spexcode 0.6.7 → 0.7.0-next.0

package/node_modules/@spexcode/spec-cli/dist/sessions.js

@@ -1,31 +1,87 @@
-import { execFile, spawn } from 'node:child_process';
+import { execFile, execFileSync, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync, writeFileSync, appendFileSync, existsSync, renameSync, linkSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, unlinkSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, renameSync, linkSync, mkdirSync, rmSync, readdirSync, realpathSync, statSync, unlinkSync } from 'node:fs';
 import { join, dirname, isAbsolute, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { rm as rmAsync, readdir as readdirAsync } from 'node:fs/promises';
 import { seedWorktreeHostState } from './worktree-sources.js';
-import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, withGitAbortSignal, isGitObjectId } from '@spexcode/spec-core';
+import { git, gitA, gitTry, repoRoot, mergeBaseDiff, mergeConflicts, parseStatPath, withGitAbortSignal, isGitObjectId } from '@spexcode/spec-core';
 import { loadConfig, loadSpecs, loadSpecsLite } from '@spexcode/spec-core';
 import { adapterLoadedReferenceState, assertRvSockPath, defaultHarness, HARNESSES, sessionIdentityEnvVars, defaultLauncher, harnessById, procSnapshot, resolveLauncher, rendezvousListening, stampRvSock } from './harness.js';
 import { materialize } from './materialize.js';
 import { mainBranch, mainRoot, gitCommonDir, readConfig, runtimeRoot, treeSlotDir, sessionStoreDir, sessionRecordPath, sessionArtifactPath, listSessionIds, rawLaunchReadinessOriginal, readRecordEntry, readAliasedRecordEntry, readPublicRecordEntry, envSessionId, isSessionLifecycle, isSessionProposal } from '@spexcode/spec-core';
 import { readSessionFiles } from './session-files.js';
 import { readSessionWebs } from './session-web.js';
-import { acceptMessage, drain, recordStatus, lastHumanSendVia, owesDelivery, pendingMessages } from '@spexcode/session-core';
-import { pendingSnapshot, replacePendingWhileLocked, revokePendingFromWhileLocked, revokeSenderDelivery, withDeliveryLocks, trySessionRecordLockSync, withSessionRecordLock, withSessionRecordLockSync as coreWithSessionRecordLockSync } from '@spexcode/session-core/internal';
+import { acquireFreshSessionApplicationForCreate, configuredSessionApplicationIfCutover, initializeFreshSessionApplication, releaseFreshSessionApplicationForCreate, sessionApplicationCutoverState, setSessionApplicationCommitWake } from './session-application.js';
+import { jsonMigrationFencePath } from '@spexcode/session-application';
+import { withDeliveryLocks } from './delivery-lock.js';
+import { withSessionRecordLock, withSessionRecordLockSync as coreWithSessionRecordLockSync } from './session-record-lock.js';
 import { stripRefSigil } from './mentions.js';
 import { shQuote } from './sh.js';
 import { assertSessionOwnerSafe, assertSessionStopSafe, ResourceConflict } from './host-resources.js';
 import { processStartToken } from '@spexcode/spec-core';
-import { bindCodexGeneration, codexGenerationBindingForSession, commitCodexGenerationRegistration, prepareCodexGenerationClose, prepareCodexGenerationRegistration, readCodexGenerationLedger } from './codex-runtime-generations.js';
+import { bindCodexGeneration, codexGenerationBindingForSession, commitCodexGenerationRegistration, prepareCodexGenerationRegistration, readCodexGenerationLedger } from './codex-runtime-generations.js';
 import { cliEntrypointArgs } from './tsx-bin.js';
+import { lastHumanSendVia, recordStatus } from './session-timeline.js';
 const pexec = promisify(execFile);
 export const TMUX_SOCK = process.env.SPEXCODE_TMUX || 'spexcode';
 const DEFER_FOOTPRINT_REFRESH = { SPEXCODE_DEFER_FOOTPRINT_REFRESH: 'session-create' };
 const HARNESS = defaultHarness;
 const COLS = 120, ROWS = 32;
 const DEFAULT_MAX_ACTIVE = 8;
+const worktreeTrashDir = (root) => join(root, '.worktrees', '.trash');
+const pendingTrashDeletes = [];
+let trashDeleteRunning = false;
+let trashDeleteScheduled = false;
+async function drainWorktreeTrash() {
+    while (pendingTrashDeletes.length) {
+        const path = pendingTrashDeletes.shift();
+        try {
+            await rmAsync(path, { recursive: true, force: true });
+            if (existsSync(path))
+                throw new Error('path remains after recursive removal');
+        }
+        catch (error) {
+            console.error(`spex: deferred worktree deletion failed for ${path}; retained for next backend startup: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+    trashDeleteRunning = false;
+}
+function queueWorktreeTrash(path) {
+    pendingTrashDeletes.push(path);
+    if (trashDeleteRunning || trashDeleteScheduled)
+        return;
+    trashDeleteScheduled = true;
+    setImmediate(() => {
+        trashDeleteScheduled = false;
+        trashDeleteRunning = true;
+        void drainWorktreeTrash();
+    });
+}
+/** Start the one process-local serial reaper and resume any crash leftovers. */
+export function startWorktreeTrashReaper() {
+    const dir = worktreeTrashDir(mainRoot());
+    readdirAsync(dir, { withFileTypes: true }).then((entries) => {
+        for (const entry of entries)
+            queueWorktreeTrash(join(dir, entry.name));
+    }).catch((error) => {
+        if (error?.code !== 'ENOENT')
+            console.error(`spex: deferred worktree trash cleanup failed for ${dir}; retrying next startup: ${error instanceof Error ? error.message : error}`);
+    });
+}
+function moveWorktreeToTrash(root, path) {
+    const worktrees = resolve(join(root, '.worktrees'));
+    const source = resolve(path);
+    // Session creation uses <root>/.worktrees/<name>. Keep an adjacent trash for legacy/manual records whose
+    // recorded path predates that layout; the normal product path always lands in the governed .worktrees/.trash.
+    const parent = dirname(source);
+    const dir = parent === worktrees ? worktreeTrashDir(root) : join(parent, '.trash');
+    mkdirSync(dir, { recursive: true });
+    const target = join(dir, `wt-${Date.now()}-${randomUUID().slice(0, 12)}`);
+    renameSync(source, target);
+    return target;
+}
 function maxActive() {
     let v;
     try {
@@ -47,7 +103,7 @@ function maxActive() {
 // propagated when set, because the session inherits the tmux SERVER's env (not the backend's), so without this
 // an overridden home would silently leak the session's hook-state + codex-trust to the default ~/.spexcode /
 // ~/.codex. Deterministic: the session's store = the backend's store, never the ambient env's.
-const rvEnv = (id, harness = HARNESS) => {
+const rvEnv = (id, harness = HARNESS, nativeStartToken) => {
     // SPEXCODE_SESSION_ID is the governed record id, and it is the SESSION'S OWN — so the launch STRIPS every
     // session-identity variable it may have inherited (the pane inherits the tmux SERVER's env, which may carry
     // a foreign session's ids from whoever started it) before setting this one. Identity is established HERE,
@@ -65,9 +121,15 @@ const rvEnv = (id, harness = HARNESS) => {
         `SPEXCODE_SESSION_ID=${id}`,
         `SPEXCODE_SESSION_IDENTITY_VARS=${shQuote(sessionIdentityEnvVars().join(','))}`,
         `SPEXCODE_PROJECT_ROOT=${shQuote(mainRoot())}`,
+        ...(nativeStartToken ? [`SPEXCODE_NATIVE_START_TOKEN=${shQuote(nativeStartToken)}`] : []),
         ...harness.launchEnv(id), ...homeVars].join(' ');
 };
 const PROPOSAL_STATUS = { merge: 'review', nothing: 'done', close: 'close-pending' };
+// Awaiting is the durable lifecycle row; its proposal selects the user-facing display status. Keep this
+// projection in the session package so backend reconciliation and offline client reads cannot drift apart.
+export function displayStatusForProposal(proposal) {
+    return PROPOSAL_STATUS[proposal ?? 'nothing'];
+}
 function normalizeCloseSource(raw) {
     if (raw == null)
         return { kind: 'user' };
@@ -80,64 +142,6 @@ function normalizeCloseSource(raw) {
         return { kind: 'unverified-session-claim', id: source.id.trim() };
     throw new ResourceConflict('refusing session close: source must be user or an unverified session claim');
 }
-function appendCloseLedger(id, rec, source) {
-    const path = join(runtimeRoot(), 'session-close-ledger.ndjson');
-    const event = {
-        version: 1,
-        action: 'close-authorized',
-        at: new Date().toISOString(),
-        source,
-        target: {
-            id,
-            harness: rec.harness,
-            thread: rec.harnessSessionId,
-            worktree: rec.worktreePath,
-            branch: rec.branch,
-        },
-    };
-    appendFileSync(path, `${JSON.stringify(event)}\n`);
-}
-export function findSessionClosure(selector) {
-    const query = stripRefSigil(selector).trim();
-    if (!query)
-        return null;
-    const path = join(runtimeRoot(), 'session-close-ledger.ndjson');
-    let text;
-    try {
-        text = readFileSync(path, 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-    const matches = new Map();
-    for (const line of text.split('\n')) {
-        if (!line.trim())
-            continue;
-        let event;
-        try {
-            event = JSON.parse(line);
-        }
-        catch {
-            throw new ResourceConflict('session close history is unreadable');
-        }
-        if (!event || typeof event !== 'object' || event.action !== 'close-authorized')
-            continue;
-        const target = event.target;
-        const id = target && typeof target === 'object' ? target.id : undefined;
-        const closedAt = event.at;
-        if (typeof id !== 'string' || !id || typeof closedAt !== 'string' || !closedAt)
-            throw new ResourceConflict('session close history is malformed');
-        if (id === query || id.startsWith(query))
-            matches.set(id, { id, closedAt });
-    }
-    if (!matches.size)
-        return null;
-    if (matches.size > 1)
-        throw new ResourceConflict(`close history for ${query} is ambiguous: ${[...matches.keys()].map((id) => id.slice(0, 8)).join(', ')}`);
-    return [...matches.values()][0];
-}
 function storeDir(id) { const d = sessionStoreDir(id); mkdirSync(d, { recursive: true }); return d; }
 function writePromptFile(id, prompt) {
     try {
@@ -245,19 +249,57 @@ export function canDrainQueued(rec, authority = backendLaunchAuthority()) {
     return rec.status === 'queued' && !rec.stopped && (rec.launchOwner === null || rec.launchOwner === authority);
 }
 // typed read of a session's record from the global store (null if it has none — a self-launched session that
-// only ever wrote spec-discipline sentinels has a store dir but no session.json). Goes through layout's
+// only ever wrote spec-discipline sentinels has a store dir but no runtime.json). Goes through layout's
 // readAliasedRawRecord (the seam that owns the path + the codex-thread-id alias), then validates the loose
 // on-disk fields into the typed shape — so a codex hook resolving by its thread id reaches the real record.
 function readRecord(id) {
     const entry = readAliasedRecordEntry(id);
-    if (entry.kind === 'absent')
-        return null;
+    if (entry.kind === 'absent') {
+        // A migrated session may retain its canonical application row after an envelope was removed or never
+        // materialized. Lifecycle hooks must still reach that row; do not turn missing runtime metadata into a
+        // silent "not governed" result. The minimal projection deliberately carries no guessed resource identity.
+        const application = configuredSessionApplicationIfCutover();
+        const state = application?.readState(id);
+        if (!state)
+            return null;
+        return {
+            session: id,
+            governed: true,
+            worktreePath: '', branch: null, node: null, title: null, name: null, parent: state.parentSessionId,
+            status: state.status,
+            proposal: isSessionProposal(state.proposal) ? state.proposal : null,
+            merges: 0, note: state.note, sortKey: null, createdAt: state.updatedAtMs,
+            harness: 'claude', harnessSessionId: null, runtimeStartToken: null,
+            stopped: false, archived: false, closedAt: null, coldProof: null, adapterRecovery: null,
+            launcher: null, launchCmd: null, launchOwner: null, launchReadinessStartedAt: null,
+            createRequestId: null, createPayloadHash: null, zcodeChildSessionIds: [], base: null,
+            diffComments: [], launchReadinessPending: null,
+        };
+    }
     if (entry.kind === 'corrupt')
         throw new SessionRecordUnusable('corrupt', id, corruptReason(entry));
     try {
-        return fromRaw(entry.raw);
+        const record = fromRaw(entry.raw);
+        // After cutover, runtime.json is only the runtime/worktree envelope. Lifecycle is owned by the
+        // session application. Overlaying here keeps every internal caller on the same fact instead of
+        // letting a stale JSON snapshot steer a launch, close, or hook decision.
+        const application = configuredSessionApplicationIfCutover();
+        if (!application || !record.governed)
+            return record;
+        const state = application.readState(record.session);
+        if (!state)
+            throw new ResourceConflict(`session ${record.session} has no canonical application state after JSON cutover`);
+        return {
+            ...record,
+            status: state.status,
+            proposal: isSessionProposal(state.proposal) ? state.proposal : null,
+            note: state.note,
+            parent: state.parentSessionId,
+        };
     }
     catch (error) {
+        if (error instanceof ResourceConflict)
+            throw error;
         throw new SessionRecordUnusable('corrupt', id, `session record is unreadable: ${sessionRecordPath(id)} — ${error instanceof Error ? error.message : String(error)}. The file is kept as-is; nothing will rewrite it.`);
     }
 }
@@ -275,7 +317,9 @@ const corruptReason = (e) => `session record is unreadable: ${e.path} — ${e.er
 function retirementReason(rec) {
     if (!rec.worktreePath || existsSync(rec.worktreePath))
         return null;
-    return `session ${rec.session.slice(0, 8)} is retired: its worktree ${rec.worktreePath} no longer exists, so it cannot work, be marked active/idle, or be relaunched. Close it (\`spex session close <id>\`) to drop the record.`;
+    if (rec.archived)
+        return `session ${rec.session.slice(0, 8)} is closed and read-only: its worktree ${rec.worktreePath} no longer exists`;
+    return `session ${rec.session.slice(0, 8)} is retired: its worktree ${rec.worktreePath} no longer exists, so it cannot work, be marked active/idle, or be relaunched`;
 }
 function readLiveRecord(id) {
     const rec = readRecord(id);
@@ -291,22 +335,6 @@ export function withSessionRecordLockSync(id, body) {
     return coreWithSessionRecordLockSync(id, body);
 }
 const withRecordLockSync = withSessionRecordLockSync;
-// Synchronous terminal input is another product turn-entry path. The PTY bridge uses this narrow seam to
-// enqueue input while holding the same durable record lock as archive, so an archive preflight cannot pass idle
-// and then race a just-queued TUI turn.
-export function withSessionInputLock(id, body) {
-    // PTY input is synchronous. A single non-blocking open is the only safe barrier: EEXIST rejects this input
-    // regardless of owner PID, so a same-process async archive can never be frozen behind Atomics.wait.
-    const release = trySessionRecordLockSync(id);
-    if (!release)
-        return null;
-    try {
-        return body();
-    }
-    finally {
-        release();
-    }
-}
 const COLD_PROOF_VERSION = 'cold-v1';
 function coldProofFor(rec) {
     const adapter = harnessById(rec.harness || defaultHarness.id).id;
@@ -332,6 +360,9 @@ export function fromRaw(raw) {
     if (pendingRaw && !pendingStatus)
         throw new Error(`session '${raw.session_id}' launch readiness original has invalid lifecycle '${pendingRaw.status}'`);
     const pendingProposal = pendingRaw && isSessionProposal(pendingRaw.proposal) ? pendingRaw.proposal : null;
+    if (raw.closed_at != null && raw.closed_at !== ''
+        && (typeof raw.closed_at !== 'string' || !Number.isFinite(Date.parse(raw.closed_at))))
+        throw new Error(`session '${raw.session_id}' has invalid closed_at`);
     if (pendingRaw?.proposal && !pendingProposal)
         throw new Error(`session '${raw.session_id}' launch readiness original has invalid proposal '${pendingRaw.proposal}'`);
     const zcodeChildSessionIds = raw.zcode_child_session_ids ?? [];
@@ -339,6 +370,18 @@ export function fromRaw(raw) {
         || zcodeChildSessionIds.some((id) => typeof id !== 'string' || !id || id.trim() !== id)
         || new Set(zcodeChildSessionIds).size !== zcodeChildSessionIds.length)
         throw new Error(`session '${raw.session_id}' has invalid zcode_child_session_ids`);
+    const diffComments = raw.diff_comments ?? [];
+    if (!Array.isArray(diffComments) || diffComments.some((comment) => !comment || typeof comment !== 'object'))
+        throw new Error(`session '${raw.session_id}' has invalid diff_comments`);
+    const parsedDiffComments = diffComments.map((comment) => {
+        const c = comment;
+        if (!c.id || typeof c.id !== 'string' || typeof c.file_path !== 'string' || !c.file_path
+            || !Number.isInteger(c.line_start) || c.line_start < 1 || !Number.isInteger(c.line_end) || c.line_end < c.line_start
+            || typeof c.body !== 'string' || !c.body.trim() || typeof c.diff_identity !== 'string'
+            || !(c.sent_at === null || typeof c.sent_at === 'string'))
+            throw new Error(`session '${raw.session_id}' has invalid diff comment`);
+        return { id: c.id, filePath: c.file_path, lineStart: c.line_start, lineEnd: c.line_end, body: c.body, diffIdentity: c.diff_identity, sentAt: c.sent_at };
+    });
     return {
         session: raw.session_id, governed: !!raw.governed, worktreePath: raw.worktree_path || '', branch: raw.branch || null,
         node: raw.node || null, title: raw.title || null, name: raw.name || null, parent: raw.parent || null,
@@ -346,23 +389,30 @@ export function fromRaw(raw) {
         note: raw.note || null, sortKey, createdAt: Number(raw.createdAt) || 0,
         harness: raw.harness || 'claude', // records written before the harness field default to claude
         harnessSessionId: raw.harness_session_id || null,
+        runtimeStartToken: raw.runtime_start_token || null,
         stopped: !!raw.stopped, // records written before explicit stop tracking were not stopped
-        archived: !!raw.archived, // records written before archive → absent → not shelved
+        archived: !!raw.archived, // records written before close retention → absent → working
+        closedAt: typeof raw.closed_at === 'string' && raw.closed_at ? raw.closed_at : null,
         coldProof: raw.cold_proof || null, // legacy archived rows have no proof and remain visible until re-archived
         adapterRecovery: raw.adapter_recovery || null,
         launcher: raw.launcher || null, // records written before launchers → null → old-record fallback
         launchCmd: raw.launch_cmd || null, // records written before the pin → null → fall back to launcher name / ambient
         launchOwner: launchOwner || null,
+        launchReadinessStartedAt: Number.isFinite(Number(raw.launch_readiness_started_at))
+            ? Number(raw.launch_readiness_started_at) : null,
         createRequestId: raw.create_request_id || null,
         createPayloadHash: raw.create_payload_hash || null,
         zcodeChildSessionIds: [...zcodeChildSessionIds],
         base: raw.base || null, // records written before pinned bases → null → the source-of-truth branch
+        forkCommit: raw.fork_commit || null, // records written before the fork commit → null → recovered from the branch reflog
+        diffComments: parsedDiffComments,
         launchReadinessPending: pendingRaw ? {
             version: 1,
             startedAt: raw.launch_readiness_pending.startedAt,
             original: {
                 status: pendingStatus, proposal: pendingProposal, note: pendingRaw.note || null,
                 stopped: pendingRaw.stopped, archived: pendingRaw.archived,
+                closedAt: pendingRaw.closed_at || null,
                 coldProof: pendingRaw.cold_proof || null, adapterRecovery: pendingRaw.adapter_recovery || null,
             },
         } : null,
@@ -382,6 +432,7 @@ function launchReadinessPending(original) {
             note: original.note,
             stopped: original.stopped,
             archived: original.archived,
+            closedAt: original.closedAt,
             coldProof: original.coldProof ?? null,
             adapterRecovery: original.adapterRecovery ?? null,
         },
@@ -392,12 +443,42 @@ function restoreLaunchReadinessOriginal(rec) {
     return original ? { ...rec, ...original, launchReadinessPending: null } : rec;
 }
 // Rebuild the full disk projection so retired keys disappear on the next write.
+function assertLegacyJsonWritesAllowed() {
+    const fence = jsonMigrationFencePath(join(runtimeRoot(), 'sessions'));
+    if (existsSync(fence) && !configuredSessionApplicationIfCutover()) {
+        throw new ResourceConflict(`legacy JSON session store is fenced for one-time migration: ${fence}`);
+    }
+}
 function writeRecord(rec) {
+    assertLegacyJsonWritesAllowed();
+    const application = configuredSessionApplicationIfCutover();
+    // The JSON file is runtime/worktree metadata after cutover, not a lifecycle store. Once the canonical row
+    // exists, omit the four old lifecycle keys entirely; retaining them would leave a second apparent fact for
+    // readers and tempt a future path to trust the wrong writer. New records still need the legacy shape until
+    // their canonical row is created, and non-governed external runtime records keep their own contract.
+    const envelope = application && rec.governed ? readAliasedRecordEntry(rec.session) : null;
+    const canonicalMetadataOnly = envelope?.kind === 'ok' && rec.governed && !!application;
+    const lifecycle = { status: rawLifecycleStatus(rec), proposal: rec.proposal, note: rec.note, parent: rec.parent };
+    // A queued legacy envelope may still carry its lease until this metadata rewrite. The lease is an
+    // operational launch claim, not a lifecycle fact, so preserve only that field while the typed record clears it.
+    const envelopeLaunchOwner = envelope?.kind === 'ok'
+        ? envelope.raw.launch_owner?.trim() || null
+        : null;
     let previous = null;
     try {
         previous = readRecord(rec.session);
     }
     catch { /* a new or damaged record has no prior transition */ }
+    const metadataChanged = !previous || [
+        'governed', 'worktreePath', 'branch', 'node', 'title', 'name', 'merges', 'sortKey', 'createdAt',
+        'harness', 'harnessSessionId', 'runtimeStartToken', 'stopped', 'archived', 'closedAt', 'coldProof',
+        'adapterRecovery', 'launcher', 'launchCmd', 'launchOwner', 'launchReadinessStartedAt', 'createRequestId',
+        'createPayloadHash', 'zcodeChildSessionIds', 'base', 'forkCommit', 'diffComments', 'launchReadinessPending',
+    ].some((key) => JSON.stringify(previous[key]) !== JSON.stringify(rec[key]));
+    // Once a canonical row exists, a lifecycle-only write is already complete when the application transition
+    // commits. Rewriting runtime.json here would recreate a second, stale status/proposal/note authority.
+    if (canonicalMetadataOnly && previous && !metadataChanged)
+        return;
     const obj = {
         session_id: rec.session,
         governed: rec.governed,
@@ -406,28 +487,37 @@ function writeRecord(rec) {
         node: rec.node ?? '',
         title: rec.title ?? '',
         name: rec.name ?? '',
-        parent: rec.parent ?? '',
-        status: rawLifecycleStatus(rec),
-        proposal: rec.proposal ?? '',
         merges: rec.merges,
-        note: rec.note ?? '',
         sortkey: rec.sortKey ?? '',
         createdAt: rec.createdAt,
         harness: rec.harness || 'claude',
         harness_session_id: rec.harnessSessionId ?? '',
         stopped: rec.stopped,
         archived: rec.archived,
+        // Pre-field records stay byte-shape compatible until a real close publishes the timestamp. In particular,
+        // a failed resume must be able to restore an old working record without inventing an empty metadata key.
+        ...(rec.closedAt ? { closed_at: rec.closedAt } : {}),
         cold_proof: rec.coldProof ?? '',
         adapter_recovery: rec.adapterRecovery ?? '',
         launcher: rec.launcher ?? '',
         launch_cmd: rec.launchCmd ?? '',
-        launch_owner: rec.status === 'queued' ? rec.launchOwner ?? '' : '',
+        launch_owner: (lifecycle.status === 'queued' || lifecycle.status === OWNED_QUEUE_RAW_STATUS)
+            ? rec.launchOwner ?? envelopeLaunchOwner ?? '' : '',
+        ...(rec.launchReadinessStartedAt ? { launch_readiness_started_at: rec.launchReadinessStartedAt } : {}),
+        ...(rec.runtimeStartToken ? { runtime_start_token: rec.runtimeStartToken } : {}),
         create_request_id: rec.createRequestId ?? '',
         create_payload_hash: rec.createPayloadHash ?? '',
         ...(rec.zcodeChildSessionIds?.length ? { zcode_child_session_ids: rec.zcodeChildSessionIds } : {}),
         // Written only when the creator pinned one: an unpinned record keeps its exact legacy bytes, so a
         // restore-the-frozen-record path stays byte-identical instead of silently gaining a key.
         ...(rec.base ? { base: rec.base } : {}),
+        // The commit `git worktree add` actually started from, written on every create since it was introduced.
+        // Conditional like `base` above, so a record written before it keeps its exact legacy bytes.
+        ...(rec.forkCommit ? { fork_commit: rec.forkCommit } : {}),
+        ...((rec.diffComments ?? []).length ? { diff_comments: (rec.diffComments ?? []).map((comment) => ({
+                id: comment.id, file_path: comment.filePath, line_start: comment.lineStart, line_end: comment.lineEnd,
+                body: comment.body, diff_identity: comment.diffIdentity, sent_at: comment.sentAt,
+            })) } : {}),
         launch_readiness_pending: rec.launchReadinessPending ? {
             version: 1,
             startedAt: rec.launchReadinessPending.startedAt,
@@ -437,104 +527,62 @@ function writeRecord(rec) {
                 note: rec.launchReadinessPending.original.note ?? '',
                 stopped: rec.launchReadinessPending.original.stopped,
                 archived: rec.launchReadinessPending.original.archived,
+                closed_at: rec.launchReadinessPending.original.closedAt,
                 cold_proof: rec.launchReadinessPending.original.coldProof ?? '',
                 adapter_recovery: rec.launchReadinessPending.original.adapterRecovery ?? '',
             },
         } : '',
+        ...(canonicalMetadataOnly ? {} : {
+            parent: lifecycle.parent ?? '',
+            status: lifecycle.status,
+            proposal: lifecycle.proposal ?? '',
+            note: lifecycle.note ?? '',
+        }),
     };
     const dir = sessionStoreDir(rec.session);
     mkdirSync(dir, { recursive: true });
     const path = sessionRecordPath(rec.session);
-    const tmp = join(dir, `.session.json.${process.pid}.tmp`);
+    const tmp = join(dir, `.runtime.json.${process.pid}.tmp`);
     writeFileSync(tmp, JSON.stringify(obj, null, 2) + '\n');
     renameSync(tmp, path); // atomic within the dir: a concurrent reader sees the old record or the new one
     const previousPublic = previous ? publicRecord(previous) : null;
     const nextPublic = publicRecord(rec);
-    if (rec.governed && previousPublic && (previousPublic.status !== nextPublic.status
+    if (!application && rec.governed && previousPublic && (previousPublic.status !== nextPublic.status
         || previousPublic.proposal !== nextPublic.proposal || previousPublic.note !== nextPublic.note)) {
         recordStatus(rec.session, nextPublic.status, nextPublic.proposal, nextPublic.note);
         scheduleWatchNotifications(rec);
     }
 }
-const watchPath = (target) => sessionArtifactPath(target, 'watchers.json');
-function readWatchEntries(target) {
-    try {
-        const raw = JSON.parse(readFileSync(watchPath(target), 'utf8'));
-        if (!Array.isArray(raw))
-            return [];
-        const parent = readRecord(target)?.parent ?? '';
-        const seen = new Set();
-        return raw.flatMap((entry) => {
-            if (!entry || typeof entry !== 'object')
-                return [];
-            const watcher = entry.watcher;
-            const createdAt = entry.createdAt;
-            if (!watcher || typeof watcher !== 'string' || typeof createdAt !== 'string' || seen.has(watcher))
-                return [];
-            seen.add(watcher);
-            const rawSources = entry.sources;
-            const sources = Array.isArray(rawSources)
-                ? [...new Set(rawSources.filter((source) => source === 'manual' || source === 'parent'))]
-                // The former one-source format cannot name an origin. Its child pointer is the only durable witness
-                // that this watcher was installed for parent supervision; every other legacy row is a manual watch.
-                : [watcher === parent ? 'parent' : 'manual'];
-            const snapshotPending = entry.snapshotPending;
-            return sources.length ? [{ watcher, createdAt, sources,
-                    ...(sources.includes('parent') && typeof snapshotPending === 'string' && snapshotPending ? { snapshotPending } : {}),
-                }] : [];
-        });
-    }
-    catch {
+function canonicalWatchEntries(target) {
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        return null;
+    if (!application.readState(target))
         return [];
-    }
-}
-function writeWatchEntries(target, entries) {
-    const path = watchPath(target);
-    if (!entries.length) {
-        try {
-            unlinkSync(path);
+    const seen = new Map();
+    for (const edge of application.topology.parents(target)) {
+        if (edge.relationType !== 'parent' && !edge.relationType.startsWith('watch'))
+            continue;
+        const source = edge.relationType === 'parent' || edge.relationType === 'watch:parent' ? 'parent' : 'manual';
+        const current = seen.get(edge.fromSessionId);
+        if (current) {
+            if (!current.sources.includes(source))
+                current.sources.push(source);
+            continue;
         }
-        catch { /* already absent */ }
-        ;
-        return;
+        seen.set(edge.fromSessionId, {
+            watcher: edge.fromSessionId,
+            createdAt: new Date(edge.createdAtMs).toISOString(),
+            sources: [source],
+        });
     }
-    const dir = sessionStoreDir(target);
-    mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `.watchers.json.${process.pid}.tmp`);
-    writeFileSync(tmp, JSON.stringify(entries, null, 2) + '\n');
-    renameSync(tmp, path);
-}
-function addWatchSource(entries, watcher, source, deferInitialSnapshot = false) {
-    const existing = entries.find((entry) => entry.watcher === watcher);
-    const snapshotPending = deferInitialSnapshot && !existing?.sources.includes('manual') ? randomUUID() : undefined;
-    if (!existing)
-        return { entries: [...entries, {
-                    watcher, createdAt: new Date().toISOString(), sources: [source], ...(snapshotPending ? { snapshotPending } : {}),
-                }], added: true };
-    if (existing.sources.includes(source))
-        return { entries, added: false };
-    return {
-        entries: entries.map((entry) => entry === existing ? {
-            ...entry, sources: [...entry.sources, source], ...(snapshotPending ? { snapshotPending } : {}),
-        } : entry),
-        added: true,
-    };
+    return [...seen.values()].sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.watcher.localeCompare(b.watcher));
 }
-function removeWatchSource(entries, watcher, source) {
-    let removed = false;
-    const next = entries.flatMap((entry) => {
-        if (entry.watcher !== watcher || !entry.sources.includes(source))
-            return [entry];
-        removed = true;
-        const sources = entry.sources.filter((candidate) => candidate !== source);
-        if (!sources.length)
-            return [];
-        if (source !== 'parent')
-            return [{ ...entry, sources }];
-        const { snapshotPending: _pending, ...withoutParentDebt } = entry;
-        return [{ ...withoutParentDebt, sources }];
-    });
-    return { entries: next, removed };
+function readWatchEntries(target) {
+    const canonical = canonicalWatchEntries(target);
+    if (canonical)
+        return canonical;
+    throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
 }
 function managedWatchRecord(id) {
     const rec = readRecord(id);
@@ -544,7 +592,7 @@ function managedWatchRecord(id) {
 }
 function watchMessage(target) {
     const status = target.status === 'awaiting'
-        ? PROPOSAL_STATUS[target.proposal ?? 'nothing']
+        ? displayStatusForProposal(target.proposal)
         : target.status === 'active' ? 'working' : target.status;
     const note = target.note ? ` — ${target.note}` : '';
     return `[spex watch] ${target.session} is ${status}${note}`;
@@ -555,180 +603,81 @@ function shouldDeliverWatchTransition(target, sources) {
 }
 function scheduleWatchNotifications(target) {
     const watchers = readWatchEntries(target.session)
-        .filter((entry) => !entry.snapshotPending && shouldDeliverWatchTransition(target, entry.sources))
+        .filter((entry) => shouldDeliverWatchTransition(target, entry.sources))
         .map((entry) => entry.watcher);
     if (!watchers.length)
         return;
     queueMicrotask(() => {
         for (const watcher of watchers) {
-            void sendText(watcher, watchMessage(target), target.session).then((result) => {
+            void sendText(watcher, watchMessage(target), target.session, { allowStranded: true }).then((result) => {
                 if (!result.ok)
                     console.error(`spex session watch: could not deliver ${target.session} state to ${watcher}: ${result.error}`);
             });
         }
     });
 }
-const watchSnapshotState = (target) => JSON.stringify([target.status, target.proposal, target.note]);
-async function deliverPendingWatchSnapshots(targetId, forceCurrent = true) {
-    const pending = readWatchEntries(targetId).filter((entry) => entry.snapshotPending);
-    for (const original of pending) {
-        const token = original.snapshotPending;
-        let force = forceCurrent;
-        for (;;) {
-            const target = readRecord(targetId);
-            const entry = readWatchEntries(targetId)
-                .find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
-            if (!target || !entry)
-                break;
-            const state = watchSnapshotState(target);
-            const shouldDeliver = force || shouldDeliverWatchTransition(target, entry.sources);
-            if (!shouldDeliver) {
-                let settled = false;
-                await withRecordLock(targetId, async () => {
-                    const current = readRecord(targetId);
-                    const entries = readWatchEntries(targetId);
-                    const pendingEntry = entries.find((candidate) => candidate.watcher === original.watcher && candidate.snapshotPending === token);
-                    if (!current || !pendingEntry || watchSnapshotState(current) !== state)
-                        return;
-                    const next = entries.map((candidate) => {
-                        if (candidate !== pendingEntry)
-                            return candidate;
-                        const { snapshotPending: _pending, ...cleared } = candidate;
-                        return cleared;
-                    });
-                    writeWatchEntries(targetId, next);
-                    settled = true;
-                });
-                if (settled)
-                    break;
-                force = false;
-                continue;
-            }
-            const identity = `${targetId}\0${entry.watcher}\0${token}\0${state}`;
-            const delivered = await sendText(entry.watcher, watchMessage(target), targetId, {
-                idempotency: {
-                    operation: 'watch-initial-snapshot',
-                    requestDigest: digest(identity),
-                    payloadHash: digest(`watch-initial-snapshot\0${identity}\0${watchMessage(target)}`),
-                },
-                acceptGuard: async () => {
-                    const current = readRecord(targetId);
-                    const stillPending = readWatchEntries(targetId)
-                        .some((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
-                    if (!current || !stillPending || watchSnapshotState(current) !== state)
-                        throw new ResourceConflict('watch initial snapshot changed before acceptance');
-                },
-            });
-            if (!delivered.ok) {
-                if (delivered.error?.includes('watch initial snapshot changed before acceptance'))
-                    continue;
-                console.error(`spex session watch: could not deliver initial ${targetId} state to ${entry.watcher}: ${delivered.error}`);
-                break;
-            }
-            force = false;
-            let settled = false;
-            await withRecordLock(targetId, async () => {
-                const current = readRecord(targetId);
-                const entries = readWatchEntries(targetId);
-                const pendingEntry = entries.find((candidate) => candidate.watcher === entry.watcher && candidate.snapshotPending === token);
-                if (!current || !pendingEntry) {
-                    settled = true;
-                    return;
-                }
-                const currentState = watchSnapshotState(current);
-                if (currentState !== state && shouldDeliverWatchTransition(current, pendingEntry.sources))
-                    return;
-                const next = entries.map((candidate) => {
-                    if (candidate !== pendingEntry)
-                        return candidate;
-                    const { snapshotPending: _pending, ...cleared } = candidate;
-                    return cleared;
-                });
-                writeWatchEntries(targetId, next);
-                settled = true;
-            });
-            if (settled)
-                break;
-        }
-    }
-}
-async function clearPendingWatchSnapshots(targetId) {
-    await withRecordLock(targetId, async () => {
-        const entries = readWatchEntries(targetId);
-        const next = entries.map((entry) => {
-            if (!entry.snapshotPending)
-                return entry;
-            const { snapshotPending: _pending, ...settled } = entry;
-            return settled;
-        });
-        if (next.some((entry, index) => entry !== entries[index]))
-            writeWatchEntries(targetId, next);
-    });
-}
 export async function subscribeSessionWatch(watcher, targets, source = 'manual') {
     managedWatchRecord(watcher);
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
     const watched = [];
+    const channel = source === 'parent' ? 'watch:parent' : 'watch:manual';
     for (const target of [...new Set(targets)]) {
         if (target === watcher)
             throw new ResourceConflict('a session cannot watch itself');
-        let targetRecord = null;
-        let added = false;
-        let pending = false;
-        withRecordLockSync(target, () => {
-            targetRecord = managedWatchRecord(target);
-            const entries = readWatchEntries(target);
-            const next = addWatchSource(entries, watcher, source, source === 'parent' && targetRecord.status === 'queued');
-            if (next.added)
-                writeWatchEntries(target, next.entries);
-            added = next.added;
-            pending = next.entries.some((entry) => entry.watcher === watcher && !!entry.snapshotPending);
-        });
-        if (pending) {
-            if (source === 'manual')
-                await deliverPendingWatchSnapshots(target);
+        const targetRecord = managedWatchRecord(target);
+        try {
+            application.attachWatcher(watcher, target, channel);
         }
-        else if (source === 'manual' || added) {
-            const delivered = await sendText(watcher, watchMessage(targetRecord), target);
-            if (!delivered.ok)
-                throw new ResourceConflict(`watch established but could not queue ${target}'s current state for ${watcher}: ${delivered.error}`);
+        catch (error) {
+            if (!(error instanceof Error) || !/already exists|duplicate|active topology edge/i.test(error.message))
+                throw error;
         }
+        const message = watchMessage(targetRecord);
+        application.enqueueMessage(watcher, {
+            kind: 'session.prompt.v1',
+            body: Buffer.from(message, 'utf8'),
+            senderSessionId: target,
+            idempotencyKey: digest(`watch-initial-snapshot\0${watcher}\0${target}\0${source}\0${message}`),
+        });
         watched.push(target);
     }
     return { watched };
 }
 export function listSessionWatches(watcher) {
     managedWatchRecord(watcher);
-    const watches = [];
-    for (const target of listSessionIds()) {
-        const entries = readWatchEntries(target);
-        const active = entries.filter((entry) => {
-            try {
-                return !!readRecord(entry.watcher)?.governed;
-            }
-            catch {
-                return false;
-            }
-        });
-        if (active.length !== entries.length)
-            writeWatchEntries(target, active);
-        for (const entry of active)
-            if (entry.watcher === watcher)
-                watches.push({ target, createdAt: entry.createdAt });
-    }
-    return watches.sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.target.localeCompare(b.target));
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
+    // `listWatchers` defaults to the bare `watch` channel. Canonical policy stores the source
+    // (`watch:parent`/`watch:manual`) in the relation type, so listing must inspect every watch
+    // channel or a valid parent watch appears to have disappeared.
+    const edges = ['watch', 'watch:parent', 'watch:manual']
+        .flatMap(channel => application.listWatchers(watcher, channel))
+        .filter((edge, index, all) => all.findIndex(other => other.toSessionId === edge.toSessionId) === index);
+    return edges
+        .map(edge => ({ target: edge.toSessionId, createdAt: new Date(edge.createdAtMs).toISOString() }))
+        .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.target.localeCompare(b.target));
 }
 export function cancelSessionWatch(watcher, targets) {
     managedWatchRecord(watcher);
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy watcher path');
     let cancelled = 0;
     for (const target of [...new Set(targets)]) {
-        withRecordLockSync(target, () => {
-            const entries = readWatchEntries(target);
-            const next = removeWatchSource(entries, watcher, 'manual');
-            if (next.removed) {
-                writeWatchEntries(target, next.entries);
+        for (const channel of ['watch:manual', 'watch']) {
+            try {
+                application.detachWatcher(watcher, target, channel);
                 cancelled++;
+                break;
             }
-        });
+            catch (error) {
+                if (!(error instanceof Error) || !/does not exist|unknown/i.test(error.message))
+                    throw error;
+            }
+        }
     }
     return cancelled;
 }
@@ -762,65 +711,65 @@ function assertReparentable(children, parent, records) {
 }
 export async function reparentSessionRecords(rawChildren, parent) {
     const children = [...new Set(rawChildren)].sort();
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        throw new ResourceConflict('session application is unavailable; refusing the legacy reparent path');
     const notify = [];
     await withRecordLock('session-reparent-transaction', async () => {
-        // Read former supervisors only after the transaction fence: a concurrent reparent may change exactly
-        // this relation, and its real sender lock is part of the next transaction's outgoing-message boundary.
         const before = new Map(children.map((id) => [id, managedWatchRecord(id)]));
         assertReparentable(children, parent, before);
         const formerParents = [...new Set([...before.values()].flatMap((record) => record.parent ? [record.parent] : []))];
         await withRecordLocks([...children, ...formerParents].sort(), () => withDeliveryLocks(children, async () => {
             const current = new Map(children.map((id) => [id, managedWatchRecord(id)]));
             assertReparentable(children, parent, current);
-            const snapshots = children.map((id) => ({ id, record: current.get(id), watchers: readWatchEntries(id), pending: pendingSnapshot(id) }));
-            try {
-                for (const snapshot of snapshots) {
-                    const { record, watchers } = snapshot;
-                    const hadNewParent = !!parent && watchers.some((entry) => entry.watcher === parent && entry.sources.includes('parent'));
-                    const withoutFormerParent = record.parent
-                        ? removeWatchSource(watchers, record.parent, 'parent').entries
-                        : watchers;
-                    const nextWatchers = parent
-                        ? addWatchSource(withoutFormerParent, parent, 'parent').entries
-                        : withoutFormerParent;
-                    if (nextWatchers !== watchers)
-                        writeWatchEntries(snapshot.id, nextWatchers);
-                    if (record.parent !== parent)
-                        writeRecord({ ...record, parent });
-                    if (parent && (record.parent !== parent || !hadNewParent))
-                        notify.push({ ...record, parent });
-                }
-                for (const snapshot of snapshots) {
-                    if (snapshot.record.parent && snapshot.record.parent !== parent)
-                        revokePendingFromWhileLocked(snapshot.id, snapshot.record.parent);
+            for (const [id, record] of current) {
+                const state = application.readState(id);
+                if (!state)
+                    throw new ResourceConflict(`session ${id} has no canonical application state during reparent`);
+                if (state.parentSessionId !== record.parent) {
+                    throw new ResourceConflict(`session ${id} canonical/record parent mismatch: record=${record.parent ?? 'null'} canonical=${state.parentSessionId ?? 'null'}`);
                 }
             }
-            catch (error) {
-                let rollbackFailure = null;
-                for (const snapshot of [...snapshots].reverse()) {
+            for (const [id, record] of current) {
+                if (record.parent === parent)
+                    continue;
+                const change = application.transitionSession(id, { parentSessionId: parent, reason: 'reparent' });
+                if (record.parent) {
                     try {
-                        replacePendingWhileLocked(snapshot.id, snapshot.pending);
-                        writeWatchEntries(snapshot.id, snapshot.watchers);
-                        writeRecord(snapshot.record);
+                        application.detachWatcher(record.parent, id, 'watch:parent');
+                    }
+                    catch (error) {
+                        if (!(error instanceof Error) || !/does not exist|unknown/i.test(error.message))
+                            throw error;
                     }
-                    catch (rollback) {
-                        rollbackFailure ??= rollback;
+                    for (const message of application.readPendingMessages(id)) {
+                        if (message.senderSessionId === record.parent)
+                            application.dequeuePendingMessage(id, message.messageId);
                     }
                 }
-                const detail = error instanceof Error ? error.message : String(error);
-                const rollbackDetail = rollbackFailure instanceof Error ? `; rollback also failed: ${rollbackFailure.message}` : '';
-                throw new ResourceConflict(`reparent did not commit: ${detail}${rollbackDetail}`);
+                if (parent) {
+                    try {
+                        application.attachWatcher(parent, id, 'watch:parent');
+                    }
+                    catch (error) {
+                        if (!(error instanceof Error) || !/already exists|duplicate|active topology edge/i.test(error.message))
+                            throw error;
+                    }
+                    // The transition above published to the OLD watcher set. The new supervisor learns the child's current
+                    // state here, keyed by that transition's own event so a retried rewrite never sends it twice.
+                    const moved = { ...record, parent };
+                    application.enqueueMessage(parent, {
+                        kind: 'session.prompt.v1',
+                        body: Buffer.from(watchMessage(moved), 'utf8'),
+                        senderSessionId: id,
+                        idempotencyKey: digest(`reparent-snapshot\0${change.event.eventId}`),
+                    });
+                    notify.push(moved);
+                }
             }
         }));
     });
-    const notified = [];
-    if (parent)
-        for (const child of notify) {
-            const delivered = await sendText(parent, watchMessage(child), child.session);
-            if (!delivered.ok)
-                throw new ResourceConflict(`reparent committed but could not queue ${child.session}'s current state for ${parent}: ${delivered.error}`);
-            notified.push(child.session);
-        }
+    const notified = notify.map((child) => child.session);
     return { children, parent, notified };
 }
 // tmux rewrites CONTROL characters in a format string before printing them — 3.6a turns both a tab and a raw
@@ -1083,18 +1032,18 @@ export function liveness(rec, snap) {
         return 'unknown';
     return 'offline';
 }
-function reconcile(rec, snap) {
+function reconcile(rec, snap, residentLiveness) {
     // record integrity outranks both axes: a session whose worktree is gone has no work to be in any state
     // about. It reads `retired` — a terminal, human-closable row, never a lifecycle a hook can write back over.
-    if (retirementReason(rec))
-        return 'retired';
     if (rec.archived)
         return 'offline';
+    if (retirementReason(rec))
+        return 'retired';
     if (rec.status === 'awaiting')
-        return PROPOSAL_STATUS[rec.proposal || 'nothing'];
+        return displayStatusForProposal(rec.proposal);
     if (rec.status !== 'active' && rec.status !== 'idle')
         return rec.status; // parked | error | asking | queued (no tmux yet)
-    const lv = liveness(rec, snap);
+    const lv = residentLiveness ?? liveness(rec, snap);
     if (lv !== 'online')
         return lv; // 'offline' | 'starting' | 'unknown'
     return rec.status === 'idle' ? 'idle' : 'working';
@@ -1119,13 +1068,26 @@ export function reviewIdentity(id) {
         label: deriveLabel({ id, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch }),
     };
 }
+export function sessionHookState(id) {
+    const rec = readRecord(id);
+    if (!rec)
+        return null;
+    const application = configuredSessionApplicationIfCutover();
+    const state = application?.readState(id);
+    return {
+        governed: rec.governed,
+        status: (state?.status ?? rec.status),
+        proposal: (state?.proposal || rec.proposal || null),
+        note: state?.note ?? (rec.note || null),
+    };
+}
 function corruptSession(id, entry) {
     const label = `${id.slice(0, 8)} (unreadable record)`;
     return {
         id, node: null, branch: null, path: '', label, title: label, raw: { name: null, title: null },
         parent: null, harness: defaultHarness.id, capabilities: { headless: false }, launcher: null,
         lifecycle: 'active', proposal: null, merges: 0, status: 'corrupt', liveness: 'unknown',
-        note: corruptReason(entry), archived: false, prompt: null, promptPreview: null, created: 0,
+        note: corruptReason(entry), archived: false, closedAt: null, prompt: null, promptPreview: null, created: 0,
         activity: null, sortKey: null, archiveHazard: null, files: [], web: [],
     };
 }
@@ -1138,7 +1100,7 @@ export function toSession(rec, status, lv, activity = null) {
     const pp = prompt ? oneLinePreview(prompt) : null;
     const parts = { id: rec.session, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch, activity: act, note: rec.note, promptPreview: pp };
     const harness = harnessById(rec.harness || defaultHarness.id);
-    return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), title: deriveTitle(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, archived: rec.archived, archiveHazard: null, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey, files: readSessionFiles(rec.session), web: readSessionWebs(rec.session), ...(rec.zcodeChildSessionIds?.length ? { zcodeChildSessionIds: [...rec.zcodeChildSessionIds] } : {}) };
+    return { id: rec.session, node: rec.node, branch: rec.branch, label: deriveLabel(parts), title: deriveTitle(parts), raw: { name: rec.name, title: rec.title }, path: rec.worktreePath, parent: rec.parent, harness: harness.id, capabilities: { headless: harness.headless }, launcher: rec.launcher, lifecycle: rec.status, proposal: rec.proposal, merges: rec.merges, note: rec.note, status, liveness: lv, archived: rec.archived, closedAt: rec.archived ? rec.closedAt : null, archiveHazard: null, prompt, promptPreview: pp, created: rec.createdAt, activity: act, sortKey: rec.sortKey, files: readSessionFiles(rec.session), web: readSessionWebs(rec.session), ...(rec.zcodeChildSessionIds?.length ? { zcodeChildSessionIds: [...rec.zcodeChildSessionIds] } : {}) };
 }
 // @@@zcode child identity - ZCode owns the child id and SpexCode owns the session record. The writer accepts
 // only their exact declared pair; names, worktrees, branches, and timestamps are deliberately not candidates.
@@ -1197,6 +1159,44 @@ export async function sessionPrompt(id) {
         throw e;
     }
 }
+// The archive overlay has no reader for the session model. Keep this projection separate from listSessions so
+// opening it skips the live tmux census, resident adapter probes, and files/web reads, and carries no full prompt bytes.
+export async function listArchivedSessionIndex(probe) {
+    const rows = [];
+    for (const id of listSessionIds()) {
+        let entry;
+        try {
+            entry = readPublicRecordEntry(id);
+        }
+        catch {
+            continue;
+        }
+        if (entry.kind !== 'ok')
+            continue;
+        const rec = fromRaw(entry.raw);
+        if (!rec.governed || !rec.archived)
+            continue;
+        const parts = {
+            id: rec.session, name: rec.name, node: rec.node, title: rec.title, branch: rec.branch,
+            activity: null, note: rec.note, promptPreview: null,
+        };
+        // Name and note are ahead of the prompt in deriveTitle's precedence. Avoid touching the prompt artifact
+        // unless both are absent; only then can its preview change the visible title.
+        if (!rec.name && !rec.note?.trim()) {
+            probe && (probe.promptReads = (probe.promptReads || 0) + 1);
+            const prompt = readPromptFile(id);
+            parts.promptPreview = prompt ? oneLinePreview(prompt) : null;
+        }
+        rows.push({
+            id: rec.session,
+            title: deriveTitle(parts),
+            label: deriveLabel(parts),
+            closedAt: rec.closedAt,
+            node: rec.node,
+        });
+    }
+    return rows;
+}
 // Preserve rows through a transient record-read failure; prune after the store entry disappears.
 const lastKnownSession = new Map();
 // A BOARD row carries the launch ask only as its one-line preview. The full text is served by the
@@ -1222,9 +1222,23 @@ export async function listSessions(includeArchived = false) {
         }
         catch { /* guardSession below preserves the last-known row for a transient read failure */ }
     }
-    // Only archived adapter records need the resident-ID join. If there are none, this read path performs zero
-    // control-plane probes; resources still owns the full turn/read probe for its detailed report.
-    const censusRecords = [...snapshots.values()].flatMap(({ entry, rec }) => entry.kind === 'ok' && entry.liveness === null && rec && rec.governed && rec.archived && rec.harnessSessionId
+    const canonical = configuredSessionApplicationIfCutover();
+    const canonicalStates = new Map();
+    if (canonical) {
+        for (const [id, snapshot] of snapshots) {
+            if (!snapshot.rec?.governed)
+                continue;
+            const state = canonical.readState(id);
+            if (!state)
+                throw new ResourceConflict(`session ${id} has no canonical application state after JSON cutover`);
+            canonicalStates.set(id, state);
+        }
+    }
+    // Adapter-owned records have no pane witness. Join one project-wide resident-ID census to every exact
+    // bound target, including live rows; otherwise a dead shared app-server could leave a stale headless record
+    // online indefinitely. The descriptor probe remains one-per-generation, not one RPC per session.
+    const censusRecords = [...snapshots.values()].flatMap(({ entry, rec }) => entry.kind === 'ok' && rec && rec.governed
+        && rec.harnessSessionId && harnessById(rec.harness || defaultHarness.id).runtimeOwnership === 'adapter'
         ? [{ ...rec, harness: rec.harness || defaultHarness.id }]
         : []);
     const residentCensus = censusRecords.length ? await adapterLoadedReferenceState(censusRecords) : new Map();
@@ -1263,35 +1277,43 @@ export async function listSessions(includeArchived = false) {
             lastKnownSession.delete(id);
             return null;
         } // no record, or a self-launched (non-board) one
+        const projectedRecord = canonicalRecordProjection(rec, canonicalStates.get(id));
         // A forced public liveness comes only from the shared record projection. Do not let live process/thread
         // evidence punch through it (including archive hazard repair).
         if (entry.kind === 'ok' && entry.liveness === 'offline') {
-            const pending = boardRow(toSession(rec, 'offline', 'offline'));
+            const pending = boardRow(toSession(projectedRecord, 'offline', 'offline'));
             lastKnownSession.set(id, pending);
             return pending;
         }
         // the pane title → headline activity, gated by THIS session's harness ([[harness-adapter]]): claude's title
         // is its task self-summary (used); codex's is the cwd folder name (refused → headline falls to the prompt).
         const activity = paneActivity(harnessById(rec.harness || defaultHarness.id), snap.titles.get(id));
-        const sessionHarness = harnessById(rec.harness || defaultHarness.id);
-        const resident = rec.harnessSessionId
-            ? residentCensus.get(`${rec.harness || defaultHarness.id}:${rec.harnessSessionId}`)
+        const sessionHarness = harnessById(projectedRecord.harness || defaultHarness.id);
+        const resident = projectedRecord.harnessSessionId
+            ? residentCensus.get(`${projectedRecord.harness || defaultHarness.id}:${projectedRecord.harnessSessionId}`)
             : undefined;
-        const residentRequired = sessionHarness.runtimeOwnership === 'adapter' && !!rec.harnessSessionId && !!sessionHarness.sharedRuntimes?.(runtimeRoot()).length;
-        const physical = rec.archived
+        const residentRequired = sessionHarness.runtimeOwnership === 'adapter' && !!projectedRecord.harnessSessionId && !!sessionHarness.sharedRuntimes?.(runtimeRoot()).length;
+        const physical = projectedRecord.archived
             ? (sessionHarness.runtimeOwnership === 'adapter'
                 ? (resident && !resident.healthy ? 'unknown' : resident?.loaded ? 'online' : snap.windows.has(id) ? 'online' : 'offline')
-                : liveness({ ...rec, archived: false, stopped: false }, snap))
+                : liveness({ ...projectedRecord, archived: false, stopped: false }, snap))
             : null;
         // Only a physically-offline record projects as archived. A legacy archived+live/unknown record is exposed
         // as ordinary working-set state with its real liveness/status and one backend-owned hazard marker. A
         // missing durable cold proof is also legacy: leaf liveness alone cannot prove a Codex loaded thread was
         // unloaded, so it remains visible until an explicit archive repair.
-        const cleanCold = rec.archived && !changedDuringCensus.has(id) && hasValidColdProof(rec) && physical === 'offline' && (!residentRequired || resident?.healthy === true);
-        const projected = rec.archived && !cleanCold ? { ...rec, archived: false, stopped: false } : rec;
-        const projectedLv = projected === rec ? liveness(rec, snap) : physical;
-        const s = boardRow(toSession(projected, reconcile(projected, snap), projectedLv, activity));
-        if (projected !== rec)
+        const cleanCold = projectedRecord.archived && !changedDuringCensus.has(id) && hasValidColdProof(projectedRecord) && physical === 'offline' && (!residentRequired || resident?.healthy === true);
+        const projected = projectedRecord.archived && !cleanCold ? { ...projectedRecord, archived: false, stopped: false } : projectedRecord;
+        const projectedLv = projected === projectedRecord
+            ? sessionHarness.runtimeOwnership === 'adapter'
+                ? adapterResidentLiveness(projectedRecord, resident)
+                : liveness(projectedRecord, snap)
+            : physical;
+        const s = boardRow(toSession(projected, reconcile(projected, snap, projectedLv), projectedLv, activity));
+        // Canonical projection deliberately creates a fresh object for every governed row. That identity change is not
+        // an archive failure: a hazard belongs only to a record that was actually archived and then had its cold proof
+        // rejected. Otherwise every live row would inherit the missing-cold-witness message after cutover.
+        if (projectedRecord.archived && !cleanCold)
             s.archiveHazard = changedDuringCensus.has(id)
                 ? 'archived runtime hazard: record changed while adapter residency was being reconciled; retry exact archive'
                 : hasValidColdProof(rec)
@@ -1308,7 +1330,7 @@ export async function listSessions(includeArchived = false) {
         lastKnownSession.set(id, s);
         return s;
     }, () => {
-        // DEGRADED: the record dir still exists but reading session.json failed transiently. NEVER drop a live
+        // DEGRADED: the record dir still exists but reading runtime.json failed transiently. NEVER drop a live
         // session — serve its last-known row. (No last-known means a first sighting raced a failure; nothing to
         // show yet, and it reappears on the next build.)
         return lastKnownSession.get(id) ?? null;
@@ -1436,7 +1458,7 @@ export function withPeerSenderHint(text, sender, sshAddress, machineId) {
     const who = sender.label && sender.label !== sender.id ? `session "${sender.label}" (${sender.id})` : `session ${sender.id}`;
     return `${text}\n\n— from ${who} on machine ${machineId}. To reply: spex session send --ssh ${sshAddress} ${sender.id} "<your reply>"`;
 }
-export const withNoteReplyHint = (text) => `${text}\n\n— REQUIRED REPLY TRANSPORT (PER-MESSAGE): this terminal-free sender CANNOT see normal assistant/final output. Do not stop after only printing the answer. As your FINAL action, put your COMPLETE reply to this message in the truthful declaration's --note. For an answered exploratory question or simple answer awaiting the sender's follow-up, run \`spex session ask --note "<complete reply>"\`; if the true state is done or parked, put the same complete reply in that declaration's --note instead. This declaration command is reply transport, not part of the requested work, and remains REQUIRED even when the message says to use no tools, make no tool calls, or only print/reply. A later message arriving WITHOUT this notice means the sender is back at a terminal and reads your normal output again.`;
+export const withNoteReplyHint = (text) => `${text}\n\n— REPLY TRANSPORT: This sender cannot read normal assistant output. Before ending this turn, make your FINAL tool call a Spex declaration carrying the COMPLETE reply in --note: use \`session ask\` when waiting for a human reply; use \`done\` or \`park\` when that is the truthful state. This rule applies even when asked to only print/reply or make no tool calls.\n\nFor multi-line replies, preserve real LF characters. \`functions.exec\` runs a shell command through bash, so never interpolate \`JSON.stringify(note)\` into it; use stdin, a heredoc, or base64, then pass \`--note \"$note\"\`. Never use \`String.raw\` or literal backslash+n. Do not call any tool after the declaration.`;
 export const withTerminalReplyHint = (text) => `${text}\n\n— sent from a terminal-attached client: the sender now reads your terminal output directly. Reply in your normal conversation output from here on — stop putting replies in declaration --notes (the earlier terminal-free notices no longer apply; a --note can go back to being a short status line).`;
 export const slugify = (s) => (s || 'session').normalize('NFC').replace(/[^\p{L}\p{N}_-]+/gu, '-').replace(/-+/g, '-').replace(/^-+|-+$/g, '') || 'session';
 const MENTION = /\[\[(\.?[\p{L}\p{N}_-]+)\]\]/u;
@@ -1552,6 +1574,10 @@ export function launchPreflight(rec) {
 }
 // @@@ launch quoting - single-quote a string for a POSIX shell, `'` → `'\''`. Used to nest the whole agent
 // invocation inside the birth-registration `sh -c '…'` wrapper without any segment double-expanding.
+// 后端把这条命令输入交互式 shell，脚本路径必须作为一个 shell 参数传递。
+export function launchShellCommand(file) {
+    return `bash ${shQuote(file)}`;
+}
 export function launchScript(id, tail, harness = HARNESS, cmd) {
     const file = join(storeDir(id), 'launch.sh');
     // NO --append-system-prompt / --settings: the contract + hooks are materialized into the worktree at
@@ -1559,7 +1585,7 @@ export function launchScript(id, tail, harness = HARNESS, cmd) {
     // agent. The launch line is just the rendezvous env + the harness command + the session-id/spec-pointer/prompt tail.
     // `cmd` is the session's persisted launcher command ([[launcher-select]]); when set it OVERRIDES the harness's
     // ambient default so resume reuses the same auth. Undefined is only for old records before launch_cmd existed.
-    const invocation = `${rvEnv(id, harness)} ${harness.launchCmd(id, runtimeRoot(), cmd)} ${tail}`;
+    const invocation = `${rvEnv(id, harness, readRecord(id)?.runtimeStartToken)} ${harness.launchCmd(id, runtimeRoot(), cmd)} ${tail}`;
     // @@@ birth registration - record the AGENT's real pid BEFORE exec, the anchor of the 100ms hot death tier
     // ([[state]]). Each attempt runs `sh -c '<pid-write>; exec env <invocation>'`: the sh writes its own `$$` to
     // agent.pid, then `exec env` REPLACES that sh in place — so the pid persists down the whole command chain
@@ -1613,7 +1639,7 @@ export function launchScript(id, tail, harness = HARNESS, cmd) {
             // -t "$TMUX_PANE" names THIS pane explicitly (tmux still resolves the server from $TMUX), so the capture
             // can never land on a neighbouring pane; run outside tmux the call fails, nothing matches, and the plain
             // bounded retry stands.
-            `  if tmux capture-pane -p -S -400 -t "\${TMUX_PANE:-}" 2>/dev/null | sed -n "/$__spex_mark/,\\$p" | grep -Eq ${shQuote(fatal)}; then`,
+            `  if tmux capture-pane -p -S -400 -t "\${TMUX_PANE:-.}" 2>/dev/null | sed -n "/$__spex_mark/,\\$p" | grep -Eq ${shQuote(fatal)}; then`,
             `    printf '[spex launch] attempt %s exited in %ss (rc=%s) - the launcher reported a failure retrying cannot fix (see above); not retrying\\n' "$__spex_try" "$(( SECONDS - __spex_t0 ))" "$__spex_rc" >&2`,
             `    exit $__spex_rc`,
             `  fi`,
@@ -1634,7 +1660,8 @@ async function launch(id, path, tail, harness = HARNESS, cmd) {
     if (harness.ownsRendezvous)
         stampRvSock(id);
     await tmux(['new-session', '-d', '-s', id, '-x', String(COLS), '-y', String(ROWS), '-c', path]);
-    await tmux(['send-keys', '-t', id, '-l', '--', `bash ${launchScript(id, tail, harness, cmd)}`]);
+    const file = launchScript(id, tail, harness, cmd);
+    await tmux(['send-keys', '-t', id, '-l', '--', launchShellCommand(file)]);
     await tmux(['send-keys', '-t', id, 'Enter']);
     launchedAt.set(id, Date.now()); // stamp the boot window so reconcile reads 'starting', not 'offline', until the socket is up
 }
@@ -1642,10 +1669,9 @@ const OCCUPIES_SLOT = new Set(['working', 'parked', 'starting']); // starting's
 function isOccupying(s, snap) {
     if (!OCCUPIES_SLOT.has(s.status))
         return false; // waiting-on-human / proposed / queued / dead → free
-    const rec = readRecord(s.id);
-    if (!rec)
-        return false;
-    return harnessById(rec.harness || defaultHarness.id).liveness(rec, snap.windows.has(rec.session), runtimeRoot(), snap.windows.get(rec.session), snap.sockets.has(rec.session)) === 'online';
+    // `listSessions` already joined the adapter resident census and projected the resulting liveness. Re-reading
+    // the harness here would resurrect the old record-backed codex-headless shortcut and disagree with the row.
+    return s.liveness === 'online';
 }
 // sessions we've JUST launched whose agent hasn't come online yet. During that boot window reconcile reads them
 // `offline` (the adapter's online-signal not up yet) and isOccupying would miss them, so the drainer would
@@ -1675,23 +1701,167 @@ async function withSessionTransition(id, body) {
     }
 }
 let draining = false; // re-entrancy guard: only one drain pass runs at a time (no double-launch)
-function noteQueuedLaunchFailureUnlocked(id, error) {
+// A native receipt is bound before the readiness fence validates it. Suppress only that immediate wake so
+// queued prompts cannot drain during the candidate window; the successful publication path drains normally.
+const readinessWakeSuppressed = new Set();
+function noteQueuedLaunchFailureUnlocked(id, error, terminal = true, label, live = false) {
     const reason = error instanceof Error ? error.message : String(error);
-    const note = `queued launch readiness failed: ${reason}`;
+    const note = `${label ?? (terminal ? 'queued launch readiness failed' : 'launch readiness warning')}: ${reason}`;
     console.error(`spex: session ${id}: ${note}`);
     const rec = readRecord(id);
-    if (rec && rec.note !== note)
-        writeRecord({ ...rec, note });
+    if (rec && !retirementReason(rec) && (rec.note !== note
+        || (terminal && (rec.status !== 'error' || !rec.stopped || rec.launchReadinessStartedAt != null))
+        || (!terminal && live && (rec.status === 'error' || rec.stopped)))) {
+        // Readiness failure is terminal for this launch attempt. Keep the exact reason on the record,
+        // publish an offline/error transition, and clear every durable/in-memory ownership marker so close
+        // and a later explicit resume have an honest starting point.
+        if (terminal) {
+            publishCanonicalLifecycle(rec, 'error', null, note);
+            writeRecord({ ...rec, status: 'error', proposal: null, stopped: true, note, launchOwner: null, launchReadinessStartedAt: null });
+        }
+        else {
+            const status = live && (rec.status === 'error' || rec.stopped) ? 'active' : rec.status;
+            const stopped = live ? false : rec.stopped;
+            const restored = { ...rec, status, stopped, note, launchOwner: null, launchReadinessStartedAt: null };
+            // A live post-receipt timeout is a diagnostic, not a new parent-watch transition. If an older failed
+            // attempt already published `error`, however, the canonical row must be repaired to the live status or
+            // the JSON write below would leave the sole lifecycle authority disagreeing with the runtime witness.
+            // Publish even when status is unchanged: the warning note is canonical too. Active recipients exclude
+            // the parent, so this diagnostic cannot manufacture a parent-watch transition.
+            publishCanonicalLifecycle(restored, status, restored.proposal, note);
+            writeRecord(restored);
+        }
+    }
+}
+function clearReadinessResidueUnlocked(rec, clearDiagnostic) {
+    const application = configuredSessionApplicationIfCutover();
+    const next = {
+        ...rec,
+        status: 'active',
+        stopped: false,
+        note: clearDiagnostic ? null : rec.note,
+        launchReadinessStartedAt: null,
+    };
+    if (application?.readState(rec.session) && (clearDiagnostic || rec.status !== 'active' || rec.stopped)) {
+        application.transitionSession(rec.session, {
+            status: 'active',
+            proposal: rec.proposal,
+            note: next.note,
+            parentSessionId: rec.parent,
+            recipientSessionIds: [],
+        });
+    }
+    writeRecord(next);
+}
+export function canonicalWatchRecipients(application, sessionId, status) {
+    const recipients = new Set();
+    for (const edge of application.topology.parents(sessionId)) {
+        // The canonical topology stores the structural parent edge as the durable parent-watch source. Older
+        // migrated rows may also have an explicit watch:parent edge; both represent the same policy source.
+        if (edge.relationType !== 'parent' && !edge.relationType.startsWith('watch'))
+            continue;
+        if (status === 'active' && (edge.relationType === 'parent' || edge.relationType === 'watch:parent'))
+            continue;
+        recipients.add(edge.fromSessionId);
+    }
+    return [...recipients];
 }
-function observeQueuedLaunchReadiness(id, harness) {
-    void waitForReady(id, harness)
+export function sessionHasPendingDelivery(id, application = configuredSessionApplicationIfCutover() ?? null) {
+    if (!application)
+        throw new ResourceConflict(`session application is unavailable for ${id}`);
+    const runtime = application.resolveRuntime?.(id, 'spex-governed');
+    if (runtime === null)
+        return false;
+    try {
+        return application.readPendingMessages(id).length > 0;
+    }
+    catch (error) {
+        // A legacy record can outlive its migrated protocol address. It has no canonical queue to drain;
+        // treating that address as owed makes the supervisor retry the same impossible lookup forever.
+        if (error?.code === 'PROTOCOL_SESSION_UNKNOWN'
+            || /unknown protocol address/i.test(error instanceof Error ? error.message : String(error)))
+            return false;
+        throw error;
+    }
+}
+export function canonicalRecordProjection(rec, canonical) {
+    // The application row is the only lifecycle fact after cutover. A JSON status is historical envelope data,
+    // so it must not win merely because it says waiting/error/archived while the canonical row says otherwise.
+    if (!canonical) {
+        return rec;
+    }
+    return {
+        ...rec,
+        status: canonical.status,
+        proposal: canonical.proposal,
+        note: canonical.note,
+        parent: canonical.parentSessionId,
+    };
+}
+function publishCanonicalLifecycle(rec, status, proposal, note) {
+    const application = configuredSessionApplicationIfCutover();
+    if (!application)
+        return;
+    if (!application.readState(rec.session)) {
+        application.createSession({ sessionId: rec.session, status, proposal, note, parentSessionId: rec.parent });
+        if (rec.parent)
+            application.attachWatcher(rec.parent, rec.session, 'watch:parent');
+        return;
+    }
+    application.transitionSession(rec.session, {
+        status,
+        proposal,
+        note,
+        parentSessionId: rec.parent,
+        recipientSessionIds: canonicalWatchRecipients(application, rec.session, status),
+    });
+}
+async function launchReadinessWitnessAlive(id, harness, current) {
+    if (harness.runtimeOwnership === 'adapter') {
+        const state = await adapterRuntimeLiveness({ ...current, stopped: false, archived: false });
+        return state === 'online';
+    }
+    if (agentAlive(id) === true)
+        return true;
+    try {
+        const snap = await liveSnapshot(id);
+        return harness.liveness(current, snap.windows.has(id), runtimeRoot(), snap.windows.get(id), snap.sockets.has(id)) === 'online';
+    }
+    catch {
+        return false;
+    }
+}
+export function adapterResidentLiveness(rec, resident) {
+    if (rec.stopped || rec.archived)
+        return 'offline';
+    if (!rec.harnessSessionId)
+        return 'offline';
+    if (!resident)
+        return 'unknown';
+    if (!resident.healthy)
+        return 'unknown';
+    return resident.loaded ? 'online' : 'offline';
+}
+async function adapterRuntimeLiveness(rec) {
+    if (rec.stopped || rec.archived)
+        return 'offline';
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (harness.runtimeOwnership !== 'adapter')
+        return liveness(rec, await liveSnapshot());
+    if (!rec.harnessSessionId)
+        return 'offline';
+    const states = await adapterLoadedReferenceState([{ ...rec, harness: harness.id }], runtimeRoot());
+    return adapterResidentLiveness(rec, states.get(`${harness.id}:${rec.harnessSessionId}`));
+}
+function observeQueuedLaunchReadiness(id, harness, timeoutMs = SOCKET_READY_TIMEOUT_MS) {
+    void waitForReady(id, harness, undefined, timeoutMs)
         .then(async (readiness) => {
         if (!readiness) {
             const committed = !!readRecord(id)?.harnessSessionId;
             throw new ResourceConflict(harness.launchPayloadProof
                 ? committed
-                    ? 'post-proof adapter liveness did not become ready before launch readiness timed out'
-                    : 'native identity and first-turn rollout proof did not arrive before launch readiness timed out'
+                    ? 'post-receipt adapter liveness did not become ready before launch readiness timed out'
+                    : 'native identity and first-turn rollout receipt did not arrive before launch readiness timed out'
                 : 'adapter liveness did not become ready before launch readiness timed out');
         }
         let readyToPublish = false;
@@ -1708,23 +1878,35 @@ function observeQueuedLaunchReadiness(id, harness) {
             const current = readRecord(id);
             if (!current)
                 return;
-            if (current.status === 'queued')
-                writeRecord({ ...current, status: 'active', proposal: null, note: null, launchOwner: null });
+            if (current.status === 'queued') {
+                publishCanonicalLifecycle(current, 'active', null, null);
+                writeRecord({ ...current, status: 'active', proposal: null, note: null, stopped: false, launchOwner: null, launchReadinessStartedAt: null });
+            }
+            else if (current.launchReadinessStartedAt != null)
+                writeRecord({ ...current, launchReadinessStartedAt: null });
             readyToPublish = true;
         });
         if (!readyToPublish)
             return;
-        await deliverPendingWatchSnapshots(id);
         await drainSession(id);
     })
         .catch(async (error) => {
+        const reason = error instanceof Error ? error.message : String(error);
+        const timedOut = /timed out|did not become ready/i.test(reason);
+        let live = false;
+        let terminal = timedOut;
         try {
-            await withRecordLock(id, async () => noteQueuedLaunchFailureUnlocked(id, error));
+            await withRecordLock(id, async () => {
+                const current = readRecord(id);
+                if (timedOut && current)
+                    live = await launchReadinessWitnessAlive(id, harness, current);
+                terminal = timedOut && !live;
+                noteQueuedLaunchFailureUnlocked(id, error, terminal, live ? 'launch readiness warning' : undefined, live);
+            });
         }
         catch (recordError) {
-            console.error(`spex: session ${id}: queued launch failure could not be recorded: ${recordError instanceof Error ? recordError.message : String(recordError)}; original failure: ${error instanceof Error ? error.message : String(error)}`);
+            console.error(`spex: session ${id}: queued launch failure could not be recorded: ${recordError instanceof Error ? recordError.message : String(recordError)}; original failure: ${reason}`);
         }
-        await clearPendingWatchSnapshots(id);
     })
         .finally(() => launching.delete(id));
 }
@@ -1743,7 +1925,7 @@ async function startQueuedUnlocked(id) {
     if (!canDrainQueued(wt.rec))
         return 'retryable';
     const h = harnessById(wt.rec.harness || defaultHarness.id);
-    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+    if (h.launchPayloadProof && hasReadableLaunchReceipt(id)) {
         launching.add(id);
         let readinessOwnsSlot = false;
         try {
@@ -1751,11 +1933,13 @@ async function startQueuedUnlocked(id) {
                 consumeHarnessLaunchProofUnlocked(id);
             }
             catch (error) {
-                noteQueuedLaunchFailureUnlocked(id, error);
+                noteQueuedLaunchFailureUnlocked(id, error, false);
                 throw error;
             }
             const recovered = readRecord(id) || wt.rec;
-            writeRecord({ ...recovered, status: 'active', proposal: null, note: null, launchOwner: null });
+            const readinessStartedAt = Date.now();
+            publishCanonicalLifecycle(recovered, 'active', null, null);
+            writeRecord({ ...recovered, status: 'active', proposal: null, note: null, launchOwner: null, launchReadinessStartedAt: readinessStartedAt });
             observeQueuedLaunchReadiness(id, h);
             readinessOwnsSlot = true;
             return 'started';
@@ -1788,11 +1972,17 @@ async function startQueuedUnlocked(id) {
     launching.add(id); // hold the slot across the boot window BEFORE we launch, so a concurrent count can't race us
     let readinessOwnsSlot = false;
     try {
+        const readinessStartedAt = Date.now();
+        const stamped = readRecord(id) || wt.rec;
+        writeRecord({ ...stamped, launchReadinessStartedAt: readinessStartedAt });
         try {
             const sq = shQuote(launchPrompt);
             await launch(id, wt.path, `${h.sessionIdArg(id)} ${sq}`.trim(), h, launcherCmd(wt.rec));
         }
         catch {
+            const failedLaunch = readRecord(id);
+            if (failedLaunch)
+                writeRecord({ ...failedLaunch, launchReadinessStartedAt: null });
             return 'retryable'; // launch failed → stays `queued`, with its initial debt, for the next drain tick
         }
         // the note this record may carry is the QUEUED state's word (a launch-blocker message stamped above); the
@@ -1800,7 +1990,8 @@ async function startQueuedUnlocked(id) {
         // belongs to the state currently declared" true for every writer — the invariant [[session-label]]'s
         // headline precedence stands on.
         const launched = readRecord(id) || wt.rec;
-        writeRecord({ ...launched, status: 'active', proposal: null, note: null, launchOwner: null });
+        publishCanonicalLifecycle(launched, 'active', null, null);
+        writeRecord({ ...launched, status: 'active', proposal: null, note: null, stopped: false, launchOwner: null, launchReadinessStartedAt: readinessStartedAt });
         if (!h.launchPayloadProof)
             removeLaunchFile(id);
         // release the boot-window hold once the socket is up (then isOccupying takes over) or after the bounded
@@ -1825,16 +2016,60 @@ async function drainQueueUnlocked() {
             const [sessions, snap] = await Promise.all([listSessions(), liveSnapshot()]);
             for (const session of sessions) {
                 const rec = readRecord(session.id);
-                if (!rec || launching.has(session.id) || !readWatchEntries(session.id).some((entry) => entry.snapshotPending))
+                if (!rec || launching.has(session.id))
                     continue;
-                if (rec.status === 'queued')
+                // Older timed-out rows predate the durable readiness timestamp. Reconcile their recorded failure
+                // before any queue/watch work so a backend restart cannot resurrect the old active/limbo projection.
+                if (rec.status !== 'queued' && /^queued launch readiness failed:/.test(rec.note || '')) {
+                    const priorReason = (rec.note || '').replace(/^queued launch readiness failed:\s*/, '') || 'launch readiness timed out';
+                    const harness = harnessById(rec.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, rec);
+                    if (live) {
+                        await withRecordLock(session.id, async () => {
+                            const current = readRecord(session.id);
+                            if (current && !current.archived && !current.stopped)
+                                clearReadinessResidueUnlocked(current, true);
+                        });
+                        continue;
+                    }
+                    await withRecordLock(session.id, async () => noteQueuedLaunchFailureUnlocked(session.id, priorReason, !live, live ? 'launch readiness warning' : undefined, live));
                     continue;
-                if (rec.status === 'active' && !rec.stopped && !rec.archived) {
+                }
+                // A pre-fix active row may still carry the authoritative launch artifact without a timestamp. Its
+                // mtime is the only durable age witness available; seed the new field so the same bounded recovery
+                // rule applies on this and later restarts.
+                if (rec.status === 'active' && !rec.stopped && existsSync(sessionArtifactPath(session.id, 'launch')) && rec.launchReadinessStartedAt == null) {
+                    const harness = harnessById(rec.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, rec);
+                    if (!live) {
+                        let startedAt = Date.now();
+                        try {
+                            startedAt = statSync(sessionArtifactPath(session.id, 'launch')).mtimeMs;
+                        }
+                        catch { /* race: observer below will fail loud */ }
+                        writeRecord({ ...rec, launchReadinessStartedAt: startedAt });
+                    }
+                }
+                const refreshed = readRecord(session.id) || rec;
+                if (refreshed.launchReadinessStartedAt && !refreshed.stopped && !refreshed.archived) {
+                    const harness = harnessById(refreshed.harness || defaultHarness.id);
+                    const live = await launchReadinessWitnessAlive(session.id, harness, refreshed);
+                    if (live) {
+                        await withRecordLock(session.id, async () => {
+                            const current = readRecord(session.id);
+                            if (current && !current.archived && !current.stopped) {
+                                clearReadinessResidueUnlocked(current, /^launch readiness warning:/.test(current.note || ''));
+                            }
+                        });
+                        continue;
+                    }
                     launching.add(session.id);
-                    observeQueuedLaunchReadiness(session.id, harnessById(rec.harness || defaultHarness.id));
+                    const remaining = Math.max(0, SOCKET_READY_TIMEOUT_MS - (Date.now() - refreshed.launchReadinessStartedAt));
+                    observeQueuedLaunchReadiness(session.id, harness, remaining);
                     continue;
                 }
-                await deliverPendingWatchSnapshots(session.id, false);
+                if (rec.status === 'queued')
+                    continue;
             }
             // if the liveness probe FAILED (tmux timing out — the overload condition), occupancy is UNKNOWABLE: every
             // session would read window-less and isOccupying would undercount, so the drainer would OVER-launch and pile
@@ -1844,13 +2079,6 @@ async function drainQueueUnlocked() {
                 break;
             const occupied = sessions.reduce((n, s) => n + (launching.has(s.id) || isOccupying(s, snap) ? 1 : 0), 0);
             if (occupied >= cap) {
-                const authority = backendLaunchAuthority();
-                await Promise.all(sessions.filter((session) => {
-                    if (session.status !== 'queued')
-                        return false;
-                    const rec = readRecord(session.id);
-                    return !!rec && canDrainQueued(rec, authority);
-                }).map((session) => deliverPendingWatchSnapshots(session.id)));
                 break;
             }
             const authority = backendLaunchAuthority();
@@ -1864,8 +2092,6 @@ async function drainQueueUnlocked() {
                 break;
             const started = await startQueued(next.id);
             if (started !== 'started') {
-                if (started === 'blocked')
-                    await clearPendingWatchSnapshots(next.id);
                 break; // launch failed → stop this pass; a later tick retries
             }
         }
@@ -1880,6 +2106,18 @@ const requestQueueDrain = () => {
         console.error(`spex: queue drain failed: ${error instanceof Error ? error.message : String(error)}`);
     });
 };
+// Canonical state commits already own the durable recipient queue. This is only the post-commit wake that hands
+// each queued recipient to its existing runtime; a failed or absent runtime leaves the message pending for retry.
+setSessionApplicationCommitWake((recipients) => {
+    const wakeRecipients = recipients.filter(recipient => !readinessWakeSuppressed.has(recipient));
+    queueMicrotask(() => {
+        for (const recipient of wakeRecipients) {
+            void drainSession(recipient).catch((error) => {
+                console.error(`spex: canonical delivery wake failed for ${recipient}: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+    });
+});
 let supervisingQueue = false;
 export function superviseQueue(intervalMs = 3000) {
     if (supervisingQueue)
@@ -1907,22 +2145,28 @@ export function superviseDelivery(intervalMs = 2000) {
     supervisingDelivery = true;
     const tick = async () => {
         try {
+            const application = configuredSessionApplicationIfCutover();
             for (const id of listSessionIds()) {
-                if (!owesDelivery(id))
+                if (!sessionHasPendingDelivery(id, application))
                     continue;
                 try {
                     await drainSession(id);
                 }
-                catch { /* an adapter that refused stays owed; next tick retries */ }
+                catch (error) {
+                    console.error(`spex: delivery retry failed for ${id}: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
         }
-        catch { /* transient store read; next tick retries */ }
+        catch (error) {
+            console.error(`spex: delivery retry sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
         setTimeout(tick, intervalMs).unref();
     };
     void tick();
 }
 const turnFailureObservers = new Map();
 let supervisingTurnFailures = false;
+let startingTurnFailureObserver = false;
 const TURN_FAILURE_OBSERVER_STABLE_MS = 5000;
 export function turnFailureNote(harness, failure) {
     const message = failure.message.replace(/\s+/g, ' ').trim().slice(0, 500) || 'turn failed';
@@ -1953,7 +2197,10 @@ export function reconcileTurnFailureObservers() {
         catch {
             continue;
         }
-        if (!rec?.governed || rec.stopped || rec.archived || !rec.harnessSessionId)
+        // Native turn failure observation is for an executing turn, not a durable roster census. Asking, awaiting,
+        // and parked records have no turn to observe; subscribing them creates one expensive app-server resume per
+        // idle record and lets stale observers accumulate after a backend restart.
+        if (!rec?.governed || rec.stopped || rec.archived || rec.status !== 'active' || !rec.harnessSessionId)
             continue;
         const harness = harnessById(rec.harness || defaultHarness.id);
         if (!harness.observeTurnFailures)
@@ -1977,11 +2224,16 @@ export function reconcileTurnFailureObservers() {
             }
             continue;
         }
+        // Codex thread/resume is an expensive native subscription under load. Admit one observer at a time so a
+        // backend restart cannot fan out N concurrent history reconciliations and exhaust CPU/RSS before any can settle.
+        if (startingTurnFailureObserver)
+            continue;
         if (state && now < state.retryAt)
             continue;
         state ??= { fingerprint: target.fingerprint, subscription: null, startedAt: 0, failures: 0, retryAt: 0, lastReason: null };
         state.startedAt = now;
         turnFailureObservers.set(id, state);
+        startingTurnFailureObserver = true;
         try {
             const subscription = target.harness.observeTurnFailures({
                 session: id,
@@ -2000,7 +2252,12 @@ export function reconcileTurnFailureObservers() {
                 }
             });
             state.subscription = subscription;
+            if (subscription.ready)
+                void subscription.ready.then(() => { startingTurnFailureObserver = false; }, () => { startingTurnFailureObserver = false; });
+            else
+                startingTurnFailureObserver = false;
             void subscription.closed.then((reason) => {
+                startingTurnFailureObserver = false;
                 if (turnFailureObservers.get(id) !== state)
                     return;
                 if (reason)
@@ -2010,6 +2267,7 @@ export function reconcileTurnFailureObservers() {
             });
         }
         catch (error) {
+            startingTurnFailureObserver = false;
             deferTurnFailureObserver(id, target.harness.id, state, error instanceof Error ? error.message : String(error));
         }
     }
@@ -2150,6 +2408,13 @@ export async function sessionCreateRequest(body, options = {}) {
     if (input.base !== undefined && typeof input.base !== 'string')
         return { status: 400, error: 'session-create base must be a string' };
     const base = typeof input.base === 'string' && input.base.trim() ? input.base.trim() : null;
+    const cutoverState = sessionApplicationCutoverState();
+    if (cutoverState === 'fenced')
+        return { status: 409, error: 'legacy JSON session store is fenced for one-time migration', code: 'session_create_failed', phase: 'request' };
+    if (cutoverState === 'migration-required')
+        return { status: 409, error: 'legacy JSON session store must be migrated before creating sessions', code: 'session_create_failed', phase: 'request' };
+    if (cutoverState === 'ambiguous')
+        return { status: 409, error: 'session database exists without a migration marker', code: 'session_create_failed', phase: 'request' };
     let key;
     try {
         key = normalizeCreateKey(options.requestKey);
@@ -2164,6 +2429,23 @@ export async function sessionCreateRequest(body, options = {}) {
     // immutable creation input because it publishes the record's existing display override. `base` joins them
     // for the same reason and with the same shape: absent, it must not perturb an existing receipt's bytes.
     const payloadHash = digest(JSON.stringify({ prompt, parent, launcher: launcher ?? null, ...(name ? { name } : {}), ...(base ? { base } : {}) }));
+    let freshStoreOwned = false;
+    let freshStoreCommitted = false;
+    try {
+        const acquired = acquireFreshSessionApplicationForCreate();
+        freshStoreOwned = acquired.owned;
+    }
+    catch (error) {
+        return { status: 409, error: error instanceof Error ? error.message : String(error), code: 'session_create_failed', phase: 'request' };
+    }
+    try {
+        assertLegacyJsonWritesAllowed();
+    }
+    catch (error) {
+        releaseFreshSessionApplicationForCreate(freshStoreOwned, false);
+        const message = error instanceof Error ? error.message : String(error);
+        return { status: 409, error: message, code: 'session_create_failed', phase: 'request' };
+    }
     const controller = new AbortController();
     const cancel = () => controller.abort(new SessionCreateError('session_create_cancelled', 'request', 'session creation caller disconnected', 408));
     if (options.signal?.aborted)
@@ -2176,6 +2458,8 @@ export async function sessionCreateRequest(body, options = {}) {
     try {
         try {
             const session = await prepareSession(prompt, parent, launcher, name, { id, requestDigest, payloadHash, base, signal: controller.signal });
+            await options.onPublished?.(session);
+            freshStoreCommitted = true;
             traceSessionCreate(id, requestDigest, 'request', 'finish');
             return { status: 201, session };
         }
@@ -2189,6 +2473,7 @@ export async function sessionCreateRequest(body, options = {}) {
         }
     }
     finally {
+        releaseFreshSessionApplicationForCreate(freshStoreOwned, freshStoreCommitted);
         clearTimeout(timer);
         options.signal?.removeEventListener('abort', cancel);
     }
@@ -2244,7 +2529,7 @@ export async function createSession(prompt, launcher, name, base) {
     const refused = await probeSessionCreateAuthority(target);
     if (refused) {
         console.error('spex: no backend reachable — launching in-process (caller env owns auth, no concurrency cap)');
-        const fallback = await sessionCreateRequest(body, { requestKey });
+        const fallback = await sessionCreateRequest(body, { requestKey, onPublished: projectCreatedSession });
         if (fallback.status === 201)
             return fallback.session;
         const error = new Error(`${fallback.code || 'session_create_failed'}: ${fallback.error}`);
@@ -2284,6 +2569,27 @@ export async function createSession(prompt, launcher, name, base) {
     }
     return await res.json();
 }
+export function projectCreatedSession(session) {
+    const application = initializeFreshSessionApplication();
+    try {
+        application.createSession({
+            sessionId: session.id,
+            status: session.lifecycle,
+            parentSessionId: session.parent,
+            proposal: session.proposal,
+            note: session.note,
+        });
+        if (session.parent)
+            application.attachWatcher(session.parent, session.id, 'watch:parent');
+    }
+    catch (error) {
+        const state = application.readState(session.id);
+        const sameProjection = state?.status === session.lifecycle
+            && state.parentSessionId === (session.parent ?? null);
+        if (!sameProjection)
+            throw error;
+    }
+}
 export function spawnerClause(p) {
     if (!p?.worktreePath)
         return '';
@@ -2545,7 +2851,7 @@ function existingCreateReceipt(rec) {
     const h = harnessById(rec.harness || defaultHarness.id);
     if (rec.status === 'queued')
         return toSession(rec, 'queued', 'offline');
-    const status = rec.status === 'active' ? 'working' : rec.status === 'awaiting' ? PROPOSAL_STATUS[rec.proposal ?? 'nothing'] : rec.status;
+    const status = rec.status === 'active' ? 'working' : rec.status === 'awaiting' ? displayStatusForProposal(rec.proposal) : rec.status;
     return toSession(rec, status, rec.stopped ? 'offline' : h.headless ? 'online' : 'starting');
 }
 async function proveSessionCandidate(path, branch, signal) {
@@ -2695,13 +3001,21 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                     traceSessionCreate(id, requestDigest, phase, 'start', 'seed-worktree-host-state');
                     seedWorktreeHostState(root, path);
                     traceSessionCreate(id, requestDigest, phase, 'finish', 'seed-worktree-host-state');
+                    // The branch ref right after `worktree add` IS the fork point. Record it: it is the only thing that
+                    // later separates "this branch never authored a commit" from "its commits landed in the base", and
+                    // git ancestry alone cannot tell those apart. A read that fails leaves it null — the diff reader
+                    // recovers the same commit from the branch's creation reflog entry.
+                    const forkResolved = await withGitAbortSignal(signal, () => gitTry(['-C', root, 'rev-parse', '--verify', `refs/heads/${branch}^{commit}`]));
+                    const forkCommit = forkResolved.ok && isGitObjectId(root, forkResolved.stdout.trim()) ? forkResolved.stdout.trim() : null;
                     let rec = {
                         session: id, governed: true, worktreePath: path, branch,
                         node: ref || null, title, name, parent: parent && parent !== id ? parent : null,
                         status: 'queued', proposal: null, merges: 0, note: null, sortKey: null, createdAt: Date.now(),
-                        harness: h.id, harnessSessionId: null, stopped: false, archived: false, coldProof: null, adapterRecovery: null, launcher: chosen.name,
+                        harness: h.id, harnessSessionId: null, runtimeStartToken: randomUUID(), stopped: false, archived: false, closedAt: null, coldProof: null, adapterRecovery: null, launcher: chosen.name,
                         launchCmd: pinned, launchOwner: backendLaunchAuthority(), createRequestId: requestDigest, createPayloadHash: payloadHash,
+                        diffComments: [],
                         ...(base ? { base } : {}),
+                        ...(forkCommit ? { forkCommit } : {}),
                     };
                     owned.store = true;
                     const dir = storeDir(id);
@@ -2720,13 +3034,8 @@ async function prepareSession(prompt, parent, launcher, name, context) {
                     if (gitMismatch)
                         throw new SessionCreateError('session_create_failed', phase, `refusing session publication: ${gitMismatch}`, 500);
                     throwIfCreateAborted(signal, phase);
+                    publishCanonicalLifecycle(rec, rec.status, rec.proposal, rec.note);
                     writeRecord(rec);
-                    if (rec.parent && readRecord(rec.parent)?.governed) {
-                        const watchers = readWatchEntries(id);
-                        const next = addWatchSource(watchers, rec.parent, 'parent', true);
-                        if (next.added)
-                            writeWatchEntries(id, next.entries);
-                    }
                     published = true;
                     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(rec, root);
                     if (receiptFailure)
@@ -2819,12 +3128,24 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
     const deadline = Date.now() + timeoutMs;
     if (harness.launchPayloadProof && !current()?.harnessSessionId) {
         for (;;) {
-            if (existsSync(sessionArtifactPath(id, 'launch.proof'))) {
-                if (recordLockHeld)
-                    consumeHarnessLaunchProofUnlocked(id);
-                else
-                    await withRecordLock(id, async () => consumeHarnessLaunchProofUnlocked(id));
-                break;
+            if (hasReadableLaunchReceipt(id)) {
+                // The probe above ran outside the fence, so another consumer (the drain, a resume recovery) may have
+                // taken the receipt first. Under the fence a receipt that is already gone with the identity bound is
+                // that consumer's success, not a missing receipt; gone and unbound means keep waiting.
+                const consume = () => {
+                    readinessWakeSuppressed.add(id);
+                    try {
+                        if (!hasReadableLaunchReceipt(id))
+                            return !!readRecord(id)?.harnessSessionId;
+                        consumeHarnessLaunchProofUnlocked(id);
+                        return true;
+                    }
+                    finally {
+                        readinessWakeSuppressed.delete(id);
+                    }
+                };
+                if (recordLockHeld ? consume() : await withRecordLock(id, async () => consume()))
+                    break;
             }
             if (Date.now() >= deadline)
                 return null;
@@ -2851,7 +3172,57 @@ async function waitForReady(id, harness, pending, timeoutMs = SOCKET_READY_TIMEO
         await new Promise((r) => setTimeout(r, SOCKET_POLL_MS));
     }
 }
-const restingLifecycle = (status) => status === 'active' || status === 'queued' ? 'idle' : status;
+// An explicit successful resume is a new runtime attempt. A prior terminal launch/turn error must not
+// survive that handoff as current lifecycle truth; waiting declarations remain waiting declarations.
+const restingLifecycle = (status) => status === 'active' || status === 'queued' || status === 'error' ? 'idle' : status;
+const resumeNote = (status, note) => status === 'error' ? null : note;
+const archiveRef = (id) => `refs/spex-archive/${id}`;
+function archiveWorktreeState(id, path) {
+    const root = mainRoot();
+    try {
+        const parent = git(['-C', path, 'rev-parse', 'HEAD']).trim();
+        git(['-C', path, 'add', '-A']);
+        const tree = git(['-C', path, 'write-tree']).trim();
+        const commit = git(['-C', path, '-c', 'user.name=SpexCode', '-c', 'user.email=spexcode@localhost', 'commit-tree', tree, '-p', parent, '-m', `spex close archive ${id}`]).trim();
+        if (!/^[0-9a-f]{40,64}$/.test(commit))
+            throw new Error('archive commit was malformed');
+        git(['-C', root, 'update-ref', archiveRef(id), commit]);
+        const stored = git(['-C', root, 'rev-parse', '--verify', `${archiveRef(id)}^{commit}`]).trim();
+        if (stored !== commit)
+            throw new Error('archive ref publication was not verified');
+        return commit;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.split('\n')[0] : String(error);
+        throw new ResourceConflict(`refusing to close ${id}: could not publish ${archiveRef(id)}${detail ? ` - ${detail}` : ''}`);
+    }
+}
+async function restoreArchivedWorktree(id, rec) {
+    if (existsSync(rec.worktreePath))
+        return;
+    if (!rec.branch)
+        throw new ResourceConflict(`session ${id} has no branch to restore its archived worktree`);
+    const ref = archiveRef(id);
+    const archive = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${ref}^{commit}`]);
+    const start = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `refs/heads/${rec.branch}^{commit}`]);
+    if (!start.ok)
+        throw new ResourceConflict(`session ${id} branch ${rec.branch} is missing`);
+    await gitTry(['-C', mainRoot(), 'worktree', 'add', rec.worktreePath, rec.branch]).then((result) => {
+        if (!result.ok)
+            throw new ResourceConflict(`git worktree add failed: ${result.stderr.trim() || result.failure}`);
+    });
+    if (!archive.ok)
+        return;
+    const patch = git(['-C', mainRoot(), 'diff', '--binary', `${rec.branch}..${ref}`]);
+    if (!patch)
+        return;
+    try {
+        execFileSync('git', ['-C', rec.worktreePath, 'apply', '--binary', '-'], { input: patch, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+    }
+    catch (error) {
+        throw new ResourceConflict(`session ${id} archived changes could not be restored: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 async function resumeSessionUnlocked(id, opts = {}) {
     const { force = false, guard = true } = opts;
     let wt;
@@ -2865,6 +3236,17 @@ async function resumeSessionUnlocked(id, opts = {}) {
     }
     if (!wt)
         return { ok: false, error: `no such session ${id}` };
+    if (wt.rec.archived && retirementReason(wt.rec)) {
+        try {
+            await restoreArchivedWorktree(id, wt.rec);
+            wt = await findWorktree(id);
+            if (!wt)
+                return { ok: false, error: `session ${id} disappeared while restoring its archived worktree` };
+        }
+        catch (error) {
+            return { ok: false, refused: true, error: `session ${id}: archived worktree restore failed: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     // A process that died while validating left an internal candidate behind. This record lock proves no live
     // resume still owns it. Restore the frozen public original before doing any transport work and require an
     // explicit retry; stale runtime evidence is never adopted into a fresh launch attempt.
@@ -2891,19 +3273,19 @@ async function resumeSessionUnlocked(id, opts = {}) {
     // A prior adapter process may have proven identity + first-turn durability just before its session owner
     // died. Consume that receipt before choosing a recovery tail, so retry resumes the proven thread instead of
     // creating another one with the same first prompt.
-    if (h.launchPayloadProof && existsSync(sessionArtifactPath(id, 'launch.proof'))) {
+    if (h.launchPayloadProof && hasReadableLaunchReceipt(id)) {
         consumeHarnessLaunchProofUnlocked(id);
         wt = await findWorktree(id);
         if (!wt)
-            return { ok: false, error: `session ${id} disappeared while recovering native launch proof` };
+            return { ok: false, error: `session ${id} disappeared while recovering native launch receipt` };
     }
     // An archived record is expected to be stopped, but the guard must still inspect physical liveness in case
     // it is a legacy/invariant-violating row. Ignore filing and stale stop metadata for this one safety probe so
     // resume can never kill a live leaf merely because the record was hidden.
     const probeRec = wt.rec.archived ? { ...wt.rec, archived: false, stopped: false } : wt.rec;
-    const resumeSnap = await liveSnapshot();
+    const resumeSnap = h.runtimeOwnership === 'adapter' ? null : await liveSnapshot();
     const lv = h.runtimeOwnership === 'adapter'
-        ? (resumeSnap.windows.has(id) ? 'online' : 'offline')
+        ? await adapterRuntimeLiveness(probeRec)
         : liveness(probeRec, resumeSnap); // FRESH, honest liveness (listener-verified)
     if (guard && !force && lv === 'online')
         return { ok: false, refused: true, error: `session ${id} is ALIVE — refusing to relaunch, which would kill a live worker mid-work. To steer it, send it a message; use force only for a genuinely wedged (but alive) process.` };
@@ -2914,7 +3296,7 @@ async function resumeSessionUnlocked(id, opts = {}) {
         const recovery = await h.restoreRuntime?.(wt.rec);
         if (recovery && !recovery.ok)
             return { ok: false, refused: true, error: `session ${id}: recovery required before resume — ${recovery.reason}` };
-        writeRecord({ ...(readRecord(id) || wt.rec), adapterRecovery: null, coldProof: null, archived: false, stopped: true });
+        writeRecord({ ...(readRecord(id) || wt.rec), adapterRecovery: null, coldProof: null, archived: false, closedAt: null, stopped: true });
         wt = await findWorktree(id);
         if (!wt)
             return { ok: false, error: `session ${id} disappeared during adapter recovery` };
@@ -2923,8 +3305,8 @@ async function resumeSessionUnlocked(id, opts = {}) {
         // Make the durable row visible/offline before any adapter unarchive or launch RPC. Any later failure leaves
         // a retryable unarchived record rather than archived:true with a newly loaded target thread.
         const pendingRecovery = wt.rec.adapterRecovery || 'restore-runtime-pending';
-        writeRecord({ ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery });
-        const visible = readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery };
+        writeRecord({ ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery });
+        const visible = readRecord(id) || { ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: wt.rec.coldProof, adapterRecovery: pendingRecovery };
         const restored = await h.restoreRuntime?.(visible);
         if (restored && !restored.ok)
             return { ok: false, refused: true, error: `session ${id}: ${restored.reason}` };
@@ -2936,8 +3318,16 @@ async function resumeSessionUnlocked(id, opts = {}) {
     // fall through to a metadata-only no-op.
     // Archived sessions have no runtime by invariant. Resume first leaves cold storage, then the normal
     // starting -> online launch path recreates the same conversation.
-    const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, stopped: true, coldProof: null }) : wt.rec;
-    const resumed = { ...current, archived: false, coldProof: null, status: restingLifecycle(current.status), stopped: false };
+    const current = wasArchived ? (readRecord(id) || { ...wt.rec, archived: false, closedAt: null, stopped: true, coldProof: null }) : wt.rec;
+    const resumed = {
+        ...current,
+        archived: false,
+        closedAt: null,
+        coldProof: null,
+        status: restingLifecycle(current.status),
+        note: resumeNote(current.status, current.note),
+        stopped: false,
+    };
     if (force || lv === 'offline') {
         let resumeTail;
         try {
@@ -2969,8 +3359,10 @@ async function resumeSessionUnlocked(id, opts = {}) {
         const candidate = {
             ...latest,
             archived: false,
+            closedAt: null,
             coldProof: null,
             status: restingLifecycle(latest.status),
+            note: resumeNote(latest.status, latest.note),
             stopped: false,
             launchReadinessPending: launchReadinessPending(preResume),
         };
@@ -2994,11 +3386,19 @@ async function resumeSessionUnlocked(id, opts = {}) {
                 error: `session ${id}: launch readiness changed across the pending publication${readinessError ? ` - ${readinessError}` : ''}; the session remains stopped and can be retried`,
             };
         }
-        const published = readRecord(id) || candidate;
+        // `readRecord` projects the still-public pre-resume lifecycle while the candidate fence is pending.
+        // Carrying that stale projection into the final publish used to leave queued/error rows unchanged in
+        // SQLite even though the runtime envelope had crossed readiness. Publish the candidate lifecycle while
+        // retaining the latest non-lifecycle envelope fields.
+        const latestPublished = readRecord(id) || candidate;
+        const published = { ...latestPublished, status: candidate.status, proposal: candidate.proposal, note: candidate.note };
+        publishCanonicalLifecycle(published, candidate.status, candidate.proposal, candidate.note);
         writeRecord({ ...published, launchReadinessPending: null });
     }
-    else
+    else {
+        publishCanonicalLifecycle(current, resumed.status, resumed.proposal, resumed.note);
         writeRecord(resumed);
+    }
     return { ok: true };
 }
 export const resumeSession = (id, opts = {}) => withSessionTransition(id, async () => {
@@ -3012,9 +3412,28 @@ export function markState(status, opts = {}) {
     if (!id)
         return false;
     return withRecordLockSync(id, () => {
+        const raw = readRecord(id);
+        if (raw?.archived)
+            throw new ResourceConflict(`refusing lifecycle change for closed session ${id}: it is read-only; resume it before changing state`);
         const rec = readLiveRecord(id);
-        if (!rec)
+        if (!rec?.governed)
             return false;
+        const application = configuredSessionApplicationIfCutover();
+        if (application) {
+            const proposal = status === 'awaiting' ? (opts.proposal ?? 'nothing') : null;
+            const note = opts.note ?? null;
+            const current = application.readState(id);
+            if (current && current.status === status && current.proposal === proposal && current.note === note)
+                return true;
+            const recipients = canonicalWatchRecipients(application, id, status);
+            application.transitionSession(id, {
+                status,
+                proposal,
+                note,
+                recipientSessionIds: recipients,
+            });
+            return true;
+        }
         const proposal = status === 'awaiting' ? (opts.proposal ?? 'nothing') : null;
         writeRecord({
             ...rec, status,
@@ -3024,22 +3443,95 @@ export function markState(status, opts = {}) {
         return true;
     });
 }
+// A human prompt is the explicit re-entry from a waiting turn; runtime liveness is not.
+export function markHumanPromptActive(sessionId) {
+    try {
+        const rec = readRecord(sessionId);
+        const canonical = sessionHookState(sessionId);
+        // The canonical lifecycle decides whether this record is writable. Any real human re-entry can
+        // resume a waiting declaration, including an `awaiting` close/merge proposal; the old envelope
+        // status is only migration metadata and must never veto the re-entry.
+        if (!rec || !canonical || rec.archived || retirementReason(rec))
+            return false;
+        return markState('active', { sessionId });
+    }
+    catch (error) {
+        // The message/PTY write is already accepted; a raced close or unreadable record must not turn it into a false send failure.
+        console.error(`spex: could not publish human-input activity for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}
 export const markDone = (proposal = 'nothing', sessionId, note) => markState('awaiting', { proposal, note, sessionId });
-export const markError = (sessionId) => markState('error', { sessionId });
 export function markTurnFailure(sessionId, note) {
     if (!sessionId)
         return false;
     return withRecordLockSync(sessionId, () => {
         const rec = readLiveRecord(sessionId);
-        if (!rec || rec.status !== 'active' || rec.stopped || rec.archived)
+        if (!rec?.governed || rec.status !== 'active' || rec.stopped || rec.archived)
             return false;
+        const application = configuredSessionApplicationIfCutover();
+        if (application) {
+            application.transitionSession(sessionId, {
+                status: 'error', proposal: null, note,
+                recipientSessionIds: canonicalWatchRecipients(application, sessionId, 'error'),
+            });
+            return true;
+        }
         writeRecord({ ...rec, status: 'error', proposal: null, note });
         return true;
     });
 }
+// @@@ interrupt projection - a CONFIRMED human interrupt ended the turn, and the record says so the way an
+// undeclared stop does: `asking`, with the reason, because the agent now waits for the human's next message.
+// Active-only like every other turn-outcome writer: a declaration that landed first (the agent answered
+// before the abort reached it) stays authoritative. The marker is stamped before the abort is sent so the
+// adapter's own exit report — a one-turn process leaves with a non-zero code when aborted — reads the same
+// outcome instead of filing a failed turn; it expires so a genuine failure later is never mistaken for it.
+export const INTERRUPTED_NOTE = 'interrupted: the human stopped this turn; the next message continues the conversation';
+const INTERRUPT_MARKER_TTL_MS = 15_000;
+const interruptMarkerPath = (id) => sessionArtifactPath(id, 'turn.interrupted');
+export function stampInterrupt(id) {
+    mkdirSync(storeDir(id), { recursive: true });
+    writeFileSync(interruptMarkerPath(id), String(Date.now()));
+}
+export function clearInterruptMarker(id) {
+    try {
+        unlinkSync(interruptMarkerPath(id));
+    }
+    catch { /* never stamped, or already consumed */ }
+}
+function consumeInterruptMarker(id) {
+    let at = NaN;
+    try {
+        at = Number(readFileSync(interruptMarkerPath(id), 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    clearInterruptMarker(id);
+    return Number.isFinite(at) && Date.now() - at <= INTERRUPT_MARKER_TTL_MS;
+}
+function projectInterruptedUnlocked(sessionId) {
+    const rec = readLiveRecord(sessionId);
+    if (!rec?.governed || rec.status !== 'active' || rec.stopped || rec.archived)
+        return false;
+    const application = configuredSessionApplicationIfCutover();
+    if (application) {
+        application.transitionSession(sessionId, {
+            status: 'asking', proposal: null, note: INTERRUPTED_NOTE,
+            recipientSessionIds: canonicalWatchRecipients(application, sessionId, 'asking'),
+        });
+        return true;
+    }
+    writeRecord({ ...rec, status: 'asking', proposal: null, note: INTERRUPTED_NOTE });
+    return true;
+}
+export const markInterrupted = (sessionId) => withRecordLockSync(sessionId, () => projectInterruptedUnlocked(sessionId));
 export function markHeadlessTurnFailure(sessionId, harness, exitCode) {
     if (exitCode === '0')
         return false;
+    if (consumeInterruptMarker(sessionId))
+        return markInterrupted(sessionId);
     const outcome = /^\d+$/.test(exitCode) ? `exit code ${exitCode}` : `signal ${exitCode}`;
     return markTurnFailure(sessionId, `${harness} turn exited with ${outcome}`);
 }
@@ -3063,8 +3555,22 @@ function bindHarnessSessionIdUnlocked(rec, harnessSessionId, generationId = proc
             registrationPrepared = true;
         }
     }
+    const application = configuredSessionApplicationIfCutover();
+    const nativeStartToken = rec.runtimeStartToken || process.env.SPEXCODE_NATIVE_START_TOKEN?.trim();
+    if (application && !nativeStartToken)
+        throw new ResourceConflict(`refusing to bind runtime for ${id}: native start token is missing`);
     try {
         writeRecord({ ...rec, harnessSessionId, coldProof: null, adapterRecovery: null });
+        if (application) {
+            if (!nativeStartToken)
+                throw new ResourceConflict(`refusing to bind runtime for ${id}: native start token is missing`);
+            application.bindRuntime(id, {
+                namespace: 'spex-governed',
+                runtimeKind: rec.harness || defaultHarness.id,
+                nativeSessionId: harnessSessionId,
+                nativeStartToken,
+            });
+        }
     }
     catch (error) {
         if (codex && generationId && registrationPrepared) {
@@ -3080,9 +3586,26 @@ function bindHarnessSessionIdUnlocked(rec, harnessSessionId, generationId = proc
     if (codex && generationId)
         commitCodexGenerationRegistration(root, id, harnessSessionId, generationId);
 }
-function readHarnessLaunchProof(id) {
+const NATIVE_LAUNCH_RECEIPT_FILE = 'launch.receipt';
+const LEGACY_NATIVE_LAUNCH_RECEIPT_FILE = 'launch.proof'; // dead-words-ok: one-release reader preserves staged receipts created before the protocol rename
+function launchReceiptPath(id) {
+    return sessionArtifactPath(id, NATIVE_LAUNCH_RECEIPT_FILE);
+}
+function readableLaunchReceiptPath(id) {
+    const current = launchReceiptPath(id);
+    if (existsSync(current))
+        return current;
+    const legacy = sessionArtifactPath(id, LEGACY_NATIVE_LAUNCH_RECEIPT_FILE);
+    return existsSync(legacy) ? legacy : null;
+}
+function hasReadableLaunchReceipt(id) {
+    return readableLaunchReceiptPath(id) !== null;
+}
+function readHarnessLaunchProof(id, path = readableLaunchReceiptPath(id)) {
+    if (!path)
+        throw new ResourceConflict(`native launch receipt for ${id} is missing`);
     try {
-        const proof = JSON.parse(readFileSync(sessionArtifactPath(id, 'launch.proof'), 'utf8'));
+        const proof = JSON.parse(readFileSync(path, 'utf8'));
         if (!proof || proof.version !== 1 || typeof proof.sessionId !== 'string'
             || typeof proof.harnessId !== 'string' || typeof proof.harnessSessionId !== 'string' || !proof.harnessSessionId
             || typeof proof.launchPayloadHash !== 'string'
@@ -3091,7 +3614,7 @@ function readHarnessLaunchProof(id) {
         return proof;
     }
     catch (error) {
-        throw new ResourceConflict(`native launch proof for ${id} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+        throw new ResourceConflict(`native launch receipt for ${id} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
 function sameHarnessLaunchProof(left, right) {
@@ -3099,6 +3622,32 @@ function sameHarnessLaunchProof(left, right) {
         && left.harnessSessionId === right.harnessSessionId && left.launchPayloadHash === right.launchPayloadHash
         && left.generationId === right.generationId;
 }
+// A native launch can be proven just before its visible TUI exits. A shell-level retry must be able to ask
+// for that exact target without replaying the first prompt. This read-only resolver accepts either side of the
+// proof-consumption boundary: the durable record after identity binding, or the staged receipt while the record
+// lock has not consumed it yet. Any mismatch remains a loud resource conflict; returning null means no proof has
+// been established and a fresh first-turn attempt is still allowed.
+export function existingHarnessLaunchTarget(id) {
+    const rec = readLiveRecord(id);
+    if (!rec)
+        return null;
+    const harness = harnessById(rec.harness || defaultHarness.id);
+    if (!harness.launchPayloadProof)
+        return null;
+    const receiptPath = readableLaunchReceiptPath(id);
+    if (receiptPath) {
+        const proof = readHarnessLaunchProof(id, receiptPath);
+        if (proof.sessionId !== id || proof.harnessId !== harness.id)
+            throw new ResourceConflict(`native launch receipt for ${id} does not match the governed adapter identity`);
+        const pending = readLaunchFile(id);
+        if (pending != null && proof.launchPayloadHash !== createHash('sha256').update(pending).digest('hex'))
+            throw new ResourceConflict(`native launch receipt for ${id} does not match the authoritative resolved launch payload`);
+        if (rec.harnessSessionId && rec.harnessSessionId !== proof.harnessSessionId)
+            throw new ResourceConflict(`refusing to replace exact harness thread identity for ${id}; staged launch receipt differs from the record`);
+        return proof.harnessSessionId;
+    }
+    return rec.harnessSessionId || null;
+}
 export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPayload) {
     const id = sessionId || ownSessionId();
     if (!id || !harnessSessionId)
@@ -3108,17 +3657,17 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
         return false;
     const harness = harnessById(rec.harness || defaultHarness.id);
     if (!harness.launchPayloadProof)
-        throw new ResourceConflict(`harness ${harness.id} does not use native launch-payload proof`);
+        throw new ResourceConflict(`harness ${harness.id} does not use native launch-payload receipts`);
     const pending = readLaunchFile(id);
     if (pending == null)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: authoritative resolved launch payload is missing`);
     if (pending !== launchPayload)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: first-turn payload differs from the authoritative resolved launch payload`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: first-turn payload differs from the authoritative resolved launch payload`);
     const generationId = process.env.SPEXCODE_CODEX_GENERATION?.trim() || null;
     if (rec.harness === 'codex' || rec.harness === 'codex-headless') {
         const ledger = readCodexGenerationLedger(runtimeRoot());
         if (ledger.revision > 0 && !generationId)
-            throw new ResourceConflict(`refusing native launch proof for ${id}: launch did not provide an exact Codex generation id`);
+            throw new ResourceConflict(`refusing native launch receipt for ${id}: launch did not provide an exact Codex generation id`);
         if (generationId && (!ledger.generations[generationId] || ledger.generations[generationId].state === 'reclaimed'))
             throw new ResourceConflict(`refusing to bind Codex thread ${harnessSessionId}: generation ${generationId} is absent or reclaimed`);
     }
@@ -3130,7 +3679,14 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
         launchPayloadHash: createHash('sha256').update(launchPayload).digest('hex'),
         generationId,
     };
-    const path = sessionArtifactPath(id, 'launch.proof');
+    const existingPath = readableLaunchReceiptPath(id);
+    if (existingPath) {
+        const staged = readHarnessLaunchProof(id, existingPath);
+        if (sameHarnessLaunchProof(staged, proof))
+            return true;
+        throw new ResourceConflict(`refusing to replace native launch receipt for ${id}: the staged session, thread, payload, or generation differs`);
+    }
+    const path = launchReceiptPath(id);
     const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     writeFileSync(temp, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
     try {
@@ -3140,10 +3696,10 @@ export function stageHarnessLaunchProof(sessionId, harnessSessionId, launchPaylo
     catch (error) {
         if (error.code !== 'EEXIST')
             throw error;
-        const staged = readHarnessLaunchProof(id);
+        const staged = readHarnessLaunchProof(id, path);
         if (sameHarnessLaunchProof(staged, proof))
             return true;
-        throw new ResourceConflict(`refusing to replace native launch proof for ${id}: the staged session, thread, payload, or generation differs`);
+        throw new ResourceConflict(`refusing to replace native launch receipt for ${id}: the staged session, thread, payload, or generation differs`);
     }
     finally {
         rmSync(temp, { force: true });
@@ -3154,14 +3710,15 @@ function consumeHarnessLaunchProofUnlocked(id) {
     if (!rec)
         return false;
     const harness = harnessById(rec.harness || defaultHarness.id);
-    const proof = readHarnessLaunchProof(id);
+    const receiptPath = readableLaunchReceiptPath(id);
+    const proof = readHarnessLaunchProof(id, receiptPath);
     if (proof.sessionId !== id || proof.harnessId !== harness.id)
-        throw new ResourceConflict(`native launch proof for ${id} does not match the governed adapter identity`);
+        throw new ResourceConflict(`native launch receipt for ${id} does not match the governed adapter identity`);
     const pending = readLaunchFile(id);
     if (pending == null && rec.harnessSessionId !== proof.harnessSessionId)
-        throw new ResourceConflict(`refusing native launch proof for ${id}: authoritative resolved launch payload is missing`);
+        throw new ResourceConflict(`refusing native launch receipt for ${id}: authoritative resolved launch payload is missing`);
     if (pending != null && proof.launchPayloadHash !== createHash('sha256').update(pending).digest('hex'))
-        throw new ResourceConflict(`native launch proof for ${id} does not match the authoritative resolved launch payload`);
+        throw new ResourceConflict(`native launch receipt for ${id} does not match the authoritative resolved launch payload`);
     bindHarnessSessionIdUnlocked(rec, proof.harnessSessionId, proof.generationId || undefined);
     if (pending != null) {
         try {
@@ -3169,17 +3726,18 @@ function consumeHarnessLaunchProofUnlocked(id) {
         }
         catch (error) {
             if (error.code !== 'ENOENT') {
-                console.error(`spex: native launch proof committed for ${id}, but launch could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+                console.error(`spex: native launch receipt committed for ${id}, but launch could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
                 return true;
             }
         }
     }
     try {
-        rmSync(sessionArtifactPath(id, 'launch.proof'));
+        if (receiptPath)
+            rmSync(receiptPath);
     }
     catch (error) {
         if (error.code !== 'ENOENT')
-            console.error(`spex: native launch proof committed for ${id}, but launch.proof could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
+            console.error(`spex: native launch receipt committed for ${id}, but the receipt could not be consumed: ${error instanceof Error ? error.message : String(error)}`);
     }
     return true;
 }
@@ -3193,7 +3751,7 @@ export function markHarnessSessionId(sessionId, harnessSessionId) {
             return false;
         const harness = harnessById(rec.harness || defaultHarness.id);
         if (harness.launchPayloadProof)
-            throw new ResourceConflict(`harness ${harness.id} must stage native identity together with authoritative first-turn payload proof`);
+            throw new ResourceConflict(`harness ${harness.id} must stage native identity together with an authoritative first-turn payload receipt`);
         bindHarnessSessionIdUnlocked(rec, harnessSessionId);
         return true;
     });
@@ -3204,9 +3762,13 @@ export function markIdle(sessionId) {
         return false;
     return withRecordLockSync(id, () => {
         const rec = readLiveRecord(id);
-        if (!rec || rec.status !== 'active')
-            return false; // active-only: never clobber a declaration
-        writeRecord({ ...rec, status: 'idle' });
+        if (!rec?.governed || rec.status !== 'active')
+            return false; // managed active-only: never clobber a declaration
+        publishCanonicalLifecycle(rec, 'idle', null, null);
+        // After cutover the JSON file is only the runtime/worktree envelope. Do not mirror this inferred
+        // lifecycle transition into it: doing so creates a second, stale-looking status surface for hooks.
+        if (!configuredSessionApplicationIfCutover())
+            writeRecord({ ...rec, status: 'idle' });
         return true;
     });
 }
@@ -3244,6 +3806,265 @@ function porcelainPath(line) {
         p = p.slice(arrow + 4);
     return p;
 }
+export function commitUrlForRemote(remote, commit) {
+    const raw = remote.trim();
+    let host = '', path = '';
+    try {
+        const url = new URL(raw);
+        if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'ssh:') {
+            host = url.host;
+            path = url.pathname;
+        }
+    }
+    catch {
+        const scp = /^(?:[^@/]+@)?([^:/]+):(.+)$/.exec(raw);
+        if (scp)
+            [, host, path] = scp;
+    }
+    path = path.replace(/^\/+|\/+$/g, '').replace(/\.git$/, '');
+    if (!host || !path)
+        return null;
+    const commitPath = host.toLowerCase().includes('gitlab') ? '-/commit' : 'commit';
+    return `https://${host}/${path}/${commitPath}/${commit}`;
+}
+// The branch diff is a proof over commits, not over a working directory: refs and objects are shared with
+// the main checkout, so a session whose worktree directory is gone (landed and cleaned, or reaped) keeps a
+// provable diff for as long as its branch ref survives. Anchor git at the live worktree when it exists and
+// at the main checkout otherwise; only a branch whose ref is gone everywhere is honestly unavailable, and
+// that refusal is a structured conflict (409 {error, code}) — never a raw git ENOENT turned into a 500.
+async function diffAnchorRoot(wt) {
+    if (!wt.branch)
+        throw new ResourceConflict(`session ${wt.rec.session} has no branch to diff`, 'diff-unavailable');
+    if (wt.path && existsSync(wt.path))
+        return wt.path;
+    const main = mainRoot();
+    const proven = await gitTry(['-C', main, 'rev-parse', '--verify', `refs/heads/${wt.branch}^{commit}`]);
+    if (proven.ok)
+        return main;
+    throw new ResourceConflict(`session ${wt.rec.session} has no worktree on disk and its branch ${wt.branch} no longer exists`, 'diff-unavailable');
+}
+// @@@ forkCommitOf - the commit the branch was created at, from the most authoritative source that has it.
+// The record carries it for every session created since it was introduced. Older records recover the same
+// commit from the branch ref's OLDEST reflog entry, which is where git itself wrote the `worktree add` start
+// point. Neither available (reflog pruned, or a branch adopted from outside this flow) → null, and the caller
+// falls back to what ancestry alone can prove.
+async function forkCommitOf(root, wt) {
+    if (wt.rec.forkCommit && isGitObjectId(root, wt.rec.forkCommit))
+        return wt.rec.forkCommit;
+    if (!wt.branch)
+        return null;
+    const log = await gitTry(['-C', root, 'reflog', 'show', '--no-abbrev', '--format=%H', `refs/heads/${wt.branch}`]);
+    if (!log.ok)
+        return null;
+    const entries = log.stdout.split('\n').map((line) => line.trim()).filter(Boolean);
+    const created = entries[entries.length - 1];
+    return created && isGitObjectId(root, created) ? created : null;
+}
+async function diffHeadPair(root, wt) {
+    if (!wt.branch)
+        throw new ResourceConflict(`session ${wt.rec.session} has no branch to diff`, 'diff-unavailable');
+    const baseRef = wt.rec.base || mainBranch();
+    const [headOut, baseOut] = await Promise.all([
+        gitTry(['-C', root, 'rev-parse', '--verify', `refs/heads/${wt.branch}^{commit}`]),
+        gitTry(['-C', root, 'rev-parse', '--verify', `${baseRef}^{commit}`]),
+    ]);
+    const head = headOut.ok ? headOut.stdout.trim() : '', resolvedBase = baseOut.ok ? baseOut.stdout.trim() : '';
+    if (!head || !resolvedBase || !isGitObjectId(root, head) || !isGitObjectId(root, resolvedBase))
+        throw new ResourceConflict(`session ${wt.rec.session} diff heads are unproven`, 'diff-unavailable');
+    const mergeBaseOut = await gitTry(['-C', root, 'merge-base', resolvedBase, head]);
+    const mergeBase = mergeBaseOut.ok ? mergeBaseOut.stdout.trim() : '';
+    if (!mergeBase || !isGitObjectId(root, mergeBase))
+        throw new ResourceConflict(`session ${wt.rec.session} diff merge-base is unproven`, 'diff-unavailable');
+    const [ancestor, remote, forkCommit] = await Promise.all([
+        gitTry(['-C', root, 'merge-base', '--is-ancestor', head, resolvedBase]),
+        gitTry(['-C', root, 'remote', 'get-url', 'origin']),
+        forkCommitOf(root, wt),
+    ]);
+    // A branch that never authored a commit is ALSO an ancestor of its base, so ancestry must be asked second.
+    // Without a fork commit the only provable form of "authored nothing" is a head that is still the base head.
+    const authoredNothing = forkCommit ? head === forkCommit : head === resolvedBase;
+    return {
+        branch: wt.branch, baseRef, base: resolvedBase, head, mergeBase,
+        branchState: authoredNothing ? 'no-commits' : ancestor.ok ? 'merged' : 'open',
+        commitUrl: remote.ok ? commitUrlForRemote(remote.stdout, head) : null,
+    };
+}
+// @@@ workingFiles - the session's uncommitted changes, enumerated from ONE porcelain status plus ONE numstat.
+// Untracked files count their own lines rather than spawning a git child each: the metadata call stays two
+// processes however dirty the tree is, and nothing here touches the index — an `--intent-to-add` would mutate
+// the worktree a live agent is working in.
+const WORKING_STATUS = { '??': 'untracked', A: 'added', D: 'deleted', R: 'renamed', C: 'copied', T: 'type-changed' };
+async function workingFiles(root) {
+    const [statusOut, numstatOut] = await Promise.all([
+        gitA(['-C', root, '-c', 'core.quotePath=false', 'status', '--porcelain', '--untracked-files=all']),
+        gitA(['-C', root, '-c', 'core.quotePath=false', 'diff', '--numstat', '-M', 'HEAD']),
+    ]);
+    const counts = new Map();
+    for (const line of numstatOut.split('\n')) {
+        const m = line.match(/^(-|\d+)\t(-|\d+)\t(.+)$/);
+        if (!m)
+            continue;
+        const { to } = parseStatPath(m[3]);
+        counts.set(to, { additions: m[1] === '-' ? 0 : +m[1], deletions: m[2] === '-' ? 0 : +m[2] });
+    }
+    const files = [];
+    for (const line of statusOut.split('\n')) {
+        if (!line.trim())
+            continue;
+        const code = line.slice(0, 2);
+        const path = porcelainPath(line);
+        const arrow = line.indexOf(' -> ');
+        const oldPath = arrow >= 0 ? line.slice(3, arrow) : '';
+        const letter = code.trim().replace(/[^A-Z?]/g, '').slice(0, 1) || 'M';
+        const status = WORKING_STATUS[code === '??' ? '??' : letter] ?? 'modified';
+        files.push({
+            path,
+            ...(oldPath && oldPath !== path ? { oldPath } : {}),
+            status,
+            ...(counts.get(path) ?? (code === '??' ? untrackedCounts(join(root, path)) : { additions: 0, deletions: 0 })),
+        });
+    }
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+}
+// An untracked file is entirely new, so its addition count is its line count. A NUL byte means git would
+// print `-`/`-` for a binary blob; report the same nothing rather than a line count of bytes.
+function untrackedCounts(absolute) {
+    try {
+        const body = readFileSync(absolute);
+        if (body.includes(0))
+            return { additions: 0, deletions: 0 };
+        const text = body.toString('utf8');
+        return { additions: text.length ? text.replace(/\n$/, '').split('\n').length : 0, deletions: 0 };
+    }
+    catch {
+        return { additions: 0, deletions: 0 };
+    }
+}
+async function workingPatch(root, file, untracked) {
+    if (untracked) {
+        // --no-index against /dev/null renders a whole new file as one addition hunk. It exits 1 when the two
+        // sides differ, which is the normal case here, so the patch is read off stdout rather than off `ok`.
+        const out = await gitTry(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', '--no-index', '--', '/dev/null', file.path]);
+        return out.stdout;
+    }
+    return gitA(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', 'HEAD', '--', ...(file.oldPath ? [file.oldPath, file.path] : [file.path])]);
+}
+// A working file's identity must move when its CONTENT moves, or a stale editor and a stale comment anchor
+// would survive an edit. Size and mtime are what change on every write, and they cost one stat.
+function workingIdentity(root, file) {
+    let stamp = 'gone';
+    try {
+        const s = statSync(join(root, file.path));
+        stamp = `${s.size}:${s.mtimeMs}`;
+    }
+    catch { /* deleted in the worktree */ }
+    return createHash('sha256').update(`working\0${file.path}\0${file.oldPath || ''}\0${stamp}`).digest('hex');
+}
+export async function sessionDiff(id, filePath, offset = 0, limit = 120_000, scope = 'branch') {
+    const wt = await findWorktree(id);
+    if (!wt)
+        return null;
+    const root = await diffAnchorRoot(wt);
+    const pair = await diffHeadPair(root, wt);
+    // The working tree is the session's OWN directory or it is not knowable. `root` falls back to the main
+    // checkout once the worktree is gone ([[diff-document]]), and that checkout's dirty files belong to whoever
+    // is working there — never to this session.
+    const liveRoot = wt.path && existsSync(wt.path) ? wt.path : null;
+    const window = (patch) => patch.slice(offset, offset + limit);
+    // A per-file fetch names its scope, so only that scope is enumerated: opening one file in a worktree with a
+    // hundred dirty paths must not re-walk the other scope's git reads.
+    const branch = scope === 'branch' || !filePath ? await mergeBaseDiff(root, pair.base, pair.head) : [];
+    const branchSelected = scope === 'branch' && filePath ? branch.filter((file) => file.path === filePath || file.oldPath === filePath) : (filePath ? [] : branch);
+    const files = await Promise.all(branchSelected.map(async (file) => {
+        const identity = createHash('sha256').update(`${pair.mergeBase}\0${pair.head}\0${file.path}\0${file.oldPath || ''}`).digest('hex');
+        if (!filePath)
+            return { ...file, patch: '', diffIdentity: identity };
+        const patch = await gitA(['-C', root, '--no-pager', 'diff', '--no-ext-diff', '--unified=40', pair.mergeBase, pair.head, '--', ...(file.oldPath ? [file.oldPath, file.path] : [file.path])]);
+        return { ...file, patch: window(patch), diffIdentity: identity };
+    }));
+    const dirty = liveRoot && (scope === 'working' || !filePath) ? await workingFiles(liveRoot) : [];
+    const workingSelected = scope === 'working' && filePath ? dirty.filter((file) => file.path === filePath || file.oldPath === filePath) : (filePath ? [] : dirty);
+    const working = await Promise.all(workingSelected.map(async (file) => {
+        const identity = workingIdentity(liveRoot, file);
+        if (!filePath)
+            return { ...file, patch: '', diffIdentity: identity };
+        const patch = await workingPatch(liveRoot, file, file.status === 'untracked');
+        return { ...file, patch: window(patch), diffIdentity: identity };
+    }));
+    return {
+        id, scope: 'branch', ...pair, files,
+        working: { readable: !!liveRoot, files: working },
+        comments: wt.rec.diffComments ?? [],
+    };
+}
+export async function saveDiffComment(id, input) {
+    const body = input.body.trim();
+    if (!input.filePath || !body || !Number.isInteger(input.lineStart) || input.lineStart < 1 || !Number.isInteger(input.lineEnd) || input.lineEnd < input.lineStart || !input.diffIdentity)
+        throw new ResourceConflict('diff comment needs a file, line range, body, and diff identity');
+    return withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const comment = { id: input.id || randomUUID(), filePath: input.filePath, lineStart: input.lineStart, lineEnd: input.lineEnd, body, diffIdentity: input.diffIdentity, sentAt: null };
+        const comments = (rec.diffComments ?? []).filter((candidate) => candidate.id !== comment.id);
+        writeRecord({ ...rec, diffComments: [...comments, comment] });
+        return comment;
+    });
+}
+// A review conversation you can only append to is not a conversation. Saving, editing and sending all
+// existed; nothing could take a row back, so a comment filed on the wrong line — or a probe left by a
+// measurement — stayed on the record forever. Retract is the same shape as the other two `retract` verbs
+// this product already has ([[session-files]], eval): it removes the row under the record lock and says
+// which one it removed. Already-DELIVERED text is not recalled — the agent read it — so this retracts the
+// record's row, never the message that was sent.
+export async function retractDiffComment(id, commentId) {
+    if (!commentId)
+        throw new ResourceConflict('retracting a diff comment needs its id');
+    return withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const comments = rec.diffComments ?? [];
+        const removed = comments.find((comment) => comment.id === commentId);
+        if (!removed)
+            return null;
+        writeRecord({ ...rec, diffComments: comments.filter((comment) => comment.id !== commentId) });
+        return removed;
+    });
+}
+export async function sendDiffComments(id, ids) {
+    const selected = await withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return null;
+        const wanted = ids?.length ? new Set(ids) : null;
+        return (rec.diffComments ?? []).filter((comment) => !comment.sentAt && (!wanted || wanted.has(comment.id)));
+    });
+    if (!selected)
+        return { ok: false, error: `no such session ${id}` };
+    if (!selected.length)
+        return { ok: false, error: 'no unsent diff comments' };
+    const text = ['Review comments on the branch diff:', ...selected.map((comment) => {
+            const lines = comment.lineStart === comment.lineEnd ? `L${comment.lineStart}` : `L${comment.lineStart}-L${comment.lineEnd}`;
+            return `- ${comment.filePath}:${lines}\n  ${comment.body.replace(/\n/g, '\n  ')}`;
+        })].join('\n');
+    const sent = await sendText(id, text);
+    if (!sent.ok)
+        return { ok: false, error: sent.error || 'could not send diff comments' };
+    const sentAt = new Date().toISOString();
+    await withRecordLock(id, async () => {
+        const rec = readLiveRecord(id);
+        if (!rec)
+            return;
+        const selectedById = new Map(selected.map((comment) => [comment.id, comment]));
+        writeRecord({ ...rec, diffComments: (rec.diffComments ?? []).map((comment) => {
+                const before = selectedById.get(comment.id);
+                const unchanged = before && !comment.sentAt && comment.body === before.body && comment.diffIdentity === before.diffIdentity;
+                return unchanged ? { ...comment, sentAt } : comment;
+            }) });
+    });
+    return { ok: true, sentAt, count: selected.length };
+}
 async function reviewHeadPair(root, branch, base) {
     const branchRef = `refs/heads/${branch}`, baseRef = `refs/heads/${base}`;
     const output = await gitA(['-C', root, 'for-each-ref', '--sort=refname', '--format=%(refname)%00%(objectname)', branchRef, baseRef]);
@@ -3350,16 +4171,7 @@ export async function mergeSession(id) {
         return { dispatched: false, reason: 'no such mergeable session' };
     const r = await sendText(id, MERGE_PROMPT, undefined, {
         deferDrain: true,
-        acceptGuard: async (rec) => {
-            if (!rec.governed || rec.status !== 'awaiting' || rec.proposal !== 'merge') {
-                const error = new ResourceConflict(`session ${id} is not a governed awaiting merge proposal`);
-                Object.assign(error, { code: 'session_merge_not_proposed' });
-                throw error;
-            }
-        },
     });
-    if (r.code === 'session_merge_not_proposed')
-        return { dispatched: false, reason: r.error || 'merge dispatch refused', code: r.code, status: 409 };
     if (!r.ok)
         return { dispatched: false, reason: r.error || 'could not dispatch merge prompt' };
     await resumeSession(id, { guard: false });
@@ -3627,7 +4439,7 @@ async function inspectSessionLeafIdentity(id, rec) {
     const startAfter = sessionLeafStartToken(pid);
     const candidate = sessionLeafReceiptCandidate(id, pid, panePid, procs, startBefore, startAfter);
     if (!candidate.ok || !candidate.receipt)
-        return { state: 'unknown', pid, reason: candidate.reason || 'leaf birth receipt proof failed' };
+        return { state: 'unknown', pid, reason: candidate.reason || 'leaf birth receipt validation failed' };
     if (readAgentPid(path) !== pid || sessionLeafStartToken(pid) !== candidate.receipt.startToken)
         return { state: 'unknown', pid, reason: `leaf PID ${pid} identity changed before receipt commit` };
     writeSessionLeafReceipt(id, candidate.receipt);
@@ -3681,7 +4493,7 @@ async function stopAgentProcess(id, rec, requireCold = false, coldReceipt) {
     if (requireCold) {
         const cold = await harness.coldRuntime?.(rec, coldReceipt);
         if (cold && !cold.ok)
-            throw new ResourceConflict(`refusing to archive ${id}: ${cold.reason}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${cold.reason}`);
     }
 }
 async function stopSessionUnlocked(id) {
@@ -3706,25 +4518,23 @@ async function stopSessionUnlocked(id) {
     return !!wt;
 }
 export const stopSession = (id) => withSessionTransition(id, () => withRecordLock(id, () => stopSessionUnlocked(id)));
-async function archiveSessionUnlocked(id, on = true) {
+async function coldStopSessionUnlocked(id) {
     let wt;
     try {
         wt = await findWorktree(id);
     }
     catch (e) {
         if (e instanceof SessionRecordUnusable)
-            throw new ResourceConflict(`refusing to archive ${id}: ${e.message}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${e.message}`);
         throw e;
     }
     if (!wt)
         return false;
-    if (!on)
-        throw new ResourceConflict('unarchive is not a record-only transition; use resume to restore the runtime');
     if (wt.rec.status === 'queued')
-        throw new ResourceConflict(`refusing to archive ${id}: queued sessions have only a prepared launch prompt; resume/startQueued is their lifecycle`);
+        throw new ResourceConflict(`refusing to close ${id}: queued sessions have only a prepared launch prompt; close handles their prepared tree directly`);
     const retired = retirementReason(wt.rec);
     if (retired)
-        throw new ResourceConflict(`refusing to archive ${id}: ${retired}`);
+        throw new ResourceConflict(`refusing to close ${id}: ${retired}`);
     archiving.add(id);
     try {
         const h = harnessById(wt.rec.harness || defaultHarness.id);
@@ -3738,12 +4548,12 @@ async function archiveSessionUnlocked(id, on = true) {
         if (wt.rec.archived && hasValidColdProof(wt.rec)) {
             const proofSnap = await liveSnapshot(id);
             if (proofSnap.probeFailed)
-                throw new ResourceConflict(`refusing to re-archive ${id}: liveness probe failed; the exact leaf may have respawned`);
+                throw new ResourceConflict(`refusing to close ${id}: liveness probe failed; the exact leaf may have respawned`);
             const proofLv = h.runtimeOwnership === 'adapter'
                 ? (proofSnap.windows.has(id) ? 'online' : 'offline')
                 : liveness({ ...wt.rec, archived: false, stopped: false }, proofSnap);
             if (proofLv === 'unknown' || proofLv === 'starting')
-                throw new ResourceConflict(`refusing to re-archive ${id}: session liveness is ${proofLv}; exact cold state is unproven`);
+                throw new ResourceConflict(`refusing to close ${id}: session liveness is ${proofLv}; exact cold state is unproven`);
             if (proofLv === 'offline') {
                 // A deliberately stopped shared control plane is a valid empty resident census. A durable proof plus
                 // an adapter-owned root-absent fact is the only idempotent short-circuit; a live root still has to prove
@@ -3768,28 +4578,25 @@ async function archiveSessionUnlocked(id, on = true) {
                 }
             }
         }
-        // Legacy/respawned archives are made visible before repair. Any refusal below therefore leaves an unarchived
-        // row instead of relying on a hidden bit while a runtime proof is missing.
+        // Legacy/respawned closed rows are probed as ordinary runtime records, but the durable archived bit is kept
+        // untouched until the new close publication succeeds.
         if (wt.rec.archived) {
-            writeRecord({ ...wt.rec, archived: false, coldProof: null });
-            wt = await findWorktree(id);
-            if (!wt)
-                return false;
+            wt = { ...wt, rec: { ...wt.rec, archived: false, coldProof: null } };
         }
         const snap = await liveSnapshot(id);
         if (snap.probeFailed)
-            throw new ResourceConflict(`refusing to archive ${id}: liveness probe failed; the leaf may still be live`);
+            throw new ResourceConflict(`refusing to close ${id}: liveness probe failed; the leaf may still be live`);
         const lv = h.runtimeOwnership === 'adapter'
             ? 'offline'
             : liveness({ ...wt.rec, archived: false, stopped: false }, snap);
         if (lv === 'unknown' || lv === 'starting')
-            throw new ResourceConflict(`refusing to archive ${id}: session liveness is ${lv}; exact leaf ownership is unproven`);
+            throw new ResourceConflict(`refusing to close ${id}: session liveness is ${lv}; exact leaf ownership is unproven`);
         // The adapter guard runs BEFORE any tmux/process signal. Active/unknown native turns and ambiguous descendant
         // ownership refuse here; a verified adapter receipt carries an exact subtree through to coldRuntime's commit.
         assertSessionOwnerSafe(id, h.id);
         const preflight = await h.coldPreflight?.({ ...wt.rec, archived: false, stopped: lv === 'offline' });
         if (preflight && !preflight.ok)
-            throw new ResourceConflict(`refusing to archive ${id}: ${preflight.reason}`);
+            throw new ResourceConflict(`refusing to close ${id}: ${preflight.reason}`);
         // Even a proven-offline leaf can leave a stale rendezvous/socket or adapter artifact. Reuse the same exact
         // teardown seam with the explicit stopped marker so cleanupRuntime gets its ownership check and no second
         // cleanup primitive is invented.
@@ -3801,12 +4608,12 @@ async function archiveSessionUnlocked(id, on = true) {
             coldCommitted = true;
             const latest = readRecord(id);
             if (!latest)
-                throw new ResourceConflict(`refusing to archive ${id}: session record disappeared before filing`);
+                throw new ResourceConflict(`refusing to close ${id}: session record disappeared before archive-ref publication`);
             // The leaf identity kill and adapter cold proof established process/transport absence. Record-backed
             // adapters intentionally project online until the archive write, so display liveness is not physical
             // evidence here. A target pane appearing after the stop proof is the remaining shared runtime witness.
             await assertTargetTmuxAbsent(id, 'before archive filing');
-            writeRecord({ ...latest, archived: true, stopped: true, coldProof: coldProofFor(latest), adapterRecovery: null });
+            writeRecord({ ...latest, stopped: true, coldProof: coldProofFor(latest), adapterRecovery: null });
         }
         catch (error) {
             if (coldCommitted) {
@@ -3832,102 +4639,10 @@ async function archiveSessionUnlocked(id, on = true) {
         archiving.delete(id);
     }
 }
-export const archiveSession = (id, on = true) => {
-    if (!on)
-        return archiveSessionUnarchive(id);
-    return withSessionTransition(id, () => withRecordLock(id, () => archiveSessionUnlocked(id, on)));
-};
-async function archiveSessionUnarchive(id) {
-    const wt = await findWorktree(id);
-    if (!wt)
-        return false;
-    if (!wt.rec.archived)
-        return true;
-    const resumed = await resumeSession(id);
-    if (!resumed.ok)
-        throw new ResourceConflict(resumed.error || `refusing to resume ${id}`);
-    return true;
-}
-// @@@ cold retirement - archive already returned the target's runtime, so closing a proven-cold row must not
-// re-enter the live stop guard and make unrelated shared-root references prove ownership again. Verify only
-// that the target-bound cold proof is still current and that no target PID/window/socket/thread has reappeared.
-// This is read-only: no signal, adapter mutation, or shared-root cleanup belongs on the cold path.
-async function assertColdRetirementSafe(id, rec) {
-    if (!rec.archived || !rec.stopped || !hasValidColdProof(rec))
-        throw new ResourceConflict(`refusing to close archived session ${id}: target-bound cold witness is missing or stale`);
-    if (rec.adapterRecovery)
-        throw new ResourceConflict(`refusing to close archived session ${id}: adapter recovery is pending (${rec.adapterRecovery})`);
-    const [snap, socket] = await Promise.all([liveSnapshot(id), rendezvousListening(id)]);
-    if (snap.probeFailed)
-        throw new ResourceConflict(`refusing to close archived session ${id}: liveness probe failed; target runtime absence is unproven`);
-    if (snap.windows.has(id))
-        throw new ResourceConflict(`refusing to close archived session ${id}: target tmux window has reappeared`);
-    if (socket === 'live')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous transport has reappeared`);
-    if (socket === 'unproven')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target rendezvous state is ambiguous`);
-    const leaf = await inspectSessionLeafIdentity(id, rec);
-    if (leaf.state === 'owned')
-        throw new ResourceConflict(`refusing to close archived session ${id}: target leaf PID ${leaf.identity.pid} is live or recycled; ownership is ambiguous`);
-    if (leaf.state === 'unknown')
-        throw new ResourceConflict(`refusing to close archived session ${id}: ${leaf.reason}; ownership is ambiguous`);
-    const harness = harnessById(rec.harness || defaultHarness.id);
-    if (harness.coldRetirementPreflight) {
-        const proof = await harness.coldRetirementPreflight(rec);
-        if (!proof.ok)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`);
-        return;
-    }
-    const descriptors = harness.sharedRuntimes?.(runtimeRoot()) ?? [];
-    let everySharedRootAbsent = descriptors.length > 0;
-    for (const descriptor of descriptors) {
-        const resident = descriptor.residency
-            ? await descriptor.residency()
-            : await descriptor.probe().then((probe) => ({ healthy: probe.healthy, referenceIds: probe.references.map((reference) => reference.referenceId), error: probe.error }));
-        if (!resident.healthy)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${resident.error || `${descriptor.label} resident census is unhealthy`}`);
-        if (rec.harnessSessionId && resident.referenceIds.includes(rec.harnessSessionId))
-            throw new ResourceConflict(`refusing to close archived session ${id}: target adapter thread ${rec.harnessSessionId} is loaded`);
-        everySharedRootAbsent = everySharedRootAbsent && resident.rootAbsent === true;
-    }
-    if (harness.coldPreflight && !everySharedRootAbsent) {
-        const proof = await harness.coldPreflight(rec);
-        if (!proof.ok)
-            throw new ResourceConflict(`refusing to close archived session ${id}: ${proof.reason}`);
-        if (!proof.alreadyCold)
-            throw new ResourceConflict(`refusing to close archived session ${id}: target adapter collection is not proven cold`);
-    }
-}
-async function assertDiscardableWorktree(id, path, branch, kind) {
-    if (existsSync(path)) {
-        const status = await gitTry(['-C', path, 'status', '--porcelain', '--untracked-files=all']);
-        if (!status.ok)
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree status is unreadable`);
-        if (status.stdout.trim())
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree has dirty work`);
-    }
-    if (branch) {
-        const resolved = await gitTry(['-C', mainRoot(), 'rev-parse', '--verify', `${branch}^{commit}`]);
-        if (resolved.ok) {
-            const count = await gitTry(['-C', mainRoot(), 'rev-list', '--count', `${mainBranch()}..${branch}`]);
-            if (!count.ok)
-                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch ancestry is unreadable`);
-            const ahead = Number(count.stdout.trim());
-            if (!Number.isFinite(ahead) || ahead !== 0)
-                throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch is ${Number.isFinite(ahead) ? ahead : 'an unknown number of'} commit(s) ahead`);
-        }
-        else if (resolved.failure !== 'exit') {
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} branch identity is unreadable`);
-        }
-        else if (existsSync(path)) {
-            throw new ResourceConflict(`refusing to close ${kind} session ${id}: ${kind} worktree exists but branch ${branch} is missing`);
-        }
-    }
-}
 // A never-launched queue owns only prepared disk state. The transition/record locks around close serialize
 // this check with startQueued: whichever wins decides whether the record is still a queue or has become live.
 // No shared-runtime probe belongs here because a valid prepared row has no adapter thread to look up.
-async function assertQueuedRetirementSafe(id, rec, path, branch) {
+async function assertQueuedCloseSafe(id, rec) {
     if (rec.status !== 'queued' || rec.harnessSessionId)
         throw new ResourceConflict(`refusing to close queued session ${id}: the record has a target thread or is no longer queued`);
     if (rec.adapterRecovery || launching.has(id))
@@ -3946,14 +4661,20 @@ async function assertQueuedRetirementSafe(id, rec, path, branch) {
         const pid = readAgentPid(pidPath);
         throw new ResourceConflict(`refusing to close queued session ${id}: target leaf PID artifact ${Number.isFinite(pid) && pid > 0 ? pid : 'is unreadable'}; never-launched ownership is ambiguous`);
     }
-    await assertDiscardableWorktree(id, path, branch, 'prepared');
+    // close preserves the prepared tree's dirty state in refs/spex-archive/<id>; cleanliness is not a
+    // precondition for the soft terminal transition.
 }
 // A launch may leave its row active before Codex publishes the native thread binding. This close path owns
 // only the record's dead local launch residue; an unbound app-server peer stays unowned and untouched.
-async function assertUnboundRetirementSafe(id, rec, path, branch) {
+async function assertUnboundCloseSafe(id, rec) {
     if (harnessById(rec.harness || defaultHarness.id).exactNativeTargetId(rec) || rec.status === 'queued' || rec.archived)
         throw new ResourceConflict(`refusing to close unbound session ${id}: it is not an unbound live-record residue`);
-    if (rec.adapterRecovery || rec.launchReadinessPending || launching.has(id) || existsSync(sessionArtifactPath(id, 'launch')))
+    const failureStamped = /^queued launch readiness failed:/.test(rec.note || '') || rec.status === 'error' || rec.stopped;
+    const readinessStartedAt = rec.launchReadinessStartedAt ?? rec.launchReadinessPending?.startedAt ?? null;
+    const readinessInProgress = !failureStamped && (readinessStartedAt != null
+        ? Date.now() - readinessStartedAt < SOCKET_READY_TIMEOUT_MS
+        : launching.has(id));
+    if (rec.adapterRecovery || readinessInProgress)
         throw new ResourceConflict(`refusing to close unbound session ${id}: launch or recovery is still in progress`);
     const [snap, socket] = await Promise.all([liveSnapshot(id), rendezvousListening(id)]);
     if (snap.probeFailed)
@@ -3968,55 +4689,45 @@ async function assertUnboundRetirementSafe(id, rec, path, branch) {
     const leaf = await inspectSessionLeafIdentity(id, rec);
     if (leaf.state !== 'missing' && leaf.state !== 'dead')
         throw new ResourceConflict(`refusing to close unbound session ${id}: ${leaf.state === 'unknown' ? leaf.reason : 'target leaf identity is live or ambiguous'}`);
-    await assertDiscardableWorktree(id, path, branch, 'unbound');
 }
-async function closeOwnedSessionUnlocked(id, wt, source, unboundRetired = false) {
+async function closeOwnedSessionUnlocked(id, wt, _source, unboundStopped = false) {
     const root = mainRoot();
     const receiptFailure = publishedSessionCandidateReceiptRetirementFailure(wt.rec, root);
     if (receiptFailure)
-        throw new ResourceConflict(`refusing destructive close for ${id}: ${receiptFailure}; public record and resources remain the authority fence`);
-    const closesCodexBinding = (wt.rec.harness === 'codex' || wt.rec.harness === 'codex-headless') && !!wt.rec.harnessSessionId;
-    const retired = !wt.rec.archived && !!retirementReason(wt.rec);
-    // A retired row has already lost its worktree; close is its explicit record-only terminal cleanup.
-    if (!retired) {
-        if (wt.rec.archived)
-            await assertColdRetirementSafe(id, wt.rec);
-        else if (wt.rec.status === 'queued')
-            await assertQueuedRetirementSafe(id, wt.rec, wt.path, wt.branch);
-        else if (!unboundRetired)
-            throw new ResourceConflict(`refusing to close ${id}: target runtime was not cold-retired first`);
-    }
-    // The marker protects only the destructive half. A failed cold proof must leave a normal, resumable binding.
-    if (closesCodexBinding)
-        prepareCodexGenerationClose(runtimeRoot(), id, wt.rec.harnessSessionId);
-    appendCloseLedger(id, wt.rec, source);
+        throw new ResourceConflict(`refusing close for ${id}: ${receiptFailure}; public record and resources remain the authority fence`);
+    const retired = !!retirementReason(wt.rec);
+    if (!retired && wt.rec.status === 'queued')
+        await assertQueuedCloseSafe(id, wt.rec);
+    if (!retired && !unboundStopped && wt.rec.status !== 'queued') {
+        await coldStopSessionUnlocked(id);
+        wt = (await findWorktree(id)) || wt;
+    }
+    // The archive ref is published before any worktree removal. A failed ref write leaves the complete
+    // worktree and record in place for retry.
+    if (!retired && existsSync(wt.path))
+        archiveWorktreeState(id, wt.path);
+    const latest = readRecord(id);
+    if (!latest)
+        throw new ResourceConflict(`refusing to finish close for ${id}: session record disappeared before publication`);
+    writeRecord({
+        ...latest,
+        archived: true,
+        closedAt: latest.closedAt || new Date().toISOString(),
+        stopped: true,
+        coldProof: latest.coldProof || coldProofFor(latest),
+        adapterRecovery: null,
+    });
     let slot = null;
     try {
-        slot = treeSlotDir(wt.path);
+        slot = existsSync(wt.path) ? treeSlotDir(wt.path) : null;
     }
     catch { /* tree already unresolvable — nothing to key the slot by */ }
-    // a retired session's worktree/branch are already gone; removing them is a no-op to skip, not a failure.
     if (existsSync(wt.path)) {
-        const removed = await gitTry(['-C', root, 'worktree', 'remove', '--force', wt.path]);
-        if (!removed.ok)
-            throw new ResourceConflict(`refusing to finish close for ${id}: worktree removal failed`);
-        if (existsSync(wt.path))
-            throw new ResourceConflict(`refusing to finish close for ${id}: worktree remains after removal`);
-    }
-    if (wt.branch) {
-        const branchRef = `refs/heads/${wt.branch}`;
-        const present = await gitTry(['-C', root, 'rev-parse', '--verify', '--quiet', branchRef]);
-        if (present.ok) {
-            const removed = await gitTry(['-C', root, 'branch', '-D', wt.branch]);
-            if (!removed.ok)
-                throw new ResourceConflict(`refusing to finish close for ${id}: branch removal failed`);
-            const remaining = await gitTry(['-C', root, 'rev-parse', '--verify', '--quiet', branchRef]);
-            if (remaining.ok || remaining.failure !== 'exit')
-                throw new ResourceConflict(`refusing to finish close for ${id}: branch remains or its removal is unproven`);
-        }
-        else if (present.failure !== 'exit') {
-            throw new ResourceConflict(`refusing to finish close for ${id}: branch presence is unreadable`);
-        }
+        const trashed = moveWorktreeToTrash(root, wt.path);
+        const pruned = await gitTry(['-C', root, 'worktree', 'prune']);
+        if (!pruned.ok)
+            console.error(`spex: deferred worktree ${id} was renamed to ${trashed}, but git worktree prune failed: ${pruned.stderr.trim() || pruned.failure}`);
+        queueWorktreeTrash(trashed);
     }
     if (slot) {
         try {
@@ -4024,20 +4735,6 @@ async function closeOwnedSessionUnlocked(id, wt, source, unboundRetired = false)
         }
         catch { /* best-effort GC */ }
     }
-    try {
-        rmSync(sessionStoreDir(id), { recursive: true, force: true });
-    }
-    catch (error) {
-        throw new ResourceConflict(`refusing to finish close for ${id}: session record/prompt removal failed (${error instanceof Error ? error.message : String(error)})`);
-    }
-    if (existsSync(sessionStoreDir(id)))
-        throw new ResourceConflict(`refusing to finish close for ${id}: session record removal failed`);
-    // The close still owns this sender's record lock. Marking after its store is gone lets any send already
-    // admitted finish before close returns, while every later send and every retry sweep sees terminal output.
-    revokeSenderDelivery(id);
-    if (closesCodexBinding && wt.rec.harnessSessionId) {
-        bindCodexGeneration(runtimeRoot(), id, wt.rec.harnessSessionId, null);
-    }
     requestQueueDrain(); // a close frees a slot — start the next queued session if any
     return true;
 }
@@ -4053,7 +4750,7 @@ async function closeSessionUnlocked(id, source) {
         const runtime = sessionStoreDir(id);
         const evidence = quarantined
             ? `Original bytes were copied to ${quarantined}`
-            : `Original bytes remain at ${join(runtime, 'session.json')}; no quarantine copy could be made`;
+            : `Original bytes remain at ${join(runtime, 'runtime.json')}; no quarantine copy could be made`;
         let guard = 'no readable session record proves the adapter or leaf owner';
         try {
             await stopAgentProcess(id, null);
@@ -4061,42 +4758,29 @@ async function closeSessionUnlocked(id, source) {
         catch (error) {
             guard = error instanceof Error ? error.message : String(error);
         }
-        throw new SessionRecordUnusable('corrupt', id, `refusing destructive close for ${id}: the unreadable record proves no adapter, leaf, worktree, or branch owner (${guard}). ${evidence}. Runtime remains at ${runtime}; worktree and branch ownership is unknown and was not touched; no process signal or deletion was attempted.`);
+        throw new SessionRecordUnusable('corrupt', id, `refusing close for ${id}: the unreadable record proves no adapter, leaf, worktree, or branch owner (${guard}). ${evidence}. Runtime remains at ${runtime}; worktree and branch ownership is unknown and was not touched; no process signal or deletion was attempted.`);
     }
     if (!wt)
         return false;
-    let unboundRetired = false;
+    let unboundStopped = false;
     if (!retirementReason(wt.rec) && !wt.rec.archived && wt.rec.status !== 'queued') {
         const harness = harnessById(wt.rec.harness || defaultHarness.id);
         if (!harness.exactNativeTargetId(wt.rec)) {
-            await assertUnboundRetirementSafe(id, wt.rec, wt.path, wt.branch);
+            await assertUnboundCloseSafe(id, wt.rec);
             await tmuxOk(['kill-session', '-t', id]);
-            await assertTargetTmuxAbsent(id, 'after unbound residue retirement');
+            await assertTargetTmuxAbsent(id, 'after unbound residue close');
             await harness.cleanupRuntime(wt.rec);
-            unboundRetired = true;
+            unboundStopped = true;
         }
         else {
-            // A confirmed terminal close may end an exact native turn before cold proof. Ordinary archive deliberately
-            // remains non-destructive while a turn is active; close already means discard this session's work.
-            assertSessionOwnerSafe(id, harness.id);
-            const interrupt = harness.interrupt;
-            if (interrupt) {
-                const result = await interrupt({ ...wt.rec, runtimeDir: runtimeRoot() });
-                if (!result.ok)
-                    throw new ResourceConflict(`refusing to close ${id}: native interrupt failed (${result.error || 'unknown error'})`);
-            }
-            const archived = await archiveSessionUnlocked(id);
-            if (!archived)
-                return false;
-            wt = await findWorktree(id);
-            if (!wt)
-                return false;
+            // closeOwnedSessionUnlocked performs the one exact cold-stop proof immediately before archive-ref
+            // publication. Keeping that seam in one place prevents a second adapter mutation on retry.
         }
     }
     const target = wt;
     return target.branch
-        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source, unboundRetired))
-        : closeOwnedSessionUnlocked(id, target, source, unboundRetired);
+        ? withRecordLock(sessionCandidateLockId(target.path, target.branch), () => closeOwnedSessionUnlocked(id, target, source, unboundStopped))
+        : closeOwnedSessionUnlocked(id, target, source, unboundStopped);
 }
 export const closeSession = (id, rawSource) => {
     const source = normalizeCloseSource(rawSource);
@@ -4229,7 +4913,7 @@ export async function quarantineCorruptRecord(id, rawWitness) {
         const git = await proveQuarantineGitAbsent(id, witness);
         const adapter = await proveQuarantineAdapter(id, witness);
         const bundle = join(quarantineRoot(id), `${observedAt.replace(/[:.]/g, '-')}-${randomUUID()}`);
-        const stored = join(bundle, 'session.json');
+        const stored = join(bundle, 'runtime.json');
         const provenance = join(bundle, 'provenance.json');
         const audit = {
             version: 1,
@@ -4279,10 +4963,10 @@ export async function restoreQuarantinedRecord(id) {
                 throw new ResourceConflict(`refusing to restore ${id}: no quarantine bundle exists`);
             throw new ResourceConflict(`refusing to restore ${id}: quarantine bundle inventory is unreadable`);
         }
-        const bundle = bundles.map((name) => join(quarantineRoot(id), name)).find((path) => existsSync(join(path, 'session.json')) && existsSync(join(path, 'provenance.json')));
+        const bundle = bundles.map((name) => join(quarantineRoot(id), name)).find((path) => existsSync(join(path, 'runtime.json')) && existsSync(join(path, 'provenance.json')));
         if (!bundle)
             throw new ResourceConflict(`refusing to restore ${id}: no complete quarantine bundle exists`);
-        const stored = join(bundle, 'session.json');
+        const stored = join(bundle, 'runtime.json');
         let provenance;
         try {
             provenance = JSON.parse(readFileSync(join(bundle, 'provenance.json'), 'utf8'));
@@ -4486,6 +5170,7 @@ export function formatTable(sessions, color = true, scope = { kind: 'sessions' }
     });
     return [heading, header, ...rows, statusLegend(color)].join('\n');
 }
+export const EMPTY_PROMPT_ERROR = 'empty prompt — nothing to dispatch';
 class StrandedDeliveryError extends Error {
 }
 async function strandedDeliveryError(rec) {
@@ -4495,100 +5180,199 @@ async function strandedDeliveryError(rec) {
     const transport = await h.deliveryTransport({ ...rec, runtimeDir: runtimeRoot() });
     if (transport.kind !== 'unreachable' || agentAlive(rec.session) !== true)
         return null;
-    const queued = pendingMessages(rec.session).length;
+    const application = configuredSessionApplicationIfCutover();
+    const queued = application?.readPendingMessages(rec.session).length ?? 0;
     const noun = queued === 1 ? 'message is' : 'messages are';
     return new StrandedDeliveryError(`session ${rec.session} is stranded: ${transport.reason} while its registered agent process is still alive; ${queued} queued ${noun} waiting with no transport to claim them. Use \`spex session send ${rec.session} --keys "<keys>"\` to steer the live tmux pane, then repair the control transport before sending text.`);
 }
 export async function sendText(id, text, from, opts = {}) {
-    if (!text)
-        return { ok: false, error: 'empty prompt — nothing to dispatch' };
-    let replayed = false;
-    try {
-        // Taking a declared sender's record lock makes close a real outgoing fence even across backend processes:
-        // a send either appends before close obtains the fence (and close's revocation voids its debt), or sees
-        // the terminal marker before it records anything. Arbitrary legacy `from` values keep working; they just
-        // name an otherwise-unused lock until a matching session is closed.
-        let rec = null;
-        const accepted = await acceptMessage({
-            target: id,
-            text,
-            from,
-            idempotency: opts.idempotency,
-            validate: async () => {
-                rec = readRecord(id);
-                if (!rec)
-                    throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
-            },
-            prepare: async () => {
-                await opts.acceptGuard?.(rec);
-                const stranded = await strandedDeliveryError(rec);
-                if (stranded)
-                    throw stranded;
-                // Composed at ACCEPT time, once: the log keeps the raw conversational text plus the effective reply channel,
-                // the queue keeps the transport form. Composing again at handover would let a later send change the hints on
-                // a message that was already accepted.
-                const prompt = await composeSessionPrompt(text, rec, { from, replyVia: opts.replyVia });
-                return { text: prompt.text, ...(prompt.replyVia ? { replyVia: prompt.replyVia } : {}) };
-            },
-        });
-        replayed = accepted.replayed;
-    }
-    catch (error) {
-        const code = error?.code;
-        const detail = error instanceof StrandedDeliveryError
-            ? error.message
-            : `could not append the message to session ${id}'s log: ${error instanceof Error ? error.message : String(error)} — prompt NOT delivered`;
+    if (!text.trim())
+        return { ok: false, error: EMPTY_PROMPT_ERROR };
+    const application = configuredSessionApplicationIfCutover();
+    if (application) {
+        let message;
+        let replayed = false;
+        try {
+            const rec = readRecord(id);
+            if (!rec)
+                throw new ResourceConflict(`no session record for ${id} — prompt NOT delivered`);
+            await opts.acceptGuard?.(rec);
+            const prompt = await composeSessionPrompt(text, rec, { from, replyVia: opts.replyVia });
+            const idempotencyKey = opts.idempotency?.requestDigest ?? (opts.deliveryKey?.trim() || null);
+            const existing = idempotencyKey
+                ? application.readMessageHistory(id).find(message => message.idempotencyKey === idempotencyKey)
+                : undefined;
+            message = existing ?? application.enqueueConversationMessage(id, {
+                kind: 'session.prompt.v1',
+                body: Buffer.from(prompt.text, 'utf8'),
+                senderSessionId: from ?? null,
+                idempotencyKey,
+            }, { text, from: from ?? null, ...(prompt.replyVia ? { replyVia: prompt.replyVia } : {}) });
+            replayed = !!existing;
+        }
+        catch (error) {
+            return { ok: false, error: `could not append the message to session ${id}'s application queue: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        // Acceptance and handover are separate boundaries. A committed SQLite message remains a successful
+        // command even when the runtime is currently unbound; binding/resume is the explicit event that makes
+        // the durable debt drainable. Reporting the post-commit refusal as an append failure made command-box
+        // callers show a false error despite the prompt already being safely queued.
+        if (!opts.deferDrain) {
+            try {
+                await drainSession(id);
+            }
+            catch (error) {
+                if (!(error instanceof ResourceConflict) || !/no bound spex-governed runtime/u.test(error.message))
+                    throw error;
+            }
+        }
+        const pending = application.readPendingMessages(id).some(candidate => candidate.messageId === message.messageId);
+        // Queue acceptance is not runtime activity. A prompt remains owed while the adapter is unbound,
+        // restarting, or refusing the insert; only the handoff that removes this exact message may re-enter
+        // a waiting session as active. This keeps a queued command from painting a dead pane as working.
+        if (!from && !pending)
+            markHumanPromptActive(id);
+        // @@@ a deferred drain measured NOTHING, and must not be reported as a refusal.
+        // `pending` is read microseconds after the enqueue with no await in between, so when the drain was
+        // deferred it is answering "did I skip the handover" — always yes — rather than "did the adapter refuse".
+        // Reporting that as `queued` made every first Command Box send claim the transport was still owed while
+        // the prompt was in fact in the agent's pane milliseconds later, and the claim was UNCONDITIONAL: no
+        // transport state, harness, or runtime binding could change it. Name the deferral instead, so the one
+        // caller that defers can say "accepted, handover in flight" and the callers that DO drain keep a
+        // `queued` that still means what it says.
         return {
-            ok: false,
-            error: detail,
-            ...(code ? { code } : {}),
+            ok: true,
+            delivery: opts.deferDrain ? 'deferred' : pending ? 'queued' : 'accepted',
+            ...(opts.idempotency || opts.deliveryKey ? { replayed } : {}),
         };
     }
-    // Awaited, not fire-and-forget: an unawaited insert can lose its race with a short-lived caller's exit,
-    // costing that send its same-turn arrival. Draining HERE rather than leaving it to the sweep is what puts
-    // the text in a live agent's current turn instead of up to one tick later.
-    if (!opts.deferDrain)
-        await drainSession(id);
-    return { ok: true, ...(opts.idempotency ? { replayed } : {}) };
+    throw new ResourceConflict('session application is unavailable; refusing the legacy delivery path');
 }
 // @@@ drainSession - hand over what this session is owed, as ordinary prompts. Safe to call from anywhere and
 // at any time: the queue's own lock serializes concurrent passes, and an empty queue costs one existsSync.
 // The retry sweep in `serve` calls this for the sessions whose queues an earlier pass could not empty.
 export async function drainSession(id) {
-    if (!owesDelivery(id))
-        return;
-    const rec = readRecord(id);
-    if (!rec)
-        return;
-    const h = harnessById(rec.harness || defaultHarness.id);
-    if (h.launchPayloadProof && !rec.harnessSessionId)
-        return;
-    await drain(id, async (msg) => {
-        // the pane guard ([[harness-adapter]] deliveryBlockedBy): the ONE pane state where the harness swallows a
-        // prompt its channel confirms (claude's sessions panel), checkable only from the pane. Treated as a REFUSAL
-        // rather than a skip — the message stays owed and the sweep hands it over once the pane leaves that state.
-        if (h.deliveryBlockedBy) {
-            try {
-                if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
-                    return false;
+    const application = configuredSessionApplicationIfCutover();
+    if (application) {
+        const rec = readRecord(id);
+        if (!rec)
+            return;
+        // An empty canonical queue is a successful no-op. Do not turn a resume with no owed prompt into a
+        // runtime-binding error; require a bound adapter only when there is a message that must be handed over.
+        if (application.readPendingMessages(id).length === 0)
+            return;
+        const h = harnessById(rec.harness || defaultHarness.id);
+        const binding = application.resolveRuntime(id, 'spex-governed');
+        if (!binding || binding.status !== 'bound') {
+            // Leaf adapters own their per-session controller and can deliver without a shared native identity.
+            // Preserve the governed transport while that identity is absent, then acknowledge the same canonical
+            // queue directly. Shared adapter runtimes (Codex) remain fail-closed until their exact binding exists.
+            const leafWithoutNativeIdentity = !rec.harnessSessionId && (rec.harness === 'claude' || h.runtimeOwnership === 'leaf');
+            if (leafWithoutNativeIdentity) {
+                await withDeliveryLocks([id], async () => {
+                    for (;;) {
+                        const pending = application.readPendingMessages(id);
+                        const msg = pending[0];
+                        if (!msg)
+                            return;
+                        const text = canonicalMessageText(msg, rec);
+                        if (h.deliveryBlockedBy) {
+                            try {
+                                if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
+                                    return;
+                            }
+                            catch { /* no pane to consult — let the adapter decide */ }
+                        }
+                        const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.messageId }, text);
+                        if (!delivered.ok)
+                            return;
+                        const removed = application.dequeuePendingMessage(id, msg.messageId);
+                        if (!removed || removed.messageId !== msg.messageId)
+                            throw new ResourceConflict(`canonical queue head changed while delivering ${id}`);
+                    }
+                });
+                return;
             }
-            catch { /* no pane to consult — let the insert itself decide */ }
+            throw new ResourceConflict(`canonical delivery for ${id} remains pending: no bound spex-governed runtime`);
         }
-        const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.mid }, msg.text);
-        return delivered.ok;
-    });
+        await withDeliveryLocks([id], async () => {
+            for (;;) {
+                const pending = application.readPendingMessages(id);
+                const msg = pending[0];
+                if (!msg)
+                    return;
+                const text = canonicalMessageText(msg, rec);
+                if (h.deliveryBlockedBy) {
+                    try {
+                        if (h.deliveryBlockedBy(await tmux(['capture-pane', '-p', '-t', rec.session], TMUX_PROBE_TIMEOUT_MS)))
+                            return;
+                    }
+                    catch { /* no pane to consult — let the adapter decide */ }
+                }
+                const delivered = await h.deliver({ ...rec, runtimeDir: runtimeRoot(), mid: msg.messageId }, text);
+                if (!delivered.ok)
+                    return;
+                const removed = application.dequeueForRuntime(id, 'spex-governed', binding.bindingGeneration, msg.messageId);
+                if (!removed || removed.messageId !== msg.messageId)
+                    throw new ResourceConflict(`canonical queue head changed while delivering ${id}`);
+            }
+        });
+        return;
+    }
+    throw new ResourceConflict('session application is unavailable; refusing the legacy delivery path');
+}
+// `recipient` is the session this text is delivered TO; a state message speaks about its `sessionId`, the
+// watched subject, and the notice must name that subject — never the reader of the notice.
+export function canonicalMessageText(message, recipient) {
+    if (message.kind === 'session.prompt.v1')
+        return Buffer.from(message.body).toString('utf8');
+    if (message.kind === 'session.state.changed.v1') {
+        try {
+            const change = JSON.parse(Buffer.from(message.body).toString('utf8'));
+            if (typeof change.sessionId !== 'string' || !change.sessionId)
+                throw new ResourceConflict(`canonical state message delivered to ${recipient.session} names no subject session`);
+            return watchMessage({ ...recipient, session: change.sessionId, status: (change.status ?? recipient.status), proposal: change.proposal ?? null, note: change.note ?? null, parent: change.parentSessionId ?? null });
+        }
+        catch (error) {
+            if (error instanceof ResourceConflict)
+                throw error;
+            throw new ResourceConflict(`canonical state message for ${recipient.session} is not valid JSON`);
+        }
+    }
+    throw new ResourceConflict(`canonical message kind ${message.kind} cannot be delivered as session text`);
 }
-// Hard interrupt is adapter-native control, distinct from stop's process teardown. A harness without a
-// confirmed native primitive refuses loudly; there is no signal/PTY fallback that could target the wrong turn.
+// Hard interrupt is adapter-native control, distinct from stop's process teardown. A harness with a native
+// primitive uses it. Without one the transport decides: a HEADLESS adapter has no keyboard, so it refuses
+// loudly rather than emulating an interrupt with a signal that could hit the wrong process; a PANE-BACKED
+// TUI has an operator's keyboard by definition, so its interrupt is the key that operator would press —
+// C-c into its own pane, through the raw-key channel below — and only while its lifecycle is actually
+// active, because the same key on an idle TUI is a second Ctrl-C away from quitting it.
 export async function interruptSession(id) {
+    // The lifecycle read and the key send share ONE record lock: a declaration that lands between them would
+    // otherwise turn "interrupt the working turn" into "Ctrl-C an idle TUI", so there is no window.
     return withRecordLock(id, async () => {
         const rec = readRecord(id);
         if (!rec)
             return { ok: false, error: `no session record for ${id} - nothing to interrupt` };
         const h = harnessById(rec.harness || defaultHarness.id);
-        if (!h.interrupt)
+        if (h.interrupt) {
+            // stamped BEFORE the abort: the adapter's exit report can race the confirmation, and either order must
+            // read "interrupted" (see the interrupt projection); a refused interrupt leaves no trace behind.
+            stampInterrupt(id);
+            const result = await h.interrupt({ ...rec, runtimeDir: runtimeRoot() });
+            if (!result.ok) {
+                clearInterruptMarker(id);
+                return result;
+            }
+            projectInterruptedUnlocked(id);
+            return result;
+        }
+        if (h.headless)
             return { ok: false, error: `harness ${h.id} has no native hard-interrupt control` };
-        return h.interrupt({ ...rec, runtimeDir: runtimeRoot() });
+        if (rec.status !== 'active')
+            return { ok: false, error: `session ${id} is not working (lifecycle ${rec.status}) - nothing to interrupt` };
+        const sent = await sendRawKeysLocked(id, ['C-c']);
+        return sent ? { ok: true } : { ok: false, error: `session ${id} has no live pane to interrupt` };
     });
 }
 // @@@ rawKey - the RAW-KEYSTROKE nav path, kept DELIBERATELY on `tmux send-keys` and NEVER the rendezvous
@@ -4649,19 +5433,24 @@ function rawKeyArgs(id, key) {
 // ORDER, so they reach the pane in exactly the order they were struck. Concurrent per-key POSTs used to race
 // (browser + server + send-keys all parallel) and scramble the sequence; a single serialised batch cannot.
 // An unknown token is skipped without dropping the rest; false only if the tmux session is gone or nothing sent.
+// the send itself, for a caller that already holds the record lock (rawKey below; interruptSession above)
+async function sendRawKeysLocked(id, keys) {
+    const list = keys.filter((k) => typeof k === 'string' && k.length > 0);
+    if (list.length === 0 || !(await alive(id)))
+        return false;
+    let sent = false;
+    for (const k of list) {
+        const args = rawKeyArgs(id, k);
+        if (!args)
+            continue;
+        await tmux(args);
+        sent = true;
+    }
+    return sent;
+}
 export async function rawKey(id, key) {
-    return withRecordLock(id, async () => {
-        const list = (Array.isArray(key) ? key : [key]).filter((k) => typeof k === 'string' && k.length > 0);
-        if (list.length === 0 || !(await alive(id)))
-            return false;
-        let sent = false;
-        for (const k of list) {
-            const args = rawKeyArgs(id, k);
-            if (!args)
-                continue;
-            await tmux(args);
-            sent = true;
-        }
-        return sent;
-    });
+    const sent = await withRecordLock(id, () => sendRawKeysLocked(id, Array.isArray(key) ? key : [key]));
+    // Raw-key remote control is transport fallback, not a lifecycle event. Freshness belongs to the
+    // harness turn hooks or a successfully handed-over durable prompt; navigation keys cannot forge working.
+    return sent;
 }