oh-my-codex 0.21.0 → 0.21.2

package/dist/cli/index.js

@@ -3,9 +3,9 @@
  * Multi-agent orchestration for OpenAI Codex CLI
  */
 import { execFileSync, spawn } from "child_process";
-import { basename, dirname, isAbsolute, join, posix, relative, resolve, win32 } from "path";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "path";
 import { appendFileSync, chmodSync, closeSync, constants as fsConstants, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs";
-import { copyFile, cp, lstat, mkdir, open, readFile, readdir, rm, stat, symlink, utimes, writeFile } from "fs/promises";
+import { access, chmod, copyFile, cp, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, symlink, utimes, writeFile } from "fs/promises";
 import { constants as osConstants, homedir } from "os";
 import { createHash, randomUUID } from "crypto";
 import { setup, SETUP_MCP_MODES, SETUP_SCOPES, SETUP_TEAM_MODES, } from "./setup.js";
@@ -53,10 +53,11 @@ import { ROOT_REASONING_EFFORTS, isUnsupportedRootReasoningEffort, normalizeUnsu
 export { readPersistedSetupPreferences, readPersistedSetupScope, resolveCodexConfigPathForLaunch, resolveCodexHomeForLaunch, resolveProjectLocalCodexHomeForLaunch, } from "./codex-home.js";
 import { SKILL_ACTIVE_STATE_MODE, extractSessionIdFromInitializedStatePath, listActiveSkills, syncCanonicalSkillStateForMode, updateRootSkillActiveStateForStateDir, } from "../state/skill-active.js";
 import { isTrackedWorkflowMode } from "../state/workflow-transition.js";
+import { validateDetachedAdvisorySessionSkillTransition } from "../ralplan/advisory-detached-transition.js";
 import { maybeCheckAndPromptUpdate, runImmediateUpdate } from "./update.js";
 import { maybePromptGithubStar } from "./star-prompt.js";
 import { generateOverlay, removeSessionModelInstructionsFile, resolveSessionOrchestrationMode, sessionModelInstructionsPath, writeSessionModelInstructionsFile, } from "../hooks/agents-overlay.js";
-import { closeLaunchSessionBindingOnce, establishLaunchSessionBinding, readNativeSessionOwnerEvidence, readSessionPointer, readSessionState, resolveSessionPointerContext, finalizeBoundOnce, isSessionPointerLaunchAbort, normalizeSessionId, resetSessionMetrics, } from "../hooks/session.js";
+import { closeLaunchSessionBindingOnce, establishLaunchSessionBinding, readNativeSessionOwnerEvidence, readSessionPointer, readSessionState, resolveSessionPointerContext, sessionOwnerFileIdentityMatches, finalizeBoundOnce, isSessionPointerLaunchAbort, normalizeSessionId, resetSessionMetrics, } from "../hooks/session.js";
 import { probeActualTmuxInstanceEvidence, tmuxEvidenceBindsCandidate } from "../scripts/notify-hook/managed-tmux.js";
 import { buildClientAttachedReconcileHookName, buildReconcileHudResizeArgs, buildRegisterClientAttachedReconcileArgs, buildRegisterResizeHookArgs, buildResizeHookName, buildResizeHookTarget, buildScheduleDelayedHudResizeArgs, buildUnregisterClientAttachedReconcileArgs, buildUnregisterResizeHookArgs, enableMouseScrolling, isMsysOrGitBash, isNativeWindows, isTmuxAvailable, } from "../team/tmux-session.js";
 import { getPackageRoot } from "../utils/package.js";
@@ -633,10 +634,10 @@ export const CODEX_SQLITE_HOME_ENV = "CODEX_SQLITE_HOME";
 export function runtimeCodexHomePath(cwd, sessionId) {
     return join(omxRoot(cwd), "runtime", "codex-home", sessionId);
 }
-async function linkOrCopyCodexHomeEntry(source, destination) {
+async function linkOrCopyCodexHomeEntry(source, destination, createSymlink = symlink) {
     const stat = await lstat(source);
     try {
-        await symlink(source, destination, stat.isDirectory() && process.platform === "win32" ? "junction" : undefined);
+        await createSymlink(source, destination, stat.isDirectory() && process.platform === "win32" ? "junction" : undefined);
     }
     catch {
         if (stat.isDirectory()) {
@@ -646,10 +647,116 @@ async function linkOrCopyCodexHomeEntry(source, destination) {
         await copyFile(source, destination);
     }
 }
-async function copyFilePreservingTimestamps(source, destination) {
-    await copyFile(source, destination);
-    const sourceStat = await stat(source);
-    await utimes(destination, sourceStat.atime, sourceStat.mtime);
+async function copyFilePreservingTimestamps(source, destination, options = {}) {
+    const sourcePath = options.allowTopLevelSymlink === true ? await realpath(source) : source;
+    const sourceRoot = options.sourceRoot ? await realpath(options.sourceRoot) : undefined;
+    const destinationRoot = options.destinationRoot ? await realpath(options.destinationRoot) : undefined;
+    if (sourceRoot)
+        await assertHistoryPathWithin(sourcePath, sourceRoot);
+    if (destinationRoot)
+        await assertHistoryDestinationParentWithin(destination, destinationRoot);
+    const sourceHandle = await open(sourcePath, fsConstants.O_RDONLY | historyNoFollowFlag());
+    let destinationHandle;
+    const temporary = `${destination}.omx-history-${randomUUID()}`;
+    try {
+        const sourceStat = await sourceHandle.stat();
+        if (!sourceStat.isFile())
+            throw new Error(`history source is not a regular file: ${source}`);
+        if (options.expectedSourceStat && !hasSameHistoryIdentity(sourceStat, options.expectedSourceStat)) {
+            throw new HistoryEntryChangedError(`history source changed during copy: ${source}`);
+        }
+        await options.afterSourceOpen?.();
+        if (destinationRoot)
+            await assertHistoryDestinationParentWithin(destination, destinationRoot);
+        await mkdir(dirname(destination), { recursive: true });
+        destinationHandle = await open(temporary, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | historyNoFollowFlag(), historyDestinationMode(sourceStat.mode));
+        const buffer = Buffer.alloc(64 * 1024);
+        let position = 0;
+        const copiedHash = createHash("sha256");
+        while (true) {
+            const { bytesRead } = await sourceHandle.read(buffer, 0, buffer.length, position);
+            if (bytesRead === 0)
+                break;
+            copiedHash.update(buffer.subarray(0, bytesRead));
+            let written = 0;
+            while (written < bytesRead) {
+                const { bytesWritten } = await destinationHandle.write(buffer, written, bytesRead - written);
+                written += bytesWritten;
+            }
+            position += bytesRead;
+        }
+        const copiedSourceStat = await sourceHandle.stat();
+        if (!hasSameHistoryVersion(copiedSourceStat, sourceStat)) {
+            throw new HistoryEntryChangedError(`history source content changed during copy: ${source}`);
+        }
+        const verificationHash = createHash("sha256");
+        position = 0;
+        while (true) {
+            const { bytesRead } = await sourceHandle.read(buffer, 0, buffer.length, position);
+            if (bytesRead === 0)
+                break;
+            verificationHash.update(buffer.subarray(0, bytesRead));
+            position += bytesRead;
+        }
+        if (verificationHash.digest("hex") !== copiedHash.digest("hex")) {
+            throw new HistoryEntryChangedError(`history source bytes changed during copy: ${source}`);
+        }
+        await destinationHandle.chmod(historyDestinationMode(sourceStat.mode));
+        await destinationHandle.utimes(sourceStat.atime, sourceStat.mtime);
+        await destinationHandle.close();
+        destinationHandle = undefined;
+        await options.afterStage?.(temporary, destination);
+        const stagedStat = await lstat(temporary);
+        if (!stagedStat.isFile() || stagedStat.isSymbolicLink() || stagedStat.nlink !== 1) {
+            throw new Error(`history staging path is not a regular file: ${temporary}`);
+        }
+        if (destinationRoot)
+            await assertHistoryDestinationParentWithin(destination, destinationRoot);
+        await publishHistoryReplacement(temporary, destination, false);
+    }
+    finally {
+        await destinationHandle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+        await sourceHandle.close();
+    }
+}
+async function readHistoryFileWithoutSymlink(source, allowTopLevelSymlink = false, sourceRoot) {
+    const sourcePath = allowTopLevelSymlink === true ? await realpath(source) : source;
+    const canonicalSourceRoot = sourceRoot ? await realpath(sourceRoot) : undefined;
+    if (canonicalSourceRoot)
+        await assertHistoryPathWithin(sourcePath, canonicalSourceRoot);
+    const sourceHandle = await open(sourcePath, fsConstants.O_RDONLY | historyNoFollowFlag());
+    try {
+        const sourceStat = await sourceHandle.stat();
+        if (!sourceStat.isFile())
+            throw new Error(`history source is not a regular file: ${source}`);
+        return await sourceHandle.readFile("utf-8");
+    }
+    finally {
+        await sourceHandle.close();
+    }
+}
+async function writeHistoryFileAtomically(destination, contents, mode, destinationRoot) {
+    const canonicalDestinationRoot = destinationRoot ? await realpath(destinationRoot) : undefined;
+    if (canonicalDestinationRoot)
+        await assertHistoryDestinationParentWithin(destination, canonicalDestinationRoot);
+    const destinationMode = historyDestinationMode(mode);
+    const temporary = `${destination}.omx-history-${randomUUID()}`;
+    let destinationHandle;
+    try {
+        destinationHandle = await open(temporary, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | historyNoFollowFlag(), destinationMode);
+        await destinationHandle.writeFile(contents, "utf-8");
+        await destinationHandle.chmod(destinationMode);
+        await destinationHandle.close();
+        destinationHandle = undefined;
+        if (canonicalDestinationRoot)
+            await assertHistoryDestinationParentWithin(destination, canonicalDestinationRoot);
+        await publishHistoryReplacement(temporary, destination, false);
+    }
+    finally {
+        await destinationHandle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
 }
 function isCodexSqliteArtifact(entryName) {
     return /^(?:state|logs)_\d+\.sqlite(?:-(?:shm|wal))?$/.test(entryName);
@@ -680,6 +787,333 @@ function shouldMirrorProjectLaunchRuntimeEntry(entryName, includeHistoryArtifact
 function shouldPersistProjectLaunchRuntimeEntry(entryName) {
     return PROJECT_LAUNCH_PERSISTED_RUNTIME_ENTRY_NAMES.has(entryName);
 }
+function isRegularHistoryTarget(sourceStat) {
+    return sourceStat.isDirectory() || sourceStat.isFile();
+}
+export function historyDestinationMode(sourceMode) {
+    const permissions = sourceMode & 0o777;
+    return permissions | ((permissions & 0o070) << 3) | ((permissions & 0o007) << 6);
+}
+function historyNoFollowFlag() {
+    return process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+}
+function isHistoryPathWithin(candidate, root) {
+    const normalizedRoot = process.platform === "win32" ? win32.normalize(root).toLowerCase() : root;
+    const normalizedCandidate = process.platform === "win32" ? win32.normalize(candidate).toLowerCase() : candidate;
+    const path = process.platform === "win32"
+        ? win32.relative(normalizedRoot, normalizedCandidate)
+        : relative(normalizedRoot, normalizedCandidate);
+    const escapes = path === ".." || path.startsWith(`..${sep}`);
+    return path === "" || (!escapes && !isAbsolute(path));
+}
+async function assertHistoryPathWithin(path, root, allowMissing = false) {
+    const canonicalRoot = root;
+    const canonicalPath = await realpath(path).catch((error) => {
+        if (allowMissing && isUnresolvableHistoryLinkError(error))
+            return undefined;
+        throw error;
+    });
+    if (canonicalPath && !isHistoryPathWithin(canonicalPath, canonicalRoot)) {
+        throw new Error(`history path escapes its authorized root: ${path}`);
+    }
+}
+async function assertHistoryDestinationParentWithin(destination, root) {
+    await assertHistoryPathWithin(dirname(destination), root);
+}
+async function assertHistoryDestinationDirectorySafe(destination, root) {
+    const destinationStat = await lstat(destination);
+    if (!destinationStat.isDirectory() || destinationStat.isSymbolicLink()) {
+        throw new HistoryEntryChangedError(`history destination changed during copy: ${destination}`);
+    }
+    await assertHistoryPathWithin(destination, root);
+}
+async function chmodHistoryDestination(destination, mode, tolerateForeignOwner) {
+    try {
+        await chmod(destination, mode);
+    }
+    catch (error) {
+        if (tolerateForeignOwner && error.code === "EPERM")
+            return;
+        throw error;
+    }
+}
+async function utimesHistoryDestination(destination, atime, mtime, tolerateForeignOwner) {
+    try {
+        await utimes(destination, atime, mtime);
+    }
+    catch (error) {
+        if (tolerateForeignOwner && error.code === "EPERM")
+            return;
+        throw error;
+    }
+}
+async function publishHistoryReplacement(temporary, destination, recursive) {
+    try {
+        await rename(temporary, destination);
+        return;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "EEXIST" && code !== "EPERM" && code !== "ENOTEMPTY")
+            throw error;
+    }
+    const backup = `${destination}.omx-history-backup-${randomUUID()}`;
+    await rename(destination, backup);
+    try {
+        await rename(temporary, destination);
+    }
+    catch (error) {
+        await rename(backup, destination).catch(() => undefined);
+        throw error;
+    }
+    await rm(backup, { recursive, force: true }).catch(() => undefined);
+}
+function isUnresolvableHistoryLinkError(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const code = error.code;
+    return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
+}
+class HistoryEntryChangedError extends Error {
+    code = "ESTALE";
+}
+function isDiscardableHistoryCopyError(error) {
+    return isUnresolvableHistoryLinkError(error) || error instanceof HistoryEntryChangedError;
+}
+const HISTORY_PERSISTENCE_LOCK_TIMEOUT_MS = 5_000;
+const HISTORY_PERSISTENCE_LOCK_STALE_MS = 30_000;
+const HISTORY_PERSISTENCE_LOCK_HEARTBEAT_MS = 5_000;
+const HISTORY_PERSISTENCE_LOCK_RENAME_RETRIES = 20;
+const HISTORY_PERSISTENCE_LOCK_RENAME_RETRY_DELAY_MS = 10;
+async function readHistoryPersistenceLockOwner(lockPath) {
+    try {
+        const raw = await readFile(join(lockPath, "owner.json"), "utf-8");
+        const parts = raw.split("\n");
+        const completeLines = raw.endsWith("\n") || parts.length === 1 ? parts.filter(Boolean) : parts.slice(0, -1).filter(Boolean);
+        const owner = JSON.parse(completeLines.at(-1) ?? "");
+        if (typeof owner.token !== "string" || typeof owner.pid !== "number")
+            return null;
+        if (owner.startIdentity !== undefined && typeof owner.startIdentity !== "string")
+            return null;
+        return { token: owner.token, pid: owner.pid, startIdentity: owner.startIdentity };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        return null;
+    }
+}
+async function historyProcessStartIdentity(pid) {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const stat = await readFile(`/proc/${pid}/stat`, "utf-8");
+        const fields = stat.slice(stat.lastIndexOf(") ") + 2).split(" ");
+        return fields[19] ? `${pid}:${fields[19]}` : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function isHistoryProcessAlive(owner) {
+    try {
+        process.kill(owner.pid, 0);
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        return true;
+    }
+    if (!owner.startIdentity)
+        return undefined;
+    const currentIdentity = await historyProcessStartIdentity(owner.pid);
+    if (!currentIdentity)
+        return undefined;
+    return currentIdentity === owner.startIdentity;
+}
+async function historyLockIsCurrent(lease) {
+    const lockStat = await lstat(lease.lockPath).catch(() => undefined);
+    if (!lockStat || !lockStat.isDirectory() || lockStat.isSymbolicLink())
+        return false;
+    if (!hasSameHistoryIdentity(lockStat, lease.lockIdentity))
+        return false;
+    const owner = await readHistoryPersistenceLockOwner(lease.lockPath);
+    return owner?.token === lease.token;
+}
+async function retireHistoryLock(lockPath, root, expectedIdentity, expectedToken) {
+    const currentStat = await lstat(lockPath).catch(() => undefined);
+    if (!currentStat || !currentStat.isDirectory() || currentStat.isSymbolicLink())
+        return;
+    if (!hasSameHistoryIdentity(currentStat, expectedIdentity))
+        return;
+    if (expectedToken) {
+        const owner = await readHistoryPersistenceLockOwner(lockPath);
+        if (owner?.token !== expectedToken)
+            return;
+    }
+    const retiredPath = `${lockPath}.retired-${randomUUID()}`;
+    let retired = false;
+    for (let attempt = 0; attempt < HISTORY_PERSISTENCE_LOCK_RENAME_RETRIES; attempt += 1) {
+        try {
+            await rename(lockPath, retiredPath);
+            retired = true;
+            break;
+        }
+        catch {
+            if (attempt + 1 < HISTORY_PERSISTENCE_LOCK_RENAME_RETRIES) {
+                await new Promise((resolveWait) => setTimeout(resolveWait, HISTORY_PERSISTENCE_LOCK_RENAME_RETRY_DELAY_MS));
+            }
+        }
+    }
+    if (!retired)
+        return;
+    await assertHistoryPathWithin(retiredPath, root);
+    await rm(retiredPath, { recursive: true, force: true }).catch(() => undefined);
+}
+export async function releaseHistoryPersistenceLock(lease) {
+    clearInterval(lease.heartbeat);
+    await lease.waitForHeartbeat();
+    if (!(await historyLockIsCurrent(lease)))
+        return;
+    await retireHistoryLock(lease.lockPath, lease.root, lease.lockIdentity, lease.token);
+}
+export async function acquireHistoryPersistenceLock(root, options = {}) {
+    root = await realpath(root);
+    const lockPath = join(root, ".omx-history.lock");
+    const ownerPath = join(lockPath, "owner.json");
+    const timeoutMs = options.timeoutMs ?? HISTORY_PERSISTENCE_LOCK_TIMEOUT_MS;
+    const staleMs = options.staleMs ?? HISTORY_PERSISTENCE_LOCK_STALE_MS;
+    const heartbeatMs = options.heartbeatMs ?? HISTORY_PERSISTENCE_LOCK_HEARTBEAT_MS;
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        try {
+            await mkdir(lockPath, { mode: 0o700 });
+            const lockStat = await lstat(lockPath);
+            if (!lockStat.isDirectory() || lockStat.isSymbolicLink()) {
+                throw new Error(`history persistence lock is not a private directory: ${lockPath}`);
+            }
+            await assertHistoryPathWithin(lockPath, root);
+            const lockIdentity = { dev: lockStat.dev, ino: lockStat.ino };
+            if (process.platform !== "win32" && (lockStat.mode & 0o077) !== 0) {
+                throw new Error(`history persistence lock is not private: ${lockPath}`);
+            }
+            const token = randomUUID();
+            const startIdentity = await historyProcessStartIdentity(process.pid);
+            const initialOwnerPath = `${ownerPath}.${randomUUID()}.tmp`;
+            await writeFile(initialOwnerPath, `${JSON.stringify({ token, pid: process.pid, startIdentity, heartbeatAt: Date.now() })}\n`, { flag: "wx", mode: 0o600 });
+            await rename(initialOwnerPath, ownerPath);
+            let heartbeatInFlight = Promise.resolve();
+            const runHeartbeat = async () => {
+                let temporaryOwnerPath;
+                try {
+                    const owner = await readHistoryPersistenceLockOwner(lockPath);
+                    if (owner?.token !== token)
+                        return;
+                    if (process.platform === "win32") {
+                        const currentLockStat = await lstat(lockPath);
+                        if (!hasSameHistoryIdentity(currentLockStat, lockIdentity))
+                            return;
+                        await utimes(lockPath, new Date(), new Date());
+                        await writeFile(ownerPath, `${JSON.stringify({ token, pid: process.pid, startIdentity, heartbeatAt: Date.now() })}\n`, { flag: "a" });
+                        return;
+                    }
+                    temporaryOwnerPath = `${ownerPath}.${randomUUID()}.tmp`;
+                    await writeFile(temporaryOwnerPath, `${JSON.stringify({ token, pid: process.pid, startIdentity, heartbeatAt: Date.now() })}\n`, { flag: "wx", mode: 0o600 });
+                    const currentLockStat = await lstat(lockPath);
+                    const currentOwner = await readHistoryPersistenceLockOwner(lockPath);
+                    if (!hasSameHistoryIdentity(currentLockStat, lockIdentity) || currentOwner?.token !== token) {
+                        await rm(temporaryOwnerPath, { force: true }).catch(() => undefined);
+                        return;
+                    }
+                    await rename(temporaryOwnerPath, ownerPath);
+                }
+                catch {
+                    // A contender may have removed a dead owner's lock between checks.
+                    if (temporaryOwnerPath)
+                        await rm(temporaryOwnerPath, { force: true }).catch(() => undefined);
+                }
+            };
+            const heartbeat = setInterval(() => {
+                heartbeatInFlight = heartbeatInFlight.then(runHeartbeat, runHeartbeat);
+            }, heartbeatMs);
+            heartbeat.unref?.();
+            return { root, lockPath, token, lockIdentity, heartbeat, waitForHeartbeat: () => heartbeatInFlight };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const lockStat = await lstat(lockPath).catch(() => undefined);
+            if (!lockStat)
+                continue;
+            if (lockStat?.isSymbolicLink())
+                throw new Error(`history persistence lock is a symlink: ${lockPath}`);
+            const owner = await readHistoryPersistenceLockOwner(lockPath);
+            const lockAge = lockStat ? Date.now() - lockStat.mtimeMs : 0;
+            if (owner && owner !== null && (await isHistoryProcessAlive(owner)) === false) {
+                const ownerStat = await stat(join(lockPath, "owner.json")).catch(() => undefined);
+                if (ownerStat && Date.now() - ownerStat.mtimeMs > staleMs) {
+                    await retireHistoryLock(lockPath, root, lockStat ? { dev: lockStat.dev, ino: lockStat.ino } : { dev: -1, ino: -1 }, owner.token);
+                    continue;
+                }
+            }
+            else if (owner === undefined && lockAge > staleMs) {
+                await retireHistoryLock(lockPath, root, lockStat ? { dev: lockStat.dev, ino: lockStat.ino } : { dev: -1, ino: -1 });
+                continue;
+            }
+            if (process.platform !== "win32" && (lockStat.mode & 0o077) !== 0) {
+                throw new Error(`history persistence lock is not private: ${lockPath}`);
+            }
+            if (Date.now() >= deadline)
+                throw new Error(`timed out waiting for history persistence lock: ${lockPath}`);
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        }
+    }
+}
+function hasSameHistoryIdentity(actual, expected) {
+    return actual.dev === expected.dev && actual.ino === expected.ino;
+}
+function hasSameHistoryVersion(actual, expected) {
+    return hasSameHistoryIdentity(actual, expected) && actual.size === expected.size && actual.mtimeMs === expected.mtimeMs;
+}
+async function inspectProjectLaunchRuntimeHistoryEntry(source) {
+    // Durable history names are an explicit allowlist. Follow only the named
+    // entry's top-level link so a directory link is classified as a directory;
+    // the destination remains the fixed runtime history path below.
+    let linkStat;
+    try {
+        linkStat = await lstat(source);
+    }
+    catch (error) {
+        if (isUnresolvableHistoryLinkError(error))
+            return undefined;
+        throw error;
+    }
+    if (!linkStat.isSymbolicLink())
+        return { linkStat, targetStat: linkStat, targetRealpath: undefined };
+    try {
+        return { linkStat, targetStat: await stat(source), targetRealpath: await realpath(source) };
+    }
+    catch (error) {
+        if (isUnresolvableHistoryLinkError(error))
+            return { linkStat, targetStat: undefined };
+        throw error;
+    }
+}
+async function historyEntryStillMatches(source, inspection) {
+    if (!inspection)
+        return false;
+    const current = await inspectProjectLaunchRuntimeHistoryEntry(source);
+    const inspectedTarget = inspection.targetStat;
+    const currentTarget = current?.targetStat;
+    if (!current || !inspectedTarget || !currentTarget)
+        return false;
+    if (current.linkStat.dev !== inspection.linkStat.dev || current.linkStat.ino !== inspection.linkStat.ino)
+        return false;
+    if (inspection.targetRealpath !== current.targetRealpath)
+        return false;
+    return (currentTarget.dev === inspectedTarget.dev &&
+        currentTarget.ino === inspectedTarget.ino);
+}
 function uniqueJsonlLines(contents) {
     const seen = new Set();
     const lines = [];
@@ -691,84 +1125,366 @@ function uniqueJsonlLines(contents) {
     }
     return lines;
 }
-async function persistProjectLaunchRuntimeJsonlArtifact(source, destination) {
-    const existing = existsSync(destination) ? await readFile(destination, "utf-8").catch(() => "") : "";
-    const sourceContents = await readFile(source, "utf-8");
-    const separator = existing === "" || existing.endsWith("\n") || sourceContents === "" ? "" : "\n";
-    const lines = uniqueJsonlLines(`${existing}${separator}${sourceContents}`);
-    await writeFile(destination, lines.length > 0 ? `${lines.join("\n")}\n` : "", "utf-8");
-}
-async function persistProjectLaunchRuntimeHistoryArtifacts(runtimeCodexHome, projectCodexHome) {
-    if (!runtimeCodexHome || !projectCodexHome)
-        return;
-    if (!existsSync(runtimeCodexHome))
+async function persistProjectLaunchRuntimeJsonlArtifact(source, destination, sourceRoot, destinationRoot, sourceMode, expectedSourceStat) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const destinationInspection = await inspectProjectLaunchRuntimeHistoryEntry(destination);
+        if (destinationInspection && !destinationInspection.targetStat?.isFile())
+            return;
+        const destinationPath = destinationInspection?.targetRealpath ?? destination;
+        await assertHistoryPathWithin(destinationPath, destinationRoot, true);
+        const destinationVersion = destinationInspection?.targetStat;
+        const existing = destinationInspection ? await readHistoryFileWithoutSymlink(destinationPath, false, destinationRoot) : "";
+        const sourceContents = await readHistoryFileWithoutSymlink(source, false, sourceRoot);
+        const sourceStat = await stat(source);
+        if (!hasSameHistoryVersion(sourceStat, expectedSourceStat)) {
+            throw new HistoryEntryChangedError(`history source changed during JSONL read: ${source}`);
+        }
+        const latestDestinationInspection = await inspectProjectLaunchRuntimeHistoryEntry(destination);
+        const latestDestinationVersion = latestDestinationInspection?.targetStat;
+        if ((destinationVersion && !latestDestinationVersion) ||
+            (!destinationVersion && latestDestinationVersion) ||
+            (destinationVersion && latestDestinationVersion && !hasSameHistoryVersion(latestDestinationVersion, destinationVersion))) {
+            continue;
+        }
+        const separator = existing === "" || existing.endsWith("\n") || sourceContents === "" ? "" : "\n";
+        const lines = uniqueJsonlLines(`${existing}${separator}${sourceContents}`);
+        const mode = destinationInspection?.targetStat?.mode ?? historyDestinationMode(sourceMode);
+        await writeHistoryFileAtomically(destinationPath, lines.length > 0 ? `${lines.join("\n")}\n` : "", mode, destinationRoot);
         return;
-    await mkdir(projectCodexHome, { recursive: true });
+    }
+    throw new HistoryEntryChangedError(`history destination changed during JSONL persistence: ${destination}`);
+}
+async function resolveHistoryPersistenceLockRoot(projectCodexHome, destinationRoot) {
+    const candidates = [];
     for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
-        const source = join(runtimeCodexHome, entryName);
-        if (!existsSync(source))
-            continue;
-        const sourceStat = await lstat(source);
-        if (sourceStat.isSymbolicLink())
-            continue;
         const destination = join(projectCodexHome, entryName);
-        if (sourceStat.isDirectory()) {
-            await cp(source, destination, { recursive: true, force: true, preserveTimestamps: true, verbatimSymlinks: true });
+        const inspection = await inspectProjectLaunchRuntimeHistoryEntry(destination);
+        const targetStat = inspection?.targetStat;
+        const target = inspection?.targetRealpath ?? (targetStat ? await realpath(destination).catch(() => undefined) : undefined);
+        if (!target)
             continue;
+        const anchors = [dirname(target), ...(targetStat?.isDirectory() ? [target] : [])];
+        for (const anchor of anchors) {
+            const canonicalAnchor = await realpath(anchor).catch(() => undefined);
+            if (!canonicalAnchor)
+                continue;
+            if (await access(canonicalAnchor, fsConstants.W_OK).then(() => true, () => false)) {
+                candidates.push(canonicalAnchor);
+                break;
+            }
         }
-        if (entryName === "history.jsonl" || entryName === "session_index.jsonl") {
-            await persistProjectLaunchRuntimeJsonlArtifact(source, destination);
-            continue;
-        }
-        if (sourceStat.isFile()) {
-            await copyFilePreservingTimestamps(source, destination);
-        }
+    }
+    return (candidates.length > 0 ? [...new Set(candidates)] : [destinationRoot]).sort();
+}
+async function withHistoryPersistenceLocks(roots, action) {
+    const leases = [];
+    try {
+        for (const root of [...new Set(roots)].sort())
+            leases.push(await acquireHistoryPersistenceLock(root));
+        return await action();
+    }
+    finally {
+        for (const lease of leases.reverse())
+            await releaseHistoryPersistenceLock(lease);
     }
 }
-async function ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome) {
+async function persistProjectLaunchRuntimeHistoryArtifacts(runtimeCodexHome, projectCodexHome, expectedRuntimeStat) {
+    if (!runtimeCodexHome || !projectCodexHome)
+        return true;
+    if (!existsSync(runtimeCodexHome))
+        return true;
+    await mkdir(projectCodexHome, { recursive: true });
+    const destinationRoot = await realpath(projectCodexHome);
+    const lockRoots = await resolveHistoryPersistenceLockRoot(projectCodexHome, destinationRoot);
+    return withHistoryPersistenceLocks(lockRoots, async () => {
+        let complete = true;
+        for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
+            if (expectedRuntimeStat) {
+                const runtimeStat = await lstat(runtimeCodexHome).catch(() => undefined);
+                if (!runtimeStat || !hasSameHistoryIdentity(runtimeStat, expectedRuntimeStat)) {
+                    complete = false;
+                    break;
+                }
+            }
+            const source = join(runtimeCodexHome, entryName);
+            const sourceInspection = await inspectProjectLaunchRuntimeHistoryEntry(source);
+            if (!sourceInspection?.targetStat || !isRegularHistoryTarget(sourceInspection.targetStat))
+                continue;
+            const sourcePath = sourceInspection.targetRealpath ?? source;
+            const sourceRoot = sourceInspection.targetRealpath ?? source;
+            if (!(await historyEntryStillMatches(source, sourceInspection))) {
+                complete = false;
+                continue;
+            }
+            const destination = join(projectCodexHome, entryName);
+            const destinationInspection = await inspectProjectLaunchRuntimeHistoryEntry(destination);
+            if (destinationInspection && !destinationInspection.targetStat) {
+                complete = false;
+                continue;
+            }
+            if (destinationInspection && !isRegularHistoryTarget(destinationInspection.targetStat)) {
+                complete = false;
+                continue;
+            }
+            const destinationPath = destinationInspection?.targetRealpath ?? destination;
+            const sourceCanonical = await realpath(sourcePath).catch((error) => {
+                if (isDiscardableHistoryCopyError(error))
+                    return undefined;
+                throw error;
+            });
+            const destinationCanonical = await realpath(destinationPath).catch((error) => {
+                if (isDiscardableHistoryCopyError(error))
+                    return undefined;
+                throw error;
+            });
+            if (sourceCanonical && destinationCanonical && sourceCanonical === destinationCanonical)
+                continue;
+            await assertHistoryPathWithin(destinationPath, destinationRoot, true);
+            if (sourceInspection.targetStat.isDirectory()) {
+                try {
+                    await copyProjectLaunchRuntimeHistoryDirectory(sourcePath, destinationPath, false, sourceRoot, destinationRoot, sourceInspection.targetStat);
+                }
+                catch (error) {
+                    if (isDiscardableHistoryCopyError(error)) {
+                        complete = false;
+                        continue;
+                    }
+                    throw error;
+                }
+                continue;
+            }
+            if (entryName === "history.jsonl" || entryName === "session_index.jsonl") {
+                try {
+                    await persistProjectLaunchRuntimeJsonlArtifact(sourcePath, destinationPath, sourceRoot, destinationRoot, sourceInspection.targetStat.mode, sourceInspection.targetStat);
+                }
+                catch (error) {
+                    if (isDiscardableHistoryCopyError(error)) {
+                        complete = false;
+                        continue;
+                    }
+                    throw error;
+                }
+                continue;
+            }
+            if (sourceInspection.targetStat.isFile()) {
+                try {
+                    await copyFilePreservingTimestamps(sourcePath, destinationPath, {
+                        sourceRoot,
+                        destinationRoot,
+                        expectedSourceStat: sourceInspection.targetStat,
+                    });
+                }
+                catch (error) {
+                    if (isDiscardableHistoryCopyError(error)) {
+                        complete = false;
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+        }
+        return complete;
+    });
+}
+async function ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome, skipEntryNames = new Set(), createSymlink = symlink) {
     await mkdir(projectCodexHome, { recursive: true });
     for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
+        if (skipEntryNames.has(entryName))
+            continue;
         const runtimeEntry = join(runtimeCodexHome, entryName);
         if (existsSync(runtimeEntry))
             continue;
         const projectEntry = join(projectCodexHome, entryName);
+        const projectEntryInspection = await inspectProjectLaunchRuntimeHistoryEntry(projectEntry);
+        if (projectEntryInspection &&
+            (!projectEntryInspection.targetStat || !isRegularHistoryTarget(projectEntryInspection.targetStat))) {
+            continue;
+        }
         if (entryName === "sessions") {
             await mkdir(projectEntry, { recursive: true });
         }
         else if (!existsSync(projectEntry)) {
             await writeFile(projectEntry, "");
         }
-        await linkOrCopyCodexHomeEntry(projectEntry, runtimeEntry);
+        await linkOrCopyCodexHomeEntry(projectEntry, runtimeEntry, createSymlink);
     }
 }
-async function materializeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, sourceCodexHome) {
+async function materializeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, sourceCodexHome, options = {}) {
+    const skipEntryNames = new Set();
+    const destinationRoot = await realpath(runtimeCodexHome);
     for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
         const source = join(sourceCodexHome, entryName);
-        if (!existsSync(source))
+        const sourceInspection = await inspectProjectLaunchRuntimeHistoryEntry(source);
+        if (!sourceInspection || !sourceInspection.targetStat)
+            continue;
+        if (options.onlySymlinks === true && !sourceInspection.linkStat.isSymbolicLink())
             continue;
         const destination = join(runtimeCodexHome, entryName);
+        await options.beforeCopy?.(entryName, source, destination);
+        if (!(await historyEntryStillMatches(source, sourceInspection))) {
+            skipEntryNames.add(entryName);
+            continue;
+        }
+        await options.afterValidation?.(entryName, source, destination);
+        if (!(await historyEntryStillMatches(source, sourceInspection))) {
+            skipEntryNames.add(entryName);
+            continue;
+        }
+        try {
+            const sourceStat = sourceInspection.targetStat;
+            if (!sourceStat)
+                continue;
+            const sourcePath = sourceInspection.targetRealpath ?? source;
+            if (sourceStat.isDirectory()) {
+                await replaceProjectLaunchRuntimeHistoryDirectory(sourcePath, destination, false, destinationRoot, sourceStat, options.afterStage
+                    ? (temporary, stagedDestination) => options.afterStage(entryName, temporary, stagedDestination)
+                    : undefined);
+                continue;
+            }
+            if (sourceStat.isFile()) {
+                await copyFilePreservingTimestamps(sourcePath, destination, {
+                    allowTopLevelSymlink: false,
+                    sourceRoot: sourcePath,
+                    destinationRoot,
+                    expectedSourceStat: sourceStat,
+                    afterStage: options.afterStage
+                        ? (temporary, stagedDestination) => options.afterStage(entryName, temporary, stagedDestination)
+                        : undefined,
+                    afterSourceOpen: options.afterSourceOpen
+                        ? () => options.afterSourceOpen(entryName, sourcePath)
+                        : undefined,
+                });
+            }
+        }
+        catch (error) {
+            if (isDiscardableHistoryCopyError(error)) {
+                skipEntryNames.add(entryName);
+                continue;
+            }
+            throw error;
+        }
+    }
+    return skipEntryNames;
+}
+async function copyProjectLaunchRuntimeHistoryDirectory(source, destination, allowTopLevelSymlink = false, sourceRoot = source, destinationRoot = destination, expectedSourceStat) {
+    sourceRoot = await realpath(sourceRoot);
+    destinationRoot = await realpath(destinationRoot);
+    const sourceStat = allowTopLevelSymlink ? await stat(source) : await lstat(source);
+    if (!sourceStat.isDirectory() || (!allowTopLevelSymlink && sourceStat.isSymbolicLink()))
+        return;
+    if (expectedSourceStat && !hasSameHistoryIdentity(sourceStat, expectedSourceStat)) {
+        throw new HistoryEntryChangedError(`history source changed during directory copy: ${source}`);
+    }
+    await assertHistoryPathWithin(source, sourceRoot);
+    const destinationStat = await lstat(destination).catch((error) => {
+        if (isUnresolvableHistoryLinkError(error))
+            return undefined;
+        throw error;
+    });
+    if (destinationStat && (!destinationStat.isDirectory() || destinationStat.isSymbolicLink())) {
         await rm(destination, { recursive: true, force: true });
-        const sourceStat = await lstat(source);
-        if (sourceStat.isDirectory()) {
-            await cp(source, destination, { recursive: true, force: true, dereference: true, preserveTimestamps: true });
+    }
+    await assertHistoryDestinationParentWithin(destination, destinationRoot);
+    const destinationMode = destinationStat && destinationStat.isDirectory() && !destinationStat.isSymbolicLink()
+        ? destinationStat.mode & historyDestinationMode(sourceStat.mode) & 0o7777
+        : undefined;
+    const destinationWasExistingDirectory = Boolean(destinationStat && destinationStat.isDirectory() && !destinationStat.isSymbolicLink());
+    const sourceDestinationMode = historyDestinationMode(sourceStat.mode);
+    await mkdir(destination, { recursive: true, mode: destinationMode ?? sourceDestinationMode });
+    await assertHistoryDestinationDirectorySafe(destination, destinationRoot);
+    await chmodHistoryDestination(destination, (destinationMode ?? sourceDestinationMode) | 0o700, destinationWasExistingDirectory);
+    for (const entry of await readdir(source, { withFileTypes: true })) {
+        if (entry.name === ".omx-history.lock" || entry.name.startsWith(".omx-history.lock."))
+            continue;
+        const sourceEntry = join(source, entry.name);
+        const destinationEntry = join(destination, entry.name);
+        const entryStat = await lstat(sourceEntry).catch((error) => {
+            if (isUnresolvableHistoryLinkError(error))
+                return undefined;
+            throw error;
+        });
+        if (!entryStat || entryStat.isSymbolicLink())
             continue;
+        if (entryStat.isDirectory()) {
+            await copyProjectLaunchRuntimeHistoryDirectory(sourceEntry, destinationEntry, false, sourceRoot, destinationRoot, entryStat);
+        }
+        else if (entryStat.isFile()) {
+            await copyFilePreservingTimestamps(sourceEntry, destinationEntry, {
+                sourceRoot,
+                destinationRoot,
+                expectedSourceStat: entryStat,
+            });
+        }
+    }
+    await assertHistoryDestinationDirectorySafe(destination, destinationRoot);
+    await chmodHistoryDestination(destination, destinationMode ?? sourceDestinationMode, destinationWasExistingDirectory);
+    await assertHistoryDestinationDirectorySafe(destination, destinationRoot);
+    await utimesHistoryDestination(destination, sourceStat.atime, sourceStat.mtime, destinationWasExistingDirectory);
+}
+async function replaceProjectLaunchRuntimeHistoryDirectory(source, destination, allowTopLevelSymlink, destinationRoot, expectedSourceStat, afterStage) {
+    const temporary = `${destination}.omx-history-${randomUUID()}`;
+    try {
+        const sourceStat = allowTopLevelSymlink ? await stat(source) : await lstat(source);
+        if (!sourceStat.isDirectory() || (!allowTopLevelSymlink && sourceStat.isSymbolicLink())) {
+            throw new Error(`history source is not a directory: ${source}`);
+        }
+        if (!hasSameHistoryIdentity(sourceStat, expectedSourceStat)) {
+            throw new HistoryEntryChangedError(`history source changed during directory publication: ${source}`);
+        }
+        await copyProjectLaunchRuntimeHistoryDirectory(source, temporary, allowTopLevelSymlink, source, destinationRoot, sourceStat);
+        await afterStage?.(temporary, destination);
+        const stagedStat = await lstat(temporary);
+        if (!stagedStat.isDirectory() || stagedStat.isSymbolicLink()) {
+            throw new Error(`history staging path is not a directory: ${temporary}`);
         }
-        await copyFilePreservingTimestamps(source, destination);
+        await assertHistoryDestinationParentWithin(destination, destinationRoot);
+        await publishHistoryReplacement(temporary, destination, true);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true }).catch(() => undefined);
     }
 }
 async function mergeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, sourceCodexHome, mergedHistorySourceRealpaths) {
+    const destinationRoot = await realpath(runtimeCodexHome);
     for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
         const source = join(sourceCodexHome, entryName);
-        if (!existsSync(source))
+        const sourceInspection = await inspectProjectLaunchRuntimeHistoryEntry(source);
+        if (!sourceInspection?.targetStat || !isRegularHistoryTarget(sourceInspection.targetStat))
+            continue;
+        const sourceRealpath = sourceInspection.targetRealpath ??
+            await realpath(source).catch((error) => {
+                if (isUnresolvableHistoryLinkError(error))
+                    return undefined;
+                throw error;
+            });
+        if (!sourceRealpath)
             continue;
-        const sourceRealpath = realpathSync(source);
         if (mergedHistorySourceRealpaths.has(sourceRealpath))
             continue;
+        if (!(await historyEntryStillMatches(source, sourceInspection)))
+            continue;
         const destination = join(runtimeCodexHome, entryName);
-        const sourceStat = await stat(source);
+        const sourceStat = sourceInspection.targetStat;
+        if (!sourceStat)
+            continue;
         if (sourceStat.isDirectory()) {
+            const destinationStat = await lstat(destination).catch((error) => {
+                if (isUnresolvableHistoryLinkError(error))
+                    return undefined;
+                throw error;
+            });
+            if (destinationStat && (!destinationStat.isDirectory() || destinationStat.isSymbolicLink())) {
+                await rm(destination, { recursive: true, force: true });
+            }
             await mkdir(destination, { recursive: true });
-            await cp(source, destination, { recursive: true, force: true, dereference: true, preserveTimestamps: true });
+            try {
+                await copyProjectLaunchRuntimeHistoryDirectory(sourceInspection.targetRealpath ?? source, destination, false, sourceInspection.targetRealpath ?? source, destinationRoot, sourceStat);
+            }
+            catch (error) {
+                if (isDiscardableHistoryCopyError(error))
+                    continue;
+                throw error;
+            }
             mergedHistorySourceRealpaths.add(sourceRealpath);
             continue;
         }
@@ -776,22 +1492,70 @@ async function mergeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, sourceC
             continue;
         if (!sourceStat.isFile())
             continue;
-        if (existsSync(destination)) {
-            const destinationStat = await stat(destination);
+        const destinationLinkStat = await lstat(destination).catch((error) => {
+            if (isUnresolvableHistoryLinkError(error))
+                return undefined;
+            throw error;
+        });
+        if (destinationLinkStat?.isSymbolicLink()) {
+            await rm(destination, { force: true });
+        }
+        if (destinationLinkStat && !destinationLinkStat.isSymbolicLink()) {
+            const destinationStat = destinationLinkStat;
             if (!destinationStat.isFile()) {
                 await rm(destination, { recursive: true, force: true });
-                await copyFilePreservingTimestamps(source, destination);
+                try {
+                    await copyFilePreservingTimestamps(sourceInspection.targetRealpath ?? source, destination, {
+                        allowTopLevelSymlink: false,
+                        sourceRoot: sourceInspection.targetRealpath ?? source,
+                        destinationRoot,
+                        expectedSourceStat: sourceStat,
+                    });
+                }
+                catch (error) {
+                    if (isDiscardableHistoryCopyError(error))
+                        continue;
+                    throw error;
+                }
                 mergedHistorySourceRealpaths.add(sourceRealpath);
                 continue;
             }
-            const existing = await readFile(destination, "utf-8").catch(() => "");
-            const addition = await readFile(source, "utf-8");
+            let existing;
+            let addition;
+            try {
+                existing = await readHistoryFileWithoutSymlink(destination, false, destinationRoot);
+                addition = await readHistoryFileWithoutSymlink(sourceInspection.targetRealpath ?? source, false, sourceInspection.targetRealpath ?? source);
+            }
+            catch (error) {
+                if (isDiscardableHistoryCopyError(error))
+                    continue;
+                throw error;
+            }
             const separator = existing === "" || existing.endsWith("\n") || addition === "" ? "" : "\n";
-            await writeFile(destination, `${existing}${separator}${addition}`, "utf-8");
+            try {
+                await writeHistoryFileAtomically(destination, `${existing}${separator}${addition}`, destinationStat.mode & 0o7777, destinationRoot);
+            }
+            catch (error) {
+                if (isDiscardableHistoryCopyError(error))
+                    continue;
+                throw error;
+            }
             mergedHistorySourceRealpaths.add(sourceRealpath);
             continue;
         }
-        await copyFilePreservingTimestamps(source, destination);
+        try {
+            await copyFilePreservingTimestamps(sourceInspection.targetRealpath ?? source, destination, {
+                allowTopLevelSymlink: false,
+                sourceRoot: sourceInspection.targetRealpath ?? source,
+                destinationRoot,
+                expectedSourceStat: sourceStat,
+            });
+        }
+        catch (error) {
+            if (isDiscardableHistoryCopyError(error))
+                continue;
+            throw error;
+        }
         mergedHistorySourceRealpaths.add(sourceRealpath);
     }
 }
@@ -812,7 +1576,7 @@ export async function prepareRuntimeCodexHomeForProjectLaunch(cwd, sessionId, pr
     await rm(runtimeCodexHome, { recursive: true, force: true });
     await mkdir(runtimeCodexHome, { recursive: true });
     if (!existsSync(projectCodexHome)) {
-        await ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome);
+        await ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome, new Set(), options.createSymlink);
         return runtimeCodexHome;
     }
     for (const entry of await readdir(projectCodexHome, { withFileTypes: true })) {
@@ -822,6 +1586,16 @@ export async function prepareRuntimeCodexHomeForProjectLaunch(cwd, sessionId, pr
             continue;
         const source = join(projectCodexHome, entry.name);
         const destination = join(runtimeCodexHome, entry.name);
+        if (PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES.has(entry.name)) {
+            const sourceInspection = await inspectProjectLaunchRuntimeHistoryEntry(source);
+            if (!sourceInspection?.targetStat)
+                continue;
+            if (options.includeHistoryArtifacts === true) {
+                if (!isRegularHistoryTarget(sourceInspection.targetStat))
+                    continue;
+                continue;
+            }
+        }
         if (entry.name === "config.toml") {
             const projectHooksPath = join(projectCodexHome, "hooks.json");
             const projectConfig = await readFile(source, "utf-8");
@@ -838,19 +1612,37 @@ export async function prepareRuntimeCodexHomeForProjectLaunch(cwd, sessionId, pr
         }
         await linkOrCopyCodexHomeEntry(source, destination);
     }
-    await ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome);
-    if (options.includeHistoryArtifacts === true && (options.extraHistoryCodexHomes?.length ?? 0) > 0) {
+    let skippedHistoryEntryNames = new Set();
+    if (options.includeHistoryArtifacts === true) {
+        const extraHistoryCodexHomes = options.extraHistoryCodexHomes ?? [];
+        const mergingHistory = extraHistoryCodexHomes.length > 0;
         const mergedHistorySourceRealpaths = new Set();
         for (const entryName of PROJECT_LAUNCH_DURABLE_HISTORY_ENTRY_NAMES) {
             const source = join(projectCodexHome, entryName);
-            if (existsSync(source))
-                mergedHistorySourceRealpaths.add(realpathSync(source));
+            const sourceInspection = await inspectProjectLaunchRuntimeHistoryEntry(source);
+            if (!sourceInspection?.targetStat || !isRegularHistoryTarget(sourceInspection.targetStat))
+                continue;
+            const sourceRealpath = sourceInspection.targetRealpath ??
+                await realpath(source).catch((error) => {
+                    if (isUnresolvableHistoryLinkError(error))
+                        return undefined;
+                    throw error;
+                });
+            if (sourceRealpath)
+                mergedHistorySourceRealpaths.add(sourceRealpath);
         }
-        await materializeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, projectCodexHome);
-        for (const extraCodexHome of options.extraHistoryCodexHomes ?? []) {
+        skippedHistoryEntryNames = await materializeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, projectCodexHome, {
+            onlySymlinks: !mergingHistory,
+            beforeCopy: options.beforeHistoryEntryCopy,
+            afterValidation: options.afterHistoryEntryValidation,
+            afterStage: options.afterHistoryEntryStage,
+            afterSourceOpen: options.afterHistorySourceOpen,
+        });
+        for (const extraCodexHome of extraHistoryCodexHomes) {
             await mergeProjectLaunchRuntimeHistoryEntries(runtimeCodexHome, extraCodexHome, mergedHistorySourceRealpaths);
         }
     }
+    await ensureProjectLaunchRuntimeHistoryLinks(runtimeCodexHome, projectCodexHome, skippedHistoryEntryNames, options.createSymlink);
     return runtimeCodexHome;
 }
 function resolveProjectSqliteHomeForLaunch(projectCodexHome, env) {
@@ -1013,6 +1805,8 @@ async function prepareResumeCodexHomeForLaunch(cwd, sessionId, args, env = proce
             args: selection.args,
             prepared: {
                 codexHomeOverride: runtimeCodexHome,
+                projectLocalCodexHomeForCleanup: projectHomes[0].path,
+                runtimeCodexHomeForCleanup: runtimeCodexHome,
             },
         };
     }
@@ -1044,9 +1838,36 @@ export async function persistProjectLaunchRuntimeProjectTrustState(runtimeCodexH
 export async function cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence) {
     if (!runtimeCodexHomeForCleanup)
         return;
+    const runtimeParent = dirname(runtimeCodexHomeForCleanup);
+    const initialParentStat = await lstat(runtimeParent).catch(() => undefined);
+    const initialParentRealpath = await realpath(runtimeParent).catch(() => undefined);
+    const initialRuntimeStat = await lstat(runtimeCodexHomeForCleanup).catch(() => undefined);
+    if (!initialParentStat || !initialParentRealpath || !initialRuntimeStat)
+        return;
+    if (initialParentStat.isSymbolicLink())
+        return;
+    try {
+        await assertHistoryPathWithin(runtimeCodexHomeForCleanup, initialParentRealpath);
+    }
+    catch {
+        return;
+    }
     await persistProjectLaunchRuntimeAuthState(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
-    await persistProjectLaunchRuntimeHistoryArtifacts(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
+    const historyPersisted = await persistProjectLaunchRuntimeHistoryArtifacts(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence, { dev: initialRuntimeStat.dev, ino: initialRuntimeStat.ino });
+    if (!historyPersisted)
+        return;
     await persistProjectLaunchRuntimeProjectTrustState(runtimeCodexHomeForCleanup, projectCodexHomeForPersistence);
+    const finalParentStat = await lstat(runtimeParent).catch(() => undefined);
+    const finalParentRealpath = await realpath(runtimeParent).catch(() => undefined);
+    const finalRuntimeStat = await lstat(runtimeCodexHomeForCleanup).catch(() => undefined);
+    if (!finalParentStat ||
+        finalParentStat.isSymbolicLink() ||
+        !finalParentRealpath ||
+        finalParentRealpath !== initialParentRealpath ||
+        !hasSameHistoryIdentity(finalParentStat, initialParentStat) ||
+        !finalRuntimeStat ||
+        !hasSameHistoryIdentity(finalRuntimeStat, initialRuntimeStat))
+        return;
     await rm(runtimeCodexHomeForCleanup, { recursive: true, force: true });
 }
 function execTmuxFileSync(args, options) {
@@ -1091,6 +1912,27 @@ export function parseDetachedLeaderPaneIdByPid(snapshot, leaderPid) {
         throw new Error("detached leader pane identity is unavailable");
     return matches[0];
 }
+function resolveDetachedLeaderPaneIdentity(sessionName, expectedTmuxSessionId, inheritedPane, platform, leaderPid, requireInheritedPane, probeInheritedPane, listPanes) {
+    if (inheritedPane && /^%[0-9]+$/.test(inheritedPane)) {
+        try {
+            const [observedSessionName, observedSessionId, observedPaneId] = probeInheritedPane(inheritedPane).split("\t");
+            if (observedSessionName === sessionName && observedPaneId === inheritedPane
+                && (expectedTmuxSessionId === undefined || observedSessionId === expectedTmuxSessionId))
+                return inheritedPane;
+        }
+        catch {
+            // Fall through to the platform-specific resolution policy below.
+        }
+    }
+    if (requireInheritedPane || platform === "win32") {
+        throw new Error("detached leader inherited pane identity is unavailable");
+    }
+    return parseDetachedLeaderPaneIdByPid(listPanes(), leaderPid);
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function resolveDetachedLeaderPaneForTest(options) {
+    return resolveDetachedLeaderPaneIdentity(options.sessionName, options.expectedTmuxSessionId, options.inheritedPane, options.platform, options.leaderPid, options.requireInheritedPane, () => options.identityOutput, () => options.paneSnapshot);
+}
 function detachedLeaderAuthorityCondition(authority, requireOwner = true) {
     const conditions = [
         "#{==:#{pane_dead},0}",
@@ -1104,14 +1946,17 @@ function detachedLeaderAuthorityCondition(authority, requireOwner = true) {
     ];
     return conditions.reduce((combined, condition) => `#{&&:${combined},${condition}}`);
 }
-function detachedHudAuthorityCondition(authority, requireMarker = true) {
+function detachedHudAuthorityCondition(authority, requireMarker = true, ownerId) {
     const conditions = [
         "#{==:#{pane_dead},0}",
         `#{==:#{pane_id},${authority.paneId}}`,
         `#{==:#{pane_pid},${authority.panePid}}`,
+        `#{==:#{session_name},${authority.sessionName}}`,
         `#{==:#{session_id},${authority.sessionId}}`,
+        `#{==:#{session_created},${authority.sessionCreated}}`,
         `#{==:#{window_id},${authority.windowId}}`,
         ...(requireMarker ? [`#{m:*OMX_DETACHED_HUD_OPERATION=${authority.operationMarker}*,#{pane_start_command}}`] : []),
+        ...(ownerId ? [`#{==:#{@omx_hud_owner},${ownerId}}`] : []),
     ];
     return conditions.reduce((combined, condition) => `#{&&:${combined},${condition}}`);
 }
@@ -1146,26 +1991,167 @@ function runDetachedLeaderMutation(authority, args, requireOwner = true, retryMi
     const mutation = args.length >= 4 && args[0] === "set-option" ? `${args[0]} ${args.at(-2)}` : args[0] ?? "unknown";
     throw new Error(`detached leader authority blocked tmux mutation ${mutation}: ${describeDetachedLeaderAuthorityMismatch(authority)}`);
 }
-function detachedPreReportCleanupCondition(authority) {
+function runDetachedLeaderTagMutation(authority, ownerId) {
+    const receipt = detachedAuthorityReceipt();
+    const phaseMarker = ["set-option", "-t", authority.sessionName, "@omx_detached_owner_tag_attempted", "1"].map(quoteShellArg).join(" ");
+    const ownerTag = ["set-option", "-t", authority.sessionName, OMX_INSTANCE_OPTION, ownerId].map(quoteShellArg).join(" ");
+    const success = `${phaseMarker} ; ${ownerTag} ; display-message -p ${quoteShellArg(receipt)}`;
+    const output = execTmuxFileSync([
+        "if-shell", "-F", "-t", authority.paneId, detachedLeaderAuthorityCondition(authority, false),
+        success, "display-message -p ''",
+    ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (output !== receipt)
+        throw new Error(`detached leader authority blocked tmux mutation tag-session: ${describeDetachedLeaderAuthorityMismatch(authority)}`);
+}
+/**
+ * #3578: session-scoped fence for pre-report cleanup when the leader pane no
+ * longer exists at all. A normal leader exit with `remain-on-exit off` (set by
+ * the tag-session step) removes the pane, so the pane-dead predicate above can
+ * never match and rollback leaked a HUD-only session. The replacement fence is
+ * evaluated against the SESSION (a server-scoped stable identity), not a pane:
+ * exact session_name + session_id + session_created, plus either this launch's
+ * @omx_instance_id owner tag or the empty owner state that exists before the
+ * tag-session step succeeds. A foreign tag is never accepted. The leader-pane
+ * probe is retained as a fail-closed existence check, but is not reused as a
+ * pane-targeted destructive sink; a replacement session has a different
+ * session_id/session_created and fails the session fence.
+ */
+function detachedPreReportSessionCleanupCondition(authority, allowUnownedPreTag, requireCapturedDeadPane) {
+    // The tag-session step is the first mutation after new-session. A bootstrap
+    // failure can therefore leave a retained dead leader pane in a session whose
+    // exact identity is ours but whose owner option is still unset. When the
+    // caller has authenticated the pre-tag phase, accept only that empty state
+    // or our expected tag; otherwise require our expected tag. A foreign tag
+    // remains a hard denial. Session id + creation time prevent a name-reused
+    // session from satisfying the pre-tag branch.
+    const owner = allowUnownedPreTag
+        ? `#{||:#{==:#{@omx_instance_id},${authority.ownerId}},#{==:#{@omx_instance_id},}}`
+        : `#{==:#{@omx_instance_id},${authority.ownerId}}`;
     const conditions = [
-        "#{==:#{pane_dead},1}",
-        `#{==:#{pane_id},${authority.paneId}}`,
         `#{==:#{session_name},${authority.sessionName}}`,
         `#{==:#{session_id},${authority.sessionId}}`,
         `#{==:#{session_created},${authority.sessionCreated}}`,
-        `#{==:#{window_id},${authority.windowId}}`,
+        owner,
     ];
+    if (requireCapturedDeadPane) {
+        // The session target resolves the active pane without using a pane target.
+        // If the captured dead pane was respawned, its PID or liveness changes and
+        // this single queued tmux predicate refuses the destructive sink. If a
+        // different pane is active, preserving is the only safe result.
+        conditions.push(`#{==:#{pane_id},${authority.paneId}}`, `#{==:#{pane_pid},${authority.panePid}}`, "#{==:#{pane_dead},1}");
+    }
     return conditions.reduce((combined, condition) => `#{&&:${combined},${condition}}`);
 }
-export function cleanupDetachedPreReportSession(authority) {
+function detachedPreReportLeaderPaneState(authority) {
+    // Enumerate the exact named session and classify the captured pane before any
+    // destructive command. A live captured leader is always preserved: a report
+    // can arrive after the final file read and before a separate tmux command,
+    // so timeout-based cleanup must never kill a pane that is still running.
+    // Enumeration failures (notably the exact session no longer exists) are
+    // fail-closed: unknown topology preserves without mutation.
+    try {
+        const sessionTarget = authority.sessionName;
+        const output = execTmuxFileSync(["list-panes", "-s", "-t", sessionTarget, "-F", "#{pane_id}\t#{pane_dead}"], {
+            encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"],
+        });
+        const row = output.split("\n").map((line) => line.trim()).filter(Boolean).find((line) => line.split("\t")[0] === authority.paneId);
+        if (!row)
+            return "absent";
+        const paneDead = row.split("\t")[1];
+        if (paneDead === "1")
+            return "dead";
+        if (paneDead === "0")
+            return "live";
+        return "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function detachedSessionExists(sessionName) {
+    try {
+        execTmuxFileSync(["has-session", "-t", sessionName], {
+            encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function cleanupDetachedPreReportSessionInternal(authority, afterTopologyProbe, allowUnownedPreTag = false, authenticatedReadyOrTerminalProbe, afterAuthenticatedReadyOrTerminalProbe) {
     const receipt = detachedAuthorityReceipt();
-    const success = `kill-session -t ${quoteShellArg(authority.sessionName)} ; display-message -p ${quoteShellArg(receipt)}`;
-    const output = execTmuxFileSync([
-        "if-shell", "-F", "-t", authority.paneId, detachedPreReportCleanupCondition(authority),
+    const sessionTarget = authority.sessionName;
+    const success = `kill-session -t ${quoteShellArg(sessionTarget)} ; display-message -p ${quoteShellArg(receipt)}`;
+    // #3562/#3578: probe the exact session topology for diagnostics, but never
+    // feed the captured pane id into the destructive sink. The probe is
+    // non-atomic; a leader pane can disappear or be reused before the sink runs.
+    // The sink therefore targets only the session name and rechecks the complete
+    // session identity plus the authenticated owner/pre-tag fence in the same
+    // tmux command queue.
+    const paneState = detachedPreReportLeaderPaneState(authority);
+    if (paneState === "unknown")
+        throw new Error("detached pre-report topology changed before cleanup");
+    afterTopologyProbe?.();
+    const authenticatedReady = authenticatedReadyOrTerminalProbe?.() === true;
+    afterAuthenticatedReadyOrTerminalProbe?.();
+    if (authenticatedReady) {
+        throw new Error("detached leader became ready or terminal before pre-report cleanup");
+    }
+    if (paneState === "live")
+        return "preserved-live";
+    const sessionScoped = execTmuxFileSync([
+        "if-shell", "-F", "-t", sessionTarget, detachedPreReportSessionCleanupCondition(authority, allowUnownedPreTag, paneState === "dead"),
         success, "display-message -p ''",
     ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (output !== receipt)
+    if (sessionScoped !== receipt)
         throw new Error("detached pre-report topology changed before cleanup");
+    return "cleaned";
+}
+function cleanupDetachedPreReportSessionWithRetry(authority, allowUnownedPreTag, authenticatedReadyOrTerminalProbe, authenticatedFailedReportProbe, retryAuthenticatedFailure = true) {
+    let result;
+    try {
+        result = cleanupDetachedPreReportSessionInternal(authority, undefined, allowUnownedPreTag, authenticatedReadyOrTerminalProbe);
+    }
+    catch (error) {
+        // A failed leader may have already removed its own exact session before
+        // the parent reaches rollback. Only an authenticated failed report permits
+        // acknowledging that disappearance as completed cleanup.
+        if (authenticatedFailedReportProbe?.() && !detachedSessionExists(authority.sessionName))
+            return "cleaned";
+        throw error;
+    }
+    if (result === "cleaned" || !retryAuthenticatedFailure || !authenticatedFailedReportProbe?.())
+        return result;
+    // A failed report may be published while the leader pane is still live. Do
+    // not treat that observation as successful cleanup: retain the marker and
+    // retry the identity-fenced decision after the leader exits. A later ready,
+    // terminal, respawn, or ownership change fails closed inside the retry.
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        blockMs(20);
+        try {
+            result = cleanupDetachedPreReportSessionInternal(authority, undefined, allowUnownedPreTag, authenticatedReadyOrTerminalProbe);
+        }
+        catch (error) {
+            if (authenticatedFailedReportProbe() && !detachedSessionExists(authority.sessionName))
+                return "cleaned";
+            throw error;
+        }
+        if (result === "cleaned")
+            return result;
+    }
+    throw new Error("detached leader remained live before pre-report cleanup retry");
+}
+export function cleanupDetachedPreReportSession(authority, allowUnownedPreTag = false, authenticatedReadyOrTerminalProbe, authenticatedFailedReportProbe, retryAuthenticatedFailure = true) {
+    return cleanupDetachedPreReportSessionWithRetry(authority, allowUnownedPreTag, authenticatedReadyOrTerminalProbe, authenticatedFailedReportProbe, retryAuthenticatedFailure);
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function cleanupDetachedPreReportSessionForTest(authority, afterTopologyProbe, allowUnownedPreTag = false, authenticatedReadyOrTerminalProbe, afterAuthenticatedReadyOrTerminalProbe, retryAfterLive = false, authenticatedFailedReportProbe) {
+    const result = cleanupDetachedPreReportSessionInternal(authority, afterTopologyProbe, allowUnownedPreTag, authenticatedReadyOrTerminalProbe, afterAuthenticatedReadyOrTerminalProbe);
+    if (retryAfterLive && result === "preserved-live") {
+        cleanupDetachedPreReportSessionWithRetry(authority, allowUnownedPreTag, authenticatedReadyOrTerminalProbe, authenticatedFailedReportProbe);
+    }
 }
 function runDetachedHudMutation(leaderAuthority, hudAuthority, args, requireMarker = true) {
     const receipt = detachedAuthorityReceipt();
@@ -1178,47 +2164,151 @@ function runDetachedHudMutation(leaderAuthority, hudAuthority, args, requireMark
     if (output !== receipt)
         throw new Error("detached leader or HUD authority changed before tmux mutation");
 }
-export function cleanupDetachedHudPane(authority, ownerId) {
-    if (ownerId) {
-        execTmuxFileSync(["kill-pane", "-t", authority.paneId], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
-    }
-    else {
-        execTmuxFileSync([
-            "if-shell", "-F", "-t", authority.paneId, detachedHudAuthorityCondition(authority, false),
-            `kill-pane -t ${quoteShellArg(authority.paneId)}`, "",
+function detachedHudPaneProofFormat() {
+    // The trailing literal sentinel keeps an empty @omx_hud_owner from being
+    // trimmed away as trailing whitespace by tmux's format output.
+    return "#{pane_id}\t#{pane_pid}\t#{session_name}\t#{session_id}\t#{session_created}\t#{window_id}\t#{pane_dead}\t#{@omx_hud_owner}\t#{pane_start_command}\tEND";
+}
+function parseDetachedHudPaneProofLine(line) {
+    const fields = line.split("\t");
+    // Seven fixed fields, then @omx_hud_owner, then pane_start_command (which may
+    // itself contain TAB bytes), then the literal END sentinel.
+    if (fields.length < 10 || fields.at(-1) !== "END")
+        return undefined;
+    const [paneId, panePid, sessionName, sessionId, sessionCreated, windowId, paneDead, hudOwner] = fields;
+    const paneStartCommand = fields.slice(8, -1).join("\t");
+    return {
+        paneId: paneId ?? "", panePid: panePid ?? "", sessionName: sessionName ?? "",
+        sessionId: sessionId ?? "", sessionCreated: sessionCreated ?? "", windowId: windowId ?? "",
+        paneDead: paneDead ?? "", paneStartCommand, hudOwner: hudOwner ?? "",
+    };
+}
+function matchesDetachedHudAuthority(proof, authority, ownerId) {
+    if (proof.paneId !== authority.paneId)
+        return false;
+    if (Number(proof.panePid) !== authority.panePid)
+        return false;
+    if (proof.paneDead !== "0")
+        return false;
+    if (proof.sessionName !== authority.sessionName)
+        return false;
+    if (proof.sessionId !== authority.sessionId)
+        return false;
+    if (proof.sessionCreated !== authority.sessionCreated)
+        return false;
+    if (proof.windowId !== authority.windowId)
+        return false;
+    // Marker non-vacuity: tmux reports pane_start_command wrapped in double
+    // quotes; the command must begin with the exact env assignment the
+    // production split sink injects. A pane whose command merely contains the
+    // marker text (e.g. an echo) is not the HUD.
+    const markerPrefix = `env OMX_DETACHED_HUD_OPERATION=${authority.operationMarker} `;
+    const startCommand = proof.paneStartCommand.replace(/^"|"$/g, "");
+    if (!startCommand.startsWith(markerPrefix))
+        return false;
+    if (ownerId !== undefined && proof.hudOwner !== ownerId)
+        return false;
+    return true;
+}
+/**
+ * Enumerate the exact expected HUD pane inside its proven session scope and
+ * evaluate the full proof locally. The tmux enumeration target is the session
+ * name (a server-scoped stable identity), never the pane id: a stale or
+ * missing pane proof must resolve to an ordinary fail-closed preserve result
+ * instead of an `if-shell -t <stale pane>` evaluation that can tear down the
+ * server with the leader and any replacement/foreign panes (#3562).
+ * `-s` widens the enumeration to every window of the session: an attached user
+ * may select another window, and a window-scoped listing would hide a fully
+ * matching HUD in the original window (#3562 review).
+ *
+ * Preserve (undefined) on malformed enumeration output and any tmux command
+ * failure; callers preserve on zero or multiple authority matches.
+ */
+function listDetachedHudPaneProofsInSession(authority) {
+    try {
+        const output = execTmuxFileSync([
+            "list-panes", "-s", "-t", authority.sessionName, "-F", detachedHudPaneProofFormat(),
         ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+        const proofs = [];
+        for (const line of output.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            const proof = parseDetachedHudPaneProofLine(trimmed);
+            if (!proof)
+                return undefined;
+            proofs.push(proof);
+        }
+        return proofs;
+    }
+    catch {
+        return undefined;
+    }
+}
+function removeDetachedHudPaneIfAuthorized(authority, ownerId) {
+    const proofs = listDetachedHudPaneProofsInSession(authority);
+    if (!proofs)
+        return false;
+    const matching = proofs.filter((proof) => matchesDetachedHudAuthority(proof, authority, ownerId));
+    if (matching.length !== 1)
+        return false;
+    const receipt = detachedAuthorityReceipt();
+    const killed = `killed:${receipt}`;
+    const mismatched = `mismatch:${receipt}`;
+    try {
+        const output = execTmuxFileSync([
+            "if-shell", "-F", "-t", matching[0].paneId,
+            detachedHudAuthorityCondition(authority, true, ownerId),
+            `kill-pane -t ${quoteShellArg(matching[0].paneId)} ; display-message -p ${quoteShellArg(killed)}`,
+            `display-message -p ${quoteShellArg(mismatched)}`,
+        ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return output === killed;
+    }
+    catch {
+        return false;
     }
+}
+function awaitDetachedHudPaneRemoval(paneId) {
     for (let attempt = 0; attempt < 50; attempt += 1) {
         const panes = execTmuxFileSync(["list-panes", "-a", "-F", "#{pane_id}"], {
             encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"],
         }).split("\n").map((value) => value.trim()).filter(Boolean);
-        if (!panes.includes(authority.paneId))
+        if (!panes.includes(paneId))
             return;
         blockMs(20);
     }
     throw new Error("detached HUD topology changed before teardown");
 }
+export function cleanupDetachedHudPane(authority, ownerId) {
+    if (!removeDetachedHudPaneIfAuthorized(authority, ownerId)) {
+        // A stale, missing, or changed proof is an ordinary fail-closed preserve
+        // result. Throwing here would let callers escalate a benign mismatch into
+        // broader cleanup; the HUD pane and its session are left untouched.
+        return false;
+    }
+    awaitDetachedHudPaneRemoval(authority.paneId);
+    return true;
+}
+/**
+ * Remove the bootstrap HUD after an authenticated finalized leader result.
+ *
+ * The outer launcher retained the original HUD proof while creating the pane.
+ * Revalidate that proof and its owner tag at the tmux mutation sink so failure
+ * cleanup stays fail-closed when a pane is replaced or taken over.
+ */
+export function cleanupFinalizedDetachedHud(expected, ownerId) {
+    if (!expected)
+        return false;
+    if (!removeDetachedHudPaneIfAuthorized(expected, ownerId))
+        return false;
+    awaitDetachedHudPaneRemoval(expected.paneId);
+    return true;
+}
 function tagDetachedHudPane(leaderAuthority, authority, ownerId) {
     runDetachedHudMutation(leaderAuthority, authority, [
         "set-option", "-pq", "-t", authority.paneId, "@omx_hud_owner", ownerId,
     ], false);
 }
-export function discoverDetachedHudAuthority(sessionName, ownerId) {
-    const rows = execTmuxFileSync([
-        "list-panes", "-a", "-F",
-        "#{pane_id}\t#{pane_dead}\t#{pane_pid}\t#{session_name}\t#{session_id}\t#{session_created}\t#{window_id}\t#{@omx_hud_owner}",
-    ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
-    const matches = rows.split("\n").map((line) => line.trim()).filter(Boolean).flatMap((line) => {
-        const [paneId, paneDead, panePidRaw, discoveredSessionName, sessionId, sessionCreated, windowId, owner] = line.split("\t");
-        const panePid = Number(panePidRaw);
-        if (paneDead !== "0" || discoveredSessionName !== sessionName || owner !== ownerId || !/^%\d+$/.test(paneId ?? "") || !/^\$\d+$/.test(sessionId ?? "") || !/^\d+$/.test(sessionCreated ?? "") || !/^@\d+$/.test(windowId ?? "") || !Number.isSafeInteger(panePid) || panePid <= 0)
-            return [];
-        return [{ paneId: paneId, panePid, sessionId: sessionId, sessionCreated: sessionCreated, windowId: windowId, operationMarker: randomUUID() }];
-    });
-    if (matches.length > 1)
-        throw new Error("multiple detached HUD ownership tags found");
-    return matches[0];
-}
 function buildDeferredDetachedHudGuard(leaderAuthority, hudAuthority, command) {
     const deferredReceipt = detachedAuthorityReceipt();
     let guardedSinkCount = 0;
@@ -1281,20 +2371,20 @@ function runDetachedLeaderSplit(authority, args) {
         throw new Error("invalid detached HUD split receipt format");
     const commandIndex = splitArgs.length - 1;
     splitArgs[commandIndex] = `env OMX_DETACHED_HUD_OPERATION=${operationMarker} ${splitArgs[commandIndex]}`;
-    splitArgs[formatIndex + 1] = `#{pane_id}\t#{pane_pid}\t#{session_id}\t#{window_id}\t${receipt}`;
+    splitArgs[formatIndex + 1] = `#{pane_id}\t#{pane_pid}\t#{session_name}\t#{session_id}\t#{session_created}\t#{window_id}\t${receipt}`;
     const output = execTmuxFileSync([
         "if-shell", "-F", "-t", authority.paneId, detachedLeaderAuthorityCondition(authority),
         splitArgs.map(quoteShellArg).join(" "), "display-message -p ''",
     ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    const [paneId, panePid, sessionId, windowId, observedReceipt, ...extra] = output.split("\t");
-    if (!/^%[0-9]+$/.test(paneId) || !/^[1-9][0-9]*$/.test(panePid) || !/^\$[0-9]+$/.test(sessionId)
-        || !/^@[0-9]+$/.test(windowId) || observedReceipt !== receipt || extra.length !== 0) {
+    const [paneId, panePid, sessionName, sessionId, sessionCreated, windowId, observedReceipt, ...extra] = output.split("\t");
+    if (!/^%[0-9]+$/.test(paneId) || !/^[1-9][0-9]*$/.test(panePid) || !sessionName || !/^\$[0-9]+$/.test(sessionId)
+        || !/^\d+$/.test(sessionCreated) || !/^@[0-9]+$/.test(windowId) || observedReceipt !== receipt || extra.length !== 0) {
         throw new Error("detached leader authority changed before HUD split");
     }
     const parsedPid = Number(panePid);
     if (!Number.isSafeInteger(parsedPid) || parsedPid <= 0)
         throw new Error("malformed detached HUD authority");
-    return { paneId, panePid: parsedPid, sessionId, windowId, operationMarker };
+    return { paneId, panePid: parsedPid, sessionName, sessionId, sessionCreated, windowId, operationMarker };
 }
 function readTmuxEnvValueForTarget(targetPaneId) {
     if (!targetPaneId.startsWith("%"))
@@ -1418,6 +2508,34 @@ function reportOrdinaryLaunchRootConflict(error, cwd, ordinaryLaunch) {
         "[omx] cmd.exe: set \"OMX_ROOT=%USERPROFILE%\\.omx\\instances\\second-conversation\" && omx\n" +
         "[omx] The selected OMX_ROOT is used literally; OMX does not reroute or allocate one automatically.");
 }
+/**
+ * #3578: a detached leader's session-pointer abort previously died with the
+ * leader pane. The validated abort code now reaches the outer launcher; print
+ * the same bounded, actionable guidance the ordinary launch path prints.
+ * `cwd` selects the root that produced the conflict, mirroring the ordinary
+ * path's cwd-default gating without weakening any ownership check.
+ */
+export function reportDetachedSessionPointerGuidance(error, cwd = process.cwd()) {
+    const candidate = findDetachedSessionPointerAbort(error);
+    if (!candidate)
+        return;
+    if (candidate.code === "session_pointer_owner_conflict") {
+        // Rebuild a well-formed SessionPointerLaunchAbort so reportOrdinaryLaunchRootConflict's
+        // isSessionPointerLaunchAbort gate (name/committed/cwd/operation/code) accepts it,
+        // then reuse the ordinary path's exact OMX_ROOT guidance block unchanged.
+        reportOrdinaryLaunchRootConflict(Object.assign(new Error("Session pointer sess-live-owner conflicts with an active session; launch aborted"), {
+            name: "SessionPointerLaunchAbort",
+            committed: false,
+            cwd,
+            operation: "detached-leader-pre-bind",
+            code: candidate.code,
+        }), cwd, true);
+        return;
+    }
+    if (candidate.code === "session_pointer_unusable") {
+        console.error("[omx] the selected session pointer is unusable; run `omx doctor` for the exact pointer status and bounded recovery steps.");
+    }
+}
 function logCliOperationFailure(error) {
     if (isMissingTmuxLaunchNoise(error))
         return;
@@ -2273,13 +3391,41 @@ export class DetachedLaunchSafetyError extends Error {
     cause;
     report;
     name = "DetachedLaunchSafetyError";
-    constructor(phase, cause, report) {
-        super(`detached launch safety failure during ${phase}${cause instanceof Error ? `: ${describeDetachedLeaderFailure(cause)}` : ""}`);
+    /**
+     * The exact bootstrap step that failed, when the failure came from a named
+     * detached tmux step (#3578). `phase` stays the coarse D-state group; `step`
+     * disambiguates `tag-session`, its follow-on mutations, the HUD split, and
+     * every finalize step that previously collapsed into `pane-id`.
+     */
+    step;
+    constructor(phase, cause, report, step) {
+        super(`detached launch safety failure during ${phase}${step && step !== phase ? ` (${step})` : ""}${cause instanceof Error ? `: ${describeDetachedLeaderFailure(cause)}` : ""}`);
         this.phase = phase;
         this.cause = cause;
         this.report = report;
+        if (step)
+            this.step = step;
     }
 }
+export function isExactDetachedFinalization(finalization, expected) {
+    return finalization !== undefined && (finalization.kind === "failed" || finalization.kind === "terminal") &&
+        finalization.nonce === expected.nonce &&
+        finalization.sessionId === expected.sessionId && finalization.sessionName === expected.sessionName &&
+        finalization.leaderPid === expected.leaderPid;
+}
+function authenticatedDetachedFinalization(resolution) {
+    if (resolution?.acknowledged !== true || !resolution.nonce || !resolution.sessionId || !resolution.sessionName ||
+        typeof resolution.leaderPid !== "number" || !Number.isSafeInteger(resolution.leaderPid) ||
+        (resolution.kind !== "failed" && resolution.kind !== "terminal"))
+        return undefined;
+    return {
+        nonce: resolution.nonce,
+        sessionId: resolution.sessionId,
+        sessionName: resolution.sessionName,
+        leaderPid: resolution.leaderPid,
+        kind: resolution.kind,
+    };
+}
 export class DetachedTransportUnavailable extends Error {
     reason;
     name = "DetachedTransportUnavailable";
@@ -2298,6 +3444,7 @@ export async function executeDetachedLaunchStateMachine(input, deps) {
     let released = false;
     let retainedAuthority = false;
     let rollbackAuthorized = false;
+    let finalization;
     try {
         transition("D1");
         binding = await deps.establish();
@@ -2347,8 +3494,8 @@ export async function executeDetachedLaunchStateMachine(input, deps) {
                 released = true;
                 throw new AggregateError([releaseError, abortError], "detached release and abort publication both failed");
             }
-            rollbackAuthorized = resolution?.acknowledged === true && Boolean(resolution.nonce && resolution.sessionId && resolution.sessionName &&
-                Number.isSafeInteger(resolution.leaderPid) && resolution.kind);
+            finalization = authenticatedDetachedFinalization(resolution);
+            rollbackAuthorized = finalization !== undefined;
             if (!rollbackAuthorized)
                 released = true;
             throw releaseError;
@@ -2362,8 +3509,8 @@ export async function executeDetachedLaunchStateMachine(input, deps) {
         if (retainedAuthority && !rollbackAuthorized && !released) {
             try {
                 const resolution = await deps.abortAndAwaitFinalization?.(error);
-                rollbackAuthorized = resolution?.rollbackAuthorized === true || (resolution?.acknowledged === true && Boolean(resolution.nonce && resolution.sessionId && resolution.sessionName &&
-                    Number.isSafeInteger(resolution.leaderPid) && resolution.kind));
+                finalization = authenticatedDetachedFinalization(resolution);
+                rollbackAuthorized = resolution?.rollbackAuthorized === true || finalization !== undefined;
                 if (!rollbackAuthorized)
                     released = true;
             }
@@ -2375,7 +3522,7 @@ export async function executeDetachedLaunchStateMachine(input, deps) {
         if (!released) {
             try {
                 report.rollback.attempted.push("rollback");
-                await deps.rollback(ownedRecord, report);
+                await deps.rollback(ownedRecord, report, finalization);
             }
             catch (rollbackError) {
                 report.rollback.failures.push({ step: "rollback", status: "failed", code: detachedFailureCode(rollbackError) });
@@ -2383,7 +3530,7 @@ export async function executeDetachedLaunchStateMachine(input, deps) {
             }
         }
         if (error instanceof DetachedLaunchSafetyError) {
-            throw new DetachedLaunchSafetyError(error.phase, error.cause, report);
+            throw new DetachedLaunchSafetyError(error.phase, error.cause, report, error.step);
         }
         const phase = report.transitions.at(-1);
         const phaseName = phase === "D1" ? "establishment"
@@ -2475,6 +3622,7 @@ function renderDetachedLaunchSafetyReport(error) {
     }));
     return JSON.stringify({
         phase: error.phase,
+        ...(error.step ? { step: error.step } : {}),
         failure: describeDetachedLeaderFailure(error.cause),
         transitions: error.report.transitions,
         ...(establishmentCleanup ? { establishmentCleanup } : {}),
@@ -2767,6 +3915,7 @@ export async function main(args) {
         if (err instanceof DetachedLaunchSafetyError) {
             console.error(`Error: ${err.message}`);
             console.error(`[omx] detached launch safety report: ${renderDetachedLaunchSafetyReport(err)}`);
+            reportDetachedSessionPointerGuidance(err.cause);
         }
         else {
             console.error(`Error: ${err instanceof Error ? err.message : err}`);
@@ -3769,16 +4918,100 @@ function buildDetachedWindowsLeaderCommand(cwd, sessionName, codexCmd, sessionId
     const invocation = `& ${quotePowerShellArg(process.execPath)} ${quotePowerShellArg(omxBin)} __detached-session-leader ${quotePowerShellArg(payload)}`;
     return `powershell.exe -NoLogo -NoProfile -NonInteractive -Command ${quotePowerShellArg(invocation)}`;
 }
-export function isDetachedReadyReportAuthorized(report, expected) {
+/**
+ * #3578: forward only the bounded machine-readable abort code of a leader-side
+ * session-pointer abort into the failed report. The human reason travels in
+ * `error`; nothing else from the nested error object is copied, so arbitrary
+ * nested errors are never dumped into the report.
+ */
+function detachedSessionPointerAbortCode(failure) {
+    if (isSessionPointerLaunchAbort(failure))
+        return { abortCode: failure.code };
+    // #3578: the leader's terminal catch wraps non-finalized failures in an
+    // AggregateError (launch + lifecycle errors). The session-pointer abort can
+    // only be the launch-side member, never the lifecycle error, so a bounded
+    // one-level unwrap keeps the code without copying anything else.
+    if (failure instanceof AggregateError) {
+        for (const member of failure.errors) {
+            if (isSessionPointerLaunchAbort(member))
+                return { abortCode: member.code };
+        }
+    }
+    return {};
+}
+/**
+ * #3578: rebuild a leader-side session-pointer abort (code + reason only) from
+ * a validated failed report so the outer launcher can present the same
+ * actionable guidance the ordinary launch path prints. Non-abort failures keep
+ * a plain Error carrying the leader's bounded reason.
+ */
+function detachedLeaderFailureError(report) {
+    const reason = report.error || "detached leader setup failed";
+    if (!report.abortCode)
+        return new Error(reason);
+    const error = new Error(reason);
+    error.code = report.abortCode;
+    error.abortedSessionPointer = true;
+    return error;
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function detachedLeaderFailureErrorForTest(report) {
+    return detachedLeaderFailureError({
+        version: 1, kind: "failed", nonce: "test", sessionId: "test-session", sessionName: "test-name",
+        ...report,
+    });
+}
+/**
+ * #3578: recognize the bounded abort marker set by {@link detachedLeaderFailureError}
+ * directly on an error or on the launch-side member of a wrapping AggregateError.
+ * The D2 completion path wraps the leader's error in an AggregateError before the
+ * outer launcher sees it; without this unwrap the actionable abort code would be
+ * invisible to the guidance printer.
+ */
+function findDetachedSessionPointerAbort(error) {
+    const candidates = [error];
+    if (error instanceof AggregateError)
+        candidates.push(...error.errors);
+    for (const candidate of candidates) {
+        const marker = candidate;
+        if (marker && marker.abortedSessionPointer === true && typeof marker.code === "string") {
+            return { code: marker.code };
+        }
+    }
+    return undefined;
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function isDetachedSessionPointerAbortCarried(error) {
+    return findDetachedSessionPointerAbort(error) !== undefined;
+}
+export function isDetachedReadyReportAuthorized(report, expected, platform = process.platform) {
     if (report?.kind !== "ready" || report.nonce !== expected.nonce
         || report.sessionId !== expected.sessionId || report.sessionName !== expected.sessionName
         || typeof report.leaderPid !== "number" || report.leaderPid <= 0)
         return false;
+    if (platform === "win32")
+        return report.paneId === expected.leaderPaneId;
     if (expected.shouldAttach && expected.leaderPanePid !== null) {
         return report.leaderPid === expected.leaderPanePid;
     }
     return report.paneId === expected.leaderPaneId;
 }
+function isDetachedTerminalReportAuthorized(report, expected, platform = process.platform) {
+    if (report?.kind !== "terminal" || report.finalized !== true)
+        return false;
+    return isDetachedReadyReportAuthorized({ ...report, kind: "ready" }, expected, platform);
+}
+function isDetachedFailedReportAuthorized(report, expected, platform = process.platform) {
+    return report?.kind === "failed" && report.nonce === expected.nonce
+        && report.sessionId === expected.sessionId && report.sessionName === expected.sessionName
+        && report.paneId === expected.leaderPaneId
+        && typeof report.leaderPid === "number" && report.leaderPid > 0
+        && (platform === "win32" || expected.leaderPanePid === null || report.leaderPid === expected.leaderPanePid);
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function isDetachedFailedReportAuthorizedForTest(report, expected, platform) {
+    return isDetachedFailedReportAuthorized(report, expected, platform);
+}
 function writeDetachedLeaderReport(path, report) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -3834,6 +5067,8 @@ function readDetachedLeaderReport(path) {
             return undefined;
         if (report.exitStatus !== undefined && (!Number.isSafeInteger(report.exitStatus) || Number(report.exitStatus) < 0 || Number(report.exitStatus) > 255))
             return undefined;
+        if (report.abortCode !== undefined && (typeof report.abortCode !== "string" || report.abortCode.length > 128 || !/^[a-z_]+$/.test(report.abortCode)))
+            return undefined;
         return report;
     }
     catch {
@@ -5045,9 +6280,11 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
         let detachedHudAuthority = null;
         let detachedLeaderPid = null;
         let rollbackFromPreReportAuthority = false;
+        let rollbackFromAuthenticatedFailure = false;
         let attachStep = null;
         const launchDetachedSession = async () => {
             let createdSession = false;
+            let detachedLeaderOwnerTagInstalled = false;
             const bootstrapLeader = async () => {
                 if (!nativeWindows)
                     detachedParentEnvFilePath = writeDetachedSessionParentEnvFile(cwd, sessionId, codexEnvWithNotify);
@@ -5073,7 +6310,8 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                         if (!authority)
                             throw new Error("detached leader authority missing before tmux mutation");
                         if (step.name === "tag-session") {
-                            runDetachedLeaderMutation(authority, step.args, false);
+                            runDetachedLeaderTagMutation(authority, sessionId);
+                            detachedLeaderOwnerTagInstalled = true;
                             // tmux can acknowledge the session tag before the first owner-format
                             // evaluation sees it. Retrying this idempotent first owner-guarded
                             // mutation once gives the server a command boundary without relaxing
@@ -5111,7 +6349,7 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                         }
                     }
                     catch (error) {
-                        throw new DetachedLaunchSafetyError(step.name === "new-session" ? "inert-session" : "pane-id", error, detachedPreflight.report);
+                        throw new DetachedLaunchSafetyError(step.name === "new-session" ? "inert-session" : "pane-id", error, detachedPreflight.report, step.name);
                     }
                 }
                 return undefined;
@@ -5134,11 +6372,34 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                             return { kind: "success" };
                         }
                         if (report?.nonce === detachedLaunchNonce && report.sessionId === sessionId && report.sessionName === sessionName && report.leaderPid && report.kind === "failed") {
+                            if (!isDetachedFailedReportAuthorized(report, {
+                                nonce: detachedLaunchNonce,
+                                sessionId,
+                                sessionName,
+                                leaderPaneId: detachedLeaderPaneId,
+                                leaderPanePid: detachedLeaderAuthority?.panePid ?? null,
+                            })) {
+                                throw new Error("detached failed report is not authorized");
+                            }
                             detachedLeaderPid = report.leaderPid;
-                            return { kind: "failure", operation: "session-instructions", error: new Error(report.error || "detached leader setup failed") };
+                            // #3578: a failed leader report is terminal evidence. A leader that
+                            // never reached readiness cannot hold pointer authority, so the
+                            // outer launcher owns the pre-report tmux topology it created and
+                            // may roll it back through the captured authority — never through
+                            // the wait-for-finalization path, which only a ready leader can
+                            // satisfy and would otherwise stall 30s and skip rollback.
+                            rollbackFromPreReportAuthority = detachedLeaderAuthority !== null;
+                            rollbackFromAuthenticatedFailure = rollbackFromPreReportAuthority;
+                            return { kind: "failure", operation: "session-instructions", error: detachedLeaderFailureError(report) };
                         }
-                        if (Date.now() >= readyDeadline)
+                        if (Date.now() >= readyDeadline) {
+                            // A timeout still owns the created pre-report topology. Keep
+                            // the marker and authorize the asynchronous watcher so a
+                            // failed report published just after this boundary can trigger
+                            // cleanup after the leader exits without blocking completion.
+                            rollbackFromPreReportAuthority = detachedLeaderAuthority !== null;
                             return { kind: "failure", operation: "session-instructions", error: new Error("detached leader readiness timed out") };
+                        }
                         blockMs(20);
                     }
                 },
@@ -5188,7 +6449,13 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                     // The leader has the retained binding. Publishing abort is the only
                     // outer action permitted after a D9 write failure; a mismatched or
                     // missing report leaves every artifact and the tmux session intact.
-                    if (!detachedLeaderPid) {
+                    if (!detachedLeaderPid || rollbackFromPreReportAuthority) {
+                        // #3578: either the leader was never observed (classic timeout /
+                        // bootstrap abort) or it already reported a terminal failure before
+                        // readiness — in both cases it never held pointer authority, so the
+                        // pre-report tmux topology the outer launcher created is its own to
+                        // roll back. Never wait for finalization here: only a leader that
+                        // reached readiness can acknowledge it.
                         rollbackFromPreReportAuthority = detachedLeaderAuthority !== null;
                         return { acknowledged: false, rollbackAuthorized: rollbackFromPreReportAuthority };
                     }
@@ -5225,7 +6492,7 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                 },
                 attachOrReturn: async () => { if (attachStep)
                     execTmuxFileSync(attachStep.args, { stdio: "inherit" }); },
-                rollback: async (_ownedRecord, report) => {
+                rollback: async (_ownedRecord, report, finalization) => {
                     const attempt = async (step, operation) => {
                         report.rollback.attempted.push(step);
                         try {
@@ -5238,20 +6505,64 @@ async function runCodex(cwd, args, sessionId, workerDefaultModel, codexHomeOverr
                     await attempt("parent-env", async () => { if (detachedParentEnvFilePath)
                         await rm(detachedParentEnvFilePath, { force: true }); });
                     await attempt("runtime-codex-home", () => cleanupRuntimeCodexHome(runtimeCodexHomeForCleanup, projectLocalCodexHomeForCleanup));
-                    await attempt("rollback", () => { rmSync(releaseMarkerPath, { force: true }); rmSync(`${releaseMarkerPath}.release`, { force: true }); rmSync(`${releaseMarkerPath}.abort`, { force: true }); });
+                    const removeReleaseMarkers = () => {
+                        rmSync(releaseMarkerPath, { force: true });
+                        rmSync(`${releaseMarkerPath}.release`, { force: true });
+                        rmSync(`${releaseMarkerPath}.abort`, { force: true });
+                    };
+                    let sessionCleanupCompleted = !rollbackFromPreReportAuthority;
                     if (createdSession) {
+                        if (isExactDetachedFinalization(finalization, {
+                            nonce: detachedLaunchNonce,
+                            sessionId,
+                            sessionName,
+                            leaderPid: detachedLeaderPid,
+                        })) {
+                            if (detachedHudAuthority) {
+                                await attempt("session:kill-bootstrap-hud", () => {
+                                    if (!cleanupFinalizedDetachedHud(detachedHudAuthority, sessionId)) {
+                                        throw new Error("detached bootstrap HUD authority changed before finalized cleanup");
+                                    }
+                                });
+                            }
+                            await attempt("rollback", removeReleaseMarkers);
+                            return;
+                        }
                         for (const step of buildDetachedSessionRollbackSteps(sessionName, null, null, null)) {
                             await attempt(`session:${step.name}`, () => {
-                                if (!detachedLeaderAuthority)
+                                const leaderAuthority = detachedLeaderAuthority;
+                                if (!leaderAuthority)
                                     throw new Error("detached leader authority missing before rollback");
                                 if (rollbackFromPreReportAuthority && step.name === "kill-session") {
-                                    cleanupDetachedPreReportSession(detachedLeaderAuthority);
+                                    const cleanupResult = cleanupDetachedPreReportSession(leaderAuthority, !detachedLeaderOwnerTagInstalled, () => {
+                                        const expected = {
+                                            nonce: detachedLaunchNonce,
+                                            sessionId,
+                                            sessionName,
+                                            shouldAttach: detachedPreflight.shouldAttach,
+                                            leaderPaneId: detachedLeaderPaneId,
+                                            leaderPanePid: leaderAuthority.panePid,
+                                        };
+                                        const report = readDetachedLeaderReport(releaseMarkerPath);
+                                        return isDetachedReadyReportAuthorized(report, expected) ||
+                                            isDetachedTerminalReportAuthorized(report, expected);
+                                    }, () => isDetachedFailedReportAuthorized(readDetachedLeaderReport(releaseMarkerPath), {
+                                        nonce: detachedLaunchNonce,
+                                        sessionId,
+                                        sessionName,
+                                        leaderPaneId: detachedLeaderPaneId,
+                                        leaderPanePid: leaderAuthority.panePid,
+                                    }), rollbackFromAuthenticatedFailure);
+                                    sessionCleanupCompleted = cleanupResult === "cleaned";
                                     return;
                                 }
-                                runDetachedLeaderMutation(detachedLeaderAuthority, step.args);
+                                runDetachedLeaderMutation(leaderAuthority, step.args);
                             });
                         }
                     }
+                    if (sessionCleanupCompleted) {
+                        await attempt("rollback", removeReleaseMarkers);
+                    }
                 },
             });
             if (launchTerminal.kind === "attached" && detachedLeaderPid) {
@@ -5435,13 +6746,17 @@ function parseDetachedHudAuthorityProof(value) {
         return undefined;
     if (typeof proof.panePid !== "number" || !Number.isSafeInteger(proof.panePid) || proof.panePid <= 0)
         return undefined;
+    if (typeof proof.sessionName !== "string" || proof.sessionName.length === 0 || proof.sessionName.includes("\t"))
+        return undefined;
     if (typeof proof.sessionId !== "string" || !/^\$[0-9]+$/.test(proof.sessionId))
         return undefined;
+    if (typeof proof.sessionCreated !== "string" || !/^\d+$/.test(proof.sessionCreated))
+        return undefined;
     if (typeof proof.windowId !== "string" || !/^@[0-9]+$/.test(proof.windowId))
         return undefined;
     if (typeof proof.operationMarker !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(proof.operationMarker))
         return undefined;
-    return { paneId: proof.paneId, panePid: proof.panePid, sessionId: proof.sessionId, windowId: proof.windowId, operationMarker: proof.operationMarker };
+    return { paneId: proof.paneId, panePid: proof.panePid, sessionName: proof.sessionName, sessionId: proof.sessionId, sessionCreated: proof.sessionCreated, windowId: proof.windowId, operationMarker: proof.operationMarker };
 }
 function teardownDetachedOwnedHudPane(leaderPaneId, payload, hudProof) {
     // #3266: on a normal child exit, kill exactly the bootstrap-proven OMX HUD pane so
@@ -5450,13 +6765,13 @@ function teardownDetachedOwnedHudPane(leaderPaneId, payload, hudProof) {
     // Contract: only the proven HUD is removed. A pane the user added to the detached
     // session is deliberately preserved, which intentionally keeps that session (and any
     // attached client) alive; natural closure and shell return happen only when no other
-    // panes remain.
-    const discovered = discoverDetachedHudAuthority(payload.sessionName, payload.sessionId);
-    const proof = discovered ?? hudProof;
-    if (!proof)
+    // panes remain. The leader pane is removed only after the proven HUD removal is
+    // confirmed; a stale, missing, or changed HUD proof leaves the leader untouched too.
+    if (!hudProof)
         return;
     try {
-        cleanupDetachedHudPane(proof, discovered ? payload.sessionId : undefined);
+        if (!cleanupDetachedHudPane(hudProof, payload.sessionId))
+            return;
         execTmuxFileSync(["kill-pane", "-t", leaderPaneId], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
     }
     catch (error) {
@@ -5464,6 +6779,43 @@ function teardownDetachedOwnedHudPane(leaderPaneId, payload, hudProof) {
         logCliOperationFailure(error);
     }
 }
+function cleanupDetachedLeaderSessionWithAuthority(authority, ownerId, beforeSink) {
+    try {
+        const owner = `#{||:#{==:#{@omx_instance_id},${ownerId}},#{&&:#{==:#{@omx_instance_id},},#{!=:#{@omx_detached_owner_tag_attempted},1}}}`;
+        const condition = [
+            `#{==:#{session_name},${authority.sessionName}}`,
+            `#{==:#{session_id},${authority.sessionId}}`,
+            `#{==:#{session_created},${authority.sessionCreated}}`,
+            owner,
+        ].reduce((combined, item) => `#{&&:${combined},${item}}`);
+        const receipt = detachedAuthorityReceipt();
+        const success = `kill-session -t ${quoteShellArg(authority.sessionName)} ; display-message -p ${quoteShellArg(receipt)}`;
+        beforeSink?.();
+        const result = execTmuxFileSync([
+            "if-shell", "-F", "-t", authority.sessionName, condition, success, "display-message -p ''",
+        ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (result !== receipt)
+            throw new Error("detached failed leader session authority changed before cleanup");
+    }
+    catch {
+        // The parent retains the report and its own identity-fenced cleanup marker.
+        // A failed leader must never turn an uncertain session lookup into a kill.
+    }
+}
+function cleanupDetachedLeaderSessionAfterFailure(paneId, payload) {
+    try {
+        const authority = captureDetachedLeaderAuthority(paneId, payload.sessionName, payload.sessionId);
+        cleanupDetachedLeaderSessionWithAuthority(authority, payload.sessionId);
+    }
+    catch {
+        // The parent retains the report and its own identity-fenced cleanup marker.
+        // A failed leader must never turn an uncertain session lookup into a kill.
+    }
+}
+/** Internal detached-launch seam. Exported solely for deterministic CLI tests. */
+export function cleanupDetachedLeaderSessionAfterFailureForTest(authority, ownerId, beforeSink) {
+    cleanupDetachedLeaderSessionWithAuthority(authority, ownerId, beforeSink);
+}
 function traceDetachedLeaderPhase(phase) {
     if (process.env.OMX_TEST_DETACHED_TRACE !== "1")
         return;
@@ -5479,32 +6831,58 @@ async function runDetachedSessionLeader(payload) {
             continue;
         process.env[key] = value;
     }
+    const nonce = payload.readyPath?.split(".").at(-2) || payload.sessionId;
     let pane;
     const inheritedPane = process.env.TMUX_PANE?.trim();
-    if (payload.preLaunchOptions.shouldAttach === false) {
-        if (!inheritedPane || !/^%[0-9]+$/.test(inheritedPane)) {
-            throw new Error("detached Hermes leader has no tmux pane identity");
+    if (process.platform !== "win32") {
+        if (payload.preLaunchOptions.shouldAttach === false) {
+            if (!inheritedPane || !/^%[0-9]+$/.test(inheritedPane))
+                throw new Error("detached Hermes leader has no tmux pane identity");
+            pane = inheritedPane;
+        }
+        else {
+            const paneSnapshot = execTmuxFileSync(["list-panes", "-t", payload.sessionName, "-F", "#{pane_id}\t#{pane_dead}\t#{pane_pid}"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+            pane = parseDetachedLeaderPaneIdByPid(paneSnapshot, process.pid);
         }
-        pane = inheritedPane;
     }
     else {
-        const paneSnapshot = execTmuxFileSync(["list-panes", "-t", payload.sessionName, "-F", "#{pane_id}\t#{pane_dead}\t#{pane_pid}"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
-        pane = parseDetachedLeaderPaneIdByPid(paneSnapshot, process.pid);
+        pane = resolveDetachedLeaderPaneIdentity(payload.sessionName, undefined, inheritedPane, process.platform, process.pid, payload.preLaunchOptions.shouldAttach === false, (paneId) => execTmuxFileSync(["display-message", "-p", "-t", paneId, "#{session_name}\t#{session_id}\t#{pane_id}"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim(), () => execTmuxFileSync(["list-panes", "-t", payload.sessionName, "-F", "#{pane_id}\t#{pane_dead}\t#{pane_pid}"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }));
     }
     process.env.TMUX_PANE = pane;
-    const established = await establishPreLaunchBinding(payload.cwd, payload.sessionId, {
-        tmuxSessionName: payload.sessionName,
-        tmuxPaneId: pane,
-    });
+    // #3578: a pre-binding failure (notably session_pointer_owner_conflict) used to
+    // die with the pane — remain-on-exit is off, so this leader's stderr vanished and
+    // the outer launcher could only report a readiness failure. Record the same
+    // bounded failure string the in-try path records so the parent can surface the
+    // actionable abort instead of a generic detached phase. Keep pane resolution
+    // outside the try so the exact clean-base identity path is preserved.
+    let established;
+    try {
+        established = await establishPreLaunchBinding(payload.cwd, payload.sessionId, {
+            tmuxSessionName: payload.sessionName,
+            tmuxPaneId: pane,
+        });
+    }
+    catch (error) {
+        if (payload.readyPath) {
+            writeDetachedLeaderReport(payload.readyPath, {
+                version: 1, kind: "failed", nonce, sessionId: payload.sessionId, sessionName: payload.sessionName,
+                paneId: pane,
+                leaderPid: process.pid, error: describeDetachedLeaderFailure(error),
+                ...detachedSessionPointerAbortCode(error),
+            });
+        }
+        cleanupDetachedLeaderSessionAfterFailure(pane, payload);
+        throw error;
+    }
     const binding = established.binding;
     let ownedRecord;
     let detachedHudProof;
-    const nonce = payload.readyPath?.split(".").at(-2) || payload.sessionId;
     const contextKey = process.env[OMX_MADMAX_DETACHED_CONTEXT_ENV]?.trim();
+    let externalInterrupt;
     const activeRecordPath = contextKey
         ? madmaxDetachedActiveRecordPath(resolveMadmaxRunsRoot(process.env), contextKey)
         : join(omxRoot(payload.cwd), "state", "detached-active-record.json");
-    let externalInterrupt;
+    let readyReportWritten = false;
     try {
         const completion = await completePreLaunchSetup(payload.cwd, payload.sessionId, payload.preLaunchOptions.notifyTempContract, payload.codexHomeOverride, payload.preLaunchOptions.enableNotifyFallbackAuthority, payload.preLaunchOptions.worktreeDirty);
         if (completion.kind === "failure") {
@@ -5531,6 +6909,7 @@ async function runDetachedSessionLeader(payload) {
         });
         if (payload.readyPath) {
             writeDetachedLeaderReport(payload.readyPath, { version: 1, kind: "ready", nonce, sessionId: payload.sessionId, sessionName: payload.sessionName, paneId: pane, leaderPid: process.pid });
+            readyReportWritten = true;
             const releasePath = `${payload.readyPath}.release`;
             const abortPath = `${payload.readyPath}.abort`;
             const releaseDeadline = Date.now() + 30_000;
@@ -5667,8 +7046,12 @@ async function runDetachedSessionLeader(payload) {
         if (payload.readyPath)
             writeDetachedLeaderReport(payload.readyPath, {
                 version: 1, kind: "failed", nonce, sessionId: payload.sessionId, sessionName: payload.sessionName,
+                paneId: pane,
                 leaderPid: process.pid, finalized, error: failure instanceof Error ? failure.message : String(failure),
+                ...detachedSessionPointerAbortCode(failure),
             });
+        if (!readyReportWritten)
+            cleanupDetachedLeaderSessionAfterFailure(pane, payload);
         throw failure;
     }
     finally {
@@ -6388,6 +7771,58 @@ async function listHookVisibleRunDirStateRefs(cwd) {
     }
     return refs.sort((a, b) => a.mode.localeCompare(b.mode));
 }
+function detachedIdentity(stat) {
+    return {
+        dev: stat.dev,
+        ino: stat.ino,
+        mode: stat.mode,
+        nlink: stat.nlink,
+        kind: stat.isDirectory() ? "directory" : "file",
+        size: stat.size,
+        mtimeNs: stat.mtimeNs,
+        ctimeNs: stat.ctimeNs,
+    };
+}
+function detachedIdentityMatches(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode
+        && left.nlink === right.nlink && left.kind === right.kind && left.size === right.size
+        && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+function detachedDirectoryIdentityMatches(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode
+        && left.nlink === right.nlink && left.kind === "directory" && right.kind === "directory";
+}
+async function captureDetachedDirectory(path) {
+    const before = await lstat(path, { bigint: true });
+    if (!before.isDirectory() || before.isSymbolicLink() || await realpath(path) !== path) {
+        throw new Error(`detached authority directory is not canonical: ${path}`);
+    }
+    return detachedIdentity(before);
+}
+async function readDetachedPinnedFile(path) {
+    const before = await lstat(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new Error(`detached authority file is not regular: ${path}`);
+    const handle = await open(path, fsConstants.O_RDONLY | historyNoFollowFlag());
+    try {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || !detachedIdentityMatches(detachedIdentity(before), detachedIdentity(opened))) {
+            throw new Error(`detached authority file changed before open: ${path}`);
+        }
+        const content = (await handle.readFile()).toString("utf8");
+        const afterHandle = await handle.stat({ bigint: true });
+        const afterPath = await lstat(path, { bigint: true });
+        const frozen = detachedIdentity(before);
+        if (!detachedIdentityMatches(frozen, detachedIdentity(afterHandle))
+            || !detachedIdentityMatches(frozen, detachedIdentity(afterPath))) {
+            throw new Error(`detached authority file changed during read: ${path}`);
+        }
+        return { identity: frozen, content };
+    }
+    finally {
+        await handle.close();
+    }
+}
 function isCanonicalPathWithin(parent, child, allowEqual = false) {
     const rel = relative(parent, child);
     if (rel === "")
@@ -6425,18 +7860,80 @@ async function selectAuthorizedHookVisibleRunDirState(cwd) {
             if (!isCanonicalPathWithin(canonicalRunsRoot, canonicalRunDir)) {
                 throw new Error("run directory escapes the authorized runs root");
             }
-            const stateDir = realpathSync(join(canonicalRunDir, ".omx", "state"));
+            const omxDir = join(canonicalRunDir, ".omx");
+            const stateDir = join(omxDir, "state");
+            const sessionsDir = join(stateDir, "sessions");
+            const treeDirectories = new Map();
+            for (const path of [canonicalRunDir, omxDir, stateDir, sessionsDir]) {
+                treeDirectories.set(path, await captureDetachedDirectory(path));
+            }
             if (!isCanonicalPathWithin(canonicalRunDir, stateDir)) {
                 throw new Error("state directory escapes the authorized run directory");
             }
-            const session = JSON.parse(await readFile(join(stateDir, "session.json"), "utf-8"));
+            const protectedFiles = new Map();
+            const pointerPath = join(stateDir, "session.json");
+            const pointer = await readDetachedPinnedFile(pointerPath);
+            protectedFiles.set(pointerPath, pointer);
+            const session = JSON.parse(pointer.content);
             if (session.session_id !== record.session_id)
                 throw new Error("run session pointer changed");
-            const sessionDir = realpathSync(join(stateDir, "sessions", record.session_id));
+            const sessionDir = join(sessionsDir, record.session_id);
+            treeDirectories.set(sessionDir, await captureDetachedDirectory(sessionDir));
             if (!isCanonicalPathWithin(stateDir, sessionDir)) {
                 throw new Error("session directory escapes the authorized state directory");
             }
-            candidates.push({ sessionDir, sessionId: record.session_id, record });
+            const refs = [];
+            const stateFiles = await readdir(sessionDir).catch(() => []);
+            for (const stateFile of stateFiles) {
+                if (!isModeStateFilename(stateFile))
+                    continue;
+                const path = join(sessionDir, stateFile);
+                const snapshot = await readDetachedPinnedFile(path);
+                protectedFiles.set(path, snapshot);
+                refs.push({ mode: stateFile.slice(0, -"-state.json".length), path, scope: "session" });
+            }
+            const advisoryRootPath = join(sessionDir, "ralplan-advisory");
+            let advisoryGenerationDir;
+            let advisoryGenerationEntries;
+            try {
+                treeDirectories.set(advisoryRootPath, await captureDetachedDirectory(advisoryRootPath));
+                const currentPath = join(advisoryRootPath, "current.json");
+                const current = await readDetachedPinnedFile(currentPath);
+                protectedFiles.set(currentPath, current);
+                const generationId = JSON.parse(current.content).generation_id;
+                if (typeof generationId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(generationId)) {
+                    throw new Error("detached Advisory current generation is invalid");
+                }
+                const generationPath = join(advisoryRootPath, generationId);
+                advisoryGenerationDir = generationPath;
+                treeDirectories.set(generationPath, await captureDetachedDirectory(generationPath));
+                advisoryGenerationEntries = new Set(await readdir(generationPath));
+                for (const name of ["fence.json", "closeout-journal.json"]) {
+                    const path = join(generationPath, name);
+                    try {
+                        protectedFiles.set(path, await readDetachedPinnedFile(path));
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT")
+                            throw error;
+                    }
+                }
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            candidates.push({
+                refs: refs.sort((a, b) => a.mode.localeCompare(b.mode)),
+                sessionDir,
+                sessionId: record.session_id,
+                runCwd: canonicalRunDir,
+                treeDirectories,
+                protectedFiles,
+                ...(advisoryGenerationDir ? { advisoryGenerationDir } : {}),
+                ...(advisoryGenerationEntries ? { advisoryGenerationEntries } : {}),
+                record,
+            });
         }
         catch (err) {
             throw new Error(`Refusing cancellation because detached run authority is invalid: ${record.run_dir}.`, { cause: err });
@@ -6446,33 +7943,7 @@ async function selectAuthorizedHookVisibleRunDirState(cwd) {
         throw new Error("Refusing cancellation because multiple detached run authorities match.");
     if (candidates.length === 0)
         return null;
-    const [{ sessionDir, sessionId, record }] = candidates;
-    const refs = [];
-    const stateFiles = await readdir(sessionDir).catch(() => []);
-    for (const file of stateFiles) {
-        if (!isModeStateFilename(file))
-            continue;
-        const path = join(sessionDir, file);
-        try {
-            const fileStat = lstatSync(path);
-            if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
-                throw new Error(`Refusing cancellation through non-regular run state target: ${path}.`);
-            }
-            const canonicalFile = realpathSync(path);
-            if (!isCanonicalPathWithin(sessionDir, canonicalFile)) {
-                throw new Error(`Refusing cancellation outside authorized run session: ${path}.`);
-            }
-            refs.push({
-                mode: file.slice(0, -"-state.json".length),
-                path: canonicalFile,
-                scope: "session",
-            });
-        }
-        catch (err) {
-            throw new Error(`Refusing cancellation because detached run state authority is invalid: ${path}.`, { cause: err });
-        }
-    }
-    return { refs: refs.sort((a, b) => a.mode.localeCompare(b.mode)), sessionId, sessionDir, record };
+    return candidates[0];
 }
 function assertCancellationAuthorityPath(baseStateDir, authorityRoot) {
     const resolvedBase = resolve(baseStateDir);
@@ -6614,6 +8085,9 @@ function assertCompatibleNestedSkillOwners(value, authority, path) {
         assertExactSkillOwner(entry, authority, entryPath);
     }
 }
+export function cancellationFileIdentityMatches(frozen, current, platform = process.platform) {
+    return sessionOwnerFileIdentityMatches(frozen, current, platform);
+}
 async function cancelModes(args = [], options = {}) {
     const cwd = options.cwd ?? process.cwd();
     const nowIso = new Date().toISOString();
@@ -6631,23 +8105,24 @@ async function cancelModes(args = [], options = {}) {
             ? await resolveExactSessionCancellationAuthority(cwd, baseStateDir, writableScope.sessionId)
             : undefined;
         const expectedOwnerIds = collectCancellationOwnerIds(baseStateDir, writableScope.sessionId);
-        const loadStates = async (refs, authorityRoot, ownerIds = expectedOwnerIds) => {
+        const loadStates = async (refs, authorityRoot, ownerIds = expectedOwnerIds, pinnedFiles) => {
             const loaded = new Map();
             if (refs.length === 0)
                 return loaded;
             const canonicalAuthorityRoot = assertCancellationAuthorityPath(authorityRoot === writableScope.stateDir ? baseStateDir : authorityRoot, authorityRoot);
             for (const ref of refs) {
-                const fileStat = lstatSync(ref.path);
-                if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
+                const pinned = pinnedFiles?.get(ref.path);
+                const fileStat = pinned ? null : lstatSync(ref.path);
+                if (fileStat && (!fileStat.isFile() || fileStat.isSymbolicLink())) {
                     throw new Error(`Refusing cancellation through non-regular state target ${ref.path}.`);
                 }
-                const canonicalPath = realpathSync(ref.path);
+                const canonicalPath = pinned ? ref.path : realpathSync(ref.path);
                 const canonicalParent = realpathSync(dirname(ref.path));
                 if (!isCanonicalPathWithin(canonicalAuthorityRoot, canonicalParent, true)
                     || !isCanonicalPathWithin(canonicalAuthorityRoot, canonicalPath)) {
                     throw new Error(`Refusing cancellation outside authorized state root: ${ref.path}.`);
                 }
-                const content = await readFile(canonicalPath, "utf-8");
+                const content = pinned?.content ?? await readFile(canonicalPath, "utf-8");
                 let parsedState;
                 try {
                     const parsed = JSON.parse(content);
@@ -6708,8 +8183,8 @@ async function cancelModes(args = [], options = {}) {
                     scope: ref.scope,
                     state: parsedState,
                     originalContent: content,
-                    dev: fileStat.dev,
-                    ino: fileStat.ino,
+                    dev: pinned ? Number(pinned.identity.dev) : fileStat.dev,
+                    ino: pinned ? Number(pinned.identity.ino) : fileStat.ino,
                 });
             }
             return loaded;
@@ -6736,14 +8211,208 @@ async function cancelModes(args = [], options = {}) {
             runSelection = await selectAuthorizedHookVisibleRunDirState(cwd);
             if (runSelection) {
                 const runOwnerIds = new Set([runSelection.sessionId]);
-                const runDirStates = await loadStates(runSelection.refs, runSelection.sessionDir, runOwnerIds);
+                const runDirStates = await loadStates(runSelection.refs, runSelection.sessionDir, runOwnerIds, runSelection.protectedFiles);
                 if (hasActiveWorkflowMode(runDirStates))
                     states = runDirStates;
                 else
                     runSelection = null;
             }
         }
+        const assertRunAuthority = () => {
+            if (runSelection && !hasMatchingMadmaxDetachedRuntimeBinding(runSelection.record)) {
+                throw new Error("Refusing cancellation because detached run authority changed.");
+            }
+        };
         const currentSessionId = writableScope.sessionId ?? runSelection?.sessionId ?? "";
+        const activeAdvisory = states.get("ralplan");
+        if (activeAdvisory?.state.active === true && activeAdvisory.state.workflow_variant === "advisory") {
+            if (!currentSessionId)
+                throw new Error("Refusing Advisory cancellation without an authoritative session scope.");
+            const { cancelRalplanConsensus } = await import("../ralplan/runtime.js");
+            const cancellationCwd = runSelection ? runSelection.runCwd : cwd;
+            let expectedModeIdentity = runSelection?.protectedFiles.get(activeAdvisory.path)?.identity;
+            let expectedModeContent = activeAdvisory.originalContent;
+            const detachedSessionSkillBaseline = runSelection
+                ? [...runSelection.protectedFiles.entries()].find(([path]) => basename(path) === "skill-active-state.json"
+                    && path.split(sep).includes("sessions") && path.split(sep).includes(currentSessionId))?.[1].content
+                : undefined;
+            const detachedRootSkillBaseline = runSelection
+                ? runSelection.protectedFiles.get(join(dirname(dirname(runSelection.sessionDir)), "skill-active-state.json"))?.content
+                : undefined;
+            let sessionModeMutationPending = false;
+            const pendingProtectedMutations = new Set();
+            const revalidateDetachedAdvisoryAuthority = runSelection
+                ? async (checkpoint) => {
+                    if (checkpoint === "mirror_session_mode" || checkpoint === "cancel_mode_update"
+                        || checkpoint === "mode_update_complete"
+                        || checkpoint === "mode_commit_ralplan.session-state") {
+                        sessionModeMutationPending = true;
+                    }
+                    assertRunAuthority();
+                    const stateDir = dirname(dirname(runSelection.sessionDir));
+                    for (const [path, frozen] of runSelection.treeDirectories) {
+                        let current;
+                        try {
+                            current = await captureDetachedDirectory(path);
+                        }
+                        catch (error) {
+                            throw new Error(`Refusing cancellation because detached directory is no longer canonical: ${path}.`, { cause: error });
+                        }
+                        if (!detachedDirectoryIdentityMatches(frozen, current)) {
+                            const isGeneration = path === runSelection.advisoryGenerationDir;
+                            const stableObject = frozen.dev === current.dev && frozen.ino === current.ino
+                                && frozen.mode === current.mode && frozen.kind === current.kind;
+                            if (isGeneration && stableObject && runSelection.advisoryGenerationEntries) {
+                                const entries = new Set(await readdir(path));
+                                const allowed = [...entries].every((entry) => runSelection.advisoryGenerationEntries.has(entry)
+                                    || entry === "generation.lock" || entry === "fence.json" || entry === "closeout-journal.json"
+                                    || entry === "admin-event-0001.json"
+                                    || /^fence-event-[0-9]{4}\.json$/.test(entry));
+                                if (allowed) {
+                                    runSelection.advisoryGenerationEntries = entries;
+                                    runSelection.treeDirectories.set(path, current);
+                                    continue;
+                                }
+                            }
+                            if (stableObject) {
+                                runSelection.treeDirectories.set(path, current);
+                                continue;
+                            }
+                            throw new Error(`Refusing cancellation because detached directory identity changed at ${checkpoint}: ${path}.`);
+                        }
+                    }
+                    const pointerPath = join(stateDir, "session.json");
+                    const pointerSnapshot = await readDetachedPinnedFile(pointerPath);
+                    const frozenPointer = runSelection.protectedFiles.get(pointerPath);
+                    if (!frozenPointer || !detachedIdentityMatches(frozenPointer.identity, pointerSnapshot.identity)
+                        || frozenPointer.content !== pointerSnapshot.content) {
+                        throw new Error("Refusing cancellation because detached session pointer changed.");
+                    }
+                    const pointer = JSON.parse(pointerSnapshot.content);
+                    if (pointer.session_id !== currentSessionId) {
+                        throw new Error("Refusing cancellation because detached session authority changed.");
+                    }
+                    for (const [path, frozen] of [...runSelection.protectedFiles]) {
+                        if (path === pointerPath || path === activeAdvisory.path)
+                            continue;
+                        const snapshot = await readDetachedPinnedFile(path);
+                        if (!detachedIdentityMatches(frozen.identity, snapshot.identity) || frozen.content !== snapshot.content) {
+                            const isPendingSessionSkill = pendingProtectedMutations.has(path)
+                                && basename(path) === "skill-active-state.json"
+                                && path.split(sep).includes("sessions")
+                                && path.split(sep).includes(currentSessionId);
+                            if (isPendingSessionSkill && checkpoint !== "journal_step_session_skill")
+                                continue;
+                            if (!pendingProtectedMutations.delete(path)) {
+                                throw new Error(`Refusing cancellation because detached protected state changed at ${checkpoint}: ${path}.`);
+                            }
+                            if (basename(path) === "skill-active-state.json"
+                                && path.split(sep).includes("sessions")
+                                && path.split(sep).includes(currentSessionId)) {
+                                const journalPath = runSelection.advisoryGenerationDir
+                                    ? join(runSelection.advisoryGenerationDir, "closeout-journal.json") : "";
+                                const journalSnapshot = journalPath ? runSelection.protectedFiles.get(journalPath) : undefined;
+                                const journal = journalSnapshot
+                                    ? JSON.parse(journalSnapshot.content) : null;
+                                const terminalSkillUpdates = journal && typeof journal.terminal_skill_updates === "object"
+                                    && journal.terminal_skill_updates !== null
+                                    ? journal.terminal_skill_updates : null;
+                                const expectedTerminalState = terminalSkillUpdates?.session_skill;
+                                const terminalModeState = journal?.terminal_mode_updates;
+                                const terminalTimestamp = journal?.terminal_timestamp;
+                                if (!expectedTerminalState || typeof expectedTerminalState !== "object" || Array.isArray(expectedTerminalState)) {
+                                    throw new Error("Refusing cancellation without a canonical detached Advisory session skill payload.");
+                                }
+                                if (!terminalModeState || typeof terminalModeState !== "object" || Array.isArray(terminalModeState)
+                                    || typeof terminalTimestamp !== "string" || terminalTimestamp.length === 0) {
+                                    throw new Error("Refusing cancellation without canonical detached Advisory terminal metadata.");
+                                }
+                                validateDetachedAdvisorySessionSkillTransition({
+                                    baseline: JSON.parse(detachedSessionSkillBaseline ?? frozen.content),
+                                    rootBaseline: detachedRootSkillBaseline
+                                        ? JSON.parse(detachedRootSkillBaseline)
+                                        : null,
+                                    current: JSON.parse(snapshot.content),
+                                    journalProjection: expectedTerminalState,
+                                    terminalModeState: {
+                                        ...activeAdvisory.state,
+                                        ...terminalModeState,
+                                    },
+                                    terminalTimestamp,
+                                    sessionId: currentSessionId,
+                                });
+                            }
+                            runSelection.protectedFiles.set(path, snapshot);
+                        }
+                    }
+                    if (checkpoint === "mode_commit_ralplan.session-skill-write"
+                        || checkpoint === "mirror_session_skill") {
+                        for (const path of runSelection.protectedFiles.keys()) {
+                            if (basename(path) === "skill-active-state.json"
+                                && path.split(sep).includes("sessions")
+                                && path.split(sep).includes(currentSessionId)) {
+                                pendingProtectedMutations.add(path);
+                            }
+                        }
+                    }
+                    if (runSelection.advisoryGenerationDir) {
+                        for (const name of ["fence.json", "closeout-journal.json"]) {
+                            const path = join(runSelection.advisoryGenerationDir, name);
+                            if (runSelection.protectedFiles.has(path) || !pendingProtectedMutations.has(path))
+                                continue;
+                            try {
+                                runSelection.protectedFiles.set(path, await readDetachedPinnedFile(path));
+                                pendingProtectedMutations.delete(path);
+                            }
+                            catch (error) {
+                                if (error.code !== "ENOENT")
+                                    throw error;
+                            }
+                        }
+                    }
+                    const modeSnapshot = await readDetachedPinnedFile(activeAdvisory.path);
+                    const content = modeSnapshot.content;
+                    if (!expectedModeIdentity)
+                        throw new Error("Refusing cancellation without a pinned detached Ralplan state.");
+                    if (sessionModeMutationPending) {
+                        const stillOriginal = detachedIdentityMatches(modeSnapshot.identity, expectedModeIdentity)
+                            && content === expectedModeContent;
+                        if (!stillOriginal) {
+                            const parsed = JSON.parse(content);
+                            if (parsed.mode !== "ralplan" || parsed.workflow_variant !== "advisory"
+                                || parsed.advisory_generation_id !== activeAdvisory.state.advisory_generation_id
+                                || parsed.session_id !== currentSessionId || parsed.active !== false) {
+                                throw new Error("Refusing cancellation because detached Advisory mode mutation was not canonical.");
+                            }
+                            expectedModeIdentity = modeSnapshot.identity;
+                            expectedModeContent = content;
+                            sessionModeMutationPending = false;
+                        }
+                    }
+                    else if (!detachedIdentityMatches(modeSnapshot.identity, expectedModeIdentity) || content !== expectedModeContent) {
+                        throw new Error(`Refusing cancellation because detached Ralplan state changed at ${checkpoint}.`);
+                    }
+                    if (runSelection.advisoryGenerationDir) {
+                        const fencePath = join(runSelection.advisoryGenerationDir, "fence.json");
+                        const journalPath = join(runSelection.advisoryGenerationDir, "closeout-journal.json");
+                        if (["fence_create", "fence_recovery_required", "fence_terminal", "admin_fence_event"].includes(checkpoint)) {
+                            pendingProtectedMutations.add(fencePath);
+                        }
+                        if (checkpoint === "journal_prepare" || checkpoint.startsWith("journal_step_")
+                            || checkpoint === "journal_commit" || checkpoint === "journal_fence_terminal") {
+                            pendingProtectedMutations.add(journalPath);
+                        }
+                    }
+                }
+                : undefined;
+            const cancelled = await cancelRalplanConsensus(cancellationCwd, currentSessionId, {
+                revalidateAuthority: revalidateDetachedAdvisoryAuthority,
+            });
+            if (!cancelled)
+                throw new Error("Refusing false Advisory cancellation success: the selected generation was not terminalized.");
+            console.log("Cancelled: ralplan");
+            return;
+        }
         const changed = new Set();
         const reported = new Set();
         const cancelMode = (mode, phase = "cancelled", reportIfWasActive = true) => {
@@ -6849,11 +8518,6 @@ async function cancelModes(args = [], options = {}) {
                     cancelMode(mode, "cancelled", true);
             }
         }
-        const assertRunAuthority = () => {
-            if (runSelection && !hasMatchingMadmaxDetachedRuntimeBinding(runSelection.record)) {
-                throw new Error("Refusing cancellation because detached run authority changed.");
-            }
-        };
         if (force && currentSessionId) {
             const stopStateEntries = [...states.entries()].filter(([mode]) => mode === "native-stop");
             for (const [, entry] of stopStateEntries) {
@@ -6888,7 +8552,8 @@ async function cancelModes(args = [], options = {}) {
                 const handle = await open(change.entry.path, fsConstants.O_RDWR | fsConstants.O_NOFOLLOW);
                 const currentStat = await handle.stat();
                 const currentContent = await handle.readFile({ encoding: "utf-8" });
-                if (!currentStat.isFile() || currentStat.dev !== change.entry.dev || currentStat.ino !== change.entry.ino) {
+                if (!currentStat.isFile()
+                    || !cancellationFileIdentityMatches(change.entry, currentStat)) {
                     await handle.close();
                     throw new Error(`Refusing cancellation because state identity changed: ${change.entry.path}.`);
                 }