pairling 0.2.10 → 0.2.12

package/payload/mac/companiond/pairlingd.py

@@ -456,10 +456,22 @@ AUTH_RESULT_CACHE_SECONDS = max(0.0, float(os.environ.get("PAIRLING_AUTH_RESULT_
 AUTH_RESULT_CACHE_MAX = max(16, int(os.environ.get("PAIRLING_AUTH_RESULT_CACHE_MAX", "512")))
 RUNTIME_MAX_ACTIVE_FAST_REQUESTS = max(2, int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_FAST_REQUESTS", "4")))
 RUNTIME_MAX_ACTIVE_REQUESTS = max(4, int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_REQUESTS", "12")))
-RUNTIME_MAX_ACTIVE_STREAMS = max(2, int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_STREAMS", "6")))
+RUNTIME_MAX_ACTIVE_DASHBOARD_STREAMS = max(2, int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_DASHBOARD_STREAMS", "8")))
+RUNTIME_MAX_ACTIVE_STREAMS = max(2, int(os.environ.get(
+    "PAIRLING_RUNTIME_MAX_ACTIVE_DETAIL_STREAMS",
+    os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_STREAMS", "6"),
+)))
+RUNTIME_MAX_ACTIVE_AUX_STREAMS = max(2, int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_AUX_STREAMS", "4")))
 RUNTIME_MAX_ACTIVE_CONNECTIONS = max(
-    RUNTIME_MAX_ACTIVE_FAST_REQUESTS + RUNTIME_MAX_ACTIVE_REQUESTS + RUNTIME_MAX_ACTIVE_STREAMS + 2,
-    int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_CONNECTIONS", "24")),
+    (
+        RUNTIME_MAX_ACTIVE_FAST_REQUESTS
+        + RUNTIME_MAX_ACTIVE_REQUESTS
+        + RUNTIME_MAX_ACTIVE_DASHBOARD_STREAMS
+        + RUNTIME_MAX_ACTIVE_STREAMS
+        + RUNTIME_MAX_ACTIVE_AUX_STREAMS
+        + 2
+    ),
+    int(os.environ.get("PAIRLING_RUNTIME_MAX_ACTIVE_CONNECTIONS", "28")),
 )
 TERMINAL_TRUTH_OSASCRIPT_TIMEOUT_SECONDS = max(
     0.5,
@@ -469,9 +481,6 @@ TERMINAL_SURFACE_V2_NONCE_SALT = os.urandom(16).hex()
 LAST_HUMAN_ACTIVITY_AT = 0.0
 DAEMON_STARTED_AT = _time.time()
 BOUND_HOST = ""
-POWER_STATE_PATH = Path(os.environ.get("COMPANION_POWER_STATE_PATH", "/var/run/pairling-power-state.json"))
-POWER_STATE_FALLBACK_PATH = Path(os.environ.get("COMPANION_POWER_STATE_FALLBACK_PATH", "/tmp/pairling-power-state.json"))
-POWER_STATE_STALE_SECONDS = 90
 DAEMON_VERSION = "2026-05-07"
 
 _sessions_health_lock = threading.Lock()
@@ -553,6 +562,7 @@ def _clean_terminal_display_text(text: str) -> str:
 
 _HEALTH_PROBE_CACHE_SECONDS = 30.0
 _HEALTH_PAYLOAD_CACHE_SECONDS = 5.0
+REQUEST_READ_TIMEOUT_SECONDS = 15.0
 _health_probe_cache_lock = threading.Lock()
 _health_probe_cache: dict[str, tuple[float, object]] = {}
 _health_payload_cache_lock = threading.Lock()
@@ -564,7 +574,9 @@ _auth_result_cache_lock = threading.Lock()
 _auth_result_cache: dict[tuple, tuple[float, object]] = {}
 _FAST_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_FAST_REQUESTS)
 _REQUEST_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_REQUESTS)
+_DASHBOARD_STREAM_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_DASHBOARD_STREAMS)
 _STREAM_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_STREAMS)
+_AUX_STREAM_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_AUX_STREAMS)
 _CONNECTION_ADMISSION_SEMAPHORE = threading.BoundedSemaphore(RUNTIME_MAX_ACTIVE_CONNECTIONS)
 _STREAM_ENDPOINTS = {
     "/health-stream",
@@ -582,7 +594,26 @@ _STREAM_ENDPOINTS = {
     "/turn-state-stream",
     "/llm-route-stream",
 }
-_FAST_ENDPOINTS = {"/health", "/healthz", "/readyz", "/routez", "/power-state", "/manifest"}
+_DASHBOARD_STREAM_ENDPOINTS = {
+    "/health-stream",
+    "/sessions-stream",
+}
+_AUX_STREAM_ENDPOINTS = {
+    "/activity-stream",
+    "/commands-stream",
+    "/invocations-stream",
+    "/llm-route-stream",
+}
+_FAST_ENDPOINTS = {"/health", "/healthz", "/readyz", "/routez", "/manifest"}
+
+
+def _is_orchestration_stream_path(path: str) -> bool:
+    prefix = f"{ORCHESTRATIONS_ROUTE}/"
+    suffix = "/stream"
+    if not path.startswith(prefix) or not path.endswith(suffix):
+        return False
+    inner = path[len(prefix):-len(suffix)]
+    return bool(inner) and "/" not in inner
 
 
 class _RuntimeAdmission:
@@ -912,12 +943,8 @@ def _pairdrop_gateway_provenance_ok(headers, client_address=None) -> bool:
     header_ok = str(getter("X-Pairling-Connect-Gateway", "") or "") == "pairling-connectd"
     if not header_ok:
         return False
-    # The gateway header alone is spoofable, so in the default loopback-only bind
-    # also require the loopback hop from connectd. Under PAIRLING_BIND_MODE=all a
-    # direct-LAN client is non-loopback, so waive the loopback requirement there
-    # to avoid breaking that path.
-    if os.environ.get("PAIRLING_BIND_MODE", "loopback").strip().lower() == "all":
-        return True
+    # The gateway header alone is spoofable. The trusted connectd hop is loopback,
+    # even when connectd received the original request over a tailnet route.
     return _loopback_client_address(client_address)
 
 
@@ -957,7 +984,7 @@ def _required_scopes_for_request(path: str, method: str) -> set[str]:
         return {"files:write"}
     if _is_pairdrop_upload_path(path):
         return {"files:write"}
-    if path in {"/health", "/healthz", "/readyz", "/routez", "/power-state", "/health-stream", "/provider-status", "/status", "/aperture-cli/status", "/aperture-cli/providers", "/aperture-cli/launch-contexts"}:
+    if path in {"/health", "/healthz", "/readyz", "/routez", "/health-stream", "/provider-status", "/status", "/aperture-cli/status", "/aperture-cli/providers", "/aperture-cli/launch-contexts"}:
         return {"health:read"}
     if path == "/manifest":
         return {"manifest:read"}
@@ -1043,6 +1070,10 @@ def _funnel_origin_request(headers, client_address) -> bool:
     return str(getter("X-Pairling-Funnel-Origin", "") or "").strip() == "1"
 
 
+def _pair_claim_requires_app_attest(headers, client_address) -> bool:
+    return _funnel_origin_request(headers, client_address) or not _loopback_client_address(client_address)
+
+
 def _connectd_peer_node_id(headers) -> str:
     getter = headers.get if hasattr(headers, "get") else lambda key, default=None: default
     value = str(getter("X-Pairling-Peer-Node", "") or "").strip()
@@ -1699,6 +1730,24 @@ def _agent_registry_heartbeat_by_claude_uuid(provider: str, claude_uuid: str, *,
         return False
 
 
+def _agent_registry_heartbeat_by_native_id(provider: str, native_id: str, *,
+                                           terminal_tty: str = "", pid: int = 0) -> bool:
+    if not provider or not native_id:
+        return False
+    try:
+        with _agent_registry_conn() as conn:
+            cur = conn.execute(
+                "UPDATE agent_sessions SET last_heartbeat = ?, state = 'running', closed_at = NULL, "
+                "terminal_tty = COALESCE(NULLIF(?, ''), terminal_tty), "
+                "pid = COALESCE(NULLIF(?, 0), pid) "
+                "WHERE provider = ? AND native_id = ?",
+                (_time.time(), terminal_tty or "", int(pid or 0), provider, native_id),
+            )
+            return cur.rowcount > 0
+    except Exception:
+        return False
+
+
 def _agent_registry_mark_closed_by_claude_uuid(provider: str, claude_uuid: str) -> bool:
     """Tombstone keyed on claude_uuid (SessionEnd hook path). Idempotent —
     only rows without an existing closed_at are touched, like the PG
@@ -1717,6 +1766,21 @@ def _agent_registry_mark_closed_by_claude_uuid(provider: str, claude_uuid: str)
         return False
 
 
+def _agent_registry_mark_closed_by_native_id(provider: str, native_id: str) -> bool:
+    if not provider or not native_id:
+        return False
+    try:
+        with _agent_registry_conn() as conn:
+            cur = conn.execute(
+                "UPDATE agent_sessions SET closed_at = ?, state = 'terminated' "
+                "WHERE provider = ? AND native_id = ? AND closed_at IS NULL",
+                (_time.time(), provider, native_id),
+            )
+            return cur.rowcount > 0
+    except Exception:
+        return False
+
+
 def _registry_metadata_from_row(row: dict | None) -> dict:
     if not row:
         return {}
@@ -1975,7 +2039,15 @@ def _runtime_admission_for_path(path: str) -> _RuntimeAdmission:
         if _FAST_ADMISSION_SEMAPHORE.acquire(blocking=False):
             return _RuntimeAdmission(_FAST_ADMISSION_SEMAPHORE, True)
         return _RuntimeAdmission(None, False, "fast_capacity_exceeded")
-    if path in _STREAM_ENDPOINTS:
+    if path in _DASHBOARD_STREAM_ENDPOINTS:
+        if _DASHBOARD_STREAM_ADMISSION_SEMAPHORE.acquire(blocking=False):
+            return _RuntimeAdmission(_DASHBOARD_STREAM_ADMISSION_SEMAPHORE, True)
+        return _RuntimeAdmission(None, False, "dashboard_stream_capacity_exceeded")
+    if path in _AUX_STREAM_ENDPOINTS:
+        if _AUX_STREAM_ADMISSION_SEMAPHORE.acquire(blocking=False):
+            return _RuntimeAdmission(_AUX_STREAM_ADMISSION_SEMAPHORE, True)
+        return _RuntimeAdmission(None, False, "aux_stream_capacity_exceeded")
+    if path in _STREAM_ENDPOINTS or _is_orchestration_stream_path(path):
         if _STREAM_ADMISSION_SEMAPHORE.acquire(blocking=False):
             return _RuntimeAdmission(_STREAM_ADMISSION_SEMAPHORE, True)
         return _RuntimeAdmission(None, False, "stream_capacity_exceeded")
@@ -2119,19 +2191,6 @@ def _codex_terminal_tty_candidates(reg: dict | None) -> list[str]:
     return candidates
 
 
-def _guardian_tailnet_ip(power_state: dict | None) -> str | None:
-    if not isinstance(power_state, dict):
-        return None
-    for section_name in ("network", "facts"):
-        section = power_state.get(section_name)
-        if not isinstance(section, dict):
-            continue
-        ip = str(section.get("tailscale_ip") or "").strip()
-        if ip.startswith("100."):
-            return ip
-    return None
-
-
 def _probe_tailnet_ip() -> str | None:
     ok, out, _ = _run_text(["tailscale", "ip", "-4"], timeout=3)
     if not ok:
@@ -2143,29 +2202,10 @@ def _probe_tailnet_ip() -> str | None:
     return None
 
 
-def _tailnet_ip(power_state: dict | None = None) -> str | None:
-    guardian_ip = _guardian_tailnet_ip(power_state)
-    if guardian_ip:
-        return guardian_ip
+def _tailnet_ip() -> str | None:
     return _cached_probe("tailnet_ip", _HEALTH_PROBE_CACHE_SECONDS, _probe_tailnet_ip)
 
 
-def _guardian_lan_ips(power_state: dict | None) -> list[str]:
-    if not isinstance(power_state, dict):
-        return []
-    network = power_state.get("network")
-    if not isinstance(network, dict):
-        return []
-    ips: list[str] = []
-    for item in network.get("lan_ips") or []:
-        ip = str(item or "").strip()
-        if not ip or ip.startswith(("127.", "169.254.", "100.")):
-            continue
-        if ip not in ips:
-            ips.append(ip)
-    return ips
-
-
 def _probe_lan_ips() -> list[str]:
     ok, out, _ = _run_text(["/sbin/ifconfig"], timeout=3)
     if not ok:
@@ -2180,27 +2220,10 @@ def _probe_lan_ips() -> list[str]:
     return ips
 
 
-def _lan_ips(power_state: dict | None = None) -> list[str]:
-    guardian_ips = _guardian_lan_ips(power_state)
-    if guardian_ips:
-        return guardian_ips
+def _lan_ips() -> list[str]:
     return _cached_probe("lan_ips", _HEALTH_PROBE_CACHE_SECONDS, _probe_lan_ips)
 
 
-def _guardian_listener_entries(power_state: dict | None) -> list[str]:
-    if not isinstance(power_state, dict):
-        return []
-    daemon = power_state.get("daemon")
-    if not isinstance(daemon, dict):
-        return []
-    entries: list[str] = []
-    for item in daemon.get("listen") or []:
-        entry = str(item or "").strip()
-        if entry and entry not in entries:
-            entries.append(entry)
-    return entries
-
-
 def _probe_listener_entries() -> list[str]:
     host = BOUND_HOST or os.environ.get("PAIRLING_BOUND_HOST", "")
     entries: list[str] = []
@@ -2217,153 +2240,10 @@ def _probe_listener_entries() -> list[str]:
     return entries
 
 
-def _listener_entries(power_state: dict | None = None) -> list[str]:
-    guardian_entries = _guardian_listener_entries(power_state)
-    if guardian_entries:
-        return guardian_entries
+def _listener_entries() -> list[str]:
     return _cached_probe("listener_entries", _HEALTH_PROBE_CACHE_SECONDS, _probe_listener_entries)
 
 
-def _read_guardian_state() -> tuple[dict | None, str | None, float | None, str | None]:
-    for path in (POWER_STATE_PATH, POWER_STATE_FALLBACK_PATH):
-        try:
-            if not path.exists():
-                continue
-            state = json.loads(path.read_text())
-            generated = float(state.get("generated_at") or state.get("ts") or 0)
-            age = max(0.0, _time.time() - generated) if generated else None
-            return state, str(path), age, None
-        except Exception as exc:
-            return None, str(path), None, f"{type(exc).__name__}: {exc}"
-    return None, None, None, "guardian state missing"
-
-
-def _coordinator_from_guardian(state: dict | None, age: float | None, error: str | None) -> dict:
-    if not state:
-        return {
-            "role": "primary_coordinator",
-            "posture": "unknown",
-            "severity": "unknown",
-            "summary": error or "Guardian state is unavailable",
-            "stale": True,
-        }
-    if isinstance(state.get("posture"), dict):
-        posture = state.get("posture") or {}
-        status = posture.get("status") or "unknown"
-        severity = posture.get("severity") or ("ok" if status == "ready" else status)
-        summary = posture.get("summary") or state.get("summary") or "Coordinator posture is unknown"
-    else:
-        status = state.get("posture") or "unknown"
-        severity = state.get("severity") or ("ok" if status == "ready" else status)
-        summary = state.get("summary") or "Coordinator posture is unknown"
-    stale = age is None or age > POWER_STATE_STALE_SECONDS
-    if stale:
-        status = "unknown"
-        severity = "unknown"
-        summary = f"Guardian sample is stale ({int(age or 0)}s old)"
-    return {
-        "role": (state.get("host") or {}).get("role") if isinstance(state.get("host"), dict) else "primary_coordinator",
-        "host": (state.get("host") or {}).get("name") if isinstance(state.get("host"), dict) else (state.get("host") or DEFAULT_COORDINATOR_HOST),
-        "posture": status,
-        "severity": severity,
-        "summary": summary,
-        "stale": stale,
-        "sample_age_seconds": age,
-    }
-
-
-def _normalize_guardian_state(state: dict | None) -> dict | None:
-    if not state:
-        return None
-    if isinstance(state.get("posture"), dict) and any(isinstance(state.get(key), dict) for key in ("host", "network", "daemon")):
-        normalized = dict(state)
-        host = normalized.get("host")
-        if not isinstance(host, dict):
-            normalized["host"] = {
-                "name": str(host or DEFAULT_COORDINATOR_HOST),
-                "role": "primary_coordinator",
-            }
-        return normalized
-
-    facts = state.get("facts") if isinstance(state.get("facts"), dict) else {}
-    checks_in = state.get("checks") if isinstance(state.get("checks"), list) else []
-    checks: dict[str, str] = {}
-    warnings: list[str] = []
-    for item in checks_in:
-        if not isinstance(item, dict):
-            continue
-        ident = str(item.get("id") or "check")
-        ok = bool(item.get("ok"))
-        message = str(item.get("message") or ("ok" if ok else "failed"))
-        checks[ident] = "ok" if ok else message
-        if not ok:
-            warnings.append(message)
-
-    sleep_minutes = facts.get("sleep_minutes")
-    disk_sleep = facts.get("disk_sleep_minutes")
-    thermal_speed = facts.get("thermal_cpu_speed_limit")
-    thermal_scheduler = facts.get("thermal_cpu_scheduler_limit")
-    thermal_state = "nominal"
-    if isinstance(thermal_speed, (int, float)) and thermal_speed < 80:
-        thermal_state = "warning"
-    if isinstance(thermal_scheduler, (int, float)) and thermal_scheduler < 80:
-        thermal_state = "warning"
-
-    host_name = state.get("host") if isinstance(state.get("host"), str) else DEFAULT_COORDINATOR_HOST
-    return {
-        "schema_version": state.get("schema_version") or 1,
-        "generated_at": state.get("generated_at") or state.get("ts") or _time.time(),
-        "host": {
-            "name": host_name or DEFAULT_COORDINATOR_HOST,
-            "role": "primary_coordinator",
-        },
-        "posture": {
-            "status": state.get("posture") or "unknown",
-            "severity": state.get("severity") or "unknown",
-            "summary": state.get("summary") or "Coordinator posture is unknown",
-        },
-        "power": {
-            "ac_power": facts.get("ac_power"),
-            "battery_percent": facts.get("battery_percent"),
-            "low_power_mode": facts.get("low_power_mode"),
-            "system_sleep_disabled": sleep_minutes == 0 if sleep_minutes is not None else None,
-            "display_sleep_minutes": facts.get("display_sleep_minutes"),
-            "disk_sleep_disabled": disk_sleep == 0 if disk_sleep is not None else None,
-            "caffeinate_pid": facts.get("caffeinate_pid"),
-            "prevent_system_sleep": facts.get("prevent_system_sleep"),
-            "prevent_idle_system_sleep": facts.get("prevent_user_idle_system_sleep"),
-            "prevent_display_sleep": facts.get("prevent_user_idle_display_sleep"),
-        },
-        "lid": {
-            "closed": facts.get("lid_closed"),
-            "apple_clamshell_causes_sleep": facts.get("clamshell_causes_sleep"),
-            "supported_posture": facts.get("lid_closed") is False,
-        },
-        "thermal": {
-            "state": thermal_state,
-            "cpu_speed_limit": thermal_speed,
-            "cpu_scheduler_limit": thermal_scheduler,
-        },
-        "network": {
-            "tailscale_installed": facts.get("tailscale_ip") is not None,
-            "tailscale_variant": "standalone",
-            "tailscale_ip": facts.get("tailscale_ip"),
-            "tailscale_status": "ok" if facts.get("tailscale_ip") else "missing",
-            "default_interface": None,
-            "lan_ips": [],
-        },
-        "daemon": {
-            "pairling_pid": os.getpid(),
-            "listen": (listener_entries := _listener_entries()),
-            "reachable_local": bool(listener_entries),
-            "reachable_tailnet": facts.get("daemon_reachable"),
-        },
-        "warnings": warnings,
-        "checks": checks,
-        "raw_schema": "legacy_flat_guardian",
-    }
-
-
 def _pairling_connect_health() -> dict:
     """Cached snapshot of the Pairling Connect (connectd) axis for health
     surfaces: {"ready": bool, "summary": dict | None, "routes": list}.
@@ -2417,38 +2297,7 @@ def _coordinator_from_pairling_connect(connect: dict) -> dict:
     }
 
 
-# Guardian checks whose failure is fully compensated by a ready Pairling
-# Connect route: both only measure the standalone-Tailscale axis.
-_TAILNET_AXIS_CHECK_IDS = {"tailscale_ip", "daemon_reachable"}
-
-
-def _apply_pairling_connect_posture(coordinator: dict, power_state: dict | None, connect: dict) -> dict:
-    """Downgrade tailnet-axis criticality when the Pairling Connect route is
-    ready. The guardian historically measured only standalone Tailscale; a
-    healthy embedded connectd route serves phones regardless, so its absence
-    alone must not mark the coordinator unsafe. Any other failing check
-    keeps the original posture untouched."""
-    if not connect.get("ready"):
-        return coordinator
-    if coordinator.get("posture") != "unsafe":
-        return coordinator
-    checks = (power_state or {}).get("checks")
-    if not isinstance(checks, dict) or not checks:
-        return coordinator
-    failing = {cid for cid, msg in checks.items() if msg != "ok"}
-    if not failing or not failing.issubset(_TAILNET_AXIS_CHECK_IDS):
-        return coordinator
-    adjusted = dict(coordinator)
-    adjusted["posture"] = "warning"
-    adjusted["severity"] = "warning"
-    adjusted["summary"] = (
-        "Pairling Connect tailnet route is ready; standalone Tailscale is offline."
-    )
-    adjusted["tailnet_axis"] = "pairling_connect"
-    return adjusted
-
-
-def _health_routes(coordinator: dict, power_state: dict | None = None) -> list[dict]:
+def _health_routes(coordinator: dict) -> list[dict]:
     now = _time.time()
     routes: list[dict] = []
     connect = _pairling_connect_health()
@@ -2466,7 +2315,7 @@ def _health_routes(coordinator: dict, power_state: dict | None = None) -> list[d
             "source": str(route.get("source") or "pairling_connectd"),
             "id": route.get("id"),
         })
-    tailnet = _tailnet_ip(power_state)
+    tailnet = _tailnet_ip()
     if tailnet:
         ok = coordinator.get("posture") in ("ready", "warning")
         routes.append({
@@ -2476,7 +2325,7 @@ def _health_routes(coordinator: dict, power_state: dict | None = None) -> list[d
             "score": 100 if ok else 40,
             "last_ok_at": now if ok else None,
         })
-    for ip in _lan_ips(power_state)[:2]:
+    for ip in _lan_ips()[:2]:
         routes.append({
             "kind": "lan",
             "base_url": f"http://{ip}:{PORT}",
@@ -2497,8 +2346,8 @@ def _health_routes(coordinator: dict, power_state: dict | None = None) -> list[d
     return routes
 
 
-def _daemon_snapshot(power_state: dict | None = None) -> dict:
-    entries = _listener_entries(power_state)
+def _daemon_snapshot() -> dict:
+    entries = _listener_entries()
     return {
         "name": "pairlingd",
         "pid": os.getpid(),
@@ -2571,14 +2420,13 @@ def _routez_payload(auth_result=None) -> dict:
     }
 
 
-def _health_payload(full_power: bool = False, authenticated: bool = False, auth_result=None) -> dict:
+def _health_payload(authenticated: bool = False, auth_result=None) -> dict:
     connect = _pairling_connect_health()
-    power_state = None
     coordinator = _coordinator_from_pairling_connect(connect)
     if connect.get("summary") is not None:
         coordinator = dict(coordinator)
         coordinator["pairling_connect"] = connect["summary"]
-    routes = _health_routes(coordinator, power_state)
+    routes = _health_routes(coordinator)
     ok = coordinator.get("posture") in ("ready", "warning")
     runtime_info = _runtime_info_snapshot()
     public_runtime = _public_runtime_info(runtime_info) if _public_runtime_info else runtime_info
@@ -2593,7 +2441,7 @@ def _health_payload(full_power: bool = False, authenticated: bool = False, auth_
             "required": True,
             "legacy_global_token": False,
         },
-        "daemon": _daemon_snapshot(power_state),
+        "daemon": _daemon_snapshot(),
         "coordinator": coordinator,
     }
     if authenticated:
@@ -2617,16 +2465,16 @@ def _health_payload(full_power: bool = False, authenticated: bool = False, auth_
     return payload
 
 
-def _cached_health_payload(full_power: bool = False, authenticated: bool = False, auth_result=None) -> dict:
+def _cached_health_payload(authenticated: bool = False, auth_result=None) -> dict:
     device_id = str(getattr(auth_result, "device_id", "") or "")
     install_id = str(getattr(auth_result, "install_id", "") or "")
-    key = (bool(full_power), bool(authenticated), device_id, install_id)
+    key = (bool(authenticated), device_id, install_id)
     now = _time.time()
     with _health_payload_cache_lock:
         cached = _health_payload_cache.get(key)
         if cached is not None and now - cached[0] < _HEALTH_PAYLOAD_CACHE_SECONDS:
             return _copy_cache_value(cached[1])
-    payload = _health_payload(full_power=full_power, authenticated=authenticated, auth_result=auth_result)
+    payload = _health_payload(authenticated=authenticated, auth_result=auth_result)
     with _health_payload_cache_lock:
         _health_payload_cache[key] = (now, _copy_cache_value(payload))
     return _copy_cache_value(payload)
@@ -2662,38 +2510,24 @@ def _health_diff_digest(payload: dict) -> str:
     mirror = stable.get("mirror")
     if isinstance(mirror, dict):
         mirror.pop("updated_at", None)
-    stable.pop("guardian_sample_age_seconds", None)
     return hashlib.sha256(json.dumps(stable, sort_keys=True).encode()).hexdigest()
 
 
 def _orchestration_preflight_from_health(health: dict) -> tuple[dict, dict]:
-    power_state = health.get("power_state") if isinstance(health.get("power_state"), dict) else None
-    if power_state is None:
-        power_state = {}
     coordinator = health.get("coordinator") or {}
     route = (health.get("routes") or [{}])[0]
     runtime_info = health.get("runtime") if isinstance(health.get("runtime"), dict) else {}
-    power = power_state.get("power") if isinstance(power_state.get("power"), dict) else {}
-    lid = power_state.get("lid") if isinstance(power_state.get("lid"), dict) else {}
-    network = power_state.get("network") if isinstance(power_state.get("network"), dict) else {}
-    thermal = power_state.get("thermal") if isinstance(power_state.get("thermal"), dict) else {}
-    facts = power_state.get("facts") if isinstance(power_state.get("facts"), dict) else {}
     preflight = {
         "posture": coordinator.get("posture") or "unknown",
-        "warnings": power_state.get("warnings") or [],
+        "warnings": [],
         "route": route.get("kind") or "unknown",
         "route_base": route.get("base_url"),
         "checked_at": health.get("ts"),
-        "tailscale_ip": network.get("tailscale_ip") or facts.get("tailscale_ip"),
-        "lid_closed": lid.get("closed") if "closed" in lid else facts.get("lid_closed"),
-        "ac_power": power.get("ac_power") if "ac_power" in power else facts.get("ac_power"),
-        "low_power_mode": power.get("low_power_mode") if "low_power_mode" in power else facts.get("low_power_mode"),
-        "thermal": thermal.get("state") or (
-            "throttled" if (
-                (facts.get("thermal_cpu_speed_limit") is not None and facts.get("thermal_cpu_speed_limit") < 80) or
-                (facts.get("thermal_cpu_scheduler_limit") is not None and facts.get("thermal_cpu_scheduler_limit") < 80)
-            ) else "normal"
-        ),
+        "tailscale_ip": None,
+        "lid_closed": None,
+        "ac_power": None,
+        "low_power_mode": None,
+        "thermal": "unknown",
         "runtime_version": runtime_info.get("runtime_version"),
         "runtime_source_revision": runtime_info.get("source_revision"),
         "runtime_contract_version": runtime_info.get("contract_version") or RUNTIME_CONTRACT_VERSION,
@@ -2800,6 +2634,7 @@ def _pid_for_tty_command(tty: str, command_name: str) -> int:
 
 
 _codex_terminal_scan_cache: dict[str, object] = {"ts": 0.0, "rows": []}
+_claude_terminal_scan_cache: dict[str, object] = {"ts": 0.0, "rows": []}
 _codex_task_boundary_cache: dict[str, dict[str, object]] = {}
 
 
@@ -2831,6 +2666,11 @@ def _is_codex_cli_command(command: str) -> bool:
     )
 
 
+def _is_claude_cli_command(command: str) -> bool:
+    lower = (command or "").lower()
+    return re.search(r"(^|/)claude(\s|$)", lower) is not None
+
+
 def _codex_live_terminal_rows() -> list[dict]:
     now = _time.time()
     cached_ts = float(_codex_terminal_scan_cache.get("ts") or 0)
@@ -2883,6 +2723,56 @@ def _codex_live_terminal_rows() -> list[dict]:
     return rows
 
 
+def _claude_live_terminal_rows() -> list[dict]:
+    now = _time.time()
+    cached_ts = float(_claude_terminal_scan_cache.get("ts") or 0)
+    if now - cached_ts < 2:
+        return list(_claude_terminal_scan_cache.get("rows") or [])
+    try:
+        proc = subprocess.run(
+            ["ps", "-axo", "pid=,tty=,lstart=,command="],
+            capture_output=True,
+            text=True,
+            timeout=2,
+        )
+    except Exception:
+        return []
+    if proc.returncode != 0:
+        return []
+
+    by_tty: dict[str, dict] = {}
+    for line in proc.stdout.splitlines():
+        parts = line.strip().split(None, 7)
+        if len(parts) < 8 or not parts[0].isdigit():
+            continue
+        tty_name = parts[1]
+        command = parts[7]
+        if tty_name == "??" or not _is_claude_cli_command(command):
+            continue
+        try:
+            started = datetime.strptime(" ".join(parts[2:7]), "%a %b %d %H:%M:%S %Y").timestamp()
+        except Exception:
+            started = 0.0
+        pid = int(parts[0])
+        tty = f"/dev/{tty_name}"
+        cwd = _process_cwd(pid)
+        if not cwd:
+            continue
+        current = by_tty.get(tty)
+        if current is None or pid < int(current.get("pid") or 0):
+            by_tty[tty] = {
+                "pid": pid,
+                "tty": tty,
+                "project": cwd,
+                "started_at": started,
+                "command": command,
+            }
+    rows = list(by_tty.values())
+    _claude_terminal_scan_cache["ts"] = now
+    _claude_terminal_scan_cache["rows"] = rows
+    return rows
+
+
 def _codex_discover_terminal_control(project: str, observed_started_at: float) -> dict | None:
     if not project or observed_started_at <= 0:
         return None
@@ -2898,6 +2788,109 @@ def _codex_discover_terminal_control(project: str, observed_started_at: float) -
     return best if delta <= 600 else None
 
 
+def _codex_terminal_native_id(row: dict) -> str:
+    tty = str(row.get("tty") or "")
+    project = str(row.get("project") or "")
+    started = int(float(row.get("started_at") or 0))
+    seed = f"{tty}|{project}|{started}"
+    return "terminal-" + hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+
+def _claude_terminal_native_id(row: dict) -> str:
+    tty = str(row.get("tty") or "")
+    project = str(row.get("project") or "")
+    started = int(float(row.get("started_at") or 0))
+    seed = f"{tty}|{project}|{started}"
+    return "terminal-" + hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+
+def _codex_register_terminal_only_rows(seen: set[str]) -> None:
+    for terminal in _codex_live_terminal_rows():
+        tty = str(terminal.get("tty") or "")
+        project = str(terminal.get("project") or "")
+        pid = int(terminal.get("pid") or 0)
+        if not project or not pid or not re.match(r"^/dev/ttys[0-9]{3,}$", tty):
+            continue
+        existing = _agent_registry_get_by_tty("codex", tty)
+        if existing and not existing.get("closed_at"):
+            native_id = existing.get("native_id") or ""
+            if native_id in seen:
+                continue
+            _agent_registry_update_control(
+                "codex",
+                native_id,
+                pid=pid,
+                terminal_tty=tty,
+                state="running",
+                reopen=True,
+            )
+            continue
+        native_id = _codex_terminal_native_id(terminal)
+        if native_id in seen:
+            continue
+        _agent_registry_upsert(
+            "codex",
+            native_id,
+            project,
+            pid=pid,
+            terminal_tty=tty,
+            state="running",
+            metadata={
+                "discovered_by": "terminal_scan",
+                "terminal_only": True,
+                "command": str(terminal.get("command") or "")[:500],
+            },
+            working_on="Live Codex terminal",
+        )
+
+
+def _registry_row_has_live_terminal(row: dict, command_name: str) -> bool:
+    tty = str(row.get("terminal_tty") or "")
+    if not re.match(r"^/dev/ttys[0-9]{3,}$", tty):
+        return False
+    return bool(_pid_for_tty_command(tty, command_name))
+
+
+def _claude_register_terminal_only_rows(seen: set[str]) -> None:
+    for terminal in _claude_live_terminal_rows():
+        tty = str(terminal.get("tty") or "")
+        project = str(terminal.get("project") or "")
+        pid = int(terminal.get("pid") or 0)
+        if not project or not pid or not re.match(r"^/dev/ttys[0-9]{3,}$", tty):
+            continue
+        existing = _agent_registry_get_by_tty("claude", tty)
+        if existing and not existing.get("closed_at"):
+            native_id = existing.get("native_id") or ""
+            if native_id in seen:
+                continue
+            _agent_registry_update_control(
+                "claude",
+                native_id,
+                pid=pid,
+                terminal_tty=tty,
+                state="running",
+                reopen=True,
+            )
+            continue
+        native_id = _claude_terminal_native_id(terminal)
+        if native_id in seen:
+            continue
+        _agent_registry_upsert(
+            "claude",
+            native_id,
+            project,
+            pid=pid,
+            terminal_tty=tty,
+            state="running",
+            metadata={
+                "discovered_by": "terminal_scan",
+                "terminal_only": True,
+                "command": str(terminal.get("command") or "")[:500],
+            },
+            working_on="Live Claude terminal",
+        )
+
+
 # Phase 4 B.3: warm claude --continue pool. Maintains up to one long-running
 # `claude` session per model. After 5 min idle, the worker exits.
 # This turns 18-25s cold start into ~2s for repeat /llm-route calls.
@@ -4388,8 +4381,10 @@ class ClaudeSessionsSqliteBackend:
         if live_only:
             source = [
                 row for row in _agent_registry_live("claude")
-                if row.get("claude_uuid")
-                and float(row.get("last_heartbeat") or 0) > cutoff
+                if (
+                    row.get("claude_uuid")
+                    and float(row.get("last_heartbeat") or 0) > cutoff
+                ) or _registry_row_has_live_terminal(row, "claude")
             ]
         else:
             source = _agent_registry_recent("claude", since_min=within_min, limit=1000)
@@ -4415,7 +4410,7 @@ class ClaudeSessionsSqliteBackend:
     def collect_rows(self, since_min: int, live_only: bool, limit: int) -> list[dict]:
         rows: list[dict] = []
         for row in _agent_registry_recent("claude", since_min=since_min, limit=1000):
-            if not row.get("claude_uuid"):
+            if not row.get("claude_uuid") and not _registry_row_has_live_terminal(row, "claude"):
                 continue
             if live_only and row.get("closed_at") is not None:
                 continue
@@ -4908,17 +4903,7 @@ def _terminal_surface_source(raw_session: str) -> dict:
     if provider not in AGENT_PROVIDERS:
         return {"available": False, "source": "unavailable", "reason": "unsupported_provider"}
 
-    if PTY_BROKER is not None:
-        session = PTY_BROKER.get(qualified)
-        if session is not None:
-            return {
-                "available": True,
-                "source": "broker_vt",
-                "reason": "broker_vt",
-                "broker_id": _broker_session_id(session),
-                "tty": _broker_slave_tty(session),
-                "can_control": True,
-            }
+    broker_error = ""
 
     if provider == "codex":
         reg = _agent_registry_get("codex", native_id) or {}
@@ -4931,9 +4916,16 @@ def _terminal_surface_source(raw_session: str) -> dict:
             metadata = {}
         broker_id = str(metadata.get("broker_id") or "").strip()
         if broker_id and PTY_BROKER is not None:
-            session = PTY_BROKER.get(broker_id)
+            try:
+                session = PTY_BROKER.get(broker_id)
+            except Exception as e:
+                session = None
+                broker_error = str(e)[:160]
             if session is not None:
-                PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                try:
+                    PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                except Exception:
+                    pass
                 return {
                     "available": True,
                     "source": "broker_vt",
@@ -4972,7 +4964,59 @@ def _terminal_surface_source(raw_session: str) -> dict:
             "can_control": True,
         }
 
-    return {"available": False, "source": "unavailable", "reason": "no_terminal_tty"}
+    if provider == "claude":
+        reg = _agent_registry_get("claude", native_id) or {}
+        metadata = {}
+        try:
+            metadata = json.loads(reg.get("metadata_json") or "{}")
+            if not isinstance(metadata, dict):
+                metadata = {}
+        except Exception:
+            metadata = {}
+        broker_id = str(metadata.get("broker_id") or "").strip()
+        if broker_id and PTY_BROKER is not None:
+            try:
+                session = PTY_BROKER.get(broker_id)
+            except Exception as e:
+                session = None
+                broker_error = str(e)[:160]
+            if session is not None:
+                try:
+                    PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                except Exception:
+                    pass
+                return {
+                    "available": True,
+                    "source": "broker_vt",
+                    "reason": "broker_vt",
+                    "broker_id": _broker_session_id(session),
+                    "tty": _broker_slave_tty(session),
+                    "can_control": True,
+                }
+        tty = str(reg.get("terminal_tty") or "")
+        if not tty:
+            return {"available": False, "source": "unavailable", "reason": broker_error or "no_terminal_tty"}
+        if not re.match(r"^/dev/ttys[0-9]{3,}$", tty):
+            return {"available": False, "source": "unavailable", "reason": "invalid_tty", "tty": tty}
+        capture_path = _terminal_capture_for_tty(tty, reg.get("project"))
+        if capture_path and capture_path.exists():
+            return {
+                "available": True,
+                "source": "script_capture",
+                "reason": "script_capture",
+                "terminal_log": str(capture_path),
+                "tty": tty,
+                "can_control": True,
+            }
+        return {
+            "available": True,
+            "source": "terminal_app_contents",
+            "reason": "terminal_app_contents",
+            "tty": tty,
+            "can_control": True,
+        }
+
+    return {"available": False, "source": "unavailable", "reason": broker_error or "no_terminal_tty"}
 
 
 def _terminal_surface_capabilities(raw_session: str) -> dict:
@@ -5324,8 +5368,8 @@ def _session_runtime_truth_from_parts(
         control_state = "blocked"
         blocked_reason = contradictions[0]["code"] if contradictions else "terminal_surface_degraded"
     elif selected_surface == "v1_fallback":
-        control_state = "read_only"
-        blocked_reason = "v1_fallback"
+        control_state = "eligible" if selected.get("screen_hash") and selected.get("nonce") else "read_only"
+        blocked_reason = None if control_state == "eligible" else "v1_fallback"
     else:
         control_state = "unavailable"
         blocked_reason = "terminal_surface_unavailable"
@@ -6156,6 +6200,8 @@ def _decorate_claude_session_row(row: dict, native_id: str, claude_pid: int = 0,
     row["provider"] = "claude"
     row["native_id"] = native_id
     row["id"] = _qualified_session_id("claude", native_id)
+    row["terminal_tty"] = terminal_tty
+    row["pid"] = claude_pid
     capabilities = list(CLAUDE_SESSION_CAPABILITIES)
     if terminal_tty and _terminal_capture_for_tty(terminal_tty, row.get("project")):
         capabilities.append("terminal_output")
@@ -6179,6 +6225,35 @@ def _decorate_claude_session_row(row: dict, native_id: str, claude_pid: int = 0,
     return row
 
 
+def _collapse_live_session_rows_by_terminal(rows: list[dict]) -> list[dict]:
+    by_tty: dict[tuple[str, str], dict] = {}
+    passthrough: list[dict] = []
+    for row in rows:
+        provider = str(row.get("provider") or "")
+        tty = str(row.get("terminal_tty") or "")
+        if row.get("closed_at") is not None or not provider or not re.match(r"^/dev/ttys[0-9]{3,}$", tty):
+            passthrough.append(row)
+            continue
+        key = (provider, tty)
+        current = by_tty.get(key)
+        if current is None or _session_row_terminal_score(row) > _session_row_terminal_score(current):
+            by_tty[key] = row
+    return passthrough + list(by_tty.values())
+
+
+def _session_row_terminal_score(row: dict) -> tuple[int, int, int, int, int]:
+    caps = set(row.get("capabilities") or [])
+    control = row.get("controllability") if isinstance(row.get("controllability"), dict) else {}
+    native_id = str(row.get("native_id") or row.get("id") or "")
+    return (
+        1 if bool(control.get("can_send_text") or control.get("can_terminate")) else 0,
+        0 if native_id.startswith("terminal-") else 1,
+        1 if row.get("claude_uuid") else 0,
+        1 if "transcript" in caps else 0,
+        int(row.get("last_heartbeat") or 0),
+    )
+
+
 def _refresh_claude_observed_activity(row: dict, project: str | None, claude_uuid: str | None) -> None:
     """Use transcript/turn-state evidence to correct stale PG heartbeats."""
     observed = int(row.get("last_heartbeat") or 0)
@@ -6539,6 +6614,10 @@ def _codex_control_overlay(row: dict, observed_mtime: float | None = None, *, ve
     state_payload = _codex_turn_state_payload(row.get("native_id") or "", apply_boundary=False)
     can_send = bool(tty)
     can_signal = bool(pid)
+    if tty:
+        row["terminal_tty"] = tty
+    if pid:
+        row["pid"] = pid
     caps = set(row.get("capabilities") or [])
     if state_payload or can_send or can_signal:
         caps.add("live_state")
@@ -6608,6 +6687,8 @@ def _codex_pending_registry_rows(seen: set[str], live_only: bool, active_within_
             "last_heartbeat": int(heartbeat or _time.time()),
             "stale_seconds": stale_seconds,
             "source_freshness": "registry_stale_process_alive" if heartbeat < cutoff and process_alive else "registry_live",
+            "terminal_tty": tty,
+            "pid": pid,
             "first_prompt": None,
             "state": "running",
             "tool": None,
@@ -6700,7 +6781,7 @@ def _list_codex_sessions(live_only: bool, active_within_min: int) -> list[dict]:
 
 
 def _list_codex_sessions_uncached(live_only: bool, active_within_min: int) -> list[dict]:
-    """Read-only Codex provider: persisted rollouts, no process control yet."""
+    """Codex provider backed by transcripts plus live terminal discovery."""
     index = _codex_index_map()
     history = _codex_history_map()
     cutoff = _time.time() - max(1, active_within_min) * 60
@@ -6760,12 +6841,14 @@ def _list_codex_sessions_uncached(live_only: bool, active_within_min: int) -> li
             row["tool"] = state_payload.get("tool")
             row["turn_started_at"] = state_payload.get("started_at")
             row["effort"] = state_payload.get("effort")
-        rows.append(_codex_control_overlay(row, st.st_mtime, verify_process=False))
+        rows.append(_codex_control_overlay(row, st.st_mtime, verify_process=True))
         if len(rows) >= 50:
             break
+    _codex_register_terminal_only_rows(seen)
     rows.extend(_codex_pending_registry_rows(seen, live_only, active_within_min))
     if not live_only:
         rows.extend(_codex_recent_closed_registry_rows(seen, active_within_min))
+    rows = _collapse_live_session_rows_by_terminal(rows)
     rows.sort(
         key=lambda r: (
             1 if (r.get("controllability") or {}).get("can_terminate") else 0,
@@ -7261,28 +7344,37 @@ class ClientDisconnected(Exception):
 
 
 class Handler(BaseHTTPRequestHandler):
+    timeout = REQUEST_READ_TIMEOUT_SECONDS
 
     def do_GET(self):
         try:
             return self._dispatch()
+        except socket.timeout:
+            self._send_json({"ok": False, "error": {"code": "request_timeout"}}, status=408)
         except ClientDisconnected:
             return
 
     def do_POST(self):
         try:
             return self._dispatch()
+        except socket.timeout:
+            self._send_json({"ok": False, "error": {"code": "request_timeout"}}, status=408)
         except ClientDisconnected:
             return
 
     def do_PUT(self):
         try:
             return self._dispatch()
+        except socket.timeout:
+            self._send_json({"ok": False, "error": {"code": "request_timeout"}}, status=408)
         except ClientDisconnected:
             return
 
     def do_DELETE(self):
         try:
             return self._dispatch()
+        except socket.timeout:
+            self._send_json({"ok": False, "error": {"code": "request_timeout"}}, status=408)
         except ClientDisconnected:
             return
 
@@ -7536,7 +7628,9 @@ class Handler(BaseHTTPRequestHandler):
             elif u.path == "/manifest":
                 self._handle_manifest(q)
             elif u.path == "/pair/start":
-                if _funnel_origin_request(self.headers, self.client_address):
+                if not _loopback_client_address(self.client_address):
+                    self._send_json({"ok": False, "error": {"code": "pair_start_loopback_required", "message": "pair start is only available from loopback"}}, status=403)
+                elif _funnel_origin_request(self.headers, self.client_address):
                     # Belt-and-suspenders: /pair/start returns the 192-bit secret
                     # in plaintext and must never be served to a funnel-origin
                     # request, even if connectd's allowlist ever drifted.
@@ -7559,8 +7653,6 @@ class Handler(BaseHTTPRequestHandler):
                 self._handle_pair_bind_node(q)
             elif u.path == "/healthz":
                 self._handle_healthz(q)
-            elif u.path == "/power-state":
-                self._handle_power_state(q)
             elif u.path == "/health-stream":
                 self._handle_health_stream(q)
             elif u.path == "/open":
@@ -7794,17 +7886,24 @@ class Handler(BaseHTTPRequestHandler):
         uuid = str(payload.get("claude_uuid") or "").strip()
         return uuid if self._CLAUDE_UUID_RE.match(uuid) else ""
 
+    def _internal_provider(self, payload: dict) -> str:
+        provider = str(payload.get("provider") or "claude").strip().lower()
+        return provider if provider in {"claude", "codex"} else "claude"
+
     def _internal_terminal_tty(self, payload: dict) -> str:
         tty = str(payload.get("terminal_tty") or "").strip()
         return tty if self._INTERNAL_TTY_RE.match(tty) else ""
 
-    def _internal_claude_pid(self, payload: dict) -> int:
+    def _internal_pid(self, payload: dict) -> int:
         try:
-            pid = int(payload.get("claude_pid") or 0)
+            pid = int(payload.get("pid") or payload.get("claude_pid") or payload.get("codex_pid") or 0)
         except (TypeError, ValueError):
             return 0
         return pid if 0 < pid < 10 ** 8 else 0
 
+    def _internal_claude_pid(self, payload: dict) -> int:
+        return self._internal_pid(payload)
+
     def _read_internal_json(self) -> dict | None:
         if self.command != "POST":
             self.send_error(405, "POST required")
@@ -7823,6 +7922,7 @@ class Handler(BaseHTTPRequestHandler):
         payload = self._read_internal_json()
         if payload is None:
             return
+        provider = self._internal_provider(payload)
         session_id = str(payload.get("id") or "").strip()
         project = str(payload.get("project") or "").strip()
         if not _safe_session_id(session_id) or not project:
@@ -7833,17 +7933,18 @@ class Handler(BaseHTTPRequestHandler):
             return
         claude_uuid = self._internal_claude_uuid(payload)
         ok = _agent_registry_upsert(
-            "claude",
+            provider,
             session_id,
             project,
-            pid=self._internal_claude_pid(payload),
+            pid=self._internal_pid(payload),
             terminal_tty=self._internal_terminal_tty(payload),
-            claude_uuid=claude_uuid,
+            claude_uuid=claude_uuid if provider == "claude" else "",
             working_on=str(payload.get("working_on") or "")[:500],
+            metadata={"registered_by": "internal_session_register"},
         )
         # Mirrors the PG pg_notify('session_ready'): only fire once the row
         # carries a claude_uuid — that is what /turn-state-stream waits on.
-        if ok and claude_uuid:
+        if provider == "claude" and ok and claude_uuid:
             _signal_session_ready(session_id)
         self._send_json({"ok": bool(ok)})
 
@@ -7851,6 +7952,23 @@ class Handler(BaseHTTPRequestHandler):
         payload = self._read_internal_json()
         if payload is None:
             return
+        provider = self._internal_provider(payload)
+        if provider == "codex":
+            session_id = str(payload.get("id") or "").strip()
+            if not _safe_session_id(session_id):
+                self._send_json({
+                    "ok": False,
+                    "error": {"code": "bad_request", "message": "id required"},
+                }, status=400)
+                return
+            ok = _agent_registry_heartbeat_by_native_id(
+                "codex",
+                session_id,
+                terminal_tty=self._internal_terminal_tty(payload),
+                pid=self._internal_pid(payload),
+            )
+            self._send_json({"ok": bool(ok)})
+            return
         claude_uuid = self._internal_claude_uuid(payload)
         if not claude_uuid:
             self._send_json({
@@ -7862,7 +7980,7 @@ class Handler(BaseHTTPRequestHandler):
             "claude",
             claude_uuid,
             terminal_tty=self._internal_terminal_tty(payload),
-            pid=self._internal_claude_pid(payload),
+            pid=self._internal_pid(payload),
         )
         # ok=false simply means no row matched — same as the PG UPDATE no-op.
         self._send_json({"ok": bool(ok)})
@@ -7871,6 +7989,18 @@ class Handler(BaseHTTPRequestHandler):
         payload = self._read_internal_json()
         if payload is None:
             return
+        provider = self._internal_provider(payload)
+        if provider == "codex":
+            session_id = str(payload.get("id") or "").strip()
+            if not _safe_session_id(session_id):
+                self._send_json({
+                    "ok": False,
+                    "error": {"code": "bad_request", "message": "id required"},
+                }, status=400)
+                return
+            closed = _agent_registry_mark_closed_by_native_id("codex", session_id)
+            self._send_json({"ok": True, "closed": bool(closed)})
+            return
         claude_uuid = self._internal_claude_uuid(payload)
         if not claude_uuid:
             self._send_json({
@@ -7883,20 +8013,24 @@ class Handler(BaseHTTPRequestHandler):
 
     def _handle_internal_active_sessions(self, q):
         project = q.get("project", [""])[0].strip()
+        provider_filter = str(q.get("provider", ["claude"])[0] or "claude").strip().lower()
+        providers = ["claude", "codex"] if provider_filter == "all" else [provider_filter if provider_filter in {"claude", "codex"} else "claude"]
         cutoff = _time.time() - 300
         items = []
-        for row in _agent_registry_live("claude"):
-            if float(row.get("last_heartbeat") or 0) < cutoff:
-                continue
-            if project and row.get("project") != project:
-                continue
-            items.append({
-                "id": row.get("native_id"),
-                "project": row.get("project"),
-                "working_on": row.get("working_on") or None,
-                "started_at": float(row.get("started_at") or 0),
-                "last_heartbeat": float(row.get("last_heartbeat") or 0),
-            })
+        for provider in providers:
+            for row in _agent_registry_live(provider):
+                if float(row.get("last_heartbeat") or 0) < cutoff:
+                    continue
+                if project and row.get("project") != project:
+                    continue
+                items.append({
+                    "id": row.get("native_id"),
+                    "provider": provider,
+                    "project": row.get("project"),
+                    "working_on": row.get("working_on") or None,
+                    "started_at": float(row.get("started_at") or 0),
+                    "last_heartbeat": float(row.get("last_heartbeat") or 0),
+                })
         items.sort(key=lambda r: r["started_at"], reverse=True)
         self._send_json({"ok": True, "count": len(items), "sessions": items})
 
@@ -7952,17 +8086,15 @@ class Handler(BaseHTTPRequestHandler):
             subprocess.run(["open", "-a", SUBLIME_APP, path], check=False)
         self._send_text(200, b"ok\n")
 
-    # ----- /healthz + /power-state + /health-stream: coordinator health -----
+    # ----- /healthz + /health-stream: coordinator health -----
     def _handle_health(self, q):
         self._send_json(_cached_health_payload(
-            full_power=False,
             authenticated=self.pairling_auth is not None,
             auth_result=self.pairling_auth,
         ))
 
     def _handle_healthz(self, q):
         self._send_json(_cached_health_payload(
-            full_power=False,
             authenticated=self.pairling_auth is not None,
             auth_result=self.pairling_auth,
         ))
@@ -8282,6 +8414,7 @@ class Handler(BaseHTTPRequestHandler):
                 relay_device_id=payload.get("relay_device_id"),
                 relay_required=bool(relay_claims_required and relay_claims_required()),
                 relay_claim_verifier=RELAY_CLAIM_VERIFIER,
+                require_direct_attest=_pair_claim_requires_app_attest(self.headers, self.client_address),
             )
             if PAIRING_ADVERTISER is not None:
                 PAIRING_ADVERTISER.stop()
@@ -8339,6 +8472,7 @@ class Handler(BaseHTTPRequestHandler):
             payload = self._read_json_object()
             host_chain = self._pairing_host_chain()
             funnel_origin = _funnel_origin_request(self.headers, self.client_address)
+            require_direct_attest = _pair_claim_requires_app_attest(self.headers, self.client_address)
             claim, k_token, aad, mac_confirm = PAIRING_STORE.psk_claim_pair(
                 pair_id=str(payload.get("pair_id") or ""),
                 b_pub_b64=str(payload.get("b_pub") or ""),
@@ -8354,6 +8488,7 @@ class Handler(BaseHTTPRequestHandler):
                 relay_required=bool(relay_claims_required and relay_claims_required()),
                 relay_claim_verifier=RELAY_CLAIM_VERIFIER,
                 funnel_origin=funnel_origin,
+                require_direct_attest=require_direct_attest,
             )
             nonce, enc_token = PAIRING_STORE.seal_psk_token(k_token, claim.device.token, aad)
             # Seal proof_secret (the request-proof HMAC key) under K_token for
@@ -8519,13 +8654,6 @@ class Handler(BaseHTTPRequestHandler):
         )
         self._send_json({"ok": True, "tailnet_node_id_bound": bound})
 
-    def _handle_power_state(self, q):
-        self._send_json(_cached_health_payload(
-            full_power=True,
-            authenticated=self.pairling_auth is not None,
-            auth_result=self.pairling_auth,
-        ))
-
     def _handle_mirror_status(self, q):
         project = q.get("project", [None])[0]
         args = ["status"]
@@ -8641,7 +8769,6 @@ class Handler(BaseHTTPRequestHandler):
         deadline = _time.time() + 600
         while _time.time() < deadline:
             payload = _cached_health_payload(
-                full_power=False,
                 authenticated=self.pairling_auth is not None,
                 auth_result=self.pairling_auth,
             )
@@ -8898,6 +9025,7 @@ class Handler(BaseHTTPRequestHandler):
             for row in _list_codex_sessions(live_only=False, active_within_min=active_within_min):
                 rows.append(self._decorate_session_lifecycle_row(row))
 
+        rows = _collapse_live_session_rows_by_terminal(rows)
         rows.sort(key=lambda r: int(r.get("last_heartbeat") or 0), reverse=True)
         rows = rows[:max(1, min(int(limit or 200), 500))]
         for row in rows:
@@ -9073,6 +9201,7 @@ class Handler(BaseHTTPRequestHandler):
                 self._decorate_session_lifecycle_row(row)
                 for row in _list_codex_sessions(live_only=live_only, active_within_min=within_min)
             ]
+            rows = _collapse_live_session_rows_by_terminal(rows)
             _record_sessions_scan(rows)
             body = json.dumps({"count": len(rows), "items": rows}).encode()
             self.send_response(200)
@@ -9082,14 +9211,11 @@ class Handler(BaseHTTPRequestHandler):
             self.wfile.write(body)
             return
 
-        # Live filter semantics (live_only): not explicitly closed, has a
-        # claude_uuid (proves hooks fired post-migration), AND heartbeat is
-        # fresh enough. The freshness gate hides DORMANT zombies — claudes
-        # whose process is technically alive but stopped firing hooks hours
-        # or days ago (typical of sentinel-mode terminals whose hooks point
-        # at the Sentinel daemon on :9100 instead of us). The kill -0 GC
-        # below catches process-DEAD rows; this catches
-        # process-alive-but-mute rows. Defaults to within_min=60.
+        # Live filter semantics (live_only): keep sessions with either a fresh
+        # claude_uuid-backed hook row or a live Claude process on the recorded
+        # terminal. The freshness gate hides mute zombie rows, while terminal
+        # discovery keeps already-open Claude windows controllable.
+        _claude_register_terminal_only_rows(set())
         backend = _claude_sessions_backend()
         try:
             backend_rows = backend.sessions_rows(live_only, within_min)
@@ -9163,8 +9289,11 @@ class Handler(BaseHTTPRequestHandler):
                 self._decorate_session_lifecycle_row(row)
                 for row in _list_codex_sessions(live_only=live_only, active_within_min=within_min)
             )
+            rows = _collapse_live_session_rows_by_terminal(rows)
             rows.sort(key=lambda r: int(r.get("last_heartbeat") or 0), reverse=True)
             rows = rows[:50]
+        else:
+            rows = _collapse_live_session_rows_by_terminal(rows)
 
         _record_sessions_scan(rows)
         body = json.dumps({"count": len(rows), "items": rows}).encode()
@@ -9204,8 +9333,8 @@ class Handler(BaseHTTPRequestHandler):
                 "fresh": sum(1 for row in claude_live if now - int(row.get("last_heartbeat") or 0) < 120),
                 "stale": sum(1 for row in claude_live if now - int(row.get("last_heartbeat") or 0) >= 120),
                 "notes": [
-                    "Requires closed_at null, claude_uuid present, and a recent heartbeat.",
-                    "This is the canonical Claude dashboard source.",
+                    "Uses claude_uuid-backed hook rows plus live terminal discovery.",
+                    "Terminal-only rows are controllable even before a transcript id is known.",
                 ],
             },
             {
@@ -9304,7 +9433,8 @@ class Handler(BaseHTTPRequestHandler):
 
         def snapshot_payload(rows: list[dict]) -> tuple[bytes, str]:
             degraded = self._sessions_backend_degradation()
-            body: dict = {"source": _sessions_stream_source(), "items": rows, "ts": _time.time()}
+            source = _sessions_stream_source()
+            body: dict = {"source": source, "items": rows, "ts": _time.time()}
             if degraded is not None:
                 body["degraded"] = degraded
             digest = hashlib.sha256(
@@ -9315,6 +9445,7 @@ class Handler(BaseHTTPRequestHandler):
         try:
             # Emit initial snapshot immediately so the iPhone never paints
             # an empty Dashboard while waiting for the first poll.
+            # Initial snapshot body contract: {"items": initial}.
             initial = collect_live()
             payload, last_hash = snapshot_payload(initial)
             self.wfile.write(b"event: snapshot\ndata: " + payload + b"\n\n")
@@ -9756,10 +9887,18 @@ class Handler(BaseHTTPRequestHandler):
     def _session_live_terminal_tail(self, raw_session: str, since: int) -> dict | None:
         provider, native_id = _parse_agent_session_ref(raw_session)
         since = max(0, int(since or 0))
-        broker_found = self._broker_session_for(raw_session)
+        try:
+            broker_found = self._broker_session_for(raw_session)
+        except Exception as e:
+            broker_found = None
+            self.log_message("session-live terminal broker lookup failed for %s: %s", raw_session, str(e)[:200])
         if broker_found and PTY_BROKER:
             broker_id, _ = broker_found
-            tail = PTY_BROKER.raw_tail(broker_id, since=since)
+            try:
+                tail = PTY_BROKER.raw_tail(broker_id, since=since)
+            except Exception as e:
+                self.log_message("session-live broker tail failed for %s: %s", raw_session, str(e)[:200])
+                tail = None
             if tail is None:
                 return None
             data, next_offset, total_bytes, reset = tail
@@ -9952,22 +10091,21 @@ class Handler(BaseHTTPRequestHandler):
                             if not emit("turn_state", turn, source="turn-state"):
                                 return
 
-                if last_truth is None:
-                    # Preserve the original ordering guarantee: clients see the
-                    # first truth event before any tail data, so reducers that
-                    # gate terminal lines on transcript truth never drop bytes.
-                    if now - last_keepalive >= 20.0:
-                        if not emit("keepalive", {}):
-                            return
-                    _time.sleep(0.05)
-                    continue
-
-                for receipt_event in _session_live_control_receipts_since(session_id, receipt_seq):
+                try:
+                    receipt_events = _session_live_control_receipts_since(session_id, receipt_seq)
+                except Exception as e:
+                    receipt_events = []
+                    self.log_message("session-live control receipts failed for %s: %s", session_id, str(e)[:200])
+                for receipt_event in receipt_events:
                     receipt_seq = max(receipt_seq, int(receipt_event.get("receipt_seq") or 0))
                     if not emit("control_receipt", receipt_event, source="control-receipts"):
                         return
 
-                terminal_payload = self._session_live_terminal_tail(session_id, terminal_offset)
+                try:
+                    terminal_payload = self._session_live_terminal_tail(session_id, terminal_offset)
+                except Exception as e:
+                    terminal_payload = None
+                    self.log_message("session-live terminal tail failed for %s: %s", session_id, str(e)[:200])
                 if terminal_payload is not None:
                     if terminal_payload.get("reset"):
                         terminal_offset = 0
@@ -10118,7 +10256,14 @@ class Handler(BaseHTTPRequestHandler):
 
     def _terminal_stream_truth_for_session(self, raw_session: str) -> dict:
         provider, native_id = _parse_agent_session_ref(raw_session)
-        source = _terminal_surface_source(raw_session)
+        try:
+            source = _terminal_surface_source(raw_session)
+        except Exception as e:
+            source = {
+                "available": False,
+                "source": "unavailable",
+                "reason": str(e)[:160] or "terminal_surface_source_failed",
+            }
         backend = source.get("source")
         byte_stream_available = bool(source.get("available")) and backend in {"broker_vt", "script_capture"}
         try:
@@ -10587,9 +10732,6 @@ class Handler(BaseHTTPRequestHandler):
         if not native_id:
             return None
         qualified = _qualified_session_id(provider, native_id)
-        session = PTY_BROKER.get(qualified)
-        if session:
-            return qualified, session
         if provider == "codex":
             reg = _agent_registry_get("codex", native_id) or {}
             try:
@@ -10598,26 +10740,61 @@ class Handler(BaseHTTPRequestHandler):
                 metadata = {}
             broker_id = str(metadata.get("broker_id") or "").strip()
             if broker_id:
-                session = PTY_BROKER.get(broker_id)
+                try:
+                    session = PTY_BROKER.get(broker_id)
+                except Exception:
+                    session = None
                 if session:
-                    PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    try:
+                        PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    except Exception:
+                        pass
                     return qualified, session
             tty = reg.get("terminal_tty") or ""
             if tty:
-                session = PTY_BROKER.get_by_tty(tty)
+                try:
+                    session = PTY_BROKER.get_by_tty(tty)
+                except Exception:
+                    session = None
                 if session:
-                    PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    try:
+                        PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    except Exception:
+                        pass
                     return qualified, session
         if provider == "claude":
             session_id = _claude_native_session_id(raw_session)
             if not session_id:
                 return None
+            reg = _agent_registry_get("claude", session_id) or {}
+            try:
+                metadata = json.loads(reg.get("metadata_json") or "{}")
+            except Exception:
+                metadata = {}
+            broker_id = str(metadata.get("broker_id") or "").strip()
+            if broker_id:
+                try:
+                    session = PTY_BROKER.get(broker_id)
+                except Exception:
+                    session = None
+                if session:
+                    try:
+                        PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    except Exception:
+                        pass
+                    return qualified, session
             tty = self._lookup_terminal_tty(session_id)
             if tty:
-                session = PTY_BROKER.get_by_tty(tty)
+                try:
+                    session = PTY_BROKER.get_by_tty(tty)
+                except Exception:
+                    session = None
                 if session:
                     qualified = _qualified_session_id("claude", session_id)
-                    PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    try:
+                        PTY_BROKER.register_alias(qualified, _broker_session_id(session))
+                    except Exception:
+                        pass
                     return qualified, session
         return None
 
@@ -11425,15 +11602,22 @@ class Handler(BaseHTTPRequestHandler):
         project_basename = os.path.basename(project.rstrip("/")) or project
         result = self._applescript_inject(project_basename, text)
 
+        status = 200
         if not result.get("ok"):
             # Fall back to the queue-file path so nothing is lost
             queue_file = QUEUE_DIR / f"{session_id}.txt"
             with open(queue_file, "a") as f:
                 f.write(text + "\n")
+            status = 202
             body = json.dumps({
-                "ok": True, "injected": False, "queued": True,
+                "ok": False, "injected": False, "queued": True,
+                "state": "queued_not_injected",
                 "fallback_reason": result.get("reason", "unknown"),
                 "window_match": project_basename,
+                "error": {
+                    "code": "terminal_injection_queued",
+                    "message": "Text was queued but was not typed into Terminal.",
+                },
             }).encode()
         else:
             body = json.dumps({
@@ -11441,7 +11625,7 @@ class Handler(BaseHTTPRequestHandler):
                 "window_match": project_basename,
             }).encode()
 
-        self.send_response(200)
+        self.send_response(status)
         self.send_header("Content-Type", "application/json")
         self.send_header("Content-Length", str(len(body)))
         self.end_headers()
@@ -11665,6 +11849,7 @@ class Handler(BaseHTTPRequestHandler):
             cached = _runtime_snapshot_cache.get(cache_key)
             if cached is not None and now - cached[0] < RUNTIME_SNAPSHOT_CACHE_SECONDS:
                 return _copy_cache_value(cached[1])
+        _claude_register_terminal_only_rows(set())
         backend_rows = _claude_sessions_backend().collect_rows(since_min, live_only, limit)
 
         rows: list[dict] = []
@@ -13820,7 +14005,7 @@ Worker instructions:
             self.send_error(409, "project has uncommitted changes; set allow_dirty_project to continue")
             return
 
-        health = _health_payload(full_power=True)
+        health = _health_payload()
         coordinator_meta, preflight_meta = _orchestration_preflight_from_health(health)
         if isinstance(payload.get("coordinator"), dict):
             coordinator_meta.update(payload["coordinator"])
@@ -14633,10 +14818,9 @@ Worker instructions:
         self._send_json({"ok": True, "handoff_id": handoff_id, "composeDraft": compose_draft})
 
     def _handle_spawn_session(self, q):
-        """Spawn a new Claude/Codex session. Pairling-owned PTYs are the
-        default path; Terminal.app can attach as a client via `pairling attach`.
-        The legacy Terminal.app-owner path remains behind
-        PAIRLING_SPAWN_BACKEND=terminal_app for rollback/debugging.
+        """Spawn a new Claude/Codex session. User-facing direct spawns open a
+        visible Terminal.app tab. The broker remains for aperture_cli launches
+        and PAIRLING_SPAWN_BACKEND=broker rollback/debugging.
 
         Security:
         - Project path must be absolute and exist on disk.
@@ -14742,7 +14926,7 @@ Worker instructions:
                 }, status=400)
                 return
 
-        if os.environ.get("PAIRLING_SPAWN_BACKEND", "broker").lower() != "terminal_app":
+        if launch_strategy == "aperture_cli" or os.environ.get("PAIRLING_SPAWN_BACKEND", "terminal_app").lower() == "broker":
             self._handle_spawn_session_broker(
                 project,
                 provider,
@@ -14751,13 +14935,6 @@ Worker instructions:
             )
             return
 
-        if launch_strategy == "aperture_cli":
-            self._send_json({
-                "ok": False,
-                "error": "Aperture CLI launch strategy requires the Pairling PTY broker backend",
-            }, status=400)
-            return
-
         capture_id = ""
         capture_log_path: Path | None = None
         if provider == "codex":
@@ -14772,7 +14949,11 @@ Worker instructions:
         else:
             capture_id = secrets.token_hex(12)
             capture_log_path = TERMINAL_CAPTURE_DIR / f"claude-{capture_id}.log"
-            inner = f"cd {shlex.quote(project)} && claude"
+            inner = (
+                f"cd {shlex.quote(project)} && "
+                f"PAIRLING_PHONE_SESSION=1 "
+                f"exec claude --settings {shlex.quote(str(SPAWN_SETTINGS_PATH))}"
+            )
             shell_cmd = _terminal_script_command(capture_log_path, inner)
         as_escaped_cmd = _as_escape(shell_cmd)
 
@@ -14801,41 +14982,37 @@ Worker instructions:
             if len(parts) >= 2:
                 tty = parts[1].strip()
         pid = 0
-        native_id = None
-        if provider == "codex" and result.get("ok"):
-            native_id = "pending-" + secrets.token_hex(8)
+        native_id = "pending-" + secrets.token_hex(8)
+        if result.get("ok"):
             _time.sleep(0.75)
-            pid = _pid_for_tty_command(tty, "codex") if tty else 0
+            pid = _pid_for_tty_command(tty, provider) if tty else 0
             if tty and capture_log_path is not None:
                 _write_terminal_capture_mapping(
                     tty,
                     capture_log_path,
-                    provider="codex",
+                    provider=provider,
                     project=project,
                     capture_id=capture_id,
                 )
             _agent_registry_upsert(
-                "codex",
+                provider,
                 native_id,
                 project,
                 pid=pid,
                 terminal_tty=tty,
                 metadata={
-                    "spawned_by": "phone-companion",
+                    "spawned_by": "pairling",
+                    "launch_strategy": "direct_pairling",
+                    "launch_visibility": "visible_terminal",
                     "terminal_log": str(capture_log_path) if capture_log_path else None,
                     "capture_backend": "script" if capture_log_path else None,
+                    "terminal_source": "terminal_app_contents",
                     "capture_id": capture_id or None,
                 },
+                working_on=f"New {provider.title()} session",
             )
-            _write_agent_turn_state("codex", native_id, "idle", event="spawn")
-        elif provider == "claude" and result.get("ok") and tty and capture_log_path is not None:
-            _write_terminal_capture_mapping(
-                tty,
-                capture_log_path,
-                provider="claude",
-                project=project,
-                capture_id=capture_id,
-            )
+            if provider == "codex":
+                _write_agent_turn_state("codex", native_id, "idle", event="spawn")
 
         # Audit log — append-only, JSONL, includes failures.
         try:
@@ -14867,20 +15044,21 @@ Worker instructions:
             self.wfile.write(body)
             return
 
-        body = json.dumps({
+        self._send_json({
             "ok": True,
             "project": project,
             "provider": provider,
             "native_id": native_id,
+            "session_id": _qualified_session_id(provider, native_id),
             "tty": tty,
             "pid": pid,
             "terminal_log": str(capture_log_path) if capture_log_path else None,
-        }).encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
+            "capture_backend": "script" if capture_log_path else None,
+            "terminal_source": "terminal_app_contents",
+            "launch_strategy": "direct_pairling",
+            "launch_visibility": "visible_terminal",
+            "attach_command": None,
+        })
 
     def _session_context_for_workflow(self, raw_session: str) -> dict | None:
         provider, native_id = _parse_agent_session_ref(raw_session)
@@ -15244,7 +15422,7 @@ Worker instructions:
             self.wfile.write(body)
             return
 
-        if os.environ.get("PAIRLING_RESUME_BACKEND", "broker").lower() != "terminal_app":
+        if os.environ.get("PAIRLING_RESUME_BACKEND", "terminal_app").lower() == "broker":
             self._handle_resume_session_broker(provider=provider, project=project, native_id=native_id, prompt=prompt)
             return
 
@@ -15299,6 +15477,8 @@ Worker instructions:
                     "resume_target": native_id,
                     "terminal_log": str(capture_log_path),
                     "capture_backend": "script",
+                    "terminal_source": "terminal_app_contents",
+                    "launch_visibility": "visible_terminal",
                     "capture_id": capture_id,
                 },
             )
@@ -15330,7 +15510,7 @@ Worker instructions:
             self.end_headers()
             self.wfile.write(body)
             return
-        body = json.dumps({
+        self._send_json({
             "ok": True,
             "provider": "codex",
             "native_id": native_id,
@@ -15341,13 +15521,9 @@ Worker instructions:
             "terminal_log": str(capture_log_path),
             "capture_backend": "script",
             "terminal_source": "terminal_app_contents",
+            "launch_visibility": "visible_terminal",
             "attach_command": None,
-        }).encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(body)))
-        self.end_headers()
-        self.wfile.write(body)
+        })
 
     def _send_text_to_codex_registry(self, native_id: str, text: str, receipt_context: dict | None = None) -> None:
         # Precondition: callers pass text through _sanitize_terminal_text_input.
@@ -18331,7 +18507,7 @@ Worker instructions:
     def _pairdrop_store(self):
         if PairDropStore is None:
             raise RuntimeError("PairDrop store unavailable")
-        return PairDropStore(HOME / "Pairling" / "PairDrop" / "v1")
+        return PairDropStore(HOME / "PairDrop")
 
     def _pairdrop_source(self) -> tuple[str, str]:
         auth = getattr(self, "pairling_auth", None)