spexcode 0.5.2 → 0.5.3

package/spec-cli/src/sessions.ts

@@ -1,17 +1,21 @@
-import { execFile } from 'node:child_process'
+import { execFile, spawn } from 'node:child_process'
 import { promisify } from 'node:util'
 import { randomUUID } from 'node:crypto'
-import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync } from 'node:fs'
+import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, openSync, closeSync, unlinkSync, writeSync } from 'node:fs'
 import { join, dirname, relative, isAbsolute, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { seedWorktreeHostState } from './worktree-sources.js'
 import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, type ReviewDiffFile } from './git.js'
 import { loadConfig, loadSpecs, type ConfigPreset, type SpecLite } from './specs.js'
-import { defaultHarness, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rvSock, rendezvousListening, type Harness, type DispatchResult, type PaneProbe, type ProcTable } from './harness.js'
+import { adapterLoadedReferenceState, defaultHarness, sessionIdentityEnvVars, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rendezvousListening, stampRvSock, type Harness, type HarnessLaunchReadinessFence, type DispatchResult, type PaneProbe, type ProcTable } from './harness.js'
 import { materialize } from './materialize.js'
-import { mainBranch, gitCommonDir, readConfig, runtimeRoot, treeSlotDir, sessionStoreDir, sessionRecordPath, sessionArtifactPath, listSessionIds, readAliasedRawRecord, envSessionId, type RawRecord } from './layout.js'
+import { mainBranch, gitCommonDir, readConfig, runtimeRoot, treeSlotDir, sessionStoreDir, sessionRecordPath, sessionArtifactPath, listSessionIds, rawLaunchReadinessOriginal, readAliasedRawRecord, readRecordEntry, readAliasedRecordEntry, readPublicRecordEntry, envSessionId, isSessionLifecycle, isSessionProposal, type PublicRecordEntry, type RawRecord, type SessionLifecycle, type SessionProposal } from './layout.js'
 import { recordSent, recordStatus, lastHumanSendVia } from './session-timeline.js'
 import { stripRefSigil } from './mentions.js'
+import { shQuote } from './sh.js'
+import { assertSessionStopSafe, ResourceConflict } from './host-resources.js'
+import { processStartToken } from './process-identity.js'
+import { maintenanceBrokerDescriptors, runSessionOperation, runSessionOperationSync, SessionMaintenanceError, type Authorization, type MaintenanceTicket } from './session-maintenance.js'
 
 // @@@ sessions - the WORKTREE is the durable unit; tmux is a disposable runtime handle. The per-session
 // SOURCE OF TRUTH is an untracked record (`session.json`) in a per-user GLOBAL store keyed by the harness
@@ -72,26 +76,31 @@ function maxActive(): number {
   return Math.max(1, Math.floor(v ?? DEFAULT_MAX_ACTIVE))
 }
 
-// the rendezvous control socket path + its prompt-delivery/liveness logic now live in the [[harness-adapter]]
-// (claude OWNS the rendezvous; codex does not), so product code asks the adapter rather than hard-wiring it.
-// rvSock is imported only for the two NON-delivery uses that remain product-level: building the launch env var
-// (rvEnv, below) and the best-effort socket sweep on close.
-// env prefix put in front of the spawned agent so it creates this session's rendezvous control socket — and
-// so its hooks + materialize write to the SAME store the backend uses. SPEXCODE_HOME/CODEX_HOME are
+// The adapter owns any transport bootstrap env (rendezvous daemon + socket); product launch only composes it
+// with the governed session id and home vars. This env prefix also ensures hooks + materialize write to the
+// SAME store the backend uses. SPEXCODE_HOME/CODEX_HOME are
 // propagated when set, because the session inherits the tmux SERVER's env (not the backend's), so without this
 // an overridden home would silently leak the session's hook-state + codex-trust to the default ~/.spexcode /
 // ~/.codex. Deterministic: the session's store = the backend's store, never the ambient env's.
 const rvEnv = (id: string, harness = HARNESS) => {
-  // SPEXCODE_SESSION_ID is the governed record id. Claude's harness id is the same value, so hooks and CLI
-  // calls can use it directly. Codex cannot trust this env inside the long-lived shared app-server; codex hooks
-  // start from the payload thread id and alias through harness_session_id, while the short-lived codex-launch
-  // process uses this env only to store the freshly started thread id on the governed record. The CLAUDE_BG
-  // rendezvous control socket is the reclaude prompt-delivery path and exists ONLY for harnesses that own one
-  // (claude/pi/opencode) — codex has no such daemon, so it is omitted there.
-  const parts = [`SPEXCODE_SESSION_ID=${id}`]
-  if (harness.ownsRendezvous) parts.push(`CLAUDE_BG_BACKEND=daemon`, `CLAUDE_BG_RENDEZVOUS_SOCK=${rvSock(id)}`)
-  for (const v of ['SPEXCODE_HOME', 'CODEX_HOME']) { const val = process.env[v]; if (val) parts.push(`${v}=${val}`) }
-  return parts.join(' ')
+  // SPEXCODE_SESSION_ID is the governed record id, and it is the SESSION'S OWN — so the launch STRIPS every
+  // session-identity variable it may have inherited (the pane inherits the tmux SERVER's env, which may carry
+  // a foreign session's ids from whoever started it) before setting this one. Identity is established HERE,
+  // once, at the boundary; nothing downstream re-verifies it, because after this a session-identity variable
+  // exists in a process only if that process belongs to that session — either set right here, or stamped by
+  // the harness itself for its own acting conversation ([[harness-adapter]]). The same strip runs on the one
+  // other process we own that is NOT a session's own — codex's shared app-server, whose leaked inherited id
+  // was github#76.
+  const scrub = sessionIdentityEnvVars().map((v) => `-u ${v}`)
+  const homeVars = ['SPEXCODE_HOME', 'CODEX_HOME'].flatMap((v) => {
+    const value = process.env[v]
+    return value ? [`${v}=${value}`] : []
+  })
+  return [...scrub,
+    `SPEXCODE_SESSION_ID=${id}`,
+    `SPEXCODE_SESSION_IDENTITY_VARS=${shQuote(sessionIdentityEnvVars().join(','))}`,
+    `SPEXCODE_PROJECT_ROOT=${shQuote(mainRoot())}`,
+    ...harness.launchEnv(id), ...homeVars].join(' ')
 }
 
 // the prompt-dispatch outcome type + its claude/codex delivery implementations live in the [[harness-adapter]]
@@ -99,9 +108,12 @@ const rvEnv = (id: string, harness = HARNESS) => {
 // for the existing importers (client.ts) that read it off the sessions module.
 export type { DispatchResult }
 
-export type Lifecycle = 'active' | 'idle' | 'awaiting' | 'parked' | 'error' | 'asking' | 'queued'
-export type Proposal = 'merge' | 'nothing' | 'close'
-export type DisplayStatus = 'working' | 'idle' | 'offline' | 'starting' | 'review' | 'done' | 'close-pending' | 'parked' | 'error' | 'asking' | 'queued' | 'unknown'
+export type Lifecycle = SessionLifecycle
+export type Proposal = SessionProposal
+// `corrupt` and `retired` are the two RECORD-INTEGRITY readings — neither a lifecycle the agent authored nor a
+// liveness the runtime probed, but the honest answer when the record itself can no longer carry either: its
+// bytes don't parse, or the worktree it names is gone. They exist so such a row can never silently vanish.
+export type DisplayStatus = 'working' | 'idle' | 'offline' | 'starting' | 'review' | 'done' | 'close-pending' | 'parked' | 'error' | 'asking' | 'queued' | 'unknown' | 'corrupt' | 'retired'
 // liveness — the orthogonal axis to Lifecycle: whether the agent process is actually up, derived (never
 // authored) for EVERY session regardless of its lifecycle. See [[state]]: lifecycle and liveness never
 // override each other; the UI keys the terminal-mount / relaunch panel on this, the badge on lifecycle.
@@ -117,9 +129,11 @@ export type Session = {
   raw: { name: string | null; title: string | null }   // the bare parts, for explicit consumers only (rename prefill)
   parent: string | null   // the SPAWNING session's id ([[session-nesting]]) — set once at creation when `spex session new` ran inside another session, else null; the frontend folds a child under it at read time
   harness: string   // which harness (claude|codex) runs this session — carried so liveness/occupancy route through its adapter
-  capabilities: { headless: boolean; messageStream: boolean }   // stable adapter projection; console surfaces consume data, never harness ids
+  capabilities: { headless: boolean }   // stable adapter projection; console surfaces consume data, never harness ids
   launcher: string | null   // the launcher profile this session launched under ([[launcher-select]]); null only for old records predating launchers
   lifecycle: Lifecycle; proposal: Proposal | null; merges: number; status: DisplayStatus; liveness: Liveness; note: string | null
+  archived: boolean   // cold storage ([[archive]]) — successful records are offline; default views exclude them
+  archiveHazard?: string | null // explicit legacy/invariant violation; never hidden as a clean archive
   prompt: string | null; promptPreview: string | null; created: number; activity: string | null
   sortKey: number | null   // manual drag-reorder override ([[session-reorder]]); null = sort by `created`
 }
@@ -228,12 +242,17 @@ export type SessRec = {
   parent: string | null   // the spawning session's id ([[session-nesting]]); null for a top-level launch
   status: Lifecycle; proposal: Proposal | null; merges: number; note: string | null
   sortKey: number | null; createdAt: number; harness: string; harnessSessionId: string | null
+  stopped: boolean       // explicit human stop; liveness metadata, never an agent-authored lifecycle value
+  archived: boolean      // shelved by the human ([[archive]]) — only clean after coldProof is written
+  coldProof?: string | null // durable exact leaf + adapter unload proof; missing on legacy archives => visible hazard
+  adapterRecovery?: string | null // explicit adapter recovery state after an uncertain partial cold mutation
   launcher: string | null   // the launcher profile this session launches under ([[launcher-select]]); null only for old records predating launchers
   launchCmd: string | null  // the RESOLVED base launcher command pinned at creation ([[launcher-select]] resume-launcher-pin); null → old record → fall back to the launcher name / ambient
   launchOwner: string | null // stable public-backend authority while queued; null for active/legacy records
+  launchReadinessPending?: LaunchReadinessPending | null // internal resume candidate; every public reader projects `original` until one final publish
 }
-const LIFECYCLES = new Set<Lifecycle>(['active', 'idle', 'awaiting', 'parked', 'error', 'asking', 'queued'])
-const PROPOSALS = new Set<Proposal>(['merge', 'nothing', 'close'])
+type LaunchReadinessOriginal = Pick<SessRec, 'status' | 'proposal' | 'note' | 'stopped' | 'archived' | 'coldProof' | 'adapterRecovery'>
+type LaunchReadinessPending = { version: 1; startedAt: number; original: LaunchReadinessOriginal }
 export const OWNED_QUEUE_RAW_STATUS = 'launch-queued'
 
 // @@@ stable launch authority - the supervisor injects its PUBLIC proxy URL into every replaceable child.
@@ -264,35 +283,224 @@ export function canDrainQueued(rec: Pick<SessRec, 'status' | 'launchOwner'>, aut
 // readAliasedRawRecord (the seam that owns the path + the codex-thread-id alias), then validates the loose
 // on-disk fields into the typed shape — so a codex hook resolving by its thread id reaches the real record.
 function readRecord(id: string): SessRec | null {
-  const raw = readAliasedRawRecord(id)
-  if (!raw) return null
-  return fromRaw(raw)
+  const entry = readAliasedRecordEntry(id)
+  if (entry.kind === 'absent') return null
+  if (entry.kind === 'corrupt') throw new SessionRecordUnusable('corrupt', id, corruptReason(entry))
+  try { return fromRaw(entry.raw) }
+  catch (error) {
+    throw new SessionRecordUnusable('corrupt', id,
+      `session record is unreadable: ${sessionRecordPath(id)} — ${error instanceof Error ? error.message : String(error)}. The file is kept as-is; nothing will rewrite it.`)
+  }
+}
+// @@@ SessionRecordUnusable - the record exists but cannot carry state, for one of two reasons, and BOTH must
+// stop a writer rather than let it invent one. `corrupt`: the bytes don't parse, so writing would DESTROY the
+// evidence of what broke and resurrect the session as a plausible-looking empty shell (the reported failure —
+// a damaged record came back as a valid `idle` record and even had a launch script regenerated for it).
+// `retired`: the work merged and the worktree the record names is gone, so there is nothing left to be active
+// IN. Readers that enumerate (the board) catch this and render the row; writers let it out, loud.
+export class SessionRecordUnusable extends Error {
+  constructor(readonly code: 'corrupt' | 'retired', readonly session: string, message: string) {
+    super(message)
+    this.name = 'SessionRecordUnusable'
+  }
+}
+const corruptReason = (e: { path: string; error: string }): string =>
+  `session record is unreadable: ${e.path} — ${e.error}. The file is kept as-is; nothing will rewrite it. A close attempt quarantines the bytes and reports the preserved runtime/worktree/branch residue, but cannot signal or delete without an exact owner.`
+// a record whose worktree is gone names work that no longer exists on disk. That is the manual-retirement end
+// state (merged, worktree and branch removed, record left behind), and it is terminal: no lifecycle writer may
+// put such a session back to work, and no launch may be assembled for a directory that isn't there.
+function retirementReason(rec: SessRec): string | null {
+  if (!rec.worktreePath || existsSync(rec.worktreePath)) return null
+  return `session ${rec.session.slice(0, 8)} is retired: its worktree ${rec.worktreePath} no longer exists, so it cannot work, be marked active/idle, or be relaunched. Close it (\`spex session close <id>\`) to drop the record.`
+}
+// the read every LIFECYCLE writer uses: it additionally refuses a retired record. Metadata verbs (rename,
+// sort, archive) and `close` deliberately keep using readRecord — filing and removal stay available on a row
+// whose work is gone.
+function readLiveRecord(id: string): SessRec | null {
+  const rec = readRecord(id)
+  if (!rec) return null
+  const retired = retirementReason(rec)
+  if (retired) throw new SessionRecordUnusable('retired', rec.session, retired)
+  return rec
+}
+
+// Cross-process lifecycle serialization. Hooks and operator commands are separate CLI processes, so the
+// in-memory transition tail is only an optimization. This lock covers each read/modify/write or destructive
+// transition across archive/resume/stop/close and hook writers. It lives outside the record directory so close
+// may remove the record while its lock is held. A dead writer's lock is reclaimed; a live writer is waited for
+// with a bounded wall and then fails loudly rather than allowing a stale write to win.
+const recordLockRoot = () => join(runtimeRoot(), '.session-locks')
+const recordLockPath = (id: string) => join(recordLockRoot(), `${id}.lock`)
+const syncPause = (ms: number) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+function acquireRecordLockSync(id: string, timeoutMs = 30_000): () => void {
+  mkdirSync(recordLockRoot(), { recursive: true })
+  const path = recordLockPath(id), deadline = Date.now() + timeoutMs
+  for (;;) {
+    try {
+      const fd = openSync(path, 'wx')
+      writeSync(fd, String(process.pid))
+      closeSync(fd)
+      return () => { try { unlinkSync(path) } catch { /* another recovery already removed it */ } }
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e
+      let owner = 0
+      try { owner = Number(readFileSync(path, 'utf8').trim()) || 0 } catch { /* race with creator/releaser */ }
+      if (owner && owner !== process.pid) {
+        try { process.kill(owner, 0) } catch { try { unlinkSync(path) } catch { /* race */ }; continue }
+      }
+      if (Date.now() >= deadline) throw new ResourceConflict(`session ${id}: lifecycle transition lock timed out; refusing a stale write`)
+      syncPause(10)
+    }
+  }
+}
+async function acquireRecordLock(id: string, timeoutMs = 30_000): Promise<() => void> {
+  mkdirSync(recordLockRoot(), { recursive: true })
+  const path = recordLockPath(id), deadline = Date.now() + timeoutMs
+  for (;;) {
+    try {
+      const fd = openSync(path, 'wx')
+      writeSync(fd, String(process.pid))
+      closeSync(fd)
+      return () => { try { unlinkSync(path) } catch { /* another recovery already removed it */ } }
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== 'EEXIST') throw e
+      let owner = 0
+      try { owner = Number(readFileSync(path, 'utf8').trim()) || 0 } catch { /* race with creator/releaser */ }
+      if (owner && owner !== process.pid) {
+        try { process.kill(owner, 0) } catch { try { unlinkSync(path) } catch { /* race */ }; continue }
+      }
+      if (Date.now() >= deadline) throw new ResourceConflict(`session ${id}: lifecycle transition lock timed out; refusing a stale write`)
+      await new Promise((resolve) => setTimeout(resolve, 10))
+    }
+  }
+}
+async function withRecordLock<T>(id: string, body: () => Promise<T>): Promise<T> {
+  const release = await acquireRecordLock(id)
+  try { return await body() } finally { release() }
+}
+function withRecordLockSync<T>(id: string, body: () => T): T {
+  const release = acquireRecordLockSync(id)
+  try { return body() } finally { release() }
+}
+function tryRecordLockSync(id: string): (() => void) | null {
+  mkdirSync(recordLockRoot(), { recursive: true })
+  const path = recordLockPath(id)
+  try {
+    const fd = openSync(path, 'wx')
+    writeSync(fd, String(process.pid))
+    closeSync(fd)
+    return () => { try { unlinkSync(path) } catch { /* another recovery already removed it */ } }
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code === 'EEXIST') return null
+    throw e
+  }
+}
+// Synchronous terminal input is another product turn-entry path. The PTY bridge uses this narrow seam to
+// enqueue input while holding the same durable record lock as archive, so an archive preflight cannot pass idle
+// and then race a just-queued TUI turn.
+export function withSessionInputLock<T>(id: string, body: () => T): T | null {
+  // PTY input is synchronous. A single non-blocking open is the only safe barrier: EEXIST rejects this input
+  // regardless of owner PID, so a same-process async archive can never be frozen behind Atomics.wait.
+  const release = tryRecordLockSync(id)
+  if (!release) return null
+  try { return body() } finally { release() }
+}
+
+const COLD_PROOF_VERSION = 'cold-v1'
+function coldProofFor(rec: Pick<SessRec, 'session' | 'harness' | 'harnessSessionId'>): string {
+  const adapter = harnessById(rec.harness || defaultHarness.id).id
+  const exact = rec.harnessSessionId ? `thread:${rec.harnessSessionId}` : 'no-resident-ref'
+  return `${COLD_PROOF_VERSION}|${adapter}|${rec.session}|${exact}`
+}
+function hasValidColdProof(rec: SessRec): boolean {
+  return !!rec.coldProof && rec.coldProof === coldProofFor(rec)
 }
 // the loose on-disk fields validated into the typed shape. Exported so the old-record defaults (harness →
 // claude, absent pin → null) are unit-auditable without a store on disk.
 export function fromRaw(raw: RawRecord & { launch_owner?: string }): SessRec {
   const ownedQueue = raw.status === OWNED_QUEUE_RAW_STATUS
-  const status = ownedQueue ? 'queued' : LIFECYCLES.has(raw.status as Lifecycle) ? raw.status as Lifecycle : 'active'
+  const status = ownedQueue ? 'queued' : isSessionLifecycle(raw.status) ? raw.status : 'active'
   const launchOwner = ownedQueue ? raw.launch_owner?.trim() : null
   if (ownedQueue && !launchOwner) throw new Error(`owned queue record '${raw.session_id}' has no launch_owner`)
-  const proposal = raw.proposal && PROPOSALS.has(raw.proposal as Proposal) ? raw.proposal as Proposal : null
+  const proposal = isSessionProposal(raw.proposal) ? raw.proposal : null
   const sk = raw.sortkey
   const sortKey = typeof sk === 'number' && Number.isFinite(sk) ? sk : null
+  const pendingRaw = rawLaunchReadinessOriginal(raw)
+  const pendingStatus = pendingRaw && isSessionLifecycle(pendingRaw.status) ? pendingRaw.status : null
+  if (pendingRaw && !pendingStatus) throw new Error(`session '${raw.session_id}' launch readiness original has invalid lifecycle '${pendingRaw.status}'`)
+  const pendingProposal = pendingRaw && isSessionProposal(pendingRaw.proposal) ? pendingRaw.proposal : null
+  if (pendingRaw?.proposal && !pendingProposal) throw new Error(`session '${raw.session_id}' launch readiness original has invalid proposal '${pendingRaw.proposal}'`)
   return {
     session: raw.session_id, governed: !!raw.governed, worktreePath: raw.worktree_path || '', branch: raw.branch || null,
     node: raw.node || null, title: raw.title || null, name: raw.name || null, parent: raw.parent || null,
     status, proposal, merges: Number(raw.merges) || 0, note: raw.note || null, sortKey, createdAt: Number(raw.createdAt) || 0,
     harness: raw.harness || 'claude',   // records written before the harness field default to claude
     harnessSessionId: raw.harness_session_id || null,
+    stopped: !!raw.stopped,             // records written before explicit stop tracking were not stopped
+    archived: !!raw.archived,           // records written before archive → absent → not shelved
+    coldProof: raw.cold_proof || null,  // legacy archived rows have no proof and remain visible until re-archived
+    adapterRecovery: raw.adapter_recovery || null,
     launcher: raw.launcher || null,     // records written before launchers → null → old-record fallback
     launchCmd: raw.launch_cmd || null,  // records written before the pin → null → fall back to launcher name / ambient
     launchOwner: launchOwner || null,
+    launchReadinessPending: pendingRaw ? {
+      version: 1,
+      startedAt: (raw.launch_readiness_pending as { startedAt: number }).startedAt,
+      original: {
+        status: pendingStatus!, proposal: pendingProposal, note: pendingRaw.note || null,
+        stopped: pendingRaw.stopped, archived: pendingRaw.archived,
+        coldProof: pendingRaw.cold_proof || null, adapterRecovery: pendingRaw.adapter_recovery || null,
+      },
+    } : null,
   }
 }
+
+function publicRecord(rec: SessRec): SessRec {
+  const original = rec.launchReadinessPending?.original
+  return original ? { ...rec, ...original } : rec
+}
+
+function launchReadinessPending(original: SessRec): LaunchReadinessPending {
+  return {
+    version: 1,
+    startedAt: Date.now(),
+    original: {
+      status: original.status,
+      proposal: original.proposal,
+      note: original.note,
+      stopped: original.stopped,
+      archived: original.archived,
+      coldProof: original.coldProof ?? null,
+      adapterRecovery: original.adapterRecovery ?? null,
+    },
+  }
+}
+
+function restoreLaunchReadinessOriginal(rec: SessRec): SessRec {
+  const original = rec.launchReadinessPending?.original
+  return original ? { ...rec, ...original, launchReadinessPending: null } : rec
+}
+// @@@ the ONE record writer - every field of session.json is produced HERE, by serializing the typed record,
+// and lands by atomic replace (temp file in the same dir, then rename). Nothing else — no hook, no shell, no
+// route — may compose or edit the file's text: a note is arbitrary human/agent prose, so any writer that
+// substitutes it into existing JSON eventually meets a quote, a backslash, or a newline and leaves a record
+// nothing can parse (the reported corruption came from exactly that: a hot-path hook editing the value with
+// sed). The shell hooks READ this file cheaply and delegate every WRITE back through the CLI to this function.
+// The rename is what makes a reader between two writes see one whole record instead of a truncated one.
+//
 // @@@ session.json format - written one-field-per-line (JSON.stringify(_, null, 2)) with EVERY key ALWAYS
-// present (nulls rendered as "" / the empty value, never an absent key). That stable shape is the contract the
-// pure-shell hot-path hook (mark-active) relies on: it value-replaces `"status"`/`"proposal"`/`"note"` with a
-// single sed and never needs jq on the user's box. So do NOT switch to conditional keys or a compact dump.
+// present (nulls rendered as "" / the empty value, never an absent key). The stable shape is what lets the
+// pure-shell hooks answer "is this record already active, with nothing stale to clear?" with three exact-line
+// greps and no jq — a READ fast path, never an edit. So do NOT switch to conditional keys or a compact dump.
+//
+// @@@ the record self-cleans - the object below is a CLOSED key set rebuilt from the typed record on every
+// write, never a merge over what was read. So a field retired from the code is ALSO retired from disk the
+// next time anything touches that record: no migration verb, no GC pass, no accreting graveyard of dead keys.
+// A new field earns its place by being declared HERE and in `fromRaw` — that pairing is what keeps the file a
+// projection of the current type rather than a log of everything it has ever been, and it is also the reason
+// a field MISSING from this object is silently dropped: `stopped`, `archived`, `cold_proof`, and
+// `adapter_recovery` are distinct lifecycle/resource projection fields, so each must be listed and cleared by
+// its own transition rather than one being inferred from another.
 function writeRecord(rec: SessRec): void {
   let previous: SessRec | null = null
   try { previous = readRecord(rec.session) } catch { /* a new or damaged record has no prior transition */ }
@@ -316,38 +524,44 @@ function writeRecord(rec: SessRec): void {
     createdAt: rec.createdAt,
     harness: rec.harness || 'claude',
     harness_session_id: rec.harnessSessionId ?? '',
+    stopped: rec.stopped,
+    archived: rec.archived,
+    cold_proof: rec.coldProof ?? '',
+    adapter_recovery: rec.adapterRecovery ?? '',
     launcher: rec.launcher ?? '',
     launch_cmd: rec.launchCmd ?? '',
     launch_owner: rec.status === 'queued' ? rec.launchOwner ?? '' : '',
+    launch_readiness_pending: rec.launchReadinessPending ? {
+      version: 1,
+      startedAt: rec.launchReadinessPending.startedAt,
+      original: {
+        status: rec.launchReadinessPending.original.status,
+        proposal: rec.launchReadinessPending.original.proposal ?? '',
+        note: rec.launchReadinessPending.original.note ?? '',
+        stopped: rec.launchReadinessPending.original.stopped,
+        archived: rec.launchReadinessPending.original.archived,
+        cold_proof: rec.launchReadinessPending.original.coldProof ?? '',
+        adapter_recovery: rec.launchReadinessPending.original.adapterRecovery ?? '',
+      },
+    } : '',
   }
-  mkdirSync(sessionStoreDir(rec.session), { recursive: true })
-  writeFileSync(sessionRecordPath(rec.session), JSON.stringify(obj, null, 2) + '\n')
-  // session.json is only the CURRENT projection. Persist each moved lifecycle value before this writer
-  // returns, so a later write cannot erase a declaration note between observer samples. New-record genesis
-  // stays with superviseTimeline; metadata-only writes do not manufacture status events.
-  if (rec.governed && previous && (previous.status !== rec.status
-    || previous.proposal !== rec.proposal || previous.note !== rec.note)) {
-    recordStatus(rec.session, rec.status, rec.proposal, rec.note)
-  }
-}
-
-// @@@ fail-loud enumeration - the worktree set is the board's EXISTENCE truth, so a failed enumeration must
-// NEVER masquerade as an empty repo. `gitA` swallows a git error to '' (→ zero rows), which a caller would
-// read as "every worktree was removed" — exactly the false mass-`closed` watchSessions would emit once the
-// flicker debounce is gone. `git worktree list` ALWAYS lists at least the main worktree, so an ok run with
-// zero `worktree ` lines is itself a failure. Both cases THROW; the caller (listSessions) propagates and
-// watchSessions' poll `catch` simply skips the tick with `prev` intact — no fabricated removals.
-async function listWorktrees(): Promise<{ path: string; branch: string | null }[]> {
-  const r = await gitTry(['-C', mainRoot(), 'worktree', 'list', '--porcelain'])
-  if (!r.ok) throw new Error(`git worktree list failed: ${r.stderr.trim() || 'unknown error'}`)
-  const list: { path: string; branch: string | null }[] = []
-  let cur: { path: string; branch: string | null } | null = null
-  for (const line of r.stdout.split('\n')) {
-    if (line.startsWith('worktree ')) { cur = { path: line.slice(9), branch: null }; list.push(cur) }
-    else if (line.startsWith('branch ') && cur) cur.branch = line.slice(7).replace('refs/heads/', '')
+  const dir = sessionStoreDir(rec.session)
+  mkdirSync(dir, { recursive: true })
+  const path = sessionRecordPath(rec.session)
+  const tmp = join(dir, `.session.json.${process.pid}.tmp`)
+  writeFileSync(tmp, JSON.stringify(obj, null, 2) + '\n')
+  renameSync(tmp, path)   // atomic within the dir: a concurrent reader sees the old record or the new one
+  // session.json normally is the current public projection. A launch-readiness candidate is the sole internal
+  // exception: its frozen original remains public until validation clears the fence. Persist each PUBLIC moved
+  // lifecycle value before this writer returns, so a later write cannot erase a declaration note between
+  // observer samples. New-record genesis stays with superviseTimeline; metadata-only writes do not manufacture
+  // status events.
+  const previousPublic = previous ? publicRecord(previous) : null
+  const nextPublic = publicRecord(rec)
+  if (rec.governed && previousPublic && (previousPublic.status !== nextPublic.status
+    || previousPublic.proposal !== nextPublic.proposal || previousPublic.note !== nextPublic.note)) {
+    recordStatus(rec.session, nextPublic.status, nextPublic.proposal, nextPublic.note)
   }
-  if (!list.length) throw new Error('git worktree list returned no worktrees (enumeration failed; the main worktree is always present)')
-  return list
 }
 
 // @@@ reconcile - the shown status. awaiting → the proposal's label (review/done/close-pending),
@@ -456,7 +670,12 @@ async function liveSnapshot(): Promise<LiveSnap> {
   for (const [id, p] of parseLivePanes(out)) {
     windows.set(id, { panePid: p.panePid, pidAlive: agentAlive(id) })
     if (p.title) titles.set(id, p.title)
-    if (windows.get(id)!.pidAlive === undefined) { const rec = readRecord(id); if (rec) legacy.push({ harness: rec.harness, hasPid: false }) }
+    if (windows.get(id)!.pidAlive === undefined) {
+      // A corrupt row has no trustworthy harness to scan and renders liveness=unknown on its own. Letting this
+      // optional legacy enrichment throw would turn one diagnosable row into a 409 for the entire board.
+      try { const rec = readRecord(id); if (rec) legacy.push({ harness: rec.harness, hasPid: false }) }
+      catch (e) { if (!(e instanceof SessionRecordUnusable)) throw e }
+    }
   }
   // the whole-box ps table is gathered ONCE, and ONLY for the legacy pid-less-codex fallback (paneTreeRunsCodex).
   if (needsCodexProcScan(legacy)) {
@@ -574,7 +793,7 @@ const LAUNCH_FAST_FAIL_S = 12 // launchScript retries the agent command when it
 // sock lingers. A just-launched agent whose online-signal hasn't appeared yet reads the transient 'starting'
 // for the grace window; only past it (still not online) is it genuinely 'offline'.
 export function liveness(rec: SessRec, snap: LiveSnap): Liveness {
-  if (!rec.session) return 'offline'
+  if (!rec.session || rec.stopped || rec.archived) return 'offline'
   // Ask the resolved ADAPTER ([[harness-adapter]]): claude/pi/opencode prove their rendezvous listener;
   // codex proves its launch-registered pid (with the legacy descendant-tree fallback). The 'starting' grace
   // stays here: a just-launched agent whose online signal has not appeared yet reads 'starting', only past it
@@ -587,7 +806,15 @@ export function liveness(rec: SessRec, snap: LiveSnap): Liveness {
   // act on (issue #40 — a wedged-but-alive worker must not read as an actionable corpse).
   if (snap.unproven.has(rec.session)) return 'unknown'
   const at = launchedAt.get(rec.session)
-  return at && Date.now() - at < BOOT_GRACE_MS ? 'starting' : 'offline'
+  if (at && Date.now() - at < BOOT_GRACE_MS) return 'starting'
+  // A dead TRANSPORT is not a dead AGENT. The socket path is keyed by session id alone, so a foreign teardown
+  // (or a stray rm) can unlink it out from under its own live listener: the agent keeps working, unreachable,
+  // and every path-connect ENOENTs — which the adapter axis above reports as proven death. The registered
+  // agent.pid is a SECOND, independent witness, and while it still answers, death is UNPROVEN: `unknown`, not
+  // the `offline` that disarms the relaunch guard and invites a human to kill a working agent. Same rule as
+  // the probe-failure branch (issue #40), one layer down: only a corpse both witnesses agree on is actionable.
+  if (agentAlive(rec.session) === true) return 'unknown'
+  return 'offline'
 }
 
 // reconcile the compact DisplayStatus — a DERIVED label composing lifecycle + liveness for one-glyph
@@ -597,6 +824,10 @@ export function liveness(rec: SessRec, snap: LiveSnap): Liveness {
 // idle → active on the next real work, self-correcting). The orthogonal liveness field is what the UI keys
 // terminal-mount and the relaunch panel on; this label is for badges and `spex session ls`.
 function reconcile(rec: SessRec, snap: LiveSnap): DisplayStatus {
+  // record integrity outranks both axes: a session whose worktree is gone has no work to be in any state
+  // about. It reads `retired` — a terminal, human-closable row, never a lifecycle a hook can write back over.
+  if (retirementReason(rec)) return 'retired'
+  if (rec.archived) return 'offline'
   if (rec.status === 'awaiting') return PROPOSAL_STATUS[rec.proposal || 'nothing']
   if (rec.status !== 'active' && rec.status !== 'idle') return rec.status  // parked | error | asking | queued (no tmux yet)
   const lv = liveness(rec, snap)
@@ -613,6 +844,21 @@ async function findWorktree(id: string): Promise<{ path: string; branch: string
   return { path: rec.worktreePath, branch: rec.branch, rec }
 }
 
+// @@@ corruptSession - the row for a record we cannot parse. Every display field the surfaces read is filled
+// from the ONE thing we still know (the id) plus the diagnosis, so the row renders everywhere without any
+// surface having to special-case a half-record. Liveness is `unknown`, not `offline`: we never probed, so we
+// have not proven anything about the agent — the same honesty rule a failed probe follows.
+function corruptSession(id: string, entry: { path: string; error: string }): Session {
+  const label = `${id.slice(0, 8)} (unreadable record)`
+  return {
+    id, node: null, branch: null, path: '', label, headline: label, raw: { name: null, title: null },
+    parent: null, harness: defaultHarness.id, capabilities: { headless: false }, launcher: null,
+    lifecycle: 'active', proposal: null, merges: 0, status: 'corrupt', liveness: 'unknown',
+    note: corruptReason(entry), archived: false, prompt: null, promptPreview: null, created: 0,
+    activity: null, sortKey: null, archiveHazard: null,
+  }
+}
+
 export function toSession(rec: SessRec, status: DisplayStatus, lv: Liveness, activity: string | null = null): Session {
   const prompt = readPromptFile(rec.session)   // the originating ask, captured at launch (store artifact; null for old sessions)
   // activity is the LIVE pane title; it only means anything while the worker is genuinely up — a
@@ -622,7 +868,7 @@ export function toSession(rec: SessRec, status: DisplayStatus, lv: Liveness, act
   const pp = prompt ? promptPreview(prompt) : null
   const parts = { id: rec.session, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch, activity: act, promptPreview: pp }
   const harness = harnessById(rec.harness || defaultHarness.id)
-  return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), headline: deriveHeadline(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless, messageStream: harness.messageStream }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey }
+  return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), headline: deriveHeadline(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, archived: rec.archived, archiveHazard: null, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey }
 }
 
 // @@@ renameSession - set (or clear) a session's human display NAME: the user-chosen override that wins
@@ -632,10 +878,12 @@ export function toSession(rec: SessRec, status: DisplayStatus, lv: Liveness, act
 // any state (queued/live/offline) since it edits the on-disk record, not the live tmux. Unknown id → false
 // (the route answers 404). The frontend's right-click rename is the sole caller today.
 export async function renameSession(id: string, name: string): Promise<boolean> {
-  const wt = await findWorktree(id)
-  if (!wt) return false
-  writeRecord({ ...wt.rec, name: name.trim() || null })
-  return true
+  return runSessionOperation({ op: 'rename', sessionId: id }, () => withRecordLock(id, async () => {
+    const wt = await findWorktree(id)
+    if (!wt) return false
+    writeRecord({ ...wt.rec, name: name.trim() || null })
+    return true
+  }))
 }
 
 // @@@ setSessionSort - set (or clear) a session's drag-reorder pseudo-time ([[session-reorder]]), parallel
@@ -643,15 +891,20 @@ export async function renameSession(id: string, name: string): Promise<boolean>
 // shows on every surface (all sort by `sortKey ?? created`). A null key CLEARS it, dropping the row back to
 // its `created` slot. Works in any state since it edits the on-disk record. Unknown id → false (route 404s).
 export async function setSessionSort(id: string, key: number | null): Promise<boolean> {
-  const wt = await findWorktree(id)
-  if (!wt) return false
-  writeRecord({ ...wt.rec, sortKey: key != null && Number.isFinite(key) ? key : null })
-  return true
+  return runSessionOperation({ op: 'sort', sessionId: id }, () => withRecordLock(id, async () => {
+    const wt = await findWorktree(id)
+    if (!wt) return false
+    writeRecord({ ...wt.rec, sortKey: key != null && Number.isFinite(key) ? key : null })
+    return true
+  }))
 }
 
-// the session's full ORIGINATING prompt (what it was asked to do), or null if none was recorded.
+// the session's full ORIGINATING prompt (what it was asked to do), or null if none was recorded. A record we
+// cannot read simply has no prompt to report — a READ accessor must not turn an unreadable record into an
+// error for the surface asking about it; the row itself already carries the diagnosis.
 export async function sessionPrompt(id: string): Promise<string | null> {
-  return readRecord(id) ? readPromptFile(id) : null
+  try { return readRecord(id) ? readPromptFile(id) : null }
+  catch (e) { if (e instanceof SessionRecordUnusable) return null; throw e }
 }
 
 // @@@ lastKnownSession - the last successfully-read Session row per session_id. The record's EXISTENCE in
@@ -665,19 +918,90 @@ const lastKnownSession = new Map<string, Session>()
 // old `git worktree list` scan). Every GOVERNED record this project owns becomes a row, status reconciled;
 // non-governed (user-self-launched) records are excluded — board state is a managed-session concern ([[state]]).
 // Offline and awaiting ones still appear (their record persists), so a session is never lost from view.
-export async function listSessions(): Promise<Session[]> {
+export async function listSessions(includeArchived = false): Promise<Session[]> {
   // ONE store enumeration + ONE tmux snapshot (windows + pane pids + titles, merged) for the whole list, then
   // every session reconciles by a pure set lookup + one existsSync — no per-session tmux spawn.
   const [ids, snap] = await Promise.all([
     Promise.resolve(listSessionIds()), liveSnapshot(),
   ])
+  // Freeze one record snapshot for both the census join and row projection. A second full read after an awaited
+  // probe could pair record A with thread identity B and accidentally treat a missing census entry as clean.
+  const snapshots = new Map<string, { entry: PublicRecordEntry; rec: SessRec | null }>()
+  for (const id of ids) {
+    try {
+      const entry = readPublicRecordEntry(id)
+      snapshots.set(id, { entry, rec: entry.kind === 'ok' ? fromRaw(entry.raw) : null })
+    } catch { /* guardSession below preserves the last-known row for a transient read failure */ }
+  }
+  // Only archived adapter records need the resident-ID join. If there are none, this read path performs zero
+  // control-plane probes; resources still owns the full turn/read probe for its detailed report.
+  const censusRecords = [...snapshots.values()].flatMap(({ entry, rec }) => entry.kind === 'ok' && entry.liveness === null && rec && rec.governed && rec.archived && rec.harnessSessionId
+    ? [{ ...rec, harness: rec.harness || defaultHarness.id }]
+    : [])
+  const residentCensus = censusRecords.length ? await adapterLoadedReferenceState(censusRecords) : new Map()
+  // A record can change while the one census is in flight. Mark such rows conservatively; never let the stale
+  // proof hide them. This is a bounded storage read, not another adapter RPC.
+  const changedDuringCensus = new Set<string>()
+  for (const rec of censusRecords) {
+    try {
+      const current = readPublicRecordEntry(rec.session)
+      const before = snapshots.get(rec.session)?.entry
+      if (current.kind !== 'ok' || before?.kind !== 'ok' || JSON.stringify(current.raw) !== JSON.stringify(before.raw)) changedDuringCensus.add(rec.session)
+    } catch { changedDuringCensus.add(rec.session) }
+  }
   const rows = ids.map((id) => guardSession(id, () => {
-    const rec = readRecord(id)
+    // a record we cannot READ still has a row: it is a session that exists and whose state is unknowable, which
+    // is a thing to act on, not a thing to hide. It carries its own status and names the file, so the human can
+    // see the file and close it — the alternative (dropping it) is what made a live session read as gone.
+    const snapshot = snapshots.get(id)
+    if (!snapshot) throw new Error(`session ${id} record snapshot unavailable`)
+    const { entry } = snapshot
+    // The corrupt row becomes the LAST-KNOWN row, never a deletion. Dropping it would mean the next poll that
+    // hits a transient read failure has nothing to fall back on and the row vanishes — re-opening the exact
+    // hole this branch closes, one poll later. `corrupt` is a true reading, so it is worth remembering.
+    if (entry.kind === 'corrupt') { const c = corruptSession(id, entry); lastKnownSession.set(id, c); return c }
+    const rec = snapshot.rec
     if (!rec || !rec.governed) { lastKnownSession.delete(id); return null }   // no record, or a self-launched (non-board) one
+    // A forced public liveness comes only from the shared record projection. Do not let live process/thread
+    // evidence punch through it (including archive hazard repair).
+    if (entry.kind === 'ok' && entry.liveness === 'offline') {
+      const pending = toSession(rec, 'offline', 'offline')
+      lastKnownSession.set(id, pending)
+      return pending
+    }
     // the pane title → headline activity, gated by THIS session's harness ([[harness-adapter]]): claude's title
     // is its task self-summary (used); codex's is the cwd folder name (refused → headline falls to the prompt).
     const activity = paneActivity(harnessById(rec.harness || defaultHarness.id), snap.titles.get(id))
-    const s = toSession(rec, reconcile(rec, snap), liveness(rec, snap), activity)
+    const sessionHarness = harnessById(rec.harness || defaultHarness.id)
+    const resident = rec.harnessSessionId
+      ? residentCensus.get(`${rec.harness || defaultHarness.id}:${rec.harnessSessionId}`)
+      : undefined
+    const residentRequired = sessionHarness.runtimeOwnership === 'adapter' && !!rec.harnessSessionId && !!sessionHarness.sharedRuntimes?.(runtimeRoot()).length
+    const physical = rec.archived
+      ? (sessionHarness.runtimeOwnership === 'adapter'
+        ? (resident && !resident.healthy ? 'unknown' : resident?.loaded ? 'online' : snap.windows.has(id) ? 'online' : 'offline')
+        : liveness({ ...rec, archived: false, stopped: false }, snap))
+      : null
+    // Only a physically-offline record projects as archived. A legacy archived+live/unknown record is exposed
+    // as ordinary working-set state with its real liveness/status and one backend-owned hazard marker. A
+    // missing durable cold proof is also legacy: leaf liveness alone cannot prove a Codex loaded thread was
+    // unloaded, so it remains visible until an explicit archive repair.
+    const cleanCold = rec.archived && !changedDuringCensus.has(id) && hasValidColdProof(rec) && physical === 'offline' && (!residentRequired || resident?.healthy === true)
+    const projected = rec.archived && !cleanCold ? { ...rec, archived: false, stopped: false } : rec
+    const projectedLv = projected === rec ? liveness(rec, snap) : physical!
+    const s = toSession(projected, reconcile(projected, snap), projectedLv, activity)
+    if (projected !== rec) s.archiveHazard = changedDuringCensus.has(id)
+      ? 'archived runtime hazard: record changed while adapter residency was being reconciled; retry exact archive'
+      : hasValidColdProof(rec)
+        ? residentRequired && !resident
+          ? 'archived runtime hazard: adapter resident-reference census missing; exact unload is unproven'
+          : resident && !resident.healthy
+        ? `archived runtime hazard: adapter resident-reference census is unknown (${resident.error || 'probe failed'})`
+        : resident?.loaded
+          ? 'archived runtime hazard: target adapter thread is still loaded'
+          : `archived runtime hazard: record says archived but physical liveness is ${physical}`
+      : 'archived runtime hazard: record has no durable cold witness; exact adapter unload is unproven'
+    if (rec.adapterRecovery) s.archiveHazard = `archive adapter recovery required: ${rec.adapterRecovery}`
     lastKnownSession.set(id, s)
     return s
   }, () => {
@@ -694,7 +1018,8 @@ export async function listSessions(): Promise<Session[]> {
   // `created` is the record's stored createdAt (set once at launch). A manual drag ([[session-reorder]])
   // overrides one row's slot via a pseudo-time `sortKey`, so sort by `sortKey ?? created`; id breaks ties so
   // same-instant births (or sort-keys) stay deterministic.
-  return rows.filter((s): s is Session => s != null).sort((a, b) => (a.sortKey ?? a.created) - (b.sortKey ?? b.created) || a.id.localeCompare(b.id))
+  return rows.filter((s): s is Session => s != null && (includeArchived || !s.archived))
+    .sort((a, b) => (a.sortKey ?? a.created) - (b.sortKey ?? b.created) || a.id.localeCompare(b.id))
 }
 
 // a per-session read guard mirroring resilience.guardWorktree but keyed on the store record (not a worktree
@@ -1063,10 +1388,42 @@ export function launcherCmd(rec: SessRec): string | undefined {
   if (rec.launchCmd) return rec.launchCmd
   return rec.launcher ? resolveLauncher(rec.launcher).cmd : undefined
 }
+// @@@ launch preflight - the launch transport's OWN settled failures, checked before a tmux window is ever
+// opened. Each is a fact about this machine right now that no number of attempts can change: the worktree the
+// agent would run in, the branch it would commit to, the command that would start it. Answering them here is
+// what turns a certain failure into ONE loud, named refusal instead of a launch that fast-exits and is retried
+// on a wall clock. Everything the transport CANNOT settle (a launcher that races its own daemon) still reaches
+// the bounded retry, and the harness's own settled failures are the adapter's to name (fatalLaunchOutput).
+export type LaunchBlock = { code: 'no-worktree' | 'no-branch' | 'no-launcher'; message: string }
+// does this ref resolve to a commit? Through git.ts's git() so a hook's exported GIT_DIR can't misdirect
+// discovery. `--verify --quiet` answers a MISSING ref with a bare non-zero exit and no stderr, while a broken
+// repo/timeout writes stderr — so only the silent failure is read as absence. A probe that could not answer
+// reads as "exists": the preflight refuses on a PROVEN absence, never on a failed probe ([[state]]'s board
+// honesty rule applied to launch).
+function refExists(cwd: string, ref: string): boolean {
+  try { return !!git(['-C', cwd, 'rev-parse', '--verify', '--quiet', `${ref}^{commit}`]).trim() }
+  catch (e) { return String((e as { stderr?: string })?.stderr ?? '').trim() !== '' }
+}
+export function launchPreflight(rec: SessRec): LaunchBlock | null {
+  if (!rec.worktreePath || !existsSync(rec.worktreePath))
+    return { code: 'no-worktree', message: `session ${rec.session.slice(0, 8)}: its worktree ${rec.worktreePath || '(unrecorded)'} does not exist — there is nothing to launch in. If the work merged and the worktree was removed, close the session; otherwise restore the worktree first.` }
+  if (rec.branch && !refExists(rec.worktreePath, rec.branch))
+    return { code: 'no-branch', message: `session ${rec.session.slice(0, 8)}: its branch ${rec.branch} no longer exists — a relaunch would put the agent on a detached or wrong ref. Restore the branch, or close the session.` }
+  let cmd: string | undefined
+  try { cmd = launcherCmd(rec) }
+  catch (e) { return { code: 'no-launcher', message: `session ${rec.session.slice(0, 8)}: its launcher cannot be resolved — ${e instanceof Error ? e.message : e}` } }
+  // only an ABSOLUTE command is checkable here; a bare name is the shell's PATH lookup at launch time, and
+  // guessing at it would refuse launches that work. Certainty is the whole point of a preflight.
+  const bin = (cmd ?? '').trim().split(/\s+/)[0]
+  if (bin && isAbsolute(bin) && !existsSync(bin))
+    return { code: 'no-launcher', message: `session ${rec.session.slice(0, 8)}: its pinned launcher command ${bin} is not on this machine — every launch of it will fail until the path is restored or the session is re-dispatched under a launcher that exists.` }
+  return null
+}
+
 // @@@ launch quoting - single-quote a string for a POSIX shell, `'` → `'\''`. Used to nest the whole agent
 // invocation inside the birth-registration `sh -c '…'` wrapper without any segment double-expanding.
 const shq1 = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`
-export function launchScript(id: string, tail: string, harness: Harness = HARNESS, cmd?: string): string {
+export function launchScript(id: string, tail: string, harness: Harness = HARNESS, cmd?: string, delegateFifo?: string): string {
   const file = join(storeDir(id), 'launch.sh')
   // NO --append-system-prompt / --settings: the contract + hooks are materialized into the worktree at
   // createSession ([[harness-delivery]]) and the agent auto-discovers them — the SAME path as a self-launched
@@ -1094,24 +1451,65 @@ export function launchScript(id: string, tail: string, harness: Harness = HARNES
   // A one-shot adapter (currently codex-headless) deliberately exits after its first turn while the shared
   // app-server stays alive. Retrying that successful fast exit would mint a duplicate thread/prompt, so the
   // retry loop is a runtime capability rather than a harness-id branch.
+  // @@@ retry only what retrying can fix - a fast exit says the launcher stopped before readiness, which is
+  // reason enough to try again but never a diagnosis. So after a fast exit the script reads what the harness
+  // actually SAID and matches it against the ADAPTER's own settled-failure patterns ([[harness-adapter]]
+  // fatalLaunchOutput). A match means this command cannot succeed however many times we run it: stop at one
+  // attempt and let the harness's own line be the last thing on the pane, instead of spending a certain failure
+  // three times and burying the reason. No match keeps the plain bounded retry.
+  //
+  // It reads the PANE, not the agent's streams. Capturing stderr through a pipe missed the answer entirely —
+  // measured against real reclaude, "No conversation found with session ID" arrives on STDOUT, so a
+  // stderr-only capture classified nothing and retried a certain failure three times (the unit test passed
+  // only because its stub printed to the stream the implementation happened to watch). Redirecting stdout too
+  // would be worse: a TUI that finds stdout is not a terminal stops being a TUI. The pane already holds both
+  // streams exactly as the human sees them, and the script runs inside that pane — so it just asks tmux.
+  const fatal = (harness.fatalLaunchOutput ?? []).join('|')
   const launchBody = harness.launchOneShot ? [born, ''] : [
     `for __spex_try in 1 2 3; do`,
     `  __spex_t0=$SECONDS`,
+    // @@@ classify THIS attempt only - the pane is a scrollback, so it also holds every earlier attempt and
+    // every earlier launch that ever ran in this window. Matching the whole capture would let a stale
+    // settled-failure line from minutes ago condemn an unrelated fast exit and cut a launch that retrying
+    // WOULD have recovered — the exact mirror of the miss this classifier exists to fix. So each attempt
+    // stamps a line unique to (this run, this attempt) and the match starts after it. The run's pid is what
+    // makes it unique across relaunches, which reuse the session id.
+    `  __spex_mark="attempt $__spex_try start $$"`,
+    `  printf '[spex launch] %s\\n' "$__spex_mark"`,
     `  ${born}`,
     `  __spex_rc=$?`,
     `  [ $(( SECONDS - __spex_t0 )) -ge ${LAUNCH_FAST_FAIL_S} ] && exit $__spex_rc`,
+    ...(fatal ? [
+      // -t "$TMUX_PANE" names THIS pane explicitly (tmux still resolves the server from $TMUX), so the capture
+      // can never land on a neighbouring pane; run outside tmux the call fails, nothing matches, and the plain
+      // bounded retry stands.
+      `  if tmux capture-pane -p -S -400 -t "\${TMUX_PANE:-}" 2>/dev/null | sed -n "/$__spex_mark/,\\$p" | grep -Eq ${shq1(fatal)}; then`,
+      `    printf '[spex launch] attempt %s exited in %ss (rc=%s) - the launcher reported a failure retrying cannot fix (see above); not retrying\\n' "$__spex_try" "$(( SECONDS - __spex_t0 ))" "$__spex_rc" >&2`,
+      `    exit $__spex_rc`,
+      `  fi`,
+    ] : []),
     `  printf '[spex launch] attempt %s exited in %ss (rc=%s) - fast launcher exit before readiness; retrying\\n' "$__spex_try" "$(( SECONDS - __spex_t0 ))" "$__spex_rc" >&2`,
     `  sleep 2`,
     `done`,
     `exit $__spex_rc`,
     ``,
   ]
-  writeFileSync(file, launchBody.join('\n'))
+  const delegatePreamble = delegateFifo ? [
+    `exec 9<${shq1(delegateFifo)}`,
+    `rm -f ${shq1(delegateFifo)}`,
+    'export SPEXCODE_MAINTENANCE_DELEGATE_FD=9',
+    `export SPEXCODE_MAINTENANCE_SESSION_ID=${shq1(id)}`,
+  ] : []
+  writeFileSync(file, [...delegatePreamble, ...launchBody].join('\n'))
   return file
 }
-async function launch(id: string, path: string, tail: string, harness: Harness = HARNESS, cmd?: string): Promise<void> {
+async function launch(id: string, path: string, tail: string, harness: Harness = HARNESS, cmd?: string, delegateFifo?: string): Promise<void> {
+  // record the transport path THIS runtime hands the agent, before anything reads it (launchScript bakes it
+  // into the launch env). Same kind of launch-time fact as agent.pid, and the reason a session's socket is
+  // reachable only from the world it belongs to ([[harness-adapter]] rendezvous socket).
+  if (harness.ownsRendezvous) stampRvSock(id)
   await tmux(['new-session', '-d', '-s', id, '-x', String(COLS), '-y', String(ROWS), '-c', path])
-  await tmux(['send-keys', '-t', id, '-l', '--', `bash ${launchScript(id, tail, harness, cmd)}`])
+  await tmux(['send-keys', '-t', id, '-l', '--', `bash ${launchScript(id, tail, harness, cmd, delegateFifo)}`])
   await tmux(['send-keys', '-t', id, 'Enter'])
   launchedAt.set(id, Date.now())   // stamp the boot window so reconcile reads 'starting', not 'offline', until the socket is up
 }
@@ -1140,16 +1538,46 @@ function isOccupying(s: Session, snap: LiveSnap): boolean {
 // In-memory in the single server process (the only drainer) — lost on restart, which is fine: a restart drains
 // the durable `queued` worktrees fresh with nothing in flight.
 const launching = new Set<string>()
+// A queued launch and a cold archive must not cross between their final read and record write. This is a
+// narrow per-session intent latch, not a second cleanup primitive; the launch path simply leaves an archiving id
+// alone and the archive path re-probes before filing.
+const archiving = new Set<string>()
+const transitionTails = new Map<string, Promise<void>>()
+async function withSessionTransition<T>(id: string, body: () => Promise<T>): Promise<T> {
+  const previous = transitionTails.get(id) ?? Promise.resolve()
+  let release!: () => void
+  const current = new Promise<void>((resolve) => { release = resolve })
+  transitionTails.set(id, current)
+  await previous
+  try { return await body() }
+  finally {
+    release()
+    if (transitionTails.get(id) === current) transitionTails.delete(id)
+  }
+}
 let draining = false   // re-entrancy guard: only one drain pass runs at a time (no double-launch)
 
 // launch a prepared `queued` worktree: feed it its parked launch prompt, flip it to active. Returns false
 // (leaving it queued, to be retried next drain) if the worktree/prompt is gone or the tmux launch threw.
-async function startQueued(id: string): Promise<boolean> {
+async function startQueuedUnlocked(id: string): Promise<boolean> {
+  if (archiving.has(id)) return false
   const wt = await findWorktree(id)
   if (!wt) return false
+  if (archiving.has(id) || wt.rec.archived) return false
   if (!canDrainQueued(wt.rec)) return false
   const launchPrompt = readLaunchFile(id)
   if (launchPrompt == null) return false   // a queued session always has one; if it's gone, don't spin on it
+  // a queued worktree can go missing while it waits (a human cleaned up, a disk moved). Draining it would open
+  // a window that fast-exits and burn the retry budget every tick, so refuse ONCE, loudly, and stamp the reason
+  // on the record — the drainer then leaves it alone instead of spinning on a launch that cannot work.
+  const blocked = launchPreflight(wt.rec)
+  if (blocked) {
+    if (wt.rec.note !== blocked.message) {
+      console.error(`spex: not launching queued session ${id}: ${blocked.message}`)
+      writeRecord({ ...wt.rec, note: blocked.message })
+    }
+    return false
+  }
   launching.add(id)   // hold the slot across the boot window BEFORE we launch, so a concurrent count can't race us
   const h = harnessById(wt.rec.harness || defaultHarness.id)   // launch THIS session's chosen harness (also drives waitForReady below)
   try {
@@ -1166,13 +1594,14 @@ async function startQueued(id: string): Promise<boolean> {
   void waitForReady(id, h).finally(() => launching.delete(id))
   return true
 }
+const startQueued = (id: string): Promise<boolean> => withSessionTransition(id, () => withRecordLock(id, () => startQueuedUnlocked(id)))
 
 // @@@ drainQueue - start as many `queued` sessions as there are free slots, oldest first. Idempotent and
 // re-entrancy-guarded; safe to call on every slot-freeing event (newSession / close / propose) AND on a
 // periodic tick (superviseQueue) — the periodic tick is what catches the AGENT-authored transitions
 // (done/parked written by a hook SUBPROCESS, which can't reach this server's queue). Re-lists each iteration
 // so a freshly launched session (held in `launching`) counts immediately and we never exceed the cap.
-export async function drainQueue(): Promise<void> {
+async function drainQueueUnlocked(): Promise<void> {
   if (draining) return
   draining = true
   try {
@@ -1197,6 +1626,14 @@ export async function drainQueue(): Promise<void> {
     }
   } finally { draining = false }
 }
+export const drainQueue = (): Promise<void> => runSessionOperation({ op: 'queue-drain' }, drainQueueUnlocked)
+const requestQueueDrain = (): void => {
+  void drainQueue().catch((error) => {
+    // An exact maintenance stop deliberately frees no unrelated queue work while admission is closed.
+    if (error instanceof SessionMaintenanceError && error.code === 'maintenance_active') return
+    console.error(`spex: queue drain failed: ${error instanceof Error ? error.message : String(error)}`)
+  })
+}
 
 // @@@ superviseQueue - the periodic drainer. Started once at serve(). The explicit drainQueue() calls on
 // newSession/close/propose cover the slot-freeing events the SERVER handles, but an agent proposing done or
@@ -1264,11 +1701,14 @@ export async function sessionCreateRequest(body: unknown, create: SessionCreateF
   if (!prompt.trim()) return { status: 400, error: 'empty prompt' }
   const launcher = typeof input.launcher === 'string' && input.launcher.trim() ? input.launcher.trim() : undefined
   const parent = typeof input.parent === 'string' && input.parent.trim() ? input.parent.trim() : null
-  try {
-    return { status: 201, session: await create(prompt, parent, launcher) }
-  } catch (e) {
-    return { status: 400, error: String((e as Error).message || e) }
-  }
+  return runSessionOperation({ op: 'create' }, async () => {
+    try {
+      return { status: 201, session: await create(prompt, parent, launcher) }
+    } catch (e) {
+      if (e instanceof SessionMaintenanceError) throw e
+      return { status: 400, error: String((e as Error).message || e) }
+    }
+  })
 }
 
 // @@@ createSession (dispatch via backend) - `spex session new` must launch the worker in the
@@ -1280,6 +1720,9 @@ export async function sessionCreateRequest(body: unknown, create: SessionCreateF
 // reachable do we fall back to launching in this process (with a stderr warning) — the backend's own POST
 // handler calls newSession directly, so it never re-enters this path.
 export async function createSession(prompt: string, launcher?: string): Promise<Session> {
+  if (maintenanceBrokerDescriptors()) {
+    throw new SessionMaintenanceError('maintenance_capability_missing', 'maintenance operator broker admits only its exact stop/resume plan', { operation: 'create' })
+  }
   await assertProjectMatch('spex session new')
   // @@@ parent = the CALLER's own session ([[session-nesting]]). Resolve it HERE, in the caller's process,
   // via the SAME ownSessionId env read [[agent-reply-channel]] uses for its sender hint — NOT inside the
@@ -1295,7 +1738,7 @@ export async function createSession(prompt: string, launcher?: string): Promise<
     })
   } catch {
     console.error('spex: no backend reachable — launching in-process (caller env owns auth, no concurrency cap)')
-    return newSession(prompt, parent, launcher)
+    return runSessionOperation({ op: 'fallback-create' }, () => newSession(prompt, parent, launcher))
   }
   if (!res.ok) {
     const text = await res.text().catch(() => '')
@@ -1308,6 +1751,23 @@ export async function createSession(prompt: string, launcher?: string): Promise<
   return await res.json() as Session
 }
 
+// @@@ spawnerClause - where the SPAWNER works, told to the child ([[spawner-pointer]]). A child's worktree is
+// branched off the BASE branch, never off its spawner, so everything that session has in flight — a spec node
+// it just created, an edit it hasn't landed — is absent from the child's tree AND from the spec index the
+// pointer above resolves against (that index reads the backend's own checkout). Teaching the fork or the
+// landing about nesting would cost a second base per session and would carry the spawner's unreviewed commits
+// into whatever the child merges into; naming the spawner's worktree costs one line and lets the agent decide.
+// A POINTER, never a body — same family rule as [[spec-pointer]] — and fail-quiet by absence: no parent, or a
+// parent record without a worktree, appends nothing.
+export function spawnerClause(p: SessRec | null): string {
+  if (!p?.worktreePath) return ''
+  const who = p.name || p.title
+  return `\n\nYou were created by session \`${p.session.slice(0, 8)}\`${who ? ` (${who})` : ''}, whose worktree is ${p.worktreePath}` +
+    `${p.branch ? ` on branch \`${p.branch}\`` : ''}. Your own worktree is branched from \`${mainBranch()}\`, so it does NOT contain that ` +
+    `session's uncommitted or unmerged work — a spec node it just created, an edit it hasn't landed. If your task needs anything of theirs, ` +
+    `read it there directly. Read only: never write into another session's worktree.`
+}
+
 // @@@ newSession - durable worktree (branch node/<slug> off main) + a global session.json record. The agent does NOT
 // launch inline any more: the worktree is prepared and parked as `queued`, then drainQueue() launches it
 // immediately if we're under the concurrency cap, else it waits its turn. Backs both the dashboard POST and
@@ -1334,14 +1794,13 @@ export async function newSession(prompt: string, parent: string | null = null, l
   const branch = `node/${slug}`
   const path = join(mainRoot(), '.worktrees', slug)
   // Compose the FINAL launch text before making the worktree, preserving fail-before-side-effects if live
-  // preset resolution breaks. The optional spec pointer is a seam input; the note insert remains last.
+  // preset resolution breaks. The optional spec + spawner pointers are seam inputs; the note insert remains last.
   const spec = ref ? launchSpecs?.find((n) => n.id === ref) : undefined
-  const suffix = spec
-    ? `\n\nThe spec node \`${ref}\` is your ground truth — read its spec at ${join(path, spec.path)}.`
-    : undefined
+  const suffix = (spec ? `\n\nThe spec node \`${ref}\` is your ground truth — read its spec at ${join(path, spec.path)}.` : '')
+    + spawnerClause(parent ? readRecord(parent) : null)
   const launchPrompt = (await composeSessionPrompt(rawPrompt, { session: id, harness: h.id }, {
     loadedSpecs: launchSpecs ?? undefined,
-    suffix,
+    suffix: suffix || undefined,
   })).text
   await gitA(['-C', mainRoot(), 'worktree', 'add', '-b', branch, path, mainBranch()])
   // the checkout delivers the tracked spec sources and the materialize below delivers the materialized
@@ -1360,7 +1819,7 @@ export async function newSession(prompt: string, parent: string | null = null, l
     // mutated after. A self-parent (a resolver quirk) is dropped so a session can't nest under itself.
     node: ref || null, title, name: null, parent: parent && parent !== id ? parent : null,
     status: 'queued', proposal: null, merges: 0, note: null, sortKey: null, createdAt: Date.now(),
-    harness: h.id, harnessSessionId: null, launcher: chosen.name,
+    harness: h.id, harnessSessionId: null, stopped: false, archived: false, coldProof: null, adapterRecovery: null, launcher: chosen.name,
     // PIN the resolved launch command NOW ([[launcher-select]] resume-launcher-pin) so every future
     // (re)launch replays THIS exact launcher — the one whose config-dir env holds the conversation — instead of
     // re-resolving against a default that may have flipped (a backend restarted under a different launcher).
@@ -1378,12 +1837,11 @@ export async function newSession(prompt: string, parent: string | null = null, l
   writeLaunchFile(id, launchPrompt)     // park the exact launch prompt for the drainer (consumed at launch)
   await drainQueue()                    // launch now if under the cap, else leave it queued for a free slot
   const after = readRecord(id) ?? rec   // 'active' if the drain launched it, else still 'queued'
-  // Every adapter answers from its own truth. Asking with no process facts distinguishes a record-backed
-  // adapter (online immediately) from process-backed queued/booting adapters (offline/starting) without an
-  // extra whole-box tmux snapshot on the creation hot path.
-  const recordOnline = h.liveness(after, false, runtimeRoot()) === 'online'
+  // Every headless adapter is record-backed and therefore online immediately; interactive adapters still need
+  // their real process/transport snapshot. Read that capability directly instead of smuggling a harness-mode
+  // probe through liveness with fake tmuxAlive=false.
   const queued = after.status === 'queued'
-  return toSession(after, queued ? 'queued' : 'working', recordOnline ? 'online' : queued ? 'offline' : 'starting')
+  return toSession(after, queued ? 'queued' : 'working', h.headless ? 'online' : queued ? 'offline' : 'starting')
 }
 
 // @@@ bootstrapMaterialize - the creation-time materialize is BOOTSTRAP, not best-effort: it is what writes
@@ -1417,13 +1875,29 @@ const SOCKET_READY_TIMEOUT_MS = 30000   // spans launchScript's bounded fast-fai
                                         // waitForReady (slot-hold + resume) waits through a daemon-race retry
                                         // instead of returning before a recovering socket
 const SOCKET_POLL_MS = 200
-async function waitForReady(id: string, harness: Harness, timeoutMs = SOCKET_READY_TIMEOUT_MS): Promise<boolean> {
+async function waitForReady(id: string, harness: Harness, pending?: SessRec, timeoutMs = SOCKET_READY_TIMEOUT_MS): Promise<HarnessLaunchReadinessFence | null> {
+  const current = () => {
+    const stored = readRecord(id)
+    const rec = stored && pending
+      ? { ...pending, ...stored, stopped: pending.stopped, archived: pending.archived }
+      : stored || pending
+    return rec ? { ...rec, runtimeDir: runtimeRoot() } : null
+  }
   const deadline = Date.now() + timeoutMs
+  if (harness.launchReady) return harness.launchReady(current, deadline)
+  const genericFence = (): HarnessLaunchReadinessFence => ({
+    proof: Object.freeze({ kind: 'adapter-liveness', harnessId: harness.id, sessionId: id }),
+    validate: async (latest) => {
+      const rec = latest()
+      const snap = await liveSnapshot()
+      return !!rec && harness.liveness(rec, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online'
+    },
+  })
   for (;;) {
-    const rec = readRecord(id)
+    const rec = current()
     const snap = await liveSnapshot()   // window + pane probe + live-listener set in one snapshot — all the adapter needs
-    if (rec && harness.liveness(rec, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online') return true
-    if (Date.now() >= deadline) return false
+    if (rec && harness.liveness(rec, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online') return genericFence()
+    if (Date.now() >= deadline) return null
     await new Promise((r) => setTimeout(r, SOCKET_POLL_MS))
   }
 }
@@ -1450,26 +1924,165 @@ async function waitForReady(id: string, harness: Harness, timeoutMs = SOCKET_REA
 //     session that is proposing a merge must NOT silently withdraw it. Only applied when we actually relaunch;
 //     a refusal leaves the record wholly untouched.
 // Fail-loud is unchanged: if the agent never comes online, the later deliver() fails loud.
-export async function resumeSession(id: string, opts: { force?: boolean; guard?: boolean } = {}): Promise<{ ok: boolean; error?: string; refused?: boolean; info?: string }> {
+type ResumeOptions = { force?: boolean; guard?: boolean; authorization?: Authorization }
+type ResumeExecutionOptions = ResumeOptions & { ticket?: MaintenanceTicket }
+
+async function delegatedSpawnTransfer(id: string, ticket: MaintenanceTicket): Promise<{
+  fifo: string
+  done: Promise<void>
+  close(): void
+}> {
+  const fifo = join(storeDir(id), `.maintenance-delegate-${randomUUID()}.fifo`)
+  await pexec('mkfifo', ['-m', '600', fifo])
+  const bearer = ticket.delegateSharedSpawn(id)
+  const writer = spawn('sh', ['-c', 'cat > "$1"', 'spex-maintenance-delegate', fifo], {
+    stdio: ['pipe', 'ignore', 'pipe'],
+  })
+  let stderr = ''
+  writer.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk })
+  writer.stdin.on('error', () => {})
+  writer.stdin.end(bearer)
+  let settled = false
+  const done = new Promise<void>((resolve, reject) => {
+    writer.once('error', (error) => { settled = true; reject(error) })
+    writer.once('close', (code, signal) => {
+      settled = true
+      if (code === 0) resolve()
+      else reject(new SessionMaintenanceError('maintenance_delegate_invalid',
+        `shared-spawn delegate transfer failed (${signal || code}${stderr.trim() ? `: ${stderr.trim()}` : ''})`,
+        { operation: 'shared-spawn', sessionId: id }))
+    })
+  })
+  return {
+    fifo,
+    done,
+    close() {
+      if (!settled) writer.kill('SIGTERM')
+      rmSync(fifo, { force: true })
+    },
+  }
+}
+
+async function resumeSessionUnlocked(id: string, opts: ResumeExecutionOptions = {}): Promise<{ ok: boolean; error?: string; refused?: boolean; info?: string }> {
   const { force = false, guard = true } = opts
-  const wt = await findWorktree(id)
+  let wt: { path: string; branch: string | null; rec: SessRec } | null
+  try { wt = await findWorktree(id) }
+  catch (e) { if (e instanceof SessionRecordUnusable) return { ok: false, refused: true, error: e.message }; throw e }
   if (!wt) return { ok: false, error: `no such session ${id}` }
+  // A process that died while validating left an internal candidate behind. This record lock proves no live
+  // resume still owns it. Restore the frozen public original before doing any transport work and require an
+  // explicit retry; stale runtime evidence is never adopted into a fresh launch attempt.
+  if (wt.rec.launchReadinessPending) {
+    writeRecord(restoreLaunchReadinessOriginal(wt.rec))
+    return {
+      ok: false,
+      refused: true,
+      error: `session ${id}: stale launch readiness pending was recovered fail-closed; the exact stopped/offline record was retained. Retry resume.`,
+    }
+  }
+  const preResume = wt.rec
+  // a retired session (its worktree gone) is terminal, not offline: say so in its own words rather than in the
+  // preflight's, since `close` — not a repair — is what it needs.
+  const retired = retirementReason(wt.rec)
+  if (retired) return { ok: false, refused: true, error: retired }
+  // everything else the transport can settle before opening a window: no branch, no launcher. A launch that
+  // cannot succeed must not be attempted, retried, or given a regenerated launch script.
+  const blocked = launchPreflight(wt.rec)
+  if (blocked) return { ok: false, refused: true, error: blocked.message }
   const h = harnessById(wt.rec.harness || defaultHarness.id)
-  const lv = liveness(wt.rec, await liveSnapshot())   // FRESH, honest liveness (listener-verified) — the guard must not trust a stale board reading
+  // An archived record is expected to be stopped, but the guard must still inspect physical liveness in case
+  // it is a legacy/invariant-violating row. Ignore filing and stale stop metadata for this one safety probe so
+  // resume can never kill a live leaf merely because the record was hidden.
+  const probeRec = wt.rec.archived ? { ...wt.rec, archived: false, stopped: false } : wt.rec
+  const resumeSnap = await liveSnapshot()
+  const lv = h.runtimeOwnership === 'adapter'
+    ? (resumeSnap.windows.has(id) ? 'online' : 'offline')
+    : liveness(probeRec, resumeSnap)   // FRESH, honest liveness (listener-verified)
   if (guard && !force && lv === 'online')
     return { ok: false, refused: true, error: `session ${id} is ALIVE — refusing to relaunch, which would kill a live worker mid-work. To steer it, send it a message; use force only for a genuinely wedged (but alive) process.` }
   if (guard && !force && lv === 'unknown')
     return { ok: false, refused: true, error: `session ${id}: the liveness probe failed (the box is likely overloaded) — refusing to relaunch since a live worker can't be ruled out. Retry in a moment, or use force to override.` }
+  const wasArchived = wt.rec.archived
+  if (!wasArchived && wt.rec.adapterRecovery) {
+    const recovery = await h.restoreRuntime?.(wt.rec)
+    if (recovery && !recovery.ok) return { ok: false, refused: true, error: `session ${id}: recovery required before resume — ${recovery.reason}` }
+    writeRecord({ ...(readRecord(id) || wt.rec), adapterRecovery: null, coldProof: null, archived: false, stopped: true })
+    wt = await findWorktree(id)
+    if (!wt) return { ok: false, error: `session ${id} disappeared during adapter recovery` }
+  }
+  if (wasArchived && (force || lv === 'offline')) {
+    // Make the durable row visible/offline before any adapter unarchive or launch RPC. Any later failure leaves
+    // a retryable unarchived record rather than archived:true with a newly loaded target thread.
+    const pendingRecovery = wt.rec.adapterRecovery || 'restore-runtime-pending'
+    writeRecord({ ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery })
+    const visible = readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery }
+    const restored = await h.restoreRuntime?.(visible)
+    if (restored && !restored.ok) return { ok: false, refused: true, error: `session ${id}: ${restored.reason}` }
+    writeRecord({ ...(readRecord(id) || visible), adapterRecovery: null, coldProof: null })
+  }
   // proceeding: settle the RESTING lifecycle (a resumed working agent is now idle), then relaunch iff the agent
-  // is CONFIRMED offline (or force — the wedged-but-alive escape). `starting`/`unknown` fall through to a no-op.
-  writeRecord({ ...wt.rec, status: wt.rec.status === 'active' ? 'idle' : wt.rec.status })
+  // is CONFIRMED offline (or force — the wedged-but-alive escape). Clear the explicit-stop marker only after
+  // launch has accepted the relaunch; a thrown launch leaves the record truthfully stopped. `starting`/`unknown`
+  // fall through to a metadata-only no-op.
+  // Archived sessions have no runtime by invariant. Resume first leaves cold storage, then the normal
+  // starting -> online launch path recreates the same conversation.
+  const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: null }) : wt.rec
+  const resumed: SessRec = { ...current, archived: false, coldProof: null, status: current.status === 'active' ? 'idle' : current.status, stopped: false }
   if (force || lv === 'offline') {
     await tmuxOk(['kill-session', '-t', id])   // drop a dead/offline pane (or a force-killed live one)
-    await launch(id, wt.path, h.resumeArg(wt.rec).trim(), h, launcherCmd(wt.rec))
-    await waitForReady(id, h)   // a relaunched agent is "ready" only once the adapter reads it online
-  }
+    const transfer = opts.authorization && opts.ticket && h.sharedRuntimeSpawn
+      ? await delegatedSpawnTransfer(id, opts.ticket)
+      : null
+    try {
+      await launch(id, wt.path, h.resumeArg(wt.rec).trim(), h, launcherCmd(wt.rec), transfer?.fifo)
+      if (transfer) await transfer.done
+    } finally { transfer?.close() }
+    let readiness: HarnessLaunchReadinessFence | null = null
+    let readinessError = ''
+    try { readiness = await waitForReady(id, h, resumed) }
+    catch (error) { readinessError = error instanceof Error ? error.message : String(error) }
+    if (!readiness) {
+      const failed = readRecord(id) || current
+      writeRecord({ ...failed, ...preResume, launchReadinessPending: null })
+      return {
+        ok: false,
+        refused: true,
+        error: `session ${id}: launch did not become ready${readinessError ? ` - ${readinessError}` : ''}; the session remains stopped and can be retried`,
+      }
+    }
+    const latest = readRecord(id) || resumed
+    const candidate: SessRec = {
+      ...latest,
+      archived: false,
+      coldProof: null,
+      status: latest.status === 'active' ? 'idle' : latest.status,
+      stopped: false,
+      launchReadinessPending: launchReadinessPending(preResume),
+    }
+    writeRecord(candidate)
+    let stillReady = false
+    try { stillReady = await readiness.validate(() => {
+      const stored = readRecord(id)
+      return stored ? { ...stored, runtimeDir: runtimeRoot() } : null
+    }) }
+    catch (error) { readinessError = error instanceof Error ? error.message : String(error) }
+    if (!stillReady) {
+      const failed = readRecord(id) || candidate
+      writeRecord(restoreLaunchReadinessOriginal(failed))
+      return {
+        ok: false,
+        refused: true,
+        error: `session ${id}: launch readiness changed across the pending publication${readinessError ? ` - ${readinessError}` : ''}; the session remains stopped and can be retried`,
+      }
+    }
+    const published = readRecord(id) || candidate
+    writeRecord({ ...published, launchReadinessPending: null })
+  } else writeRecord(resumed)
   return { ok: true }
 }
+export const resumeSession = (id: string, opts: ResumeOptions = {}) =>
+  runSessionOperation({ op: 'resume', sessionId: id, force: opts.force === true, ...(opts.authorization ? { authorization: opts.authorization } : {}) },
+    (ticket) => withSessionTransition(id, () => withRecordLock(id, () => resumeSessionUnlocked(id, { ...opts, ticket }))))
 
 // @@@ agent-authored state - the agent (forced by gates at boundaries) writes its OWN state; it is the
 // authority on what a stop MEANS (awaiting human vs parked on a background task). External hooks only know
@@ -1479,14 +2092,16 @@ export async function resumeSession(id: string, opts: { force?: boolean; guard?:
 export function markState(status: Lifecycle, opts: { proposal?: Proposal; note?: string; sessionId?: string } = {}): boolean {
   const id = opts.sessionId || ownSessionId()
   if (!id) return false
-  const rec = readRecord(id)
-  if (!rec) return false
-  writeRecord({
-    ...rec, status,
-    proposal: status === 'awaiting' ? (opts.proposal ?? 'nothing') : null,
-    note: opts.note ?? null,
-  })
-  return true
+  return runSessionOperationSync({ op: 'lifecycle-transition', sessionId: id }, () => withRecordLockSync(id, () => {
+    const rec = readLiveRecord(id)
+    if (!rec) return false
+    writeRecord({
+      ...rec, status,
+      proposal: status === 'awaiting' ? (opts.proposal ?? 'nothing') : null,
+      note: opts.note ?? null,
+    })
+    return true
+  }))
 }
 export const markDone = (proposal: Proposal = 'nothing', sessionId?: string, note?: string) => markState('awaiting', { proposal, note, sessionId })
 export const markError = (sessionId?: string) => markState('error', { sessionId })
@@ -1495,19 +2110,23 @@ export const markError = (sessionId?: string) => markState('error', { sessionId
 // a zero exit is never routed here, and a declaration that landed before teardown is authoritative.
 export function markHeadlessTurnFailure(sessionId: string, harness: string, exitCode: string): boolean {
   if (exitCode === '0') return false
-  const rec = readRecord(sessionId)
-  if (!rec || rec.status !== 'active') return false
-  const outcome = /^\d+$/.test(exitCode) ? `exit code ${exitCode}` : `signal ${exitCode}`
-  writeRecord({ ...rec, status: 'error', proposal: null, note: `${harness} turn exited with ${outcome}` })
-  return true
+  return runSessionOperationSync({ op: 'lifecycle-transition', sessionId }, () => withRecordLockSync(sessionId, () => {
+    const rec = readLiveRecord(sessionId)
+    if (!rec || rec.status !== 'active') return false
+    const outcome = /^\d+$/.test(exitCode) ? `exit code ${exitCode}` : `signal ${exitCode}`
+    writeRecord({ ...rec, status: 'error', proposal: null, note: `${harness} turn exited with ${outcome}` })
+    return true
+  }))
 }
 export function markHarnessSessionId(sessionId: string | undefined, harnessSessionId: string | undefined): boolean {
   const id = sessionId || ownSessionId()
   if (!id || !harnessSessionId) return false
-  const rec = readRecord(id)
-  if (!rec) return false
-  writeRecord({ ...rec, harnessSessionId })
-  return true
+  return runSessionOperationSync({ op: 'lifecycle-transition', sessionId: id }, () => withRecordLockSync(id, () => {
+    const rec = readLiveRecord(id)
+    if (!rec) return false
+    writeRecord({ ...rec, harnessSessionId, coldProof: null, adapterRecovery: null })
+    return true
+  }))
 }
 // @@@ markIdle - the ONE INFERRED state, so (unlike the agent-authored writers above) it carries a strict
 // active-only guard: the Notification(idle_prompt) hook fires it when claude is waiting at its prompt, and it
@@ -1517,10 +2136,12 @@ export function markHarnessSessionId(sessionId: string | undefined, harnessSessi
 export function markIdle(sessionId?: string): boolean {
   const id = sessionId || ownSessionId()
   if (!id) return false
-  const rec = readRecord(id)
-  if (!rec || rec.status !== 'active') return false  // active-only: never clobber a declaration
-  writeRecord({ ...rec, status: 'idle' })
-  return true
+  return runSessionOperationSync({ op: 'lifecycle-transition', sessionId: id }, () => withRecordLockSync(id, () => {
+    const rec = readLiveRecord(id)
+    if (!rec || rec.status !== 'active') return false  // active-only: never clobber a declaration
+    writeRecord({ ...rec, status: 'idle' })
+    return true
+  }))
 }
 // @@@ asking has TWO writers, both deterministic (neither guarded active-only): (1) the mark-active
 // PreToolUse hook captures it the instant the agent invokes the AskUserQuestion tool (status=asking,
@@ -1529,9 +2150,13 @@ export function markIdle(sessionId?: string): boolean {
 // way the mark-active path clears it back to active on the next tool / prompt, same as any non-active state.
 
 // @@@ mergeReadiness - the deterministic commit gate the Stop hook enforces before a session may declare
-// done / propose merge. The dogfood ritual lands every change as a COMMIT on the node branch first, so two
-// states block a declaration: (1) any uncommitted working-tree change, or (2) 0 commits ahead of main
-// (nothing committed to merge). Since the global-store refactor, SpexCode writes NO per-session files into
+// done. The dogfood ritual lands every change as a COMMIT on the node branch first, so an uncommitted
+// working tree blocks EITHER proposal: the declaration claims the work is committed, and a dirty tree makes
+// that false. The second condition — 0 commits ahead of main — is checked ONLY for `merge`, because it is
+// the only one the claim contradicts: `--propose merge` asserts there is committed work to land, while
+// `--propose nothing` asserts the opposite ("committed, but I am NOT proposing a merge; paused for the human
+// to look"), which a lane whose work ALREADY landed states truthfully. Gating `nothing` on ahead-of-main
+// left such a lane one way through: an empty commit — a lie in git history to satisfy a check about honesty. Since the global-store refactor, SpexCode writes NO per-session files into
 // the worktree (the runtime lives in ~/.spexcode), and the only in-tree SpexCode artifacts are exclude-
 // hidden materialized artifacts or filter-covered contract blocks ([[residence]]), so
 // neither shows as an uncommitted change — the worktree is pristine and EVERY dirty path is genuine spec/code
@@ -1539,7 +2164,7 @@ export function markIdle(sessionId?: string): boolean {
 // Runs from cwd = the session worktree; ALL git goes through git() so the hook's exported GIT_DIR/GIT_INDEX_FILE
 // can't misdirect repo discovery to the cwd (the same trap git.ts documents). `main` resolves via the shared
 // refs, so `main..HEAD` works from any linked worktree regardless of where main is checked out.
-export function mergeReadiness(): { ready: boolean; reason?: string } {
+export function mergeReadiness(proposal: 'merge' | 'nothing' = 'merge'): { ready: boolean; reason?: string } {
   let dirty: string[] = []
   try {
     dirty = git(['status', '--porcelain', '--untracked-files=all']).split('\n').filter(Boolean).map(porcelainPath)
@@ -1548,10 +2173,12 @@ export function mergeReadiness(): { ready: boolean; reason?: string } {
     const shown = dirty.slice(0, 8).join(', ') + (dirty.length > 8 ? ', …' : '')
     return { ready: false, reason: `uncommitted changes on your node branch (${shown}) — commit your spec+code first` }
   }
+  // a `nothing` proposal makes no claim about having something to land, so the clean tree is the whole gate.
+  if (proposal === 'nothing') return { ready: true }
   let ahead = 0
   const base = mainBranch()
   try { ahead = Number(git(['rev-list', '--count', `${base}..HEAD`]).trim()) || 0 } catch { ahead = 0 }
-  if (ahead === 0) return { ready: false, reason: `your node branch is 0 commits ahead of ${base} — nothing is committed to merge` }
+  if (ahead === 0) return { ready: false, reason: `your node branch is 0 commits ahead of ${base} — nothing is committed to merge (declaring \`done --propose nothing\` needs no commits ahead; use it to pause for the human)` }
   return { ready: true }
 }
 
@@ -1573,9 +2200,17 @@ function porcelainPath(line: string): string {
 // real product), not by a language-specific automated checker — so the gates stay language-agnostic (git +
 // the spec↔code graph, which every governed project has, TS or Python or otherwise). null when no session
 // has that id.
+// The measured-loss READOUT beside the git/graph gates. It grades nothing: no threshold, no pass/fail, no
+// block — the manager reads the four mutually exclusive scenario categories [[session-eval]] already folded
+// and decides. Its phase is part of the fact: a projection that has not been computed yet is NOT a clean
+// gate, so an absent/loading/updating/failed projection reports that phase and carries no numbers at all
+// rather than four honest-looking zeros.
+export type ReviewEvalFacts = { freshPass: number; freshFail: number; needReview: number; blind: number }
+export type ReviewEvalGate = ({ phase: 'ready' } & ReviewEvalFacts) | { phase: 'unavailable' | 'loading' | 'updating' | 'error' }
 export type ReviewGates = {
   conflictsWithMain: boolean                       // a dry-run merge into main would conflict (in-memory, safe)
   lint: { errorCount: number; warningCount: number } // the spec↔code graph lint
+  evals: ReviewEvalGate                            // [[session-eval]]'s already-computed scenario categories
 }
 export type ReviewPayload = {
   id: string; node: string | null; branch: string | null
@@ -1625,6 +2260,22 @@ async function lintGate(): Promise<ReviewGates['lint']> {
   return p
 }
 
+// @@@ evalGate - the cockpit's measured-loss readout, taken from [[session-eval]]'s EXISTING projection.
+// This is a cache READ and must stay one: buildSessionEvals() itself calls reviewPayload(), so building the
+// model from here would recurse. The import is dynamic for the same reason the lint gate's is — the eval
+// package imports this module, and the cockpit only needs it at call time.
+async function evalGate(id: string): Promise<ReviewEvalGate> {
+  const { sessionEvalProjection } = await import('../../spec-eval/src/sessioneval.js')
+  const projection = sessionEvalProjection(id)
+  if (!projection) return { phase: 'unavailable' }
+  // only a `ready` projection carries a CURRENT value; last-known is deliberately not reported as current.
+  if (projection.phase !== 'ready' || !projection.value) {
+    return { phase: projection.phase === 'ready' ? 'unavailable' : projection.phase }
+  }
+  const summary = projection.value
+  return { phase: 'ready', freshPass: summary.pass, freshFail: summary.fail, needReview: summary.review, blind: summary.blind }
+}
+
 // @@@ reviewPayload - assemble the cockpit review for one session. The four session-specific reads
 // (ahead / dirty / diff / conflict gate) plus the one location gate (lint) are all independent, so they run
 // in parallel. The lint gate goes through lintGate(), which memoizes it on the checkout's tree fingerprint —
@@ -1634,12 +2285,13 @@ export async function reviewPayload(id: string): Promise<ReviewPayload | null> {
   const wt = await findWorktree(id)
   if (!wt) return null
   const base = mainBranch()
-  const [aheadOut, statusOut, diff, conflictsWithMain, lint] = await Promise.all([
+  const [aheadOut, statusOut, diff, conflictsWithMain, lint, evals] = await Promise.all([
     gitA(['-C', wt.path, 'rev-list', '--count', `${base}..HEAD`]),
     gitA(['-C', wt.path, 'status', '--porcelain', '--untracked-files=all']),
     mergeBaseDiff(wt.path, base),
     mergeConflicts(wt.path, base),
     lintGate(),   // lint — memoized on the checkout fingerprint, not re-run per session/open
+    evalGate(id), // measured loss — a READ of the existing projection, never a build
   ])
   // the worktree carries no SpexCode runtime files any more (the store lives in ~/.spexcode), so every dirty
   // path is genuine work — this is just the total uncommitted count.
@@ -1649,7 +2301,7 @@ export async function reviewPayload(id: string): Promise<ReviewPayload | null> {
     label: deriveLabel({ id, name: wt.rec.name, node: wt.rec.node, title: wt.rec.title, branch: wt.branch }),
     ahead: Number(aheadOut.trim()) || 0,
     dirtyNonRuntime, diff,
-    gates: { conflictsWithMain, lint },
+    gates: { conflictsWithMain, lint, evals },
     proposal: { kind: wt.rec.proposal, note: wt.rec.note },
   }
 }
@@ -1658,16 +2310,21 @@ export async function reviewPayload(id: string): Promise<ReviewPayload | null> {
 // server git script: the agent knows the work, so IT runs the merge, resolves any conflicts, and VERIFIES the
 // outcome — the guarantee lives in that verification, never a server-side gate. This is also the ONE place the
 // merge STYLE is stated (no other mechanism carries it): a --no-ff merge commit `merge <branch>: <reason>`
-// into main. The agent runs git from the MAIN checkout (`-C <mainPath>`; its own cwd is the node worktree).
+// into main. The agent runs git from the MAIN checkout (`-C <mainPath>`; its own cwd is the node worktree) —
+// and that checkout is the fleet's ONE landing door, so the prompt orders the landing to be TRIVIAL by the
+// time it gets there: sync + resolve in the agent's own worktree, land only when `merge-base --is-ancestor`
+// says the branch already contains the base, wait (never abort) on someone else's in-progress merge. The
+// always-on half of that contract is the `atomic-landing` system plugin; this prompt is the per-merge half.
 // After a clean merge the branch is 0 ahead of main, so the agent proposes CLOSE — not merge (the commit gate
 // would block a merge proposal; propose-close is exempt) — and the human confirms the close.
 function mergePrompt(mainPath: string, branch: string, reason: string): string {
   const base = mainBranch()
-  return `Merge your branch \`${branch}\` into \`${base}\`, then propose close. You know this work, so resolve any conflicts yourself.\n\n` +
-    `1. Merge from the main checkout with a no-ff merge commit:\n   git -C ${mainPath} merge --no-ff -m "merge ${branch}: ${reason}" ${branch}\n` +
-    `2. If it conflicts, resolve the conflicts (you know the intent) and complete the merge commit. ` +
-    `3. Verify it landed: \`${base}\`'s HEAD must now be the new merge commit and no merge may be left in progress — if anything went half-merged, run \`git -C ${mainPath} merge --abort\` and report it rather than leaving \`${base}\` mid-state. ` +
-    `4. Once you've verified \`${base}\` advanced cleanly, propose close for the human — do NOT close it yourself.`
+  return `Merge your branch \`${branch}\` into \`${base}\`, then propose close. You know this work, so resolve any conflicts yourself — in YOUR OWN worktree, never in the shared ${base} checkout.\n\n` +
+    `1. Sync first, where you work: \`git merge ${base}\` INTO your branch, resolve every conflict here, and re-run what proves your work. The ${base} checkout is the fleet's ONE landing door — a merge that stops to ask about conflicts holds it for everyone.\n` +
+    `2. Land only a TRIVIAL merge: \`git -C ${mainPath} merge-base --is-ancestor ${base} ${branch}\` must exit 0 (your branch already contains ${base}) — then\n   git -C ${mainPath} merge --no-ff -m "merge ${branch}: ${reason}" ${branch}\n   If that check fails, ${base} moved while you tested: go back to step 1 instead of landing.\n` +
+    `3. A busy door is a wait, not a race: if the ${base} checkout is already mid-merge (an unresolved index), retry with a bounded wait — never abort or resolve someone else's in-progress merge. ` +
+    `4. Verify it landed: \`${base}\`'s HEAD must now be the new merge commit and no merge may be left in progress — if YOUR merge went half-merged, run \`git -C ${mainPath} merge --abort\` and report it rather than leaving \`${base}\` mid-state. ` +
+    `5. Once you've verified \`${base}\` advanced cleanly, propose close for the human — do NOT close it yourself.`
 }
 
 // @@@ mergeSession - the cockpit's ACT verb, the sequel to review — but a DISPATCH, not a server script: the
@@ -1679,7 +2336,7 @@ function mergePrompt(mainPath: string, branch: string, reason: string): string {
 // the main checkout, no worktree path needed). Async + fail-loud: returns {dispatched:true} once the prompt is
 // CONFIRMED accepted, else {dispatched:false, reason} (the loud DispatchResult error). The server no longer
 // re-checks gates, runs git, bumps `merges`, or closes the session — review shows the gates; the agent verifies.
-export async function mergeSession(id: string): Promise<{ dispatched: boolean; reason?: string }> {
+async function mergeSessionUnlocked(id: string): Promise<{ dispatched: boolean; reason?: string }> {
   const wt = await findWorktree(id)
   if (!wt || !wt.branch) return { dispatched: false, reason: 'no such session' }
   const branch = wt.branch, main = mainRoot()
@@ -1693,49 +2350,415 @@ export async function mergeSession(id: string): Promise<{ dispatched: boolean; r
   if (!r.ok) return { dispatched: false, reason: r.error }
   return { dispatched: true }
 }
+export const mergeSession = (id: string): Promise<{ dispatched: boolean; reason?: string }> =>
+  runSessionOperation({ op: 'merge-dispatch', sessionId: id }, () => mergeSessionUnlocked(id))
+
+// @@@ killAgentProcess - the pane is the agent's HOME, not its LEASH. `kill-session` SIGHUPs the pane's
+// process group, and an idle agent goes with it (measured: ~0.8s) — but one mid-turn can outlive the whole
+// tmux server and keep running, orphaned, still holding its rendezvous socket (measured: pane gone, server
+// gone, agent still answering). Close promises ZERO residue including the process tree, so the teardown
+// escalates on the pid launch registered for exactly this purpose: give the SIGHUP its moment, then SIGTERM,
+// then SIGKILL, each bounded. This is also what lets the socket sweep run at all — a still-answering listener
+// is never ours to unlink, so an un-killed agent would otherwise strand its own socket forever.
+// The escalation is IDENTITY-GUARDED: a recorded pid can have been recycled by an unrelated process, so we
+// signal only a pid whose argv still names THIS session. Unidentifiable → we signal nothing and let the
+// adapter's proof-of-death rule leave the transport alone; never a blind kill on a stale number.
+const AGENT_EXIT_GRACE_MS = 3000
+type LeafIdentity = { pid: number; startToken: string; ownerNeedle: string }
+async function killAgentProcess(id: string, beforeSignal: () => Promise<void>, leaf: LeafIdentity): Promise<void> {
+  const pid = readAgentPid(sessionArtifactPath(id, 'agent.pid'))
+  if (pid !== leaf.pid)
+    throw new ResourceConflict(`refusing to stop ${id}: session leaf identity changed before signal`)
+  if (!Number.isFinite(pid) || pid <= 0) return
+  const startToken = leaf.startToken
+  const alive = (): boolean => {
+    try { process.kill(pid, 0); return true } catch (e) { return (e as NodeJS.ErrnoException).code === 'EPERM' }
+  }
+  const identityState = (): 'same' | 'gone' | 'changed' => {
+    if (readAgentPid(sessionArtifactPath(id, 'agent.pid')) !== leaf.pid) return 'changed'
+    const current = processStartToken(pid)
+    if (!current) return alive() ? 'changed' : 'gone'
+    return current === startToken ? 'same' : 'changed'
+  }
+  const initialState = identityState()
+  if (initialState === 'gone') return
+  if (initialState === 'changed') throw new ResourceConflict(`refusing to stop ${id}: session leaf identity changed before signal`)
+  const gone = async (ms: number): Promise<boolean> => {
+    for (const end = Date.now() + ms; Date.now() < end;) {
+      if (!alive()) return true
+      await new Promise((r) => setTimeout(r, 100))
+    }
+    return !alive()
+  }
+  if (await gone(AGENT_EXIT_GRACE_MS)) return                        // the pane's SIGHUP took it — the normal path
+  const sameAgentInstance = async (): Promise<boolean> => {
+    if (processStartToken(pid) !== startToken) return false
+    const argv = await pexec('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8' }).then((r) => r.stdout).catch(() => '')
+    return argv.includes(leaf.ownerNeedle) && processStartToken(pid) === startToken
+  }
+  for (const sig of ['SIGTERM', 'SIGKILL'] as const) {
+    await beforeSignal()
+    const state = identityState()
+    if (state === 'gone') return
+    if (state === 'changed') throw new ResourceConflict(`refusing to stop ${id}: session leaf identity changed during escalation`)
+    if (!await sameAgentInstance()) throw new ResourceConflict(`refusing to stop ${id}: leaf PID ${pid}@${startToken} no longer proves ownership`)
+    try { process.kill(pid, sig) } catch { return }                  // vanished between checks
+    if (await gone(sig === 'SIGTERM' ? AGENT_EXIT_GRACE_MS : 1000)) return
+  }
+}
 
 // @@@ stopAgentProcess - the shared teardown both stop and close begin with, so there is ONE kill path, not
-// two: kill the agent's tmux client, drop its boot-window stamp (else a just-launched id lingers in the grace
-// window reading `starting` instead of `offline`), and ask the resolved adapter to sweep its ephemeral runtime
-// transport. Deliberately does NOT drainQueue — the caller drains once, after it has settled the worktree.
-async function stopAgentProcess(id: string): Promise<void> {
-  const rec = readRecord(id)
+// two: kill the agent's tmux client, make sure the agent itself actually went with it, drop its boot-window
+// stamp (else a just-launched id lingers in the grace window reading `starting` instead of `offline`), and ask
+// the resolved adapter to sweep its ephemeral runtime transport — in that order, because the adapter only
+// removes a transport whose listener is PROVEN dead.
+// Deliberately does NOT drainQueue — the caller drains once, after it has settled the worktree.
+async function assertSessionLeafOwned(id: string, rec: SessRec): Promise<LeafIdentity | null> {
+  const harness = harnessById(rec.harness || defaultHarness.id)
+  if (harness.runtimeOwnership === 'adapter') return null
+  // Prove the exact per-session leaf before the first tmux signal. Missing identity is acceptable only for a
+  // record-only/queued runtime; a live leaf without a matching pid/start/argv stays visible.
+  const pid = readAgentPid(sessionArtifactPath(id, 'agent.pid'))
+  if (!Number.isFinite(pid) || pid <= 0) {
+    if (rec.stopped || rec.status === 'queued') return null
+    throw new ResourceConflict(`refusing to stop ${id}: no readable session-owned leaf PID`)
+  }
+  const startToken = processStartToken(pid)
+  if (!startToken) {
+    if (rec.stopped) return null
+    throw new ResourceConflict(`refusing to stop ${id}: session-owned leaf PID ${pid} is not alive or has no start identity`)
+  }
+  const argv = await pexec('ps', ['-o', 'args=', '-p', String(pid)], { encoding: 'utf8' }).then((r) => r.stdout).catch(() => '')
+  const ownerNeedle = harness.leafOwnerNeedle?.(rec)
+  if (!ownerNeedle)
+    throw new ResourceConflict(`refusing to stop ${id}: no exact harness identity is registered for leaf PID ${pid}`)
+  if (!argv.includes(ownerNeedle) || processStartToken(pid) !== startToken)
+    throw new ResourceConflict(`refusing to stop ${id}: leaf PID ${pid}@${startToken} does not prove argv ownership`)
+  return { pid, startToken, ownerNeedle }
+}
+
+async function stopAgentProcess(id: string, rec: SessRec | null, requireCold = false): Promise<void> {
+  // The caller resolves one readable owner before entering this seam. An absent/corrupt record never reaches
+  // tmux, signals, or adapter cleanup: a bare session id is an address, not ownership authority.
+  const assertOwned = () => assertSessionStopSafe(id, rec ? { ...rec, harness: rec.harness } : null)
+  await assertOwned()
+  if (!rec) throw new ResourceConflict(`refusing to stop ${id}: no readable session owner`)
+  const harness = harnessById(rec.harness || defaultHarness.id)
+  const leaf = await assertSessionLeafOwned(id, rec)
+  // Adapter-owned headless sessions may have no live leaf PID, but launch still created an exact tmux session
+  // wrapper. Kill that session-id unconditionally; runtimeOwnership only changes the PID/argv proof, never the
+  // exact tmux teardown.
   await tmuxOk(['kill-session', '-t', id])
+  if (leaf) await killAgentProcess(id, assertOwned, leaf)
   launchedAt.delete(id)
-  harnessById(rec?.harness || defaultHarness.id).cleanupRuntime(rec ?? { session: id })
+  await harness.cleanupRuntime(rec)
+  if (requireCold) {
+    const cold = await harness.coldRuntime?.(rec)
+    if (cold && !cold.ok) throw new ResourceConflict(`refusing to archive ${id}: ${cold.reason}`)
+  }
 }
 
 // @@@ stopSession - the SOFT stop (vs closeSession's removal): stops the agent process but LEAVES the durable
-// worktree + branch + transcript intact. The session stays on the board, now reading `offline` (no tmux window)
-// whatever its lifecycle, so the relaunch panel offers to --resume the SAME conversation (see resumeSession). This is
+// worktree + branch + transcript intact. The retained record's explicit-stop marker makes liveness `offline`
+// whatever its lifecycle or adapter probe, so the relaunch panel offers to --resume the SAME conversation. This is
 // "step away, come back later"; closeSession is "discard this work". An offline session occupies no slot, so
 // the freed capacity drains a queued session next (drainQueue).
-export async function stopSession(id: string): Promise<boolean> {
-  const wt = await findWorktree(id)
-  await stopAgentProcess(id)
-  void drainQueue()   // a stop frees a slot — start the next queued session if any
+async function stopSessionUnlocked(id: string): Promise<boolean> {
+  let wt: { path: string; branch: string | null; rec: SessRec } | null
+  try { wt = await findWorktree(id) }
+  catch (e) {
+    if (!(e instanceof SessionRecordUnusable) || e.code !== 'corrupt') throw e
+    await stopAgentProcess(id, null)
+    throw e
+  }
+  if (!wt) return false
+  await stopAgentProcess(id, wt.rec)
+  const rec = readRecord(id)
+  if (rec) writeRecord({ ...rec, stopped: true })
+  requestQueueDrain()   // a stop frees a slot — start the next queued session if any
   return !!wt
 }
+export const stopSession = (id: string, opts: { authorization?: Authorization } = {}): Promise<boolean> =>
+  runSessionOperation({ op: 'stop', sessionId: id, ...(opts.authorization ? { authorization: opts.authorization } : {}) },
+    () => withSessionTransition(id, () => withRecordLock(id, () => stopSessionUnlocked(id))))
+
+// @@@ archiveSession - cold storage ([[archive]]): prove and stop the exact session-owned runtime first, then
+// write archived:true + stopped:true. The shared adapter root is never torn down. A guard/ownership failure
+// leaves the record unarchived and visible; no second cleanup primitive or fail-open record write exists.
+async function archiveSessionUnlocked(id: string, on = true): Promise<boolean> {
+  let wt: { path: string; branch: string | null; rec: SessRec } | null
+  try { wt = await findWorktree(id) }
+  catch (e) {
+    if (e instanceof SessionRecordUnusable) throw new ResourceConflict(`refusing to archive ${id}: ${e.message}`)
+    throw e
+  }
+  if (!wt) return false
+  if (!on) throw new ResourceConflict('unarchive is not a record-only transition; use resume to restore the runtime')
+  if (wt.rec.status === 'queued') throw new ResourceConflict(`refusing to archive ${id}: queued sessions have only a prepared launch prompt; resume/startQueued is their lifecycle`)
+  const retired = retirementReason(wt.rec)
+  if (retired) throw new ResourceConflict(`refusing to archive ${id}: ${retired}`)
+  archiving.add(id)
+  try {
+  const h = harnessById(wt.rec.harness || defaultHarness.id)
+  // A proven cold record is already archived; never clear it and issue a second thread/archive RPC. Verify the
+  // adapter's exact resident reference first so an externally respawned thread is repaired rather than hidden.
+  if (wt.rec.archived && hasValidColdProof(wt.rec)) {
+    const proofSnap = await liveSnapshot()
+    if (proofSnap.probeFailed) throw new ResourceConflict(`refusing to re-archive ${id}: liveness probe failed; the exact leaf may have respawned`)
+    const proofLv = h.runtimeOwnership === 'adapter'
+      ? (proofSnap.windows.has(id) ? 'online' : 'offline')
+      : liveness({ ...wt.rec, archived: false, stopped: false }, proofSnap)
+    if (proofLv === 'unknown' || proofLv === 'starting') throw new ResourceConflict(`refusing to re-archive ${id}: session liveness is ${proofLv}; exact cold state is unproven`)
+    if (proofLv === 'offline') {
+      // A deliberately stopped shared control plane is a valid empty resident census. A durable proof plus
+      // an adapter-owned root-absent fact is the only idempotent short-circuit; a live root still has to prove
+      // the thread's archived/non-archived disk collection before we can claim it is already cold.
+      const rootAbsent = await Promise.all((h.sharedRuntimes?.(runtimeRoot()) ?? []).map(async (descriptor) => {
+        if (!descriptor.residency) return false
+        const state = await descriptor.residency()
+        return state.healthy && state.rootAbsent === true && state.referenceIds.length === 0
+      })).then((states) => states.some(Boolean))
+      if (rootAbsent) return true
+      const pre = await h.coldPreflight?.({ ...wt.rec, archived: false, stopped: true })
+      if (!pre || pre.ok) {
+        const cold = await h.coldRuntime?.({ ...wt.rec, archived: false, stopped: true })
+        if (!cold || cold.ok) return true
+      }
+    }
+  }
+  // Legacy/respawned archives are made visible before repair. Any refusal below therefore leaves an unarchived
+  // row instead of relying on a hidden bit while a runtime proof is missing.
+  if (wt.rec.archived) {
+    writeRecord({ ...wt.rec, archived: false, coldProof: null })
+    wt = await findWorktree(id)
+    if (!wt) return false
+  }
+
+  const snap = await liveSnapshot()
+  if (snap.probeFailed) throw new ResourceConflict(`refusing to archive ${id}: liveness probe failed; the leaf may still be live`)
+  const lv = h.runtimeOwnership === 'adapter'
+    ? 'offline'
+    : liveness({ ...wt.rec, archived: false, stopped: false }, snap)
+  if (lv === 'unknown' || lv === 'starting')
+    throw new ResourceConflict(`refusing to archive ${id}: session liveness is ${lv}; exact leaf ownership is unproven`)
+  // The adapter guard runs BEFORE any tmux/process signal. Active/unknown Codex turns and owned descendants
+  // refuse here, leaving the leaf/shared root/record untouched; coldRuntime is the commit cleanup after this.
+  const preflight = await h.coldPreflight?.({ ...wt.rec, archived: false, stopped: lv === 'offline' })
+  if (preflight && !preflight.ok) throw new ResourceConflict(`refusing to archive ${id}: ${preflight.reason}`)
+  // Even a proven-offline leaf can leave a stale rendezvous/socket or adapter artifact. Reuse the same exact
+  // teardown seam with the explicit stopped marker so cleanupRuntime gets its ownership check and no second
+  // cleanup primitive is invented.
+  let coldCommitted = false
+  let coldAttempted = false
+  try {
+    coldAttempted = true
+    await stopAgentProcess(id, { ...wt.rec, archived: false, stopped: lv === 'offline' }, true)
+    coldCommitted = true
+    const latest = readRecord(id)
+    if (!latest) throw new ResourceConflict(`refusing to archive ${id}: session record disappeared before filing`)
+    const finalSnap = await liveSnapshot()
+    if (finalSnap.probeFailed) throw new ResourceConflict(`refusing to archive ${id}: final liveness probe failed; the leaf may still be live`)
+    const finalLv = h.runtimeOwnership === 'adapter'
+      ? (finalSnap.windows.has(id) ? 'online' : 'offline')
+      : liveness({ ...latest, archived: false, stopped: false }, finalSnap)
+    if (finalLv === 'unknown' || finalLv === 'starting' || finalLv === 'online')
+      throw new ResourceConflict(`refusing to archive ${id}: leaf became ${finalLv} before filing`)
+    writeRecord({ ...latest, archived: true, stopped: true, coldProof: coldProofFor(latest) })
+  } catch (error) {
+    if (coldCommitted) {
+      const restored = await h.restoreRuntime?.(wt.rec)
+      if (restored && !restored.ok) {
+        const current = readRecord(id)
+        if (current) writeRecord({ ...current, archived: false, stopped: true, coldProof: null, adapterRecovery: `restore-runtime:${restored.reason}` })
+        console.error(`spex: archive compensation for ${id} failed: ${restored.reason}`)
+      }
+    } else if (coldAttempted && error instanceof Error && /compensation failed|state is unknown|reconciliation failed/i.test(error.message)) {
+      const current = readRecord(id)
+      if (current) writeRecord({ ...current, archived: false, stopped: true, coldProof: coldProofFor(current), adapterRecovery: `restore-runtime:${error.message}` })
+    }
+    throw error
+  }
+  requestQueueDrain()
+  return true
+  } finally { archiving.delete(id) }
+}
+export const archiveSession = (id: string, on = true): Promise<boolean> => {
+  if (!on) return archiveSessionUnarchive(id)
+  return runSessionOperation({ op: 'archive', sessionId: id },
+    () => withSessionTransition(id, () => withRecordLock(id, () => archiveSessionUnlocked(id, on))))
+}
+async function archiveSessionUnarchive(id: string): Promise<boolean> {
+  const wt = await findWorktree(id)
+  if (!wt) return false
+  if (!wt.rec.archived) return true
+  const resumed = await resumeSession(id)
+  if (!resumed.ok) throw new ResourceConflict(resumed.error || `refusing to resume ${id}`)
+  return true
+}
+
+// @@@ cold retirement - archive already returned the target's runtime, so closing a proven-cold row must not
+// re-enter the live stop guard and make unrelated shared-root references prove ownership again. Verify only
+// that the target-bound cold proof is still current and that no target PID/window/socket/thread has reappeared.
+// This is read-only: no signal, adapter mutation, or shared-root cleanup belongs on the cold path.
+async function assertColdRetirementSafe(id: string, rec: SessRec): Promise<void> {
+  if (!rec.archived || !rec.stopped || !hasValidColdProof(rec))
+    throw new ResourceConflict(`refusing to close archived session ${id}: target-bound cold witness is missing or stale`)
+  if (rec.adapterRecovery)
+    throw new ResourceConflict(`refusing to close archived session ${id}: adapter recovery is pending (${rec.adapterRecovery})`)
+
+  const [snap, socket] = await Promise.all([liveSnapshot(), rendezvousListening(id)])
+  if (snap.probeFailed) throw new ResourceConflict(`refusing to close archived session ${id}: liveness probe failed; target runtime absence is unproven`)
+  if (snap.windows.has(id)) throw new ResourceConflict(`refusing to close archived session ${id}: target tmux window has reappeared`)
+  if (socket === 'live') throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous transport has reappeared`)
+  if (socket === 'unproven') throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous state is ambiguous`)
+  const pid = readAgentPid(sessionArtifactPath(id, 'agent.pid'))
+  if (Number.isFinite(pid) && pid > 0 && processStartToken(pid))
+    throw new ResourceConflict(`refusing to close archived session ${id}: target leaf PID ${pid} is live or recycled; ownership is ambiguous`)
+
+  const harness = harnessById(rec.harness || defaultHarness.id)
+  if (harness.coldRetirementPreflight) {
+    const proof = await harness.coldRetirementPreflight(rec)
+    if (!proof.ok) throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`)
+    return
+  }
+  const descriptors = harness.sharedRuntimes?.(runtimeRoot()) ?? []
+  let everySharedRootAbsent = descriptors.length > 0
+  for (const descriptor of descriptors) {
+    const resident: { healthy: boolean; referenceIds: string[]; error?: string; rootAbsent?: boolean } = descriptor.residency
+      ? await descriptor.residency()
+      : await descriptor.probe().then((probe) => ({ healthy: probe.healthy, referenceIds: probe.references.map((reference) => reference.referenceId), error: probe.error }))
+    if (!resident.healthy)
+      throw new ResourceConflict(`refusing to close archived session ${id}: ${resident.error || `${descriptor.label} resident census is unhealthy`}`)
+    if (rec.harnessSessionId && resident.referenceIds.includes(rec.harnessSessionId))
+      throw new ResourceConflict(`refusing to close archived session ${id}: target adapter thread ${rec.harnessSessionId} is loaded`)
+    everySharedRootAbsent = everySharedRootAbsent && resident.rootAbsent === true
+  }
+  if (harness.coldPreflight && !everySharedRootAbsent) {
+    const proof = await harness.coldPreflight(rec)
+    if (!proof.ok) throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`)
+    if (!proof.alreadyCold)
+      throw new ResourceConflict(`refusing to close archived session ${id}: target adapter collection is not proven cold`)
+  }
+}
+
+// A never-launched queue owns only prepared disk state. The transition/record locks around close serialize
+// this check with startQueued: whichever wins decides whether the record is still a queue or has become live.
+// No shared-runtime probe belongs here because a valid prepared row has no adapter thread to look up.
+async function assertQueuedRetirementSafe(id: string, rec: SessRec, path: string, branch: string | null): Promise<void> {
+  if (rec.status !== 'queued' || rec.harnessSessionId)
+    throw new ResourceConflict(`refusing to close queued session ${id}: the record has a target thread or is no longer queued`)
+  if (rec.adapterRecovery || launching.has(id))
+    throw new ResourceConflict(`refusing to close queued session ${id}: target launch/recovery is already in progress`)
+
+  const [snap, socket] = await Promise.all([liveSnapshot(), rendezvousListening(id)])
+  if (snap.probeFailed) throw new ResourceConflict(`refusing to close queued session ${id}: liveness probe failed; target runtime absence is unproven`)
+  if (snap.windows.has(id)) throw new ResourceConflict(`refusing to close queued session ${id}: target tmux window already exists`)
+  if (socket === 'live') throw new ResourceConflict(`refusing to close queued session ${id}: target rendezvous transport already exists`)
+  if (socket === 'unproven') throw new ResourceConflict(`refusing to close queued session ${id}: target rendezvous state is ambiguous`)
+  const pidPath = sessionArtifactPath(id, 'agent.pid')
+  if (existsSync(pidPath)) {
+    const pid = readAgentPid(pidPath)
+    throw new ResourceConflict(`refusing to close queued session ${id}: target leaf PID artifact ${Number.isFinite(pid) && pid > 0 ? pid : 'is unreadable'}; never-launched ownership is ambiguous`)
+  }
+
+  if (existsSync(path)) {
+    const status = await gitTry(['-C', path, 'status', '--porcelain', '--untracked-files=all'])
+    if (!status.ok) throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree status is unreadable`)
+    if (status.stdout.trim()) throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree has dirty work`)
+  }
+  if (branch) {
+    const resolved = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${branch}^{commit}`])
+    if (resolved.ok) {
+      const count = await gitTry(['-C', mainRoot(), 'rev-list', '--count', `${mainBranch()}..${branch}`])
+      if (!count.ok) throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch ancestry is unreadable`)
+      const ahead = Number(count.stdout.trim())
+      if (!Number.isFinite(ahead) || ahead !== 0)
+        throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch is ${Number.isFinite(ahead) ? ahead : 'an unknown number of'} commit(s) ahead`)
+    } else if (resolved.failure !== 'exit') {
+      throw new ResourceConflict(`refusing to close queued session ${id}: prepared branch identity is unreadable`)
+    } else if (existsSync(path)) {
+      throw new ResourceConflict(`refusing to close queued session ${id}: prepared worktree exists but branch ${branch} is missing`)
+    }
+  }
+}
 
-// @@@ closeSession - the REMOVAL (human-confirmed): stop's soft kill PLUS removing the worktree + branch AND
-// the session's whole global-store record dir — the work is gone, not just stopped. Same stop primitive as
-// stopSession (no duplicate kill path), then the git worktree/branch teardown that stop deliberately skips,
-// then the store sweep (stop KEEPS the record so the session stays on the board offline; close discards it).
+// @@@ closeSession - the REMOVAL (human-confirmed): a live row uses stop's exact kill, while a proven-cold
+// archive or never-launched queue uses its target-only read proof above. All then remove the worktree + branch and the session's whole
+// global-store record dir — the work is gone, not just stopped. The git/store teardown remains one path.
 // The tree's materialize slot ([[runtime]] trees/<enc>) retires with the worktree — its key needs the live tree,
 // so it is resolved BEFORE the removal; both sweeps are best-effort (residue is swept at uninstall anyway).
-export async function closeSession(id: string): Promise<boolean> {
-  const wt = await findWorktree(id)
-  await stopAgentProcess(id)
-  if (wt) {
-    let slot: string | null = null
-    try { slot = treeSlotDir(wt.path) } catch { /* tree already unresolvable — nothing to key the slot by */ }
-    await gitA(['-C', mainRoot(), 'worktree', 'remove', '--force', wt.path])
-    if (wt.branch) await gitA(['-C', mainRoot(), 'branch', '-D', wt.branch])
-    if (slot) { try { rmSync(slot, { recursive: true, force: true }) } catch { /* best-effort GC */ } }
-  }
-  try { rmSync(sessionStoreDir(id), { recursive: true, force: true }) } catch { /* best-effort sweep of the global record */ }
-  void drainQueue()   // a close frees a slot — start the next queued session if any
-  return !!wt
+// A corrupt record proves no adapter, leaf, worktree, or branch owner. Close may copy those bytes to the
+// control-plane quarantine, but then fails before this teardown seam and names every residue it preserved.
+async function closeSessionUnlocked(id: string): Promise<boolean> {
+  let wt: { path: string; branch: string | null; rec: SessRec } | null = null
+  try { wt = await findWorktree(id) }
+  catch (e) {
+    if (!(e instanceof SessionRecordUnusable) || e.code !== 'corrupt') throw e
+    const quarantined = quarantineRecord(id)
+    const runtime = sessionStoreDir(id)
+    const evidence = quarantined
+      ? `Original bytes were copied to ${quarantined}`
+      : `Original bytes remain at ${join(runtime, 'session.json')}; no quarantine copy could be made`
+    let guard = 'no readable session record proves the adapter or leaf owner'
+    try { await stopAgentProcess(id, null) }
+    catch (error) { guard = error instanceof Error ? error.message : String(error) }
+    throw new SessionRecordUnusable('corrupt', id,
+      `refusing destructive close for ${id}: the unreadable record proves no adapter, leaf, worktree, or branch owner (${guard}). ${evidence}. Runtime remains at ${runtime}; worktree and branch ownership is unknown and was not touched; no process signal or deletion was attempted.`)
+  }
+  if (!wt) return false
+  if (wt.rec.archived) await assertColdRetirementSafe(id, wt.rec)
+  else if (wt.rec.status === 'queued') await assertQueuedRetirementSafe(id, wt.rec, wt.path, wt.branch)
+  else await stopAgentProcess(id, wt.rec)
+  let slot: string | null = null
+  try { slot = treeSlotDir(wt.path) } catch { /* tree already unresolvable — nothing to key the slot by */ }
+  // a retired session's worktree/branch are already gone; removing them is a no-op to skip, not a failure.
+  if (existsSync(wt.path)) {
+    const removed = await gitTry(['-C', mainRoot(), 'worktree', 'remove', '--force', wt.path])
+    if (!removed.ok) throw new ResourceConflict(`refusing to finish close for ${id}: worktree removal failed`)
+    if (existsSync(wt.path)) throw new ResourceConflict(`refusing to finish close for ${id}: worktree remains after removal`)
+  }
+  if (wt.branch) {
+    const branchRef = `refs/heads/${wt.branch}`
+    const present = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', '--quiet', branchRef])
+    if (present.ok) {
+      const removed = await gitTry(['-C', mainRoot(), 'branch', '-D', wt.branch])
+      if (!removed.ok) throw new ResourceConflict(`refusing to finish close for ${id}: branch removal failed`)
+      const remaining = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', '--quiet', branchRef])
+      if (remaining.ok || remaining.failure !== 'exit') throw new ResourceConflict(`refusing to finish close for ${id}: branch remains or its removal is unproven`)
+    } else if (present.failure !== 'exit') {
+      throw new ResourceConflict(`refusing to finish close for ${id}: branch presence is unreadable`)
+    }
+  }
+  if (slot) { try { rmSync(slot, { recursive: true, force: true }) } catch { /* best-effort GC */ } }
+  try { rmSync(sessionStoreDir(id), { recursive: true, force: true }) }
+  catch (error) { throw new ResourceConflict(`refusing to finish close for ${id}: session record/prompt removal failed (${error instanceof Error ? error.message : String(error)})`) }
+  if (existsSync(sessionStoreDir(id))) throw new ResourceConflict(`refusing to finish close for ${id}: session record removal failed`)
+  requestQueueDrain()   // a close frees a slot — start the next queued session if any
+  return true
+}
+export const closeSession = (id: string): Promise<boolean> =>
+  runSessionOperation({ op: 'close', sessionId: id },
+    () => withSessionTransition(id, () => withRecordLock(id, () => closeSessionUnlocked(id))))
+
+// @@@ quarantine - closing sweeps the session's whole store dir, so an UNREADABLE record would take the only
+// evidence of what corrupted it with it. Copy those bytes to the per-project `corrupt/` shelf first, named by
+// session id and close time. Only unreadable records are shelved (a healthy one's contents are already known
+// and reproducible); the shelf is never read by the product, it is there for the human who asks "what broke?".
+function quarantineRecord(id: string): string | null {
+  let entry
+  try { entry = readRecordEntry(id) } catch { return null }   // unreadable for another reason (permissions) — leave it
+  if (entry.kind !== 'corrupt') return null
+  try {
+    const shelf = join(runtimeRoot(), 'corrupt')
+    mkdirSync(shelf, { recursive: true })
+    const dest = join(shelf, `${id}-${new Date().toISOString().replace(/[:.]/g, '-')}.json`)
+    writeFileSync(dest, readFileSync(entry.path))
+    console.error(`spex: session ${id.slice(0, 8)} had an unreadable record; its original bytes are preserved at ${dest}`)
+    return dest
+  } catch (e) {
+    console.error(`spex: could not quarantine the unreadable record for ${id}: ${e instanceof Error ? e.message : e}`)
+    return null
+  }
 }
 
 // @@@ captureSessionResult - the session's live pane as a one-shot snapshot (output), the server side of
@@ -1749,7 +2772,7 @@ export async function closeSession(id: string): Promise<boolean> {
 export type CaptureResult = { ok: true; pane: string } | { ok: false; reason: 'unknown' | 'offline' | 'capture-failed' }
 export async function captureSessionResult(id: string): Promise<CaptureResult> {
   if (!(await alive(id))) {
-    const known = (await listSessions()).some((s) => s.id === id)
+    const known = (await listSessions(true)).some((s) => s.id === id)
     return { ok: false, reason: known ? 'offline' : 'unknown' }
   }
   try { return { ok: true, pane: await tmux(['capture-pane', '-e', '-p', '-t', id]) } }
@@ -1768,9 +2791,11 @@ export async function captureSessionResult(id: string): Promise<CaptureResult> {
 export const STATUS_GLYPH: Record<DisplayStatus, string> = {
   working: '\u25cf', idle: '\u25cb', offline: '\u23fb', starting: '\u25d4', review: '\u25c6', done: '\u2713',
   'close-pending': '\u2715', parked: '\u29d6', error: '\u2717', asking: '\u2370', queued: '\u25cc', unknown: '\u2047',
+  corrupt: '\u26a0', retired: '\u2691',
 }
 const ANSI: Record<DisplayStatus, string> = {
   working: '33', idle: '90', offline: '90', starting: '36', review: '35', done: '34', 'close-pending': '31', parked: '36', error: '31', asking: '93', queued: '90', unknown: '93',
+  corrupt: '31', retired: '90',
 }
 
 // @@@ session selectors - the ONE matcher every session command shares (see [[session-selectors]]). A
@@ -1913,11 +2938,13 @@ export function launchEvent(s: Session): string {
   const asked = s.promptPreview ? ` · asked: ${s.promptPreview}` : ''
   return `[spex] launched · ${sessionLabel(s)} — act: capture | send "<msg>"${note}${asked}  [id ${s.id}]`
 }
-// @@@ source - the session board the poll reads. The CLI passes the BACKEND CLIENT (client.ts
-// clientListSessions), so `spex session watch` streams whatever backend SPEXCODE_API_URL points at — including a
-// REMOTE machine's. It is REQUIRED (no local default): a forgotten source must be a compile error, never a
-// silent in-process read of the wrong (local) board — the exact false-green the 2-machine test guards.
-export type WatchOpts = { source: () => Promise<Session[]>; selectors?: string[]; statuses?: string[]; includeIdle?: boolean; intervalMs?: number; as?: string; until?: { timeoutMs: number; onObserved?: (status: DisplayStatus, previous: DisplayStatus | null) => void } }
+// @@@ source/presenceSource - event population and existence truth are deliberately separate projections. The
+// broad CLI watch passes the default active-only source so it never enumerates the archive shelf, plus an
+// all-record `presenceSource` so a hidden archive is not mistaken for a removed worktree. An explicit selector
+// passes the all-record source for BOTH, allowing that one target's offline archive/resume transitions through.
+// Both are backend clients (client.ts), so `spex session watch` monitors the machine named by
+// SPEXCODE_API_URL; a forgotten source must be a compile error, never a silent local-board fallback.
+export type WatchOpts = { source: () => Promise<Session[]>; presenceSource?: () => Promise<Session[]>; selectors?: string[]; statuses?: string[]; includeIdle?: boolean; intervalMs?: number; as?: string; until?: { timeoutMs: number; onObserved?: (status: DisplayStatus, previous: DisplayStatus | null) => void } }
 // @@@ watch outcome - only the BOUNDED `until` mode resolves (that mode is what `spex session wait` runs on); a
 // plain watch (no `until`) streams forever and never resolves. The bound is what makes `wait` a one-shot
 // "block for a worker's NEXT transition, then exit" that is GUARANTEED to return. Bounded mode is
@@ -1937,7 +2964,7 @@ export type WatchOpts = { source: () => Promise<Session[]>; selectors?: string[]
 // supervisor must never be able to read a transport failure as a session state (issue #40).
 export type WatchOutcome = { reached: DisplayStatus; path: DisplayStatus[] } | { timedOut: true; path: DisplayStatus[] } | { gone: true; path: DisplayStatus[] } | { backendDown: string; kind: 'unreachable' | 'http' }
 export async function watchSessions(emit: (line: string) => void, opts: WatchOpts): Promise<WatchOutcome> {
-  const { source, selectors = [], statuses, includeIdle = false, intervalMs = 5000, as, until } = opts
+  const { source, presenceSource = source, selectors = [], statuses, includeIdle = false, intervalMs = 5000, as, until } = opts
   const tag = as ? `[${as}] ` : ''
   const prev = new Map<string, DisplayStatus>()
   const paths = new Map<string, DisplayStatus[]>()   // bounded mode: every status observed per target, arrival first
@@ -1950,14 +2977,19 @@ export async function watchSessions(emit: (line: string) => void, opts: WatchOpt
   let downMsg: string | null = null   // set while the backend is unreachable, cleared on a good poll; the deadline reports it
   for (;;) {
     try {
-      // EXISTENCE is the selector-matched board across ALL statuses — listSessions now lists every worktree
-      // that exists (a transient detail-read failure degrades a row, never drops it — see guardWorktree), so
-      // membership here IS the worktree's existence. The `statuses` filter governs only which TRANSITIONS we
-      // emit, never whether a session is present — using it for presence would read a status change out of the
-      // filtered set as a (false) removal.
-      const all = selectSessions(await source(), selectors)
+      // EVENTS come from the caller's chosen population (broad watch uses active-only; an explicit selector
+      // uses history). EXISTENCE always comes from the all-record presence source, so a cold archive can never
+      // look removed merely because the default event population hides it. The `statuses` filter governs only
+      // which transitions we emit, never whether a session is present.
+      const eventRows = await source()
+      // Explicit selector wait passes the same history function for both roles. Reuse that one snapshot so a
+      // single poll cannot combine two HTTP instants (or pay for the same request twice); broad watch supplies
+      // distinct function references because it genuinely needs active events plus all-record presence.
+      const presenceRows = presenceSource === source ? eventRows : await presenceSource()
+      const all = selectSessions(eventRows, selectors)
+      const presence = selectSessions(presenceRows, selectors)
       warnedDown = false; downMsg = null   // a successful poll re-arms the down-warning (and clears the deadline's down-report)
-      const ids = new Set(all.map((s) => s.id))
+      const ids = new Set(presence.map((s) => s.id))
       const passesStatus = (st: DisplayStatus) => !statuses?.length || statuses.includes(st)
       let edge: { status: DisplayStatus; path: DisplayStatus[] } | null = null
       for (const s of all) {
@@ -1993,7 +3025,7 @@ export async function watchSessions(emit: (line: string) => void, opts: WatchOpt
       // before we hand control back.
       if (until) {
         if (edge) return { reached: edge.status, path: edge.path }
-        if (!all.length) return { gone: true, path: anyPath() }
+        if (!presence.length) return { gone: true, path: anyPath() }
       }
     } catch (e) {
       // a backend error in the poll must NOT be swallowed AND must NOT emit a false `closed` for every session:
@@ -2027,7 +3059,7 @@ export async function watchSessions(emit: (line: string) => void, opts: WatchOpt
 // ok:false with a reason that propagates to the caller (API non-2xx, `spex session send`, the merge dispatch),
 // instead of reporting a false success. The harness is resolved from the record; an unknown id fails before any
 // harness transport is addressed. (The separate RAW nav-key channel keeps its own `tmux send-keys` path — see rawKey.)
-export async function sendText(id: string, text: string, from?: string, opts: { replyVia?: 'note' } = {}): Promise<DispatchResult> {
+async function sendTextUnlocked(id: string, text: string, from?: string, opts: { replyVia?: 'note' } = {}): Promise<DispatchResult> {
   if (!text) return { ok: false, error: 'empty prompt — nothing to dispatch' }
   const rec = readRecord(id)
   if (!rec) return { ok: false, error: `no session record for ${id} — prompt NOT delivered` }
@@ -2051,15 +3083,22 @@ export async function sendText(id: string, text: string, from?: string, opts: {
   if (r.ok) recordSent(id, text, from ?? null, prompt.replyVia)
   return r
 }
+export async function sendText(id: string, text: string, from?: string, opts: { replyVia?: 'note' } = {}): Promise<DispatchResult> {
+  // The record lock spans the delivery RPC. Archive preflight and leaf teardown cannot race a product turn
+  // start/steer/input from another CLI process and then discover it only after killing the pane.
+  return runSessionOperation({ op: 'send', sessionId: id }, () => withRecordLock(id, () => sendTextUnlocked(id, text, from, opts)))
+}
 
 // Hard interrupt is adapter-native control, distinct from stop's process teardown. A harness without a
 // confirmed native primitive refuses loudly; there is no signal/PTY fallback that could target the wrong turn.
 export async function interruptSession(id: string): Promise<DispatchResult> {
-  const rec = readRecord(id)
-  if (!rec) return { ok: false, error: `no session record for ${id} - nothing to interrupt` }
-  const h = harnessById(rec.harness || defaultHarness.id)
-  if (!h.interrupt) return { ok: false, error: `harness ${h.id} has no native hard-interrupt control` }
-  return h.interrupt({ ...rec, runtimeDir: runtimeRoot() })
+  return runSessionOperation({ op: 'interrupt', sessionId: id }, () => withRecordLock(id, async () => {
+    const rec = readRecord(id)
+    if (!rec) return { ok: false, error: `no session record for ${id} - nothing to interrupt` }
+    const h = harnessById(rec.harness || defaultHarness.id)
+    if (!h.interrupt) return { ok: false, error: `harness ${h.id} has no native hard-interrupt control` }
+    return h.interrupt({ ...rec, runtimeDir: runtimeRoot() })
+  }))
 }
 
 // @@@ rawKey - the RAW-KEYSTROKE nav path, kept DELIBERATELY on `tmux send-keys` and NEVER the rendezvous
@@ -2115,13 +3154,15 @@ function rawKeyArgs(id: string, key: string): string[] | null {
 // (browser + server + send-keys all parallel) and scramble the sequence; a single serialised batch cannot.
 // An unknown token is skipped without dropping the rest; false only if the tmux session is gone or nothing sent.
 export async function rawKey(id: string, key: string | string[]): Promise<boolean> {
-  const list = (Array.isArray(key) ? key : [key]).filter((k) => typeof k === 'string' && k.length > 0)
-  if (list.length === 0 || !(await alive(id))) return false
-  let sent = false
-  for (const k of list) {
-    const args = rawKeyArgs(id, k)
-    if (!args) continue
-    await tmux(args); sent = true
-  }
-  return sent
+  return runSessionOperation({ op: 'raw-key-input', sessionId: id }, () => withRecordLock(id, async () => {
+    const list = (Array.isArray(key) ? key : [key]).filter((k) => typeof k === 'string' && k.length > 0)
+    if (list.length === 0 || !(await alive(id))) return false
+    let sent = false
+    for (const k of list) {
+      const args = rawKeyArgs(id, k)
+      if (!args) continue
+      await tmux(args); sent = true
+    }
+    return sent
+  }))
 }