok: false, error: 'close_abort_result_timeout' }), RIFF_ADMISSION_RESTORE_TIMEOUT_MS);
+        const timer = setTimeout(() => finish({ ok: false, error: 'close_abort_result_timeout' }), REMOTE_ADMISSION_RESTORE_TIMEOUT_MS);
         timer.unref?.();
         worker.on?.('message', onMessage);
         worker.once?.('exit', onExit);
@@ -2162,39 +2950,192 @@ async function abortLiveRiffWorkerClose(ds, requestId, opts = {}) {
             finish({ ok: false, error: err instanceof Error ? err.message : String(err) });
         }
     });
-    if (restored.ok && ds.riffCloseState?.requestId === requestId) {
-        ds.riffCloseState = undefined;
+    // A handled-but-REFUSED abort must not clear the fence. `ok` alone did, which
+    // is the same laundering as before, one path over.
+    const admissionRestored = restored.ok && restored.admissionRestored !== false;
+    if (admissionRestored && ds.remoteCloseState?.requestId === requestId) {
+        ds.remoteCloseState = undefined;
         return true;
     }
+    // A proven earlier restore excuses a MISSING ack, never a refused one: the
+    // backend just told us writes are still fenced.
     if (opts.allowAbsentAfterProvenRestore
-        && ds.riffCloseState?.requestId === requestId) {
-        ds.riffCloseState = undefined;
+        && restored.admissionRestored !== false
+        && ds.remoteCloseState?.requestId === requestId) {
+        ds.remoteCloseState = undefined;
         return true;
     }
-    if (ds.riffCloseState?.requestId === requestId) {
-        ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+    if (ds.remoteCloseState?.requestId === requestId) {
+        ds.remoteCloseState = { ...ds.remoteCloseState, phase: 'uncertain' };
     }
-    logger.warn(`[${tag(ds)}] Riff close abort was not acknowledged (${restored.error ?? 'unknown'}); `
+    logger.warn(`[${tag(ds)}] Remote close abort did not restore write admission `
+        + `(${restored.fenceReason ?? restored.error ?? 'unknown'}); `
         + 'retaining admission fence pending explicit lineage reconciliation');
     return false;
 }
-async function prepareLiveRiffWorkerClose(ds) {
+async function prepareLiveRemoteWorkerClose(ds, backendType) {
     const worker = ds.worker;
     if (!worker || worker.killed) {
-        return { ok: false, error: 'riff_worker_close_failed', retryable: true };
+        return {
+            ok: false,
+            error: backendType === 'riff' ? 'riff_worker_close_failed' : 'mojo_cancel_failed',
+            retryable: true,
+        };
     }
-    if (ds.riffCloseState || ds.riffShutdownState) {
+    if (backendType === 'mojo' && ds.remoteCloseState?.phase === 'abort_restored') {
+        const restoredState = ds.remoteCloseState;
+        try {
+            const committed = sessionStore.finishMojoCloseAbort(ds.session.sessionId, restoredState.requestId, {
+                admissionRestored: true,
+                ...(restoredState.taskId ? { taskId: restoredState.taskId } : {}),
+            });
+            ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+            ds.session.riffParentTaskId = committed.riffParentTaskId;
+            ds.remoteCloseState = undefined;
+        }
+        catch (err) {
+            logger.error(`[${tag(ds)}] Mojo admission restore proof could not clear the durable close journal: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(restoredState.taskId ? { taskId: restoredState.taskId } : {}),
+            };
+        }
+    }
+    if (backendType === 'mojo' && ds.remoteCloseState?.phase === 'prepared') {
+        try {
+            const committed = sessionStore.markMojoClosePrepared(ds.session.sessionId, ds.remoteCloseState.requestId, ds.remoteCloseState.taskId, 
+            // The retry must republish the SAME proof, residual included — the
+            // original prepare saw the local evidence grade; this replay did not.
+            ds.remoteCloseState.localResidual);
+            ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+            ds.session.riffParentTaskId = committed.riffParentTaskId;
+        }
+        catch (err) {
+            logger.error(`[${tag(ds)}] Mojo close proof could not be persisted for durable commit: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            };
+        }
+        return {
+            ok: true,
+            ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            // Stored residual → derived at read time (see liveLocalResidual): the
+            // journal write above still republishes the original proof verbatim.
+            ...(residualField(liveLocalResidual(ds.session.sessionId, ds.remoteCloseState.localResidual))),
+        };
+    }
+    if (ds.remoteShutdownState) {
         return {
             ok: false,
-            error: 'riff_worker_close_failed',
+            error: 'remote_shutdown_fence_in_progress',
             retryable: true,
-            ...((ds.riffCloseState?.taskId ?? ds.riffShutdownState?.taskId)
-                ? { taskId: (ds.riffCloseState?.taskId ?? ds.riffShutdownState?.taskId) }
+            ...(typeof ds.remoteShutdownState.taskId === 'string' && ds.remoteShutdownState.taskId
+                ? { taskId: ds.remoteShutdownState.taskId }
                 : {}),
         };
     }
+    let takenOverRuntimeState;
+    if (ds.remoteCloseState) {
+        const runtimeUncertain = backendType === 'mojo'
+            && ds.remoteCloseState.phase === 'uncertain';
+        // A runtime `uncertain` fence used to be a dead end: "a blind retry proves
+        // nothing" was true when the journal refused every restart, so /close
+        // failed with retryable:false for the daemon's whole lifetime and the only
+        // exit was a daemon restart — a process-level soft deadlock (third-round
+        // review, gate 1). The retry is no longer blind: an explicit close with a
+        // LIVE worker re-runs the full destroySession, which can produce fresh
+        // evidence. When the runtime fence and the DURABLE journal describe the
+        // same failed attempt — same phase, same requestId, same lineage — the
+        // fence is cleared and the close re-enters prepare under a new requestId
+        // (beginMojoCloseJournal accepts the uncertain takeover). Anything less
+        // than an exact match keeps the refusal: a mismatched pair means runtime
+        // and disk disagree about which attempt happened, and clearing on that
+        // would launder an unknown state.
+        const durableForTakeover = ds.session.mojoCloseJournal;
+        // Three legs, each covering a REAL production writer of this pair
+        // (fourth-round review named the two the exact-match version missed):
+        //   phase   — the runtime fence is `uncertain` for every non-irreversible
+        //             failed prepare, while the DURABLE phase differs by verdict:
+        //             `uncertain` for an uncertain one, `preparing` (with
+        //             recovery 'retryable') for a retryable-but-fenced one. Both
+        //             pairs describe the same failed attempt; matching only
+        //             uncertain/uncertain left retryable+fenced soft-deadlocked
+        //             with a durable row that itself promises a retry (gap A).
+        //   requestId — exact, always: both sides were written by that attempt.
+        //   lineage — equal, or the durable side is a superset (the worker may
+        //             have reported the pre-init lineage into the journal while
+        //             the runtime fence kept none, gap B). A CONFLICTING pair
+        //             still refuses: runtime and disk disagreeing about which
+        //             remote session was touched must never be laundered.
+        const durablePhaseMatches = durableForTakeover?.phase === 'uncertain'
+            || (durableForTakeover?.phase === 'preparing'
+                && durableForTakeover.recovery === 'retryable');
+        const runtimeTaskId = ds.remoteCloseState.taskId ?? undefined;
+        const durableTaskId = durableForTakeover?.taskId ?? undefined;
+        const takeoverEligible = runtimeUncertain
+            && durableForTakeover !== undefined
+            && durablePhaseMatches
+            && durableForTakeover.requestId === ds.remoteCloseState.requestId
+            && (durableTaskId === runtimeTaskId || runtimeTaskId === undefined);
+        if (takeoverEligible) {
+            logger.warn(`[${tag(ds)}] explicit close takes over ${durableForTakeover.phase} Mojo journal `
+                + `(${ds.remoteCloseState.requestId}); re-running the cancel through the live worker`);
+            // Cleared only in memory here; restored if the fresh attempt's durable
+            // write below fails, so the runtime fence (and everything keyed on it,
+            // e.g. the shutdown-detach explicit-close guard) never vanishes without
+            // a successor journal actually on disk.
+            takenOverRuntimeState = ds.remoteCloseState;
+            ds.remoteCloseState = undefined;
+        }
+        else if (runtimeUncertain) {
+            return {
+                ok: false,
+                error: 'mojo_close_reconciliation_required',
+                retryable: false,
+                recovery: 'uncertain',
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            };
+        }
+        else {
+            return {
+                ok: false,
+                error: backendType === 'riff' ? 'riff_worker_close_failed' : 'mojo_cancel_failed',
+                retryable: true,
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            };
+        }
+    }
     const requestId = randomUUID();
-    ds.riffCloseState = {
+    if (backendType === 'mojo') {
+        try {
+            const committed = sessionStore.beginMojoCloseJournal(ds.session.sessionId, requestId, ds.session.riffParentTaskId);
+            ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+        }
+        catch (err) {
+            // Reinstate a runtime fence the takeover cleared: without this, a failed
+            // durable write left the ds fence-less while disk still said uncertain,
+            // and guards keyed on ds.remoteCloseState (shutdown-detach's
+            // explicit-close check) silently lost their signal.
+            if (takenOverRuntimeState)
+                ds.remoteCloseState = takenOverRuntimeState;
+            logger.error(`[${tag(ds)}] Mojo close journal could not be persisted before cancellation: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(ds.session.riffParentTaskId ? { taskId: ds.session.riffParentTaskId } : {}),
+            };
+        }
+    }
+    ds.remoteCloseState = {
         phase: 'preparing',
         requestId,
         ...(ds.session.riffParentTaskId ? { taskId: ds.session.riffParentTaskId } : {}),
@@ -2208,17 +3149,29 @@ async function prepareLiveRiffWorkerClose(ds) {
             settled = true;
             clearTimeout(timer);
             worker.removeListener?.('exit', onExit);
-            pendingRiffWorkerCloses.delete(requestId);
+            pendingRemoteWorkerCloses.delete(requestId);
             resolve(value);
         };
+        // The worker died mid-prepare, so whatever destroySession() had already done
+        // is unknown -- including a completed irreversible cancel. Fence.
         const onExit = () => finish({
             ok: false,
             error: 'worker_exited_before_close_result',
+            recovery: 'uncertain',
         });
-        const timer = setTimeout(() => finish({ ok: false, error: 'worker_close_result_timeout' }), 23_000);
+        // Riff's adapter has its own 20s destroy deadline. Mojo may first spend 8s
+        // waiting for system/init, then up to 60s in `mojo session cancel`; aborting
+        // at the old 23s Riff budget re-opened admission while that irreversible
+        // cancellation was still in flight. Stay above both bounded Mojo phases.
+        const closeResultTimeoutMs = backendType === 'mojo'
+            ? MOJO_EXPLICIT_CLOSE_RESULT_TIMEOUT_MS
+            : 23_000;
+        const timer = setTimeout(
+        // A timed-out prepare may still be running remotely; the outcome is unknown.
+        () => finish({ ok: false, error: 'worker_close_result_timeout', recovery: 'uncertain' }), closeResultTimeoutMs);
         timer.unref?.();
         worker.once?.('exit', onExit);
-        pendingRiffWorkerCloses.set(requestId, {
+        pendingRemoteWorkerCloses.set(requestId, {
             sessionId: ds.session.sessionId,
             worker,
             resolve: value => {
@@ -2234,14 +3187,223 @@ async function prepareLiveRiffWorkerClose(ds) {
         }
     });
     const taskId = result.taskId ?? ds.session.riffParentTaskId;
+    if (backendType === 'mojo') {
+        if (result.ok) {
+            try {
+                const committed = sessionStore.markMojoClosePrepared(ds.session.sessionId, requestId, taskId, 
+                // Durable ON PURPOSE: the residual is part of the close outcome, and a
+                // daemon restart replaying this prepared journal must still publish
+                // `closed_with_residual` (only the worker saw the evidence grade).
+                result.residual);
+                ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+                ds.session.riffParentTaskId = committed.riffParentTaskId;
+            }
+            catch (err) {
+                // Cancellation is irreversible. The runtime proof stays prepared and
+                // admission remains fenced; a retry republishes that same proof without
+                // asking the worker to cancel twice — residual included, or the retry
+                // would silently downgrade a residual close to a plain one. The durable
+                // `preparing` journal makes a daemon crash fail closed rather than
+                // resume this generation.
+                ds.remoteCloseState = {
+                    phase: 'prepared',
+                    requestId,
+                    ...(taskId ? { taskId } : {}),
+                    ...(result.residual ? { localResidual: result.residual } : {}),
+                };
+                logger.error(`[${tag(ds)}] Mojo close proof persistence failed after cancellation; `
+                    + `retaining prepared commit: ${err instanceof Error ? err.message : String(err)}`);
+                return {
+                    ok: false,
+                    error: 'mojo_durable_close_failed',
+                    retryable: true,
+                    ...(taskId ? { taskId } : {}),
+                };
+            }
+            ds.remoteCloseState = {
+                phase: 'prepared',
+                requestId,
+                ...(taskId ? { taskId } : {}),
+                ...(result.residual ? { localResidual: result.residual } : {}),
+            };
+            logger.info(`[${tag(ds)}] mojo worker close prepared and remote cancellation confirmed`);
+            // The remote lineage is confirmed cancelled, but that says nothing about the
+            // LOCAL process tree. When the backend could not prove its subtree gone it
+            // kept the containment handle, so this row must NOT be published as an
+            // ordinary closed one: the device-isolation blocker is still live and an
+            // operator reading "closed" would believe a credentialed process was gone.
+            //
+            // Kept distinct from the remote lineage residual on purpose. That one names a
+            // surviving remote task id and asks for remote cleanup; this one names a host
+            // subtree and asks for local cleanup, and collapsing them would send the
+            // operator after the wrong thing. Hence no taskId here even when one exists —
+            // the remote side really was cancelled.
+            if (result.residual) {
+                logger.warn(`[${tag(ds)}] mojo remote cancellation confirmed, but the LOCAL subtree was not `
+                    + `proven gone (${result.residual}); publishing a residual close so the `
+                    + 'device-isolation blocker stays visible');
+                return {
+                    ok: true,
+                    ...(taskId ? { taskId } : {}),
+                    residual: { reason: result.residual },
+                };
+            }
+            return { ok: true, ...(taskId ? { taskId } : {}) };
+        }
+        // Only a REVERSIBLE failure may be rolled back. Sending close_abort for every
+        // ok:false re-opened write admission after an `uncertain` verdict (an unnamed
+        // remote session may exist) and after an `irreversible` one (the remote side is
+        // already gone), which laundered both back into `retryable` end to end.
+        const recovery = result.recovery ?? 'retryable';
+        // Whether writes may be admitted is a DIFFERENT question from whether the
+        // close may be retried. Keying the rollback on `recovery` re-opened admission
+        // for an unproven local child termination (retryable, yet a credentialed
+        // process may still be alive); absent `admission` keeps the historical
+        // derivation so riff and older workers are unaffected.
+        // Delegated to the shared helper rather than re-implementing the derivation:
+        // two copies of this rule is how the daemon drifted back to reading
+        // `recovery` and re-opened admission on a latched fence.
+        const mayRestore = mayRestoreWriteAdmission({
+            ok: false,
+            ...(result.recovery ? { recovery: result.recovery } : {}),
+            ...(result.admission ? { admission: result.admission } : {}),
+        });
+        if (!mayRestore) {
+            // No abort: the runtime fence stays up, so the session remains active and
+            // keeps its device-isolation blocker. But the DURABLE row must also stop
+            // saying `preparing` with the pre-prepare task id -- a crash here left a
+            // journal that could not be told apart from an interrupted cancel, and
+            // silently discarded the exact lineage the worker just reported.
+            const irreversible = recovery === 'irreversible';
+            let journalled = false;
+            try {
+                const committed = sessionStore.markMojoCloseUnresolved(ds.session.sessionId, requestId, {
+                    recovery,
+                    // The EXACT id from close_result (the pre-init window means the worker
+                    // may be the first to know it), not the pre-prepare guess.
+                    ...(taskId ? { taskId } : {}),
+                    // Persisted verbatim and separately from `recovery`: no close_abort
+                    // was sent, so writes are still fenced even when the close itself is
+                    // retryable. Re-deriving this on restore is what re-opened admission.
+                    admission: 'fenced',
+                });
+                ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+                ds.session.riffParentTaskId = committed.riffParentTaskId;
+                journalled = true;
+            }
+            catch (err) {
+                // Fail closed: keep the runtime fence exactly as strict as the disk state
+                // is ambiguous. Never fall back to a rollback.
+                logger.error(`[${tag(ds)}] Mojo ${recovery} close verdict could not be journalled: `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            }
+            // An irreversible teardown leaves ONLY the local commit outstanding, so the
+            // runtime state must be `prepared` -- parking it at `uncertain` made every
+            // retry bounce off the fence and the row could never be closed at all.
+            // NOTE: the runtime phase deliberately stays `uncertain` for everything
+            // that is not a journalled irreversible teardown. A retryable-but-fenced
+            // close is recorded as `preparing` in the DURABLE journal (a restart may
+            // retry the cancel), but within this process the reconciliation gate
+            // refuses a retry either way, so distinguishing the runtime phase here
+            // would be an untestable claim.
+            ds.remoteCloseState = {
+                phase: irreversible && journalled ? 'prepared' : 'uncertain',
+                requestId,
+                ...(taskId ? { taskId } : {}),
+            };
+            logger.error(`[${tag(ds)}] mojo worker close prepare failed as ${recovery} `
+                + `(${result.error ?? 'unknown'}); admission stays fenced, `
+                + `journal=${journalled ? ds.session.mojoCloseJournal?.phase ?? 'unknown' : 'unwritten'}`);
+            if (!journalled) {
+                return {
+                    ok: false,
+                    error: 'mojo_durable_close_failed',
+                    retryable: true,
+                    recovery,
+                    ...(taskId ? { taskId } : {}),
+                };
+            }
+            // Fenced but still retryable (an unproven LOCAL termination; the
+            // irreversible remote cancel never ran). The close may be retried as a
+            // close -- reporting it as `mojo_close_reconciliation_required` would
+            // strand a session a plain retry can still finish.
+            if (recovery === 'retryable') {
+                return {
+                    ok: false,
+                    error: 'mojo_cancel_failed',
+                    retryable: true,
+                    recovery,
+                    ...(taskId ? { taskId } : {}),
+                };
+            }
+            return irreversible
+                // Retryable, but only as a LOCAL commit: the durable journal is now
+                // commit-only, so a retry can never issue a second cancel.
+                ? {
+                    ok: false,
+                    error: 'mojo_close_commit_required',
+                    retryable: true,
+                    recovery,
+                    ...(taskId ? { taskId } : {}),
+                }
+                // Unknown outcome: a blind retry proves nothing. Demand reconciliation
+                // instead of advertising a retry that cannot succeed.
+                : {
+                    ok: false,
+                    error: 'mojo_close_reconciliation_required',
+                    retryable: false,
+                    recovery,
+                    ...(taskId ? { taskId } : {}),
+                };
+        }
+        const admissionRestored = await abortLiveRemoteWorkerClose(ds, requestId, {
+            allowAbsentAfterProvenRestore: matchedCloseResult,
+        });
+        // NOTE: no separate "refused" branch here. finishMojoCloseAbort already keeps
+        // a durable fenced row when admissionRestored is false; the bug was never its
+        // behaviour but the CALLER inventing that flag from `close_abort_result.ok`.
+        // An extra branch differing only in which non-clearing row it writes was not
+        // distinguishable by any test, so it is not claimed as a fix.
+        try {
+            const committed = sessionStore.finishMojoCloseAbort(ds.session.sessionId, requestId, { admissionRestored, ...(taskId ? { taskId } : {}) });
+            ds.session.mojoCloseJournal = committed.mojoCloseJournal;
+            ds.session.riffParentTaskId = committed.riffParentTaskId;
+        }
+        catch (err) {
+            // The worker may have restored admission, but without a durable journal
+            // clear a crash would still be ambiguous. Keep the daemon fence aligned
+            // with the disk-side uncertainty instead of accepting new input.
+            ds.remoteCloseState = {
+                phase: admissionRestored ? 'abort_restored' : 'uncertain',
+                requestId,
+                ...(taskId ? { taskId } : {}),
+            };
+            logger.error(`[${tag(ds)}] Mojo close abort could not be committed durably: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(taskId ? { taskId } : {}),
+            };
+        }
+        logger.warn(`[${tag(ds)}] mojo worker close prepare failed: ${result.error ?? 'unknown'}; `
+            + `session remains active${taskId ? ` (task ${taskId})` : ''}`);
+        return {
+            ok: false,
+            error: 'mojo_cancel_failed',
+            retryable: true,
+            ...(taskId ? { taskId } : {}),
+        };
+    }
     if (result.taskId) {
         ds.session.riffParentTaskId = result.taskId;
         try {
             sessionStore.updateSession(ds.session);
         }
         catch (err) {
-            await abortLiveRiffWorkerClose(ds, requestId);
-            logger.error(`[${tag(ds)}] Riff close lineage persistence failed; close aborted: `
+            await abortLiveRemoteWorkerClose(ds, requestId);
+            logger.error(`[${tag(ds)}] ${backendType} close lineage persistence failed; close aborted: `
                 + `${err instanceof Error ? err.message : String(err)}`);
             return {
                 ok: false,
@@ -2252,10 +3414,10 @@ async function prepareLiveRiffWorkerClose(ds) {
         }
     }
     if (!result.ok) {
-        await abortLiveRiffWorkerClose(ds, requestId, {
+        await abortLiveRemoteWorkerClose(ds, requestId, {
             allowAbsentAfterProvenRestore: matchedCloseResult,
         });
-        logger.warn(`[${tag(ds)}] Riff worker close prepare failed: ${result.error ?? 'unknown'}; `
+        logger.warn(`[${tag(ds)}] ${backendType} worker close prepare failed: ${result.error ?? 'unknown'}; `
             + `session remains active${taskId ? ` (task ${taskId})` : ''}`);
         return {
             ok: false,
@@ -2264,12 +3426,12 @@ async function prepareLiveRiffWorkerClose(ds) {
             ...(taskId ? { taskId } : {}),
         };
     }
-    ds.riffCloseState = {
+    ds.remoteCloseState = {
         phase: 'prepared',
         requestId,
         ...(taskId ? { taskId } : {}),
     };
-    logger.info(`[${tag(ds)}] Riff worker close prepared and remote task cancellation confirmed`);
+    logger.info(`[${tag(ds)}] ${backendType} worker close prepared and remote cancellation confirmed`);
     return { ok: true, ...(taskId ? { taskId } : {}) };
 }
 /** Await remote cancellation for any Riff owner before its durable row is
@@ -2281,23 +3443,23 @@ async function prepareRiffExplicitClose(ds, stored) {
         return { ok: true };
     const backendType = ds?.initConfig?.backendType ?? session.backendType;
     const taskId = session.riffParentTaskId;
-    if (ds?.riffShutdownState) {
-        const fencedTaskId = Object.prototype.hasOwnProperty.call(ds.riffShutdownState, 'taskId')
-            ? ds.riffShutdownState.taskId
+    if (ds?.remoteShutdownState) {
+        const fencedTaskId = Object.prototype.hasOwnProperty.call(ds.remoteShutdownState, 'taskId')
+            ? ds.remoteShutdownState.taskId
             : taskId;
         return {
             ok: false,
-            error: 'riff_shutdown_fence_in_progress',
+            error: 'remote_shutdown_fence_in_progress',
             retryable: true,
             ...(typeof fencedTaskId === 'string' && fencedTaskId ? { taskId: fencedTaskId } : {}),
         };
     }
-    if (ds?.riffCloseState) {
+    if (ds?.remoteCloseState) {
         return {
             ok: false,
             error: 'riff_close_reconciliation_required',
             retryable: true,
-            ...(ds.riffCloseState.taskId ? { taskId: ds.riffCloseState.taskId } : {}),
+            ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
         };
     }
     if (backendType !== 'riff')
@@ -2313,7 +3475,7 @@ async function prepareRiffExplicitClose(ds, stored) {
                 ...(taskId ? { taskId } : {}),
             };
         }
-        return prepareLiveRiffWorkerClose(ds);
+        return prepareLiveRemoteWorkerClose(ds, 'riff');
     }
     const durableBefore = sessionStore.getSession(session.sessionId);
     if (ds && durableBefore
@@ -2322,57 +3484,511 @@ async function prepareRiffExplicitClose(ds, stored) {
         logger.warn(`[${tag(ds)}] explicit close refused before cancellation: runtime/durable Riff lineage differs `
             + `(${ds.session.riffParentTaskId ?? 'none'}/${durableBefore.riffParentTaskId ?? 'none'})`);
         return {
-            ok: false,
-            error: 'riff_task_changed',
-            retryable: true,
-            ...(authoritativeTaskId ? { taskId: authoritativeTaskId } : {}),
+            ok: false,
+            error: 'riff_task_changed',
+            retryable: true,
+            ...(authoritativeTaskId ? { taskId: authoritativeTaskId } : {}),
+        };
+    }
+    if (!taskId)
+        return { ok: true };
+    let riffConfig;
+    const larkAppId = ds?.larkAppId ?? session.larkAppId;
+    try {
+        if (larkAppId)
+            riffConfig = getBot(larkAppId).config.riff;
+    }
+    catch { /* bot removed */ }
+    const cleanup = await cleanupExplicitSessionBacking({
+        sessionId: session.sessionId,
+        backendType,
+        riffParentTaskId: taskId,
+        riffConfig,
+    });
+    const closeLabel = ds ? tag(ds) : session.sessionId.slice(0, 8);
+    if (!cleanup.ok) {
+        logger.warn(`[${closeLabel}] explicit close refused: ${cleanup.kind}; `
+            + `Riff task ${taskId} remains active and retryable`);
+        return {
+            ok: false,
+            error: cleanup.kind === 'riff_config_missing' ? 'riff_config_missing' : 'riff_cancel_failed',
+            retryable: true,
+            taskId,
+        };
+    }
+    if (cleanup.kind !== 'cancelled_riff')
+        return { ok: true };
+    const latest = sessionStore.getSession(session.sessionId);
+    const latestTaskId = latest?.riffParentTaskId;
+    const runtimeTaskId = ds?.session.riffParentTaskId;
+    if (!latest || latest.status !== 'active' || latestTaskId !== cleanup.taskId
+        || (ds && runtimeTaskId !== cleanup.taskId)) {
+        logger.warn(`[${closeLabel}] explicit close cancelled stale Riff task ${cleanup.taskId}, `
+            + `but runtime/durable lineage or status changed to `
+            + `${runtimeTaskId ?? 'none'}/${latestTaskId ?? 'none'}/${latest?.status ?? 'missing'}; retry required`);
+        return {
+            ok: false,
+            error: 'riff_task_changed',
+            retryable: true,
+            taskId: latestTaskId ?? runtimeTaskId ?? cleanup.taskId,
+        };
+    }
+    logger.info(`[${closeLabel}] Riff task ${cleanup.taskId} cancellation prepared for explicit close`);
+    return { ok: true, taskId: cleanup.taskId };
+}
+/**
+ * Prove a mojo session's remote lineage is cancelled BEFORE its row is published
+ * as closed — the mojo half of what prepareRiffExplicitClose does.
+ *
+ * Without this, `/close` on a workerless mojo session marked the row closed and
+ * returned success while the cancel was still in flight, so a failed cancel left
+ * the operator believing the session was gone while the remote one kept running
+ * and holding the injected credential. The retained lineage was not a recovery
+ * path either: cancelMojoSessionById has exactly one call site (the best-effort
+ * killWorker teardown), which a second `/close` can no longer reach because the
+ * first close removed the session from the active registry.
+ *
+ * A live worker uses prepare/commit: MojoBackend.destroySession() awaits the
+ * cancel (including the pre-init window), then the daemon durably closes the row
+ * before committing worker retirement. A failed durable write keeps the exact
+ * generation prepared so retry commits without cancelling twice.
+ *
+ * An open durable row with no entry in the active registry cannot be cancelled
+ * from here at all (every helper the cancel needs is keyed on DaemonSession), so
+ * it is refused as retryable rather than published as closed — restoring the owner
+ * makes the retry work.
+ */
+async function prepareMojoExplicitClose(ds, stored) {
+    const session = ds?.session ?? stored;
+    if (!session)
+        return { ok: true };
+    if (ds?.initConfig?.adoptMode || ds?.adoptedFrom || session.adoptedFrom)
+        return { ok: true };
+    // A row whose lineage was PARKED (restore-time quarantine moves the id here and
+    // clears the active slot) still has a remote session running. It is reported as
+    // a residual on every close of this row, including replays of an already-closed
+    // one — which is what makes the outcome idempotent instead of degrading to a
+    // failure once the owner is gone.
+    const parked = mojoCloseResidualForRow(stored ?? session);
+    const remoteId = stored ? stored.riffParentTaskId : session.riffParentTaskId;
+    const runtimeClose = ds?.session.mojoCloseJournal;
+    const storedClose = stored?.mojoCloseJournal;
+    if (ds && stored && ds.session !== stored && runtimeClose) {
+        const runtimeMatchesDurable = !!storedClose
+            && runtimeClose.phase === storedClose.phase
+            && runtimeClose.requestId === storedClose.requestId
+            && runtimeClose.taskId === storedClose.taskId
+            && runtimeClose.updatedAt === storedClose.updatedAt;
+        if (!runtimeMatchesDurable) {
+            // A runtime copy is not durable authority. In particular, a stale/forged
+            // in-memory `prepared` value must never bypass cancellation, while a real
+            // prepared store row must not be re-cancelled because a detached runtime
+            // copy missed the last sync.
+            logger.error(`[${session.sessionId.slice(0, 8)}] explicit close refused: runtime/durable Mojo journal mismatch`);
+            return {
+                ok: false,
+                error: 'mojo_close_reconciliation_required',
+                retryable: true,
+                ...((storedClose?.taskId ?? runtimeClose.taskId ?? remoteId)
+                    ? { taskId: (storedClose?.taskId ?? runtimeClose.taskId ?? remoteId) }
+                    : {}),
+            };
+        }
+    }
+    let durableClose = storedClose ?? runtimeClose;
+    if (durableClose && !sessionStore.isValidMojoCloseJournal(durableClose)) {
+        logger.error(`[${session.sessionId.slice(0, 8)}] explicit close refused: malformed Mojo close journal`);
+        return {
+            ok: false,
+            error: 'mojo_close_reconciliation_required',
+            retryable: true,
+            ...(remoteId ? { taskId: remoteId } : {}),
+        };
+    }
+    // Already closed is normally an idempotent replay. A journal on a closed row
+    // is NOT normal (the status transition clears it atomically), so do not flatten
+    // that contradictory disk state into an ordinary success.
+    if (stored && stored.status === 'closed') {
+        if (durableClose) {
+            return {
+                ok: false,
+                error: 'mojo_close_reconciliation_required',
+                retryable: true,
+                ...((durableClose.taskId ?? remoteId)
+                    ? { taskId: (durableClose.taskId ?? remoteId) }
+                    : {}),
+            };
+        }
+        return parked ? { ok: true, residual: parked } : { ok: true };
+    }
+    if (durableClose?.phase === 'prepared') {
+        // A prior daemon already received and durably recorded the irreversible
+        // worker cancellation proof. Finish only the local status/lineage commit;
+        // repeating the CLI cancel would turn an idempotent recovery into failure.
+        // A parked remote lineage outranks the journal's LOCAL residual in the one
+        // slot the response has (it names a live remote session); the local marker
+        // still surfaces whenever nothing is parked.
+        return {
+            ok: true,
+            ...((durableClose.taskId ?? remoteId)
+                ? { taskId: (durableClose.taskId ?? remoteId) }
+                : {}),
+            // The journal's residual is a stored copy of the original proof; whether
+            // it still describes reality is the ledger's call (a reboot between the
+            // prepare and this replay may have discharged the handle).
+            ...(parked
+                ? { residual: parked }
+                : residualField(liveLocalResidual(session.sessionId, durableClose.localResidual))),
+        };
+    }
+    const matchingRuntimePreparedProof = durableClose?.phase === 'preparing'
+        && ds?.remoteCloseState?.phase === 'prepared'
+        && ds.remoteCloseState.requestId === durableClose.requestId;
+    const matchingRuntimeAbortRestoreProof = durableClose?.phase === 'preparing'
+        && ds?.remoteCloseState?.phase === 'abort_restored'
+        && ds.remoteCloseState.requestId === durableClose.requestId;
+    const hasLiveWorker = !!ds?.worker && !ds.worker.killed;
+    if (ds && matchingRuntimePreparedProof && !hasLiveWorker) {
+        // Workerless cancellation is irreversible too. If publishing `prepared`
+        // failed after the CLI proved cancellation, retain the in-memory proof and
+        // let a retry publish that SAME proof before committing the row. Never issue
+        // a second cancel merely because the first durable write failed.
+        try {
+            const committed = sessionStore.markMojoClosePrepared(session.sessionId, ds.remoteCloseState.requestId, ds.remoteCloseState.taskId, ds.remoteCloseState.localResidual);
+            session.mojoCloseJournal = committed.mojoCloseJournal;
+            session.riffParentTaskId = committed.riffParentTaskId;
+            return {
+                ok: true,
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+                ...(parked
+                    ? { residual: parked }
+                    : residualField(liveLocalResidual(session.sessionId, ds.remoteCloseState.localResidual))),
+            };
+        }
+        catch (err) {
+            logger.error(`[${tag(ds)}] Workerless Mojo close proof could not be persisted for durable commit: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            };
+        }
+    }
+    if (ds && matchingRuntimeAbortRestoreProof && !hasLiveWorker) {
+        // No worker admission changed on this path, but the durable intent must be
+        // cleared before another cancel attempt is allowed. A failed clear keeps the
+        // central admission fence aligned with disk.
+        try {
+            const restoredState = ds.remoteCloseState;
+            const committed = sessionStore.finishMojoCloseAbort(session.sessionId, restoredState.requestId, {
+                admissionRestored: true,
+                ...(restoredState.taskId ? { taskId: restoredState.taskId } : {}),
+            });
+            session.mojoCloseJournal = committed.mojoCloseJournal;
+            session.riffParentTaskId = committed.riffParentTaskId;
+            ds.remoteCloseState = undefined;
+            durableClose = undefined;
+        }
+        catch (err) {
+            logger.error(`[${tag(ds)}] Workerless Mojo abort proof could not clear the durable close journal: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                ...(ds.remoteCloseState.taskId ? { taskId: ds.remoteCloseState.taskId } : {}),
+            };
+        }
+    }
+    const livePreparedProof = matchingRuntimePreparedProof
+        && !!ds.worker
+        && !ds.worker.killed;
+    const liveAbortRestoreProof = matchingRuntimeAbortRestoreProof
+        && !!ds.worker
+        && !ds.worker.killed;
+    if (durableClose && !livePreparedProof && !liveAbortRestoreProof) {
+        const journalLineage = durableClose.taskId ?? remoteId;
+        // The RECONCILIATION EXIT this journal has always promised (types.ts:
+        // "pending explicit reconciliation"). Before it existed, every journal
+        // without a matching runtime proof was refused here forever: restore
+        // downgraded crashed closes to `uncertain` and quarantined the row
+        // unregistered, this branch then refused each /close as
+        // reconciliation_required, and CLI-mismatch cleanup re-quarantined it —
+        // a permanent brick whose remote session kept credentials, fixable only
+        // by hand-editing JSON state (P1-1). Two journal shapes are reconcilable
+        // by an EXPLICIT close:
+        //   * `uncertain` — no retry can classify the crashed cancel without a
+        //     remote status oracle, so the row DRAINS: it closes with the lineage
+        //     parked as an explicit residual (same isolation-over-deletion shape
+        //     as a quarantined lineage — cleanup is remote, the id is preserved,
+        //     and replays keep reporting it).
+        //   * `preparing` + recovery 'retryable' — the failed prepare durably
+        //     recorded that retrying the cancel is legitimate (P1-2). With a
+        //     registered owner the close falls through and re-runs the cancel
+        //     under a fresh requestId (beginMojoCloseJournal accepts the restart);
+        //     without one there is nothing to cancel through, so it drains like
+        //     `uncertain`.
+        const retryableJournal = durableClose.phase === 'preparing'
+            && durableClose.recovery === 'retryable';
+        // NEVER drain past a live worker (P0-new). Draining set the row closed and
+        // deleted the registry entry while killWorker's remote guard (P0-2) refused
+        // the request-less retirement — the still-running, credential-carrying mojo
+        // worker became unreachable by every entry point. A live worker is also the
+        // one owner that can produce FRESH evidence, so it falls through to
+        // prepare/commit below instead: beginMojoCloseJournal accepts the takeover
+        // of an uncertain/retryable journal under the new requestId, the worker
+        // re-runs destroySession, and killWorker retires it legally with the commit
+        // requestId. (An in-process runtime `uncertain` fence still refuses inside
+        // prepareLiveRemoteWorkerClose — deliberately; refusal keeps the worker
+        // reachable, which is exactly what the drain violated.)
+        const drainable = !hasLiveWorker
+            && (durableClose.phase === 'uncertain' || (retryableJournal && !ds));
+        if (drainable) {
+            logger.warn(`[${session.sessionId.slice(0, 8)}] explicit close drains ${durableClose.phase} Mojo `
+                + `journal (${durableClose.requestId}): the row closes`
+                + (journalLineage
+                    ? ` and lineage ${journalLineage} is parked as a residual for manual cleanup`
+                    : ' with no lineage to park'));
+            if (!journalLineage)
+                return parked ? { ok: true, residual: parked } : { ok: true };
+            return {
+                ok: true,
+                residual: parked ?? { reason: 'mojo_lineage_quarantined', taskId: journalLineage },
+                parkMojoLineage: journalLineage,
+            };
+        }
+        const liveWorkerReconciles = hasLiveWorker
+            && (durableClose.phase === 'uncertain' || retryableJournal);
+        if (!retryableJournal && !liveWorkerReconciles) {
+            logger.warn(`[${session.sessionId.slice(0, 8)}] explicit close requires Mojo reconciliation: `
+                + `durable journal is ${durableClose.phase} (${durableClose.requestId})`);
+            return {
+                ok: false,
+                error: 'mojo_close_reconciliation_required',
+                retryable: true,
+                ...(journalLineage ? { taskId: journalLineage } : {}),
+            };
+        }
+        // Fall through: a retryable journal with a registered owner re-runs the
+        // cancel (live worker → prepare/commit; workerless → the cancel below),
+        // and an uncertain journal with a LIVE worker goes to prepare/commit.
+    }
+    // A live worker is the only authority that can cover the pre-init window:
+    // destroySession waits for system/init, then returns the exact lineage in its
+    // close_result. This must run even when the durable row has no id yet.
+    if (ds?.worker && !ds.worker.killed) {
+        if (!stored || stored.status !== 'active') {
+            return {
+                ok: false,
+                error: 'mojo_close_identity_missing',
+                retryable: true,
+                ...(remoteId ? { taskId: remoteId } : {}),
+            };
+        }
+        return prepareLiveRemoteWorkerClose(ds, 'mojo');
+    }
+    // Nothing ACTIVE to cancel: either a clean row, or a parked-only one.
+    if (!remoteId)
+        return parked ? { ok: true, residual: parked } : { ok: true };
+    if (!ds) {
+        // An open durable row carrying a lineage, with no owner in the active
+        // registry. Everything the cancel needs (frozen identity, launch identity)
+        // hangs off DaemonSession, so this cannot be cancelled from here — and
+        // silently publishing it as closed would be the same lie as before, just
+        // through a different door. Fail closed; a restore/adopt puts the owner back
+        // and makes the retry work.
+        logger.warn(`[${session.sessionId.slice(0, 8)}] explicit close refused: mojo lineage ${remoteId} `
+            + 'has no active owner to cancel through; row stays open');
+        return { ok: false, error: 'mojo_close_identity_missing', retryable: true, taskId: remoteId };
+    }
+    const resolved = resolveMojoCancelLaunch(ds, remoteId, 'explicit close');
+    if (!resolved.ok) {
+        if (resolved.reason === 'bot_gone') {
+            // NOT permanent: re-registering the bot restores the config this needs, so
+            // this is retryable and must not close the row behind the operator's back.
+            return { ok: false, error: 'mojo_config_missing', retryable: true, taskId: remoteId };
+        }
+        // Quarantined: cancelling could reach a different tenant, and no retry can
+        // ever make an unverifiable control plane verifiable. Refusing forever would
+        // strand the row, so the close proceeds — but as an EXPLICIT residual, never
+        // as an ordinary success, and the lineage stays on the row for manual cleanup.
+        //
+        // The id is PARKED as part of the durable close (see parkMojoLineage), which is
+        // what makes the decision replayable: a second close reads it back out of the
+        // parked slot instead of tripping over an active lineage with no owner.
+        return {
+            ok: true,
+            residual: parked ?? { reason: 'mojo_lineage_quarantined', taskId: remoteId },
+            parkMojoLineage: remoteId,
         };
     }
-    if (!taskId)
-        return { ok: true };
-    let riffConfig;
-    const larkAppId = ds?.larkAppId ?? session.larkAppId;
+    const requestId = randomUUID();
     try {
-        if (larkAppId)
-            riffConfig = getBot(larkAppId).config.riff;
+        const committed = sessionStore.beginMojoCloseJournal(session.sessionId, requestId, remoteId);
+        session.mojoCloseJournal = committed.mojoCloseJournal;
+        session.riffParentTaskId = committed.riffParentTaskId;
     }
-    catch { /* bot removed */ }
-    const cleanup = await cleanupExplicitSessionBacking({
-        sessionId: session.sessionId,
-        backendType,
-        riffParentTaskId: taskId,
-        riffConfig,
-    });
-    const closeLabel = ds ? tag(ds) : session.sessionId.slice(0, 8);
-    if (!cleanup.ok) {
-        logger.warn(`[${closeLabel}] explicit close refused: ${cleanup.kind}; `
-            + `Riff task ${taskId} remains active and retryable`);
+    catch (err) {
+        logger.error(`[${tag(ds)}] Workerless Mojo close journal could not be persisted before cancellation: `
+            + `${err instanceof Error ? err.message : String(err)}`);
         return {
             ok: false,
-            error: cleanup.kind === 'riff_config_missing' ? 'riff_config_missing' : 'riff_cancel_failed',
+            error: 'mojo_durable_close_failed',
             retryable: true,
-            taskId,
+            taskId: remoteId,
         };
     }
-    if (cleanup.kind !== 'cancelled_riff')
-        return { ok: true };
-    const latest = sessionStore.getSession(session.sessionId);
-    const latestTaskId = latest?.riffParentTaskId;
-    const runtimeTaskId = ds?.session.riffParentTaskId;
-    if (!latest || latest.status !== 'active' || latestTaskId !== cleanup.taskId
-        || (ds && runtimeTaskId !== cleanup.taskId)) {
-        logger.warn(`[${closeLabel}] explicit close cancelled stale Riff task ${cleanup.taskId}, `
-            + `but runtime/durable lineage or status changed to `
-            + `${runtimeTaskId ?? 'none'}/${latestTaskId ?? 'none'}/${latest?.status ?? 'missing'}; retry required`);
+    ds.remoteCloseState = { phase: 'preparing', requestId, taskId: remoteId };
+    const outcome = await cancelMojoSessionById(resolved.launchCfg, remoteId).catch((err) => ({
+        kind: 'failed',
+        message: err instanceof Error ? err.message : String(err),
+        retryable: true,
+    }));
+    // Structured, NOT a boolean: `if (!outcome)` on an object is always false and
+    // would turn every failure into a silent success. `already_terminal` counts as
+    // gone, but only when the classifier could PROVE it (see MojoCancelOutcome).
+    if (!isMojoRemoteGone(outcome)) {
+        try {
+            const committed = sessionStore.finishMojoCloseAbort(session.sessionId, requestId, { admissionRestored: true, taskId: remoteId });
+            session.mojoCloseJournal = committed.mojoCloseJournal;
+            session.riffParentTaskId = committed.riffParentTaskId;
+            ds.remoteCloseState = undefined;
+        }
+        catch (err) {
+            // There was no live worker admission to restore, but accepting input while
+            // disk still says `preparing` would recreate the same split-brain. Retain
+            // an abort-restored runtime proof so a retry clears the journal first.
+            ds.remoteCloseState = { phase: 'abort_restored', requestId, taskId: remoteId };
+            logger.error(`[${tag(ds)}] Workerless Mojo close abort could not be committed durably: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+            return {
+                ok: false,
+                error: 'mojo_durable_close_failed',
+                retryable: true,
+                taskId: remoteId,
+            };
+        }
+        logger.warn(`[${tag(ds)}] explicit close refused: mojo session ${remoteId} could not be `
+            + 'cancelled; the row stays open and the lineage is retained so the close is retryable'
+            + (outcome.kind === 'failed' ? ` (${outcome.message})` : ''));
+        return { ok: false, error: 'mojo_cancel_failed', retryable: true, taskId: remoteId };
+    }
+    // The workerless local-subtree proof travels ON the outcome (see
+    // cancelMojoSessionById): a weak-only proof keeps its containment handle, and
+    // this close must say so — durably, so retries and restarts republish it.
+    const localResidual = outcome.kind !== 'failed' ? outcome.localResidual : undefined;
+    try {
+        const committed = sessionStore.markMojoClosePrepared(session.sessionId, requestId, remoteId, localResidual);
+        session.mojoCloseJournal = committed.mojoCloseJournal;
+        session.riffParentTaskId = committed.riffParentTaskId;
+    }
+    catch (err) {
+        // Cancellation is proven and cannot be rolled back. Keep the runtime proof
+        // prepared so the same daemon can publish it on retry; after a crash the
+        // durable `preparing` journal remains fenced for explicit reconciliation.
+        ds.remoteCloseState = {
+            phase: 'prepared',
+            requestId,
+            taskId: remoteId,
+            ...(localResidual ? { localResidual } : {}),
+        };
+        logger.error(`[${tag(ds)}] Workerless Mojo close proof persistence failed after cancellation: `
+            + `${err instanceof Error ? err.message : String(err)}`);
         return {
             ok: false,
-            error: 'riff_task_changed',
+            error: 'mojo_durable_close_failed',
             retryable: true,
-            taskId: latestTaskId ?? runtimeTaskId ?? cleanup.taskId,
+            taskId: remoteId,
         };
     }
-    logger.info(`[${closeLabel}] Riff task ${cleanup.taskId} cancellation prepared for explicit close`);
-    return { ok: true, taskId: cleanup.taskId };
+    ds.remoteCloseState = {
+        phase: 'prepared',
+        requestId,
+        taskId: remoteId,
+        ...(localResidual ? { localResidual } : {}),
+    };
+    // Deliberately does NOT clear the runtime lineage here. sessionStore commonly
+    // holds the very same Session object, so an early clear is visible to the durable
+    // save — and if that save then fails, the rollback has already lost the id it
+    // would restore while the on-disk row may still carry it. The lineage is cleared
+    // atomically with the status change instead (clearRiffParentTaskId), and the
+    // repeat-cancel is suppressed with an explicit flag rather than by mutating
+    // shared state early.
+    logger.info(`[${tag(ds)}] mojo session ${remoteId} cancelled for explicit close`);
+    // Workerless twin of MojoBackend.destroySession()'s reap: the close verdict
+    // above is already decided, so a reaping failure only leaks an idle daemon
+    // (logged inside), never fails the close. Host-mode gating lives inside the
+    // helper via the isolated dir's existence — a cloud session never created one.
+    void cleanupMojoIsolatedWorkspace(session.sessionId).catch(() => undefined);
+    // Cancelling the ACTIVE lineage says nothing about a previously parked one: a row
+    // can carry both (restore parked the old id, the session then created a new one).
+    // Reporting a plain success here would hide the parked remote session entirely.
+    // With nothing parked, the LOCAL residual takes the slot for the same reason.
+    return {
+        ok: true,
+        taskId: remoteId,
+        ...(parked
+            ? { residual: parked }
+            : localResidual
+                ? { residual: { reason: localResidual } }
+                : {}),
+    };
+}
+/**
+ * The residual a row carries because a lineage was PARKED as unverifiable.
+ *
+ * Read from the parked slot, never from the active one: restore-time quarantine
+ * moves the id into `mojoQuarantinedLineage` and clears `riffParentTaskId`, so a
+ * check against the active slot misses the production shape completely — the row
+ * would close as an ordinary success while its remote session kept running.
+ *
+ * May hold more than one id (comma-joined) when two unverifiable lineages were
+ * parked together; it is passed through verbatim so manual cleanup sees both.
+ */
+export function mojoCloseResidualForRow(session) {
+    // A parked REMOTE lineage outranks a local residual: it names a live remote
+    // session burning cloud time, the more urgent cleanup, and the response has a
+    // single residual slot. The local residual surfaces whenever nothing is parked.
+    const parked = session?.mojoQuarantinedLineage;
+    if (parked)
+        return { reason: 'mojo_lineage_quarantined', taskId: parked };
+    if (session?.mojoLocalResidual)
+        return liveLocalResidual(session.sessionId, session.mojoLocalResidual);
+    return undefined;
+}
+/**
+ * Surface a stored LOCAL residual only while its containment handle is still
+ * outstanding.
+ *
+ * The containment-handle ledger is the SOURCE OF TRUTH for the device-isolation
+ * blocker; `Session.mojoLocalResidual` (and a journal's `localResidual`) are
+ * DERIVED display state with deliberately no clear path of their own: the two
+ * paths that discharge a handle — boot reconciliation and operator revoke —
+ * operate on the one global ledger, and having them also rewrite session rows
+ * would tie a global cleanup to whichever bots' per-bot row files happen to be
+ * loaded at the time. Deriving at read time keeps the two stores fork-free: the
+ * handle is gone → the "credentialed process may remain on this host" claim is
+ * no longer true, report nothing; the ledger cannot be read → we cannot rule the
+ * claim out, keep reporting it (fail-closed, matching hasUnprovenContainment's
+ * own contract of throwing rather than answering false).
+ */
+/** Spread helper: `{ residual }` when present, `{}` otherwise. */
+function residualField(residual) {
+    return residual ? { residual } : {};
+}
+function liveLocalResidual(sessionId, residual) {
+    if (!residual)
+        return undefined;
+    try {
+        if (!hasUnprovenContainment(sessionId))
+            return undefined;
+    }
+    catch {
+        // Unreadable ledger: a handle may exist, so the residual stays reported.
+    }
+    return { reason: residual };
 }
 /**
  * Reclaim a session's parked crash-diagnostic shell (`bmx-diag-<sid>`) and its
@@ -2477,8 +4093,14 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
     // probes. See sweepIdleWorkers + restoreActiveSessions.
     ds.hasHistory = true;
     ds.session.suspendedColdResume = true;
+    // P1-13：suspend 会销毁 CLI 与其子进程，那一代 dev server 随之消失（端口号交还
+    // 内核）。会话本身还活着，所以不会走 close 路径——预览必须在这里同步失效，否则
+    // 「休眠中」的会话卡片仍然挂着一条指向空端口/别人进程的预览入口。
+    const suspendedPreviewTarget = takeSessionPreviewTarget(ds.session);
     sessionStore.updateSessionPid(ds.session.sessionId, null);
     sessionStore.updateSession(ds.session);
+    if (suspendedPreviewTarget !== undefined)
+        publishSessionPreviewCleared(ds.session.sessionId);
     if (!ds.exitEventEmitted) {
         ds.exitEventEmitted = true;
         dashboardEventBus.publish({
@@ -2774,19 +4396,64 @@ function teardownAuthoritativePersistentBackingBeforeCloseImpl(target, closeWins
 export function teardownAuthoritativePersistentBackingBeforeClose(target) {
     teardownAuthoritativePersistentBackingBeforeCloseImpl(target, false);
 }
+/**
+ * Close from a BACKGROUND path — one with no user surface to report to
+ * (trigger-session cleanup, deferred-schedule settlement, sweeps).
+ *
+ * These callers cannot show a card or a toast, so the only honest thing they can
+ * do with a residual or a refusal is make it OBSERVABLE: an uncancelled remote
+ * session is still burning cloud time and holding an injected credential, and
+ * silently discarding the result is how that became invisible everywhere else.
+ *
+ * Returns the untouched result so a caller that DOES care can still branch.
+ */
+export async function closeSessionForBackgroundCleanup(sessionId, context) {
+    const result = await closeSession(sessionId);
+    const tagId = sessionId.slice(0, 8);
+    if (!result.ok) {
+        logger.error(`[${tagId}] ${context}: close REFUSED (${result.error}); the row stays active `
+            + 'and its remote session may still be running'
+            + (result.taskId ? ` (remote ${result.taskId})` : ''));
+        return result;
+    }
+    if (result.outcome === 'closed_with_residual') {
+        // Kind-aware: a LOCAL-subtree residual has no taskId, so the old wording
+        // logged "remote session undefined was NOT cancelled" and pointed cleanup at
+        // a nonexistent remote session instead of the host process (round-11 P1-2).
+        logger.warn(`[${tagId}] ${context}: closed locally — ${closeResidualClause(result.residual)} `
+            + `(${result.residual.reason})`);
+    }
+    return result;
+}
 export async function closeSession(sessionId) {
     const ds = findActiveBySessionId(sessionId);
     const stored = sessionStore.getOwnedSession(sessionId);
+    const closeFrozenBackendType = ds?.initConfig?.backendType
+        ?? ds?.session.backendType ?? stored?.backendType;
+    const isOwnedClose = !ds?.initConfig?.adoptMode
+        && !ds?.adoptedFrom
+        && !stored?.adoptedFrom;
+    const isOwnedRiffClose = isOwnedClose && closeFrozenBackendType === 'riff';
+    const isOwnedMojoClose = isOwnedClose && closeFrozenBackendType === 'mojo';
+    const closeJournal = ds?.session.mojoCloseJournal ?? stored?.mojoCloseJournal;
+    if (closeJournal && !isOwnedMojoClose) {
+        // Never let a Mojo cancellation journal silently disappear through another
+        // backend's ordinary close path. It may be corrupt metadata, but only an
+        // explicit reconciliation/repair may remove that fence.
+        return {
+            ok: false,
+            alreadyClosed: false,
+            error: 'mojo_close_reconciliation_required',
+            retryable: true,
+            ...(closeJournal.taskId ? { taskId: closeJournal.taskId } : {}),
+        };
+    }
     // Prove fail-closed ZMX teardown before any registry/store mutation. Repo
     // replacement paths reuse the same helper before their own state transition.
     const teardownTarget = ds ?? stored;
     if (teardownTarget) {
         teardownAuthoritativePersistentBackingBeforeCloseImpl(teardownTarget, true);
     }
-    const isOwnedRiffClose = !ds?.initConfig?.adoptMode
-        && !ds?.adoptedFrom
-        && !stored?.adoptedFrom
-        && (ds?.initConfig?.backendType ?? ds?.session.backendType ?? stored?.backendType) === 'riff';
     let killedLive = false;
     const hadLiveWorker = !!ds?.worker && !ds.worker.killed;
     const closeWorkerGeneration = ds ? closeFenceGeneration(ds) : undefined;
@@ -2794,6 +4461,11 @@ export async function closeSession(sessionId) {
     // sessionStore commonly holds the very same Session reference as `ds`.
     const known = !!ds || !!stored;
     const wasOpen = !!stored && stored.status !== 'closed';
+    // P1-13：关闭必须显式广播 `preview: null`。sessionStore.closeSession 会把字段从磁盘
+    // 上抹掉，但没有事件——浏览器侧只会收到 `session.exited`，会话卡片上的预览入口就
+    // 那么留着，Dashboard 的 preview SSE/WS 也拿不到断流信号。
+    const hadPreviewTarget = ds?.session.previewTarget !== undefined
+        || stored?.previewTarget !== undefined;
     const storedHadDocCommentTargets = Object.keys(stored?.docCommentTargets ?? {}).length > 0;
     const docReactionTargets = collectDocCommentReactionTargets(ds, stored);
     if (ds) {
@@ -2801,17 +4473,27 @@ export async function closeSession(sessionId) {
         // crash/limited turn may never have reached an idle edge).
         recordUsageForDaemonSession(ds);
     }
-    // Riff owns a remote credential-bearing process. Prove cancellation before
-    // mutating routing, transient capabilities, or the durable row. Non-Riff
-    // closes retain master's synchronous state-transition path.
+    // Riff and mojo both own a remote, credential-bearing session. Prove
+    // cancellation before mutating routing, transient capabilities, or the durable
+    // row — publishing "closed" while the cancel is still in flight is how a failed
+    // cancel became a silent leak. Other backends retain master's synchronous
+    // state-transition path.
     const prepared = isOwnedRiffClose
         ? await prepareRiffExplicitClose(ds, stored)
-        : { ok: true };
+        : isOwnedMojoClose
+            ? await prepareMojoExplicitClose(ds, stored)
+            : { ok: true };
     if (!prepared.ok) {
         return { ...prepared, alreadyClosed: false };
     }
-    const preparedRiffRequestId = ds?.riffCloseState?.phase === 'prepared'
-        ? ds.riffCloseState.requestId
+    // Only when the cancel actually happened: a quarantined / bot-gone mojo session
+    // keeps its lineage on the row for manual cleanup.
+    const clearMojoLineage = isOwnedMojoClose && !!prepared.taskId;
+    // NOTE: the residual is derived from the COMMITTED row at the end of this
+    // function, not captured here — the store merges parked ids, so a value computed
+    // before the transaction can disagree with what was actually persisted.
+    const preparedRemoteRequestId = ds?.remoteCloseState?.phase === 'prepared'
+        ? ds.remoteCloseState.requestId
         : undefined;
     // 会话关闭即可回收其崩溃重启计数；否则每个曾崩溃过的 session 会在 daemon
     // 生命周期内永久占位（restartCounts 此前无任何 delete）。
@@ -2831,16 +4513,42 @@ export async function closeSession(sessionId) {
         if (!ds && stored && !isOwnedRiffClose)
             destroyUnregisteredPersistentBacking(stored);
         try {
+            // Parking is handed to the store as part of ITS transaction rather than
+            // pre-written here: the runtime object is not always the authoritative row,
+            // and a pre-write survives a failed save (the store's rollback cannot restore
+            // a field it never set). Same mistake as the early lineage clear fixed
+            // earlier — one layer up.
             sessionStore.closeSession(sessionId, {
                 cleanupBridgeMarkers: !hadLiveWorker,
-                ...(isOwnedRiffClose ? { clearRiffParentTaskId: true } : {}),
+                ...(prepared.parkMojoLineage ? { parkMojoLineage: prepared.parkMojoLineage } : {}),
+                // Park a LOCAL residual so an idempotent re-close still reports it — the
+                // journal (its runtime home) is wiped by this same transaction.
+                ...(prepared.residual
+                    && prepared.residual.reason !== 'mojo_lineage_quarantined'
+                    ? { parkLocalResidual: prepared.residual.reason }
+                    : {}),
+                ...(isOwnedRiffClose || clearMojoLineage || prepared.parkMojoLineage
+                    ? { clearRiffParentTaskId: true }
+                    : {}),
             });
         }
         catch (err) {
+            if (isOwnedMojoClose
+                && (preparedRemoteRequestId || stored?.mojoCloseJournal?.phase === 'prepared')) {
+                logger.error(`[${sessionId.slice(0, 8)}] Durable session close failed after Mojo cancel; `
+                    + `retaining prepared commit: ${err instanceof Error ? err.message : String(err)}`);
+                return {
+                    ok: false,
+                    alreadyClosed: false,
+                    error: 'mojo_durable_close_failed',
+                    retryable: true,
+                    ...(prepared.taskId ? { taskId: prepared.taskId } : {}),
+                };
+            }
             if (!isOwnedRiffClose)
                 throw err;
-            if (ds && preparedRiffRequestId) {
-                await abortLiveRiffWorkerClose(ds, preparedRiffRequestId);
+            if (ds && preparedRemoteRequestId) {
+                await abortLiveRemoteWorkerClose(ds, preparedRemoteRequestId);
             }
             logger.error(`[${sessionId.slice(0, 8)}] Durable session close failed after Riff prepare; `
                 + `worker admission restored: ${err instanceof Error ? err.message : String(err)}`);
@@ -2856,11 +4564,32 @@ export async function closeSession(sessionId) {
         if (ds) {
             ds.session.status = 'closed';
             ds.session.closedAt = after?.closedAt ?? ds.session.closedAt;
+            // 活对象与 store 里的行未必是同一个引用；durable close 只清了后者。
+            takeSessionPreviewTarget(ds.session);
+            // Sync the parking back from the store's committed row. Only reached after a
+            // SUCCESSFUL save, and skipped when the two are the same object anyway, so
+            // the runtime view cannot end up carrying a park the disk does not have.
+            if (after && after !== ds.session) {
+                ds.session.mojoCloseJournal = after.mojoCloseJournal;
+                if (clearMojoLineage || prepared.parkMojoLineage) {
+                    ds.session.riffParentTaskId = after.riffParentTaskId;
+                }
+            }
+            if (prepared.parkMojoLineage && after && after !== ds.session) {
+                ds.session.mojoQuarantinedLineage = after.mojoQuarantinedLineage;
+                ds.session.mojoQuarantineNoticePending = after.mojoQuarantineNoticePending;
+            }
         }
+        if (hadPreviewTarget)
+            publishSessionPreviewCleared(sessionId);
     }
     if (ds) {
+        disposeOrdinaryTurnRecovery(ds.session);
         killWorker(ds, {
-            ...(preparedRiffRequestId ? { riffCloseCommitRequestId: preparedRiffRequestId } : {}),
+            ...(preparedRemoteRequestId ? { remoteCloseCommitRequestId: preparedRemoteRequestId } : {}),
+            // The prepare above already proved this cancel; the durable row cleared the
+            // lineage in the same transaction. Suppress the best-effort repeat.
+            ...(clearMojoLineage ? { mojoCancelAlreadyProven: true } : {}),
         });
         // A transferred/restored exact object may remain under more than one alias.
         // Remove only identity matches, never a same-key successor.
@@ -2950,7 +4679,26 @@ export async function closeSession(sessionId) {
     }
     // alreadyClosed = nothing happened on either path.
     const alreadyClosed = !killedLive && !wasOpen;
-    return { ok: true, alreadyClosed, known };
+    // The local row IS closed, but a remote session was deliberately left running
+    // (its control plane could not be verified, so cancelling it might have hit
+    // another tenant). Callers must render this differently from an ordinary close.
+    // Read the residual back off the authoritative row so it always matches disk
+    // (including the merge when a second id was parked). `prepared.residual` is only
+    // a fallback for the paths that never reached the store.
+    const closeResidual = isOwnedMojoClose
+        ? (mojoCloseResidualForRow(sessionStore.getOwnedSession(sessionId) ?? stored ?? ds?.session)
+            ?? prepared.residual)
+        : undefined;
+    if (closeResidual) {
+        return {
+            ok: true,
+            outcome: 'closed_with_residual',
+            residual: closeResidual,
+            alreadyClosed,
+            known,
+        };
+    }
+    return { ok: true, outcome: 'closed', alreadyClosed, known };
 }
 /**
  * Close can arrive through daemon IPC before startup restore has registered the
@@ -3029,7 +4777,34 @@ async function closeUnregisteredCollisionLoser(map, loser) {
             + `${err instanceof Error ? err.message : String(err)}`);
         return { ok: false, error: 'durable_close_failed' };
     }
-    killWorker(loser);
+    // The registry entry is deleted right below, so the loser's worker must be
+    // put on a guaranteed path to death here. killWorker refuses an unprepared
+    // live remote worker (P0-2) — correct for lineage, but on this path the
+    // refusal recreated the P0-new orphan: row closed, registry cleared,
+    // credential-carrying worker alive and unreachable. A remote loser is
+    // therefore retired process-only: SIGTERM now, SIGKILL by backstop. To be
+    // precise about the claim (fourth-round review): this SIGNALS death and arms
+    // the escalation — it does not synchronously prove the exit. That is
+    // acceptable here because nothing downstream gates on this process being
+    // gone (unlike the VC fence, which separately demands exit proof before
+    // admitting replay); the registry delete below is safe either way.
+    //
+    // No remote cancel is issued: the lineage stays on the CLOSED row
+    // (riffParentTaskId) as the manual-cleanup handle, mirroring the drain's
+    // isolation-over-deletion shape — named in the log below so an operator can
+    // actually find it. Local losers keep killWorker so their backing session
+    // is destroyed.
+    if (isRemoteBackendSession(loser)) {
+        if (loser.session.riffParentTaskId) {
+            logger.warn(`[${tag(loser)}] collision loser owns remote lineage `
+                + `${loser.session.riffParentTaskId}; it is NOT cancelled and stays on the closed `
+                + 'row for manual cleanup');
+        }
+        retireWorkerProcessOnly(loser, 'collision_loser');
+    }
+    else {
+        killWorker(loser);
+    }
     for (const [registeredKey, candidate] of map) {
         if (candidate === loser)
             map.delete(registeredKey);
@@ -3274,6 +5049,10 @@ function failOrdinaryImDelivery(record, reason) {
     logger.error(`[${tag(record.ds)}] Ordinary IM worker delivery failed `
         + `turn=${record.turnId.substring(0, 16)} generation=${record.workerGeneration} `
         + `attempts=${record.attempt} reason=${reason}`);
+    if (record.turnId.startsWith('bmx-recovery-')) {
+        requireOrdinaryTurnRecoveryAttention(record.ds.session, record.turnId, 'recovery_delivery_failed');
+        return;
+    }
     if (record.ds.session.vcMeetingReceiver || isSilentScheduledTurn(record.ds, record.turnId))
         return;
     const loc = botLocale(getBot(record.ds.larkAppId).config);
@@ -3360,7 +5139,8 @@ function sendOrdinaryImDeliveryTracked(ds, message) {
     return sendOrdinaryImDeliveryAttempt(record);
 }
 function shouldTrackOrdinaryImDelivery(ds, message) {
-    return !!message.turnId?.startsWith('om_')
+    return !!message.turnId
+        && (message.turnId.startsWith('om_') || message.turnId.startsWith('bmx-recovery-'))
         && message.dispatchAttempt === undefined
         && (message.type !== 'init' || (!!message.prompt && !message.adoptMode))
         && !ds.adoptedFrom
@@ -3943,6 +5723,7 @@ targetScope, opts) {
         ds.streamCardId = undefined;
         ds.streamCardNonce = undefined;
         ds.currentImageKey = undefined;
+        rehomeReplyTargetState(ds);
         sessionStore.updateSession(ds.session);
         const newAnchor = sessionAnchorId(ds);
         if (activeSessionsRegistry) {
@@ -4011,13 +5792,13 @@ targetScope, opts) {
 }
 /** Backends whose conversation state is a local, copyable transcript file and
  *  whose CLI exposes a native "fork/branch this session" primitive that botmux
- *  can drive at cold spawn (Claude family: `--fork-session`; Codex terminal:
+ *  can drive at cold spawn (Claude family / Grok: `--fork-session`; Codex terminal:
  *  `codex fork <id>`). App-server backends (codex-app, or a codex CLI running in
  *  Hybrid RPC mode) keep state in a live app-server process + SQLite and have no
  *  byte-level fork we can reproduce — they are refused. Riff / other pure-remote
  *  backends have no local rollout to fork either. */
 const FORK_CAPABLE_CLI_IDS = new Set([
-    'claude-code', 'seed', 'relay', 'codex',
+    'claude-code', 'seed', 'relay', 'codex', 'grok',
 ]);
 /** True when this session can be byte-level forked via a CLI-native primitive.
  *  Refuses codex-app outright, and refuses a plain `codex` session that is
@@ -4164,12 +5945,19 @@ export async function forkSession(sessionId, targetChatId, targetRootMessageId,
     //     (bwrap credential seal — bots.json deny / sibling appsecrets /
     //     master.key / network deny — silently dropped). This is a security
     //     escape, so copy the recorded decision and its path lists verbatim.
-    //   • model / reasoningEffort / cliPathOverride / wrapperCli / agentFrozen:
+    //   • reasoningEffort / cliPathOverride / wrapperCli / agentFrozen:
     //     without these the child's sessionAgentConfig() sees !agentFrozen and
     //     re-freezes from the CURRENT bot config, silently dropping any per-session
-    //     model or effort override the source carried (reasoningEffort has no
-    //     botCfg fallback at all → drops to undefined). Copying the frozen tuple
-    //     keeps the clone's launch identity == the source's.
+    //     /effort override the source carried (reasoningEffort has no botCfg
+    //     fallback at all → drops to undefined). Copying the frozen tuple keeps
+    //     the clone's launch identity == the source's. `model` is no longer a
+    //     FROZEN value — it resolves from the live bot config at every spawn — but
+    //     the record of what the source last launched with still has to travel:
+    //     when the source is pinned to a CLI the bot no longer runs, that record is
+    //     the only thing keeping either session off the CLI default (rule 3 in
+    //     resolveSessionLaunchModel). Copying it cannot resurrect the old frozen
+    //     bug, because the live bot model outranks it whenever the CLIs match.
+    //     An explicit per-trigger override rides on the runtime childDs below.
     // readIsolation is intentionally NOT copied: it is not a persisted Session
     // field (forkWorker derives it from botCfg at spawn), and the child runs the
     // SAME bot, so it is preserved automatically. persistentBackendTarget is also
@@ -4180,8 +5968,8 @@ export async function forkSession(sessionId, targetChatId, targetRootMessageId,
     childSession.sandboxHidePaths = ds.session.sandboxHidePaths;
     childSession.sandboxReadonlyPaths = ds.session.sandboxReadonlyPaths;
     childSession.sandboxNetwork = ds.session.sandboxNetwork;
-    childSession.model = ds.session.model;
     childSession.reasoningEffort = ds.session.reasoningEffort;
+    childSession.model = ds.session.model;
     childSession.cliRuntime = ds.session.cliRuntime
         ? { ...ds.session.cliRuntime, update: { ...ds.session.cliRuntime.update } }
         : undefined;
@@ -4213,6 +6001,9 @@ export async function forkSession(sessionId, targetChatId, targetRootMessageId,
         streamCardNonce: undefined,
         displayMode: ds.displayMode ?? 'hidden',
         suppressRecoveryCard: false,
+        // Explicit per-trigger model override travels with the runtime session, so a
+        // fork of a trigger session launches on the same model the caller asked for.
+        ...(ds.spawnModelOverride ? { spawnModelOverride: ds.spawnModelOverride } : {}),
     };
     if (activeSessionsRegistry) {
         if (!(await setActiveSessionSafe(activeSessionsRegistry, targetKey, childDs))) {
@@ -4698,15 +6489,50 @@ function rollbackWorkerForkPreInit(ds, queuedSnapshot, acceptedDispatch) {
     if (changed)
         sessionStore.updateSession(ds.session);
 }
+/** Finish ordinary-turn recovery bookkeeping only after a fresh Lark turn has
+ * crossed its real admission boundary (durable activation tail or worker
+ * input). The user turn is already accepted at this point, so persistence
+ * failures here are logged without making the caller retry and risk a duplicate
+ * execution. */
+function recordAdmittedOrdinaryUserTurn(ds, turnId, opts) {
+    const priorRecoveryStatus = ds.session.ordinaryTurnRecovery?.status;
+    let recoveryBookkeepingSucceeded = false;
+    try {
+        if (opts.beginRecovery) {
+            const state = beginOrdinaryTurnRecovery(ds.session, turnId);
+            recoveryBookkeepingSucceeded = state?.logicalTurnId === turnId
+                && state.currentTurnId === turnId;
+        }
+        else {
+            const state = cancelOrdinaryRecoveryForUserInput(ds.session, turnId);
+            recoveryBookkeepingSucceeded = state?.status === 'cancelled'
+                && state.cancelledByTurnId === turnId;
+        }
+    }
+    catch (err) {
+        logger.error(`[${tag(ds)}] Failed to persist ordinary-turn recovery bookkeeping `
+            + `after admitting ${turnId.substring(0, 16)}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (recoveryBookkeepingSucceeded
+        && (priorRecoveryStatus === 'exhausted' || priorRecoveryStatus === 'attention_required')
+        && ds.agentAttention) {
+        ds.agentAttention = undefined;
+        publishAttentionPatch(ds);
+    }
+}
 /** Send one normal (non-raw) worker turn while applying the per-bot Codex App
  * clean-input gate at message acceptance time. This freezes the sidecar onto
  * the IPC item, so later config flips do not mutate an already queued turn. */
 export function sendWorkerInput(ds, payload, turnId, opts = {}) {
-    const riffRetirementPhase = riffRetirementAdmissionPhase(ds);
-    if (riffRetirementPhase) {
-        logger.warn(`[${tag(ds)}] Rejected turn ${turnId ?? '?'} while Riff retirement fence is ${riffRetirementPhase}`);
-        void callbacks?.sessionReply(sessionAnchorId(ds), tr('worker.riff_close_in_progress', undefined, localeForBot(ds.larkAppId)), 'text', ds.larkAppId, turnId).catch(err => {
-            logger.warn(`[${tag(ds)}] Failed to notify rejected Riff close-race turn: `
+    const remoteRetirementPhase = remoteRetirementAdmissionPhase(ds);
+    if (remoteRetirementPhase) {
+        const remoteBackend = (ds.initConfig?.backendType ?? ds.session.backendType) === 'mojo'
+            ? 'Mojo'
+            : 'Riff';
+        logger.warn(`[${tag(ds)}] Rejected turn ${turnId ?? '?'} while ${remoteBackend} retirement fence is ${remoteRetirementPhase}`);
+        void callbacks?.sessionReply(sessionAnchorId(ds), tr('worker.remote_close_in_progress', { backend: remoteBackend }, localeForBot(ds.larkAppId)), 'text', ds.larkAppId, turnId).catch(err => {
+            logger.warn(`[${tag(ds)}] Failed to notify rejected remote close-race turn: `
                 + `${err instanceof Error ? err.message : String(err)}`);
         });
         return false;
@@ -4757,6 +6583,7 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
                     // tail's frozen payload so promote/repark/restore COPY it verbatim
                     // (admission computed once; never re-inferred downstream).
                     ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
+                    ...(opts.trustedCaller ? { trustedCaller: opts.trustedCaller } : {}),
                 },
                 turnId: queuedTurnId,
                 ...(opts.dispatchAttempt !== undefined
@@ -4764,6 +6591,9 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
                     : {}),
             });
             logger.info(`[${tag(ds)}] Staged turn ${queuedTurnId} behind queued activation ACK`);
+            if (turnId?.startsWith('om_')) {
+                recordAdmittedOrdinaryUserTurn(ds, turnId, { beginRecovery: false });
+            }
             return true;
         }
         catch (err) {
@@ -4793,6 +6623,12 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
     const message = {
         type: 'message',
         content: normalized.content,
+        // A parked (crash-loop stopped) worker respawns the CLI from INSIDE the
+        // worker when this message arrives, and that path has no restart IPC to
+        // refresh its launch snapshot — so carry the current model on the message
+        // itself. Only while parked: an ordinary turn changes no launch config, and
+        // an unconditional field would be pure noise on every message.
+        ...(ds.crashDiagnosticParked ? { model: latestModelForRespawn(ds) } : {}),
         ...(codexAppInput ? { codexAppInput } : {}),
         ...(nativeSessionTitle ? { nativeSessionTitle } : {}),
         ...(nativeSessionTitlePrompt ? { nativeSessionTitlePrompt } : {}),
@@ -4802,10 +6638,15 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
         ...(codexAppDispatchId ? { codexAppDispatchId } : {}),
         ...(opts.codexAppSteerable ? { codexAppSteerable: true } : {}),
         ...(opts.atMostOnce ? { atMostOnce: true } : {}),
+        ...(opts.trustedCaller ? { trustedCaller: opts.trustedCaller } : {}),
         ...(vcMeetingImTurnOrigin
             ? { vcMeetingImTurnOrigin }
             : {}),
+        ...(mojoLivePatchForSession(ds) ?? {}),
     };
+    // First moment with a reply context after a restore/resume-time quarantine.
+    deliverPendingMojoQuarantineNotice(ds, turnId, opts.dispatchAttempt);
+    deliverPendingMojoLegacyPinNotice(ds, turnId, opts.dispatchAttempt);
     // #597: the accept-ledger entry is already appended above; if the IPC send
     // fails (returns false or throws) we MUST roll it back or the dispatch ledger
     // keeps a phantom accepted turn. master's ordinary-IM-delivery tracking runs
@@ -4826,8 +6667,199 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
         rollbackAcceptedCodexAppDispatch(ds, codexAppDispatchId, effectiveTurnId, opts.dispatchAttempt);
         return false;
     }
+    if (turnId?.startsWith('om_')) {
+        recordAdmittedOrdinaryUserTurn(ds, turnId, { beginRecovery: true });
+    }
     return true;
 }
+/**
+ * Complete live-credential snapshot to ride along with a turn, so a live mojo
+ * session picks up a rotated / cleared JWT without a refork.
+ *
+ * Sent on EVERY turn rather than only when it differs from the init snapshot. The
+ * daemon cannot know which patches a live worker has already applied, so diffing
+ * against init was wrong in both directions:
+ *   - a deleted `mojo.jwt` produced no patch, leaving the old token in place;
+ *   - `init A → patch B → config rolled back to A` compared A against A and sent
+ *     nothing, leaving the backend on B.
+ * The backend de-duplicates against its own current value, which is the only
+ * authoritative source.
+ *
+ * The control plane is NOT included — it stays frozen for the session's lifetime.
+ */
+export function mojoLivePatchForSession(ds) {
+    const backendType = ds.initConfig?.backendType ?? ds.session.backendType;
+    if (backendType !== 'mojo')
+        return undefined;
+    let botCfg;
+    try {
+        botCfg = getBot(ds.larkAppId).config;
+    }
+    catch {
+        return undefined;
+    }
+    // Resolves jwtEnv daemon-side across the same layers buildEnv() uses, so the
+    // worker receives a value and never an env map.
+    return {
+        mojoLivePatch: pickMojoLivePatch(botCfg.mojo, {
+            genericEnv: botCfg.env ? sanitizePerBotEnv(botCfg.env) : undefined,
+        }),
+    };
+}
+/**
+ * Is auxiliary UI an authorized output channel for this session/turn?
+ *
+ * The single source of truth for this policy: setupWorkerHandlers' own
+ * `managedAuxUiSuppressed` now delegates here instead of keeping a parallel copy
+ * that could drift. Deliberately conservative: a
+ * dedicated VC receiver, a silent scheduled turn, or a session with no real Lark
+ * transport must never receive a bypass message. Those cases still get the
+ * persisted quarantine state for dashboard/audit — the notice is only about the
+ * chat channel.
+ */
+/** Sessions with a quarantine notice send in flight, so it cannot double-post. */
+const mojoQuarantineNoticeInFlight = new Set();
+/**
+ * THE auxiliary-UI suppression policy. One definition, two call sites.
+ *
+ * Previously setupWorkerHandlers held this as a closure and the quarantine notice
+ * COPIED three of its four checks — dropping `ordinaryManagedSuppression`, so a
+ * durable-suppressed turn still posted to Lark. Copying a policy is how the two
+ * diverge; this is the shared implementation both now call.
+ *
+ * Returns true when auxiliary UI must be suppressed.
+ */
+export function auxUiSuppressedFor(ds, turnId, dispatchAttempt) {
+    // No-transport session (apiOnly bot or HTTP virtual chat): there is no real
+    // Feishu chat to render into.
+    try {
+        if (!larkTransportEnabled({
+            chatId: ds.chatId,
+            apiOnly: getBot(ds.larkAppId).config.apiOnly,
+        }))
+            return true;
+    }
+    catch {
+        // Bot deregistered — fail closed.
+        return true;
+    }
+    if (isSilentScheduledTurn(ds, turnId))
+        return true;
+    if (ds.session.vcMeetingReceiver)
+        return true;
+    // Durable ledger: an attempt at or below the armed watermark is a replay whose
+    // output already happened (or was deliberately suppressed).
+    const armedThrough = turnId ? ds.suppressedFinalOutputTurns?.get(turnId) : undefined;
+    return dispatchAttempt !== undefined
+        && armedThrough !== undefined
+        && dispatchAttempt <= armedThrough;
+}
+/**
+ * Deliver the one-time notice that a mojo session's earlier remote lineage was
+ * parked, then clear the flag.
+ *
+ * Quarantining happens during restore/resume where there is no reply context, so
+ * the notice is deferred to the first ACCEPTED turn — hot send and cold fork both
+ * call this, since a cold-resumed session goes straight to forkWorker and would
+ * otherwise never deliver it.
+ *
+ * The flag is marked delivered (`false`) only AFTER a successful send, so a
+ * transient Lark failure retries on the next turn instead of losing the notice
+ * permanently. For a suppressed channel (durable replay / silent schedule / VC
+ * receiver / no transport) the flag STAYS PENDING: that turn merely had no
+ * authorized output channel, so a later ordinary IM turn delivers it. The
+ * quarantine state itself is persisted for dashboard/audit either way.
+ */
+function deliverPendingMojoQuarantineNotice(ds, turnId, dispatchAttempt) {
+    if (ds.session.mojoQuarantineNoticePending !== true)
+        return;
+    // In-flight guard: two turns can be accepted before the first sessionReply
+    // resolves, which would post the notice twice.
+    if (mojoQuarantineNoticeInFlight.has(ds.session.sessionId))
+        return;
+    const lineage = ds.session.mojoQuarantinedLineage;
+    if (!lineage) {
+        ds.session.mojoQuarantineNoticePending = undefined;
+        sessionStore.updateSession(ds.session);
+        return;
+    }
+    let botCfg;
+    try {
+        botCfg = getBot(ds.larkAppId).config;
+    }
+    catch {
+        return; // Bot deregistered — retry once it is back.
+    }
+    // `false` = DELIVERED, distinct from `undefined` = never queued. Clearing to
+    // undefined made the restore migration read it as "old build, never notified"
+    // and queue the notice again after every restart.
+    const markDelivered = () => {
+        ds.session.mojoQuarantineNoticePending = false;
+        sessionStore.updateSession(ds.session);
+    };
+    if (auxUiSuppressedFor(ds, turnId, dispatchAttempt)) {
+        // Stay PENDING: this turn simply had no authorized channel (durable replay,
+        // silent schedule, VC receiver, no transport). A later ordinary IM turn
+        // delivers it. The quarantine state itself is already persisted for
+        // dashboard/audit either way.
+        logger.info(`[${tag(ds)}] mojo quarantine notice deferred — no authorized output channel `
+            + 'for this turn; still pending');
+        return;
+    }
+    mojoQuarantineNoticeInFlight.add(ds.session.sessionId);
+    const message = tr('worker.mojo_lineage_quarantined', { lineage }, botLocale(botCfg));
+    void callbacks?.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, 
+    // The turn that actually carried this delivery, not a stale reply target.
+    turnId, ds.session.vcMeetingReceiver ? { sourceSessionId: ds.session.sessionId } : undefined).then(markDelivered).catch((err) => {
+        // Flag intentionally left set: the next turn retries.
+        logger.warn(`[${tag(ds)}] failed to deliver mojo quarantine notice (will retry): ${err}`);
+    }).finally(() => {
+        mojoQuarantineNoticeInFlight.delete(ds.session.sessionId);
+    });
+}
+const mojoLegacyPinNoticeInFlight = new Set();
+/** In-chat twin of the sessionMojoConfig legacy pin's daemon-log warn: without
+ *  it the user keeps retrying a session whose tools and replies silently fail
+ *  (observed live). Same pending/delivered protocol and suppression rules as
+ *  deliverPendingMojoQuarantineNotice above. */
+function deliverPendingMojoLegacyPinNotice(ds, turnId, dispatchAttempt) {
+    if (ds.session.mojoLegacyPinNoticePending !== true)
+        return;
+    if (mojoLegacyPinNoticeInFlight.has(ds.session.sessionId))
+        return;
+    let botCfg;
+    try {
+        botCfg = getBot(ds.larkAppId).config;
+    }
+    catch {
+        return; // Bot deregistered — retry once it is back.
+    }
+    if (auxUiSuppressedFor(ds, turnId, dispatchAttempt)) {
+        logger.info(`[${tag(ds)}] mojo legacy-pin notice deferred — no authorized output channel `
+            + 'for this turn; still pending');
+        return;
+    }
+    mojoLegacyPinNoticeInFlight.add(ds.session.sessionId);
+    const message = tr('worker.mojo_legacy_pinned', {}, botLocale(botCfg));
+    void callbacks?.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, turnId, ds.session.vcMeetingReceiver ? { sourceSessionId: ds.session.sessionId } : undefined).then(() => {
+        ds.session.mojoLegacyPinNoticePending = false;
+        // Best-effort, same as the queueing side (review N2): the notice IS
+        // delivered at this point — a failed persist only risks one duplicate
+        // send after a restart, and must not surface as a delivery failure.
+        try {
+            sessionStore.updateSession(ds.session);
+        }
+        catch (err) {
+            logger.warn(`[${tag(ds)}] mojo legacy-pin notice delivered but the delivered marker could not be `
+                + `persisted (may re-send once after a restart): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }).catch((err) => {
+        // Flag intentionally left set: the next turn retries.
+        logger.warn(`[${tag(ds)}] failed to deliver mojo legacy-pin notice (will retry): ${err}`);
+    }).finally(() => {
+        mojoLegacyPinNoticeInFlight.delete(ds.session.sessionId);
+    });
+}
 /** Promote the oldest durable activation successor into a fresh tokened
  * journal and (for Codex App) its single accepted-ledger owner in one store
  * update, then hand it to the current worker. The tail is never shifted merely
@@ -4871,6 +6903,7 @@ export function promoteQueuedActivationTail(ds, opts = {}) {
         // queuedActivationInput so the ensuing fork/accept-ledger COPY (below) sees
         // it. Only `=== true`; a missing/false tail head stays forced-serial.
         ...(head.cliInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+        ...(head.cliInput.trustedCaller ? { trustedCaller: head.cliInput.trustedCaller } : {}),
     };
     const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, head.turnId);
     ds.session.queued = false;
@@ -4922,6 +6955,8 @@ export function promoteQueuedActivationTail(ds, opts = {}) {
         ds.worker.send({
             type: 'message',
             content: exactInput.content,
+            // Same parked-worker launch-snapshot refresh as the ordinary send.
+            ...(ds.crashDiagnosticParked ? { model: latestModelForRespawn(ds) } : {}),
             ...(codexAppInput ? { codexAppInput } : {}),
             turnId: head.turnId,
             ...(head.dispatchAttempt !== undefined
@@ -4933,9 +6968,13 @@ export function promoteQueuedActivationTail(ds, opts = {}) {
             // ledger head steerable=true but the worker reservation false, so a
             // legitimate superseded settlement would be wrongly rejected.
             ...(exactInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+            ...(exactInput.trustedCaller ? { trustedCaller: exactInput.trustedCaller } : {}),
             queuedActivationToken: token,
             ...(vcMeetingImTurnOrigin ? { vcMeetingImTurnOrigin } : {}),
         });
+        if (head.turnId.startsWith('om_')) {
+            recordAdmittedOrdinaryUserTurn(ds, head.turnId, { beginRecovery: true });
+        }
     }
     catch (err) {
         // Durable ownership already moved to the journal (and Codex ledger). Never
@@ -4984,6 +7023,7 @@ export function admitQueuedActivationTail(ds, entry, reservation = reserveQueued
             // (only `=== true`, never truthy). Dropping it here silently un-authorized
             // every queued/opening turn — the strip point that defeated the R4 fix.
             ...(entry.cliInput.codexAppSteerable === true ? { codexAppSteerable: true } : {}),
+            ...(entry.cliInput.trustedCaller ? { trustedCaller: entry.cliInput.trustedCaller } : {}),
         },
     };
     const priorTail = ds.session.queuedActivationTail;
@@ -5080,6 +7120,35 @@ export function resolveQuarantinedForkPlan(ds, promptInput, resumeOrTurnId) {
  */
 export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const gatedPrompt = typeof promptInput === 'string' ? { content: promptInput } : promptInput;
+    const remoteRetirementPhase = remoteRetirementAdmissionPhase(ds);
+    if (remoteRetirementPhase) {
+        // A close/shutdown coordinator owns this exact remote generation. Never
+        // spawn a replacement behind its back: a fork can materialize the opening
+        // prompt before sendWorkerInput gets a chance to reject it. Route non-empty
+        // input through the ordinary fence solely for the user-visible warning.
+        if (gatedPrompt.content !== '') {
+            const gatedTurnId = typeof resumeOrTurnId === 'string'
+                ? resumeOrTurnId
+                : typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                    ? resumeOrTurnId.turnId
+                    : undefined;
+            const gatedDispatchAttempt = typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                ? resumeOrTurnId.dispatchAttempt
+                : undefined;
+            sendWorkerInput(ds, promptInput, gatedTurnId, {
+                ...(gatedDispatchAttempt !== undefined
+                    ? { dispatchAttempt: gatedDispatchAttempt }
+                    : {}),
+                ...(gatedPrompt.codexAppSteerable === true
+                    ? { codexAppSteerable: true }
+                    : {}),
+            });
+        }
+        logger.warn(`[${tag(ds)}] Refused worker fork while remote retirement fence is ${remoteRetirementPhase}`);
+        // The request was handled by the retirement fence; false is reserved for
+        // tail-only quarantine promotion failures by this function's contract.
+        return true;
+    }
     const transferGate = transferInputGates.get(ds);
     if (transferGate && !transferReplacementForkBypass.has(ds)) {
         if (gatedPrompt.content !== '') {
@@ -5094,6 +7163,10 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             const gatedAtMostOnce = typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
                 ? resumeOrTurnId.atMostOnce
                 : undefined;
+            const gatedTrustedCaller = gatedPrompt.trustedCaller
+                ?? (typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                    ? resumeOrTurnId.trustedCaller
+                    : undefined);
             sendWorkerInput(ds, promptInput, gatedTurnId, {
                 ...(gatedDispatchAttempt !== undefined
                     ? { dispatchAttempt: gatedDispatchAttempt }
@@ -5109,6 +7182,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                 // terminalized the turn re-runs it. forkWorker's own init path sets this
                 // from resumeOrTurnId.atMostOnce; the reroute must forward it identically.
                 ...(gatedAtMostOnce ? { atMostOnce: true } : {}),
+                ...(gatedTrustedCaller ? { trustedCaller: gatedTrustedCaller } : {}),
             });
         }
         else {
@@ -5180,6 +7254,10 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     else {
         resume = resumeOrTurnId;
     }
+    const initTrustedCaller = promptPayload.trustedCaller
+        ?? (typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+            ? resumeOrTurnId.trustedCaller
+            : undefined);
     if (ds.session.queuedActivationPending && ds.session.queuedActivationResume !== undefined) {
         resume = ds.session.queuedActivationResume;
     }
@@ -5207,6 +7285,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                     // R5-B1-2: preserve the frozen steer authorization on the double-fork
                     // staged tail entry (only `=== true`).
                     ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+                    ...(initTrustedCaller ? { trustedCaller: initTrustedCaller } : {}),
                 },
                 turnId,
                 ...(initDispatchAttempt !== undefined
@@ -5225,6 +7304,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // opts too. The gate branch above already admits with the flag; this
             // sibling branch would otherwise silently downgrade true → false.
             ...(initCodexAppSteerable ? { codexAppSteerable: true } : {}),
+            ...(initTrustedCaller ? { trustedCaller: initTrustedCaller } : {}),
         });
         logger[routed ? 'info' : 'warn'](`[${tag(ds)}] ${routed ? 'Routed' : 'Failed to route'} double-fork prompt through existing durable owner`);
         return true;
@@ -5603,15 +7683,15 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
                 else {
                     reparkQueuedActivationFollowUpTail(ds, 'worker error during activation follow-up handoff');
                 }
-                const retainExactRetirementGeneration = ds.riffShutdownState !== undefined
-                    || ds.riffCloseState !== undefined;
+                const retainExactRetirementGeneration = ds.remoteShutdownState !== undefined
+                    || ds.remoteCloseState !== undefined;
                 if (!retainExactRetirementGeneration) {
                     ds.worker = null;
                     ds.workerPort = null;
                     ds.workerToken = null;
                     ds.workerViewToken = null;
                     ds.managedTurnOrigin = undefined;
-                    ds.riffCloseState = undefined;
+                    ds.remoteCloseState = undefined;
                 }
                 // The retirement coordinator owns a prepared generation. Keep the exact
                 // ChildProcess pointer until exit so it can decide whether abort/commit
@@ -5701,16 +7781,23 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // Per-bot local read isolation (enforced worker-side; the worker gates it).
             // Sibling data needs no app-id enumeration: per-bot dirs are denied wholesale
             // and per-bot session files by filename pattern (see buildV2DenyPaths).
-            // HARD credential boundary for a no-transport session (apiOnly bot OR HTTP
-            // virtual chat): force read isolation so the CLI physically cannot read the
-            // full bots.json / sibling BOT_HOME / send-cred / lark-cli store — a model
-            // that deletes/forges the ancestry marker or bypasses the CLI still cannot
-            // build ANY (sibling) Lark client. The pid-marker gate is only friendly
-            // early-reject; THIS is the fail-closed boundary. Reuses the existing unified
-            // fs-policy (mac+Linux fail-closed); a backend that can't isolate locally
-            // refuses to spawn rather than leak creds.
-            readIsolation: botCfg.readIsolation === true
-                || !larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }),
+            // Opt-in only, driven purely by explicit per-bot `readIsolation`. A
+            // no-transport session (apiOnly bot OR HTTP virtual chat) is NO LONGER
+            // force-isolated: disk read scope now follows the owner's own sandbox config,
+            // symmetric with a normal chat session (unset/false → not isolated). Accepted
+            // trade-off: a no-transport session with no sandbox config can read the full
+            // bots.json / sibling BOT_HOME on disk; protecting sibling creds from lateral
+            // read on a multi-bot host now depends on the owner explicitly enabling
+            // sandbox/readIsolation, not on this force. Two adjacent boundaries are
+            // unchanged and independent: (1) this bot's own transport secret is still
+            // withheld from the CLI env (gated on larkTransportEnabled below), so a
+            // no-transport session cannot drive Botmux's own send path even though it can
+            // read the file; (2) mandatory device-credential isolation (worker.ts) still
+            // masks the device authority dir / enrolled creds on enrolled hosts. Full-file
+            // sandbox stays independently driven worker-side by sandboxRequested
+            // (cfg.sandbox || cfg.readIsolation || BOTMUX_SANDBOX=1); session.sandbox is
+            // frozen from botCfg.sandbox at create time, so "follow local sandbox" holds.
+            readIsolation: botCfg.readIsolation === true,
             readDenyExtraPaths: botCfg.readDenyExtraPaths ?? [],
             // Identifies THIS daemon lifetime. Stamped onto isolated panes so the worker
             // can tell a suspend→resume reattach (same boot id, still isolated) from a
@@ -5726,7 +7813,18 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // Shared Herdr is not derivable from sessionId: preserve the exact host +
             // managed-agent affinity across daemon/worker replacement.
             persistentBackendTarget: ds.session.persistentBackendTarget,
-            backendConfig: botCfg.riff,
+            // One backendConfig channel shared by the remote backends; the selector
+            // picks the shape matching backendType. A mojo bot with no `mojo` block is
+            // valid (all fields optional), so an undefined here is not an error.
+            //
+            // mojo goes through sessionMojoConfig so the control-plane identity frozen at
+            // creation survives a cold resume: without it, editing the bot between two
+            // messages would silently move a live session from cloud to host execution,
+            // or resume it against a different tenant/workspace than the one holding its
+            // remote session.
+            backendConfig: botCfg.backendType === 'mojo' || agentCfg.cliId === 'mojo'
+                ? sessionMojoConfig(ds, botCfg, { freeze: true }).config
+                : botCfg.riff,
             riffParentTaskId: ds.session.riffParentTaskId,
             riffRepoDirs: ds.session.riffRepoDirs,
             deferredScheduleRun: ds.session.deferredScheduleRun,
@@ -5789,6 +7887,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             // worker tags the keyed init prompt no-replay (codex #776 round-7 #1).
             ...(initAtMostOnce ? { atMostOnce: true } : {}),
             vcMeetingImTurnOrigin: initVcMeetingImTurnOrigin,
+            ...(initTrustedCaller ? { trustedCaller: initTrustedCaller } : {}),
             pluginBindings: botCfg.plugins,
             skillPolicy: botCfg.skills,
             ...(runtimeIdentity.status === 'known'
@@ -5808,6 +7907,14 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             }
         }
         ds.initConfig = initMsg;
+        // New generation ledger. NOT a plain reset: the previous generation's keys are
+        // parked until its worker is observed to exit, because the double-fork guard
+        // kills asynchronously and spawns the replacement synchronously.
+        startNewGenerationEnvLedger(ds, initMsg.env);
+        // Cold-resume path: a workerless session goes straight here without passing
+        // through sendWorkerInput, so without this the "notice on the next message"
+        // promise was never kept for exactly the sessions most likely to need it.
+        deliverPendingMojoQuarantineNotice(ds, initAttributionTurnId, initDispatchAttempt);
         // Stamp cliId on the persisted session so the dashboard can show a CLI badge
         // even after the session is closed. Do this before installing worker handlers:
         // a fast worker can emit `ready` immediately after init, and card rendering
@@ -5836,6 +7943,9 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         else {
             worker.send(initMsg);
         }
+        if (prompt.length > 0 && initAttributionTurnId?.startsWith('om_')) {
+            recordAdmittedOrdinaryUserTurn(ds, initAttributionTurnId, { beginRecovery: true });
+        }
         ds.spawnedAt = Date.now();
         // master: per-runtime-key CLI version (the init send already happened above via
         // the tracked-delivery if/else — do NOT re-send initMsg here).
@@ -5873,6 +7983,10 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         throw err;
     }
     ds.initConfig = initMsg;
+    // New generation ledger. NOT a plain reset: the previous generation's keys are
+    // parked until its worker is observed to exit, because the double-fork guard
+    // kills asynchronously and spawns the replacement synchronously.
+    startNewGenerationEnvLedger(ds, initMsg.env);
     try {
         sessionStore.updateSessionPid(ds.session.sessionId, worker.pid ?? null);
     }
@@ -6044,7 +8158,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         && ds.larkAppId === handlerLarkAppId
         && sessionAnchorId(ds) === handlerAnchor
         && (!activeSessionsRegistry
-            || activeSessionsRegistry.get(sessionKey(handlerAnchor, handlerLarkAppId)) === ds);
+            || activeSessionsRegistry.get(activeSessionKey(ds)) === ds);
     const ownsLifecycleMutation = () => ownsWorkerSession() && !isSessionTransferring(ds);
     // A new worker generation is starting. As a backstop, invalidate any
     // stuck-warning card posted by the previous generation — explicit kill/suspend/
@@ -6077,22 +8191,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     };
     /** Auxiliary worker UI is never an authorized output channel for a dedicated
      * VC receiver. Dashboard/audit state is still updated before these guards. */
-    const managedAuxUiSuppressed = (turnId, dispatchAttempt) => {
-        // No-transport session (apiOnly bot or HTTP virtual chat): there is no real
-        // Feishu chat to render a card/reaction into. Suppress ALL auxiliary UI at
-        // the single source every aux-UI handler funnels through — this is the
-        // authoritative fix, NOT a fake "success" message id from sessionReply (a
-        // synthetic id would get stored as streamCardId and later scheduleCardPatch
-        // → updateMessage would still dial Feishu). Dashboard/web-terminal state is
-        // still updated before these guards, so the terminal view is unaffected.
-        if (!larkTransportEnabled({ chatId: ds.chatId, apiOnly: getBot(ds.larkAppId).config.apiOnly }))
-            return true;
-        if (isSilentScheduledTurn(ds, turnId))
-            return true;
-        if (ds.session.vcMeetingReceiver)
-            return true;
-        return ordinaryManagedSuppression(turnId, dispatchAttempt);
-    };
+    // Delegates to the shared policy (auxUiSuppressedFor) so this and the mojo
+    // quarantine notice cannot drift apart. Suppressing here is the authoritative
+    // fix, NOT a fake "success" message id from sessionReply (a synthetic id would
+    // get stored as streamCardId and later scheduleCardPatch → updateMessage would
+    // still dial Feishu). Dashboard/web-terminal state is updated before these
+    // guards, so the terminal view is unaffected.
+    const managedAuxUiSuppressed = (turnId, dispatchAttempt) => auxUiSuppressedFor(ds, turnId, dispatchAttempt);
     /** final_output is the sole exception: listener_thread and exact IM replies
      * may proceed into the durable action ledger; silent/stale attempts do not. */
     const managedFinalOutputSuppressed = (turnId, dispatchAttempt) => {
@@ -6120,6 +8225,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     const bot = getBot(ds.larkAppId);
     const botCfg = bot.config;
     const loc = botLocale(botCfg);
+    ensureOrdinaryTurnRecoveryAttached(ds, botCfg);
     const notifyStartupFailure = async (reason, turnId, dispatchAttempt) => {
         if (startupState.failureNotified)
             return;
@@ -6303,6 +8409,23 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 }
                 startupState.ready = true;
                 ds.workerReady = true;
+                // Restore the daemon-owned display mode BEFORE any card handling: a
+                // fresh worker always boots with displayMode='hidden', and every early
+                // break below (managed / replyAlreadySent / streamingCardDisabled /
+                // CARD_POSTING_SENTINEL) used to skip the re-sync entirely. The
+                // sentinel break is not even rare: a headless backend (mojo) reaches
+                // prompt-ready synchronously on spawn, so screen_update reliably wins
+                // the card-POST race and `ready` breaks at the sentinel — the worker
+                // then never starts its screenshot loop while the daemon keeps
+                // rendering "waiting for first screenshot" forever. Sending before the
+                // card exists is safe: at worst the first screenshot_uploaded is
+                // dropped by the streamCardPending gate and the next 10s cycle
+                // delivers a fresh frame.
+                syncWorkerDisplayMode(ds);
+                // A live CLI is up again: the parked-diagnostic recovery is over, so the
+                // per-message launch-model refresh (see sendWorkerInput) stops here and
+                // ordinary restart/refork paths take over again.
+                ds.crashDiagnosticParked = undefined;
                 // Treat `ready` as a full state boundary for the usage refresh: clear
                 // any timer inherited from a PRIOR worker generation up front, so the
                 // managed/replyAlreadySent/disabled/recovery/sentinel early-breaks below
@@ -6386,7 +8509,6 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // (if any) is left untouched. The next real user turn clears this flag
                 // (rememberLastCliInput) and the normal card flow resumes.
                 if (ds.suppressRecoveryCard) {
-                    syncWorkerDisplayMode(ds);
                     logger.info(`[${t}] Restored session — suppressing recovery streaming card (silent restart)`);
                     break;
                 }
@@ -6427,8 +8549,6 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                             scheduleCodexServiceTierPatch(ds);
                         }
                         persistStreamCardState(ds);
-                        // Re-sync worker's display mode (it starts fresh in 'hidden')
-                        syncWorkerDisplayMode(ds);
                         // The restored card is now the active one — withdraw any cards
                         // frozen before the daemon went down so they don't pile up in the
                         // thread on each restart.
@@ -6460,6 +8580,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (ds.streamCardId === CARD_POSTING_SENTINEL)
                     break;
                 const postingGeneration = ds.streamCardTurnGeneration ?? 0;
+                const cardReplyTarget = captureStreamingCardReplyTarget(ds, msg.turnId);
                 ds.streamCardId = CARD_POSTING_SENTINEL;
                 try {
                     ds.streamCardNonce = randomBytes(4).toString('hex');
@@ -6474,12 +8595,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // before the first screen_update lands. Fresh worker spawn
                     // has lastScreenContent undefined → '' (unchanged).
                     ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId), sessionRuntimeDisplayName(ds, botCfg), codexServiceTierBadge(effectiveCliId, ds.codexServiceTier));
-                    const postedCardId = await scopedReply(streamCardJson, 'interactive', msg.turnId);
+                    const postedCardId = await scopedReply(streamCardJson, 'interactive', cardReplyTarget.turnId);
                     if (!ownsLifecycleMutation()) {
                         void deleteMessage(ds.larkAppId, postedCardId).catch(() => { });
                         break;
                     }
                     ds.streamCardId = postedCardId;
+                    ds.streamCardReplyTargetKey = cardReplyTarget.replyTargetKey;
                     // This card IS the current turn's live card — clear the new-turn flag
                     // so subsequent screen_updates PATCH it (starting → working) instead of
                     // POSTing a second card. Without this, a re-fork that happens while
@@ -6495,8 +8617,6 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     }
                     ds.parkedStreamCardNonce = undefined;
                     persistStreamCardState(ds);
-                    // Re-sync worker's display mode (it starts fresh in 'hidden')
-                    syncWorkerDisplayMode(ds);
                     // New card is live — recall any cards frozen by previous turns.
                     // Done after `streamCardId` is committed so we never delete the old
                     // card without a successor visible to the user.
@@ -6591,6 +8711,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     sendWorkerSessionInput(ds, {
                         type: 'raw_input',
                         content: rawInput,
+                        // Passthrough commands (/compact, /model, ...) become REAL mojo turns,
+                        // so they must carry the same credential snapshot a normal message
+                        // does — otherwise a cleared or rotated JWT simply did not apply here.
+                        ...(mojoLivePatchForSession(ds) ?? {}),
                         ...((ds.session.queuedActivationTurnId ?? rawTurnId)
                             ? { turnId: ds.session.queuedActivationTurnId ?? rawTurnId }
                             : {}),
@@ -6728,6 +8852,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 updateUsageLimitState(ds, msg.usageLimit);
                 ds.lastScreenContent = msg.content;
                 ds.lastScreenStatus = (msg.usageLimit ?? ds.usageLimit) ? 'limited' : msg.status;
+                bumpStreamCardStatusRevision(ds);
                 // A suspend that arrived mid-turn parked itself here. Defer until this
                 // screen_update has finished using process state — suspendWorker nulls
                 // `worker` + `lastScreenStatus`, which everything below still reads
@@ -6843,13 +8968,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // not POSTed as duplicate cards.
                     ds.streamCardPending = false;
                     ds.streamCardId = CARD_POSTING_SENTINEL;
-                    scopedReply(cardJson, 'interactive', msg.turnId)
+                    const cardReplyTarget = captureStreamingCardReplyTarget(ds, msg.turnId);
+                    scopedReply(cardJson, 'interactive', cardReplyTarget.turnId)
                         .then(msgId => {
                         if (!ownsLifecycleMutation()) {
                             void deleteMessage(ds.larkAppId, msgId).catch(() => { });
                             return;
                         }
                         ds.streamCardId = msgId;
+                        ds.streamCardReplyTargetKey = cardReplyTarget.replyTargetKey;
                         const superseded = (ds.streamCardTurnGeneration ?? 0) !== postingGeneration;
                         if (!superseded)
                             ds.streamCardPendingTurnId = undefined;
@@ -6917,10 +9044,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // reflect previous turn's content. Next 10s cycle picks up fresh content.
                 if (ds.streamCardPending)
                     break;
-                ds.currentImageKey = msg.imageKey;
                 const prevStatus = ds.lastScreenStatus;
                 updateUsageLimitState(ds, msg.usageLimit);
                 ds.lastScreenStatus = (msg.usageLimit ?? ds.usageLimit) ? 'limited' : msg.status;
+                bumpStreamCardStatusRevision(ds);
                 // Same deferred-suspend checkpoint as the screen_update branch, and
                 // deferred for the same reason (see runPendingSuspendIfSettled).
                 // The predicate is defense-in-depth here: the handler's fence already
@@ -6934,7 +9061,6 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     imageKey: msg.imageKey,
                     content: ds.lastScreenContent ?? '',
                 });
-                persistStreamCardState(ds);
                 // screenshot_uploaded never ARMS the usage refresh — screen_update owns
                 // the authorized arm. Here we only tear it down: unconditionally on
                 // leaving `working`, and on a managed/silent turn (below) that must not
@@ -6945,8 +9071,16 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     clearUsageRefreshTimer(ds);
                 if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
                     clearUsageRefreshTimer(ds);
+                    persistStreamCardState(ds);
                     break;
                 }
+                // Store the image key only AFTER the managed gate: now that the ready
+                // handler re-syncs display mode on every path, a worker can be
+                // uploading during a suppressed managed/silent turn — letting that
+                // frame into ds.currentImageKey would paste it onto the next visible
+                // card render (the same leak class the comment above names).
+                ds.currentImageKey = msg.imageKey;
+                persistStreamCardState(ds);
                 if ((ds.displayMode ?? 'hidden') !== 'screenshot')
                     break;
                 if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !workerHasInitialized(ds))
@@ -7296,20 +9430,21 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     }
                     break;
                 }
-                // Riff is a remote lineage-owning backend, not a local CLI process.
-                // The worker intentionally refuses restart because tearing it down can
-                // destroy or orphan the remote sandbox. Stop before crash-loop
-                // accounting and tell the user how to recover, rather than logging an
-                // "auto-restart" whose IPC is guaranteed to be a no-op.
-                if (isRiffBackendSession(ds)) {
-                    const retirementPhase = riffRetirementAdmissionPhase(ds);
-                    logger.warn(`[${t}] Riff backend exited; automatic restart is unsupported`
+                // EVERY remote backend is a lineage-owning backend, not a local CLI
+                // process. Stop before crash-loop accounting: for riff the restart IPC
+                // is a guaranteed no-op, and for mojo it is WORSE than a no-op — the
+                // worker executes it, cancelling the remote session and cold-booting a
+                // context-less replacement, so treating a mojo backend exit as a local
+                // CLI crash silently destroyed remote context (fourth-round review).
+                if (isRemoteBackendSession(ds)) {
+                    const retirementPhase = remoteRetirementAdmissionPhase(ds);
+                    logger.warn(`[${t}] Remote backend exited; automatic restart is unsupported`
                         + (retirementPhase ? ` (${retirementPhase})` : ''));
                     // Explicit /close and daemon shutdown already own the user-visible
                     // lifecycle. Only an unexpected backend exit needs recovery guidance.
                     if (!retirementPhase && !suppressExitUi) {
                         try {
-                            await scopedReply(tr('cmd.restart.riff_unsupported', undefined, loc), 'text', undefined);
+                            await scopedReply(tr('cmd.restart.remote_unsupported', undefined, loc), 'text', undefined);
                         }
                         catch (replyErr) {
                             if (replyErr instanceof MessageWithdrawnError) {
@@ -7348,6 +9483,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // terminal URL can show the startup failure; the next user message
                         // tells that same worker to destroy the diagnostic shell and retry.
                         ds.workerReady = false;
+                        // The worker now holds a parked diagnostic shell and will respawn the
+                        // CLI itself on the next message (no restart IPC in that path), so the
+                        // next message must carry the current launch model. Cleared once a
+                        // worker generation reports ready again.
+                        ds.crashDiagnosticParked = true;
                         ds.worker.send({ type: 'park_diagnostic' });
                         restartCounts.delete(key);
                         ds.lastScreenStatus = 'idle';
@@ -7396,7 +9536,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (ds.worker && !ds.worker.killed) {
                     logger.info(`[${t}] Auto-restarting ${sessionCliDisplayName(ds, botCfg)}...`);
                     ds.workerReady = false;
-                    ds.worker.send({ type: 'restart', reason: 'cli_crash', env: latestPerBotEnvForRestart(ds) });
+                    ds.worker.send({ type: 'restart', reason: 'cli_crash', env: latestPerBotEnvForRestart(ds), model: latestModelForRespawn(ds) });
                 }
                 break;
             }
@@ -7465,19 +9605,28 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 break;
             }
             case 'close_result': {
-                const pending = pendingRiffWorkerCloses.get(msg.requestId);
+                const pending = pendingRemoteWorkerCloses.get(msg.requestId);
                 if (!pending
                     || pending.worker !== worker
                     || pending.sessionId !== ds.session.sessionId
                     || ds.worker !== worker) {
-                    logger.warn(`[${t}] Ignored stale/unmatched Riff close result ${msg.requestId}`);
+                    logger.warn(`[${t}] Ignored stale/unmatched remote close result ${msg.requestId}`);
                     break;
                 }
-                pendingRiffWorkerCloses.delete(msg.requestId);
+                pendingRemoteWorkerCloses.delete(msg.requestId);
                 pending.resolve({
                     ok: msg.ok,
                     ...(msg.taskId ? { taskId: msg.taskId } : {}),
                     ...(msg.error ? { error: msg.error } : {}),
+                    ...(msg.recovery ? { recovery: msg.recovery } : {}),
+                    // Forwarded, never re-derived: the backend may keep writes fenced on a
+                    // close that is otherwise retryable, and only it knows that.
+                    ...(msg.admission ? { admission: msg.admission } : {}),
+                    // Same reason, and this one was the leak: an ok:true close carrying a
+                    // local residual arrived here, lost the field, and was published as an
+                    // ordinary closed row while the backend still held the containment
+                    // handle for a subtree it could not prove gone.
+                    ...(msg.residual ? { residual: msg.residual } : {}),
                 });
                 break;
             }
@@ -7599,6 +9748,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     && ds.managedTurnOrigin.dispatchAttempt === msg.dispatchAttempt) {
                     ds.managedTurnOrigin = undefined;
                 }
+                const isClaudeProviderFailure = msg.status !== 'completed'
+                    && sessionCliId(ds, botCfg) === 'claude-code'
+                    && (msg.errorCode?.startsWith('provider_') ?? false);
+                const recoveryOwnsTerminal = ordinaryTurnRecoveryHandlesTerminal(ds.session, msg);
+                let recoveryHandled = false;
                 try {
                     await cb.onTurnTerminal?.(ds, msg, { workerGeneration });
                 }
@@ -7607,6 +9761,98 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // never let a projection/store failure crash the worker IPC loop.
                     logger.error(`[${t}] Failed to persist turn_terminal for ${msg.turnId.substring(0, 8)}: ${err.message}`);
                 }
+                try {
+                    handleOrdinaryTurnRecoveryTerminal(ds.session, msg);
+                    recoveryHandled = recoveryOwnsTerminal;
+                }
+                catch (err) {
+                    // Recovery projection is durable fail-closed state, but a temporary
+                    // session-store failure must not escape the worker IPC handler. The
+                    // prior in-memory/persisted state was restored by the coordinator and
+                    // can be reconciled on the next terminal or daemon restart.
+                    logger.error(`[${t}] Failed to persist ordinary-turn recovery terminal for `
+                        + `${msg.turnId.substring(0, 8)}: `
+                        + `${err instanceof Error ? err.message : String(err)}`);
+                }
+                let nonLarkFailureHandled = false;
+                if (isClaudeProviderFailure && !ds.session.vcMeetingReceiver) {
+                    const failureCode = msg.errorCode ?? msg.status;
+                    const waitPromise = ds.pendingWaitPromises?.get(msg.turnId);
+                    if (waitPromise) {
+                        nonLarkFailureHandled = true;
+                        ds.pendingWaitPromises?.delete(msg.turnId);
+                        const failure = new Error(`Claude turn failed: ${failureCode}`);
+                        if (waitPromise.reject)
+                            waitPromise.reject(failure);
+                        else
+                            waitPromise.resolve(`ERROR: ${failure.message}`);
+                        logger.info(`[${t}] Settled Wait Mode HTTP turn ${msg.turnId.substring(0, 8)} `
+                            + `failed (${failureCode})`);
+                    }
+                    const asyncResult = ds.asyncTriggerResults?.get(msg.turnId);
+                    const asyncSink = !!asyncResult || ds.chatId.startsWith('http_async_');
+                    if (asyncSink) {
+                        nonLarkFailureHandled = true;
+                        const failedAt = Date.now();
+                        if (asyncResult?.status === 'completed') {
+                            // final_output is stronger and may have settled immediately before
+                            // the ordered terminal IPC. Never replace known output with a
+                            // later failure boundary, even if its best-effort durable write
+                            // has not landed yet.
+                            ds.idempotentAsyncTurns?.delete(msg.turnId);
+                            logger.info(`[${t}] Ignored failed terminal for completed async HTTP turn `
+                                + msg.turnId.substring(0, 8));
+                        }
+                        else {
+                            if (asyncResult?.status === 'pending') {
+                                asyncResult.status = 'failed';
+                                asyncResult.failedAt = failedAt;
+                                asyncResult.errorCode = 'trigger_failed';
+                                asyncResult.terminalErrorCode = failureCode;
+                            }
+                            try {
+                                const outcome = asyncTriggerStore.recordTerminalFailureStrict(ds.session.sessionId, msg.turnId, failedAt, ds.larkAppId, failureCode);
+                                if (outcome === 'already_completed') {
+                                    // Durable completed proof is stronger. Drop a stale in-memory
+                                    // pending/failed projection so trigger-result reads that proof.
+                                    ds.asyncTriggerResults?.delete(msg.turnId);
+                                }
+                            }
+                            catch (err) {
+                                // The live failed projection still terminates current-daemon
+                                // polling. Keep it when durable persistence is unavailable and
+                                // report the lost restart guarantee explicitly.
+                                logger.error(`[${t}] Failed to persist async worker terminal for `
+                                    + `${msg.turnId.substring(0, 8)}: `
+                                    + `${err instanceof Error ? err.message : String(err)}`);
+                            }
+                            ds.idempotentAsyncTurns?.delete(msg.turnId);
+                            logger.info(`[${t}] Settled async HTTP turn ${msg.turnId.substring(0, 8)} `
+                                + `failed (${failureCode})`);
+                        }
+                    }
+                }
+                if (isClaudeProviderFailure
+                    && !nonLarkFailureHandled
+                    && !recoveryHandled
+                    && !managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    const failureCode = msg.errorCode ?? msg.status;
+                    const warning = tr('worker.claude_terminal_failure_unrecovered', { errorCode: failureCode }, loc);
+                    ds.agentAttention = { kind: 'blocked', reason: warning, at: Date.now() };
+                    publishAttentionPatch(ds);
+                    emitSessionLifecycleHook(ds, 'session.requires_attention', {
+                        reason: 'claude_terminal_failure_unrecovered',
+                        errorCode: failureCode,
+                        turnId: msg.turnId,
+                    });
+                    try {
+                        await scopedReply(warning, 'text', msg.turnId);
+                    }
+                    catch (err) {
+                        logger.error(`[${t}] Failed to deliver Claude terminal failure warning: `
+                            + `${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
                 // Async-HTTP settle-on-terminal (core-only completion bug #70): a turn
                 // the worker's bridge gate suppressed as GENUINE SILENCE (the model
                 // terminated with a bare nothing-to-send sentinel, no `botmux send`)
@@ -8141,10 +10387,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             ds.workerToken = null;
             ds.workerViewToken = null;
             ds.managedTurnOrigin = undefined;
-            if (ds.riffCloseState) {
-                ds.riffCloseState = { ...ds.riffCloseState, phase: 'uncertain' };
+            if (ds.remoteCloseState) {
+                ds.remoteCloseState = { ...ds.remoteCloseState, phase: 'uncertain' };
             }
-            // Do not clear riffShutdownState here. Only the shutdown coordinator can
+            // Do not clear remoteShutdownState here. Only the shutdown coordinator can
             // release a generation after lineage persistence or admission restore.
             // This worker generation is gone. Invalidate any stuck-warning card it
             // posted so a late click cannot inject keys into a replacement worker.
@@ -8159,7 +10405,12 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             ds.workerGeneration = fencedGeneration;
             ds.session.workerGeneration = fencedGeneration;
             ds.session.pid = undefined;
+            // P1-13：worker 退出（崩溃、被杀、正常结束）同样是权威换代——它带走整棵 CLI
+            // 进程树，包括那一代注册的 dev server。与代次围栏并进同一次落盘。
+            const exitedPreviewTarget = takeSessionPreviewTarget(ds.session);
             sessionStore.updateSession(ds.session);
+            if (exitedPreviewTarget !== undefined)
+                publishSessionPreviewCleared(ds.session.sessionId);
         }
         if (!transferRetirement) {
             try {
@@ -8224,6 +10475,26 @@ export function codexAppFinalSettlementCount() {
 function finalOutputDedupeKey(ds, msg) {
     return `${msg.sessionId ?? ds.session.sessionId}:${msg.lastUuid || msg.turnId}`;
 }
+/**
+ * Stable Lark `uuid` idempotency token for an ordinary bridge final_output
+ * delivery. Derived from the same identity as the daemon-side dedupe key, so
+ * every retry of the same answer — and any duplicate IPC/re-emit of the same
+ * turn — collapses into ONE Lark message (the Feishu `uuid` field is
+ * idempotent for 1h and returns the original message_id on repeat).
+ *
+ * Without it, the daemon's own transient-failure retry
+ * (`FINAL_OUTPUT_RETRY_BACKOFF_MS`, up to 3 attempts) is at-least-once: an
+ * ambiguous first attempt whose reply the server accepted but whose response
+ * the client never saw (network error/timeout) creates a brand-new copy on
+ * each retry — the user-visible "the answer repeated 3 times" incident. The
+ * VC-managed (`vcp_*`) and Codex App settlement (`ca_*`) paths already carry
+ * their own stable provider keys; this closes the same gap for the ordinary
+ * thread/chat fallback path.
+ */
+function bridgeFinalOutputUuid(ds, msg) {
+    const seed = finalOutputDedupeKey(ds, msg);
+    return `bf_${createHash('sha256').update(seed, 'utf8').digest('hex').slice(0, 46)}`;
+}
 function shouldDropMismatchedFinalOutput(ds, msg, t) {
     if (!msg.sessionId || msg.sessionId === ds.session.sessionId)
         return false;
@@ -8688,7 +10959,7 @@ function deliverFinalOutput(ds, msg, t, attempt, onComplete, isStillOwned = () =
                         }
                         : {}),
                 }
-                : codexAppSettlementReply;
+                : codexAppSettlementReply ?? { uuid: bridgeFinalOutputUuid(ds, msg) };
             const messageId = await scopedReply(canonicalOutput.content, canonicalOutput.msgType, msg.replyTurnId ?? msg.turnId, frozenReplyTarget && !managedReceiver
                 ? { ...deliveryReplyOptions, replyTarget: frozenReplyTarget }
                 : deliveryReplyOptions);
@@ -8765,6 +11036,11 @@ function reserveWorkerGeneration(ds) {
     const workerGeneration = Math.max(previousDaemonGeneration ?? 0, previousSessionGeneration ?? 0) + 1;
     ds.workerGeneration = workerGeneration;
     ds.session.workerGeneration = workerGeneration;
+    // P1-13：换代边界统一清 previewTarget。fork / refork / 切 CLI / adopt 全部经由这里
+    // 预留代次，所以这一处就是「上一代 CLI 起的 dev server 已经失去权威」的唯一判据。
+    // 并进同一次 updateSession，代次推进与预览清空要么一起落盘、要么一起回滚——否则
+    // 会出现「代次已经是新的、磁盘上还留着上一代端口」的中间态，重启后被当成有效路由。
+    const previousPreviewTarget = takeSessionPreviewTarget(ds.session);
     try {
         sessionStore.updateSession(ds.session);
     }
@@ -8777,8 +11053,13 @@ function reserveWorkerGeneration(ds) {
             delete ds.session.workerGeneration;
         else
             ds.session.workerGeneration = previousSessionGeneration;
+        // 只在原本有目标时写回：预留失败不该给一个从未注册过预览的会话凭空加上这个键。
+        if (previousPreviewTarget !== undefined)
+            ds.session.previewTarget = previousPreviewTarget;
         throw error;
     }
+    if (previousPreviewTarget !== undefined)
+        publishSessionPreviewCleared(ds.session.sessionId);
     // Reservation is the first durable proof that the previous generation has
     // lost authority. Clear its TUI slot before any environment check, adapter
     // creation, or fork can throw and strand a clicked card in "processing".
@@ -9070,6 +11351,10 @@ export function forkAdoptWorker(ds, opts) {
     };
     worker.send(initMsg);
     ds.initConfig = initMsg;
+    // New generation ledger. NOT a plain reset: the previous generation's keys are
+    // parked until its worker is observed to exit, because the double-fork guard
+    // kills asynchronously and spawns the replacement synchronously.
+    startNewGenerationEnvLedger(ds, initMsg.env);
     // Stamp cliId on the persisted session so the dashboard can show a CLI badge
     // even after the session is closed. Adopt sessions inherit the adopted CLI's id.
     // Do this before installing worker handlers: a fast worker can emit `ready`