oysterun 1.6.0-beta.2 → 1.6.0-beta.21

package/host-service/server.mjs

@@ -1,3 +1,21 @@
+import { VoiceInputReceiptStore, voiceInputFingerprint } from './voice-input-receipt-store.mjs';
+import { readAgentFolderAvailability, requireAgentFolder, agentFolderErrorResponse } from "./agent-folder-availability.mjs";
+import { resolveSessionTranscriptTarget, sessionTranscriptTargetFields, createHistoryTranscriptPager } from "./session-transcript-target.mjs";
+import { withRouteCMatrixTranscriptReadOnly } from "./routec-matrix-storage-adapter.mjs";
+import { getServiceDefinitionIdentity, buildServiceRenderBundle } from "./lifecycle-service-render-bundle.mjs";
+import { parseHostPort, readUserHostPort } from "./host-port-resolution.mjs";
+import {
+  assertConfirmedUpdateTarget, assertFreshContinuitySnapshot, continuityDigest, continuityFailure, recordContinuityRecovery,
+  continuityReceiptPath, prepareContinuity, readContinuity, bindFreshContinuityBaseline, writeContinuityAtomic,
+  hasCompleteContinuityResumeIdentity, compareContinuityIdentities,
+} from "./lifecycle-continuity.mjs";
+import { recordContinuityUserPath } from "./lifecycle-user-path.mjs";
+import { projectContinuityOperation } from "./lifecycle-continuity-projection.mjs";
+import { resolveContinuityQualificationOrigin } from "./lifecycle-continuity-runner.mjs";
+import { retainContinuityFile, digestContinuityPackage } from "./lifecycle-continuity-assets.mjs";
+import {
+  createContinuityProbeGrant, verifyContinuityProbeGrant,
+} from "./lifecycle-continuity-probe.mjs";
 import { spawn, spawnSync } from "child_process";
 import { createRequire } from "module";
 import { createServer } from "http";
@@ -24,6 +42,7 @@ import { performance } from "perf_hooks";
 import { brotliCompressSync, gzipSync } from "zlib";
 import { homedir } from "os";
 import { WebSocketServer } from "ws";
+import { createRouteCRequestDelayWindowController } from "./routec-request-delay-window.mjs";
 import { SessionManager } from "./session-manager.mjs";
 import {
   DEFAULT_HOST_PRODUCT_CAPABILITIES,
@@ -48,12 +67,14 @@ import {
 } from "./scheduler-run-product-contract.mjs";
 import { finalizeSchedulerMutationResponse } from "./scheduler-mutation-audit.mjs";
 import { buildSessionLifecycleRevision } from "./session-lifecycle-snapshot.mjs";
+import { resolveProductRuntimeHostOrigin } from "./product-runtime-host-origin.mjs";
 import { createTunnelAgent } from "./tunnel-agent-factory.mjs";
 import { buildWebsiteCanonicalUrlPayload } from "./website-canonical-url.mjs";
 import {
   buildInitialSharedAgentConfig,
   getConfigDir,
   getConfigPath,
+  readRawConfigSource,
   getConfigSource,
   getDefaultConfig,
   getDefaultHostDisplayName,
@@ -168,7 +189,20 @@ import {
   logProviderStartupEvent,
   preflightProviderStartup,
 } from "./provider-startup-preflight.mjs";
-import { getSessionHistory } from "./session-history.mjs";
+import {
+  getSessionHistory,
+  updateSessionRecord,
+  captureSessionTagsHistoryRollback,
+} from "./session-history.mjs";
+import {
+  RecentSessionTagsStore,
+  SessionTagLabelsStore,
+  commitSessionTagSave,
+  resolveSessionStartTags,
+  canonicalSessionTags,
+  projectSessionTags,
+  normalizeSessionTags,
+} from "./session-tags.mjs";
 import {
   buildDefaultBranchName,
   buildSessionNameConflictMessage,
@@ -212,6 +246,7 @@ import {
   isLoopbackRemoteAddress,
   verifyLocalServiceControlToken,
 } from "./service-control-token.mjs";
+import { reconcileFailedInitialPreflight, failedInitialPreflightState } from "./initial-preflight-recovery.mjs";
 import {
   UPDATE_RESTART_RUNNER_LEASE_MS,
   evaluateCompletedRestartRecovery,
@@ -241,6 +276,7 @@ import {
 } from "./host-restart-login-gate.mjs";
 import {
   appendHostRuntimeDiagnostic,
+  getHostRuntimeMetadataPath,
   readHostRuntimeMetadataStatus,
   serializeRuntimeError,
   writeHostRuntimeMetadata,
@@ -293,12 +329,20 @@ import { TransportUsageCircuitStore } from "./connectivity/transport-usage-circu
 import { createRouteCMatrixFacade } from "./matrix-facade.mjs";
 import {
   openRouteCMatrixSQLiteStore,
+  readRouteCMatrixSQLiteEvent,
+  readRouteCMatrixSQLiteLatestTimelineSeqs,
+  withRouteCMatrixSQLiteRoomReadContext,
 } from "./routec-matrix-sqlite-store.mjs";
 import { openDurableCallbackStore } from "./callback-durable-store.mjs";
 import { createCallbackHostIntegration } from "./callback-host-integration.mjs";
+import {
+  createCompleteMessageNotificationBroadcaster,
+  observeCommittedCompletedTurn,
+} from "./completed-turn-notification-observer.mjs";
 import {
   createRouteCMatrixRoomBinding,
   getRouteCMatrixRoomBinding,
+  getRouteCMatrixRoomBindings,
   requireRouteCMatrixRoomBinding,
 } from "./matrix-room-binding.mjs";
 import {
@@ -309,12 +353,19 @@ import {
   readMatrixTranscriptRecentTail,
 } from "./matrix-transcript-read-adapter.mjs";
 import { SessionListPreviewService } from "./session-list-preview-service.mjs";
-import { buildSessionSwitcherRows } from "./session-switcher-projection.mjs";
+import { SessionListProjectionService } from "./session-list-projection-service.mjs";
+import {
+  admitSessionCollectionLiveSession,
+  SessionCollectionService,
+  isSessionCollectionLiveSessionAdmitted,
+} from "./session-collection-service.mjs";
 import {
   HOST_OWNER_READ_CURSOR_USER_ID,
   acknowledgeCompletedSessionRead,
+  beginCompletedSessionChatVisit,
   ensureCompletedSessionUnreadSchema,
-  readCompletedSessionUnreadProjection,
+  createCompletedSessionUnreadReader,
+  markLatestCompletedSessionUnread,
 } from "./completed-session-unread.mjs";
 import { buildLiveSessionProfilePayload } from "./session-profile-runtime.mjs";
 import {
@@ -333,6 +384,7 @@ import {
 import {
   cancelRouteCHost2IntakeForMatrixEvent,
   getRouteCHost2IntakeProof,
+  restoreRouteCHost2IntakeFromCommittedMatrixEvent,
 } from "./matrix-event-correlator.mjs";
 import {
   buildDemotedLoopStopCommandResponse,
@@ -521,14 +573,25 @@ try {
 // ── Config (env vars take precedence over ~/.oysterun/config.json) ──
 
 const DEFAULT_HOST_CONFIG = getDefaultConfig();
+const RESOLVED_HOST_PORT = process.env.OYSTERUN_PORT !== undefined
+  ? parseHostPort(process.env.OYSTERUN_PORT)
+  : getActiveStackName() && getActiveStackName() !== "production"
+    ? parseHostPort(readRawConfigSource().port ?? DEFAULT_HOST_CONFIG.port)
+    : readUserHostPort({
+      configPath: getConfigPath(), runtimePath: getHostRuntimeMetadataPath(), configDir: getConfigDir(),
+      existingServicePaths: [join(getConfigDir(), "run", "oysterun-host.pid"),
+        join(getConfigDir(), "run", "oysterun-host.origin.tsv"),
+        join(homedir(), "Library", "LaunchAgents", "com.oysterun.host.plist")],
+    });
+if (RESOLVED_HOST_PORT === null) throw new Error("Invalid Host port; use an integer from 1 to 65535.");
+if (process.env.OYSTERUN_PORT === undefined && existsSync(getConfigPath()) &&
+    !Object.hasOwn(readRawConfigSource(), "port")) writeConfig({ port: RESOLVED_HOST_PORT });
 const CONNECTION_MODE =
   getConfigValue("connection_mode", "OYSTERUN_CONNECTION_MODE") === "cloud"
     ? "cloud"
     : "direct";
-const PORT = parseInt(
-  getConfigValue("port", "OYSTERUN_PORT") || String(DEFAULT_HOST_CONFIG.port),
-  10
-);
+const PORT = RESOLVED_HOST_PORT;
+if (PORT === null) throw new Error("Invalid Host port; use an integer from 1 to 65535.");
 let localServiceControlReady = false;
 try {
   ensureLocalServiceControlToken({ configDir: getConfigDir() });
@@ -1010,23 +1073,6 @@ function isRouteCMatrixBindingNotFoundError(err) {
   );
 }
 
-function getLastMatrixMessagePreviewForBinding(binding) {
-  return sessionListPreviewService.readForBinding(binding).last_message_preview;
-}
-
-function getLastMessagePreview(agentFolder, agentId, sessionId) {
-  const binding = getRouteCMatrixRoomBinding(sessionId);
-  if (binding) {
-    if (agentId && binding.host_agent_id !== agentId) return null;
-    try {
-      return getLastMatrixMessagePreviewForBinding(binding);
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
-
 function shouldIncludeSessionListPreviews(url) {
   const raw = normalizeString(url.searchParams.get("include_previews"));
   return raw !== "0" && raw !== "false" && raw !== "no";
@@ -1562,6 +1608,39 @@ function isCleanSessionChatAppShellPath(requestPath) {
   return /^\/app\/sessions\/[^/]+\/chat\/?$/.test(requestPath);
 }
 
+function isCleanSessionMigratedSurfaceAppShellPath(requestPath) {
+  return /^\/app\/sessions\/[^/]+\/(?:profile|loop|explorer|file-preview)\/?$/.test(requestPath);
+}
+
+function buildLegacySessionSurfaceRedirectLocation(requestUrl) {
+  if (!(requestUrl instanceof URL)) return null;
+  const surface =
+    requestUrl.pathname === "/app/agent-profile"
+      ? "profile"
+      : requestUrl.pathname === "/app/session-loop"
+        ? "loop"
+        : null;
+  if (!surface) return null;
+  const sessionId = normalizeString(requestUrl.searchParams.get("session_id"));
+  if (!sessionId) return null;
+  return `/app/sessions/${encodeURIComponent(sessionId)}/${surface}${requestUrl.search}`;
+}
+
+function isStandaloneMigratedSurfaceAppShellPath(requestPath) {
+  return /^\/app\/(?:file-preview|web|browser|mail(?:\/[^/]+)?)\/?$/.test(requestPath);
+}
+
+function isStandaloneMigratedBrowseAppShellPath(requestPath) {
+  return requestPath === "/app/explorer" ||
+    requestPath === "/app/explorer/" ||
+    requestPath === "/app/folder-picker" ||
+    requestPath === "/app/folder-picker/" ||
+    requestPath === "/app/change-password" ||
+    requestPath === "/app/change-password/" ||
+    requestPath === "/app/tool-detail" ||
+    requestPath === "/app/tool-detail/";
+}
+
 function getCleanSessionChatAppShellSessionId(requestPath) {
   const match =
     typeof requestPath === "string"
@@ -1575,6 +1654,23 @@ function getCleanSessionChatAppShellSessionId(requestPath) {
   }
 }
 
+function getCleanSessionAppShellSessionId(requestPath) {
+  const chatSessionId = getCleanSessionChatAppShellSessionId(requestPath);
+  if (chatSessionId) return chatSessionId;
+  const match =
+    typeof requestPath === "string"
+      ? requestPath.match(
+          /^\/app\/sessions\/([^/]+)\/(?:profile|loop|explorer|file-preview)\/?$/,
+        )
+      : null;
+  if (!match) return null;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return match[1];
+  }
+}
+
 function buildStaleCleanSessionChatRedirectLocation() {
   return "/app/sessions?notice=stale_clean_chat";
 }
@@ -1634,7 +1730,11 @@ function serveWebChatAppDocument(req, res) {
 
   const response = buildRouteCStaticResponse(
     req,
-    readFileSync(ROUTEC_WEB_CHAT_INDEX_PATH),
+    readFileSync(ROUTEC_WEB_CHAT_INDEX_PATH, "utf8").replace("</head>",
+      `<script id="host-default-session-defaults-json" type="application/json">${JSON.stringify(getDefaultSessionDefaults()).replace(/</g, "\\u003c")}</script>` +
+      `<script id="host-default-shared-allowed-paths-json" type="application/json">${JSON.stringify(getDefaultSharedAllowedPaths()).replace(/</g, "\\u003c")}</script>` +
+      `<script id="host-routec-auth-loss-diagnostics-json" type="application/json">${JSON.stringify(readConfig().debug_routec_auth_loss_diagnostics_enabled === true)}</script>` +
+      `<script id="host-system-timezone-json" type="application/json">${JSON.stringify(getHostSystemTimezone()).replace(/</g, "\\u003c")}</script></head>`),
     getWebChatAppAssetHeaders(ROUTEC_WEB_CHAT_INDEX_PATH),
     { assetPath: ROUTEC_WEB_CHAT_INDEX_PATH }
   );
@@ -1804,6 +1904,7 @@ function getDashboardSessionRecord(token) {
 function dashboardAuthenticate(req) {
   const token = getDashboardSessionToken(req);
   if (!token) return null;
+  recordContinuityAuthenticatedUserPath(req);
   return {
     user_id: "dashboard-admin",
     device_id: DEVICE_ID || "local",
@@ -2486,6 +2587,7 @@ async function dispatchHostScheduleThroughTransientAcp(
     messageId,
     env: preparedRuntimeWorkspace.normalizedRuntimeEnv,
     redactionValues: mailCapability?.redactionValues || [],
+    timeoutMs: schedule.run_timeout_seconds * 1000,
   });
   return {
     ...result,
@@ -2526,6 +2628,7 @@ function createSchedulerSessionDispatcher(
         messageId,
         env: mailCapability?.env || {},
         redactionValues: mailCapability?.redactionValues || [],
+        timeoutMs: schedule.run_timeout_seconds * 1000,
       });
       return {
         ...result,
@@ -3015,6 +3118,9 @@ function buildHostSchedulerPayloadFromBody(body) {
     rule: buildHostSchedulerRuleFromBody(body),
     timezone: normalizeString(body.timezone),
     enabled: body.enabled === true,
+    runTimeoutSeconds: hasBodyField(body, "run_timeout_seconds")
+      ? body.run_timeout_seconds
+      : undefined,
   };
 }
 
@@ -3045,6 +3151,9 @@ function buildHostSchedulerPatchPayloadFromBody(body) {
   if (hasBodyField(body, "enabled")) {
     payload.enabled = body.enabled === true;
   }
+  if (hasBodyField(body, "run_timeout_seconds")) {
+    payload.runTimeoutSeconds = body.run_timeout_seconds;
+  }
   return payload;
 }
 
@@ -3053,16 +3162,11 @@ function getLoopbackHostOrigin() {
 }
 
 function getProductRuntimeHostOrigin() {
-  const activeDirectHostUrl = normalizeString(DIRECT_HOST_URL);
-  if (activeDirectHostUrl) return activeDirectHostUrl.replace(/\/+$/, "");
-  const config = readConfig();
-  const configuredDirectHostUrl = normalizeString(
-    config.direct_host_url || config.public_base_url
-  );
-  if (configuredDirectHostUrl) {
-    return configuredDirectHostUrl.replace(/\/+$/, "");
-  }
-  return getLoopbackHostOrigin();
+  return resolveProductRuntimeHostOrigin({
+    config: readConfig(),
+    directHostUrl: DIRECT_HOST_URL,
+    port: PORT,
+  });
 }
 
 function getSchedulerMailHostOrigin() {
@@ -3511,6 +3615,7 @@ function resolveSchedulerTargetToDirectProviderRun({ targetBinding }) {
 }
 
 const sessionManager = new SessionManager();
+const voiceInputReceipts = new VoiceInputReceiptStore();
 const voiceInputSingleFlight = new VoiceInputSingleFlight();
 const voiceInputUsageStore = new VoiceInputUsageStore({
   configDir: getConfigDir(),
@@ -3520,7 +3625,153 @@ const voiceInputRecordingCollector = new VoiceInputRecordingCollector({
   isOwnerCaptureEnabled: () =>
     readVoiceInputPrivateSettings(getConfigDir()).owner_capture_enabled === true,
 });
-const sessionListPreviewService = new SessionListPreviewService();
+let sessionListProjectionReadState = null;
+function getSessionListProjectionReadState() {
+  if (sessionListProjectionReadState) return sessionListProjectionReadState;
+  const db = openRouteCMatrixSQLiteStore({
+    jsonStoragePath: getRouteCMatrixStoragePath(),
+  });
+  const unreadReader = createCompletedSessionUnreadReader(db, {
+    hostUserId: HOST_OWNER_READ_CURSOR_USER_ID,
+  });
+  sessionListProjectionReadState = { db, unreadReader };
+  return sessionListProjectionReadState;
+}
+const sessionListPreviewService = new SessionListPreviewService({
+  readCheckpoints: ({ bindings }) => {
+    const { db } = getSessionListProjectionReadState();
+    return readRouteCMatrixSQLiteLatestTimelineSeqs(db, {
+      roomIds: bindings.map((binding) => binding.matrix_room_id),
+    });
+  },
+});
+const sessionListProjectionService = new SessionListProjectionService({
+  readTagLabels: currentSessionTagLabels,
+  readBindings: getRouteCMatrixRoomBindings,
+  previewService: sessionListPreviewService,
+  prepareDecorationRead: () => {
+    const { db, unreadReader } = getSessionListProjectionReadState();
+    return {
+      schemaVersion: unreadReader.schema_version,
+      readUnread: (binding, readContext) =>
+        unreadReader.read(binding, readContext),
+      withRoomRead: (roomId, read) => withRouteCMatrixSQLiteRoomReadContext(db, { roomId }, read),
+    };
+  },
+});
+
+const sessionCollectionAdmittedSessionIds = new Set();
+
+function buildCanonicalSessionCollectionRows() {
+  const allLiveSessions = sessionManager.list();
+  const desiredRestore = sessionManager.getDesiredOpenRestoreStatus();
+  const failedRestoreBySessionId = new Map(
+    desiredRestore.sessions
+      .filter((entry) => entry.state === "failed")
+      .map((entry) => [entry.session_id, entry])
+  );
+  const liveSessions = allLiveSessions.filter((session) => {
+    const sessionId = session.id || session.sessionId;
+    return (
+      !failedRestoreBySessionId.has(sessionId) &&
+      sessionCollectionAdmittedSessionIds.has(sessionId) &&
+      isSessionCollectionLiveSessionAdmitted(
+        sessionManager.getSession(sessionId),
+        getRouteCMatrixRoomBinding(sessionId)
+      )
+    );
+  });
+  const liveSessionIds = new Set(
+    liveSessions.map((session) => session.id || session.sessionId)
+  );
+  const liveRows = sessionListProjectionService
+    .metadata(liveSessions)
+    .session_rows.map((row) => {
+      const pendingControlRequests = serializePendingControlRequests(
+        sessionManager.getSession(row.session_id)
+      );
+      const providerLifecycle = sessionManager.getRouteCProviderLifecycle(
+        row.session_id,
+        { pendingControlRequests }
+      );
+      return {
+        ...row,
+        provider_lifecycle_active: providerLifecycle.active === true,
+        restore_failed: false,
+        restore_failed_reason: null,
+        manual_start_supported: false,
+        manual_start_setup_reason: null,
+      };
+    });
+  const historyRows = [];
+  const historyRecords = [...getSessionHistory()];
+  const historyRecordBySessionId = new Map(
+    historyRecords.map((record) => [record.session_id, record])
+  );
+  for (const failed of failedRestoreBySessionId.values()) {
+    if (historyRecordBySessionId.has(failed.session_id)) continue;
+    historyRecords.push({
+      session_id: failed.session_id,
+      session_name: failed.session_name || failed.session_id,
+      agent_id: failed.agent_id,
+      agent_folder: failed.agent_folder || null,
+      runtime: failed.provider || null,
+      model: failed.model || null,
+      created_at: failed.started_at || null,
+      last_active_at: failed.last_active_at || failed.started_at || null,
+      tags: [],
+    });
+  }
+  for (const record of historyRecords) {
+    if (!record.session_id || liveSessionIds.has(record.session_id)) continue;
+    const restoreFailure =
+      failedRestoreBySessionId.get(record.session_id) ||
+      (record.restore_failed_reason
+        ? {
+            session_id: record.session_id,
+            state: "failed",
+            reason: record.restore_failed_reason,
+          }
+        : null);
+    const folderAvailable = Boolean(
+      record.agent_folder && existsSync(record.agent_folder)
+    );
+    // Retained History membership is lifecycle-owned, even when its folder is gone.
+    if (!record.agent_id) continue;
+    const binding = getRouteCMatrixRoomBinding(record.session_id);
+    const disposition = buildHistoryResumeDisposition(record, Boolean(binding));
+    historyRows.push({
+      kind: "history",
+      session_id: record.session_id,
+      agent_id: record.agent_id,
+      session_name: record.session_name || record.session_id,
+      ...projectSessionTags(record),
+      agent_folder: record.agent_folder || null,
+      runtime: record.runtime || null,
+      model: record.model || null,
+      started_at: record.created_at || null,
+      last_active_at: record.last_active_at || record.created_at || null,
+      running: false,
+      resume_supported: disposition.resume_supported,
+      resume_unavailable_reason: disposition.resume_unavailable_reason,
+      restore_failed: Boolean(restoreFailure),
+      restore_failed_reason: restoreFailure?.reason || null,
+      manual_start_supported:
+        Boolean(restoreFailure) && folderAvailable && disposition.resume_supported,
+      manual_start_setup_reason: restoreFailure
+        ? folderAvailable
+          ? disposition.resume_unavailable_reason
+          : "agent_folder_missing"
+        : null,
+    });
+  }
+  return [...liveRows, ...historyRows];
+}
+
+const sessionCollectionService = new SessionCollectionService({
+  readRows: buildCanonicalSessionCollectionRows,
+  retention: 128,
+});
 const browserRootProjectIndex = new BrowserRootProjectIndex({ logger: console });
 setTranscriptSiteProjectFolderResolver((projectId) =>
   browserRootProjectIndex.resolveProjectFolder(projectId, { allowInvalid: true })
@@ -3548,6 +3799,10 @@ const toolEventDetailStore = createToolEventDetailStore({
 });
 const schedulerService = new SchedulerService({
   mailStore,
+  sessionLoopUnavailableGraceMs:
+    process.env.OYSTERUN_SESSION_LOOP_DEFINITION_UNAVAILABLE_GRACE_MS === undefined
+      ? undefined
+      : Number(process.env.OYSTERUN_SESSION_LOOP_DEFINITION_UNAVAILABLE_GRACE_MS),
   getHostOrigin: getSchedulerMailHostOrigin,
   getBrowserRootProjects: listBrowserRootSchedulerProjects,
   getBrowserRootMutationProjects: listBrowserRootSchedulerMutationProjects,
@@ -3589,31 +3844,17 @@ routeCMatrixFacade = createRouteCMatrixFacade({
   onCommittedMatrixEvent: async (matrixEvent) => {
     sessionListPreviewService.invalidateRoom(matrixEvent?.room_id);
     voiceInputRecordingCollector.observeCommittedMatrixEvent(matrixEvent);
-    const result =
-      await apnsCompleteMessageDispatcher.dispatchCommittedMatrixEvent(matrixEvent);
-    if (result?.notificationReleased === true && result?.candidate) {
-      broadcastCompleteMessageNotificationCandidate(result.candidate);
-    }
-    const targetSessionId =
-      matrixEvent?.content?.["org.oysterun.semantic.v1"]?.host_session_id ||
-      matrixEvent?.host_session_id ||
-      null;
-    if (callbackHostIntegration && targetSessionId) {
-      const semantic = matrixEvent?.content?.["org.oysterun.semantic.v1"] || {};
-      const terminalCompletion =
-        semantic.provider_completion_marker ===
-          "oysterun_provider_complete_message_notification_v1" &&
-        semantic.provider_completion_state !== "pending_turn_completion";
-      setImmediate(async () => {
-        try {
-          await callbackHostIntegration.observePendingForTarget(targetSessionId, {
-            finalizeSuccessfulWithoutMessage: terminalCompletion,
-          });
-        } catch (err) {
-          console.warn(`[p203-callback] committed truth observation failed: ${err.message || err}`);
-        }
-      });
-    }
+    observeCommittedCompletedTurn({
+      matrixEvent,
+      matrixStore: STARTUP_MATRIX_STORAGE,
+      getSession: (sessionId) => sessionManager.getSession(sessionId),
+      broadcastCandidate: broadcastCompleteMessageNotificationCandidate,
+      dispatchCandidate: (candidate, options) =>
+        apnsCompleteMessageDispatcher
+          .dispatchNotifiableProviderOutputNotificationCandidate(candidate, options),
+      callbackHostIntegration,
+      recordProjectionDiagnostic: recordCompletedTurnNotificationProjectionDiagnostic,
+    });
   },
 });
 // Matrix storage must be bootstrapped before the first consumer opens it. Keep
@@ -3659,6 +3900,30 @@ callbackHostIntegration = createCallbackHostIntegration({
     serverEventId,
   }) => {
     const binding = requireRouteCMatrixRoomBinding(session.id);
+    if (
+      deliveryKind === "callback_result" &&
+      !getRouteCHost2IntakeProof({
+        hostSessionId: session.id,
+        matrixRoomId: binding.matrix_room_id,
+        serverEventId,
+      })
+    ) {
+      const committed = readRouteCMatrixSQLiteEvent(STARTUP_MATRIX_STORAGE, {
+        roomId: binding.matrix_room_id,
+        eventId: serverEventId,
+      });
+      if (!committed) {
+        throw new Error("P238 callback provider recovery requires committed Matrix truth");
+      }
+      restoreRouteCHost2IntakeFromCommittedMatrixEvent({
+        hostSessionId: session.id,
+        matrixUserId: committed.sender,
+        matrixRoomId: binding.matrix_room_id,
+        txnId: messageId,
+        serverEventId,
+        content: committed.content,
+      });
+    }
     return sessionManager.deliverRouteCMatrixUserEventToProvider({
       sessionId: session.id,
       matrixUserId: binding.matrix_user_id,
@@ -3674,6 +3939,12 @@ callbackHostIntegration = createCallbackHostIntegration({
   },
   cancelProviderDelivery: ({ sessionId, messageId }) =>
     sessionManager.cancelOutboxMessage(sessionId, messageId),
+  reconcileProviderCancellation: ({ sessionId, messageId, providerText }) =>
+    sessionManager.reconcileProviderMessageCancellation(sessionId, {
+      messageId,
+      text: providerText,
+      reconcileProviderAcceptance: true,
+    }),
 });
 const schedulerSessionDispatcher = createSchedulerSessionDispatcher(
   sessionManager,
@@ -3700,6 +3971,18 @@ const providerAuthManager = new ProviderAuthManager({
 });
 const terminalSessionManager = new TerminalSessionManager();
 let lastHostRestartRestoreStatus = null;
+let lastDesiredOpenRestoreStatus = null;
+let desiredOpenReconciliationPromise = null;
+const DESIRED_OPEN_RESTORE_MAX_CONCURRENCY = 4;
+const DESIRED_OPEN_RESTORE_DEFAULT_SESSION_TIMEOUT_MS = 30_000;
+const DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS = (() => {
+  const injected = Number(
+    process.env.OYSTERUN_DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS
+  );
+  return isBoundaryTestRuntime() && Number.isInteger(injected) && injected >= 0
+    ? injected
+    : DESIRED_OPEN_RESTORE_DEFAULT_SESSION_TIMEOUT_MS;
+})();
 const telegramRealAdapter = createTelegramBotApiAdapter();
 const telegramMediaTransactionStore = new TelegramMediaTransactionStore();
 const telegramMockDebugGateClosedAdapter = {
@@ -3845,28 +4128,81 @@ let hostTelemetryScheduler = null;
  */
 const sessionSubscribers = new Map();
 const completeMessageNotificationSubscribers = new Set();
+const completedTurnNotificationProjectionDiagnosticKeys = new Set();
 const mailNotificationSubscribers = new Set();
+const sessionCollectionSubscribers = new Set();
 
-function broadcastCompleteMessageNotificationCandidate(candidate) {
-  if (!candidate || candidate.source !== "matrix_committed_event") return;
-  if (!isCompleteMessageCandidateNotificationEnabled(candidate)) return;
-  const payload = JSON.stringify({
-    type: "complete_message_notification",
-    source: "matrix_committed_event",
-    candidate,
+function recordCompletedTurnNotificationProjectionDiagnostic(completion) {
+  const identity = completion?.identity || {};
+  const terminal = completion?.terminal || {};
+  const reason = completion?.diagnostics?.notification_projection_reason;
+  const key = [
+    reason,
+    identity.host_session_id,
+    identity.matrix_room_id,
+    identity.provider_turn_id,
+    terminal.completion_event_id,
+  ].join(":");
+  if (completedTurnNotificationProjectionDiagnosticKeys.has(key)) return;
+  completedTurnNotificationProjectionDiagnosticKeys.add(key);
+  if (completedTurnNotificationProjectionDiagnosticKeys.size > 500) {
+    const oldest = completedTurnNotificationProjectionDiagnosticKeys.values().next().value;
+    if (oldest) completedTurnNotificationProjectionDiagnosticKeys.delete(oldest);
+  }
+  console.warn("[p218-notification] completed-message projection failed closed", {
+    reason,
+    projection_source: "shared_completed_turn_service",
+    host_session_id: identity.host_session_id || null,
+    matrix_room_id: identity.matrix_room_id || null,
+    provider_turn_id: identity.provider_turn_id || null,
+    completion_event_id: terminal.completion_event_id || null,
+  });
+}
+
+function commitSessionCollectionChange(changeKinds, affectedSessionIds = []) {
+  return sessionCollectionService.reconcile({
+    changeKinds,
+    affectedSessionIds,
+  });
+}
+
+function admitSessionCollectionSession(
+  sessionId,
+  changeKinds = ["create"],
+  { required = false } = {}
+) {
+  const session = sessionManager.getSession(sessionId);
+  const binding = getRouteCMatrixRoomBinding(sessionId);
+  const admittedSessionId = admitSessionCollectionLiveSession({
+    session,
+    binding,
+    admittedSessionIds: sessionCollectionAdmittedSessionIds,
+    required,
   });
-  for (const ws of [...completeMessageNotificationSubscribers]) {
+  if (!admittedSessionId) return null;
+  return commitSessionCollectionChange(changeKinds, [sessionId]);
+}
+
+sessionCollectionService.subscribe((event) => {
+  const payload = JSON.stringify(event);
+  for (const ws of [...sessionCollectionSubscribers]) {
     if (ws.readyState !== 1) {
-      completeMessageNotificationSubscribers.delete(ws);
+      sessionCollectionSubscribers.delete(ws);
       continue;
     }
     try {
       ws.send(payload);
     } catch {
-      completeMessageNotificationSubscribers.delete(ws);
+      sessionCollectionSubscribers.delete(ws);
     }
   }
-}
+});
+
+const broadcastCompleteMessageNotificationCandidate =
+  createCompleteMessageNotificationBroadcaster({
+    subscribers: completeMessageNotificationSubscribers,
+    isEnabled: isCompleteMessageCandidateNotificationEnabled,
+  });
 
 function broadcastMailNotificationCandidate(candidate) {
   if (!candidate || candidate.source !== "mail_item_committed") return;
@@ -4456,6 +4792,13 @@ sessionManager.on("runtimeEvent", (agentId, event) => {
   const enrichedEvent = ensurePersistableEventFields(
     attachRuntimeTurnId(event, () => null)
   );
+  if (enrichedEvent.type === "session.ready") {
+    const readySessionId =
+      enrichedEvent.sessionId || enrichedEvent.session_id;
+    if (sessionManager.getSession(readySessionId)?.hostRestartRestore) {
+      admitSessionCollectionSession(readySessionId, ["restore"]);
+    }
+  }
   recordRuntimeEventTelemetry(enrichedEvent);
   if (
     enrichedEvent.type === "session.notice" &&
@@ -4496,6 +4839,24 @@ sessionManager.on("runtimeEvent", (agentId, event) => {
       }
     }
   }
+  if (
+    enrichedEvent.type === "session.ready" &&
+    callbackHostIntegration
+  ) {
+    const readySessionId =
+      enrichedEvent.sessionId || enrichedEvent.session_id || null;
+    if (readySessionId) {
+      setImmediate(async () => {
+        try {
+          await callbackHostIntegration.reconcileSourceReady(readySessionId);
+        } catch (err) {
+          console.warn(
+            `[p238-callback] source-ready reconciliation failed: ${err.message || err}`
+          );
+        }
+      });
+    }
+  }
   const routeCSemanticRuntimeTypes = new Set([
     "message.assistant",
     "message.thinking",
@@ -4519,6 +4880,21 @@ sessionManager.on("runtimeEvent", (agentId, event) => {
   ) {
     scheduleRouteCSemanticBridgeWrite(enrichedEvent);
   }
+  const lifecycleSessionId =
+    enrichedEvent.sessionId || enrichedEvent.session_id || null;
+  if (
+    lifecycleSessionId &&
+    (enrichedEvent.type === "outbox.message" ||
+      enrichedEvent.type === "control.request" ||
+      enrichedEvent.type === "control.outcome" ||
+      (enrichedEvent.type === "session.notice" &&
+        enrichedEvent.subtype === "delivery.state"))
+  ) {
+    commitSessionCollectionChange(
+      ["provider_lifecycle"],
+      [lifecycleSessionId]
+    );
+  }
   broadcast(enrichedEvent.sessionId || enrichedEvent.session_id || null, {
     type: "event",
     event: enrichedEvent,
@@ -4855,6 +5231,115 @@ function materializeRouteCMatrixBindingForSessionSend(session) {
   };
 }
 
+function sessionTagLabelOwners() {
+  // Current live rows may outlive the bounded retained history window.
+  const owners = new Map(
+    getSessionHistory().map((row) => [row.session_id, row])
+  );
+  for (const row of sessionManager.list())
+    owners.set(row.id || row.sessionId, row);
+  return [...owners.values()];
+}
+
+function currentSessionTagLabels() {
+  return new SessionTagLabelsStore(getConfigDir()).labelsFor(
+    sessionTagLabelOwners()
+  );
+}
+
+function saveSuccessfulSessionTags(
+  session,
+  tags,
+  {
+    promote = true,
+    admission = false,
+    changeKinds = ["tags", "category"],
+    restoreReady = false,
+  } = {}
+) {
+  const restoreHistory = captureSessionTagsHistoryRollback();
+  const previousTags = session.tags;
+  const wasDeferred = session.tagsPersistenceDeferred;
+  const wasAdmitted = sessionCollectionAdmittedSessionIds.has(session.id);
+  const previousRestoreOutcome = restoreReady
+    ? sessionManager.getDesiredOpenRestoreOutcome(session.id)
+    : null;
+  const saved = commitSessionTagSave({
+    tags,
+    store: new SessionTagLabelsStore(getConfigDir()),
+    owners: sessionTagLabelOwners,
+    promote,
+    writeTags: (tags) => {
+      updateSessionRecord(session.id, { tags });
+      session.tags = tags;
+      if (restoreReady) sessionManager.markDesiredOpenRestoreReady(session.id);
+    },
+    rollbackTags: () => {
+      restoreHistory();
+      session.tags = previousTags;
+      session.tagsPersistenceDeferred = wasDeferred;
+      if (previousRestoreOutcome) {
+        sessionManager.desiredOpenRestoreOutcomes.set(
+          session.id,
+          previousRestoreOutcome
+        );
+      }
+    },
+    admit: () => {
+      if (admission)
+        admitSessionCollectionLiveSession({
+          session,
+          binding: getRouteCMatrixRoomBinding(session.id),
+          admittedSessionIds: sessionCollectionAdmittedSessionIds,
+          required: true,
+        });
+    },
+    publish: () =>
+      commitSessionCollectionChange(
+        changeKinds,
+        [session.id]
+      ),
+    rollbackPublication: () =>
+      commitSessionCollectionChange(
+        ["tags", "category"],
+        [session.id]
+      ),
+    rollbackAdmission: () => {
+      if (!wasAdmitted) sessionCollectionAdmittedSessionIds.delete(session.id);
+    },
+  });
+  session.tagsPersistenceDeferred = false;
+  if (promote) recordSuccessfulSessionTagsUse(session, saved);
+  return saved;
+}
+
+function commitSuccessfulSessionTags(
+  session,
+  { promote = true, changeKinds = ["create"], restoreReady = false } = {}
+) {
+  return saveSuccessfulSessionTags(session, canonicalSessionTags(session), {
+    promote,
+    admission: true,
+    restoreReady,
+    changeKinds: [...changeKinds, "tags", "category"],
+  });
+}
+
+function refreshSessionBookkeepingWarning(response, session) {
+  response.bookkeeping_warning = (session.bookkeepingWarnings || []).join("; ") || null;
+}
+
+function recordSuccessfulSessionTagsUse(session, tags) {
+  try {
+    new RecentSessionTagsStore(getConfigDir()).recordSuccessfulUse(tags);
+  } catch (err) {
+    session.bookkeepingWarnings = [
+      ...(session.bookkeepingWarnings || []),
+      `recent_session_tags_unavailable: ${err.message || String(err)}`,
+    ];
+  }
+}
+
 function clearTelegramMockRuntimeForSession(sessionId, reason) {
   const normalizedSessionId = normalizeString(sessionId);
   if (!normalizedSessionId) {
@@ -6008,7 +6493,7 @@ function buildProviderModelRefreshRunnerOptions() {
     backgroundRefreshEnabled: explicitEnable !== false,
     backgroundRefreshSource:
       explicitEnable === null
-        ? "default_product_background_24h"
+        ? "default_product_background_daily_0900"
         : PROVIDER_MODEL_REFRESH_BACKGROUND_ENABLE_ENV,
     backgroundRefreshDisabledReason:
       explicitEnable === false
@@ -6692,6 +7177,8 @@ function loadActiveHostLifecycleToolchainBundle() {
 }
 
 const OYSTERUN_NPM_PACKAGE_NAME = "oysterun";
+const P233_RUNNING_PACKAGE_VERSION = readOysterunPackageVersion();
+const p233AuthenticatedUserOrigins = new Map();
 const OYSTERUN_UPDATE_DEFAULT_REGISTRY_URL = "https://registry.npmjs.org";
 const OYSTERUN_UPDATE_RELEASE_CHANNEL = "latest";
 const OYSTERUN_UPDATE_AUTOMATIC_COOLDOWN_MS = 30 * 60 * 1000;
@@ -6877,8 +7364,11 @@ function getCachedNewestVersion(source = "status") {
 }
 
 function reconcileOysterunUpdateOperation(currentVersion) {
-  let operation = readUpdateOperationState({ configDir: getConfigDir() });
+  let operation = reconcileFailedInitialPreflight({ configDir: getConfigDir(), currentVersion });
   if (!operation.operation_id) return null;
+  if (operation.continuity_path === continuityReceiptPath(getConfigDir(), operation.operation_id)) {
+    try { operation = projectContinuityOperation(operation, readContinuity(operation.continuity_path, operation.operation_id)); } catch { /* Missing authority stays blocked. */ }
+  }
   const targetVersion = normalizeString(operation.target_version);
   const targetVersionComparison = targetVersion
     ? compareOysterunSemver(currentVersion, targetVersion)
@@ -6908,6 +7398,16 @@ function reconcileOysterunUpdateOperation(currentVersion) {
   }
   if (shouldRequireUpdateOperationRecovery(operation)) {
     const restartOnly = operation.transaction_kind === "restart_only";
+    if (operation.continuity_path) {
+      try {
+        const r = readContinuity(operation.continuity_path, operation.operation_id);
+        if (!["COMMITTED", "CLEANED", "ROLLED_BACK_HEALTHY"].includes(r.state)) {
+          const failed = recordContinuityRecovery(operation.continuity_path, operation.operation_id,
+            continuityFailure(restartOnly ? "restart_runner" : "update_runner", "runner_lease_expired", "The external lifecycle runner did not publish a terminal receipt before its bounded lease expired."));
+          operation = projectContinuityOperation(operation, failed);
+        }
+      } catch { /* Missing authority is reported by the recovery plan. */ }
+    }
     operation = writeUpdateOperationState(
       {
         ...operation,
@@ -6923,8 +7423,8 @@ function reconcileOysterunUpdateOperation(currentVersion) {
           ? "The Host restart runner did not publish a terminal receipt before its bounded lease expired."
           : "The update restart runner did not publish a terminal receipt before its bounded lease expired.",
         recovery_boundary: operation.status,
-        error:
-          "The update transaction needs operator recovery before another update or restart.",
+        error: restartOnly ? "The Host restart needs recovery before another Host action."
+          : "The update transaction needs recovery before another update or restart.",
         error_redacted: true,
       },
       { configDir: getConfigDir() }
@@ -6939,6 +7439,8 @@ function serializeOysterunUpdateOperation(operation) {
     operation_id: operation.operation_id,
     attempt_id: operation.attempt_id,
     transaction_kind: operation.transaction_kind,
+    continuity_state: operation.continuity_state || null,
+    user_path_verification: operation.user_path_verification || null,
     requested_action: operation.requested_action,
     status: operation.status,
     phase: operation.phase,
@@ -7282,6 +7784,8 @@ function digestOriginalLifecycleEvidence(operation, resultReceipt) {
   return createHash("sha256").update(canonical).digest("hex");
 }
 
+const continuityAutomaticRechecks = new Set();
+
 function maybeCloseSupersededOysterunUpdateRecovery() {
   const currentVersion = readOysterunPackageVersion();
   let operation = reconcileOysterunUpdateOperation(currentVersion);
@@ -7294,6 +7798,29 @@ function maybeCloseSupersededOysterunUpdateRecovery() {
       update_operation: null,
     };
   }
+  if (operation.continuity_path) {
+    let receipt = null;
+    try {
+      if (operation.continuity_path !== continuityReceiptPath(getConfigDir(), operation.operation_id)) throw new Error("continuity path mismatch");
+      receipt = readContinuity(operation.continuity_path, operation.operation_id);
+    } catch { /* The recovery projection fails closed on missing authority. */ }
+    if (receipt?.state === "RECOVERY_REQUIRED" && !operation.running && !isProcessRunning(operation.runner_pid) &&
+        (operation.recovery_boundary === "p233_user_path_pending" || receipt.first_failure?.code === "p233_user_path_pending" ||
+          (!receipt.restart_attempted && !receipt.restart_id)) && !continuityAutomaticRechecks.has(operation.operation_id)) {
+      continuityAutomaticRechecks.add(operation.operation_id);
+      try {
+        scheduleContinuityRecovery({ kind: "restore_and_restart", source: "automatic_recheck", recheckOnly: true });
+        operation = readUpdateOperationState({ configDir: getConfigDir() });
+      } catch (error) {
+        console.warn("[lifecycle] Automatic restoration recheck could not start:", sanitizeLifecycleDiagnostic(error.message));
+      }
+    }
+    const recoveryPlan = buildHostLifecycleRecoveryPlan({ operation, continuityReceipt: receipt,
+      runnerAlive: isProcessRunning(operation.runner_pid) });
+    return { status: "continuity_operation_observed", reconciled: false,
+      recovery_boundary: recoveryPlan.reason_code, recovery_plan: recoveryPlan,
+      recovery_action: recoveryPlan.user_action, update_operation: serializeOysterunUpdateOperation(operation) };
+  }
   if (operation.status === "superseded_reconciled") {
     const configuredReceiptPath = normalizeString(
       operation.reconciliation_receipt_path
@@ -7663,13 +8190,13 @@ function reconcileSupersededOysterunUpdateRecovery() {
 }
 
 function buildOysterunBetaUpdateStatusPayload(extra = {}) {
-  const currentVersion = readOysterunPackageVersion();
+  const currentVersion = P233_RUNNING_PACKAGE_VERSION;
   const betaVersion = normalizeString(extra.beta_version);
   const classification = betaVersion
     ? classifyOysterunBetaVersion({ currentVersion, betaVersion })
     : { relation: "unknown", install_available: false };
   const recoveryResolution = maybeCloseSupersededOysterunUpdateRecovery();
-  const operation = readUpdateOperationState({ configDir: getConfigDir() });
+  const operation = reconcileOysterunUpdateOperation(currentVersion) || readUpdateOperationState({ configDir: getConfigDir() });
   const updateSupported = isOysterunUpdateSupported();
   return {
     status: extra.status || "beta_update_status",
@@ -7722,7 +8249,9 @@ function buildOysterunBetaUpdateStatusPayload(extra = {}) {
 }
 
 function buildOysterunUpdateStatusPayload(extra = {}) {
-  const currentVersion = readOysterunPackageVersion();
+  // Package exchange precedes restart. Keep the user-visible current version
+  // bound to this running coordinator, including failed pre-handoff updates.
+  const currentVersion = P233_RUNNING_PACKAGE_VERSION;
   const channel = normalizeOysterunUpdateChannel(extra.channel, currentVersion);
   const source = normalizeOysterunUpdateSource(extra.source, "status");
   const reminder = readUpdateReminderState({ configDir: getConfigDir() });
@@ -7730,7 +8259,7 @@ function buildOysterunUpdateStatusPayload(extra = {}) {
     normalizeString(extra.newest_version || extra.latest_version) ||
     getCachedNewestVersion(source);
   const recoveryResolution = maybeCloseSupersededOysterunUpdateRecovery();
-  const operation = readUpdateOperationState({ configDir: getConfigDir() });
+  const operation = reconcileOysterunUpdateOperation(currentVersion) || readUpdateOperationState({ configDir: getConfigDir() });
   const updateAvailable = newestVersion
     ? compareOysterunSemver(newestVersion, currentVersion) === 1
     : false;
@@ -8225,52 +8754,237 @@ function buildHostActiveRuntimeStatusSummary() {
   };
 }
 
-function buildHostRestartRuntimeSnapshot({ trigger }) {
-  return {
-    trigger,
-    captured_at: new Date().toISOString(),
-    sessions: sessionManager.snapshotHostRestartState(),
-    loops: schedulerService.snapshotSessionLoopRestartState(),
-    scheduler: schedulerService.snapshotHostRestartState(),
-    terminal: terminalSessionManager.snapshotHostRestartState(),
-    shell_execs: buildActiveShellExecRestartSnapshot(),
-    telegram: telegramBridgeManager.snapshotHostRestartState(),
-    prompt_replay_policy: HOST_RESTART_RESTORE_NO_PROMPT_REPLAY_POLICY,
-    matrix_transcript_mutation: false,
-  };
-}
-
-function buildHostRestartOperationLogPath() {
-  const logDir = join(getConfigDir(), "operation_logs");
-  mkdirSync(logDir, { recursive: true });
-  return join(
-    logDir,
-    `host-restart-restore-${new Date().toISOString().replace(/[:.]/g, "-")}.log`
-  );
-}
-
-function assertHostRestartSchedulingAvailable() {
-  const stackName = getActiveStackName();
-  if (!stackName) {
-    throw new Error(
-      "Host restart is unavailable because the active stack name is not known."
-    );
+function recordContinuityAuthenticatedUserPath(req) {
+  const config = readConfig();
+  const incomingHost = normalizeString(req.headers["x-forwarded-host"] || req.headers.host);
+  let configuredRouteRecorded = false;
+  for (const candidate of [config.managed_endpoint, config.direct_host_url, config.public_base_url]) {
+    if (!candidate) continue;
+    const origin = new URL(candidate).origin;
+    if (new URL(origin).host !== incomingHost) continue;
+    p233AuthenticatedUserOrigins.set(origin, { pid: process.pid, observed_at: new Date().toISOString() });
+    configuredRouteRecorded = true;
+  }
+  if (configuredRouteRecorded) {
+    completeContinuityUserPathEvidence();
+    return;
   }
-  if (isBoundaryTestRuntime()) {
-    throw new Error("Host restart is unavailable from boundary test runtime.");
+  if (!incomingHost) return;
+  // A route-less local stack is intentionally reachable only through its
+  // exact loopback port. Do not trust an arbitrary Host header as continuity
+  // authority; accept only loopback aliases bound to this running Host.
+  let incoming;
+  try {
+    incoming = new URL(`http://${incomingHost}`);
+  } catch {
+    return;
   }
-  const restartScript = join(REPO_ROOT, "tool_scripts", "restart_oysterun.sh");
-  if (!existsSync(restartScript)) {
-    throw new Error(`Host restart script is missing: ${restartScript}`);
+  if (
+    !["127.0.0.1", "localhost", "[::1]"].includes(incoming.hostname) ||
+    Number(incoming.port || 80) !== Number(PORT)
+  ) {
+    return;
   }
-  return { stackName, restartScript };
+  const proof = { pid: process.pid, observed_at: new Date().toISOString() };
+  for (const origin of [
+    `http://127.0.0.1:${PORT}`,
+    `http://localhost:${PORT}`,
+    `http://[::1]:${PORT}`,
+  ]) {
+    p233AuthenticatedUserOrigins.set(origin, proof);
+  }
+  completeContinuityUserPathEvidence();
 }
 
-function runCompleteHostLifecyclePreflight({
-  toolchain,
-  allowOperationId = null,
-  expectedCurrentHostCwd = null,
-  expectedSourceServiceDefinitionSha256 = null,
+function completeContinuityUserPathEvidence() {
+  try {
+    const operation = readUpdateOperationState({ configDir: getConfigDir() });
+    if (!operation.operation_id || operation.continuity_path !== continuityReceiptPath(getConfigDir(), operation.operation_id)) return;
+    const receipt = readContinuity(operation.continuity_path, operation.operation_id);
+    const origin = receipt.user_path_verification?.origin;
+    const proof = p233AuthenticatedUserOrigins.get(origin);
+    if (proof?.pid === process.pid) recordContinuityUserPath(operation.continuity_path, operation.operation_id, { origin, ...proof });
+  } catch (error) {
+    console.warn("[lifecycle] Could not record supplementary login verification:", sanitizeLifecycleDiagnostic(error.message));
+  }
+}
+
+function buildHostContinuityObservation(retained = null) {
+  const config = readConfig();
+  const stack = getActiveStackName();
+  const service = getUpdateServiceDefinitionIdentity(stack);
+  const toolchain = loadActiveHostLifecycleToolchainBundle();
+  if (realpathSync(process.execPath) !== toolchain.node_realpath) {
+    throw continuityFailure("host_qualification", "running_node", "Running Host executable differs from the persisted Node runtime.");
+  }
+  const host = {
+    version: P233_RUNNING_PACKAGE_VERSION, pid: process.pid, port: PORT, stack,
+    package_root: REPO_ROOT, process_cwd: realpathSync(process.cwd()),
+    node_version: process.version, runtime_identity_digest: toolchain.toolchain_identity_digest,
+    device_id: normalizeString(config.device_id || config.host_id || DEVICE_ID),
+    config_dir: realpathSync(getConfigDir()), host_folder: realpathSync(getConfigDir()),
+    browser_root: realpathSync(resolveDefaultBrowsePath()),
+    connection_mode: CONNECTION_MODE,
+    managed_endpoint: normalizeString(config.managed_endpoint),
+    direct_host_url: normalizeString(config.direct_host_url || config.public_base_url || DIRECT_HOST_URL),
+    service_definition_sha256: existsSync(service.definitionPath)
+      ? continuityDigest(readFileSync(service.definitionPath)) : "absent",
+    service_definition_path: service.definitionPath,
+  };
+  const sessions = sessionManager.snapshotHostRestartState()
+    .filter((row) => row.alive_before_restart || row.ready_before_restart)
+    .map((row) => {
+      try {
+      const binding = getRouteCMatrixRoomBinding(row.session_id);
+      if (!binding) throw continuityFailure("session_qualification", "matrix_binding", `Session ${row.session_id} has no committed Matrix binding.`);
+      const prior = retained?.sessions.find((entry) => entry.session_id === row.session_id);
+      const anchorIds = prior ? prior.history_anchors.map((entry) => entry.event_id)
+        : readMatrixTranscriptRecentTail({ binding, limit: 2 }).messages.map((message) => message.matrix_event_id);
+      const historyAnchors = anchorIds.map((eventId) => {
+        const event = readMatrixTranscriptContext({ binding, eventId, before: 0, after: 0 })?.target_message;
+        if (!event) throw continuityFailure("session_qualification", "history_anchor_missing", `Session ${row.session_id} lost a retained Matrix event.`);
+        return { event_id: eventId, sha256: continuityDigest(event) };
+      });
+      return {
+        session_id: row.session_id, agent_id: row.agent_id, agent_folder: realpathSync(row.agent_folder),
+        provider: row.provider, provider_resume_id: row.provider_resume_id,
+        resume_identity_kind: row.resume_identity_kind || null,
+        provider_thread_id: row.provider_thread_id || row.provider_resume_id,
+        matrix_binding_host_session_id: binding.host_session_id,
+        matrix_room_id: binding.matrix_room_id,
+        adapter_resume_identity_kind: getAdapterResumeIdentityKind(sessionManager.getAdapter(row.provider)),
+        adapter_registered: Boolean(sessionManager.getAdapter(row.provider)),
+        alive: row.alive_before_restart, ready: row.ready_before_restart,
+        history_anchors: historyAnchors,
+      };
+      } catch (error) {
+        return { session_id: row.session_id, observation_error: error.code || "session_observation_failed" };
+      }
+    });
+  const baseline = { host, sessions, captured_at: new Date().toISOString() };
+  const restore = readHostRestartRestoreState({ configDir: getConfigDir() });
+  const routeOrigin = resolveContinuityQualificationOrigin({
+    connectionMode: host.connection_mode,
+    managedEndpoint: host.managed_endpoint,
+    directHostUrl: host.direct_host_url,
+    loopbackOrigin: `http://127.0.0.1:${PORT}`,
+  });
+  return {
+    baseline, host, sessions, desired_session_restore: sessionManager.getDesiredOpenRestoreStatus(),
+    restore_result: restore?.restore_result || null,
+    restart_id: restore?.restart_id || null, restart_state: restore?.state || null,
+    authenticated_user_path: p233AuthenticatedUserOrigins.get(routeOrigin) || null,
+  };
+}
+
+function prepareHostContinuity({ operationId, targetVersion, toolchain, transactionKind, restartState = null }) {
+  const path = continuityReceiptPath(getConfigDir(), operationId);
+  const { baseline } = buildHostContinuityObservation();
+  const authority = {};
+  if (restartState) {
+    authority.restart_id = restartState.restart_id;
+    authority.restart_only_snapshot = retainContinuityFile(getHostRestartRestoreStatePath(getConfigDir()), `${path}.restore`);
+  }
+  const operation = readUpdateOperationState({ configDir: getConfigDir() });
+  if (operation.operation_id !== operationId) throw continuityFailure("preparation", "operation_binding", "Lifecycle operation changed before its durable preparation.");
+  writeUpdateOperationState({ ...operation, continuity_path: path }, { configDir: getConfigDir() });
+  prepareContinuity({ path, operationId, transactionKind, authority,
+    source: { version: P233_RUNNING_PACKAGE_VERSION, runtime_identity_digest: toolchain.toolchain_identity_digest,
+      package_tree_sha256: digestContinuityPackage(REPO_ROOT), service_definition_sha256: baseline.host.service_definition_sha256 },
+    target: { version: targetVersion, runtime_identity_digest: toolchain.toolchain_identity_digest }, baseline });
+  compareContinuityIdentities(baseline.sessions, baseline.sessions, { path, operationId, stage: "preparation" });
+  for (const row of baseline.sessions) {
+    if (row.observation_error || !hasCompleteContinuityResumeIdentity(row) || !Array.isArray(row.history_anchors)) {
+      throw continuityFailure("preparation", "session_resume_unavailable", `Session ${row.session_id} has no complete provider resume/history identity.`);
+    }
+  }
+  if (restartState) assertFreshContinuitySnapshot(baseline, restartState.restart_id, restartState, { path, operationId });
+  createContinuityProbeGrant(getConfigDir(), operationId);
+  return path;
+}
+
+function assertSessionRosterMutationAvailable() {
+  const operation = readUpdateOperationState({ configDir: getConfigDir() });
+  if (!operation.continuity_path || !isUpdateOperationBlocking(operation)) return;
+  const receipt = readContinuity(operation.continuity_path, operation.operation_id);
+  if (!receipt.restart_id || ["CLEANED", "ROLLED_BACK_HEALTHY"].includes(receipt.state)) return;
+  const error = new Error("Host lifecycle recovery is preserving the fresh live Sessions. Finish that operation before changing Sessions.");
+  error.code = "oysterun_session_roster_reserved";
+  throw error;
+}
+
+function recordContinuityRunnerHandoffFailure({ operationId, error, gateId = null, stage = null, check = null }) {
+  const current = readUpdateOperationState({ configDir: getConfigDir() });
+  if (current.operation_id !== operationId || !current.continuity_path) return;
+  const prior = readContinuity(current.continuity_path, operationId);
+  if (["CLEANED", "ROLLED_BACK_HEALTHY"].includes(prior.state)) return;
+  const restartOnly = prior.transaction_kind === "restart_only";
+  const failure = continuityFailure(stage || (restartOnly ? "restart_handoff" : "update_handoff"), check || (restartOnly ? "restart_runner_spawn_failed" : "update_runner_spawn_failed"),
+    sanitizeLifecycleDiagnostic(error?.message || "The external lifecycle runner could not start."));
+  const receipt = prior.state === "COMMITTED" ? prior : recordContinuityRecovery(current.continuity_path, operationId, failure);
+  writeUpdateOperationState({ ...projectContinuityOperation(current, receipt),
+    status: restartOnly ? "restart_recovery_required" : "update_recovery_required",
+    phase: prior.state === "COMMITTED" ? "Committed cleanup requires continuation" : "External runner unavailable; recovery assets retained",
+    running: false, runner_pid: null, runner_lease_expires_at: null, lifecycle_owner_pid: null,
+    recovery_required_at: new Date().toISOString(), recovery_boundary: failure.code,
+    recovery_reason: failure.message, error: failure.message, error_redacted: true,
+  }, { configDir: getConfigDir() });
+  releaseHostRestartLoginGateSafely({ gateId, reason: "continuity_runner_spawn_failed", source: "Continuity runner handoff" });
+}
+
+function buildHostRestartRuntimeSnapshot({ trigger }) {
+  return {
+    trigger,
+    captured_at: new Date().toISOString(),
+    sessions: sessionManager.snapshotHostRestartState().map((row) => {
+      const binding = getRouteCMatrixRoomBinding(row.session_id);
+      return { ...row,
+        matrix_binding_host_session_id: binding?.host_session_id || null,
+        matrix_room_id: binding?.matrix_room_id || null,
+        adapter_resume_identity_kind: getAdapterResumeIdentityKind(sessionManager.getAdapter(row.provider)),
+        adapter_registered: Boolean(sessionManager.getAdapter(row.provider)) };
+    }),
+    loops: schedulerService.snapshotSessionLoopRestartState(),
+    scheduler: schedulerService.snapshotHostRestartState(),
+    terminal: terminalSessionManager.snapshotHostRestartState(),
+    shell_execs: buildActiveShellExecRestartSnapshot(),
+    telegram: telegramBridgeManager.snapshotHostRestartState(),
+    prompt_replay_policy: HOST_RESTART_RESTORE_NO_PROMPT_REPLAY_POLICY,
+    matrix_transcript_mutation: false,
+  };
+}
+
+function buildHostRestartOperationLogPath() {
+  const logDir = join(getConfigDir(), "operation_logs");
+  mkdirSync(logDir, { recursive: true });
+  return join(
+    logDir,
+    `host-restart-restore-${new Date().toISOString().replace(/[:.]/g, "-")}.log`
+  );
+}
+
+function assertHostRestartSchedulingAvailable() {
+  const stackName = getActiveStackName();
+  if (!stackName) {
+    throw new Error(
+      "Host restart is unavailable because the active stack name is not known."
+    );
+  }
+  if (isBoundaryTestRuntime()) {
+    throw new Error("Host restart is unavailable from boundary test runtime.");
+  }
+  const restartScript = join(REPO_ROOT, "tool_scripts", "restart_oysterun.sh");
+  if (!existsSync(restartScript)) {
+    throw new Error(`Host restart script is missing: ${restartScript}`);
+  }
+  return { stackName, restartScript };
+}
+
+function runCompleteHostLifecyclePreflight({
+  toolchain,
+  allowOperationId = null,
+  expectedCurrentHostCwd = null,
+  expectedSourceServiceDefinitionSha256 = null,
   expectedTargetServiceDefinitionSha256 = null,
 } = {}) {
   const { stackName } = assertHostRestartSchedulingAvailable();
@@ -8352,114 +9066,12 @@ function runCompleteHostLifecyclePreflight({
 }
 
 function getUpdateServiceDefinitionIdentity(stackName) {
-  const production = stackName === "production";
-  const configDir = resolve(getConfigDir());
-  const stackRoot = production ? configDir : dirname(configDir);
-  const logDir = production ? join(configDir, "logs") : join(stackRoot, "logs");
-  const serviceLabel = production ? "com.oysterun.host" : `com.oysterun.host.${stackName}`;
-  const stackKind = ["production", "staging", "test1", "test2", "test3", "test4"].includes(stackName)
-    ? "preset"
-    : "custom";
-  return {
-    production,
-    configDir,
-    stackRoot,
-    logDir,
-    hostLog: join(logDir, stackKind === "custom" ? `oysterun-host-${stackName}.log` : "oysterun-host.log"),
-    serviceLabel,
-    stackKind,
-    definitionPath: join(homedir(), "Library", "LaunchAgents", `${serviceLabel}.plist`),
-  };
-}
-
-function resolveFrozenProviderLaunchPath({ toolchain, packageRoot = REPO_ROOT }) {
-  const result = spawnSync(
-    toolchain.node_path,
-    [
-      join(packageRoot, "host-service", "provider-command-detection.mjs"),
-      "--print-launch-path",
-      "--config-path",
-      getConfigPath(),
-      "--node-bin",
-      toolchain.node_path,
-    ],
-    {
-      cwd: packageRoot,
-      env: buildNodeNpmChildEnvironment(toolchain, process.env),
-      encoding: "utf8",
-      stdio: "pipe",
-    }
-  );
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    throw new Error(`target provider resolution failed: ${sanitizeLifecycleDiagnostic(result.stderr || result.stdout)}`);
-  }
-  const pathEntries = String(result.stdout || "").trim().split(":").filter(Boolean);
-  if (pathEntries.length === 0) throw new Error("target provider resolution returned an empty PATH");
-  return pathEntries;
+  return getServiceDefinitionIdentity({ stackName, configDir: getConfigDir() });
 }
 
-function buildUpdateServiceRenderBundle({
-  toolchain,
-  stackName,
-  registry,
-  packageRoot = REPO_ROOT,
-  packageVersion = readOysterunPackageVersion(),
-}) {
-  const identity = getUpdateServiceDefinitionIdentity(stackName);
-  const manifestRaw = readFileSync(join(packageRoot, "package.json"), "utf8");
-  const manifest = JSON.parse(manifestRaw);
-  const versionOwned = manifest.oysterun_service_definition || {};
-  return {
-    schema_version: 1,
-    artifact: {
-      package_root: resolve(packageRoot),
-      package_realpath: realpathSync(packageRoot),
-      package_version: packageVersion,
-      integrity_sha256: createHash("sha256").update(manifestRaw).digest("hex"),
-    },
-    host: {
-      launch_domain: `gui/${process.getuid?.() ?? 0}`,
-      user: process.env.USER || "unknown",
-      stack_name: stackName,
-      port: PORT,
-      config_dir: identity.configDir,
-      stack_root: identity.stackRoot,
-      log_dir: identity.logDir,
-      host_log: identity.hostLog,
-      service_label: identity.serviceLabel,
-      stack_kind: identity.stackKind,
-      production: identity.production,
-    },
-    runtime: {
-      node_path: toolchain.node_path,
-      node_realpath: toolchain.node_realpath,
-      node_version: toolchain.node_version,
-      node_abi: toolchain.node_abi,
-      npm_cli_path: toolchain.npm_cli_path,
-      npm_cli_realpath: toolchain.npm_cli_realpath,
-      npm_version: toolchain.npm_version,
-      platform: toolchain.platform,
-      architecture: toolchain.architecture,
-      toolchain_identity_digest: toolchain.toolchain_identity_digest,
-    },
-    update: {
-      registry_authority: registry.source,
-      registry_url: registry.override_active ? registry.url : null,
-      state_path: normalizeString(process.env.OYSTERUN_UPDATE_REGISTRY_STATE_PATH),
-    },
-    provider_resolution: {
-      path_entries: resolveFrozenProviderLaunchPath({ toolchain, packageRoot }),
-      environment: {},
-    },
-    version_owned: {
-      environment: versionOwned.environment || {},
-      top_level: versionOwned.top_level || {},
-      run_at_load: versionOwned.run_at_load ?? true,
-      keep_alive: versionOwned.keep_alive ?? true,
-      throttle_interval: versionOwned.throttle_interval ?? 10,
-    },
-  };
+function buildUpdateServiceRenderBundle({ toolchain, stackName, registry, packageRoot = REPO_ROOT, packageVersion = readOysterunPackageVersion() }) {
+  return buildServiceRenderBundle({ toolchain, stackName, registry, packageRoot, packageVersion,
+    configDir: getConfigDir(), configPath: getConfigPath(), port: PORT });
 }
 
 function writeTargetServiceDefinitionAuthority({ receipt, targetBundle, targetRendered }) {
@@ -8652,6 +9264,7 @@ function buildHostRuntimeStatusPayload() {
     sessions: sessionManager.list().length,
     restart_restore: buildHostRestartRestoreSummary(transaction),
     last_restart_restore: lastHostRestartRestoreStatus,
+    desired_open_restore: buildDesiredOpenRestoreStatusPayload(),
     active_runtime: buildHostActiveRuntimeStatusSummary(),
     provider_model_refresh: providerModelRefreshRunner.getStatus(),
     host_runtime_metadata: buildHostRuntimeMetadataStatus(),
@@ -8661,6 +9274,27 @@ function buildHostRuntimeStatusPayload() {
   };
 }
 
+function buildDesiredOpenRestoreStatusPayload() {
+  const persisted = sessionManager.getDesiredOpenRestoreStatus();
+  return {
+    ...(lastDesiredOpenRestoreStatus || {
+      status: persisted.status === "available" ? "idle" : persisted.status,
+      trigger: null,
+      reconciliation_id: null,
+      running: false,
+      started_at: null,
+      completed_at: null,
+    }),
+    preference_enabled:
+      readConfig().restore_previous_sessions_after_restart !== false,
+    max_concurrency: DESIRED_OPEN_RESTORE_MAX_CONCURRENCY,
+    session_timeout_ms: DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS,
+    sessions: persisted.sessions,
+    prompt_replay: false,
+    terminal_command_replay: false,
+  };
+}
+
 function serializeProviderModelRefreshResult(result = {}) {
   return {
     status: normalizeString(result.status) || "unknown",
@@ -8726,6 +9360,8 @@ function releaseHostRestartLoginGateSafely({ gateId, reason, source }) {
 async function scheduleOysterunPackageUpdate({
   channel = OYSTERUN_UPDATE_RELEASE_CHANNEL,
   source = "host_preferences",
+  expectedCurrentVersion = null,
+  expectedTargetVersion = null,
   recoveryKind = null,
   recoveryOperation = null,
 } = {}) {
@@ -8926,7 +9562,12 @@ async function scheduleOysterunPackageUpdate({
         },
         { configDir: getConfigDir() }
       );
+    } else {
+      writeUpdateOperationState(failedInitialPreflightState(operationState), {
+        configDir: getConfigDir(),
+      });
     }
+
     throw error;
   }
   if (!repairRequested) {
@@ -9012,24 +9653,27 @@ async function scheduleOysterunPackageUpdate({
     }
     throw new Error(`Could not resolve exact Oysterun package version for ${resolvedChannel}`);
   }
-  if (betaUpdate && !repairRequested && updateCheck.install_available !== true) {
-    writeUpdateOperationState(
-      {
-        ...operationState,
-        status: "update_check_failed",
-        phase: "No newer Beta is available",
-        running: false,
-        lifecycle_owner_pid: null,
-        runner_lease_expires_at: null,
-        terminal_result_status: "update_check_failed",
-        next_safe_action: null,
-        error: "The npm beta version is not newer than the installed version.",
-        error_redacted: true,
-      },
-      { configDir: getConfigDir() }
-    );
-    throw new Error("The npm beta version is not newer than the installed version.");
+  if (!repairRequested) {
+    try {
+      assertConfirmedUpdateTarget({
+        currentVersion: readOysterunPackageVersion(), targetVersion: exactVersion,
+        expectedCurrentVersion, expectedTargetVersion, source,
+      });
+    } catch (error) {
+      operationState = recordUpdateRootFailure(operationState, {
+        ...error.lifecycle_diagnostic,
+        safe_message: error.message, observed_at: new Date().toISOString(),
+      });
+      writeUpdateOperationState({
+        ...operationState, status: "update_check_failed", phase: "Update confirmation rejected",
+        running: false, lifecycle_owner_pid: null, runner_lease_expires_at: null,
+        terminal_result_status: "update_check_failed", next_safe_action: null,
+        restart_attempted: false, error: error.message, error_redacted: true,
+      }, { configDir: getConfigDir() });
+      throw error;
+    }
   }
+
   if (repairRequested) {
     let metadata;
     try {
@@ -9172,6 +9816,28 @@ async function scheduleOysterunPackageUpdate({
     login_gate_activated: false,
     restore_snapshot_created: false,
   });
+  let continuityPath;
+  try {
+    continuityPath = prepareHostContinuity({
+      operationId: operationState.operation_id, targetVersion: exactVersion,
+      toolchain, transactionKind,
+    });
+  } catch (error) {
+    const retainedPath = continuityReceiptPath(getConfigDir(), operationState.operation_id);
+    const retained = existsSync(retainedPath)
+      ? recordContinuityRecovery(retainedPath, operationState.operation_id, error) : null;
+    operationState = recordUpdateRootFailure(operationState, {
+      stage: "session_preparation", check: error.lifecycle_diagnostic?.check || "fresh_roster",
+      code: error.code || "fresh_roster_failed", safe_message: sanitizeLifecycleDiagnostic(error.message),
+      observed_at: new Date().toISOString(),
+    });
+    writeUpdateOperationState({ ...operationState, continuity_path: retained ? retainedPath : null,
+      status: retained ? "update_recovery_required" : "update_check_failed", phase: "Session preparation did not pass",
+      running: false, lifecycle_owner_pid: null, restart_attempted: false, terminal_result_status: "update_check_failed",
+      error: sanitizeLifecycleDiagnostic(error.message), error_redacted: true }, { configDir: getConfigDir() });
+    throw error;
+  }
+  operationState = writeUpdateOperationState({ ...operationState, continuity_path: continuityPath }, { configDir: getConfigDir() });
   const updateInstallerArgs = [
     join(REPO_ROOT, "tool_scripts", "install_oysterun_update.mjs"),
     "--package-spec",
@@ -9202,6 +9868,8 @@ async function scheduleOysterunPackageUpdate({
           join(getConfigDir(), "service-definition-authority.json"),
         ]
       : []),
+    "--continuity-path",
+    continuityPath,
     "--retain-for-restart",
     "1",
     ...(repairRequested ? ["--force-reinstall", "1"] : []),
@@ -9223,9 +9891,10 @@ async function scheduleOysterunPackageUpdate({
     },
     { configDir: getConfigDir() }
   );
-  const logFd = openSync(logPath, "a");
+  let logFd;
   let preparationChild;
   try {
+    logFd = openSync(logPath, "a");
     preparationChild = spawn(toolchain.node_path, updateInstallerArgs, {
       cwd: REPO_ROOT,
       env: buildNodeNpmChildEnvironment(toolchain, {
@@ -9243,8 +9912,11 @@ async function scheduleOysterunPackageUpdate({
       },
       { configDir: getConfigDir() }
     );
+  } catch (error) {
+    recordContinuityRunnerHandoffFailure({ operationId: operationState.operation_id, error, stage: "package_preparation", check: "installer_spawn_failed" });
+    throw error;
   } finally {
-    closeSync(logFd);
+    if (logFd !== undefined) closeSync(logFd);
   }
   try {
     await new Promise((resolvePreparation, rejectPreparation) => {
@@ -9270,6 +9942,10 @@ async function scheduleOysterunPackageUpdate({
       // before it can publish its atomic structured result.
     }
     const failureCode = normalizeString(result?.failure_code) || "staging_install_failed";
+    recordContinuityRecovery(continuityPath, operationState.operation_id,
+      Object.assign(new Error(sanitizeLifecycleDiagnostic(result?.error || error.message)), {
+        code: failureCode, lifecycle_diagnostic: { stage: result?.package_mutated ? "activation" : "package_staging", check: failureCode },
+      }));
     operationState = recordUpdateRootFailure(operationState, {
       stage: normalizeString(result?.package_load_status) === "staged_and_activated_verified"
         ? "activation"
@@ -9283,19 +9959,21 @@ async function scheduleOysterunPackageUpdate({
       operationState.diagnostic_summary,
       "rollback",
       {
-        result: result?.rollback_completed === true ? "passed" : "not_required",
+        result: result?.rollback_completed === true ? "passed" : result?.package_mutated ? "incomplete" : "not_required",
         code: result?.rollback_completed === true
           ? "prior_package_restored"
+          : result?.package_mutated ? "retained_pair_recovery_pending"
           : "package_activation_not_reached",
         safe_message: result?.rollback_completed === true
           ? "The prior package was restored."
+          : result?.package_mutated ? "The package changed; the retained prior package and definition still require qualified recovery."
           : "Rollback was not required because the active package was not changed.",
       }
     );
     failureSummary = recordLifecycleTerminalOutcome(failureSummary, "recovery", {
       result: "available",
-      code: "repair_and_restart_available",
-      safe_message: "The update can be retried through the repair and restart action.",
+      code: "retained_continuity_recovery_available",
+      safe_message: "Continue this exact operation through its displayed recovery action; retained assets have not been cleaned.",
     });
     failureSummary = recordLifecycleTerminalOutcome(failureSummary, "cleanup", {
       result: result?.operation_cleanup_completed === true ? "passed" : "incomplete",
@@ -9350,6 +10028,13 @@ async function scheduleOysterunPackageUpdate({
       },
       { configDir: getConfigDir() }
     );
+    continuityAutomaticRechecks.add(operationState.operation_id);
+    try {
+      scheduleContinuityRecovery({ kind: "restore_and_restart", source: "automatic_recovery", automatic: true,
+        recheckOnly: result?.package_mutated !== true });
+    } catch (recoveryError) {
+      console.warn("[lifecycle] Automatic update recovery could not start:", sanitizeLifecycleDiagnostic(recoveryError.message));
+    }
     throw error;
   } finally {
     if (sourceServiceRenderBundle) {
@@ -9360,6 +10045,8 @@ async function scheduleOysterunPackageUpdate({
   try {
     retainedPreparationResult = JSON.parse(readFileSync(resultPath, "utf8"));
   } catch (error) {
+    recordContinuityRecovery(continuityPath, operationState.operation_id,
+      continuityFailure("activation", "preparation_receipt_readback", "Update preparation completed without a readable result receipt."));
     operationState = recordUpdateRootFailure(operationState, {
       stage: "activation",
       check: "preparation_receipt_readback",
@@ -9597,6 +10284,11 @@ async function scheduleOysterunPackageUpdate({
         service_definition_commit_started_at: new Date().toISOString(),
       };
       writeRecoveryReconciliationReceipt(resultPath, retainedPreparationResult);
+      {
+        const continuity = readContinuity(continuityPath, operationState.operation_id);
+        writeContinuityAtomic(continuityPath, { ...continuity,
+          target: { ...continuity.target, service_definition_sha256: effectiveTargetDefinitionDigest } });
+      }
       if (snapshot.existed) {
         migrationStage = "replacement_commit";
         migrationCheck = "atomic_target_render_commit";
@@ -9727,6 +10419,16 @@ async function scheduleOysterunPackageUpdate({
             ? "host_preferences_repair_restart"
             : "host_preferences_update_restart",
     });
+    {
+      const freshBaseline = buildHostContinuityObservation().baseline;
+      const continuity = bindFreshContinuityBaseline(continuityPath, operationState.operation_id,
+        freshBaseline, restartRestore.restart_restore?.restart_id, readHostRestartRestoreState({ configDir: getConfigDir() }));
+      writeContinuityAtomic(continuityPath, { ...continuity,
+        target: { ...continuity.target, service_definition_sha256: retainedPreparationResult.target_service_definition_sha256 || "absent" },
+        retained_files: { ...continuity.retained_files, fresh_restart_state: retainContinuityFile(
+          getHostRestartRestoreStatePath(getConfigDir()), join(continuity.operation_root, "restart-restore-state.pre-restart.json")) },
+      });
+    }
     operationState = recordUpdateLifecycleDiagnostic(operationState, {
       component: "host_coordinator",
       stage: "restart_snapshot",
@@ -9793,6 +10495,12 @@ async function scheduleOysterunPackageUpdate({
     };
     writeRecoveryReconciliationReceipt(resultPath, retainedPreparationResult);
   } catch (handoffError) {
+    // Bind the causal failure before asking another process to recover it;
+    // its recovery_requested control flag is not the incident's first cause.
+    recordContinuityRecovery(continuityPath, operationState.operation_id,
+      Object.assign(handoffError, { lifecycle_diagnostic: handoffError.lifecycle_diagnostic || {
+        stage: migrationStage, check: migrationCheck, result: "failed",
+      } }));
     for (const childEvent of handoffError?.lifecycle_diagnostics || []) {
       if (childEvent.result !== "passed") continue;
       operationState = recordUpdateLifecycleDiagnostic(operationState, {
@@ -9831,6 +10539,7 @@ async function scheduleOysterunPackageUpdate({
         }),
         {
           cwd: REPO_ROOT,
+          detached: true,
           env: buildNodeNpmChildEnvironment(toolchain, {
             ...process.env,
             OYSTERUN_DEBUG_HOST_ARTIFACT_WRITES_ENABLED:
@@ -9859,9 +10568,10 @@ async function scheduleOysterunPackageUpdate({
     ) {
       return;
     }
-    const restartLogFd = openSync(logPath, "a");
+    let restartLogFd;
     let child;
     try {
+      restartLogFd = openSync(logPath, "a");
       const restartRunnerArgs = buildRestartRunnerArgs({
         loginGateId: restartLoginGate.gate_id,
         restartId: operationState.restart_id,
@@ -9883,10 +10593,17 @@ async function scheduleOysterunPackageUpdate({
           stdio: ["ignore", restartLogFd, restartLogFd],
         }
       );
+    } catch (error) {
+      recordContinuityRunnerHandoffFailure({ operationId: operationState.operation_id, error, gateId: restartLoginGate.gate_id });
+      return;
     } finally {
-      closeSync(restartLogFd);
+      if (restartLogFd !== undefined) closeSync(restartLogFd);
     }
-    child.once("error", () => {
+    child.once("error", (error) => {
+      if (operationState.continuity_path) {
+        recordContinuityRunnerHandoffFailure({ operationId: operationState.operation_id, error, gateId: restartLoginGate.gate_id });
+        return;
+      }
       writeUpdateOperationState(
         {
           ...operationState,
@@ -9961,6 +10678,9 @@ async function schedulePreparedLifecycleRecovery({
   if (!["complete_update_and_restart", "restore_and_restart"].includes(kind)) {
     throw new Error("Unsupported prepared Host recovery action.");
   }
+  if (readUpdateOperationState({ configDir: getConfigDir() }).continuity_path) {
+    return scheduleContinuityRecovery({ kind, source });
+  }
   const resolution = maybeCloseSupersededOysterunUpdateRecovery();
   let operationState = readUpdateOperationState({ configDir: getConfigDir() });
   if (
@@ -10221,20 +10941,61 @@ async function schedulePreparedLifecycleRecovery({
   });
 }
 
-function scheduleHostRestart({
+function scheduleHostRestart(options = {}) {
+  const priorOperation = readUpdateOperationState({ configDir: getConfigDir() });
+  if (priorOperation.continuity_path && priorOperation.transaction_kind === "restart_only" &&
+      priorOperation.status === "restart_recovery_required") {
+    return scheduleContinuityRecovery({ kind: "restart_only", source: options.source || "host_preferences" });
+  }
+  assertNoOysterunUpdateOperationBlocking();
+  let operation = writeUpdateOperationState({
+    operation_id: randomUUID(), attempt_id: randomUUID(), status: "restart_preflight",
+    phase: "Checking restart prerequisites", transaction_kind: "restart_only",
+    source: options.source || "host_preferences", running: true,
+    lifecycle_owner_pid: process.pid, restart_attempted: false,
+    current_version: P233_RUNNING_PACKAGE_VERSION, target_version: P233_RUNNING_PACKAGE_VERSION,
+  }, { configDir: getConfigDir() });
+  try {
+    return scheduleHostRestartPrepared({ ...options, operationId: operation.operation_id });
+  } catch (error) {
+    const retainedPath = continuityReceiptPath(getConfigDir(), operation.operation_id);
+    const retained = existsSync(retainedPath)
+      ? recordContinuityRecovery(retainedPath, operation.operation_id, error) : null;
+    operation = { ...operation, ...readUpdateOperationState({ configDir: getConfigDir() }),
+      continuity_path: retained ? retainedPath : null };
+    operation = recordUpdateRootFailure(operation, {
+      stage: "restart_preflight", check: error.lifecycle_diagnostic?.check || "restart_prerequisites",
+      code: error.code || "restart_preflight_failed", safe_message: sanitizeLifecycleDiagnostic(error.message),
+      observed_at: new Date().toISOString(),
+    });
+    writeUpdateOperationState({ ...operation, status: retained ? "restart_recovery_required" : "restart_rejected", phase: "Restart did not start",
+      running: false, lifecycle_owner_pid: null, restart_attempted: false,
+      terminal_result_status: "restart_rejected", error: sanitizeLifecycleDiagnostic(error.message), error_redacted: true,
+    }, { configDir: getConfigDir() });
+    throw error;
+  }
+}
+
+function scheduleHostRestartPrepared({
   redirectUrl = null,
   source = "host_preferences",
   trigger = "host_preferences_restart_host",
+  operationId,
 } = {}) {
-  assertNoOysterunUpdateOperationBlocking();
   const { stackName } = assertHostRestartSchedulingAvailable();
   const toolchain = loadActiveHostLifecycleToolchainBundle();
-  runCompleteHostLifecyclePreflight({ toolchain });
+  runCompleteHostLifecyclePreflight({ toolchain, allowOperationId: operationId });
   const restartRestore = prepareHostRestartRestore({ trigger });
   const restartHandoff = createHostRestartHandoff();
   const currentVersion = readOysterunPackageVersion();
+  const continuityPath = prepareHostContinuity({ operationId, targetVersion: currentVersion, toolchain, transactionKind: "restart_only",
+    restartState: readHostRestartRestoreState({ configDir: getConfigDir() }) });
+  bindFreshContinuityBaseline(continuityPath, operationId, buildHostContinuityObservation().baseline,
+    restartRestore.restart_restore?.restart_id, readHostRestartRestoreState({ configDir: getConfigDir() }));
   let operationState = writeUpdateOperationState(
     {
+      operation_id: operationId,
+      continuity_path: continuityPath,
       status: "restart_scheduled",
       phase: "Ready to restart",
       running: true,
@@ -10318,9 +11079,10 @@ function scheduleHostRestart({
       "--restart-id",
       operationState.restart_id,
     ];
-    const logFd = openSync(logPath, "a");
+    let logFd;
     let child;
     try {
+      logFd = openSync(logPath, "a");
       child = spawn(toolchain.node_path, runnerArgs, {
         cwd: REPO_ROOT,
         detached: true,
@@ -10332,30 +11094,14 @@ function scheduleHostRestart({
         }),
         stdio: ["ignore", logFd, logFd],
       });
+    } catch (error) {
+      recordContinuityRunnerHandoffFailure({ operationId: operationState.operation_id, error, gateId: restartLoginGate.gate_id });
+      return;
     } finally {
-      closeSync(logFd);
+      if (logFd !== undefined) closeSync(logFd);
     }
-    child.once("error", () => {
-      writeUpdateOperationState(
-        {
-          ...operationState,
-          status: "restart_recovery_required",
-          phase: "Restart recovery required",
-          running: false,
-          recovery_required_at: new Date().toISOString(),
-          recovery_reason:
-            "The canonical restart runner could not start; the current Host state requires bounded recovery.",
-          recovery_boundary: "restart_runner_spawn_failed",
-          error: "The canonical restart runner could not start.",
-          error_redacted: true,
-        },
-        { configDir: getConfigDir() }
-      );
-      releaseHostRestartLoginGateSafely({
-        gateId: restartLoginGate.gate_id,
-        reason: "restart_runner_spawn_failed",
-        source: "Restart runner spawn failure",
-      });
+    child.once("error", (error) => {
+      recordContinuityRunnerHandoffFailure({ operationId: operationState.operation_id, error, gateId: restartLoginGate.gate_id });
     });
     child.once("exit", (code) => {
       if (code === 0) return;
@@ -10380,10 +11126,69 @@ function scheduleHostRestart({
   };
 }
 
+function scheduleContinuityRecovery({ kind, source, recheckOnly = false, automatic = false }) {
+  const resolution = recheckOnly || automatic ? null : maybeCloseSupersededOysterunUpdateRecovery();
+  let operation = readUpdateOperationState({ configDir: getConfigDir() });
+  if ((!recheckOnly && !automatic && resolution.recovery_plan?.user_action?.kind !== kind) || operation.running || isProcessRunning(operation.runner_pid)) {
+    throw continuityFailure("recovery", "recovery_changed", "The recovery action no longer matches the retained operation.");
+  }
+  let receipt = readContinuity(operation.continuity_path, operation.operation_id);
+  const toolchain = loadActiveHostLifecycleToolchainBundle();
+  if (!recheckOnly && receipt.transaction_kind !== "restart_only" && !receipt.restart_attempted && !receipt.restart_id &&
+      process.pid === receipt.baseline.host.pid && receipt.operation_root) {
+    // Installation can finish while a newly created provider is still booting.
+    // If no handoff snapshot was ever bound, recover from a fresh complete
+    // live Sessions of the original running coordinator. Never replace a bound one.
+    const fresh = buildHostContinuityObservation().baseline;
+    if (fresh.sessions.some((row) => row.observation_error || !hasCompleteContinuityResumeIdentity(row))) throw continuityFailure("recovery", "fresh_roster_not_ready", "Wait for every current Session provider to be ready before recovering this unprepared handoff.");
+    const prepared = prepareHostRestartRestore({ trigger: "p233_recovery_before_first_handoff_snapshot" });
+    receipt = bindFreshContinuityBaseline(operation.continuity_path, operation.operation_id, fresh,
+      prepared.restart_restore?.restart_id, readHostRestartRestoreState({ configDir: getConfigDir() }));
+    receipt = writeContinuityAtomic(operation.continuity_path, { ...receipt,
+      retained_files: { ...receipt.retained_files, fresh_restart_state: retainContinuityFile(
+        getHostRestartRestoreStatePath(getConfigDir()), join(receipt.operation_root, "restart-restore-state.pre-restart.json")) } });
+  }
+  const runner = resolveOysterunUpdateRestartRunner(toolchain);
+  const handoff = receipt.state === "COMMITTED" || recheckOnly ? {} : createHostRestartHandoff();
+  const logPath = join(getConfigDir(), "operation_logs", `oysterun-continuity-recovery-${operation.operation_id}.log`);
+  operation = writeUpdateOperationState({ ...operation, ...handoff, status: "restart_scheduled",
+    phase: recheckOnly ? "Checking the already-running Host and restored Sessions" : receipt.state === "COMMITTED" ? "Finishing committed cleanup" : "Continuing the retained lifecycle operation",
+    running: true, lifecycle_owner_pid: process.pid, runner_pid: null, requested_action: kind,
+    runner_lease_expires_at: new Date(Date.now() + UPDATE_RESTART_RUNNER_LEASE_MS).toISOString(),
+    operation_log_path: logPath }, { configDir: getConfigDir() });
+  const args = [runner.runnerScript, "--transaction-kind", receipt.transaction_kind === "restart_only" ? "restart_only" : "update_latest_and_restart",
+    "--operation-id", operation.operation_id, "--active-package-root", REPO_ROOT, "--config-dir", getConfigDir(),
+    "--node-bin", toolchain.node_path, "--npm-cli", toolchain.npm_cli_path,
+    "--identity-digest", toolchain.toolchain_identity_digest, "--stack", getActiveStackName(), "--health-url", `http://127.0.0.1:${PORT}/health`,
+    ...(operation.result_path ? ["--result-path", operation.result_path] : []),
+    ...(receipt.restart_id ? ["--restart-id", receipt.restart_id] : []),
+    ...(recheckOnly ? ["--recheck-only", "1"] : kind === "restore_and_restart" ? ["--restore-before-restart", "1"] : []),
+    ...(kind === "restart_only" ? ["--recover-restart", "1"] : []),
+  ];
+  setTimeout(() => {
+    const current = readUpdateOperationState({ configDir: getConfigDir() });
+    if (current.operation_id !== operation.operation_id || current.status !== "restart_scheduled") return;
+    let fd;
+    try {
+      fd = openSync(logPath, "a");
+      const child = spawn(toolchain.node_path, args, { cwd: REPO_ROOT, detached: true,
+        env: buildNodeNpmChildEnvironment(toolchain, { ...process.env, OYSTERUN_LIFECYCLE_OPERATION_ID: operation.operation_id }),
+        stdio: ["ignore", fd, fd] });
+      child.once("error", (error) => recordContinuityRunnerHandoffFailure({ operationId: operation.operation_id, error }));
+      child.unref();
+    } catch (error) {
+      recordContinuityRunnerHandoffFailure({ operationId: operation.operation_id, error });
+    } finally { if (fd !== undefined) closeSync(fd); }
+  }, receipt.state === "COMMITTED" || recheckOnly ? 0 : getHostRestartHandoffDelayMs(handoff.execute_not_before)).unref();
+  return recheckOnly ? null : buildOysterunUpdateStatusPayload({ status: "restart_scheduled", source, ...handoff });
+}
+
 async function scheduleHostLifecycleTransaction({
   kind,
   source = "host_preferences",
   redirectUrl = null,
+  expectedCurrentVersion = null,
+  expectedTargetVersion = null,
 } = {}) {
   if (kind === "restart_only") {
     return scheduleHostRestart({
@@ -10398,13 +11203,13 @@ async function scheduleHostLifecycleTransaction({
   if (kind === "update_latest_and_restart") {
     return scheduleOysterunPackageUpdate({
       channel: OYSTERUN_UPDATE_RELEASE_CHANNEL,
-      source,
+      source, expectedCurrentVersion, expectedTargetVersion,
     });
   }
   if (kind === "update_beta_and_restart") {
     return scheduleOysterunPackageUpdate({
       channel: OYSTERUN_UPDATE_CHANNEL_BETA,
-      source,
+      source, expectedCurrentVersion, expectedTargetVersion,
     });
   }
   if (kind === "repair_and_restart") {
@@ -10571,6 +11376,9 @@ function buildHostPreferencesPayload({ managedTunnelQuota = null } = {}) {
       config.notification_sound_web_enabled !== false,
     notification_sound_app_enabled:
       config.notification_sound_app_enabled !== false,
+    restore_previous_sessions_after_restart:
+      config.restore_previous_sessions_after_restart !== false,
+    desired_open_restore: buildDesiredOpenRestoreStatusPayload(),
     daily_telemetry_enabled: config.daily_telemetry_enabled === true,
     daily_telemetry_consent_recorded_at:
       normalizeString(config.daily_telemetry_consent_recorded_at),
@@ -11246,6 +12054,10 @@ function buildHistoryResumeDisposition(record, matrixTranscriptAvailable) {
     resume_identity_kind: resumeIdentityKind,
     resume_unavailable_reason: reason,
   });
+  // agent_folder_missing is disabled because the saved AgentFolder no longer exists.
+  // Recheck on each availability read; a previous restore failure is not a veto.
+  const folder = readAgentFolderAvailability(record.agent_folder);
+  if (!folder.available) return unavailable(folder.reason);
   if (!matrixTranscriptAvailable) {
     return unavailable("matrix_timeline_missing");
   }
@@ -11821,6 +12633,7 @@ function mergeConfigObjects(base = {}, overlay = {}) {
 }
 
 function persistAgentConfigUpdates(folder, body = {}) {
+  requireAgentFolder(folder);
   const layers = readAgentConfigLayers(folder);
   const sharedConfig = readWritableAgentConfig(
     layers.configPath,
@@ -12314,6 +13127,47 @@ function sessionRefResolutionResponseFields(resolution) {
   };
 }
 
+const historyTranscriptPager = createHistoryTranscriptPager();
+
+function resolveTranscriptTargetOrRespond({ url, claims, res }) {
+  try {
+    return resolveSessionTranscriptTarget({
+      sessionId: url.searchParams.get("session_id"),
+      sessionRef: url.searchParams.get("session_ref"),
+      requestedAgentId: normalizeString(url.searchParams.get("agent_id")),
+      runtimeOnly: isRuntimeCapabilityOnly(claims),
+      verifyRuntimeActor: () => requireRuntimeCapability(claims, res, { scope: "session:read_transcript" }),
+      verifyLiveTarget: (sessionId, agentId) => requireRuntimeCapability(claims, res, { scope: "session:read_transcript", sessionId, agentId }),
+      resolveLiveRef: (sessionRef) => {
+        if (!sessionManager.getSession(sessionRef) && !sessionManager.list().some((entry) => normalizeSessionName(entry.sessionName) === normalizeSessionName(sessionRef))) {
+          throw Object.assign(new Error("Session reference not found among live Sessions; stopped/history transcript targets require exact --session-id"), { status: 404, reason: "history_session_ref_requires_exact_id" });
+        }
+        return resolveLiveSessionReferenceOrRespond({ sessionRef, res });
+      },
+      getLive: (id) => sessionManager.getSession(id),
+      getHistory: getSessionHistory,
+      authorizeAgent: (id) => requireAgentCapability(claims, id, "can_chat", res),
+    });
+  } catch (error) {
+    respond(res, error.status || 503, { error: error.message, reason: error.reason || "session_history_metadata_unavailable" });
+    return null;
+  }
+}
+
+function readTranscriptTarget(target, binding, read) {
+  return target.target_state === "stopped"
+    ? withRouteCMatrixTranscriptReadOnly({ binding }, read)
+    : read();
+}
+
+function respondTranscriptSourceError(res, error) {
+  if (!["MATRIX_TRANSCRIPT_STORAGE_UNAVAILABLE", "MATRIX_TRANSCRIPT_ROOM_UNAVAILABLE", "MATRIX_TRANSCRIPT_BINDING_MISMATCH"].includes(error.code)) return false;
+  respond(res, error.code === "MATRIX_TRANSCRIPT_BINDING_MISMATCH" ? 403 : 503, { error: error.message,
+    reason: error.code === "MATRIX_TRANSCRIPT_BINDING_MISMATCH" ? "matrix_transcript_binding_owner_mismatch" : error.code === "MATRIX_TRANSCRIPT_ROOM_UNAVAILABLE" ? "matrix_transcript_room_unavailable" : "matrix_transcript_storage_unavailable",
+    committed_transcript_truth: "matrix_room_timeline", host_db_transcript_product_truth: false });
+  return true;
+}
+
 function resolveLiveSessionReferenceOrRespond({ sessionId, sessionRef, res }) {
   const normalizedSessionId = normalizeString(sessionId);
   if (normalizedSessionId) {
@@ -14423,6 +15277,8 @@ const ROUTEC_REQUEST_TRAFFIC_SENSITIVE_QUERY_KEYS = [
 const ROUTEC_REQUEST_TRAFFIC_LOG_BATCH_MAX_RECORDS = 50;
 const ROUTEC_REQUEST_TRAFFIC_LOG_FLUSH_DELAY_MS = 250;
 const routeCRequestTrafficLogQueues = new Map();
+const routeCRequestDelayWindowController =
+  createRouteCRequestDelayWindowController();
 
 function classifyRouteCRequestTrafficEndpoint(method, requestPath) {
   if (requestPath === "/_matrix/client/v3/sync") return "matrix_sync";
@@ -14571,15 +15427,20 @@ function isRouteCChatLivenessDiagnosticsEnabled() {
   return readConfig().debug_routec_chat_liveness_diagnostics_enabled === true;
 }
 
+function syncRouteCEventLoopDelayWindow(logPath) {
+  return routeCRequestDelayWindowController.sync(logPath);
+}
+
 function attachRouteCRequestTrafficLogger(req, res, url, requestPath) {
-  if (!isRouteCChatLivenessDiagnosticsEnabled()) return;
-  const logPath = normalizeString(
-    process.env.OYSTERUN_ROUTEC_REQUEST_TRAFFIC_LOG_PATH
-  );
-  if (!logPath) return;
+  const diagnosticsEnabled = isRouteCChatLivenessDiagnosticsEnabled();
+  const logPath = diagnosticsEnabled
+    ? normalizeString(process.env.OYSTERUN_ROUTEC_REQUEST_TRAFFIC_LOG_PATH)
+    : "";
+  const eventLoopDelayWindow = syncRouteCEventLoopDelayWindow(logPath);
+  if (!eventLoopDelayWindow) return;
 
   const startedAt = new Date();
-  const startedMs = Date.now();
+  const startedPerformanceMs = performance.now();
   const startedCpuUsage = process.cpuUsage();
   const startedEventLoopUtilization = performance.eventLoopUtilization();
   const requestId = randomUUID();
@@ -14618,7 +15479,9 @@ function attachRouteCRequestTrafficLogger(req, res, url, requestPath) {
       event,
       started_at: startedAt.toISOString(),
       ended_at: endedAt.toISOString(),
-      duration_ms: Date.now() - startedMs,
+      request_elapsed_ms: Number(
+        (performance.now() - startedPerformanceMs).toFixed(3)
+      ),
       method: req.method,
       endpoint,
       path: requestPath,
@@ -14635,6 +15498,8 @@ function attachRouteCRequestTrafficLogger(req, res, url, requestPath) {
         active_ms: Number(eventLoopUtilization.active.toFixed(3)),
         utilization: Number(eventLoopUtilization.utilization.toFixed(6)),
       },
+      event_loop_delay:
+        routeCRequestDelayWindowController.snapshot(eventLoopDelayWindow),
       raw_request_body_logged: false,
       raw_response_body_logged: false,
       stack_name: getActiveStackName(),
@@ -14751,8 +15616,28 @@ const server = createServer(async (req, res) => {
       });
     }
 
-    // ── GET /app/sessions/:session_id/chat (serves Route C shell behind clean URL) ──
-    if (req.method === "GET" && isCleanSessionChatAppShellPath(path)) {
+    // Shared Sessions/Setup source is mounted by React in the web-chat document.
+    // Missing/stale aliases retain original normalization and warning copy.
+    const legacySessionSurfaceRedirect = req.method === "GET"
+      ? buildLegacySessionSurfaceRedirectLocation(url) : null;
+    if (legacySessionSurfaceRedirect) {
+      const legacySessionId = normalizeString(url.searchParams.get("session_id"));
+      if (sessionManager.getSession(legacySessionId)) {
+        return redirect(res, 303, legacySessionSurfaceRedirect, {
+          "Cache-Control": "no-store",
+          "X-Oysterun-Legacy-Session-Surface": "clean-session-workspace",
+        });
+      }
+    }
+    if (req.method === "GET" && /^\/app\/(?:sessions\/?|session-setup\/?|agent-profile\/?|session-loop\/?|settings\/?|scheduler\/?|terminal\/?|host-preferences\/voice-input-usage\/?)$/.test(path)) {
+      return serveWebChatAppDocument(req, res);
+    }
+
+    if (
+      req.method === "GET" &&
+      (isCleanSessionChatAppShellPath(path) ||
+        isCleanSessionMigratedSurfaceAppShellPath(path))
+    ) {
       const cleanChatClaims = getCleanSessionChatAppShellClaims(req);
       if (!cleanChatClaims) {
         return serveDashboardHtml(req, res, {
@@ -14760,7 +15645,7 @@ const server = createServer(async (req, res) => {
           "X-Oysterun-Clean-Chat-Shell": "dashboard-login",
         });
       }
-      const cleanChatSessionId = getCleanSessionChatAppShellSessionId(path);
+      const cleanChatSessionId = getCleanSessionAppShellSessionId(path);
       if (!cleanChatSessionId || !sessionManager.getSession(cleanChatSessionId)) {
         return redirect(
           res,
@@ -14776,11 +15661,43 @@ const server = createServer(async (req, res) => {
       return serveWebChatAppDocument(req, res);
     }
 
+    // ── GET migrated standalone browse utilities (one web-chat document) ──
+    if (req.method === "GET" && isStandaloneMigratedBrowseAppShellPath(path)) {
+      const standaloneBrowseClaims = getCleanSessionChatAppShellClaims(req);
+      if (!standaloneBrowseClaims) {
+        return serveDashboardHtml(req, res, {
+          "X-Oysterun-Standalone-Browse-Auth-Guard": "dashboard-login-required",
+          "X-Oysterun-Standalone-Browse-Shell": "dashboard-login",
+        });
+      }
+      return serveWebChatAppDocument(req, res);
+    }
+
+    // ── GET standalone migrated product surfaces (one Route C document) ──
+    if (req.method === "GET" && isStandaloneMigratedSurfaceAppShellPath(path)) {
+      const standaloneClaims = getCleanSessionChatAppShellClaims(req);
+      if (!standaloneClaims) {
+        return serveDashboardHtml(req, res, {
+          "X-Oysterun-Standalone-Surface-Auth-Guard": "dashboard-login-required",
+          "X-Oysterun-Standalone-Surface-Shell": "dashboard-login",
+        });
+      }
+      return serveWebChatAppDocument(req, res);
+    }
+
     // ── GET /.well-known/matrix/client (exact public Route C Host-origin discovery only) ──
     if (req.method === "GET" && path === "/.well-known/matrix/client") {
       return serveRouteCWellKnownMatrixClient(req, res);
     }
 
+    // /app is the stable alias for the new frontend Sessions list.
+    if (req.method === "GET" && (path === "/app" || path === "/app/")) {
+      return redirect(res, 308, `/app/sessions${url.search}`, {
+        "Cache-Control": "no-store",
+        "X-Oysterun-Sessions-Root-Alias": "app-sessions",
+      });
+    }
+
     // ── GET /app* (serves dashboard HTML, no auth — login page is in the HTML) ──
     if (
       req.method === "GET" &&
@@ -15105,15 +16022,23 @@ const server = createServer(async (req, res) => {
       });
     }
 
-    // ── POST /routec/matrix/host-scoped-cinny-session-bootstrap (existing Host session only; no auth credentials) ──
+    // ── POST /routec/matrix/host-scoped-cinny-session-bootstrap (authenticated exact target) ──
     if (
       req.method === "POST" &&
       path === "/routec/matrix/host-scoped-cinny-session-bootstrap"
     ) {
+      const claims = authenticate(req, res);
+      if (!claims) return;
+      // Runtime capability markers are verified by their owning capability
+      // routes; they are not a login identity for Matrix credential issuance.
+      if (claims._runtimeCapabilityAuth) {
+        return respond(res, 401, { error: "Authentication required" });
+      }
       const body = await readBody(req);
       return await routeCMatrixFacade.handleHostScopedCinnySessionBootstrap({
         req,
         res,
+        claims,
         body,
         respond,
       });
@@ -15377,6 +16302,27 @@ const server = createServer(async (req, res) => {
       }
     }
 
+    if (req.method === "GET" && path === "/admin/lifecycle-qualification") {
+      const operationId = url.searchParams.get("operation_id");
+      const bearer = String(req.headers.authorization || "").replace(/^Bearer /, "");
+      if (!verifyContinuityProbeGrant(getConfigDir(), operationId, bearer)) {
+        return respond(res, 403, { error: "Operation observation grant required" });
+      }
+      try {
+        const receipt = readContinuity(continuityReceiptPath(getConfigDir(), operationId), operationId);
+        const observation = buildHostContinuityObservation(receipt.baseline);
+        res.setHeader("Cache-Control", "no-store");
+        return respond(res, 200, {
+          operation_id: operationId, request_nonce: url.searchParams.get("nonce"),
+          ...observation, baseline: undefined,
+        });
+      } catch (error) {
+        return respond(res, 409, { operation_id: operationId, request_nonce: url.searchParams.get("nonce"),
+          error: sanitizeLifecycleDiagnostic(error.message), code: error.code || "continuity_observation_failed",
+          lifecycle_diagnostic: error.lifecycle_diagnostic || null });
+      }
+    }
+
     if (req.method === "POST" && path === "/admin/restart-prepare") {
       const serviceControlClaims = authenticateLocalServiceControlRequest(req);
       let restartPrepareClaims = serviceControlClaims;
@@ -15433,6 +16379,8 @@ const server = createServer(async (req, res) => {
           await scheduleHostLifecycleTransaction({
             kind: normalizeString(body.kind),
             source: serviceControlClaims ? "terminal" : "host_preferences",
+            expectedCurrentVersion: body.expected_current_version,
+            expectedTargetVersion: body.expected_target_version,
             redirectUrl,
           })
         );
@@ -16154,7 +17102,10 @@ const server = createServer(async (req, res) => {
           })
         );
       } catch (err) {
-        return respond(res, 409, { error: err.message, code: err.code || null });
+        return respond(res, 409, {
+          ...buildOysterunUpdateStatusPayload(),
+          error: sanitizeLifecycleDiagnostic(err.message), code: err.code || null,
+        });
       }
     }
 
@@ -16197,6 +17148,8 @@ const server = createServer(async (req, res) => {
           await scheduleHostLifecycleTransaction({
             kind: "update_latest_and_restart",
             source: "host_preferences",
+            expectedCurrentVersion: body.expected_current_version,
+            expectedTargetVersion: body.expected_target_version,
           })
         );
       } catch (err) {
@@ -16221,13 +17174,15 @@ const server = createServer(async (req, res) => {
     if (req.method === "POST" && path === "/admin/update-beta-run") {
       if (!requireDashboardMode(claims, res)) return;
       try {
-        await readJsonBody(req);
+        const body = await readJsonBody(req);
         return respond(
           res,
           202,
           await scheduleHostLifecycleTransaction({
             kind: "update_beta_and_restart",
             source: "host_preferences",
+            expectedCurrentVersion: body.expected_current_version,
+            expectedTargetVersion: body.expected_target_version,
           })
         );
       } catch (err) {
@@ -17562,6 +18517,57 @@ const server = createServer(async (req, res) => {
       }
     }
 
+    if (req.method === "POST" && path === "/sessions/restore-previous") {
+      if (!requireDashboardMode(claims, res)) return;
+      try {
+        const rawBody = await readRawBody(req);
+        let body = {};
+        if (rawBody.length > 0) {
+          try {
+            body = JSON.parse(rawBody.toString());
+          } catch {
+            return respond(res, 400, { error: "Invalid JSON body" });
+          }
+        }
+        const hasSessionId = Object.prototype.hasOwnProperty.call(
+          body,
+          "session_id"
+        );
+        const sessionId = normalizeString(body.session_id);
+        if (hasSessionId && !sessionId) {
+          return respond(res, 400, { error: "session_id must be a string" });
+        }
+        if (sessionId) {
+          const desired = sessionManager.getDesiredOpenRestoreStatus();
+          if (
+            !desired.valid ||
+            !desired.sessions.some((entry) => entry.session_id === sessionId)
+          ) {
+            return respond(res, 404, {
+              error: "Desired-open Session not found",
+              session_id: sessionId,
+            });
+          }
+        }
+        const restore = await reconcileDesiredOpenSessions({
+          trigger: sessionId
+            ? "manual_restore_previous_session"
+            : "manual_restore_previous_sessions",
+          sessionIds: sessionId ? [sessionId] : null,
+        });
+        return respond(res, 200, {
+          status: "restore_previous_sessions_complete",
+          session_id: sessionId,
+          restore,
+        });
+      } catch (err) {
+        return respond(res, 400, {
+          error: err.message,
+          restore: buildDesiredOpenRestoreStatusPayload(),
+        });
+      }
+    }
+
     if (req.method === "POST" && path === "/telemetry/feature") {
       if (!requireDashboardMode(claims, res)) return;
       try {
@@ -17602,6 +18608,10 @@ const server = createServer(async (req, res) => {
             body,
             "daily_telemetry_enabled"
           ) &&
+          !Object.prototype.hasOwnProperty.call(
+            body,
+            "restore_previous_sessions_after_restart"
+          ) &&
           !Object.prototype.hasOwnProperty.call(body, "default_browse_path") &&
           !Object.prototype.hasOwnProperty.call(body, "public_base_url") &&
           !Object.prototype.hasOwnProperty.call(body, "direct_host_url") &&
@@ -17613,7 +18623,7 @@ const server = createServer(async (req, res) => {
         ) {
           return respond(res, 400, {
             error:
-              "display_name, notification_sound_web_enabled, notification_sound_app_enabled, daily_telemetry_enabled, default_browse_path, direct_host_url, claude_command, codex_command, grok_command, session_defaults, or voice_input required",
+              "display_name, notification_sound_web_enabled, notification_sound_app_enabled, restore_previous_sessions_after_restart, daily_telemetry_enabled, default_browse_path, direct_host_url, claude_command, codex_command, grok_command, session_defaults, or voice_input required",
           });
         }
 
@@ -17697,6 +18707,24 @@ const server = createServer(async (req, res) => {
           }
         }
 
+        if (
+          Object.prototype.hasOwnProperty.call(
+            body,
+            "restore_previous_sessions_after_restart"
+          )
+        ) {
+          if (
+            typeof body.restore_previous_sessions_after_restart !== "boolean"
+          ) {
+            return respond(res, 400, {
+              error:
+                "restore_previous_sessions_after_restart must be a boolean",
+            });
+          }
+          updates.restore_previous_sessions_after_restart =
+            body.restore_previous_sessions_after_restart;
+        }
+
         if (Object.prototype.hasOwnProperty.call(body, "voice_input")) {
           const requestedVoiceInput = body.voice_input;
           if (
@@ -18031,6 +19059,20 @@ const server = createServer(async (req, res) => {
       }
     }
 
+    if ((req.method === 'GET' && path === '/session/voice-input/receipt') ||
+        (req.method === 'POST' && path === '/session/voice-input/release')) {
+      const body = req.method === 'POST' ? await readJsonBody(req) : null;
+      const expectedHost = normalizeString(body?.host_identity || url.searchParams.get('host_identity'));
+      if (expectedHost && expectedHost !== readCloudIdentity()?.host_id) return respond(res,409,{error:'Recording belongs to a different Host.',code:'voice_input_host_mismatch'});
+      const sessionId = normalizeString(body?.session_id || url.searchParams.get('session_id'));
+      const target = sessionManager.getSession(sessionId) || getSessionHistory().find(row => row.session_id === sessionId);
+      if (!target) return respond(res,404,{error:'Session not found'});
+      if (!requireAgentCapability(claims, target.agentId || target.agent_id, 'can_chat', res)) return;
+      const captureId = normalizeString(body?.capture_id || url.searchParams.get('capture_id'));
+      if (!captureId || !/^[a-zA-Z0-9_-]{1,100}$/.test(captureId)) return respond(res,400,{error:'Invalid recording identity.'});
+      return respond(res,200,req.method === 'POST' ? voiceInputReceipts.release(sessionId,captureId) : voiceInputReceipts.get(sessionId,captureId));
+    }
+
     if (
       req.method === "POST" &&
       path === "/session/voice-input/transcribe"
@@ -18038,9 +19080,13 @@ const server = createServer(async (req, res) => {
       let sessionId = null;
       let singleFlightStarted = false;
       let ownerCaptureBase = null;
+      let receiptCaptureId = null;
+      let receiptGeneration = 1;
+      let providerStarted = false;
       try {
         const { fields, file } = await parseVoiceInputMultipart(req);
         sessionId = normalizeString(fields.session_id);
+        if (fields.host_identity && fields.host_identity !== readCloudIdentity()?.host_id) return respond(res,409,{error:'Recording belongs to a different Host.',code:'voice_input_host_mismatch'});
         const session = requireSessionCapability(
           claims,
           sessionId,
@@ -18058,13 +19104,6 @@ const server = createServer(async (req, res) => {
             code: "voice_input_unavailable",
           });
         }
-        if (!voiceInputSingleFlight.begin(sessionId)) {
-          return respond(res, 409, {
-            error: "Voice Input transcription is already in progress",
-            code: "voice_input_in_flight",
-          });
-        }
-        singleFlightStarted = true;
         const metadata = validateVoiceInputMetadata({
           captureId: fields.capture_id,
           recordingId: fields.recording_id,
@@ -18096,6 +19135,17 @@ const server = createServer(async (req, res) => {
             code: "voice_input_sha_mismatch",
           });
         }
+        receiptCaptureId = metadata.captureId;
+        receiptGeneration = Number(fields.attempt_generation || 1);
+        const receipt = voiceInputReceipts.begin(sessionId, receiptCaptureId,
+          voiceInputFingerprint({ ...metadata, mimeType: resolvedFile.mimeType, size: file.audio.length, audioSha256: actualSha }),
+          receiptGeneration, fields.explicit_retry === 'true', { recording_id: metadata.recordingId, segment_index: metadata.segmentIndex, duration_ms: metadata.durationMs, normalized_mime: resolvedFile.mimeType.split(';')[0].toLowerCase(), size_bytes: file.audio.length, audio_sha256: actualSha });
+        if (receipt.state === 'succeeded') return respond(res, 200, receipt.result);
+        if (receipt.state !== 'received') return respond(res, 409, { ...receipt, error: receipt.result?.error || 'The recording attempt is not ready to upload.', code: `voice_input_${receipt.state}` });
+        if (!voiceInputSingleFlight.begin(sessionId)) return respond(res,409,{error:'Voice Input transcription is already in progress',code:'voice_input_in_flight'});
+        singleFlightStarted = true;
+        if (!voiceInputReceipts.start(sessionId, receiptCaptureId, receiptGeneration)) return respond(res,409,{error:'Recording was removed or already started.',code:'voice_input_receipt_changed'});
+        providerStarted = true;
         const privateSettings = readVoiceInputPrivateSettings(getConfigDir());
         if (privateSettings.owner_capture_enabled) {
           let recentContext = [];
@@ -18156,14 +19206,20 @@ const server = createServer(async (req, res) => {
               }
             : null
         );
-        return respond(res, 200, {
+        const response = {
           status: "voice_input_transcribed",
           session_id: session.id,
           capture_id: metadata.captureId,
           audio_sha256: actualSha,
           ...result,
-        });
+          attempt_generation: receiptGeneration,
+        };
+        if (!voiceInputReceipts.complete(sessionId, receiptCaptureId, receiptGeneration, 'succeeded', response)) return respond(res,409,{error:'Recording was removed.',code:'voice_input_released'});
+        return respond(res,200,response);
       } catch (err) {
+        if (providerStarted) voiceInputReceipts.complete(sessionId, receiptCaptureId, receiptGeneration,
+          err.providerStatus ? (err.providerStatus >= 400 && err.providerStatus < 500 && err.providerStatus !== 429 ? 'failed_terminal' : 'failed_retryable') : 'outcome_unknown',
+          { error: err.message, code: err.code || 'voice_input_transcription_failed' });
         await uploadOwnerVoiceInputCaptureBestEffort(
           ownerCaptureBase
             ? {
@@ -18180,7 +19236,7 @@ const server = createServer(async (req, res) => {
         );
         return respond(
           res,
-          err.code === "voice_input_provider_timeout" ? 504 : 400,
+          err.code === "voice_input_provider_timeout" ? 504 : String(err.code).includes("receipt") || String(err.code).includes("attempt") || err.code === "voice_input_released" ? 409 : 400,
           {
             error: err.message,
             code: err.code || "voice_input_transcription_failed",
@@ -18471,7 +19527,7 @@ const server = createServer(async (req, res) => {
         });
       } catch (err) {
         return respond(res, 404, {
-          error: err.message,
+          ...agentFolderErrorResponse(err),
         });
       }
 
@@ -18546,7 +19602,7 @@ const server = createServer(async (req, res) => {
         }
       } catch (err) {
         return respond(res, 400, {
-          error: err.message,
+          ...agentFolderErrorResponse(err, folder),
           config_mutated: false,
         });
       }
@@ -18899,6 +19955,53 @@ const server = createServer(async (req, res) => {
       }
     }
 
+    const sessionLoopRecoveryMatch = path.match(
+      /^\/session\/loops\/([^/]+)\/recovery$/
+    );
+    if (sessionLoopRecoveryMatch && req.method === "POST") {
+      const scheduleId = decodeURIComponent(sessionLoopRecoveryMatch[1]);
+      const body = await readBody(req);
+      const sessionTarget = resolveLiveSessionReferenceOrRespond({
+        sessionId: body.session_id,
+        sessionRef: body.session_ref,
+        res,
+      });
+      if (!sessionTarget) return;
+      const session = requireSessionCapabilityOrRuntimeScope(
+        claims,
+        sessionTarget.sessionId,
+        "can_chat",
+        "session:send",
+        res
+      );
+      if (!session) return;
+      try {
+        const result = schedulerService.resolveSessionLoopIncidentForGui({
+          hostSessionId: session.id,
+          agentId: session.agentId,
+          agentFolder: session.cwd,
+          scheduleId,
+          action: body.action,
+        });
+        const feedback = await writeLoopFeedbackOrThrow({
+          session,
+          action: `recovery ${result.action}`,
+          schedule: result.schedule,
+        });
+        return respond(res, 200, {
+          ...result,
+          matrix_feedback: feedback,
+          ...sessionRefResolutionResponseFields(sessionTarget.resolution),
+        });
+      } catch (err) {
+        return respond(
+          res,
+          getSessionLoopCrudErrorStatus(err),
+          serializeSessionLoopCrudError(err)
+        );
+      }
+    }
+
     const sessionLoopMatch = path.match(/^\/session\/loops\/([^/]+)$/);
     if (
       sessionLoopMatch &&
@@ -18974,6 +20077,17 @@ const server = createServer(async (req, res) => {
             ...sessionRefResolutionResponseFields(sessionTarget.resolution),
           });
         }
+        const definitionFieldsPresent = [
+          "interval",
+          "command_text",
+          "prompt_text",
+          "prompt",
+          "start_at",
+          "end_at",
+        ].some((key) => Object.prototype.hasOwnProperty.call(body, key));
+        const runtimeOnly =
+          body.runtime_only === true ||
+          (typeof desiredEnabled === "boolean" && !definitionFieldsPresent);
         const result = schedulerService.updateSessionLoopScheduleForGui({
           hostSessionId: session.id,
           agentId: session.agentId,
@@ -18984,7 +20098,7 @@ const server = createServer(async (req, res) => {
           startAt: body.start_at ?? null,
           endAt: body.end_at ?? null,
           enabled: desiredEnabled,
-          runtimeOnly: body.runtime_only === true,
+          runtimeOnly,
         });
         const feedback = await writeLoopFeedbackOrThrow({
           session,
@@ -19335,6 +20449,7 @@ const server = createServer(async (req, res) => {
 
     // ── POST /session/start ────────────────────────────────
     if (req.method === "POST" && path === "/session/start") {
+      try { assertSessionRosterMutationAvailable(); } catch (error) { return respond(res, 409, { error: error.message, code: error.code }); }
       const body = await readBody(req);
       if (rejectRetiredCapabilitySettingInput(res, body)) return;
       const { agent_id, agent_folder, interface_type, session_name } = body;
@@ -19350,6 +20465,12 @@ const server = createServer(async (req, res) => {
         res
       );
       if (!auth) return;
+      let sessionTags;
+      try {
+        sessionTags = resolveSessionStartTags(body, auth);
+      } catch (err) {
+        return respond(res, 400, { error: err.message, code: err.code });
+      }
 
       let resolvedFolder;
       try {
@@ -19555,6 +20676,7 @@ const server = createServer(async (req, res) => {
       }
       let session;
       try {
+        assertSessionRosterMutationAvailable();
         session = sessionManager.start({
           agentId: agent_id,
           cwd: resolvedFolder,
@@ -19565,6 +20687,9 @@ const server = createServer(async (req, res) => {
           providerStartupResolvedCommand:
             startupPreflight.diagnostic?.resolved_command || null,
           sessionName: resolvedSessionName,
+          tags: sessionTags,
+          parentSessionId: auth.actorSession?.id || null,
+          deferTagsPersistence: true,
           provider: resolved.runtime.provider,
           model: resolved.runtime.model,
           reasoningEffort: resolved.runtime.reasoningEffort,
@@ -19720,11 +20845,13 @@ const server = createServer(async (req, res) => {
       recordTelemetryCounter("session_started_count");
       recordTelemetryFeature("sessions");
       recordTelemetryFeature("chat");
+      const persistedTags = canonicalSessionTags(session);
 
-      return respond(res, 200, {
+      const response = {
         success: true,
         session_id: session.id,
         session_name: session.sessionName,
+        tags: persistedTags,
         agent_id,
         provider: session.provider || "claude",
         permission_mode: session.permissionMode ?? null,
@@ -19800,7 +20927,10 @@ const server = createServer(async (req, res) => {
         bookkeeping_warning: bookkeepingWarnings.length
           ? bookkeepingWarnings.join("; ")
           : null,
-      });
+      };
+      commitSuccessfulSessionTags(session);
+      refreshSessionBookkeepingWarning(response, session);
+      return respond(res, 200, response);
     }
 
     // ── P203 callback get/list/cancel ──────────────────────
@@ -19859,7 +20989,7 @@ const server = createServer(async (req, res) => {
           });
           return respond(res, 200, { status: "callbacks", ...page });
         }
-        const receipt = callbackHostIntegration.cancel(
+        const receipt = await callbackHostIntegration.cancel(
           callbackBody?.callback_id,
           { relatedSessionId }
         );
@@ -20596,6 +21726,7 @@ const server = createServer(async (req, res) => {
 
     // ── POST /session/stop ─────────────────────────────────
     if (req.method === "POST" && path === "/session/stop") {
+      try { assertSessionRosterMutationAvailable(); } catch (error) { return respond(res, 409, { error: error.message, code: error.code }); }
       const body = await readBody(req);
       const { force } = body;
       const sessionTarget = resolveLiveSessionReferenceOrRespond({
@@ -20654,7 +21785,9 @@ const server = createServer(async (req, res) => {
       try {
         if (force) {
           await sessionManager.killSession(session.id);
+          sessionManager.removeDesiredOpenSession(session.id);
         } else {
+          assertSessionRosterMutationAvailable();
           await sessionManager.stopSession(session.id);
         }
         sessionLoopRuntimeCleanup =
@@ -20712,6 +21845,8 @@ const server = createServer(async (req, res) => {
 
       recordTelemetryCounter("session_stopped_count");
       recordTelemetryFeature("sessions");
+      sessionCollectionAdmittedSessionIds.delete(session.id);
+      commitSessionCollectionChange(["stop", "history"], [session.id]);
       return respond(res, 200, {
         status: force ? "killed" : "stopped",
         session_id: session.id,
@@ -20759,6 +21894,9 @@ const server = createServer(async (req, res) => {
         }
         const { session: renamedSession, changed } =
           sessionManager.renameSession(session.id, resolvedSessionName);
+        if (changed) {
+          commitSessionCollectionChange(["rename"], [renamedSession.id]);
+        }
         return respond(res, 200, {
           renamed: changed,
           session_id: renamedSession.id,
@@ -21020,7 +22158,7 @@ const server = createServer(async (req, res) => {
       );
       if (!session) return;
 
-      const message = sessionManager.cancelOutboxMessage(
+      const message = await sessionManager.cancelOutboxMessage(
         session.id,
         message_id
       );
@@ -21128,6 +22266,7 @@ const server = createServer(async (req, res) => {
 
     // ── POST /session/restart ──────────────────────────────
     if (req.method === "POST" && path === "/session/restart") {
+      try { assertSessionRosterMutationAvailable(); } catch (error) { return respond(res, 409, { error: error.message, code: error.code }); }
       const body = await readBody(req);
       const {
         provider,
@@ -21316,6 +22455,7 @@ const server = createServer(async (req, res) => {
 
       let restarted;
       try {
+        assertSessionRosterMutationAvailable();
         restarted = await sessionManager.restartSession(
           currentSession.id,
           overrides
@@ -21364,9 +22504,11 @@ const server = createServer(async (req, res) => {
       recordTelemetryCounter("session_restarted_count");
       recordTelemetryFeature("sessions");
       recordTelemetryFeature("chat");
+      admitSessionCollectionSession(restarted.id, ["restore"], { required: true });
       return respond(res, 200, {
         session_id: restarted.id,
         session_name: restarted.sessionName || null,
+        tags: canonicalSessionTags(restarted),
         agent_id: restarted.agentId,
         provider: restarted.provider || "claude",
         model: restarted.model || null,
@@ -21470,6 +22612,7 @@ const server = createServer(async (req, res) => {
         agent_id: session.agentId,
         session_id: session.id,
         session_name: session.sessionName || null,
+        tags: canonicalSessionTags(session),
         provider: session.provider || "claude",
         model: session.model || null,
         reasoning_effort: session.reasoningEffort || null,
@@ -21540,6 +22683,13 @@ const server = createServer(async (req, res) => {
         const hasNotificationRequest = hasNotificationConfigRequest(body);
         const hasAllowedPathsRequest =
           hasSessionProfileAllowedPathsRequest(body);
+        const hasTagsRequest = Object.prototype.hasOwnProperty.call(
+          body,
+          "tags"
+        );
+        const nextTags = hasTagsRequest
+          ? normalizeSessionTags(body.tags)
+          : null;
         const telegramConfigRequest = normalizeTelegramConfigPayload(body);
         const hasTelegramRequest = hasTelegramConfigUpdate(telegramConfigRequest);
         if (
@@ -21548,10 +22698,11 @@ const server = createServer(async (req, res) => {
           !hasWebsitePasswordRequest &&
           !hasNotificationRequest &&
           !hasAllowedPathsRequest &&
+          !hasTagsRequest &&
           !hasTelegramRequest
         ) {
           throw new Error(
-            "web_access, web_enabled, web_password, notifications, allowed_paths, or telegram settings required"
+            "web_access, web_enabled, web_password, notifications, allowed_paths, tags, or telegram settings required"
           );
         }
         const persistSharedConfig =
@@ -21692,7 +22843,10 @@ const server = createServer(async (req, res) => {
               session.notificationConfigUpdatedAt = new Date().toISOString();
             }
             if (hasAllowedPathsRequest) {
-              session.workspacePolicy = resolved.runtime.workspacePolicy;
+              sessionManager.updateWorkspacePolicy(
+                session.id,
+                resolved.runtime.workspacePolicy
+              );
             }
             if (hasTelegramRequest) {
               session.telegramConfig = buildResolvedSessionTelegramConfig(
@@ -21714,7 +22868,10 @@ const server = createServer(async (req, res) => {
             });
           }
           if (hasAllowedPathsRequest) {
-            session.workspacePolicy = nextWorkspacePolicy;
+            sessionManager.updateWorkspacePolicy(
+              session.id,
+              nextWorkspacePolicy
+            );
           }
           applySessionTelegramConfigRequest(session, telegramConfigRequest);
           if (hasTelegramRequest) {
@@ -21747,13 +22904,14 @@ const server = createServer(async (req, res) => {
         if (hasTelegramRequest) {
           recordTelemetryFeature("telegram_settings");
         }
-        return respond(res, 200, {
+        const response = {
           status: "session_profile_config_updated",
           session_id: session.id,
           agent_id: session.agentId,
           provider: session.provider || "claude",
           model: session.model || null,
           cwd: session.cwd || null,
+          tags: hasTagsRequest ? nextTags : canonicalSessionTags(session),
           web_access: nextWebAccess,
           web_enabled: nextWebEnabled,
           website,
@@ -21791,10 +22949,13 @@ const server = createServer(async (req, res) => {
           private_config_mutated: localConfigMutated,
           private_local_material_serialized: localConfigMutated,
           ...sessionRefResolutionResponseFields(sessionTarget.resolution),
-        });
+        };
+        if (hasTagsRequest) saveSuccessfulSessionTags(session, nextTags);
+        return respond(res, 200, response);
       } catch (err) {
         return respond(res, 400, {
           error: err.message,
+          code: err.code || "session_profile_config_invalid",
           session_profile_config: true,
           config_mutated: false,
         });
@@ -22052,36 +23213,11 @@ const server = createServer(async (req, res) => {
 
     // ── GET /session/messages/search?session_id=…&q=… ──
     if (req.method === "GET" && path === "/session/messages/search") {
-      const sessionTarget = resolveLiveSessionReferenceOrRespond({
-        sessionId: url.searchParams.get("session_id"),
-        sessionRef: url.searchParams.get("session_ref"),
-        res,
-      });
+      const sessionTarget = resolveTranscriptTargetOrRespond({ url, claims, res });
       if (!sessionTarget) return;
       const session_id = sessionTarget.sessionId;
-      const targetSession = sessionManager.getSession(session_id);
-      if (!targetSession) {
-        return respond(res, 404, { error: "Session not found" });
-      }
-      const requestedAgentId = normalizeString(url.searchParams.get("agent_id"));
-      if (requestedAgentId && requestedAgentId !== targetSession.agentId) {
-        return respond(res, 403, {
-          error: "Matrix search target does not match session agent",
-          reason: "target_session_agent_mismatch",
-        });
-      }
-      const agent_id = requestedAgentId || targetSession.agentId;
-      let runtimeAuth = null;
-      if (isRuntimeCapabilityOnly(claims)) {
-        runtimeAuth = requireRuntimeCapability(claims, res, {
-          scope: "session:read_transcript",
-          sessionId: session_id,
-          agentId: agent_id,
-        });
-        if (!runtimeAuth) return;
-      } else if (!requireAgentCapability(claims, agent_id, "can_chat", res)) {
-        return;
-      }
+      const agent_id = sessionTarget.agentId;
+      const runtimeAuth = sessionTarget.runtimeAuth;
 
       const searchQuery = normalizeString(
         url.searchParams.get("q") || url.searchParams.get("query")
@@ -22121,7 +23257,7 @@ const server = createServer(async (req, res) => {
         }
         throw err;
       }
-      if (binding.host_agent_id !== agent_id) {
+      if (binding.host_agent_id !== agent_id || binding.host_session_id !== session_id) {
         return respond(res, 403, {
           error: "Matrix search binding does not match agent",
           reason: "matrix_search_binding_agent_mismatch",
@@ -22150,14 +23286,15 @@ const server = createServer(async (req, res) => {
 
       let matrixSearch;
       try {
-        matrixSearch = searchRouteCMatrixRoomEvents({
+        matrixSearch = readTranscriptTarget(sessionTarget, binding, () => searchRouteCMatrixRoomEvents({
           binding,
           searchTerm: searchQuery,
           limit,
           nextBatchToken: backendNextBatch,
           senderFilter,
-        });
+        }));
       } catch (err) {
+        if (respondTranscriptSourceError(res, err)) return;
         if (Number.isInteger(err?.status) && err?.body) {
           return respond(res, err.status, err.body);
         }
@@ -22235,41 +23372,17 @@ const server = createServer(async (req, res) => {
         pagination_contract: "opaque_next_batch_v1",
         raw_matrix_access_token_required: false,
         ...sessionRefResolutionResponseFields(sessionTarget.resolution),
+        ...sessionTranscriptTargetFields(sessionTarget),
       });
     }
 
     // ── GET /session/messages-around?session_id=…&event_id=… ──
     if (req.method === "GET" && path === "/session/messages-around") {
-      const sessionTarget = resolveLiveSessionReferenceOrRespond({
-        sessionId: url.searchParams.get("session_id"),
-        sessionRef: url.searchParams.get("session_ref"),
-        res,
-      });
+      const sessionTarget = resolveTranscriptTargetOrRespond({ url, claims, res });
       if (!sessionTarget) return;
       const session_id = sessionTarget.sessionId;
-      const targetSession = sessionManager.getSession(session_id);
-      if (!targetSession) {
-        return respond(res, 404, { error: "Session not found" });
-      }
-      const requestedAgentId = normalizeString(url.searchParams.get("agent_id"));
-      if (requestedAgentId && requestedAgentId !== targetSession.agentId) {
-        return respond(res, 403, {
-          error: "Matrix exact context target does not match session agent",
-          reason: "target_session_agent_mismatch",
-        });
-      }
-      const agent_id = requestedAgentId || targetSession.agentId;
-      let runtimeAuth = null;
-      if (isRuntimeCapabilityOnly(claims)) {
-        runtimeAuth = requireRuntimeCapability(claims, res, {
-          scope: "session:read_transcript",
-          sessionId: session_id,
-          agentId: agent_id,
-        });
-        if (!runtimeAuth) return;
-      } else if (!requireAgentCapability(claims, agent_id, "can_chat", res)) {
-        return;
-      }
+      const agent_id = sessionTarget.agentId;
+      const runtimeAuth = sessionTarget.runtimeAuth;
 
       const eventId = normalizeString(url.searchParams.get("event_id"));
       if (!eventId) {
@@ -22331,7 +23444,7 @@ const server = createServer(async (req, res) => {
         }
         throw err;
       }
-      if (binding.host_agent_id !== agent_id) {
+      if (binding.host_agent_id !== agent_id || binding.host_session_id !== session_id) {
         return respond(res, 403, {
           error: "Matrix exact context binding does not match agent",
           reason: "matrix_context_binding_agent_mismatch",
@@ -22342,13 +23455,14 @@ const server = createServer(async (req, res) => {
 
       let exactContext;
       try {
-        exactContext = readMatrixTranscriptContext({
+        exactContext = readTranscriptTarget(sessionTarget, binding, () => readMatrixTranscriptContext({
           binding,
           eventId,
           before,
           after,
-        });
+        }));
       } catch (err) {
+        if (respondTranscriptSourceError(res, err)) return;
         const projectionInvalid =
           err?.code === "MATRIX_CONTEXT_PROJECTION_INVALID";
         return respond(res, projectionInvalid ? 502 : 503, {
@@ -22437,62 +23551,20 @@ const server = createServer(async (req, res) => {
         exact_context_read: exactContext?.context || null,
         raw_matrix_access_token_required: false,
         ...sessionRefResolutionResponseFields(sessionTarget.resolution),
+        ...sessionTranscriptTargetFields(sessionTarget),
       });
     }
 
     // ── GET /session/messages?session_id=…&agent_id=… ──────
     if (req.method === "GET" && path === "/session/messages") {
-      const sessionTarget = resolveLiveSessionReferenceOrRespond({
-        sessionId: url.searchParams.get("session_id"),
-        sessionRef: url.searchParams.get("session_ref"),
-        res,
-      });
+      const sessionTarget = resolveTranscriptTargetOrRespond({ url, claims, res });
       if (!sessionTarget) return;
       const session_id = sessionTarget.sessionId;
+      const agent_id = sessionTarget.agentId;
       const recentTailPresent = url.searchParams.has("recent_tail");
       const rawRecentTail = normalizeString(url.searchParams.get("recent_tail"));
-      if (recentTailPresent && rawRecentTail !== "true") {
-        return respond(res, 400, {
-          error: "recent_tail query param must be true when present",
-        });
-      }
+      if (recentTailPresent && rawRecentTail !== "true") return respond(res, 400, { error: "recent_tail query param must be true when present" });
       const recentTailRequested = rawRecentTail === "true";
-      let targetSession = null;
-      if (recentTailRequested) {
-        targetSession = sessionManager.getSession(session_id);
-        if (!targetSession) {
-          return respond(res, 404, { error: "Session not found" });
-        }
-      }
-      const requestedAgentId = normalizeString(
-        url.searchParams.get("agent_id")
-      );
-      if (
-        recentTailRequested &&
-        requestedAgentId &&
-        requestedAgentId !== targetSession.agentId
-      ) {
-        return respond(res, 403, {
-          error: "Recent Matrix transcript target does not match session agent",
-          committed_transcript_truth: "matrix_room_timeline",
-          host_db_transcript_product_truth: false,
-        });
-      }
-      const agent_id =
-        requestedAgentId || (recentTailRequested ? targetSession.agentId : "");
-      if (!agent_id) {
-        return respond(res, 400, { error: "agent_id query param required" });
-      }
-      if (isRuntimeCapabilityOnly(claims)) {
-        const auth = requireRuntimeCapability(claims, res, {
-          scope: "session:read_transcript",
-          sessionId: session_id,
-          agentId: agent_id,
-        });
-        if (!auth) return;
-      } else if (!requireAgentCapability(claims, agent_id, "can_chat", res)) {
-        return;
-      }
 
       let limit;
       let afterSeq;
@@ -22510,29 +23582,35 @@ const server = createServer(async (req, res) => {
       let syncResult;
       try {
         const binding = requireRouteCMatrixRoomBinding(session_id);
-        if (binding.host_agent_id !== agent_id) {
+        if (binding.host_agent_id !== agent_id || binding.host_session_id !== session_id) {
           return respond(res, 403, {
             error: "Matrix transcript read binding does not match agent",
             committed_transcript_truth: "matrix_room_timeline",
             host_db_transcript_product_truth: false,
           });
         }
-        syncResult = recentTailRequested
-          ? readMatrixTranscriptRecentTail({ binding, limit })
-          : readMatrixTranscriptMessagesAfter({
-              binding,
-              afterSeq,
-              limit,
-            });
+        syncResult = readTranscriptTarget(sessionTarget, binding, () => {
+          if (recentTailRequested) return readMatrixTranscriptRecentTail({ binding, limit });
+          if (sessionTarget.target_state === "stopped") return historyTranscriptPager.read({
+            binding, rawLimit: url.searchParams.get("limit"), cursor: url.searchParams.get("next_batch"),
+            afterSeqPresent: url.searchParams.has("after_seq"),
+            readAfter: (options) => readMatrixTranscriptMessagesAfter({ ...options, includeReadCheckpoint: true }),
+          });
+          if (url.searchParams.has("next_batch")) throw Object.assign(new Error("Live messages use after_seq, not history next_batch"), { status: 400, reason: "live_messages_cursor_incompatible" });
+          return readMatrixTranscriptMessagesAfter({ binding, afterSeq, limit });
+        });
       } catch (err) {
+        if (respondTranscriptSourceError(res, err)) return;
+        if (err.status && err.reason) return respond(res, err.status, { error: err.message, reason: err.reason });
         if (isRouteCMatrixBindingNotFoundError(err)) {
           return respond(res, 404, {
             error: "Matrix transcript read binding not available for session",
+            reason: "matrix_transcript_binding_unavailable",
             committed_transcript_truth: "matrix_room_timeline",
             host_db_transcript_product_truth: false,
           });
         }
-        throw err;
+        return respond(res, 503, { error: "Matrix transcript storage read failed", reason: "matrix_transcript_storage_unavailable", retryable: true });
       }
 
       return respond(res, 200, {
@@ -22550,7 +23628,7 @@ const server = createServer(async (req, res) => {
               one_bounded_matrix_tail_read: true,
               legacy_session_history_used: false,
             }
-          : { sync: syncResult.sync }),
+          : { sync: syncResult.sync, ...(syncResult.page ? { page: syncResult.page, next_batch: syncResult.next_batch, pagination_contract: syncResult.pagination_contract } : {}) }),
         committed_transcript_truth: "matrix_room_timeline",
         host_db_transcript_product_truth: false,
         transcript_surface_classification: "product_matrix_path",
@@ -22559,9 +23637,168 @@ const server = createServer(async (req, res) => {
         product_legacy_transcript_caller_allowed: false,
         matrix_transcript_read: syncResult.matrix_transcript_read,
         ...sessionRefResolutionResponseFields(sessionTarget.resolution),
+        ...sessionTranscriptTargetFields(sessionTarget),
       });
     }
 
+    // ── POST /sessions/completed-message-read-visit ────────
+    if (
+      req.method === "POST" &&
+      path === "/sessions/completed-message-read-visit"
+    ) {
+      const body = await readBody(req);
+      const sessionId = normalizeString(body.session_id);
+      const matrixRoomId = normalizeString(body.matrix_room_id);
+      const documentVisitId = normalizeString(body.document_visit_id);
+      const collectionId = normalizeString(body.collection_id);
+      const collectionRevision = Number(body.collection_revision);
+      if (!sessionId || !matrixRoomId || !documentVisitId ||
+        !collectionId ||
+        !Number.isSafeInteger(collectionRevision)) {
+        return respond(res, 400, {
+          error:
+            "P250 visit requires Session, room, document and collection identity",
+          code: "completed_session_unread_visit_identity_required",
+        });
+      }
+      const session = requireSessionCapability(
+        claims,
+        sessionId,
+        "can_chat",
+        res
+      );
+      if (!session) return;
+      const binding = getRouteCMatrixRoomBinding(sessionId);
+      const collection = sessionCollectionService.snapshot({ view: "running" });
+      if (
+        !binding ||
+        binding.matrix_room_id !== matrixRoomId ||
+        binding.host_agent_id !== session.agentId ||
+        collection.collection_id !== collectionId ||
+        collection.revision !== collectionRevision ||
+        !collection.rows.some((row) => row.session_id === sessionId)
+      ) {
+        return respond(res, 409, {
+          error: "P250 visit binding or collection generation is stale",
+          code: "completed_session_unread_visit_generation_mismatch",
+        });
+      }
+      try {
+        const visit = beginCompletedSessionChatVisit(
+          openRouteCMatrixSQLiteStore({
+            jsonStoragePath: getRouteCMatrixStoragePath(),
+          }),
+          {
+            hostUserId: HOST_OWNER_READ_CURSOR_USER_ID,
+            hostSessionId: sessionId,
+            matrixRoomId,
+            documentVisitId,
+            hostGeneration: collection.collection_id,
+            collectionRevision: collection.revision,
+            bindingGeneration: binding.updated_at,
+            authScope: normalizeString(claims.user_id) || "dashboard-admin",
+          }
+        );
+        return respond(res, 200, {
+          ...visit,
+          collection_id: collection.collection_id,
+          collection_revision: collection.revision,
+          host_validated_binding: true,
+        });
+      } catch (err) {
+        return respond(res, 409, {
+          error: err instanceof Error ? err.message : String(err),
+          code:
+            normalizeString(err?.code) ||
+            "completed_session_unread_visit_rejected",
+        });
+      }
+    }
+
+    // ── POST /sessions/completed-message-mark-unread ──────
+    if (
+      req.method === "POST" &&
+      path === "/sessions/completed-message-mark-unread"
+    ) {
+      const body = await readBody(req);
+      const sessionId = normalizeString(body.session_id);
+      const matrixRoomId = normalizeString(body.matrix_room_id);
+      const collectionId = normalizeString(body.collection_id);
+      const collectionRevision = Number(body.collection_revision);
+      if (
+        !sessionId ||
+        !matrixRoomId ||
+        !collectionId ||
+        !Number.isSafeInteger(collectionRevision)
+      ) {
+        return respond(res, 400, {
+          error:
+            "Mark as unread requires Session, room, and collection identity",
+          code: "completed_session_mark_unread_identity_required",
+        });
+      }
+      const session = requireSessionCapability(
+        claims,
+        sessionId,
+        "can_chat",
+        res
+      );
+      if (!session) return;
+      const binding = getRouteCMatrixRoomBinding(sessionId);
+      const collection = sessionCollectionService.snapshot({ view: "running" });
+      if (
+        !binding ||
+        binding.matrix_room_id !== matrixRoomId ||
+        binding.host_agent_id !== session.agentId ||
+        collection.collection_id !== collectionId ||
+        collection.revision !== collectionRevision ||
+        !collection.rows.some((row) => row.session_id === sessionId)
+      ) {
+        return respond(res, 409, {
+          error: "Mark as unread binding or live Session collection is stale",
+          code: "completed_session_mark_unread_generation_mismatch",
+        });
+      }
+      try {
+        const liveBindings = sessionListProjectionService.liveBindings(
+          sessionManager.list()
+        );
+        const result = markLatestCompletedSessionUnread(
+          openRouteCMatrixSQLiteStore({
+            jsonStoragePath: getRouteCMatrixStoragePath(),
+          }),
+          {
+            hostUserId: HOST_OWNER_READ_CURSOR_USER_ID,
+            hostSessionId: sessionId,
+            matrixRoomId,
+            bindings: liveBindings,
+            unreadScope: "live",
+            includeUnreadProjection: true,
+          }
+        );
+        return respond(res, 200, {
+          ...result,
+          collection_id: collection.collection_id,
+          collection_revision: collection.revision,
+          host_validated_binding: true,
+          host_validated_latest_successful_final: true,
+        });
+      } catch (err) {
+        const code =
+          normalizeString(err?.code) ||
+          "completed_session_mark_unread_rejected";
+        const status =
+          code === "completed_session_unread_binding_mismatch" ||
+          code === "completed_session_unread_room_not_found"
+            ? 403
+            : 409;
+        return respond(res, status, {
+          error: err instanceof Error ? err.message : String(err),
+          code,
+        });
+      }
+    }
+
     // ── POST /sessions/completed-message-read-ack ──────────
     if (
       req.method === "POST" &&
@@ -22585,10 +23822,13 @@ const server = createServer(async (req, res) => {
       );
       if (!session) return;
       const binding = getRouteCMatrixRoomBinding(sessionId);
+      const collection = sessionCollectionService.snapshot({ view: "running" });
       if (
         !binding ||
         binding.matrix_room_id !== matrixRoomId ||
-        binding.host_agent_id !== session.agentId
+        binding.host_agent_id !== session.agentId ||
+        collection.collection_id !== normalizeString(body.collection_id) ||
+        collection.revision !== Number(body.collection_revision)
       ) {
         return respond(res, 403, {
           error: "Completed-message acknowledgement binding does not match the current Chat",
@@ -22597,18 +23837,38 @@ const server = createServer(async (req, res) => {
       }
       if (
         body.acknowledgement_contract !==
-          "routec.p217_visible_completed_message_ack.v1" ||
+          "routec.p250_latest_timeline_read_ack.v1" ||
         body.materially_rendered !== true ||
-        body.viewport_visible !== true ||
+        body.latest_timeline_loaded !== true ||
         body.document_visible !== true ||
-        body.document_focused !== true
+        body.document_focused !== true ||
+        !normalizeString(body.visit_proof) ||
+        !normalizeString(body.host_generation) ||
+        !normalizeString(body.binding_generation)
       ) {
         return respond(res, 400, {
-          error: "Completed-message acknowledgement requires positive rendered and viewport visibility proof",
-          code: "completed_session_unread_visibility_proof_required",
+          error:
+            "Completed-message acknowledgement requires a qualified P250 visit and latest timeline proof",
+          code: "completed_session_unread_readiness_proof_required",
+        });
+      }
+      const unreadScope = normalizeString(body.unread_scope);
+      const includeUnreadProjection = body.include_unread_projection === true;
+      if (
+        (unreadScope && unreadScope !== "live") ||
+        (body.include_unread_projection !== undefined &&
+          typeof body.include_unread_projection !== "boolean") ||
+        (includeUnreadProjection && unreadScope !== "live")
+      ) {
+        return respond(res, 400, {
+          error: "Completed-message acknowledgement unread projection requires unread_scope live",
+          code: "invalid_session_unread_scope",
         });
       }
       try {
+        const liveBindings = unreadScope === "live"
+          ? sessionListProjectionService.liveBindings(sessionManager.list())
+          : null;
         const acknowledgement = acknowledgeCompletedSessionRead(
           openRouteCMatrixSQLiteStore({
             jsonStoragePath: getRouteCMatrixStoragePath(),
@@ -22618,12 +23878,21 @@ const server = createServer(async (req, res) => {
             hostSessionId: sessionId,
             matrixRoomId,
             eventId,
+            bindings: liveBindings,
+            unreadScope: unreadScope || null,
+            includeUnreadProjection,
+            visitProof: body.visit_proof,
+            hostGeneration: body.host_generation,
+            collectionRevision: Number(body.collection_revision),
+            bindingGeneration: body.binding_generation,
+            authScope: normalizeString(claims.user_id) || "dashboard-admin",
           }
         );
         return respond(res, 200, {
           ...acknowledgement,
-          acknowledgement_contract:
-            "routec.p217_visible_completed_message_ack.v1",
+          collection_id: collection.collection_id,
+          collection_revision: collection.revision,
+          acknowledgement_contract: "routec.p250_latest_timeline_read_ack.v1",
           host_validated_binding: true,
           host_validated_latest_successful_final: true,
         });
@@ -22641,15 +23910,41 @@ const server = createServer(async (req, res) => {
       }
     }
 
+    // ── GET /sessions/collection ───────────────────────────
+    if (req.method === "GET" && path === "/sessions/collection") {
+      if (!requireDashboardMode(claims, res)) return;
+      const view = url.searchParams.get("view") === "running" ? "running" : "all";
+      commitSessionCollectionChange(["read_reconcile"]);
+      const sinceText = url.searchParams.get("since_revision");
+      if (sinceText === null) {
+        return respond(res, 200, sessionCollectionService.snapshot({ view }));
+      }
+      const sinceRevision = Number(sinceText);
+      if (!Number.isSafeInteger(sinceRevision) || sinceRevision < 0) {
+        return respond(res, 400, {
+          error: "since_revision must be a non-negative integer",
+          code: "invalid_session_collection_revision",
+        });
+      }
+      return respond(res, 200, sessionCollectionService.delta({
+        sinceRevision,
+        collectionId: normalizeString(url.searchParams.get("collection_id")),
+        view,
+      }));
+    }
+
     // ── GET /sessions/previews ─────────────────────────────
     if (req.method === "GET" && path === "/sessions/previews") {
       if (!requireDashboardMode(claims, res)) return;
       const liveSessions = sessionManager.list();
-      const liveSessionIds = new Set(
-        liveSessions
-          .map((session) => session.id || session.sessionId)
-          .filter(Boolean)
-      );
+      // P236 U1 / docs/routec/dev/session_list_progressive_loading.md:
+      // Dashboard uses /sessions?include_previews=0 plus History/catalog.
+      // Chat needs only live names first, then one P032 decoration batch;
+      // never reconnect this metadata response to historical decoration reads.
+      if (url.searchParams.get("include_session_switcher") === "1" &&
+          url.searchParams.get("view") === "metadata") {
+        return respond(res, 200, sessionListProjectionService.metadata(liveSessions));
+      }
       const entriesBySessionId = new Map();
       for (const session of liveSessions) {
         const sessionId = session.id || session.sessionId;
@@ -22662,8 +23957,6 @@ const server = createServer(async (req, res) => {
         if (
           record.session_id &&
           record.agent_id &&
-          record.agent_folder &&
-          existsSync(record.agent_folder) &&
           !entriesBySessionId.has(record.session_id)
         ) {
           entriesBySessionId.set(record.session_id, {
@@ -22673,71 +23966,20 @@ const server = createServer(async (req, res) => {
         }
       }
 
-      const bindingBySessionId = new Map();
-      const bindings = [];
-      const seenRoomIds = new Set();
-      for (const entry of entriesBySessionId.values()) {
-        const binding = getRouteCMatrixRoomBinding(entry.sessionId);
-        if (!binding || binding.host_agent_id !== entry.agentId) continue;
-        bindingBySessionId.set(entry.sessionId, binding);
-        if (!seenRoomIds.has(binding.matrix_room_id)) {
-          seenRoomIds.add(binding.matrix_room_id);
-          bindings.push(binding);
-        }
+      const unreadScope = normalizeString(url.searchParams.get("unread_scope"));
+      if (unreadScope && unreadScope !== "live") {
+        return respond(res, 400, {
+          error: "unread_scope must be live when provided",
+          code: "invalid_session_unread_scope",
+        });
       }
-      const resultByRoomId =
-        sessionListPreviewService.readForBindings(bindings);
-      const unreadProjection = readCompletedSessionUnreadProjection(
-        openRouteCMatrixSQLiteStore({
-          jsonStoragePath: getRouteCMatrixStoragePath(),
-        }),
-        {
-          bindings,
-          hostUserId: HOST_OWNER_READ_CURSOR_USER_ID,
-        }
-      );
-      const previews = [];
-      for (const entry of entriesBySessionId.values()) {
-        const binding = bindingBySessionId.get(entry.sessionId) || null;
-        if (!binding) {
-          previews.push({
-            session_id: entry.sessionId,
-            status: "no_matrix_binding",
-            last_message_preview: null,
-            latest_committed_seq: 0,
-            latest_completed_event_id: null,
-            latest_completed_stream_seq: 0,
-            read_through_stream_seq: 0,
-            has_unread_completed_message: false,
-            cache_status: "not_applicable",
-            error_code: null,
-          });
-          continue;
-        }
-        const result = resultByRoomId.get(binding.matrix_room_id);
-        const unread =
-          unreadProjection.resultBySessionId.get(entry.sessionId) || {};
-        const isLiveSession = liveSessionIds.has(entry.sessionId);
-        previews.push({
-          session_id: entry.sessionId,
-          status: result.status,
-          last_message_preview: result.last_message_preview,
-          latest_committed_seq: result.latest_committed_seq,
-          latest_completed_event_id:
-            unread.latest_completed_event_id || null,
-          latest_completed_stream_seq:
-            Number(unread.latest_completed_stream_seq) || 0,
-          read_through_stream_seq:
-            Number(unread.read_through_stream_seq) || 0,
-          has_unread_completed_message:
-            isLiveSession && unread.has_unread_completed_message === true,
-          cache_status: result.cache_status,
-          error_code: result.error_code,
-        });
-      }
-      const liveUnreadSessionCount = previews.filter(
-        (preview) => preview.has_unread_completed_message === true
-      ).length;
+      const { previews, sessionRows, uniqueRoomCount,
+        unreadSchemaVersion, liveUnreadSessionCount } =
+        sessionListProjectionService.decorate(
+          [...entriesBySessionId.values()],
+          liveSessions,
+          { unreadScope: unreadScope || "all" }
+        );
       const includeSessionSwitcher =
         url.searchParams.get("include_session_switcher") === "1";
       if (!includeSessionSwitcher) {
@@ -22745,10 +23987,10 @@ const server = createServer(async (req, res) => {
           status: "session_list_previews",
           previews,
           session_count: entriesBySessionId.size,
-          unique_room_count: bindings.length,
+          unique_room_count: uniqueRoomCount,
           unread_session_count: liveUnreadSessionCount,
           completed_session_unread_schema_version:
-            unreadProjection.schema_version,
+            unreadSchemaVersion,
           dedicated_preview_query: true,
           full_transcript_pagination_used: false,
           room_aggregate_query_used: false,
@@ -22757,23 +23999,15 @@ const server = createServer(async (req, res) => {
           committed_transcript_truth: "matrix_room_timeline",
         });
       }
-      const previewBySessionId = new Map(
-        previews.map((preview) => [preview.session_id, preview])
-      );
-      const sessionRows = buildSessionSwitcherRows({
-        liveSessions,
-        previewBySessionId,
-        bindingBySessionId,
-      });
       return respond(res, 200, {
         status: "session_list_previews",
         previews,
         session_rows: sessionRows,
         session_count: sessionRows.length,
-        unique_room_count: bindings.length,
+        unique_room_count: uniqueRoomCount,
         unread_session_count: liveUnreadSessionCount,
         completed_session_unread_schema_version:
-          unreadProjection.schema_version,
+          unreadSchemaVersion,
         dedicated_preview_query: true,
         full_transcript_pagination_used: false,
         room_aggregate_query_used: false,
@@ -22785,28 +24019,65 @@ const server = createServer(async (req, res) => {
         session_switcher_projection_batched: true,
         session_switcher_per_row_http_requests: 0,
         session_switcher_matrix_query_count: 0,
+        ...(unreadScope === "live"
+          ? {
+              unread_scope: "live",
+              unread_projection_contract:
+                "routec.p236_live_completed_session_unread_projection.v1",
+            }
+          : {}),
       });
     }
 
     // ── GET /sessions/history ──────────────────────────────
     if (req.method === "GET" && path === "/sessions/history") {
       const includePreviews = shouldIncludeSessionListPreviews(url);
-      const history = getSessionHistory()
-        .filter((s) => s.agent_folder && existsSync(s.agent_folder))
-        .map((s) => {
-          const row = { ...s };
-          if (includePreviews) {
-            row.last_message_preview = getLastMessagePreview(
-              s.agent_folder,
-              s.agent_id,
-              s.session_id
-            );
-          }
-          return row;
-        });
+      const canonicalHistoryBySessionId = new Map(
+        buildCanonicalSessionCollectionRows()
+          .filter((row) => row.kind === "history")
+          .map((row) => [row.session_id, row])
+      );
+      const eligible = getSessionHistory();
+      const previews = includePreviews ? sessionListProjectionService.previewOnly(
+        eligible.map((s) => ({ sessionId: s.session_id, agentId: s.agent_id }))
+      ) : null;
+      const history = eligible.map((s) => ({
+        ...s,
+        restore_failed:
+          canonicalHistoryBySessionId.get(s.session_id)?.restore_failed === true,
+        restore_failed_reason:
+          canonicalHistoryBySessionId.get(s.session_id)?.restore_failed_reason || null,
+        manual_start_supported:
+          canonicalHistoryBySessionId.get(s.session_id)?.manual_start_supported === true,
+        manual_start_setup_reason:
+          canonicalHistoryBySessionId.get(s.session_id)?.manual_start_setup_reason || null,
+        resume_supported:
+          canonicalHistoryBySessionId.get(s.session_id)?.resume_supported === true,
+        resume_unavailable_reason:
+          canonicalHistoryBySessionId.get(s.session_id)?.resume_unavailable_reason || null,
+        ...(includePreviews ? { last_message_preview: previews.get(s.session_id) ?? null } : {}),
+      }));
       return respond(res, 200, { sessions: history });
     }
 
+    // ── GET /sessions/tags/recent ──────────────────────────
+    if (req.method === "GET" && path === "/sessions/tags/recent") {
+      if (!requireDashboardMode(claims, res)) return;
+      try {
+        return respond(res, 200, {
+          status: "recent_session_tags",
+          tags: new RecentSessionTagsStore(getConfigDir()).read(),
+          bounded: true,
+          host_local: true,
+        });
+      } catch (err) {
+        return respond(res, 500, {
+          error: err.message || String(err),
+          code: "recent_session_tags_unavailable",
+        });
+      }
+    }
+
     // ── GET /sessions/default-name?agent_id=…&mode=branch&source_session_id=… ──
     // Returns the counter-based `${parent}-branch-N` default a subsequent
     // `/sessions/resume` branch would resolve, WITHOUT bumping the counter.
@@ -22944,9 +24215,13 @@ const server = createServer(async (req, res) => {
 
       const transcripts = [];
       const resumeDispositions = [];
-      for (const record of getSessionHistory()) {
-        if (record.agent_id !== agent_id || !record.session_id) continue;
-        const binding = getRouteCMatrixRoomBinding(record.session_id);
+      const records = getSessionHistory().filter(
+        (record) => record.agent_id === agent_id && record.session_id
+      );
+      // R3 batches only the binding read; P210 timeline replay remains truth.
+      const bindings = getRouteCMatrixRoomBindings(records.map((r) => r.session_id));
+      for (const record of records) {
+        const binding = bindings.get(record.session_id);
         let matrixTranscriptAvailable = false;
         let transcript = null;
         try {
@@ -22994,6 +24269,7 @@ const server = createServer(async (req, res) => {
 
     // ── POST /sessions/resume ──────────────────────────────
     if (req.method === "POST" && path === "/sessions/resume") {
+      try { assertSessionRosterMutationAvailable(); } catch (error) { return respond(res, 409, { error: error.message, code: error.code }); }
       const body = await readBody(req);
       if (rejectRetiredCapabilitySettingInput(res, body)) return;
       const { source_session_id, agent_id, agent_folder, session_name } = body;
@@ -23028,6 +24304,14 @@ const server = createServer(async (req, res) => {
           error: "Resume source agent does not match requested agent",
         });
       }
+      let childTags;
+      try {
+        childTags = Object.prototype.hasOwnProperty.call(body, "tags")
+          ? normalizeSessionTags(body.tags)
+          : normalizeSessionTags([sourceRecord.session_name]);
+      } catch (err) {
+        return respond(res, 400, { error: err.message, code: err.code });
+      }
 
       if (!sourceRecord.agent_folder) {
         return respond(res, 400, {
@@ -23202,11 +24486,14 @@ const server = createServer(async (req, res) => {
       });
       let session;
       try {
+        assertSessionRosterMutationAvailable();
         session = sessionManager.start({
           agentId: agent_id,
           cwd: resolvedFolder,
           sessionId: childSessionId,
           sessionName: resolvedSessionName,
+          tags: childTags,
+          deferTagsPersistence: true,
           provider: resolved.runtime.provider,
           parentSessionId: sourceSessionId,
           resumeSessionId: forkSourceProviderMetadata.providerResumeId,
@@ -23341,11 +24628,13 @@ const server = createServer(async (req, res) => {
       recordTelemetryCounter("session_branch_resumed_count");
       recordTelemetryFeature("sessions");
       recordTelemetryFeature("chat");
-      return respond(res, 200, {
+      const persistedTags = canonicalSessionTags(session);
+      const response = {
         success: true,
         session_id: session.id,
         session_name: session.sessionName,
         parent_session_id: sourceSessionId,
+        tags: persistedTags,
         agent_id,
         provider: session.provider || "claude",
         permission_mode: session.permissionMode ?? null,
@@ -23412,7 +24701,10 @@ const server = createServer(async (req, res) => {
         bookkeeping_warning: bookkeepingWarnings.length
           ? bookkeepingWarnings.join("; ")
           : null,
-      });
+      };
+      commitSuccessfulSessionTags(session, { changeKinds: ["branch_resume", "create"] });
+      refreshSessionBookkeepingWarning(response, session);
+      return respond(res, 200, response);
     }
 
     // ── POST /session/resume ───────────────────────────────
@@ -23420,6 +24712,7 @@ const server = createServer(async (req, res) => {
     // therefore the Route C Matrix room binding key. Branch/fork creation stays
     // on /sessions/resume.
     if (req.method === "POST" && path === "/session/resume") {
+      try { assertSessionRosterMutationAvailable(); } catch (error) { return respond(res, 409, { error: error.message, code: error.code }); }
       const body = await readBody(req);
       if (rejectRetiredCapabilitySettingInput(res, body)) return;
       const {
@@ -23482,6 +24775,14 @@ const server = createServer(async (req, res) => {
           error: "Resume source agent does not match requested agent",
         });
       }
+      let resumedTags;
+      try {
+        resumedTags = Object.prototype.hasOwnProperty.call(body, "tags")
+          ? normalizeSessionTags(body.tags)
+          : canonicalSessionTags(sourceRecord);
+      } catch (err) {
+        return respond(res, 400, { error: err.message, code: err.code });
+      }
 
       if (!sourceRecord.agent_folder) {
         return respond(res, 400, {
@@ -23492,13 +24793,13 @@ const server = createServer(async (req, res) => {
       let sourceCanonicalFolder;
       let requestedCanonicalFolder;
       try {
-        sourceCanonicalFolder = realpathSync(sourceRecord.agent_folder);
+        sourceCanonicalFolder = requireAgentFolder(sourceRecord.agent_folder);
         requestedCanonicalFolder = agent_folder
           ? realpathSync(agent_folder)
           : sourceCanonicalFolder;
       } catch (err) {
         return respond(res, 400, {
-          error: `Resume folder validation failed: ${err.message}`,
+          ...agentFolderErrorResponse(err),
         });
       }
       if (sourceCanonicalFolder !== requestedCanonicalFolder) {
@@ -23697,6 +24998,12 @@ const server = createServer(async (req, res) => {
         });
       }
 
+      // Recheck after all asynchronous preparation, before provider construction.
+      try {
+        requireAgentFolder(resolvedFolder);
+      } catch (err) {
+        return respond(res, 400, agentFolderErrorResponse(err));
+      }
       const sessionRuntimeCapabilities =
         resolveRuntimeCapabilitiesForSessionStart(resolved.config, body);
       const runtimeCapabilityGrant = buildLiveSessionRuntimeCapabilityGrant({
@@ -23706,11 +25013,14 @@ const server = createServer(async (req, res) => {
       });
       let session;
       try {
+        assertSessionRosterMutationAvailable();
         session = sessionManager.start({
           agentId: agent_id,
           cwd: resolvedFolder,
           sessionId: sourceSessionId,
           sessionName: resolvedSessionName,
+          tags: resumedTags,
+          deferTagsPersistence: true,
           provider: resolved.runtime.provider,
           parentSessionId: sourceRecord.parent_session_id || null,
           resumeSessionId: sourceProviderMetadata.providerResumeId,
@@ -23847,12 +25157,14 @@ const server = createServer(async (req, res) => {
       recordTelemetryCounter("session_resumed_count");
       recordTelemetryFeature("sessions");
       recordTelemetryFeature("chat");
-      return respond(res, 200, {
+      const persistedTags = canonicalSessionTags(session);
+      const response = {
         success: true,
         session_id: session.id,
         source_session_id: sourceSessionId,
         session_name: session.sessionName,
         parent_session_id: session.parentSessionId || null,
+        tags: persistedTags,
         agent_id,
         provider: session.provider || "claude",
         permission_mode: session.permissionMode ?? null,
@@ -23919,13 +25231,26 @@ const server = createServer(async (req, res) => {
         bookkeeping_warning: bookkeepingWarnings.length
           ? bookkeepingWarnings.join("; ")
           : null,
+      };
+      commitSuccessfulSessionTags(session, {
+        promote: Object.prototype.hasOwnProperty.call(body, "tags"),
+        restoreReady: true,
+        changeKinds: ["resume"],
       });
+      refreshSessionBookkeepingWarning(response, session);
+      return respond(res, 200, response);
     }
 
     // ── GET /sessions ──────────────────────────────────────
     if (req.method === "GET" && path === "/sessions") {
       const includePreviews = shouldIncludeSessionListPreviews(url);
-      const allSessions = sessionManager.list();
+      const allSessions = sessionManager.list().filter((session) => {
+        const sessionId = session.id || session.sessionId;
+        return (
+          sessionManager.getDesiredOpenRestoreOutcome(sessionId)?.state !==
+          "failed"
+        );
+      });
       let accessible;
       if (isRuntimeCapabilityOnly(claims)) {
         const auth = requireRuntimeCapability(claims, res, {
@@ -23938,7 +25263,11 @@ const server = createServer(async (req, res) => {
       } else {
         accessible = allSessions.filter((s) => claims.agent_ids.includes(s.agentId));
       }
+      const previews = includePreviews ? sessionListProjectionService.previewOnly(
+        accessible.map((s) => ({ sessionId: s.id || s.sessionId, agentId: s.agentId }))
+      ) : null;
       return respond(res, 200, {
+        desired_open_restore: buildDesiredOpenRestoreStatusPayload(),
         sessions: accessible.map((session) => {
           const sessionId = session.id || session.sessionId;
           const liveSession = sessionId
@@ -23976,11 +25305,7 @@ const server = createServer(async (req, res) => {
                 ),
           };
           if (includePreviews) {
-            row.lastMessagePreview = getLastMessagePreview(
-              session.cwd,
-              session.agentId,
-              sessionId
-            );
+            row.lastMessagePreview = previews.get(sessionId) ?? null;
           }
           return row;
         }),
@@ -24027,6 +25352,7 @@ const server = createServer(async (req, res) => {
 
 const notificationWss = new WebSocketServer({ noServer: true });
 const mailNotificationWss = new WebSocketServer({ noServer: true });
+const sessionCollectionWss = new WebSocketServer({ noServer: true });
 const wss = new WebSocketServer({ noServer: true });
 
 server.on("upgrade", (req, socket, head) => {
@@ -24043,6 +25369,12 @@ server.on("upgrade", (req, socket, head) => {
     });
     return;
   }
+  if (url.pathname === "/sessions/collection/stream") {
+    sessionCollectionWss.handleUpgrade(req, socket, head, (ws) => {
+      sessionCollectionWss.emit("connection", ws, req);
+    });
+    return;
+  }
   if (url.pathname === "/session/stream") {
     wss.handleUpgrade(req, socket, head, (ws) => {
       wss.emit("connection", ws, req);
@@ -24134,6 +25466,27 @@ mailNotificationWss.on("connection", (ws, req) => {
   });
 });
 
+sessionCollectionWss.on("connection", (ws, req) => {
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+  const claims = authenticateDashboardNotificationWebSocket(req, url);
+  if (!claims?._dashboardAuth) {
+    ws.send(JSON.stringify({ type: "error", error: "Dashboard authentication required" }));
+    ws.close(4001, "Authentication failed");
+    return;
+  }
+  commitSessionCollectionChange(["feed_handshake"]);
+  sessionCollectionSubscribers.add(ws);
+  const diagnostics = sessionCollectionService.diagnostics();
+  ws.send(JSON.stringify({
+    type: "sessions.collection.status",
+    collection_id: diagnostics.collection_id,
+    revision: diagnostics.revision,
+    active: true,
+  }));
+  ws.on("close", () => sessionCollectionSubscribers.delete(ws));
+  ws.on("error", () => sessionCollectionSubscribers.delete(ws));
+});
+
 wss.on("connection", (ws, req) => {
   const url = new URL(req.url, `http://localhost:${PORT}`);
   const sessionId = url.searchParams.get("session_id");
@@ -24795,6 +26148,262 @@ async function restoreTelegramListenersAfterHostRestart({
   };
 }
 
+function waitForDesiredOpenSessionTerminal(
+  sessionId,
+  { timeoutMs = DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS } = {}
+) {
+  const session = sessionManager.getSession(sessionId);
+  if (!session) {
+    return Promise.resolve({ state: "failed", reason: "provider_runtime_exited" });
+  }
+  if (session._ready === true) return Promise.resolve({ state: "ready" });
+  if (timeoutMs === 0) {
+    return Promise.resolve({ state: "failed", reason: "restore_timeout" });
+  }
+  return new Promise((resolve) => {
+    const timer = setTimeout(
+      () => finish({ state: "failed", reason: "restore_timeout" }),
+      timeoutMs
+    );
+    timer.unref?.();
+    function finish(outcome) {
+      clearTimeout(timer);
+      session.off("event", onEvent);
+      session.off("error", onError);
+      session.off("exit", onExit);
+      resolve(outcome);
+    }
+    function onEvent(event) {
+      if (event?.type === "session.ready") finish({ state: "ready" });
+    }
+    function onError() {
+      const outcome = sessionManager.getDesiredOpenRestoreOutcome(sessionId);
+      finish({
+        state: "failed",
+        reason: outcome?.reason || "provider_runtime_restore_failed",
+      });
+    }
+    function onExit() {
+      finish({ state: "failed", reason: "provider_runtime_exited" });
+    }
+    session.on("event", onEvent);
+    session.on("error", onError);
+    session.on("exit", onExit);
+  });
+}
+
+async function executeDesiredOpenReconciliation({
+  trigger,
+  sessionIds = null,
+  timeoutMs = DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS,
+}) {
+  const reconciliationId = randomUUID();
+  const startedAt = new Date().toISOString();
+  const desired = sessionManager.getDesiredOpenRestoreStatus();
+  lastDesiredOpenRestoreStatus = {
+    status: "restoring",
+    trigger,
+    reconciliation_id: reconciliationId,
+    running: true,
+    started_at: startedAt,
+    completed_at: null,
+  };
+  if (!desired.valid) {
+    lastDesiredOpenRestoreStatus = {
+      ...lastDesiredOpenRestoreStatus,
+      status: desired.status,
+      running: false,
+      completed_at: new Date().toISOString(),
+    };
+    return buildDesiredOpenRestoreStatusPayload();
+  }
+
+  const selectedIds = Array.isArray(sessionIds) ? new Set(sessionIds) : null;
+  const queue = desired.sessions.filter(
+    (entry) =>
+      entry.state !== "failed" &&
+      (!selectedIds || selectedIds.has(entry.session_id))
+  );
+  const aggregate = { restored: [], skipped: [], failed: [] };
+  let nextIndex = 0;
+  const worker = async () => {
+    while (nextIndex < queue.length) {
+      const record = queue[nextIndex];
+      nextIndex += 1;
+      const result = sessionManager.restoreDesiredOpenSessions({
+        reconciliationId,
+        sessionIds: [record.session_id],
+        buildRuntimeCapabilityGrant: ({ sessionId, agentId, capabilities }) =>
+          buildLiveSessionRuntimeCapabilityGrant({
+            sessionId,
+            agentId,
+            capabilities,
+          }),
+      });
+      aggregate.failed.push(...result.failed);
+      for (const skippedEntry of result.skipped) {
+        const liveSession = sessionManager.getSession(skippedEntry.session_id);
+        if (
+          skippedEntry.reason === "already_live" &&
+          liveSession?._ready !== true
+        ) {
+          const terminal = await waitForDesiredOpenSessionTerminal(
+            skippedEntry.session_id,
+            { timeoutMs }
+          );
+          if (terminal.state === "failed") {
+            const failure = {
+              session_id: skippedEntry.session_id,
+              agent_id: record.agent_id,
+              provider: record.provider,
+              reason: terminal.reason,
+            };
+            sessionManager.markDesiredOpenRestoreFailure(
+              skippedEntry.session_id,
+              { ...failure, reconciliationId }
+            );
+            aggregate.failed.push(failure);
+            continue;
+          }
+        }
+        aggregate.skipped.push(skippedEntry);
+      }
+      for (const restoredEntry of result.restored) {
+        const terminal = await waitForDesiredOpenSessionTerminal(
+          restoredEntry.session_id,
+          { timeoutMs }
+        );
+        if (terminal.state === "failed") {
+          const failure = {
+            session_id: restoredEntry.session_id,
+            agent_id: record.agent_id,
+            provider: record.provider,
+            reason: terminal.reason,
+          };
+          sessionManager.markDesiredOpenRestoreFailure(
+            restoredEntry.session_id,
+            {
+              ...failure,
+              reconciliationId,
+            }
+          );
+          aggregate.failed.push(failure);
+        } else {
+          aggregate.restored.push(restoredEntry);
+        }
+      }
+    }
+  };
+  await Promise.all(
+    Array.from(
+      { length: Math.min(DESIRED_OPEN_RESTORE_MAX_CONCURRENCY, queue.length) },
+      () => worker()
+    )
+  );
+
+  if (aggregate.restored.length > 0) {
+    await restoreTelegramListenersAfterHostRestart({
+      snapshot: {},
+      sessionRestore: aggregate,
+    });
+    for (const entry of aggregate.restored) {
+      const session = sessionManager.getSession(entry.session_id);
+      if (!session?.cwd) continue;
+      try {
+        const resolved = resolveAgentRuntimeConfig(session.cwd);
+        session.notificationConfig = buildResolvedSessionNotificationConfig(
+          resolved.layers
+        );
+        session.notificationConfigUpdatedAt = new Date().toISOString();
+      } catch (err) {
+        session.bookkeepingWarnings = [
+          ...(session.bookkeepingWarnings || []),
+          `desired_open_restore.notification_config_failed: ${err.message}`,
+        ];
+      }
+    }
+  }
+
+  const failedCount = aggregate.failed.length;
+  for (const failure of aggregate.failed) {
+    if (!failure.session_id) continue;
+    const finalizedFailure = sessionManager.finalizeDesiredOpenRestoreFailure(
+      failure.session_id,
+      failure
+    );
+    try {
+      updateSessionRecord(failure.session_id, {
+        restore_failed_reason: finalizedFailure.reason,
+        restore_failed_at: new Date().toISOString(),
+      });
+    } catch (err) {
+      console.warn(
+        `[desired-open-restore] Could not persist failure history ${failure.session_id}: ${err.message}`
+      );
+    }
+    sessionCollectionAdmittedSessionIds.delete(failure.session_id);
+    if (
+      failure.reason === "restore_timeout" &&
+      sessionManager.getSession(failure.session_id)
+    ) {
+      try {
+        await sessionManager.killSession(failure.session_id);
+      } catch (err) {
+        console.warn(
+          `[desired-open-restore] Could not stop timed-out runtime ${failure.session_id}: ${err.message}`
+        );
+      }
+    }
+  }
+  commitSessionCollectionChange(
+    failedCount > 0
+      ? ["restore", "restore_failed_history"]
+      : ["restore"],
+    queue.map((entry) => entry.session_id)
+  );
+  lastDesiredOpenRestoreStatus = {
+    ...lastDesiredOpenRestoreStatus,
+    status: failedCount > 0 ? "completed_with_failures" : "completed",
+    running: false,
+    completed_at: new Date().toISOString(),
+    counts: {
+      desired: queue.length,
+      restored: aggregate.restored.length,
+      skipped: aggregate.skipped.length,
+      failed: failedCount,
+    },
+    result: aggregate,
+  };
+  return buildDesiredOpenRestoreStatusPayload();
+}
+
+async function reconcileDesiredOpenSessions({
+  trigger,
+  sessionIds = null,
+  timeoutMs = DESIRED_OPEN_RESTORE_SESSION_TIMEOUT_MS,
+}) {
+  while (desiredOpenReconciliationPromise) {
+    try {
+      await desiredOpenReconciliationPromise;
+    } catch {
+      // A queued exact retry owns a new reconciliation after the prior result.
+    }
+  }
+  const reconciliation = executeDesiredOpenReconciliation({
+    trigger,
+    sessionIds,
+    timeoutMs,
+  });
+  desiredOpenReconciliationPromise = reconciliation;
+  try {
+    return await reconciliation;
+  } finally {
+    if (desiredOpenReconciliationPromise === reconciliation) {
+      desiredOpenReconciliationPromise = null;
+    }
+  }
+}
+
 async function reconcileHostRestartRestoreOnBoot() {
   const existing = readHostRestartRestoreState({ configDir: getConfigDir() });
   const activeStack = getActiveStackName();
@@ -24808,6 +26417,30 @@ async function reconcileHostRestartRestoreOnBoot() {
       consumed: false,
       restart_restore: buildHostRestartRestoreSummary(existing),
     };
+    if (readConfig().restore_previous_sessions_after_restart !== false) {
+      void reconcileDesiredOpenSessions({ trigger: "host_boot" }).catch(
+        (err) => {
+          lastDesiredOpenRestoreStatus = {
+            status: "failed",
+            trigger: "host_boot",
+            reconciliation_id: null,
+            running: false,
+            started_at: null,
+            completed_at: new Date().toISOString(),
+            error: err.message,
+          };
+        }
+      );
+    } else {
+      lastDesiredOpenRestoreStatus = {
+        status: "disabled_by_preference",
+        trigger: "host_boot",
+        reconciliation_id: null,
+        running: false,
+        started_at: null,
+        completed_at: new Date().toISOString(),
+      };
+    }
     return lastHostRestartRestoreStatus;
   }
   const snapshot = existing.runtime_snapshot || {};
@@ -24837,6 +26470,7 @@ async function reconcileHostRestartRestoreOnBoot() {
       restoredSessionIds: sessionRestore.restored.map(
         (entry) => entry.session_id
       ),
+      loopRestorePolicy: existing.loop_restore_policy || "default_off",
     }
   );
   const schedulerRestore = schedulerService.markHostRestartInterruptedRuns({
@@ -24904,6 +26538,16 @@ async function reconcileHostRestartRestoreOnBoot() {
 }
 
 await reconcileHostRestartRestoreOnBoot();
+try {
+  const callbackReconciliation = await callbackHostIntegration.reconcilePending({
+    pageSize: 100,
+  });
+  console.log(
+    `[p238-callback] startup reconciliation considered ${callbackReconciliation.considered_count} callback(s)`
+  );
+} catch (err) {
+  console.warn(`[p238-callback] startup reconciliation failed: ${err.message || err}`);
+}
 removeObsoleteAgentRegistry(getConfigDir());
 browserRootProjectIndex.start();
 schedulerRunner.start();
@@ -25030,6 +26674,12 @@ server.listen(PORT, () => {
       `[oysterun-host] Runtime metadata write failed: ${err.message}`
     );
   }
+  // A retained route-pending incident must not require a human login to begin
+  // its read-only requalification. The external coordinator owns completion.
+  setImmediate(() => {
+    try { maybeCloseSupersededOysterunUpdateRecovery(); }
+    catch (error) { console.warn("[lifecycle] Retained operation observation failed:", sanitizeLifecycleDiagnostic(error.message)); }
+  });
   console.log(`[oysterun-host] Listening on http://localhost:${PORT}`);
   console.log(
     `[oysterun-host] WebSocket at ws://localhost:${PORT}/session/stream`