diff --git a/.github/actions/detect-changes/action.yml b/.github/actions/detect-changes/action.yml
index ade05ba124..6ce85c6b7b 100644
--- a/.github/actions/detect-changes/action.yml
+++ b/.github/actions/detect-changes/action.yml
@@ -48,6 +48,9 @@ outputs:
   installer:
     description: Run the PowerShell installer tests on a Windows runner.
     value: ${{ steps.classify.outputs.installer }}
+  desktop_updater:
+    description: Run the Windows desktop-update hand-off (windows.ps1) integration tests.
+    value: ${{ steps.classify.outputs.desktop_updater }}
   rust:
     description: Run `cargo test` for the Tauri bootstrap installer.
     value: ${{ steps.classify.outputs.rust }}
diff --git a/.github/workflows/case-collision-check.yml b/.github/workflows/case-collision-check.yml
new file mode 100644
index 0000000000..946feb0a34
--- /dev/null
+++ b/.github/workflows/case-collision-check.yml
@@ -0,0 +1,33 @@
+name: Case Collision Check
+
+# Rejects PRs that track two files whose paths differ only by case
+# (README.md vs readme.md, src/Foo.py vs SRC/foo.py).
+#
+# Linux is case-sensitive; Windows and macOS (default) are not. A
+# case-colliding pair lives fine in a Linux checkout and silently breaks
+# every clone on a case-insensitive host — the filesystem can hold only
+# one of them, so checkout fails or whichever wins overwrites the other.
+# Git won't prevent the pair from landing (it only warns at checkout time,
+# on a case-insensitive FS, for the client doing the checkout), so the only
+# enforcement point is CI, on Linux, against the index.
+#
+# Runs unconditionally (no change-classifier gate): a collision can ship in
+# any kind of PR — docs, JS, config, not just Python — so gating on a
+# language lane would be the same "passive rule that cannot enforce a
+# policy" trap the infographic check exists to close.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  check-case-collisions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Run case-collision checker
+        run: python3 scripts/check-case-collisions.py
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2f3798346b..aaa8da0386 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -49,6 +49,7 @@ jobs:
       uv_lock: ${{ steps.classify.outputs.uv_lock }}
       npm_lock: ${{ steps.classify.outputs.npm_lock }}
       installer: ${{ steps.classify.outputs.installer }}
+      desktop_updater: ${{ steps.classify.outputs.desktop_updater }}
       rust: ${{ steps.classify.outputs.rust }}
       docker_meta: ${{ steps.classify.outputs.docker_meta }}
       mcp_catalog: ${{ steps.classify.outputs.mcp_catalog }}
@@ -84,6 +85,11 @@ jobs:
     needs: detect
     if: needs.detect.outputs.python == 'true'
     uses: ./.github/workflows/tests-os.yml
+    with:
+      # The Windows lane spawns the real desktop-update hand-off script
+      # (tests/test_desktop_update_windows_*.py) only when that surface
+      # changed; unit-level windows_only tests always run.
+      desktop_updater: ${{ needs.detect.outputs.desktop_updater == 'true' }}
 
   lint:
     name: Python lints
@@ -122,14 +128,14 @@ jobs:
     # Tests-only PRs (~17% of commits) skip this 5-minute job — the longest
     # single job in the workflow — while still running the full pytest lanes.
     #
-    # ⛔ TEMPORARILY DISABLED (Aug 2, 2026, Teknium) — the suite is red on
-    # every PR and on main itself since the Aug 1 night engines/npm churn
-    # (#76499 → #76562 → #76575): the mock-backend Electron window never
-    # gets a title, so boot/chat/setup/interim specs all fail identically
-    # regardless of the PR's diff (verified on #76573 and the docs-only
-    # #76582). Tracking issue: #76627 (assigned: Ari). To re-enable,
-    # delete the `false &&` below — nothing else changed.
-    if: ${{ false && (needs.detect.outputs.python_prod == 'true' || needs.detect.outputs.frontend == 'true') }}
+    # Re-disabled (Sep 2026): the Sep 1 re-enable is still incredibly flaky.
+    # Keep this a bare `if: false`. The earlier
+    # `${{ false && (... || ...) }}` form on this reusable-workflow job made
+    # GitHub's workflow parser fail at startup ("An unexpected error has
+    # occurred") — every ci.yaml run repo-wide dispatched 0 jobs from
+    # 24f5a60ed1 until this line changed. To re-enable, restore:
+    #   if: ${{ needs.detect.outputs.python_prod == 'true' || needs.detect.outputs.frontend == 'true' }}
+    if: false
     uses: ./.github/workflows/e2e-desktop.yml
 
   docs-site:
@@ -171,6 +177,11 @@ jobs:
     needs: detect
     uses: ./.github/workflows/profile-artifact-check.yml
 
+  case-collision-check:
+    name: Check no case-colliding filenames
+    needs: detect
+    uses: ./.github/workflows/case-collision-check.yml
+
   lockfile-diff:
     name: package-lock.json diff
     needs: detect
@@ -233,6 +244,7 @@ jobs:
       - history-check
       - contributor-check
       - uv-lockfile
+      - case-collision-check
       - lockfile-diff
       - docker-lint
       - profile-artifact-check
diff --git a/.github/workflows/tests-os.yml b/.github/workflows/tests-os.yml
index 12719a853c..2477c839f4 100644
--- a/.github/workflows/tests-os.yml
+++ b/.github/workflows/tests-os.yml
@@ -27,6 +27,19 @@ name: OS-specific tests
 
 on:
   workflow_call:
+    inputs:
+      desktop_updater:
+        description: >-
+          Run the Windows desktop-update hand-off integration tests
+          (tests/test_desktop_update_windows_*.py). These spawn the real
+          scripts/desktop-update/windows.ps1 and poll its loopback server, so
+          they carry process-timing noise a shared runner amplifies; the
+          caller gates them on the classifier's desktop_updater lane so a PR
+          that never touched that surface cannot be failed by it. Push /
+          dispatch runs fail open (classifier sets every lane true).
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   contents: read
@@ -134,9 +147,23 @@ jobs:
           # would therefore abort the script on any non-zero exit and the
           # exit-5 branch below would be unreachable dead code — the job
           # would still fail red, but the diagnostic would never print.
+          # Desktop-update hand-off integration tests spawn the real
+          # windows.ps1; deselect them unless the PR touched that surface
+          # (see the workflow_call input). ``--ignore-glob`` keeps the file
+          # list above intact, so a renamed test file still trips the
+          # zero-tests guard rather than silently vanishing.
+          # (bash 3.2 on the macOS runner: an empty array under ``set -u`` is
+          # an unbound-variable error, hence the ``${arr[@]+...}`` idiom.)
+          EXTRA_ARGS=()
+          if [ "${{ inputs.desktop_updater }}" != "true" ]; then
+            echo "desktop_updater lane off: skipping tests/test_desktop_update_windows_*.py"
+            EXTRA_ARGS+=(--ignore-glob='*test_desktop_update_windows_*.py')
+          fi
+
           status=0
           uv run --no-sync python -m pytest \
             "$@" \
+            ${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"} \
             -m "${{ matrix.marker }} and not integration" \
             -v --tb=short || status=$?
           if [ "$status" -eq 5 ]; then
diff --git a/.gitignore b/.gitignore
index 2d5279bca4..7cf39fcfc9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -109,6 +109,9 @@ apps/shared/src/**/*.js
 apps/shared/src/**/*.js.map
 apps/shared/src/**/*.d.ts
 apps/desktop/release/
+# stage-and-swap Desktop rebuild output (#86443); removed after the swap, but
+# a killed build must not leave the checkout dirty
+apps/desktop/.staging-*/
 *.tsbuildinfo
 
 # Web UI assets — synced from @nous-research/ui at build time via
diff --git a/agent/agent_init.py b/agent/agent_init.py
index ec074c3324..a64fdfd854 100644
--- a/agent/agent_init.py
+++ b/agent/agent_init.py
@@ -1831,6 +1831,9 @@ def init_agent(
     except Exception:
         agent.show_commentary = True
 
+    # Window (seconds) for the bounded /fast auto|cold modes (agent.fast_mode).
+    agent.fast_auto_seconds = (_agent_cfg.get("agent") or {}).get("fast_auto_seconds", 60)
+
     # LM Studio can either be explicitly preloaded through LM Studio's
     # management API (the historical Hermes behavior) or left to LM Studio's
     # just-in-time / Auto-Evict chat-completions path.  Keep the default
@@ -1851,10 +1854,39 @@ def init_agent(
     except Exception:
         agent.lmstudio_load_mode = "explicit"
 
+    # API-transport streaming (``model.streaming``, default true).  The
+    # conversation loop prefers ``stream=True`` for every turn — including
+    # subagent turns — to get fine-grained liveness health-checking (#3120),
+    # but self-hosted OpenAI-compatible backends with broken streaming
+    # tool-call paths (e.g. vLLM ``--tool-call-parser qwen3_xml`` + a
+    # reasoning parser can leak tool-call markup into plain text and return
+    # zero ``tool_calls``, #72901) silently no-op instead of executing.
+    # ``model.streaming: false`` seeds ``_disable_streaming`` so the session
+    # uses the non-streaming path, which the loop already falls back to at
+    # runtime when a provider rejects streaming.  The setting is
+    # session-scoped: it persists across mid-session model switches, mirroring
+    # the runtime fallback's semantics.  Orthogonal to ``display.streaming``
+    # (token rendering) — display-only settings are untouched.
+    agent._disable_streaming = False
+    try:
+        _model_section = _agent_cfg.get("model", {})
+        if isinstance(_model_section, dict):
+            _streaming = str(_model_section.get("streaming", "true")).strip().lower()
+            if _streaming in {"false", "0", "no", "off"}:
+                agent._disable_streaming = True
+            elif _streaming not in {"true", "1", "yes", "on"}:
+                logger.warning(
+                    "Invalid model.streaming=%r; expected a boolean. Using streaming (default).",
+                    _model_section.get("streaming"),
+                )
+    except Exception:
+        agent._disable_streaming = False
+
     try:
         agent._tool_guardrails = ToolCallGuardrailController(
             ToolCallGuardrailConfig.from_mapping(
-                _agent_cfg.get("tool_loop_guardrails", {})
+                _agent_cfg.get("tool_loop_guardrails", {}),
+                platform=platform,
             )
         )
     except Exception as _tlg_err:
@@ -2999,8 +3031,10 @@ def init_agent(
         except Exception as _ce_err:
             _ra().logger.debug("Context engine on_session_start: %s", _ce_err)
 
+    from agent.runtime_cwd import scope_terminal_cwd as _scope_terminal_cwd
+
     agent._subdirectory_hints = SubdirectoryHintTracker(
-        working_dir=os.getenv("TERMINAL_CWD") or None,
+        working_dir=_scope_terminal_cwd() or None,
     )
     agent._user_turn_count = 0
     # Copilot x-initiator flag: first API call of a user turn sends "user" (#3040).
@@ -3011,6 +3045,7 @@ def init_agent(
     # until the first response with usage; invalidated on compaction and
     # session switches so stale anchors can never suppress compression.
     agent._usage_anchor = None
+    agent._turn_base_usage_anchor = None
 
     # Cumulative token usage for the session
     agent.session_prompt_tokens = 0
diff --git a/agent/agent_runtime_helpers.py b/agent/agent_runtime_helpers.py
index ffd9ba61fe..f9be7a0476 100644
--- a/agent/agent_runtime_helpers.py
+++ b/agent/agent_runtime_helpers.py
@@ -108,7 +108,7 @@ def _ra():
 
 
 AGENT_RUNTIME_POST_HOOK_TOOL_NAMES = frozenset(
-    {"todo", "session_search", "memory", "clarify", "read_terminal", "desktop_preview", "drive_preview", "annotate_preview", "read_window_below", "setup_mcp", "tour", "delegate_task"}
+    {"todo_list", "session_search", "memory", "clarify", "read_terminal", "desktop_preview", "drive_preview", "annotate_preview", "read_window_below", "setup_mcp", "gui_tour", "delegate_task"}
 )
 
 
@@ -3529,7 +3529,7 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
             pass
         return result
 
-    if function_name == "todo":
+    if function_name == "todo_list":
         def _execute(next_args: dict) -> Any:
             from tools.todo_tool import todo_tool as _todo_tool
             return _finish_agent_tool(
@@ -3671,7 +3671,7 @@ def invoke_tool(agent, function_name: str, function_args: dict, effective_task_i
                 ),
                 next_args,
             )
-    elif function_name == "tour":
+    elif function_name == "gui_tour":
         def _execute(next_args: dict) -> Any:
             from tools.tour_tool import tour_tool as _tour_tool
             return _finish_agent_tool(
diff --git a/agent/anthropic_adapter.py b/agent/anthropic_adapter.py
index f5dea26121..e03c07b9b3 100644
--- a/agent/anthropic_adapter.py
+++ b/agent/anthropic_adapter.py
@@ -226,7 +226,7 @@ def _is_claude_model(model: str | None) -> bool:
     return "claude" in (model or "").lower()
 
 
-_FAST_MODE_SUPPORTED_SUBSTRINGS = ("opus-4-6", "opus-4.6")
+_FAST_MODE_SUPPORTED_SUBSTRINGS = ("opus-4-8", "opus-4.8", "opus-5")
 
 # ── Max output token limits per Anthropic model ───────────────────────
 # Source: Anthropic docs + Cline model catalog.  Anthropic's API requires
@@ -433,13 +433,28 @@ def _forbids_sampling_params(model: str) -> bool:
 
 
 def _supports_fast_mode(model: str) -> bool:
-    """Return True for models that support Anthropic Fast Mode (speed=fast).
+    """Return True for models that accept the ``speed: "fast"`` request param.
 
-    Per Anthropic docs, fast mode is currently supported on Opus 4.6 only.
-    Sending ``speed: "fast"`` to any other Claude model (including Opus 4.7)
-    returns HTTP 400. This guard prevents silently 400'ing when stale config
-    or older callers leave fast mode enabled across a model upgrade.
+    Per the Anthropic fast-mode docs (research preview), the ``speed`` param
+    is supported on Opus 4.8 and Opus 5 — Claude API only. The matrix has
+    changed with nearly every Opus release, in both directions:
+
+    - Opus 4.6 HAD fast mode at launch and LOST it (2026-06-29): requests
+      with ``speed: "fast"`` do not error — they silently run at standard
+      speed and bill standard rates (``usage.speed: "standard"``). Keeping
+      4.6 in this allowlist would show users a fast toggle that does
+      nothing.
+    - Opus 4.7 never had it and hard-400s on the parameter.
+    - Dedicated ``…-fast`` model ids (e.g. OpenRouter's
+      ``claude-opus-4.8-fast``) select fast inference via the model field
+      itself and must NOT also receive the speed parameter.
+
+    Keep this an explicit allowlist rather than a version-floor check so a
+    model that drops fast mode again fails closed (standard speed) instead
+    of silently 400'ing.
     """
+    if "-fast" in model:
+        return False
     return any(v in model for v in _FAST_MODE_SUPPORTED_SUBSTRINGS)
 
 
@@ -935,9 +950,9 @@ def build_anthropic_kwargs(
     thinking block signatures are stripped (they are Anthropic-proprietary).
 
     When *fast_mode* is True, adds ``extra_body["speed"] = "fast"`` and the
-    fast-mode beta header for ~2.5x faster output throughput on Opus 4.6.
-    Currently only supported on native Anthropic endpoints (not third-party
-    compatible ones).
+    fast-mode beta header for ~2.5x faster output throughput on Opus 4.8 /
+    Opus 5. Currently only supported on native Anthropic endpoints (not
+    third-party compatible ones).
     """
     system, anthropic_messages = convert_messages_to_anthropic(
         messages, base_url=base_url, model=model
@@ -1148,12 +1163,15 @@ def build_anthropic_kwargs(
         for _sampling_key in ("temperature", "top_p", "top_k"):
             kwargs.pop(_sampling_key, None)
 
-    # ── Fast mode (Opus 4.6 only) ────────────────────────────────────
+    # ── Fast mode (Opus 4.8 / Opus 5) ────────────────────────────────
     # Adds extra_body.speed="fast" + the fast-mode beta header for ~2.5x
-    # output speed. Per Anthropic docs, fast mode is only supported on
-    # Opus 4.6 — Opus 4.7 and other models 400 on the speed parameter.
+    # output speed. Per Anthropic docs the speed param is supported on
+    # Opus 4.8 and Opus 5 (research preview); Opus 4.7 400s on it and
+    # Opus 4.6 silently ignores it (standard speed, standard billing).
     # Only for native Anthropic endpoints — third-party providers would
-    # reject the unknown beta header and speed parameter.
+    # reject the unknown beta header and speed parameter, and Anthropic
+    # itself scopes fast mode to the Claude API (not Bedrock/Vertex/
+    # Foundry).
     if (
         fast_mode
         and not _is_third_party_anthropic_endpoint(base_url)
@@ -1282,12 +1300,21 @@ def create_anthropic_message(
                     for _event in stream:
                         try:
                             on_stream_event(_event)
+                        except TimeoutError:
+                            # The callback is the caller's deadline seam
+                            # (#99692: the host waiting on this summary has
+                            # already given up). Abandon the stream — the
+                            # ``with`` closes it — instead of streaming an
+                            # answer nobody will read.
+                            raise
                         except Exception:
                             logger.debug(
                                 "%son_stream_event callback failed",
                                 log_prefix, exc_info=True,
                             )
                 return stream.get_final_message()
+        except TimeoutError:
+            raise
         except Exception as exc:
             if not _is_stream_unavailable_error(exc):
                 raise
diff --git a/agent/anthropic_credentials.py b/agent/anthropic_credentials.py
index a40cdcb298..660a672211 100644
--- a/agent/anthropic_credentials.py
+++ b/agent/anthropic_credentials.py
@@ -917,6 +917,22 @@ def _get_hermes_oauth_file() -> Path:
     return get_hermes_home() / ".anthropic_oauth.json"
 
 
+def _root_hermes_oauth_file() -> Optional[Path]:
+    """Global-root ``.anthropic_oauth.json`` when running inside a named profile.
+
+    ``None`` in classic mode (profile == root). Used to commit a rotation of a
+    grant the profile borrowed through the credential-pool root fallback.
+    """
+    try:
+        from hermes_constants import get_default_hermes_root
+        root = get_default_hermes_root()
+        if root.resolve(strict=False) == get_hermes_home().resolve(strict=False):
+            return None
+        return root / ".anthropic_oauth.json"
+    except Exception:
+        return None
+
+
 def _generate_pkce() -> tuple:
     """Generate PKCE code_verifier and code_challenge (S256)."""
     import base64
@@ -1077,9 +1093,16 @@ def _write_hermes_oauth_credentials(
     access_token: str,
     refresh_token: Optional[str],
     expires_at_ms: Optional[int],
+    *,
+    target: Optional[Path] = None,
 ) -> None:
     """Write refreshed hermes_pkce tokens back to ~/.hermes/.anthropic_oauth.json.
 
+    ``target`` overrides the destination: a named profile that rotated a grant
+    it BORROWED from the global root (credential-pool root fallback) must
+    commit the new pair to the ROOT singleton, not create a forked copy under
+    its own HERMES_HOME (#100339).
+
     Without this, a successful pool-level refresh of a ``hermes_pkce``-sourced
     entry is invisible to this singleton file. The next ``load_pool()`` call
     runs ``_seed_from_singletons()``, which reads the stale file and
@@ -1090,7 +1113,7 @@ def _write_hermes_oauth_credentials(
     file, for the same reason ``_write_claude_code_credentials`` does: this is
     the commit step of the refresh transaction.
     """
-    oauth_file = _get_hermes_oauth_file()
+    oauth_file = target if target is not None else _get_hermes_oauth_file()
     try:
         oauth_data = {
             "accessToken": access_token,
diff --git a/agent/auxiliary_client.py b/agent/auxiliary_client.py
index 6bee187258..47c682fde6 100644
--- a/agent/auxiliary_client.py
+++ b/agent/auxiliary_client.py
@@ -453,6 +453,16 @@ _aux_progress = threading.local()
 _aux_dispatch = threading.local()
 _aux_provider_response = threading.local()
 
+# Absolute wall-clock deadline (time.monotonic) of the HOST waiting for this
+# auxiliary call, when it has one (#99692). Liveness alone is not enough: a
+# host also stops waiting at its own total ceiling, and the streamed consumer
+# below bounds itself only by _aux_stream_total_ceiling() — a budget derived
+# from the aux request timeout, which is >= the host ceiling for every
+# configured value AND starts counting later. So the stream that outlives its
+# abandoned host is not an edge case; it is the guaranteed outcome of every
+# total-ceiling timeout.
+_aux_stream_deadline = threading.local()
+
 
 def _notify_aux_progress() -> None:
     """Tick the installed forward-progress hook, if any. Never raises."""
@@ -525,6 +535,37 @@ def _anthropic_event_has_content(event: Any) -> bool:
     return False
 
 
+def _anthropic_aux_stream_event_hook() -> Callable[[Any], None]:
+    """Per-event callback for the Anthropic auxiliary wire.
+
+    Records provider-response timing for every frame, ticks the forward-progress
+    hook only for substantive payloads (keepalive pings must not keep a stalled
+    summary alive), and — #99692 — stops the stream at the waiting host's
+    absolute deadline (``aux_stream_deadline``) or on an explicit hard cancel,
+    the same two stop conditions the chat.completions and Codex wires honour.
+    The ``TimeoutError`` is phrased with "timed out" so ``_is_timeout_error``
+    classifies it like any other request timeout.
+    """
+    host_deadline = _current_aux_stream_deadline()
+    started = time.monotonic()
+
+    def _on_event(event: Any) -> None:
+        if _anthropic_event_has_content(event):
+            _notify_aux_provider_response()
+        else:
+            _notify_aux_timing_response()
+        if _aux_interrupt_cancel_requested():
+            raise AuxiliaryExplicitCancellation()
+        if host_deadline is not None and time.monotonic() >= host_deadline:
+            raise TimeoutError(
+                "Anthropic auxiliary stream timed out at the host compression "
+                f"deadline after {time.monotonic() - started:.0f}s "
+                "(the caller already stopped waiting)"
+            )
+
+    return _on_event
+
+
 _CODEX_PROGRESS_DELTA_TYPES = frozenset(
     {
         "response.output_text.delta",
@@ -587,6 +628,38 @@ def aux_progress_hook(hook):
         yield
 
 
+def _current_aux_stream_deadline() -> Optional[float]:
+    """The waiting host's absolute monotonic deadline, if one is installed."""
+    return getattr(_aux_stream_deadline, "value", None)
+
+
+@contextlib.contextmanager
+def aux_stream_deadline(deadline: Optional[float]):
+    """Publish the waiting host's absolute deadline to the stream consumer.
+
+    *deadline* is a ``time.monotonic()`` timestamp — the same instant the host
+    itself stops waiting — or ``None`` for callers with no host deadline (a
+    no-op passthrough, so callers can wire it unconditionally). Re-entrant-safe.
+
+    #99692: the progress hook is a one-way channel (worker -> host). This is the
+    return leg. ``8207862212`` releases the compression OWNER when the fence is
+    cancelled, but the isolated provider daemon
+    (:func:`_run_protected_sync_provider_call`) that holds the socket keeps
+    streaming to its own ``_aux_stream_total_ceiling`` budget — >= the host's
+    ceiling by construction — billing an abandoned summary the commit fence is
+    already guaranteed to refuse, and stacking one fresh orphan per turn on a
+    session that compression never managed to shrink.
+    """
+    previous = getattr(_aux_stream_deadline, "value", None)
+    _aux_stream_deadline.value = (
+        deadline if isinstance(deadline, (int, float)) else previous
+    )
+    try:
+        yield
+    finally:
+        _aux_stream_deadline.value = previous
+
+
 # Back-compat alias — the timing hooks were introduced with this name.
 _aux_timing_hook = _aux_thread_local_hook
 
@@ -629,6 +702,11 @@ def _run_protected_sync_provider_call(
     # the protected daemon path is taken.
     dispatch_hook = getattr(_aux_dispatch, "hook", None)
     provider_response_hook = getattr(_aux_provider_response, "hook", None)
+    # #99692: the stream is consumed on the daemon below, and thread-locals do
+    # not cross that boundary — an owner-thread-only deadline would leave the
+    # fix inert on exactly the path large-session compression takes (protected
+    # call + hard-cancel source installed).
+    host_deadline = _current_aux_stream_deadline()
     provider_context = contextvars.copy_context()
     done = threading.Event()
     outcome: dict[str, Any] = {}
@@ -639,6 +717,7 @@ def _run_protected_sync_provider_call(
                 aux_progress_hook(progress_hook),
                 _aux_thread_local_hook(_aux_dispatch, dispatch_hook),
                 _aux_thread_local_hook(_aux_provider_response, provider_response_hook),
+                aux_stream_deadline(host_deadline),
                 aux_interrupt_protection(cancel_check=cancel_check),
             ):
                 outcome["result"] = callback(kwargs)
@@ -993,6 +1072,7 @@ def _fast_model_from_catalog(provider_id: str) -> str:
     network path — the underlying fetch is memory+disk cached with a
     last-known-good fallback.
     """
+    is_nous = provider_id.strip().lower() == "nous"
     try:
         from hermes_cli.auth import resolve_api_key_provider_credentials
         from hermes_cli.models import fetch_models_with_pricing
@@ -1012,6 +1092,17 @@ def _fast_model_from_catalog(provider_id: str) -> str:
             # fetch below still works for the catalogs that allow it.
             logger.debug("No credentials for %s catalog", provider_id, exc_info=True)
 
+        if not api_key and is_nous:
+            # Nous is OAuth, so the resolver above raises for it. An anonymous
+            # read returns the full catalog, and a model picked from it is
+            # refused at request time by the org's policy.
+            try:
+                from hermes_cli.models import _resolve_nous_pricing_credentials
+
+                api_key, base_url = _resolve_nous_pricing_credentials()
+            except Exception:
+                logger.debug("No Nous credentials for catalog", exc_info=True)
+
         if not base_url:
             base_url = str(getattr(get_provider_profile(provider_id), "base_url", "") or "")
         base_url = base_url.rstrip("/")
@@ -1020,14 +1111,37 @@ def _fast_model_from_catalog(provider_id: str) -> str:
         # fetch_models_with_pricing appends its own /v1/models.
         if base_url.endswith("/v1"):
             base_url = base_url[:-3]
+        # Same entry the pickers use, so the Nous-only arguments must match
+        # theirs: seeding it here without them costs the picker its sale chrome
+        # and leaves the policy catalog with no expiry.
+        _nous_kwargs = {}
+        if is_nous:
+            from hermes_cli.models import _NOUS_CATALOG_TTL_SECONDS
+
+            _nous_kwargs = {
+                "include_sale_original": True,
+                "cache_ttl_seconds": _NOUS_CATALOG_TTL_SECONDS,
+            }
         catalog = fetch_models_with_pricing(
-            api_key=api_key or None, base_url=base_url, timeout=3.0
+            api_key=api_key or None, base_url=base_url, timeout=3.0, **_nous_kwargs
         ) or {}
     except Exception:
         logger.debug("Fast-model catalog lookup failed for %s", provider_id, exc_info=True)
         return ""
 
     ids = sorted((str(m) for m in catalog), key=_model_recency_key, reverse=True)
+    if is_nous:
+        # The catalog's keys are a source of ids here, so the policy narrows
+        # them as it does the pickers' lists.
+        try:
+            from hermes_cli.models import (
+                nous_policy_allowed_ids,
+                restrict_to_nous_policy,
+            )
+
+            ids = restrict_to_nous_policy(ids, nous_policy_allowed_ids())
+        except Exception:
+            logger.debug("Nous policy filter unavailable", exc_info=True)
     for family in _FAST_MODEL_FAMILIES:
         for model_id in ids:
             lowered = model_id.lower()
@@ -1036,6 +1150,18 @@ def _fast_model_from_catalog(provider_id: str) -> str:
     return ""
 
 
+def _nous_policy_blocks(model_id: str) -> bool:
+    """True when the org's model policy does not admit *model_id*."""
+    try:
+        from hermes_cli.models import nous_policy_allowed_ids, restrict_to_nous_policy
+
+        allowed = nous_policy_allowed_ids()
+        return bool(allowed) and not restrict_to_nous_policy([model_id], allowed)
+    except Exception:
+        logger.debug("Nous policy check unavailable", exc_info=True)
+        return False
+
+
 # Default auxiliary models for direct API-key providers (cheap/fast for side tasks)
 def _get_aux_model_for_provider(provider_id: str, *, prefer_fast: bool = False) -> str:
     """Return the cheap auxiliary model for a provider.
@@ -1063,21 +1189,26 @@ def _get_aux_model_for_provider(provider_id: str, *, prefer_fast: bool = False)
     except Exception:
         pass
 
+    picked = ""
     if prefer_fast:
-        catalog_pick = _fast_model_from_catalog(provider_id)
-        if catalog_pick:
-            return catalog_pick
-        if profile is not None:
+        picked = _fast_model_from_catalog(provider_id)
+        if not picked and profile is not None:
             try:
-                live = profile.resolve_aux_model()
-                if live:
-                    return live
+                picked = profile.resolve_aux_model() or ""
             except Exception:
                 logger.debug("resolve_aux_model failed for %s", provider_id, exc_info=True)
 
-    if profile is not None and profile.default_aux_model:
-        return profile.default_aux_model
-    return _API_KEY_PROVIDER_AUX_MODELS_FALLBACK.get(provider_id, "")
+    if not picked and profile is not None and profile.default_aux_model:
+        picked = profile.default_aux_model
+    if not picked:
+        picked = _API_KEY_PROVIDER_AUX_MODELS_FALLBACK.get(provider_id, "")
+
+    # Steps 2-4 are policy-blind: resolve_aux_model queries a public
+    # recommendation and the rest are hardcoded. A blocked pick is refused at
+    # request time, so drop it and let the caller keep the main model.
+    if picked and provider_id.strip().lower() == "nous" and _nous_policy_blocks(picked):
+        return ""
+    return picked
 
 
 
@@ -1837,6 +1968,15 @@ class _CodexCompletionsAdapter:
         if total_timeout is not None:
             no_progress_timeout = min(no_progress_timeout, float(total_timeout))
         hard_deadline = _start_monotonic + _aux_stream_total_ceiling(total_timeout)
+        # #99692: the waiting host's absolute deadline (compress_context
+        # publishes its commit-fence ceiling via aux_stream_deadline) clamps
+        # the hard ceiling so the re-armable watchdog Timer wakes and severs
+        # the socket at the instant the host stops waiting — a live Codex
+        # stream cannot otherwise be stopped by a per-event cancel check
+        # while it is blocked between events.
+        _host_deadline = _current_aux_stream_deadline()
+        if isinstance(_host_deadline, (int, float)) and _host_deadline < hard_deadline:
+            hard_deadline = float(_host_deadline)
         deadline_lock = threading.Lock()
         progress_deadline = [_start_monotonic + no_progress_timeout]
         saw_content = threading.Event()
@@ -2452,13 +2592,7 @@ class _AnthropicCompletionsAdapter:
             # stalled summary open. No-op when no hook is installed (None
             # keeps the fast get_final_message path).
             on_stream_event=(
-                (
-                    lambda event: (
-                        _notify_aux_provider_response()
-                        if _anthropic_event_has_content(event)
-                        else _notify_aux_timing_response()
-                    )
-                )
+                _anthropic_aux_stream_event_hook()
                 if _aux_progress_active()
                 else None
             ),
@@ -9187,6 +9321,14 @@ def _build_call_kwargs(
             _provider_norm == "openrouter"
             or base_url_host_matches(_effective_base, "openrouter.ai")
         )
+        # The managed local llama-server honors explicit caps too: a local
+        # decode burns the user's own GPU at full tilt, so a caller that
+        # says "this is a 64-token task" must be believed — an uncapped
+        # local generation whose EOS never comes runs to the full context
+        # window. No wire-format quirks apply (llama.cpp accepts
+        # max_tokens), and the no-default-cap policy is unchanged: this
+        # only forwards caps callers explicitly set.
+        _is_managed_local = _is_managed_local_endpoint(_effective_base)
         if (
             _is_anthropic_compat_endpoint(provider, _effective_base)
             or _nous_on_messages
@@ -9194,6 +9336,7 @@ def _build_call_kwargs(
             or _is_moa
             or _is_gemini_native
             or _is_openrouter
+            or _is_managed_local
         ):
             # Use auxiliary_max_tokens_param() so models that require
             # max_completion_tokens (GPT-5 family, Copilot) get the right
@@ -9539,6 +9682,49 @@ def _is_streaming_rejected_error(exc: Exception) -> bool:
     )
 
 
+_MANAGED_LOCAL_STATE_TTL_S = 15.0
+_managed_local_cache: "tuple[float, str]" = (0.0, "")
+
+
+def _managed_local_netloc() -> str:
+    """host:port of the managed local llama-server, or "" when none.
+
+    Read from the supervisor's state file (written at spawn, removed on
+    stop) with a short TTL so per-request checks don't hit the disk. The
+    state file is the same source provider resolution uses, so the match
+    is exact — no false positives on other localhost endpoints.
+    """
+    global _managed_local_cache
+    now = time.monotonic()
+    ts, cached = _managed_local_cache
+    if now - ts < _MANAGED_LOCAL_STATE_TTL_S:
+        return cached
+    netloc = ""
+    try:
+        from hermes_cli.local_runtime.supervisor import state_path
+
+        raw = state_path().read_text(encoding="utf-8")
+        base = str((json.loads(raw) or {}).get("base_url", ""))
+        netloc = urlparse(base).netloc.lower()
+    except Exception:
+        netloc = ""
+    _managed_local_cache = (now, netloc)
+    return netloc
+
+
+def _is_managed_local_endpoint(base_url: Optional[str]) -> bool:
+    """True when *base_url* targets the llama-server this Hermes manages."""
+    if not base_url:
+        return False
+    managed = _managed_local_netloc()
+    if not managed:
+        return False
+    try:
+        return urlparse(str(base_url)).netloc.lower() == managed
+    except Exception:
+        return False
+
+
 def _provider_requires_stream(provider: str, base_url: Optional[str]) -> bool:
     """Detect providers that only accept streaming (non-stream = HTTP 400).
 
@@ -9554,6 +9740,18 @@ def _provider_requires_stream(provider: str, base_url: Optional[str]) -> bool:
     Beyond the known-host list, users can mark ANY custom endpoint as
     stream-only via ``auxiliary.stream_only_base_urls`` in config.yaml
     (list of substrings matched against the endpoint URL).
+
+    The managed local llama-server is always streamed for a different
+    reason: cancellation. llama-server only notices a dead client when it
+    writes to the socket. A non-streamed request writes once — after the
+    FULL generation — so an abandoned call (client timeout, retry, app
+    exit) keeps the GPU decoding to the end of the context window with
+    nobody listening; requests that queue behind a model load are the
+    worst case, since the client is long gone before decode even starts.
+    Streaming writes every few tokens, so an abandoned decode dies at the
+    first post-disconnect chunk (verified against llama-server b10362:
+    streamed disconnect cancels in <1s through the router; non-streamed
+    survives until the server's next incidental socket poll, if ever).
     """
     _url = str(base_url or "").lower()
     if not _url:
@@ -9561,6 +9759,9 @@ def _provider_requires_stream(provider: str, base_url: Optional[str]) -> bool:
     # Tencent Copilot — "Non-stream chat request is currently not supported"
     if base_url_host_matches(_url, "copilot.tencent.com"):
         return True
+    # Managed local llama-server — streamed so abandonment cancels decode.
+    if _is_managed_local_endpoint(_url):
+        return True
     try:
         from hermes_cli.config import load_config
         aux_cfg = (load_config() or {}).get("auxiliary", {})
@@ -9753,7 +9954,11 @@ def _aggregate_chat_stream(
     Accumulation is shared with the async mirror via
     :class:`_ChatStreamAccumulator`.
     """
-    acc = _ChatStreamAccumulator(model=model, total_ceiling=total_ceiling)
+    acc = _ChatStreamAccumulator(
+        model=model,
+        total_ceiling=total_ceiling,
+        host_deadline=_current_aux_stream_deadline(),
+    )
     try:
         for chunk in chunks:
             acc.feed(chunk)
@@ -9775,9 +9980,20 @@ class _ChatStreamAccumulator:
     tool-call delta reassembly, same "timed out" ceiling phrasing).
     """
 
-    def __init__(self, model: str = "", total_ceiling: Optional[float] = None):
+    def __init__(
+        self,
+        model: str = "",
+        total_ceiling: Optional[float] = None,
+        host_deadline: Optional[float] = None,
+    ):
         self._started = time.monotonic()
         self._total_ceiling = total_ceiling
+        # #99692: absolute instant the WAITING HOST gives up. Checked as well
+        # as (not instead of) the ceiling above: the ceiling still bounds
+        # callers with no host deadline, and the host deadline is absolute, so
+        # it is unaffected by however long dispatch and TTFT took before this
+        # accumulator was constructed.
+        self._host_deadline = host_deadline
         self.content_parts: List[str] = []
         self.reasoning_parts: List[str] = []
         self.reasoning_details: List[Any] = []
@@ -9801,6 +10017,16 @@ class _ChatStreamAccumulator:
                 f"Auxiliary streamed call timed out after {self._total_ceiling:.0f}s "
                 "total ceiling (stream still open but over budget)"
             )
+        if (
+            self._host_deadline is not None
+            and time.monotonic() >= self._host_deadline
+        ):
+            raise TimeoutError(
+                "Auxiliary streamed call timed out at the host compression "
+                f"deadline after {time.monotonic() - self._started:.0f}s "
+                "(the caller already stopped waiting; streaming on would only "
+                "pin its session lease)"
+            )
         self.resp_id = getattr(chunk, "id", None) or self.resp_id
         self.resp_model = getattr(chunk, "model", None) or self.resp_model
         chunk_usage = getattr(chunk, "usage", None)
@@ -9912,7 +10138,11 @@ async def _aggregate_chat_stream_async(
     the sync helper raises. Same accumulation and ceiling semantics via
     :class:`_ChatStreamAccumulator`.
     """
-    acc = _ChatStreamAccumulator(model=model, total_ceiling=total_ceiling)
+    acc = _ChatStreamAccumulator(
+        model=model,
+        total_ceiling=total_ceiling,
+        host_deadline=_current_aux_stream_deadline(),
+    )
     try:
         async for chunk in chunks:
             acc.feed(chunk)
diff --git a/agent/chat_completion_helpers.py b/agent/chat_completion_helpers.py
index e24c71e52d..e352f40ca9 100644
--- a/agent/chat_completion_helpers.py
+++ b/agent/chat_completion_helpers.py
@@ -34,6 +34,7 @@ from agent.error_classifier import (
     PROVIDER_STREAM_NON_JSON_ERROR_CODE,
 )
 from agent.errors import EmptyStreamError
+from agent.fast_mode import effective_request_overrides
 from agent.turn_context import substitute_api_content
 from agent.gemini_native_adapter import is_native_gemini_base_url
 from agent.model_metadata import is_local_endpoint
@@ -1055,6 +1056,59 @@ def should_use_direct_api_call(agent) -> bool:
 _DIRECT_API_ACTIVITY_HEARTBEAT_SECONDS = 15.0
 
 
+def _managed_local_load_notice(agent, api_kwargs: dict) -> "Optional[str]":
+    """A live phase notice while the managed local server works before the
+    first token, or None when neither phase (nor the managed server) applies:
+
+    - "⏳ loading <model> into memory — N%"  (weights streaming off disk;
+      real per-tensor percent from the router's SSE stream)
+    - "⚙ processing prompt — N of ~M tokens (P%)"  (prefill; live counter
+      from /slots, denominator estimated from the request body)
+
+    A cold local model spends ~tens of seconds loading and a long-context
+    turn spends tens more in prefill; without this, both windows render as
+    the generic "no output yet (provider may be slow or overloaded)" stall
+    warning — alarming copy for healthy, expected phases.
+    """
+    try:
+        base = str(getattr(agent, "base_url", "") or "")
+        if not base:
+            return None
+        import json as _json
+        from urllib.parse import urlparse
+
+        from hermes_cli.local_runtime.load_progress import (
+            get_loading_progress,
+            get_prefill_progress,
+        )
+        from hermes_cli.local_runtime.supervisor import state_path
+
+        state = _json.loads(state_path().read_text(encoding="utf-8"))
+        managed = urlparse(str(state.get("base_url", ""))).netloc.lower()
+        if not managed or urlparse(base).netloc.lower() != managed:
+            return None
+        model = str(api_kwargs.get("model", ""))
+        progress = get_loading_progress().get(model)
+        if progress is not None:
+            return (
+                f"⏳ loading {model} into memory — {progress['percent']}% "
+                "(responses start once the model is loaded)"
+            )
+        prefill = get_prefill_progress(model)
+        if prefill is not None:
+            processed = int(prefill["processed"])
+            total = estimate_request_context_tokens(api_kwargs)
+            if total and total >= processed:
+                pct = max(0, min(100, round(processed / total * 100)))
+                return f"⚙ processing prompt — {pct}%"
+            # Counter past the estimate (estimator undercounted): no honest
+            # denominator, so no percent — the UI shows label-only.
+            return "⚙ processing prompt"
+        return None
+    except Exception:  # noqa: BLE001 — a status nicety must never break a call
+        return None
+
+
 def _resolve_direct_stale_timeout(agent, api_kwargs: dict) -> float:
     """Stale budget for the inline non-streaming call.
 
@@ -1379,6 +1433,35 @@ def interruptible_api_call(agent, api_kwargs: dict):
     # a network bug and surfaced to the caller. (PR #6600 — cascading interrupt
     # hang.)
     _request_cancelled = {"value": False}
+    # Codex Responses retirement token (codex_responses only). The worker
+    # thread reads it through ``agent._active_codex_stream_request_token`` to
+    # tell whether it still owns the turn. When a watchdog below force-closes
+    # the connection it clears the agent-level token, so a worker still
+    # draining SSE frames raises instead of returning its partial output as a
+    # "completed" response (see run_codex_stream's _request_is_current).
+    # ``_codex_request_retired`` is the request-local mirror, used to swallow
+    # the transport error our own force-close causes — same split as
+    # ``_request_cancelled`` above.
+    _codex_request_token = object() if agent.api_mode == "codex_responses" else None
+    _codex_request_retired = {"value": False}
+
+    def _install_codex_request_token() -> None:
+        if _codex_request_token is None:
+            return
+        if _codex_request_retired["value"]:
+            # Already retired before the worker got going — do not re-publish.
+            return
+        agent._active_codex_stream_request_token = _codex_request_token
+
+    def _retire_codex_request_token() -> None:
+        if _codex_request_token is None:
+            return
+        _codex_request_retired["value"] = True
+        if (
+            getattr(agent, "_active_codex_stream_request_token", None)
+            is _codex_request_token
+        ):
+            agent._active_codex_stream_request_token = None
 
     def _set_request_client(client, *, kind: str = "openai"):
         with request_client_lock:
@@ -1438,6 +1521,7 @@ def interruptible_api_call(agent, api_kwargs: dict):
 
     def _call():
         try:
+            _install_codex_request_token()
             # _set_request_client registers each per-request client with the
             # stranger-thread abort machinery above; the shared dispatch helper
             # builds it via this callback (openai- or anthropic-kind) so the
@@ -1460,15 +1544,34 @@ def interruptible_api_call(agent, api_kwargs: dict):
             # handler, the transport error is the expected consequence of our
             # own force-close, NOT a network bug. Swallow it instead of
             # surfacing — the main thread raises InterruptedError. (#6600)
-            if _request_cancelled["value"]:
-                logger.debug(
-                    "Non-streaming worker caught %s after request cancellation — "
-                    "exiting without surfacing a network error.",
-                    type(e).__name__,
-                )
+            if _request_cancelled["value"] or _codex_request_retired["value"]:
+                # Retirement is logged at info: it means a watchdog discarded
+                # output the provider had already sent, which is exactly the
+                # event an operator debugging a truncated reply needs to see.
+                # Cancellation stays at debug — a user interrupt is a normal,
+                # high-frequency outcome and the caller already surfaces it.
+                if _codex_request_retired["value"]:
+                    logger.info(
+                        "Codex worker caught %s after request retirement — "
+                        "discarding the stale partial instead of surfacing it "
+                        "as a completed response. %s",
+                        type(e).__name__,
+                        agent._client_log_context(),
+                    )
+                else:
+                    logger.debug(
+                        "Non-streaming worker caught %s after request "
+                        "cancellation — exiting without surfacing a network "
+                        "error.",
+                        type(e).__name__,
+                    )
                 return
             result["error"] = e
         finally:
+            # Retire first: _close_request_client_once can raise (every other
+            # call site wraps it in try/except), and a leaked token would let a
+            # later worker mistake itself for the owning attempt.
+            _retire_codex_request_token()
             # Reuse reason only on a clean response; any other outcome —
             # error, or the cancel-swallow return above (which leaves both
             # result slots None) — really closes so the next attempt builds
@@ -1681,6 +1784,7 @@ def interruptible_api_call(agent, api_kwargs: dict):
                 _close_request_client_once("codex_ttfb_kill")
             except Exception:
                 pass
+            _retire_codex_request_token()
             agent._emit_wait_notice(
                 f"⚠ no response from provider in {int(_elapsed)}s — "
                 f"reconnecting..."
@@ -1731,6 +1835,7 @@ def interruptible_api_call(agent, api_kwargs: dict):
                 _close_request_client_once("codex_stream_idle_kill")
             except Exception:
                 pass
+            _retire_codex_request_token()
             agent._touch_activity(
                 f"codex stream killed after {int(_event_stale_elapsed)}s with no SSE events"
             )
@@ -1762,6 +1867,7 @@ def interruptible_api_call(agent, api_kwargs: dict):
                 _close_request_client_once("stale_call_kill")
             except Exception:
                 pass
+            _retire_codex_request_token()
             # Circuit breaker (#58962): count the stale kill.  See the
             # canonical comment block above ``_stale_streak()``.
             _bump_stale_streak(agent)
@@ -1809,6 +1915,7 @@ def interruptible_api_call(agent, api_kwargs: dict):
                 _close_request_client_once("interrupt_abort")
             except Exception:
                 pass
+            _retire_codex_request_token()
             # #81521 (sibling of the streaming-path fix): wait for the worker
             # to unwind Relay-managed scopes before surfacing
             # InterruptedError, so turn teardown cannot race a still-open
@@ -1826,10 +1933,63 @@ def interruptible_api_call(agent, api_kwargs: dict):
 
 
 
+def _consume_ephemeral_reasoning_off(agent) -> bool:
+    """Consume the one-shot "answer without thinking" continuation flag.
+
+    Set by the length-continuation path when a request returned reasoning
+    but NO visible content — the thinking phase consumed the entire output
+    cap (GLM-5.3 on ollama-cloud with reasoning_effort=high: reported live as
+    finish_reason="length", content="", completion_tokens == max_tokens).
+
+    Continuation turns never replay the prior reasoning, so re-running with
+    thinking ON re-derives — and re-burns — the whole thinking budget from
+    scratch instead of writing the answer (observed: 4 futile continuations
+    then "Response remained truncated after 4 continuation attempts").
+    When True is returned the caller must override the wire reasoning_config
+    with ``{"enabled": False, "effort": "none"}`` for exactly the next call.
+
+    Prompt-cache cost (deliberate, bounded): the reasoning parameter is part
+    of the provider's cache key on config-sensitive providers — Anthropic
+    renders thinking/effort into the prompt, OpenAI lists reasoning.effort
+    among prefix-affecting settings — so THAT one request misses the prefix
+    cache and pays a cold write of the full prefix (1.25x input instead of
+    the 0.1x read).  The next request goes out with the configured reasoning
+    again and hits the thinking-on entry written by the truncated request
+    (still within TTL), so the damage is exactly one write.  Template-tail
+    providers (GLM/Qwen/Kimi-style, where thinking on/off is a chat-template
+    switch at the tail) see no prefix change at all.  The system prompt bytes
+    are never touched.  This is far cheaper than what the flag prevents: four
+    full-output-budget requests that produce nothing and end the turn with an
+    error.
+    """
+    if getattr(agent, "_ephemeral_reasoning_off", False):
+        agent._ephemeral_reasoning_off = False
+        return True
+    return False
+
+
+def _reasoning_config_for_wire(agent):
+    """``agent.reasoning_config`` with the one-shot reasoning-off override applied."""
+    if _consume_ephemeral_reasoning_off(agent):
+        return {
+            **(agent.reasoning_config or {}),
+            "enabled": False,
+            "effort": "none",
+        }
+    return agent.reasoning_config
+
+
 def build_api_kwargs(agent, api_messages: list, tools_for_api: list | None = None) -> dict:
     """Build the keyword arguments dict for the active API mode."""
+    # One-shot continuation override — consumed exactly once, on the FIRST
+    # request this call builds (only one api_mode branch runs per invocation).
+    _wire_reasoning_config = _reasoning_config_for_wire(agent)
     if tools_for_api is None:
         tools_for_api = agent.tools
+    # The one place request_overrides are consumed: static /fast values are
+    # already pinned in agent.request_overrides; auto/cold windows layer the
+    # fast override here, per request, only while the window is open.
+    _request_overrides = effective_request_overrides(agent)
 
     if agent.api_mode == "anthropic_messages":
         _transport = agent._get_transport()
@@ -1844,12 +2004,12 @@ def build_api_kwargs(agent, api_messages: list, tools_for_api: list | None = Non
             messages=anthropic_messages,
             tools=tools_for_api,
             max_tokens=ephemeral_out if ephemeral_out is not None else agent.max_tokens,
-            reasoning_config=agent.reasoning_config,
+            reasoning_config=_wire_reasoning_config,
             is_oauth=agent._is_anthropic_oauth,
             preserve_dots=agent._anthropic_preserve_dots(),
             context_length=ctx_len,
             base_url=getattr(agent, "_anthropic_base_url", None),
-            fast_mode=(agent.request_overrides or {}).get("speed") == "fast",
+            fast_mode=_request_overrides.get("speed") == "fast",
             drop_context_1m_beta=bool(getattr(agent, "_oauth_1m_beta_disabled", False)),
         )
         # Nous Portal reads ``tags`` and ``session_id`` as top-level body fields
@@ -1936,13 +2096,13 @@ def build_api_kwargs(agent, api_messages: list, tools_for_api: list | None = Non
             model=agent.model,
             messages=_msgs_for_codex,
             tools=tools_for_api,
-            reasoning_config=agent.reasoning_config,
+            reasoning_config=_wire_reasoning_config,
             session_id=getattr(agent, "session_id", None),
             cache_scope_id=_cache_scope_id,
             base_url=agent.base_url,
             max_tokens=agent.max_tokens,
             timeout=agent._resolved_api_call_timeout(),
-            request_overrides=agent.request_overrides,
+            request_overrides=_request_overrides,
             provider=getattr(agent, "provider", None),
             is_github_responses=is_github_responses,
             is_codex_backend=is_codex_backend,
@@ -2093,8 +2253,8 @@ def build_api_kwargs(agent, api_messages: list, tools_for_api: list | None = Non
             max_tokens=agent.max_tokens,
             ephemeral_max_output_tokens=_ephemeral_out,
             max_tokens_param_fn=agent._max_tokens_param,
-            reasoning_config=agent.reasoning_config,
-            request_overrides=agent.request_overrides,
+            reasoning_config=_wire_reasoning_config,
+            request_overrides=_request_overrides,
             session_id=getattr(agent, "session_id", None),
             cache_scope_id=_cache_scope_id,
             provider_profile=_profile,
@@ -2126,8 +2286,8 @@ def build_api_kwargs(agent, api_messages: list, tools_for_api: list | None = Non
         max_tokens=agent.max_tokens,
         ephemeral_max_output_tokens=_ephemeral_out,
         max_tokens_param_fn=agent._max_tokens_param,
-        reasoning_config=agent.reasoning_config,
-        request_overrides=agent.request_overrides,
+        reasoning_config=_wire_reasoning_config,
+        request_overrides=_request_overrides,
         session_id=getattr(agent, "session_id", None),
         cache_scope_id=_cache_scope_id,
         model_lower=(agent.model or "").lower(),
@@ -3493,14 +3653,11 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
         if emit is not None:
             emit(final_text=final_text, finished=finished, error=error)
 
-    # Cron and other non-interactive, nested-pool contexts deadlock on the
-    # spawned worker thread (#62151). They also have no stream consumer, so the
-    # deltas this path produces go nowhere. Delegate to the non-streaming entry
-    # (which runs inline via should_use_direct_api_call) exactly like the codex
-    # branch below — routing through the _interruptible_api_call method keeps the
-    # outer loop's per-request retry/refresh seam intact.
-    if should_use_direct_api_call(agent):
-        return agent._interruptible_api_call(api_kwargs)
+    # Cron turns and delegated children (should_use_direct_api_call) used to be
+    # short-circuited here onto the NON-streaming wire. They now stay on this
+    # streaming path and run the request inline — see the ``_inline`` block
+    # before the poll loop below. Only the codex branch still detours through
+    # _interruptible_api_call (it streams internally).
 
     if agent.api_mode == "codex_responses":
         # Codex streams internally via _run_codex_stream. The main dispatch
@@ -4130,6 +4287,29 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
                     provider_tool_in_flight["yes"] = True
             except Exception:
                 pass
+            # Payload-empty terminal chunk: the provider completed the
+            # stream (`finish_reason` set, no further writable delta). The
+            # attempt/writer fence exists to stop a superseded stream from
+            # writing *more* text. Fending this marker-only chunk discards
+            # the only completion signal, which the drop-guard then
+            # mislabels as a mid-stream drop. A finish chunk that still
+            # carries content/tool_calls remains gated.
+            try:
+                _choices = getattr(_chunk, "choices", None)
+                if _choices:
+                    _choice = _choices[0]
+                    if getattr(_choice, "finish_reason", None):
+                        _delta = getattr(_choice, "delta", None)
+                        _has_write = bool(
+                            getattr(_delta, "content", None)
+                            or getattr(_delta, "tool_calls", None)
+                            or getattr(_delta, "reasoning_content", None)
+                            or getattr(_delta, "reasoning", None)
+                        )
+                        if not _has_write:
+                            return True
+            except Exception:
+                pass
             if not _stream_attempt_is_active(stream_attempt_id):
                 return False
             token = _writer_token["value"]
@@ -5295,143 +5475,246 @@ def interruptible_streaming_api_call(agent, api_kwargs: dict, *, on_first_delta=
         if _reasoning_floor is not None:
             _stream_stale_timeout = max(_stream_stale_timeout, _reasoning_floor)
 
-    t = threading.Thread(target=_context_thread_target(_call), daemon=True)
-    t.start()
+    # Delegated children and gateway cron turns run the streaming request
+    # INLINE on the conversation thread: spawning the interrupt worker inside
+    # their nested thread pools wedges before the socket opens (#62151,
+    # #60203). They used to be routed to the non-streaming wire for that
+    # reason — but streaming is also the transport keepalive and the
+    # liveness signal: a non-streaming POST that stays silent through a
+    # reasoning model's thinking phase is killed by edge proxies (z.ai 524,
+    # #90202) and by our own stale watchdog, which cannot tell thinking from
+    # a hang when no bytes ever arrive (#100260). Inline mode keeps the
+    # stream (per-token liveness) and moves ONLY the lightweight poll loop
+    # below — heartbeat, stale detector, interrupt abort — onto a monitor
+    # thread. The monitor never issues a request, so the no-worker property
+    # that fixes the deadlock class is preserved (same shape as the
+    # direct_api_call watchdog timer).
+    _inline = should_use_direct_api_call(agent)
+    _call_done = threading.Event()
+    _monitor_interrupted = {"yes": False}
+
+    def _run_call():
+        try:
+            _call()
+        finally:
+            _call_done.set()
+
+    if _inline:
+        t = None
+    else:
+        t = threading.Thread(target=_context_thread_target(_run_call), daemon=True)
+        t.start()
+
+    def _call_alive() -> bool:
+        return not _call_done.is_set()
+
+    def _wait_call(timeout: float) -> None:
+        _call_done.wait(timeout=timeout)
+
     _last_heartbeat = time.time()
     _HEARTBEAT_INTERVAL = 30.0  # seconds between gateway activity touches
-    while t.is_alive():
-        t.join(timeout=0.3)
+    # Managed local server: a cold model streams weights off disk for tens
+    # of seconds before the first token can exist. Surface THAT immediately
+    # (real per-tensor percent from the router's SSE stream) instead of
+    # letting the wait fall through to the 30s "provider may be slow or
+    # overloaded" copy. Checked on a ~1s cadence only while no chunks have
+    # arrived; the probe is an in-memory snapshot read, not a network call.
+    _last_load_poll = 0.0
+    _load_notice_shown = False
+    _load_notice_misses = 0
+    _is_local_base = bool(agent.base_url) and is_local_endpoint(agent.base_url)
 
-        # Periodic heartbeat: touch the agent's activity tracker so the
-        # gateway's inactivity monitor knows we're alive while waiting
-        # for stream chunks.  Without this, long thinking pauses (e.g.
-        # reasoning models) or slow prefill on local providers (Ollama)
-        # trigger false inactivity timeouts.  The _call thread touches
-        # activity on each chunk, but the gap between API call start
-        # and first chunk can exceed the gateway timeout — especially
-        # when the stale-stream timeout is disabled (local providers).
-        _hb_now = time.time()
-        if _hb_now - _last_heartbeat >= _HEARTBEAT_INTERVAL:
-            _last_heartbeat = _hb_now
-            _waiting_secs = int(_hb_now - last_chunk_time["t"])
-            if _waiting_secs >= _HEARTBEAT_INTERVAL:
-                # No chunks for 30s+ — rewrite the live spinner/status line
-                # so CLI/TUI/Desktop users see WHAT the wait is (slow or
-                # overloaded provider / long thinking pause) instead of an
-                # unexplained generic spinner, and WHEN recovery kicks in.
-                if (
-                    _stream_stale_timeout is not None
-                    and _stream_stale_timeout != float("inf")
-                ):
-                    _recovery = f"; auto-reconnect at {int(_stream_stale_timeout)}s"
+    def _monitor_loop() -> None:
+        nonlocal _last_heartbeat, _last_load_poll, _load_notice_shown, _load_notice_misses
+        while _call_alive():
+            _wait_call(0.3)
+
+            _hb_now = time.time()
+            # Cold-load window: last_chunk_time is touched at request-client
+            # creation and then only by REAL chunks, so "no chunk for 2s+" is
+            # true through a model load (nothing can stream while the child is
+            # still mapping weights) and false during healthy token flow —
+            # which is what keeps this poll off the streaming hot path. The
+            # probe itself is an in-memory snapshot read.
+            if (
+                _is_local_base
+                and _hb_now - last_chunk_time["t"] >= 2.0
+                and _hb_now - _last_load_poll >= 1.0
+            ):
+                _last_load_poll = _hb_now
+                _load_notice = _managed_local_load_notice(agent, api_kwargs)
+                if _load_notice is not None:
+                    agent._emit_wait_notice(_load_notice)
+                    agent._touch_activity("local model loading")
+                    _load_notice_shown = True
+                    _load_notice_misses = 0
+                    # Loading IS liveness for the heartbeat; the stale detector
+                    # needs no help — the local floor (900s) dwarfs any load.
+                    _last_heartbeat = _hb_now
+                    continue
+                if _load_notice_shown:
+                    # One missed sample is routine (a /slots read straddling a
+                    # batch boundary, a 2s probe timeout under load) — clearing
+                    # on it made the status line strobe blank once every few
+                    # seconds mid-prefill. Only a SUSTAINED absence means the
+                    # phase really ended.
+                    _load_notice_misses += 1
+                    if _load_notice_misses >= 3:
+                        _load_notice_shown = False
+                        _load_notice_misses = 0
+                        agent._emit_wait_notice("")
+
+            # Periodic heartbeat: touch the agent's activity tracker so the
+            # gateway's inactivity monitor knows we're alive while waiting
+            # for stream chunks.  Without this, long thinking pauses (e.g.
+            # reasoning models) or slow prefill on local providers (Ollama)
+            # trigger false inactivity timeouts.  The _call thread touches
+            # activity on each chunk, but the gap between API call start
+            # and first chunk can exceed the gateway timeout — especially
+            # when the stale-stream timeout is disabled (local providers).
+            if _hb_now - _last_heartbeat >= _HEARTBEAT_INTERVAL:
+                _last_heartbeat = _hb_now
+                _waiting_secs = int(_hb_now - last_chunk_time["t"])
+                if _waiting_secs >= _HEARTBEAT_INTERVAL:
+                    # No chunks for 30s+ — rewrite the live spinner/status line
+                    # so CLI/TUI/Desktop users see WHAT the wait is (slow or
+                    # overloaded provider / long thinking pause) instead of an
+                    # unexplained generic spinner, and WHEN recovery kicks in.
+                    if (
+                        _stream_stale_timeout is not None
+                        and _stream_stale_timeout != float("inf")
+                    ):
+                        _recovery = f"; auto-reconnect at {int(_stream_stale_timeout)}s"
+                    else:
+                        _recovery = ""
+                    agent._emit_wait_notice(
+                        f"⏳ waiting on {api_kwargs.get('model', 'the provider')} — "
+                        f"{_waiting_secs}s with no output yet (provider may be "
+                        f"slow or overloaded, or the model is thinking{_recovery})"
+                    )
                 else:
-                    _recovery = ""
+                    # Chunks are flowing — keep the activity tracker fresh but
+                    # leave the live display alone.
+                    agent._touch_activity(
+                        f"waiting for stream response ({_waiting_secs}s, no chunks yet)"
+                    )
+
+            # Detect stale streams: connections kept alive by SSE pings
+            # but delivering no real chunks.  Kill the client so the
+            # inner retry loop can start a fresh connection.
+            _stale_elapsed = time.time() - last_chunk_time["t"]
+            if _stale_elapsed > _stream_stale_timeout:
+                _est_ctx = estimate_request_context_tokens(api_kwargs)
+                logger.warning(
+                    "Stream stale for %.0fs (threshold %.0fs) — no chunks received. "
+                    "model=%s context=~%s tokens. Killing connection.",
+                    _stale_elapsed, _stream_stale_timeout,
+                    api_kwargs.get("model", "unknown"), f"{_est_ctx:,}",
+                )
+                agent._buffer_status(
+                    f"⚠️ No response from provider for {int(_stale_elapsed)}s "
+                    f"(model: {api_kwargs.get('model', 'unknown')}, "
+                    f"context: ~{_est_ctx:,} tokens). "
+                    f"Reconnecting..."
+                )
+                try:
+                    _cancel_current_stream_attempt("stale_stream_kill")
+                    _close_request_client_once("stale_stream_kill")
+                except Exception:
+                    pass
+                # Circuit breaker (#58962): count the stale kill.  See the
+                # canonical comment block above ``_stale_streak()``.
+                _bump_stale_streak(agent)
+                # Rebuild the primary client too — its connection pool
+                # may hold dead sockets from the same provider outage.
+                if agent.api_mode == "anthropic_messages":
+                    # #67142: the stale stream ran on a request-local anthropic
+                    # client, already socket-aborted above via
+                    # _close_request_client_once (which unblocks the worker and
+                    # preserves the #28161 no-hang guarantee). The shared
+                    # _anthropic_client is NOT the in-flight transport, so we must
+                    # not close it from this poll (stranger) thread — that was the
+                    # FD-recycle corruption vector. Nothing further is needed.
+                    pass
+                else:
+                    # #70773: same FD-recycle corruption vector as #67142.
+                    # The shared OpenAI client's connection pool must NOT be
+                    # closed from this watchdog/poll thread — worker threads
+                    # from previous stale-killed attempts may still be
+                    # unwinding their SSL BIOs.  The request-local client is
+                    # already closed above via _close_request_client_once.
+                    # The shared client will be replaced lazily by
+                    # _ensure_primary_openai_client on the next request.
+                    pass
+                # Reset the timer so we don't kill repeatedly while
+                # the inner thread processes the closure.
+                last_chunk_time["t"] = time.time()
                 agent._emit_wait_notice(
-                    f"⏳ waiting on {api_kwargs.get('model', 'the provider')} — "
-                    f"{_waiting_secs}s with no output yet (provider may be "
-                    f"slow or overloaded, or the model is thinking{_recovery})"
+                    f"⚠ no output from provider for {int(_stale_elapsed)}s — "
+                    f"reconnecting..."
                 )
-            else:
-                # Chunks are flowing — keep the activity tracker fresh but
-                # leave the live display alone.
                 agent._touch_activity(
-                    f"waiting for stream response ({_waiting_secs}s, no chunks yet)"
+                    f"stale stream detected after {int(_stale_elapsed)}s, reconnecting"
                 )
 
-        # Detect stale streams: connections kept alive by SSE pings
-        # but delivering no real chunks.  Kill the client so the
-        # inner retry loop can start a fresh connection.
-        _stale_elapsed = time.time() - last_chunk_time["t"]
-        if _stale_elapsed > _stream_stale_timeout:
-            _est_ctx = estimate_request_context_tokens(api_kwargs)
-            logger.warning(
-                "Stream stale for %.0fs (threshold %.0fs) — no chunks received. "
-                "model=%s context=~%s tokens. Killing connection.",
-                _stale_elapsed, _stream_stale_timeout,
-                api_kwargs.get("model", "unknown"), f"{_est_ctx:,}",
-            )
-            agent._buffer_status(
-                f"⚠️ No response from provider for {int(_stale_elapsed)}s "
-                f"(model: {api_kwargs.get('model', 'unknown')}, "
-                f"context: ~{_est_ctx:,} tokens). "
-                f"Reconnecting..."
-            )
-            try:
-                _cancel_current_stream_attempt("stale_stream_kill")
-                _close_request_client_once("stale_stream_kill")
-            except Exception:
-                pass
-            # Circuit breaker (#58962): count the stale kill.  See the
-            # canonical comment block above ``_stale_streak()``.
-            _bump_stale_streak(agent)
-            # Rebuild the primary client too — its connection pool
-            # may hold dead sockets from the same provider outage.
-            if agent.api_mode == "anthropic_messages":
-                # #67142: the stale stream ran on a request-local anthropic
-                # client, already socket-aborted above via
-                # _close_request_client_once (which unblocks the worker and
-                # preserves the #28161 no-hang guarantee). The shared
-                # _anthropic_client is NOT the in-flight transport, so we must
-                # not close it from this poll (stranger) thread — that was the
-                # FD-recycle corruption vector. Nothing further is needed.
-                pass
-            else:
-                # #70773: same FD-recycle corruption vector as #67142.
-                # The shared OpenAI client's connection pool must NOT be
-                # closed from this watchdog/poll thread — worker threads
-                # from previous stale-killed attempts may still be
-                # unwinding their SSL BIOs.  The request-local client is
-                # already closed above via _close_request_client_once.
-                # The shared client will be replaced lazily by
-                # _ensure_primary_openai_client on the next request.
-                pass
-            # Reset the timer so we don't kill repeatedly while
-            # the inner thread processes the closure.
-            last_chunk_time["t"] = time.time()
-            agent._emit_wait_notice(
-                f"⚠ no output from provider for {int(_stale_elapsed)}s — "
-                f"reconnecting..."
-            )
-            agent._touch_activity(
-                f"stale stream detected after {int(_stale_elapsed)}s, reconnecting"
-            )
-
-        if agent._interrupt_requested:
-            # The stale branch above already counted this iteration when its
-            # deadline won the race; do not double-count a simultaneous stop.
-            if _stale_elapsed <= _stream_stale_timeout:
-                _record_interrupted_provider_wait(
-                    agent,
-                    _stale_elapsed,
-                    response_started=deltas_were_sent["yes"],
+            if agent._interrupt_requested:
+                # The stale branch above already counted this iteration when its
+                # deadline won the race; do not double-count a simultaneous stop.
+                if _stale_elapsed <= _stream_stale_timeout:
+                    _record_interrupted_provider_wait(
+                        agent,
+                        _stale_elapsed,
+                        response_started=deltas_were_sent["yes"],
+                    )
+                # Mark THIS request cancelled before force-closing so the worker's
+                # exception handler recognizes the forced transport error as a
+                # cancel and exits without retrying or surfacing a network error.
+                # (#6600)
+                _request_cancelled["value"] = True
+                logger.debug(
+                    "Force-closing streaming httpx client due to interrupt "
+                    "(not a network error)."
                 )
-            # Mark THIS request cancelled before force-closing so the worker's
-            # exception handler recognizes the forced transport error as a
-            # cancel and exits without retrying or surfacing a network error.
-            # (#6600)
-            _request_cancelled["value"] = True
-            logger.debug(
-                "Force-closing streaming httpx client due to interrupt "
-                "(not a network error)."
-            )
-            try:
-                _cancel_current_stream_attempt("stream_interrupt_abort")
-                # #67142: kind-aware — anthropic aborts the request-local
-                # client's socket from this poll thread; the shared
-                # _anthropic_client is never closed here.
-                _close_request_client_once("stream_interrupt_abort")
-            except Exception:
-                pass
-            # Wait for the worker to unwind Relay-managed stream scopes
-            # (physical LLM + deferred logical) before surfacing
-            # InterruptedError. Raising immediately lets turn teardown
-            # (finish_logical_calls / end_turn / close_session) race a
-            # still-open physical scope and corrupt the LIFO stack —
-            # "scope handle is not at the top of the stack" → CLI EIO /
-            # redraw storm (#81521). No-op when Relay managed execution
-            # is not live.
-            _join_worker_for_relay_teardown(t, label="Streaming")
-            raise InterruptedError("Agent interrupted during streaming API call")
+                try:
+                    _cancel_current_stream_attempt("stream_interrupt_abort")
+                    # #67142: kind-aware — anthropic aborts the request-local
+                    # client's socket from this poll thread; the shared
+                    # _anthropic_client is never closed here.
+                    _close_request_client_once("stream_interrupt_abort")
+                except Exception:
+                    pass
+                # Wait for the worker to unwind Relay-managed stream scopes
+                # (physical LLM + deferred logical) before surfacing
+                # InterruptedError. Raising immediately lets turn teardown
+                # (finish_logical_calls / end_turn / close_session) race a
+                # still-open physical scope and corrupt the LIFO stack —
+                # "scope handle is not at the top of the stack" → CLI EIO /
+                # redraw storm (#81521). No-op when Relay managed execution
+                # is not live. (Inline mode has no worker: the request runs
+                # on the caller's thread and has already unwound by the time
+                # the InterruptedError below is raised.)
+                if t is not None:
+                    _join_worker_for_relay_teardown(t, label="Streaming")
+                _monitor_interrupted["yes"] = True
+                return
+
+    if _inline:
+        # Request on THIS thread; heartbeat / stale / interrupt monitor on a
+        # side thread that only ever aborts sockets (never dispatches).
+        monitor = threading.Thread(
+            target=_context_thread_target(_monitor_loop),
+            name="stream-inline-monitor",
+            daemon=True,
+        )
+        monitor.start()
+        try:
+            _run_call()
+        finally:
+            monitor.join(timeout=2.0)
+    else:
+        _monitor_loop()
+    if _monitor_interrupted["yes"]:
+        raise InterruptedError("Agent interrupted during streaming API call")
     # Worker thread exited before the main thread's poll loop could check
     # the interrupt flag.  If the worker returned early due to an interrupt
     # (e.g. _call_anthropic() detected _interrupt_requested and returned
diff --git a/agent/codex_runtime.py b/agent/codex_runtime.py
index ac272c43ea..30b86c6171 100644
--- a/agent/codex_runtime.py
+++ b/agent/codex_runtime.py
@@ -310,6 +310,7 @@ def _record_codex_app_server_compaction(
     # Native compaction rewrote the provider-side context; the usage anchor's
     # transcript snapshot no longer matches what will be sent. Invalidate it.
     agent._usage_anchor = None
+    agent._turn_base_usage_anchor = None
 
     agent._last_compaction_in_place = False
     try:
@@ -1100,7 +1101,9 @@ def _consume_codex_event_stream(
     * ``on_first_delta()`` — one-shot, fires on the first text delta only.
     * ``on_event(event)`` — fires for every event before any other processing.
       Used for watchdog activity, debug logging, anything wire-shape-agnostic.
-    * ``interrupt_check()`` — returns True to break the loop early.
+    * ``interrupt_check()`` — returns True to break the loop early, or raises
+      ``TimeoutError`` / ``InterruptedError`` for request-retirement control
+      flow that must not be converted into a partial final response.
     """
     collected_output_items: List[Any] = []
     # output_index of each collected_output_items entry, appended in lockstep
@@ -1605,18 +1608,39 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
     max_stream_retries = 1
     # Accumulate streamed text so callers / compat shims can read it.
     agent._codex_streamed_text_parts: list = []
+    # Retirement token for THIS request, installed by
+    # ``interruptible_api_call`` before it hands off to the worker thread. When
+    # a watchdog (TTFB / stream-idle / stale-call) kills the connection it
+    # clears the agent-level token, so a worker that is still draining frames
+    # can tell it has been retired. ``None`` means no watchdog owns this call
+    # (auxiliary callers drive this function directly) — then every check
+    # passes and behavior is unchanged.
+    request_token = getattr(agent, "_active_codex_stream_request_token", None)
+
+    def _request_is_current() -> bool:
+        if request_token is None:
+            return True
+        return getattr(agent, "_active_codex_stream_request_token", None) is request_token
 
     def _on_text_delta(text: str) -> None:
+        if not _request_is_current():
+            return
         agent._codex_streamed_text_parts.append(text)
         agent._fire_stream_delta(text)
 
     def _on_reasoning_delta(text: str) -> None:
+        if not _request_is_current():
+            return
         agent._fire_reasoning_delta(text)
 
     def _on_commentary_message(text: str) -> None:
+        if not _request_is_current():
+            return
         agent._fire_streamed_codex_commentary(text)
 
     def _on_event(event: Any) -> None:
+        if not _request_is_current():
+            return
         # TTFB watchdog and activity touch — runs once per SSE event.
         agent._codex_stream_last_event_ts = time.time()
         agent._touch_activity("receiving stream response")
@@ -1720,6 +1744,14 @@ def run_codex_stream(agent, api_kwargs: dict, client: Any = None, on_first_delta
             raise
 
         def _interrupt_or_superseded() -> bool:
+            # A retired request must NOT break out of the consume loop: breaking
+            # returns the partial `final` (status defaults to "completed"), which
+            # the caller persists as a finished assistant turn. Raise so the
+            # watchdog's own TimeoutError is what the retry path sees.
+            if not _request_is_current():
+                raise TimeoutError(
+                    "Codex Responses stream request retired before terminal response"
+                )
             return bool(agent._interrupt_requested)
 
         try:
diff --git a/agent/coding_context.py b/agent/coding_context.py
index 333de26b05..0eb41c85b0 100644
--- a/agent/coding_context.py
+++ b/agent/coding_context.py
@@ -253,7 +253,7 @@ CODING_AGENT_GUIDANCE = (
     "paths for the same flaw and fix the class, not just the reported site.\n"
     "- When fixing linter/type errors on a file, stop after about three "
     "attempts on the same file and ask the user rather than looping.\n"
-    "- Track multi-step work with `todo`. Reference code as `path:line` instead "
+    "- Track multi-step work with `todo_list`. Reference code as `path:line` instead "
     "of pasting whole files.\n"
     "\n"
     "Respect the user's repo: don't commit, push, or rewrite history unless "
@@ -547,9 +547,9 @@ class RuntimeMode:
         trailing: list[str] = []
         if self.profile.guidance:
             brief = self.profile.guidance
-            if valid_tool_names is not None and "todo" not in valid_tool_names:
+            if valid_tool_names is not None and "todo_list" not in valid_tool_names:
                 brief = brief.replace(
-                    "- Track multi-step work with `todo`. Reference code as "
+                    "- Track multi-step work with `todo_list`. Reference code as "
                     "`path:line` instead of pasting whole files.",
                     "- Reference code as `path:line` instead of pasting "
                     "whole files.",
diff --git a/agent/context_breakdown.py b/agent/context_breakdown.py
index 628cbd038a..9f9c5da755 100644
--- a/agent/context_breakdown.py
+++ b/agent/context_breakdown.py
@@ -135,9 +135,20 @@ def compute_session_context_breakdown(
     # after the response) and far more accurate than the heuristic total.
     from agent.model_metadata import anchored_context_tokens
 
+    # Prefer the turn-base anchor (first response of the current turn): on
+    # reasoning models, later same-turn responses inflate prompt_tokens with
+    # replayed thinking that evaporates at the turn boundary, so anchoring on
+    # the LAST response makes the meter sawtooth. Fall back to the last-
+    # response anchor, then to measured/estimated figures.
     anchored_used = anchored_context_tokens(
-        messages or [], getattr(agent, "_usage_anchor", None)
+        messages or [],
+        getattr(agent, "_turn_base_usage_anchor", None),
+        charge_stale_thinking=False,
     )
+    if anchored_used is None:
+        anchored_used = anchored_context_tokens(
+            messages or [], getattr(agent, "_usage_anchor", None)
+        )
     measured_used = int(getattr(comp, "last_prompt_tokens", 0) or 0) if comp else 0
     if anchored_used is not None:
         context_used = anchored_used
diff --git a/agent/context_compressor.py b/agent/context_compressor.py
index be38dae5f9..a70ea5a300 100644
--- a/agent/context_compressor.py
+++ b/agent/context_compressor.py
@@ -210,6 +210,20 @@ _TRUNCATED_SUMMARY_MARKER = "finish_reason=length"
 def _is_summary_access_or_quota_error(exc: Exception) -> bool:
     """Return True for non-retryable summary auth, permission, or quota errors."""
 
+    # A credential read that failed closed because no profile secret scope
+    # was active (multiplexed gateway, worker thread without the caller's
+    # ContextVars) is a missing-credential failure of our own making: the
+    # summary model cannot be reached until the spawn site is fixed, and a
+    # placeholder summary would only destroy the middle window for nothing.
+    # Classify it with the credential class so compress() preserves the
+    # session unchanged (#100849 bundle: every hygiene pass truncated).
+    try:
+        from agent.secret_scope import UnscopedSecretError
+    except Exception:  # pragma: no cover - import guard
+        UnscopedSecretError = ()  # type: ignore[assignment]
+    if UnscopedSecretError and isinstance(exc, UnscopedSecretError):
+        return True
+
     classified = classify_api_error(exc)
     if classified.reason is FailoverReason.rate_limit:
         return False
@@ -2172,7 +2186,7 @@ def _summarize_tool_result_unguarded(tool_name: str, tool_args: str, tool_conten
         target = args.get("target", "?")
         return f"[memory] {action} on {target}"
 
-    if tool_name == "todo":
+    if tool_name == "todo_list":
         return "[todo] updated task list"
 
     if tool_name == "clarify":
@@ -2225,11 +2239,11 @@ def _summarize_tool_result_unguarded(tool_name: str, tool_args: str, tool_conten
     if tool_name == "text_to_speech":
         return f"[text_to_speech] generated audio ({content_len:,} chars)"
 
-    if tool_name == "cronjob":
+    if tool_name == "cronjob_manage":
         action = args.get("action", "?")
         return f"[cronjob] {action}"
 
-    if tool_name == "process":
+    if tool_name == "process_manage":
         action = args.get("action", "?")
         sid = args.get("session_id", "?")
         return f"[process] {action} session={sid}"
@@ -2642,6 +2656,7 @@ class ContextCompressor(ContextEngine):
         self.get_active_compression_failure_cooldown()
         self._load_fallback_compression_streak()
         self._load_ineffective_compression_count()
+        self._load_anti_thrash_recovery_deadline()
         self._load_proactive_prune_rearm_tokens()
 
     def on_session_start(self, session_id: str, **kwargs) -> None:
@@ -2807,6 +2822,45 @@ class ContextCompressor(ContextEngine):
         except Exception as exc:
             logger.debug("compression ineffective count persist failed (non-sqlite): %s", exc)
 
+    def _load_anti_thrash_recovery_deadline(self) -> None:
+        """Restore the durable recovery deadline (wall-clock epoch, #100185).
+
+        Missing/absent storage leaves the in-memory clock disarmed, so the
+        next blocked evaluation arms a full fresh window (#54923).
+        """
+        session_db = getattr(self, "_session_db", None)
+        session_id = getattr(self, "_session_id", "")
+        getter = getattr(session_db, "get_compression_recovery_deadline", None)
+        if not session_id or not callable(getter):
+            return
+        try:
+            stored = getter(session_id)
+            self._anti_thrash_recovery_deadline = max(
+                0.0,
+                float(stored) if isinstance(stored, (int, float, str)) else 0.0,
+            )
+        except (TypeError, ValueError, sqlite3.Error) as exc:
+            logger.debug("compression recovery deadline lookup failed: %s", exc)
+        except Exception as exc:
+            logger.debug("compression recovery deadline lookup failed (non-sqlite): %s", exc)
+
+    def _set_anti_thrash_recovery_deadline(self, deadline: float) -> None:
+        """Set the recovery deadline, persisting on change only (0 = disarmed)."""
+        if deadline == self._anti_thrash_recovery_deadline:
+            return
+        self._anti_thrash_recovery_deadline = deadline
+        session_db = getattr(self, "_session_db", None)
+        session_id = getattr(self, "_session_id", "")
+        setter = getattr(session_db, "set_compression_recovery_deadline", None)
+        if not session_id or not callable(setter):
+            return
+        try:
+            setter(session_id, deadline)
+        except sqlite3.Error as exc:
+            logger.debug("compression recovery deadline persist failed: %s", exc)
+        except Exception as exc:
+            logger.debug("compression recovery deadline persist failed (non-sqlite): %s", exc)
+
     def _record_ineffective_compression_verdict(self, count: int) -> None:
         """Set the anti-thrash strike counter, keeping the durable copy in sync.
 
@@ -3900,9 +3954,17 @@ class ContextCompressor(ContextEngine):
         except Exception as exc:
             logger.debug("compression ineffective-count refresh failed: %s", exc)
 
-    def _automatic_compression_blocked(self) -> bool:
-        """Return whether automatic compaction is in cooldown or tripped."""
-        if not self._automatic_compression_blocked_locally():
+    def _automatic_compression_blocked(self, *, ignore_cooldown: bool = False) -> bool:
+        """Return whether automatic compaction is in cooldown or tripped.
+
+        ``ignore_cooldown=True`` evaluates only the breakers that are NOT the
+        summary-failure cooldown. Used by provider-proven overflow recovery
+        (#100661): the provider already rejected the request, so waiting out
+        the cooldown just wedges the session — every turn defers and the next
+        failure extends the ladder. The overflow path gets one real attempt;
+        the ineffective/structural breakers still apply.
+        """
+        if not self._automatic_compression_blocked_locally(ignore_cooldown=ignore_cooldown):
             return False
         # Blocked on the in-memory snapshot. Durable guard rows may have
         # been cleared by another agent since bind_session_state() — a
@@ -3912,9 +3974,9 @@ class ContextCompressor(ContextEngine):
         # local block outlive the durable state that justified it. The
         # unblocked hot path above never pays for the DB reads.
         self._refresh_durable_guards()
-        return self._automatic_compression_blocked_locally()
+        return self._automatic_compression_blocked_locally(ignore_cooldown=ignore_cooldown)
 
-    def _automatic_compression_blocked_locally(self) -> bool:
+    def _automatic_compression_blocked_locally(self, *, ignore_cooldown: bool = False) -> bool:
         """Evaluate the automatic-compaction gate on in-memory state only."""
         # Do not trigger compression while the summary LLM is in cooldown.
         # On a 429/transient failure _generate_summary() sets a cooldown and
@@ -3926,7 +3988,7 @@ class ContextCompressor(ContextEngine):
         # force=True, which clears this cooldown in compress() before running,
         # so it still retries immediately.
         _cooldown_remaining = self._summary_failure_cooldown_until - time.monotonic()
-        if _cooldown_remaining > 0:
+        if _cooldown_remaining > 0 and not ignore_cooldown:
             if not self.quiet_mode:
                 logger.debug(
                     "Compression deferred — summary LLM in cooldown for %.0fs more",
@@ -3964,21 +4026,34 @@ class ContextCompressor(ContextEngine):
         # the worst case in the truly-incompressible state is one compaction
         # attempt per recovery window — bounded, not thrash.
         #
-        # The clock is armed lazily on the first BLOCKED evaluation rather
-        # than persisted at trip time: a fresh process that loads a durable
-        # tripped counter (#69872) therefore starts a full window blocked,
-        # preserving the restart-must-not-disarm contract (#54923).
+        # The clock is armed lazily on the first BLOCKED evaluation and
+        # persisted on the session row (#100185): a fresh process/compressor
+        # that loads a durable tripped counter (#69872) with no stored
+        # deadline starts a full window blocked, preserving the
+        # restart-must-not-disarm contract (#54923) — but one that loads an
+        # already-armed deadline resumes that window instead of restarting it.
         if (
             self._ineffective_compression_count >= 2
             or self._fallback_compression_streak >= 2
         ):
-            _now = time.monotonic()
-            if self._anti_thrash_recovery_deadline <= 0.0:
-                self._anti_thrash_recovery_deadline = (
+            # Wall clock, not monotonic: the deadline is persisted on the
+            # session row (#100185) so a fresh compressor bound to the same
+            # session — the gateway rebuilds the AIAgent on every cache
+            # eviction — resumes the SAME window instead of restarting it.
+            # Without that, a blocked messaging session never earned its
+            # probe and stayed blocked forever.
+            _now = time.time()
+            if self._anti_thrash_recovery_deadline <= 0.0 or (
+                # Clock jumped backwards past a full window: never wait
+                # longer than one window from now.
+                self._anti_thrash_recovery_deadline - _now
+                > self._ANTI_THRASH_RECOVERY_SECONDS
+            ):
+                self._set_anti_thrash_recovery_deadline(
                     _now + self._ANTI_THRASH_RECOVERY_SECONDS
                 )
             elif _now >= self._anti_thrash_recovery_deadline:
-                self._anti_thrash_recovery_deadline = 0.0
+                self._set_anti_thrash_recovery_deadline(0.0)
                 if self._ineffective_compression_count >= 2:
                     self._record_ineffective_compression_verdict(1)
                 if self._fallback_compression_streak >= 2:
@@ -4009,7 +4084,7 @@ class ContextCompressor(ContextEngine):
         # Guard not tripped (counters were cleared by an effective compaction
         # or a fitting real-usage reading) — disarm any pending recovery clock
         # so a LATER trip starts its own full window.
-        self._anti_thrash_recovery_deadline = 0.0
+        self._set_anti_thrash_recovery_deadline(0.0)
         return False
 
     # ------------------------------------------------------------------
@@ -4946,6 +5021,7 @@ Summary generation was unavailable, so this is a best-effort deterministic fallb
         turns_to_summarize: List[Dict[str, Any]],
         focus_topic: Optional[str] = None,
         memory_context: str = "",
+        bypass_cooldown: bool = False,
     ) -> Optional[str]:
         """Generate a structured summary of conversation turns.
 
@@ -4968,7 +5044,10 @@ Summary generation was unavailable, so this is a best-effort deterministic fallb
         if self._compression_cancelled():
             raise AuxiliaryExplicitCancellation()
         now = prompt_started_at
-        if now < self._summary_failure_cooldown_until:
+        # bypass_cooldown (#100661): provider-proven overflow gets ONE real
+        # summary attempt while the cooldown is armed; a failure below still
+        # records/extends the cooldown normally.
+        if now < self._summary_failure_cooldown_until and not bypass_cooldown:
             logger.debug(
                 "Skipping context summary during cooldown (%.0fs remaining)",
                 self._summary_failure_cooldown_until - now,
@@ -7662,6 +7741,7 @@ This compaction should PRIORITISE preserving all information related to the focu
         focus_topic: Optional[str] = None,
         force: bool = False,
         memory_context: str = "",
+        bypass_cooldown: bool = False,
     ) -> List[Dict[str, Any]]:
         """Compress conversation messages by summarizing middle turns.
 
@@ -7698,6 +7778,10 @@ This compaction should PRIORITISE preserving all information related to the focu
                 summary path.  Auto-compress callers pass False.
             memory_context: Optional provider-supplied context to preserve in
                 the summary prompt. Whitespace-only values are ignored.
+            bypass_cooldown: If True, run the summary LLM even while the
+                summary-failure cooldown is armed, WITHOUT clearing it
+                (#100661). Set by provider-proven overflow recovery, which
+                is already bounded by the caller's attempt budget.
         """
         # Reset per-call summary failure state — callers inspect these fields
         # after compress() returns to decide whether to surface a warning.
@@ -8035,6 +8119,7 @@ This compaction should PRIORITISE preserving all information related to the focu
                     turns_to_summarize,
                     focus_topic=summary_focus_topic,
                     memory_context=memory_context,
+                    bypass_cooldown=bypass_cooldown,
                 )
             except AuxiliaryExplicitCancellation:
                 # Explicit cancellation is a true no-op. Restore state mutated by
diff --git a/agent/conversation_compression.py b/agent/conversation_compression.py
index a4ab72f9c0..b0b12f7259 100644
--- a/agent/conversation_compression.py
+++ b/agent/conversation_compression.py
@@ -718,6 +718,17 @@ class CompressionCommitFence:
         self._progress_observed = False
         self._deadline: float | None = None
         self._retain_cancelled_lock_until_worker_done = False
+        # #97963: set by the worker (mark_commit_watermark_fenced) once its
+        # commit path is watermark-fenced — i.e. it captured the session's
+        # active-row watermark at compression start, so any row appended
+        # AFTER that point survives a late commit verbatim as concurrent
+        # tail (archive_and_compact / publish_compression_child clone rows
+        # above the watermark instead of archiving them). Hosts read this
+        # at the turn-hold boundary to decide whether a detached worker may
+        # KEEP its commit admission (safe: newer turns cannot be clobbered)
+        # or must be cancelled as before (unfenced commit; discard is the
+        # only safe outcome). Plain bool store — atomic in CPython.
+        self._commit_watermark_fenced = False
         if total_ceiling_seconds is not None:
             self.set_total_ceiling_seconds(total_ceiling_seconds)
 
@@ -748,6 +759,20 @@ class CompressionCommitFence:
         deadline = self._deadline
         return deadline is not None and time.monotonic() >= deadline
 
+    @property
+    def deadline_monotonic(self) -> float | None:
+        """The armed deadline as an absolute ``time.monotonic()`` instant.
+
+        :meth:`set_total_ceiling_seconds` documents this deadline as "shared by
+        the host and worker", but until #99692 only the host could read it —
+        ``deadline_exceeded`` answers "is it past?" for a caller that is already
+        polling, which is useless to a worker blocked inside a provider stream.
+        Publishing the instant itself lets the worker's stream consumer stop at
+        exactly the moment the host stops waiting (see
+        ``auxiliary_client.aux_stream_deadline``).
+        """
+        return self._deadline
+
     def seconds_since_progress(self) -> float:
         """Seconds since the worker last reported forward progress."""
         return max(0.0, time.monotonic() - self._last_progress)
@@ -843,6 +868,24 @@ class CompressionCommitFence:
         """Prevent a timed-out live worker from overlapping a retry."""
         self._retain_cancelled_lock_until_worker_done = True
 
+    def mark_commit_watermark_fenced(self) -> None:
+        """Record that this attempt's commit is bounded by a start watermark.
+
+        Called by the compression worker right after it captures
+        ``get_active_message_watermark()`` under the durable compression
+        lock (#75316/#87484). A watermark-fenced commit archives ONLY rows
+        at or below the watermark; rows appended later — e.g. the user turn
+        the host released at the turn-hold boundary (#97963) — are cloned
+        as live concurrent tail. That is exactly the property a host needs
+        before letting a detached worker keep its commit admission.
+        """
+        self._commit_watermark_fenced = True
+
+    @property
+    def commit_watermark_fenced(self) -> bool:
+        """Lock-free read: the worker's commit is watermark-bounded."""
+        return self._commit_watermark_fenced
+
     def allow_cancelled_lock_release(self) -> None:
         """Undo :meth:`retain_compression_lock_until_worker_done`.
 
@@ -1969,6 +2012,25 @@ def context_compression_timed_out(agent: Any) -> bool:
     return getattr(agent, "_last_compression_timed_out", None) is True
 
 
+def _automatic_gate_blocked(
+    blocked: Any, compressor: Any, bypass_cooldown: bool
+) -> bool:
+    """Evaluate the automatic breaker gate, optionally ignoring the cooldown.
+
+    Provider-proven overflow recovery (#100661) passes ``bypass_cooldown``;
+    engines whose gate predates the kwarg (plugins, test doubles) are called
+    with the legacy no-argument shape.
+    """
+    if bypass_cooldown:
+        try:
+            accepts = "ignore_cooldown" in inspect.signature(blocked).parameters
+        except (TypeError, ValueError):
+            accepts = False
+        if accepts:
+            return bool(blocked(compressor, ignore_cooldown=True))
+    return bool(blocked(compressor))
+
+
 def compression_blocked_transiently(agent: Any) -> bool:
     """Type-pinned read of the transient-block signal (#97488).
 
@@ -2205,6 +2267,7 @@ def _supported_compression_kwargs(
     focus_topic: Optional[str],
     force: bool,
     memory_context: str,
+    bypass_cooldown: bool = False,
 ) -> dict:
     """Return only compression kwargs accepted by an engine callable.
 
@@ -2218,6 +2281,8 @@ def _supported_compression_kwargs(
         "focus_topic": focus_topic,
         "force": force,
     }
+    if bypass_cooldown:
+        candidates["bypass_cooldown"] = True
     if memory_context:
         candidates["memory_context"] = memory_context
     try:
@@ -2826,6 +2891,79 @@ def _is_real_user_message(message: Any) -> bool:
     return not ContextCompressor._is_synthetic_compression_user_turn(message)
 
 
+def _message_contains_busy_steer(message: Any) -> bool:
+    """Return whether *message* carries a busy-steer marker.
+
+    With ``display.busy_input_mode: steer`` the follow-up is embedded as an
+    out-of-band marker inside a ``role=tool`` result (see
+    ``agent_runtime_helpers.apply_pending_steer_to_tool_results``). That marker
+    carries real user intent but lives outside ``role=user``, so the
+    ``_is_real_user_message`` / ``_transcript_has_real_user_turn`` checks
+    alone would miss it.
+    """
+    text = _message_text(message)
+    if not text:
+        return False
+    try:
+        from agent.prompt_builder import STEER_MARKER_CLOSE, STEER_MARKER_OPEN
+
+        return STEER_MARKER_OPEN in text and STEER_MARKER_CLOSE in text
+    except Exception:
+        return "[OUT-OF-BAND USER MESSAGE" in text and "[/OUT-OF-BAND USER MESSAGE]" in text
+
+
+def _extract_steer_text_from_message(message: Any) -> Optional[str]:
+    """Extract the inner user text from a steer marker, or None."""
+    text = _message_text(message)
+    if not text:
+        return None
+    try:
+        from agent.prompt_builder import STEER_MARKER_CLOSE, STEER_MARKER_OPEN
+
+        open_marker = STEER_MARKER_OPEN
+        close_marker = STEER_MARKER_CLOSE
+    except Exception:
+        open_marker = "[OUT-OF-BAND USER MESSAGE"
+        close_marker = "[/OUT-OF-BAND USER MESSAGE]"
+    start = text.find(open_marker)
+    if start == -1:
+        # Fallback: marker wording may evolve; look for the stable prefix.
+        fallback_open = "[OUT-OF-BAND USER MESSAGE"
+        start = text.find(fallback_open)
+        if start == -1:
+            return None
+        # Skip to end of the opening line.
+        nl = text.find("\n", start)
+        if nl != -1:
+            start = nl + 1
+        else:
+            start += len(fallback_open)
+    else:
+        start += len(open_marker)
+    end = text.find(close_marker, start)
+    if end == -1:
+        end = text.find("[/OUT-OF-BAND USER MESSAGE]", start)
+        if end == -1:
+            return None
+    extracted = text[start:end].strip()
+    return extracted if extracted else None
+
+
+def _compressed_has_busy_steer(messages: list) -> bool:
+    """Whether *messages* already carries a steer marker (intent present).
+
+    Only ``role=tool`` rows count: that is the sole place the runtime ever
+    delivers a steer, so a compaction summary that merely quotes the marker
+    text must not be mistaken for live intent.
+    """
+    for msg in messages:
+        if not isinstance(msg, dict) or msg.get("role") != "tool":
+            continue
+        if _message_contains_busy_steer(msg):
+            return True
+    return False
+
+
 def _strip_stale_todo_snapshot(content: Any) -> Any:
     """Remove a previously merged todo-snapshot block from message content.
 
@@ -3028,17 +3166,34 @@ def _ensure_compressed_has_user_turn(
     """Preserve human intent, not merely a synthetic user-role placeholder."""
     if any(_is_real_user_message(message) for message in compressed):
         return "already_present"
+    if _compressed_has_busy_steer(compressed):
+        return "already_present"
     from agent.context_compressor import (
         COMPRESSION_CONTINUATION_USER_CONTENT,
         _fresh_compaction_message_copy,
     )
 
+    # One reversed positional scan: the anchor is whichever intent-bearing
+    # row is LAST in the original transcript — a real ``role=user`` turn or
+    # a steer marker riding inside a ``role=tool`` result. Scanning the two
+    # kinds separately (steer first, then user) would let an older, already
+    # consumed steer outrank a newer real user request and replay it
+    # (#100053 follow-up: ``[user A, tool(steer B), ..., user C]`` must
+    # anchor C, not B).
     for message in reversed(original_messages):
         if _is_real_user_message(message):
             return _insert_real_user_anchor(
                 compressed,
                 _fresh_compaction_message_copy(message),
             )
+        if not isinstance(message, dict) or message.get("role") != "tool":
+            continue
+        steer_text = _extract_steer_text_from_message(message)
+        if steer_text:
+            return _insert_real_user_anchor(
+                compressed,
+                {"role": "user", "content": steer_text},
+            )
     from agent.message_metadata import append_message
 
     append_message(
@@ -3156,6 +3311,7 @@ def compress_context(
     task_id: str = "default",
     focus_topic: Optional[str] = None,
     force: bool = False,
+    bypass_cooldown: bool = False,
     defer_context_engine_notification: bool = False,
     commit_fence: Optional[CompressionCommitFence] = None,
 ) -> Tuple[list, str]:
@@ -3175,6 +3331,13 @@ def compress_context(
             by the manual ``/compress`` slash command so users can retry
             immediately after an auto-compress abort.  Auto-compress
             callers use the default ``False``.
+        bypass_cooldown: If True, the automatic breaker gates ignore ONLY the
+            summary-failure cooldown for this attempt (#100661). Set by the
+            provider-proven overflow recovery path: the provider already
+            rejected the request, so deferring until the cooldown lapses
+            wedges the session. Unlike ``force`` it does not clear the
+            cooldown, and the ineffective/structural breakers still apply;
+            a failed attempt records its cooldown normally.
         defer_context_engine_notification: Delay the existing context-engine
             hook until a manual host commits its outer history transaction.
         commit_fence: Optional cooperative fence for executor callers that
@@ -3292,7 +3455,9 @@ def compress_context(
             "_automatic_compression_blocked",
             None,
         )
-        if callable(blocked) and blocked(agent.context_compressor):
+        if callable(blocked) and _automatic_gate_blocked(
+            blocked, agent.context_compressor, bypass_cooldown
+        ):
             _mark_compression_blocked_transient(agent, agent.context_compressor)
             existing_prompt = getattr(agent, "_cached_system_prompt", None)
             if not existing_prompt:
@@ -3516,6 +3681,18 @@ def compress_context(
                         _commit_watermark = _lock_db.get_active_message_watermark(
                             _lock_sid
                         )
+                        # #97963: a captured watermark makes the eventual
+                        # commit safe against rows appended after this
+                        # point (they survive as cloned concurrent tail on
+                        # BOTH commit paths — archive_and_compact and
+                        # publish_compression_child). Tell the fence so a
+                        # host at the turn-hold boundary can keep this
+                        # attempt's commit admission instead of burning it.
+                        if commit_fence is not None:
+                            try:
+                                commit_fence.mark_commit_watermark_fenced()
+                            except AttributeError:
+                                pass  # test doubles without the method
                     except Exception as _wm_err:
                         # Watermark capture is safety-additive: without it the
                         # commit falls back to archive-everything (historical
@@ -3751,7 +3928,9 @@ def compress_context(
             "_automatic_compression_blocked",
             None,
         )
-        if callable(blocked) and blocked(compressor):
+        if callable(blocked) and _automatic_gate_blocked(
+            blocked, compressor, bypass_cooldown
+        ):
             _mark_compression_blocked_transient(agent, compressor)
             _release_lock()
             existing_prompt = getattr(agent, "_cached_system_prompt", None)
@@ -3948,6 +4127,7 @@ def compress_context(
             focus_topic=focus_topic,
             force=force,
             memory_context=memory_context,
+            bypass_cooldown=bypass_cooldown,
         )
         if memory_context.strip() and "memory_context" not in compress_kwargs:
             engine_name = getattr(
@@ -3992,11 +4172,28 @@ def compress_context(
         from agent.auxiliary_client import (
             aux_interrupt_protection,
             aux_progress_hook,
+            aux_stream_deadline,
         )
         _progress_hook = (
             commit_fence.touch_progress if commit_fence is not None
             else (lambda: None)
         )
+        # #99692: the progress hook above is the worker -> host leg; this is the
+        # return leg. _compression_cancel_requested (below) releases the compression
+        # OWNER when the host gives up, but the isolated provider daemon that
+        # actually holds the socket keeps streaming to its own budget —
+        # ``_aux_stream_total_ceiling`` = max(600, 4 * aux_timeout), which is >=
+        # the host's total ceiling for every configured timeout and starts
+        # counting later (after admission, serialization, prompt build and TTFT).
+        # With ``auxiliary.compression.timeout: 600`` that is 2400s of an
+        # orphaned 500K-token summary the commit fence is already guaranteed to
+        # refuse: paid tokens, a pinned HTTP connection, and — since every new
+        # turn re-triggers compression on a session that never shrank — a fresh
+        # orphan stacked on top of the last one. Sharing the host's absolute
+        # deadline makes the stream stop when the host it serves stops waiting.
+        _host_stream_deadline = (
+            commit_fence.deadline_monotonic if commit_fence is not None else None
+        )
         # F4 state-ordering (#76354): a LATE successful summary must not undo
         # the timeout cooldown the host recorded. Install a cancellation
         # check the compressor consults BEFORE clearing the failure cooldown;
@@ -4042,7 +4239,9 @@ def compress_context(
                 )
                 compressed = messages
             else:
-                with aux_progress_hook(_progress_hook), aux_interrupt_protection(
+                with aux_progress_hook(_progress_hook), aux_stream_deadline(
+                    _host_stream_deadline
+                ), aux_interrupt_protection(
                     cancel_check=_compression_cancel_requested
                 ):
                     compressed = compress_fn(messages, **compress_kwargs)
@@ -5355,6 +5554,7 @@ def compress_context(
         # the next response with usage re-anchors (its structural id/index
         # check would also fail closed, but explicit is safer).
         agent._usage_anchor = None
+        agent._turn_base_usage_anchor = None
         # Arm the effectiveness verdict only after a completed rewrite crosses
         # the full compaction boundary. Exceptions, aborts, and no-op attempts
         # leave this false, so unrelated later usage cannot be charged to an
diff --git a/agent/conversation_loop.py b/agent/conversation_loop.py
index b0946d276b..76d944a961 100644
--- a/agent/conversation_loop.py
+++ b/agent/conversation_loop.py
@@ -41,6 +41,7 @@ from agent.conversation_compression import (
 from agent.context_engine import automatic_compaction_status_message
 from agent.display import KawaiiSpinner
 from agent.error_classifier import FailoverReason, classify_api_error
+from agent.fast_mode import begin_turn as begin_fast_mode_turn
 from agent.message_metadata import append_message
 from agent.turn_context import (
     PreflightCompressionTimedOut,
@@ -652,6 +653,40 @@ def _ollama_context_limit_error(agent: Any, request_tokens: int) -> Optional[str
     )
 
 
+def _maybe_grow_local_window(agent: Any, compressor: Any,
+                             request_tokens: int) -> Optional[int]:
+    """Try growing the managed local model's context window before
+    compressing. Returns the new window when the ladder granted one, else
+    None (hold / at native / not a managed local session).
+
+    The window ladder's design order: models launch at their zero-spill
+    window and grow toward native max as the session needs room;
+    compression is the move of last resort. Cheap for every non-local
+    provider: one lowercase compare, no imports.
+    """
+    provider = (getattr(agent, "provider", "") or "").strip().lower()
+    if provider not in ("llamacpp", "llama.cpp", "llama-cpp", "custom"):
+        return None
+    base_url = getattr(agent, "base_url", "") or ""
+    if "127.0.0.1" not in base_url and "localhost" not in base_url:
+        return None
+    try:
+        from hermes_cli.local_runtime.growth import maybe_grow_window
+
+        current_window = int(getattr(compressor, "context_length", 0) or 0)
+        if current_window <= 0:
+            return None
+        return maybe_grow_window(
+            getattr(agent, "model", "") or "",
+            base_url=base_url,
+            session_tokens=int(request_tokens),
+            current_window=current_window,
+        )
+    except Exception as exc:  # noqa: BLE001 — growth must never break a turn
+        logger.debug("local window growth check failed: %s", exc)
+        return None
+
+
 def _ra():
     """Lazy reference to ``run_agent`` so callers can patch
     ``run_agent.handle_function_call`` / ``run_agent._set_interrupt`` /
@@ -954,6 +989,7 @@ def _restore_or_build_system_prompt(agent, system_message, conversation_history)
     """
     stored_prompt = None
     stored_state = "missing"
+    session_row = None
     if conversation_history and agent._session_db:
         try:
             session_row = agent._session_db.get_session(agent.session_id)
@@ -1056,6 +1092,17 @@ def _restore_or_build_system_prompt(agent, system_message, conversation_history)
         # Continuing session — reuse the exact system prompt from the
         # previous turn so the Anthropic cache prefix matches.
         agent._cached_system_prompt = stored_prompt
+        # Same contract for tools[]: a fresh AIAgent for an existing session
+        # (gateway agent-cache eviction) re-probed every check_fn, so pin the
+        # array back to the order this session already sent (tools freeze).
+        try:
+            saved_tools = session_row.get("tool_names") if session_row else None
+            if saved_tools:
+                from tools.mcp_tool import restore_agent_tool_prefix
+
+                restore_agent_tool_prefix(agent, json.loads(saved_tools))
+        except Exception:
+            logger.debug("tool prefix restore skipped", exc_info=True)
         # Prompt-section callbacks are new-session-only. Recover their frozen
         # bytes from the persisted full prompt so a later compression rebuild
         # keeps them without evaluating plugin state in this resumed process.
@@ -1138,6 +1185,9 @@ def _restore_or_build_system_prompt(agent, system_message, conversation_history)
     if agent._session_db:
         try:
             agent._session_db.update_system_prompt(agent.session_id, agent._cached_system_prompt)
+            from tools.mcp_tool import persist_agent_tool_names
+
+            persist_agent_tool_names(agent)
         except Exception as exc:
             logger.warning(
                 "Session DB update_system_prompt failed for session %s: "
@@ -1590,6 +1640,41 @@ def _compression_deferred_result(
     }
 
 
+def _provider_overflow_exhausted_result(
+    agent,
+    messages: List[Dict],
+    conversation_history,
+    api_call_count: int,
+    request_pressure_tokens: int,
+    max_compression_attempts: int,
+) -> Dict[str, Any]:
+    """Fail closed when a rebuilt request is still too large after recovery."""
+    agent._flush_status_buffer()
+    logger.error(
+        "%sContext compression failed after %d attempts; rebuilt request "
+        "remains over threshold at ~%s tokens.",
+        agent.log_prefix,
+        max_compression_attempts,
+        f"{request_pressure_tokens:,}",
+    )
+    agent._persist_session(messages, conversation_history)
+    final_response = (
+        "Context length exceeded: compression could not reduce the rebuilt "
+        "request below the safe threshold."
+    )
+    return {
+        "final_response": final_response,
+        "messages": messages,
+        "completed": False,
+        "api_calls": api_call_count,
+        "error": final_response,
+        "partial": True,
+        "failed": True,
+        "compression_exhausted": True,
+        "turn_exit_reason": "context_compression_exhausted",
+    }
+
+
 def _rewrite_system_content_blocks(system_message: dict, effective: str) -> bool:
     """Rewrite a cache-decorated system message in place, keeping its blocks.
 
@@ -1973,6 +2058,7 @@ def run_conversation(
     agent._last_compaction_in_place = False
     agent._last_compression_attempt_recorded = False
     agent._last_compression_attempt_in_place = None
+    begin_fast_mode_turn(agent, conversation_history)
 
     # Adopt any ~/.hermes/.env credential/base-url edits made since the last
     # turn — a Settings save updates .env but not this worker's client, which
@@ -2091,6 +2177,12 @@ def run_conversation(
     failed = False
     codex_ack_continuations = 0
     length_continue_retries = 0
+    # One-shot "continue without thinking" override is turn-scoped: a
+    # thinking-only truncation arms it right before the continuation restart,
+    # and build_api_kwargs consumes it on that call. If the turn is
+    # interrupted/errors between arm and consume, it must not fire on the
+    # next turn's first request.
+    agent._ephemeral_reasoning_off = False
     # Total outer-loop exceptions this turn (#92450) — see _MAX_OUTER_LOOP_ERRORS.
     _outer_error_count = 0
     truncated_tool_call_retries = 0
@@ -2108,6 +2200,13 @@ def run_conversation(
     max_compression_attempts = getattr(agent, "max_compression_attempts", 3)
     _last_preflight_pressure: Optional[int] = None
     _preflight_compression_blocked = _ctx.preflight_compression_blocked
+    # A provider overflow is stronger evidence than the rough-estimate
+    # calibration that normally defers preflight immediately after compaction.
+    # Keep recovery armed until the rebuilt, complete request is below the
+    # configured compression threshold. Without this handoff, a compaction
+    # that drops rows but grows the actual prompt can be sent straight back to
+    # the provider while awaiting_real_usage_after_compression is true.
+    _provider_overflow_recovery_pending = False
     # Armed when a compression host-timeout terminates the turn (#98722,
     # salvaged from #98741); finalize below reuses the gateway's existing
     # context-recovery contract (error/partial/compression_exhausted).
@@ -2832,6 +2931,21 @@ def run_conversation(
         _preflight_threshold = int(
             getattr(_compressor, "threshold_tokens", 0) or 0
         )
+        _provider_overflow_preflight = (
+            _provider_overflow_recovery_pending
+            and (
+                _preflight_threshold <= 0
+                or request_pressure_tokens >= _preflight_threshold
+            )
+        )
+        if (
+            _provider_overflow_recovery_pending
+            and not _provider_overflow_preflight
+        ):
+            # The outer-loop rebuild includes the active system prompt,
+            # request-only injections, and tool schemas. Once that complete
+            # request has real output runway again, the provider may be tried.
+            _provider_overflow_recovery_pending = False
         # A previous mid-turn preflight pass deliberately continued the loop so
         # API-only context and all sanitization could be rebuilt. Compare that
         # fully assembled request with the fully assembled request that caused
@@ -2871,11 +2985,50 @@ def run_conversation(
             and not _review_fork_first_request_pending(agent)
             and len(messages) > 1
             and compression_attempts < max_compression_attempts
-            and not _preflight_compression_blocked
-            and not _defer_preflight(request_pressure_tokens)
+            and (
+                not _preflight_compression_blocked
+                or _provider_overflow_preflight
+            )
+            and (
+                not _defer_preflight(request_pressure_tokens)
+                or _provider_overflow_preflight
+            )
             and not _compression_cooldown
             and _compressor.should_compress(request_pressure_tokens)
         ):
+            # Managed local runtime: try GROWING the context window before
+            # compressing (the window ladder's design order — compression is
+            # the move of last resort, once the window is at the model's
+            # native max or physics/speed say stop). Only fires for a
+            # llamacpp-flavored provider whose base_url is the server this
+            # process supervises; every other provider falls straight
+            # through to compression, exactly as before.
+            _grown_window = _maybe_grow_local_window(
+                agent, _compressor, request_pressure_tokens
+            )
+            if _grown_window:
+                # The server now grants a bigger window: recalibrate the
+                # compressor to it and skip compression this pass — the
+                # request that was over the OLD threshold fits the new one.
+                _compressor.update_model(
+                    agent.model,
+                    _grown_window,
+                    base_url=getattr(agent, "base_url", "") or "",
+                    api_key=getattr(agent, "api_key", "") or "",
+                    provider=getattr(agent, "provider", "") or "",
+                    api_mode=getattr(agent, "api_mode", "") or "",
+                )
+                agent._buffer_status(
+                    f"📈 Context window grown to {_grown_window // 1024}K "
+                    f"(local model; conversation continues uncompressed)"
+                )
+                # This preflight iteration never reached the provider —
+                # refund the consumed call/budget exactly as the compression
+                # path below does before ITS continue.
+                api_call_count -= 1
+                agent._api_call_count = api_call_count
+                agent.iteration_budget.refund()
+                continue
             if _moa_prepared_request is not None:
                 pending_moa_prepared_request = _moa_prepared_request
             compression_attempts += 1
@@ -3006,6 +3159,34 @@ def run_conversation(
                     _turn_exit_reason = "compaction_handoff_not_actionable"
                     break
                 continue
+        elif _provider_overflow_preflight and _compression_cooldown:
+            # The provider already proved this request cannot fit, while the
+            # compressor is temporarily unavailable. Do not send the known-
+            # oversized request again; let the next user turn retry after the
+            # cooldown instead of turning this into compression exhaustion.
+            agent._persist_session(messages, conversation_history)
+            return _compression_deferred_result(
+                agent,
+                messages,
+                api_call_count,
+                reason="transient_block",
+            )
+        elif (
+            _provider_overflow_preflight
+            and compression_attempts >= max_compression_attempts
+        ):
+            # Every bounded recovery pass has been consumed and the rebuilt
+            # request is still over threshold. Fail closed before another
+            # provider call; llama.cpp can silently truncate an oversized
+            # retry instead of returning a second actionable overflow error.
+            return _provider_overflow_exhausted_result(
+                agent,
+                messages,
+                conversation_history,
+                api_call_count,
+                request_pressure_tokens,
+                max_compression_attempts,
+            )
         elif (
             agent.compression_enabled
             and len(messages) > 1
@@ -3060,6 +3241,20 @@ def run_conversation(
                 if callable(_warn_fn):
                     _warn_fn(request_pressure_tokens, _ctx_len)
 
+        if _provider_overflow_preflight:
+            # Any other gate that prevented the forced preflight (for example,
+            # an uncompressible one-message request) must also fail closed.
+            # Falling through would send a request that the provider already
+            # proved cannot fit.
+            return _provider_overflow_exhausted_result(
+                agent,
+                messages,
+                conversation_history,
+                api_call_count,
+                request_pressure_tokens,
+                max_compression_attempts,
+            )
+
         # Thinking spinner for quiet mode (animated during API call)
         thinking_spinner = None
         
@@ -3991,7 +4186,7 @@ def run_conversation(
                             "The model used all its output tokens on reasoning "
                             "and had none left for the actual response.\n\n"
                             "To fix this:\n"
-                            "→ Lower reasoning effort: `/thinkon low` or `/thinkon minimal`\n"
+                            "→ Lower reasoning effort: `/reasoning low` or `/reasoning minimal`\n"
                             "→ Or switch to a larger/non-reasoning model with `/model`"
                         )
                         agent._cleanup_task_resources(effective_task_id)
@@ -4118,29 +4313,46 @@ def run_conversation(
                             )
                         if assistant_message is not None and not _trunc_has_tool_calls:
                             length_continue_retries += 1
-                            # An EMPTY partial-stream stub (stream dropped
-                            # mid tool-call before any text was delivered)
-                            # must not be appended as an interim assistant
-                            # message: it would serialize as
-                            # {"role": "assistant", "content": ""}, and
+                            # An interim assistant message with NO visible
+                            # content must not be appended — whichever way it
+                            # got that way.  An empty partial-stream stub
+                            # (stream dropped before any text was delivered)
+                            # and a response whose whole output budget went to
+                            # reasoning delivered in a separate field (GLM-5.3
+                            # on ollama-cloud with reasoning_effort=high:
+                            # finish_reason="length", content="",
+                            # completion_tokens == max_tokens) both serialize
+                            # as {"role": "assistant", "content": ""}, and
                             # strict providers (Moonshot/Kimi via OpenRouter)
                             # reject empty assistant content with HTTP 400
                             # ("message ... with role 'assistant' must not be
                             # empty") on the very next replay — permanently
-                            # poisoning the session history.  There is no
-                            # partial text to continue from anyway, so only
-                            # the continuation user-message is appended.
+                            # poisoning the session history until the pre-call
+                            # sanitizer "heals" the hole (observed 3+ healings
+                            # per turn).  There is no partial text to continue
+                            # from anyway, so only the continuation
+                            # user-message is appended.
+                            _interim_content = getattr(assistant_message, "content", None)
                             _is_empty_partial_stub = (
                                 getattr(response, "id", "") == PARTIAL_STREAM_STUB_ID
-                                and not getattr(assistant_message, "content", None)
+                                and not _interim_content
                             )
-                            if not _is_empty_partial_stub:
+                            if not _interim_content and not _is_empty_partial_stub:
+                                # Thinking-only truncation: the model spent the
+                                # entire output cap on reasoning and produced no
+                                # visible text.  A continuation with thinking
+                                # ON would re-think the whole context from
+                                # scratch (continuations never replay prior
+                                # reasoning) and re-burn the same budget, so
+                                # the next call drops thinking for one request
+                                # — the answer must be written, not re-derived.
+                                agent._ephemeral_reasoning_off = True
+                            if _interim_content:
                                 interim_msg = agent._build_assistant_message(assistant_message, finish_reason)
                                 # Marked so the ceiling exit can drop the fragment trail.
                                 interim_msg["_length_continuation_fragment"] = True
                                 append_message(messages, interim_msg)
-                                if assistant_message.content:
-                                    truncated_response_parts.append(assistant_message.content)
+                                truncated_response_parts.append(_interim_content)
 
                             if length_continue_retries < 4:
                                 _is_partial_stream_stub = (
@@ -4184,13 +4396,43 @@ def run_conversation(
                                 break
 
                             partial_response = agent._strip_think_blocks(_join_truncated_parts(truncated_response_parts)).strip()
+                            # The pending one-shot reasoning-off override must
+                            # not leak into the next turn when the 4th
+                            # truncation goes straight to the ceiling exit
+                            # without scheduling a continuation call to
+                            # consume it.
+                            agent._ephemeral_reasoning_off = False
                             if partial_response:
                                 agent._vprint(
                                     f"{agent.log_prefix}⚠️  Response still truncated "
-                                    f"after 4 continuation attempts — keeping the "
+                                    f"after {length_continue_retries} continuation attempts — keeping the "
                                     f"partial response received so far.",
                                     force=True,
                                 )
+                                _ceiling_final = partial_response
+                            else:
+                                # Every fragment was empty — e.g. a thinking
+                                # model that spent each attempt's whole cap on
+                                # reasoning (GLM-5.3 on ollama-cloud).  Return
+                                # an actionable message instead of an invisible
+                                # None result, which only surfaces as a bare
+                                # error card.
+                                agent._vprint(
+                                    f"{agent.log_prefix}⚠️  Response still truncated "
+                                    f"after {length_continue_retries} continuation attempts — no visible "
+                                    f"text was produced.",
+                                    force=True,
+                                )
+                                _ceiling_final = (
+                                    "⚠️ **No visible answer was produced.** The "
+                                    "model hit its output-token limit on every "
+                                    "continuation attempt — its reasoning "
+                                    "consumed the entire budget each time.\n\n"
+                                    "To fix this:\n"
+                                    "→ Lower reasoning effort: `/reasoning low` "
+                                    "or `/reasoning none`\n"
+                                    "→ Or raise max_tokens for this model"
+                                )
                             # Unanswered continue nudges made every later turn re-truncate.
                             _turn_start = (
                                 current_turn_user_idx + 1
@@ -4218,7 +4460,7 @@ def run_conversation(
                             agent._cleanup_task_resources(effective_task_id)
                             agent._persist_session(messages, conversation_history)
                             return {
-                                "final_response": partial_response or None,
+                                "final_response": _ceiling_final,
                                 "messages": messages,
                                 "api_calls": api_call_count,
                                 "completed": False,
@@ -4419,6 +4661,20 @@ def run_conversation(
                     )
                     if _new_anchor is not None:
                         agent._usage_anchor = _new_anchor
+                        # Turn-base anchor for display surfaces: the FIRST
+                        # response of a turn carries minimal current-turn
+                        # reasoning replay, so its prompt_tokens approximate
+                        # the durable transcript cost (what the next turn
+                        # inherits). Later same-turn responses inflate
+                        # prompt_tokens with replayed thinking + tool
+                        # scaffolding that evaporates at the turn boundary —
+                        # anchoring the context meter here instead of on the
+                        # last response removes the end-of-turn sawtooth
+                        # (850K mid-loop -> 600K next turn) that users read
+                        # as a broken compaction. Display-only: compression
+                        # trigger math keeps using real last-request usage.
+                        if api_call_count == 1:
+                            agent._turn_base_usage_anchor = _new_anchor
                     _compression_threshold = int(
                         getattr(agent.context_compressor, "threshold_tokens", 0)
                         or 0
@@ -5639,6 +5895,12 @@ def run_conversation(
                                 )
                             )
                             time.sleep(2)
+                            # Same class as the generic overflow handler below:
+                            # the provider proved the request does not fit the
+                            # (now-reduced) window, and row count alone is not
+                            # proof the rebuilt request does. Recheck the
+                            # complete request before the next provider call.
+                            _provider_overflow_recovery_pending = True
                             _retry.restart_with_compressed_messages = True
                             break
                     # Fall through to normal error handling if compression
@@ -5924,6 +6186,11 @@ def run_conversation(
                         messages, system_message,
                         approx_tokens=estimate_request_tokens_rough(api_messages, tools=agent.tools or None),
                         task_id=effective_task_id,
+                        # #100661: the provider proved the request does not fit.
+                        # Ignore the summary-failure cooldown for this ONE
+                        # attempt (bounded by max_compression_attempts) instead
+                        # of deferring every turn until the ladder lapses.
+                        bypass_cooldown=True,
                     )
                     if messages is _overflow_input and compression_skipped_due_to_lock(agent):
                         # #69870 lock-skip: the provider proved the request
@@ -6100,6 +6367,7 @@ def run_conversation(
                                 messages, system_message,
                                 approx_tokens=request_input_estimate,
                                 task_id=effective_task_id,
+                                bypass_cooldown=True,  # #100661 provider-proven overflow
                             )
                             if messages is _overflow_input and compression_skipped_due_to_lock(agent):
                                 compression_attempts -= 1
@@ -6263,6 +6531,11 @@ def run_conversation(
                         messages, system_message,
                         approx_tokens=estimate_request_tokens_rough(api_messages, tools=agent.tools or None),
                         task_id=effective_task_id,
+                        # #100661: the provider proved the request does not fit.
+                        # Ignore the summary-failure cooldown for this ONE
+                        # attempt (bounded by max_compression_attempts) instead
+                        # of deferring every turn until the ladder lapses.
+                        bypass_cooldown=True,
                     )
                     if messages is _overflow_input and compression_skipped_due_to_lock(agent):
                         # #69870 lock-skip: the provider proved the request
@@ -6326,6 +6599,11 @@ def run_conversation(
                         elif new_tokens > 0 and new_tokens < original_tokens * 0.95:
                             agent._buffer_status(COMPRESSION_RETRY_TOKENS_STATUS_TEMPLATE.format(before=original_tokens, after=new_tokens))
                         time.sleep(2)  # Brief pause between compression retries
+                        # Rebuild the complete request before the next provider
+                        # call and force normal preflight to honor it. Message
+                        # count alone is not proof that system/tool-inclusive
+                        # token pressure fell.
+                        _provider_overflow_recovery_pending = True
                         _retry.restart_with_compressed_messages = True
                         break
                     else:
@@ -7632,7 +7910,7 @@ def run_conversation(
                 # This classification is needed regardless of whether the turn has visible content,
                 # because a substantive tool-only turn must invalidate any older housekeeping fallback.
                 _HOUSEKEEPING_TOOLS = frozenset({
-                    "memory", "todo", "skill_manage", "session_search",
+                    "memory", "todo_list", "skill_manage", "session_search",
                 })
                 _all_housekeeping = all(
                     tc.function.name in _HOUSEKEEPING_TOOLS
diff --git a/agent/copilot_acp_client.py b/agent/copilot_acp_client.py
index a547895b26..a45bc46e1d 100644
--- a/agent/copilot_acp_client.py
+++ b/agent/copilot_acp_client.py
@@ -9,6 +9,7 @@ back into the minimal shape Hermes expects from an OpenAI client.
 from __future__ import annotations
 
 import json
+import logging
 import os
 import queue
 import re
@@ -31,6 +32,7 @@ from agent.redact import redact_sensitive_text
 from tools.environments.local import hermes_subprocess_env
 
 ACP_MARKER_BASE_URL = "acp://copilot"
+logger = logging.getLogger(__name__)
 _DEFAULT_TIMEOUT_SECONDS = 900.0
 
 # Stderr fingerprint of the deprecated `gh copilot` CLI extension
@@ -185,6 +187,71 @@ def _permission_denied(message_id: Any) -> dict[str, Any]:
     }
 
 
+def _model_selection_request(
+    session: dict[str, Any], requested_model: str
+) -> tuple[str, dict[str, str]] | None:
+    """Return the ACP request that selects ``requested_model`` for ``session``.
+
+    Prefer stable v1 ``session/set_config_option``. Fall back to Copilot's
+    pre-stabilization ``session/set_model`` extension only when no model
+    config option is advertised. A reported model list is authoritative:
+    unknown and policy-disabled ids return None instead of being sent.
+    """
+    session_id = str(session.get("sessionId") or "").strip()
+    requested_model = str(requested_model or "").strip()
+    if not session_id or not requested_model or requested_model == "copilot-acp":
+        return None
+
+    config_options = [
+        o for o in (session.get("configOptions") or []) if isinstance(o, dict)
+    ]
+    model_option = next(
+        (
+            o for o in config_options
+            if o.get("category") == "model" or o.get("id") == "model"
+        ),
+        None,
+    )
+    if model_option is not None:
+        enabled_values = {
+            str(o.get("value") or "").strip()
+            for o in (model_option.get("options") or [])
+            if isinstance(o, dict)
+            and str(
+                ((o.get("_meta") or {}).get("copilotEnablement")) or ""
+            ).strip().lower() != "disabled"
+        }
+        if requested_model not in enabled_values:
+            return None
+        return (
+            "session/set_config_option",
+            {
+                "sessionId": session_id,
+                "configId": str(model_option.get("id") or "model"),
+                "value": requested_model,
+            },
+        )
+
+    advertised = [
+        m
+        for m in ((session.get("models") or {}).get("availableModels") or [])
+        if isinstance(m, dict)
+    ]
+    available = {
+        str(m.get("modelId") or "").strip()
+        for m in advertised
+        if str(
+            ((m.get("_meta") or {}).get("copilotEnablement")) or ""
+        ).strip().lower() != "disabled"
+    }
+    if available and requested_model not in available:
+        return None
+    return (
+        "session/set_model",
+        {"sessionId": session_id, "modelId": requested_model},
+    )
+
+
 def _format_messages_as_prompt(
     messages: list[dict[str, Any]],
     model: str | None = None,
@@ -197,8 +264,11 @@ def _format_messages_as_prompt(
         "IMPORTANT: If you take an action with a tool, you MUST output tool calls using <tool_call>{...}</tool_call> blocks with JSON exactly in OpenAI function-call shape.",
         "If no tool is needed, answer normally.",
     ]
-    if model:
-        sections.append(f"Hermes requested model hint: {model}")
+    # Deliberately no "requested model" line in the prompt: the model is
+    # applied for real via ACP session/set_model, and when the backend can't
+    # honor it (org-policy-disabled id) a prompt-text mention makes the
+    # serving model FALSELY self-identify as the requested one. Identity
+    # must come from the backend, not from prompt suggestion.
 
     # Copilot has no tools of its own that would collide with Hermes', so it
     # forwards the whole toolset (no allowlist).
@@ -365,6 +435,7 @@ class CopilotACPClient:
         response_text, reasoning_text = self._run_prompt(
             prompt_text,
             timeout_seconds=_effective_timeout,
+            model=model,
         )
 
         tool_calls, cleaned_text = _extract_tool_calls_from_text(response_text)
@@ -393,7 +464,13 @@ class CopilotACPClient:
             return _completion_to_stream_chunks(completion)
         return completion
 
-    def _run_prompt(self, prompt_text: str, *, timeout_seconds: float) -> tuple[str, str]:
+    def _run_prompt(
+        self,
+        prompt_text: str,
+        *,
+        timeout_seconds: float,
+        model: str | None = None,
+    ) -> tuple[str, str]:
         # Fast-fail when the CLI doesn't support the ACP args we'd pass.
         # Without this guard, a CLI like Claude Code v2.x exits with
         # ``error: unknown option '--acp'`` immediately, then the parent
@@ -416,6 +493,13 @@ class CopilotACPClient:
                 f"to a working pair."
             )
 
+        # Note the model Hermes selected; it is applied after session/new via
+        # the ACP-native `session/set_model` call. The CLI's `--model` spawn
+        # flag is deliberately NOT used here: `copilot --acp` validates it
+        # (an unknown id aborts the spawn) but then ignores it for the actual
+        # session, so it adds a failure mode without selecting anything.
+        requested_model = str(model or "").strip()
+
         try:
             # Hide the console the CLI child would otherwise flash on Windows
             # (#56747). Hide-only — stdio pipes stay intact for the ACP wire.
@@ -560,6 +644,31 @@ class CopilotACPClient:
             if not session_id:
                 raise RuntimeError("Copilot ACP did not return a sessionId.")
 
+            # Select the model Hermes asked for. Prefer the stable ACP v1
+            # session-config API: session/new advertises a category="model"
+            # select option and session/set_config_option updates it. Copilot
+            # still exposes the older models/session/set_model extension too,
+            # so retain that only as compatibility fallback for older agents.
+            if requested_model and requested_model != "copilot-acp":
+                try:
+                    selection = _model_selection_request(session, requested_model)
+                    if selection is not None:
+                        method, params = selection
+                        _request(method, params)
+                    else:
+                        logger.warning(
+                            "Copilot ACP does not offer model %r; using the "
+                            "session default.",
+                            requested_model,
+                        )
+                except Exception as exc:
+                    logger.warning(
+                        "Copilot ACP model selection for %r failed; continuing "
+                        "with the session default: %s",
+                        requested_model,
+                        exc,
+                    )
+
             text_parts: list[str] = []
             reasoning_parts: list[str] = []
             _request(
diff --git a/agent/credential_pool.py b/agent/credential_pool.py
index c28cabd2ba..2d8768d60b 100644
--- a/agent/credential_pool.py
+++ b/agent/credential_pool.py
@@ -12,7 +12,7 @@ import re
 from dataclasses import dataclass, fields, replace
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Dict, List, Optional, Set, Tuple
+from typing import Any, Dict, Iterable, List, Optional, Set, Tuple
 
 from hermes_constants import OPENROUTER_BASE_URL
 from hermes_cli.config import load_env
@@ -26,6 +26,7 @@ import hermes_cli.auth as auth_mod
 from hermes_cli.auth import (
     CODEX_ACCESS_TOKEN_REFRESH_SKEW_SECONDS,
     PROVIDER_REGISTRY,
+    SINGLE_USE_REFRESH_POOL_PROVIDERS,
     _auth_store_lock,
     _codex_access_token_is_expiring,
     _decode_jwt_claims,
@@ -807,11 +808,134 @@ def _write_through_provider_state_to_global_root(
         )
 
 
+def _singleton_target_for_entry(pool: "CredentialPool", entry: "PooledCredential") -> Optional[Path]:
+    """Root ``.anthropic_oauth.json`` when *entry* is a borrowed hermes_pkce row, else None."""
+    if entry.source != "hermes_pkce" or entry.id not in getattr(pool, "_borrowed_root_ids", ()):
+        return None
+    try:
+        from agent.anthropic_credentials import _root_hermes_oauth_file
+        return _root_hermes_oauth_file()
+    except Exception:
+        return None
+
+
+def _profile_owns_pool_provider(provider: str) -> bool:
+    """True when the ACTIVE auth.json has its own rows for *provider*.
+
+    Named profiles with no local rows read the provider through the
+    ``read_credential_pool`` global-root fallback ("borrowing").
+    """
+    try:
+        pool = _load_auth_store().get("credential_pool")
+    except Exception:
+        return True  # unreadable store: assume ownership, keep legacy path
+    entries = pool.get(provider) if isinstance(pool, dict) else None
+    return isinstance(entries, list) and bool(entries)
+
+
+def _borrowed_single_use_pool_root() -> Optional[Path]:
+    """Return the global-root auth.json when persisting a BORROWED single-use pool.
+
+    ``None`` means "persist to the active store as usual": classic mode
+    (profile == root), or the profile owns its own rows for this provider.
+    Pytest seat belt mirrors ``_write_through_provider_state_to_global_root``.
+    """
+    try:
+        global_path = _global_auth_file_path()
+    except Exception:
+        return None
+    if global_path is None:
+        return None
+    if os.environ.get("PYTEST_CURRENT_TEST"):
+        real_home_env = os.environ.get("HOME", "")
+        if real_home_env:
+            real_root = Path(real_home_env) / ".hermes" / "auth.json"
+            try:
+                if global_path.resolve(strict=False) == real_root.resolve(strict=False):
+                    return None
+            except Exception:
+                return None
+    return global_path
+
+
+def persist_pool_entries(
+    provider: str,
+    payloads: List[Dict[str, Any]],
+    *,
+    removed_ids: Optional[Iterable[str]] = None,
+) -> None:
+    """Persist a provider's pool rows to the store that OWNS them.
+
+    A named profile that sees a single-use-refresh provider (Anthropic,
+    Codex, xAI OAuth) only through the global-root fallback must not
+    materialize a local ``credential_pool.<provider>`` copy on its first
+    persist: that copy forks the single-use refresh token, the first profile
+    to rotate commits the new pair only to its own file, and root plus every
+    sibling die with ``invalid_grant`` on their next refresh (#100339). Such
+    rows are written back to the root store (under the root lock) so the
+    rotation is visible to every profile; everything else goes to the active
+    store exactly as before.
+    """
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS and not _profile_owns_pool_provider(provider):
+        global_path = _borrowed_single_use_pool_root()
+        if global_path is not None:
+            removed = {rid for rid in (removed_ids or ()) if rid}
+            try:
+                with _auth_store_lock(target_path=global_path):
+                    store = _load_auth_store(global_path)
+                    pool = store.get("credential_pool")
+                    if not isinstance(pool, dict):
+                        pool = {}
+                        store["credential_pool"] = pool
+                    existing = pool.get(provider)
+                    existing_list = existing if isinstance(existing, list) else []
+                    incoming_by_id = {
+                        p.get("id"): p for p in payloads
+                        if isinstance(p, dict) and p.get("id")
+                    }
+                    # UPDATE-ONLY: a borrower may refresh the root's rows
+                    # (rotation, cooldown state) but never add or delete
+                    # them — the root owns their lifecycle. In particular a
+                    # profile's singleton-prune (it has no
+                    # .anthropic_oauth.json of its own) must not delete the
+                    # root grant, and ``removed_ids`` is ignored here.
+                    merged: List[Dict[str, Any]] = []
+                    changed = False
+                    for disk_entry in existing_list:
+                        did = disk_entry.get("id") if isinstance(disk_entry, dict) else None
+                        incoming = incoming_by_id.get(did) if did else None
+                        if incoming is None:
+                            merged.append(disk_entry)
+                            continue
+                        updated = auth_mod._merge_disk_cooldown_state(incoming, disk_entry, provider)
+                        if updated != disk_entry:
+                            changed = True
+                        merged.append(updated)
+                    if changed:
+                        pool[provider] = merged
+                        _save_auth_store(store, target_path=global_path)
+                return
+            except Exception as exc:
+                # Fail closed on the FORK, not on the save: never fall back to
+                # writing a local copy (that IS the bug). The in-memory pool
+                # still holds the rotated pair for this process.
+                logger.warning(
+                    "%s pool: write-through of borrowed root grant failed (%s); "
+                    "not materializing a profile-local copy",
+                    provider, exc,
+                )
+                return
+    write_credential_pool(provider, payloads, removed_ids=removed_ids)
+
+
 class CredentialPool:
     def __init__(self, provider: str, entries: List[PooledCredential]):
         self.provider = provider
         self._entries = sorted(entries, key=lambda entry: entry.priority)
         self._current_id: Optional[str] = None
+        # Ids of rows read via the global-root fallback (single-use OAuth
+        # providers only); set by load_pool(), consumed by add_entry().
+        self._borrowed_root_ids: Set[str] = set()
         self._strategy = get_pool_strategy(provider)
         # RLock: the mutation primitives below (_replace_entry/_persist)
         # self-acquire this lock so the DEFERRED single-use-token refresh
@@ -938,7 +1062,7 @@ class CredentialPool:
         # Self-locking (RLock): snapshotting self._entries must not race a
         # concurrent rotation when called from the deferred refresh path.
         with self._lock:
-            write_credential_pool(
+            persist_pool_entries(
                 self.provider,
                 [entry.to_dict() for entry in self._entries],
                 removed_ids=removed_ids,
@@ -1786,10 +1910,14 @@ class CredentialPool:
                 elif entry.source == "hermes_pkce":
                     try:
                         from agent.anthropic_credentials import _write_hermes_oauth_credentials
+                        # A borrowed row was seeded from the ROOT's singleton
+                        # (this profile has none); commit the rotation there,
+                        # never into a new profile-local copy (#100339).
                         _write_hermes_oauth_credentials(
                             refreshed["access_token"],
                             refreshed["refresh_token"],
                             refreshed["expires_at_ms"],
+                            target=_singleton_target_for_entry(self, entry),
                         )
                     except Exception as wexc:
                         # Same transaction rule as claude_code above.
@@ -2806,7 +2934,7 @@ class CredentialPool:
                 replace(entry, priority=new_priority)
                 for new_priority, entry in enumerate(self._entries)
             ]
-            write_credential_pool(
+            persist_pool_entries(
                 self.provider,
                 [entry.to_dict() for entry in self._entries],
                 removed_ids=[removed.id],
@@ -2845,7 +2973,22 @@ class CredentialPool:
         with self._lock:
             entry = replace(entry, priority=_next_priority(self._entries))
             self._entries.append(entry)
-            self._persist()
+            borrowed_ids = getattr(self, "_borrowed_root_ids", None)
+            if borrowed_ids:
+                # ``hermes -p <profile> auth add <single-use provider>``: the
+                # profile is claiming its OWN credential. Persist only the
+                # profile-owned rows locally — copying the borrowed root
+                # grant alongside them would fork its single-use refresh
+                # token (#100339). Once the profile owns rows, the root
+                # fallback for this provider is shadowed (existing contract).
+                write_credential_pool(
+                    self.provider,
+                    [e.to_dict() for e in self._entries if e.id not in borrowed_ids],
+                )
+                self._entries = [e for e in self._entries if e.id not in borrowed_ids]
+                self._borrowed_root_ids = set()
+            else:
+                self._persist()
             return entry
 
 
@@ -3631,6 +3774,12 @@ def _seed_custom_pool(pool_key: str, entries: List[PooledCredential]) -> Tuple[b
 
 def load_pool(provider: str) -> CredentialPool:
     provider = (provider or "").strip().lower()
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        # One-time heal for installs that forked this grant across profiles
+        # BEFORE the clone-strip / root-write-through existed: consolidate the
+        # profile's copy into root so the read below borrows root's grant
+        # (#100339). No-op in classic mode or once the profile is clean.
+        auth_mod.heal_forked_single_use_oauth_grants(provider)
     raw_entries = read_credential_pool(provider)
     disk_ids = {
         entry.get("id")
@@ -3678,18 +3827,41 @@ def load_pool(provider: str) -> CredentialPool:
         # process missing a provider env var must not delete the persisted
         # pool entry for every other process (#9331). File-backed singletons
         # still prune when their backing file is gone.
-        changed |= _prune_stale_seeded_entries(
-            entries,
-            singleton_sources | env_sources,
-            prune_env_sources=False,
+        borrowing_root_grant = (
+            provider in SINGLE_USE_REFRESH_POOL_PROVIDERS
+            and bool(disk_ids)
+            and not _profile_owns_pool_provider(provider)
         )
+        if borrowing_root_grant:
+            # Rows read through the global-root fallback are seeded from the
+            # ROOT's singleton files, which this profile cannot see; pruning
+            # them as "backing file gone" would hide (and, via write-through,
+            # delete) the shared grant. The root's own load_pool() prunes.
+            borrowed = [e for e in entries if e.id in disk_ids]
+            others = [e for e in entries if e.id not in disk_ids]
+            changed |= _prune_stale_seeded_entries(
+                others, singleton_sources | env_sources, prune_env_sources=False,
+            )
+            entries[:] = borrowed + others
+        else:
+            changed |= _prune_stale_seeded_entries(
+                entries,
+                singleton_sources | env_sources,
+                prune_env_sources=False,
+            )
         changed |= _normalize_pool_priorities(provider, entries)
 
     if changed:
         new_ids = {entry.id for entry in entries}
-        write_credential_pool(
+        persist_pool_entries(
             provider,
             [entry.to_dict() for entry in sorted(entries, key=lambda item: item.priority)],
             removed_ids=disk_ids - new_ids,
         )
-    return CredentialPool(provider, entries)
+    pool = CredentialPool(provider, entries)
+    # Remember which rows are the root's grant (borrowed via fallback) so a
+    # later ``add_entry`` in this profile can leave them out of the profile's
+    # own store (#100339).
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS and not _profile_owns_pool_provider(provider):
+        pool._borrowed_root_ids = set(disk_ids)
+    return pool
diff --git a/agent/credits_tracker.py b/agent/credits_tracker.py
index 39c74ea58b..82e2d53caa 100644
--- a/agent/credits_tracker.py
+++ b/agent/credits_tracker.py
@@ -252,15 +252,10 @@ def is_free_tier_model(model: str, base_url: str = "") -> bool:
     if not base_url:
         return False
     try:
-        from hermes_cli.models import _is_model_free, _pricing_cache
+        from hermes_cli.models import _is_model_free, peek_cached_pricing
 
-        # Mirror get_pricing_for_provider's key normalization: the agent's
-        # Nous base_url is /v1-suffixed (https://inference-api.nousresearch.com/v1)
-        # but the picker keys _pricing_cache on the pre-/v1 root.
-        key = base_url.rstrip("/")
-        if key.endswith("/v1"):
-            key = key[:-3].rstrip("/")
-        pricing = _pricing_cache.get(key)
+        # peek_cached_pricing owns the /v1-suffix and auth-state key details.
+        pricing = peek_cached_pricing(base_url)
         if not pricing:
             return False
         return _is_model_free(model, pricing)
diff --git a/agent/display.py b/agent/display.py
index 2880cecccb..7a5dfc47a4 100644
--- a/agent/display.py
+++ b/agent/display.py
@@ -462,7 +462,7 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int | None = None) -
         "image_generate": "prompt", "text_to_speech": "text",
         "vision_analyze": "question",
         "skill_view": "name", "skills_list": "category",
-        "cronjob": "action",
+        "cronjob_manage": "action",
         "execute_code": "code", "browser_exec": "code", "delegate_task": "goal",
         "clarify": "question", "skill_manage": "name",
     }
@@ -496,7 +496,7 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int | None = None) -
         preview = _oneline(str(goal))
         return _truncate_preview(preview, max_len) if preview else None
 
-    if tool_name == "process":
+    if tool_name == "process_manage":
         action = args.get("action", "")
         sid = args.get("session_id", "")
         data = args.get("data", "")
@@ -511,7 +511,7 @@ def build_tool_preview(tool_name: str, args: dict, max_len: int | None = None) -
         parts = [p for p in parts if p]
         return " ".join(parts) if parts else None
 
-    if tool_name == "todo":
+    if tool_name == "todo_list":
         todos_arg = args.get("todos")
         merge = args.get("merge", False)
         if todos_arg is None:
@@ -657,10 +657,10 @@ _TOOL_VERBS: dict[str, str] = {
     "skills_list": "Listing skills",
     "skill_manage": "Updating skill",
     "delegate_task": "Delegating",
-    "cronjob": "Scheduling",
+    "cronjob_manage": "Scheduling",
     "clarify": "Asking",
     "memory": "Updating memory",
-    "todo": "Updating tasks",
+    "todo_list": "Updating tasks",
 }
 
 # Verbs that read better without the raw argument preview appended.
@@ -1433,7 +1433,7 @@ def _get_cute_tool_message(
         return _wrap(f"┊ 📄 fetch     pages  {dur}")
     if tool_name == "terminal":
         return _wrap(f"┊ 💻 $         {_trunc(build_tool_preview(tool_name, args) or args.get('command', ''), 42)}  {dur}")
-    if tool_name == "process":
+    if tool_name == "process_manage":
         action = args.get("action", "?")
         sid = args.get("session_id", "")[:12]
         labels = {"list": "ls processes", "poll": f"poll {sid}", "log": f"log {sid}",
@@ -1473,7 +1473,7 @@ def _get_cute_tool_message(
         return _wrap(f"┊ 🖼️  images    extracting  {dur}")
     if tool_name == "browser_vision":
         return _wrap(f"┊ 👁️  vision    analyzing page  {dur}")
-    if tool_name == "todo":
+    if tool_name == "todo_list":
         todos_arg = args.get("todos")
         merge = args.get("merge", False)
         # Parse result for completion progress
@@ -1532,7 +1532,7 @@ def _get_cute_tool_message(
         return _wrap(f"┊ 👁️  vision    {_trunc(args.get('question', ''), 30)}  {dur}")
     if tool_name == "send_message":
         return _wrap(f"┊ 📨 send      {args.get('target', '?')}: \"{_trunc(args.get('message', ''), 25)}\"  {dur}")
-    if tool_name == "cronjob":
+    if tool_name == "cronjob_manage":
         action = args.get("action", "?")
         if action == "create":
             skills = args.get("skills") or ([] if not args.get("skill") else [args.get("skill")])
diff --git a/agent/fast_mode.py b/agent/fast_mode.py
new file mode 100644
index 0000000000..b8121f6295
--- /dev/null
+++ b/agent/fast_mode.py
@@ -0,0 +1,63 @@
+"""Bounded fast-mode windows (``/fast auto`` and ``/fast cold``).
+
+``agent.service_tier`` is ``None`` (normal), ``"priority"`` (static fast),
+``"auto"`` or ``"cold"``. The static value is pinned into
+``agent.request_overrides`` at agent build time; the two bounded modes
+instead open a wall-clock window at each user-turn boundary and layer the
+provider's fast override onto the request kwargs only while it is open:
+
+- ``auto`` — every user turn opens a window of ``agent.fast_auto_seconds``.
+- ``cold`` — only the first turn of a session (no prior history) opens it.
+
+Only per-request params (``service_tier`` / ``speed``) vary between requests;
+the system prompt, tools, and messages are untouched, so the prompt cache is
+preserved across the window boundary.
+"""
+
+from __future__ import annotations
+
+import time
+from typing import Any
+
+BOUNDED_MODES = frozenset({"auto", "cold"})
+DEFAULT_WINDOW_SECONDS = 60
+
+
+def begin_turn(agent: Any, conversation_history: Any) -> None:
+    """Open (or refuse) the fast window at a user-turn boundary."""
+    mode = getattr(agent, "service_tier", None)
+    agent._fast_until = 0.0
+    if mode not in BOUNDED_MODES:
+        return
+    if mode == "cold" and any(
+        isinstance(m, dict) and m.get("role") in ("user", "assistant", "tool")
+        for m in (conversation_history or ())
+    ):
+        return
+    try:
+        window = float(getattr(agent, "fast_auto_seconds", DEFAULT_WINDOW_SECONDS))
+    except (TypeError, ValueError):
+        window = DEFAULT_WINDOW_SECONDS
+    agent._fast_until = time.monotonic() + max(window, 0.0)
+
+
+def effective_request_overrides(agent: Any) -> dict[str, Any]:
+    """``agent.request_overrides`` plus the fast override while the window is open."""
+    overrides = dict(getattr(agent, "request_overrides", None) or {})
+    if getattr(agent, "service_tier", None) not in BOUNDED_MODES:
+        return overrides
+    if time.monotonic() >= getattr(agent, "_fast_until", 0.0):
+        return overrides
+    from hermes_cli.models import resolve_fast_mode_overrides
+
+    base_url = getattr(agent, "base_url", None)
+    if getattr(agent, "api_mode", None) == "anthropic_messages":
+        base_url = getattr(agent, "_anthropic_base_url", None) or base_url
+    fast = resolve_fast_mode_overrides(
+        getattr(agent, "model", None),
+        provider=getattr(agent, "provider", None),
+        base_url=base_url,
+    )
+    if fast:
+        overrides.update(fast)
+    return overrides
diff --git a/agent/image_routing.py b/agent/image_routing.py
index 3412efe585..a861cd29bf 100644
--- a/agent/image_routing.py
+++ b/agent/image_routing.py
@@ -519,6 +519,28 @@ def _lookup_supports_vision(
         return override
     if not provider or not model:
         return None
+
+    # Managed local runtime: the server that would receive the image is
+    # the authority on whether it can see (its /props reports modalities
+    # when a vision projector is loaded; the catalog covers staged-but-
+    # unloaded models). Cloud catalogs have never heard of a local GGUF,
+    # so without this answer every local model reads as text-only and
+    # images detour to a cloud auxiliary — wrong twice for a local-first
+    # user (broken feature, and a screenshot leaving the machine).
+    try:
+        from hermes_cli.local_runtime.capabilities import (
+            is_managed_provider,
+            managed_model_supports_vision,
+        )
+
+        if is_managed_provider(provider, _resolve_inference_base_url(cfg, provider) or ""):
+            managed = managed_model_supports_vision(model)
+            if managed is not None:
+                return managed
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.debug("image_routing: managed-runtime caps lookup failed for %s:%s — %s",
+                     provider, model, exc)
+
     caps = None
     try:
         from agent.models_dev import get_model_capabilities
@@ -813,12 +835,31 @@ def _file_to_data_url(path: Path) -> Optional[str]:
         logger.warning("image_routing: failed to read %s — %s", path, exc)
         return None
     mime = _guess_mime(path, raw=raw)
-    if mime not in _UNIVERSALLY_SUPPORTED_MIMES:
+    accepted = _UNIVERSALLY_SUPPORTED_MIMES
+    # The managed local server decodes fewer formats than cloud providers
+    # (no WebP — and a WebP part fails SILENTLY: the model never sees an
+    # image and confabulates a description). When the active main model is
+    # served by the managed runtime, narrow the accepted set so those
+    # formats transcode to PNG here instead of vanishing server-side.
+    try:
+        from agent.auxiliary_client import _runtime_main_value
+        from hermes_cli.local_runtime.capabilities import (
+            ACCEPTED_IMAGE_MIMES,
+            is_managed_provider,
+        )
+
+        if is_managed_provider(
+                str(_runtime_main_value("provider") or ""),
+                str(_runtime_main_value("base_url") or "")):
+            accepted = ACCEPTED_IMAGE_MIMES
+    except Exception:  # noqa: BLE001 — best-effort narrowing only
+        pass
+    if mime not in accepted:
         transcoded = _transcode_to_png(raw)
         if transcoded is None:
             logger.warning(
-                "image_routing: %s is %s which is not accepted by all major "
-                "vision providers and could not be transcoded to PNG; "
+                "image_routing: %s is %s which is not accepted by the "
+                "active provider and could not be transcoded to PNG; "
                 "skipping this attachment.",
                 path, mime,
             )
diff --git a/agent/model_metadata.py b/agent/model_metadata.py
index af6467cc59..fb78714afd 100644
--- a/agent/model_metadata.py
+++ b/agent/model_metadata.py
@@ -370,6 +370,58 @@ def _save_model_metadata_disk_cache(data: Dict[str, Dict[str, Any]]) -> None:
     except Exception as e:
         logger.debug("Failed to save OpenRouter model metadata disk cache: %s", e)
 
+def _get_endpoint_metadata_cache_path() -> Path:
+    """On-disk memo of remote ``/models`` probes (see ``_endpoint_disk_cache_get``)."""
+    from hermes_constants import get_hermes_home
+    return get_hermes_home() / "cache" / "endpoint_model_metadata.json"
+
+
+def _endpoint_disk_cache_get(normalized: str) -> Optional[Dict[str, Dict[str, Any]]]:
+    """Return a still-fresh (``_ENDPOINT_MODEL_CACHE_TTL``) disk memo for one endpoint.
+
+    The in-memory endpoint cache only helps within a process. One-shot runs
+    (``hermes -q``, cron, every Bot Mode DM hop) start cold and re-probed the
+    live ``/models`` endpoint on every launch — 0.3–0.6s of pure network per
+    process on Nous, whose persistent context cache is bypassed by design so
+    the portal stays authoritative. This memo keeps that authority (same TTL
+    as the in-memory cache, so reconciliation still lands within 5 minutes)
+    while sharing the answer across processes. Local endpoints are never
+    memoized: their loaded context is transient (LM Studio reloads).
+    """
+    try:
+        with _get_endpoint_metadata_cache_path().open("r", encoding="utf-8") as f:
+            data = json.load(f)
+        entry = data.get(normalized) if isinstance(data, dict) else None
+        if not isinstance(entry, dict):
+            return None
+        if (time.time() - float(entry.get("at", 0))) >= _ENDPOINT_MODEL_CACHE_TTL:
+            return None
+        models = entry.get("models")
+        return models if isinstance(models, dict) else None
+    except Exception:
+        return None
+
+
+def _endpoint_disk_cache_put(normalized: str, cache: Dict[str, Dict[str, Any]]) -> None:
+    """Memoize a successful remote ``/models`` probe; expired siblings are dropped."""
+    try:
+        path = _get_endpoint_metadata_cache_path()
+        data: Dict[str, Any] = {}
+        if path.exists():
+            with path.open("r", encoding="utf-8") as f:
+                loaded = json.load(f)
+            if isinstance(loaded, dict):
+                now = time.time()
+                data = {
+                    k: v for k, v in loaded.items()
+                    if isinstance(v, dict) and (now - float(v.get("at", 0))) < _ENDPOINT_MODEL_CACHE_TTL
+                }
+        data[normalized] = {"at": time.time(), "models": cache}
+        atomic_json_write(path, data, indent=0, separators=(",", ":"))
+    except Exception as e:
+        logger.debug("Failed to save endpoint model metadata disk cache: %s", e)
+
+
 # Descending tiers for context length probing when the model is unknown.
 # We start at 256K (covers GPT-5.x, many current large-context models) and
 # step down on context-length errors until one works.  Tier[0] is also the
@@ -1362,6 +1414,12 @@ def fetch_endpoint_model_metadata(
         cached_at = _endpoint_model_metadata_cache_time.get(normalized, 0)
         if cached is not None and (time.time() - cached_at) < _ENDPOINT_MODEL_CACHE_TTL:
             return cached
+        if not is_local_endpoint(normalized):
+            memo = _endpoint_disk_cache_get(normalized)
+            if memo is not None:
+                _endpoint_model_metadata_cache[normalized] = memo
+                _endpoint_model_metadata_cache_time[normalized] = time.time()
+                return memo
 
     # Blackholed endpoint: every candidate below would spend its full 5s
     # connect budget. Returned empty rather than cached, so the endpoint is
@@ -1502,11 +1560,42 @@ def fetch_endpoint_model_metadata(
                         model_alias = props.get("model_alias", "")
                         if n_ctx and model_alias and model_alias in cache:
                             cache[model_alias]["context_length"] = n_ctx
+                    else:
+                        # Router mode: bare /props 400s and telemetry is
+                        # per-child (?model=). Enumerate children via the
+                        # native /models (carries status) and read each
+                        # LOADED child's granted window — the value the
+                        # context policy actually granted, which the meter
+                        # and compressor must follow. Unloaded children are
+                        # skipped: probing them could trigger an autoload.
+                        native = requests.get(base + "/models", headers=headers, timeout=5, verify=_verify)
+                        if native.ok:
+                            children = (native.json() or {}).get("data", [])
+                            for child in children[:16]:
+                                if not isinstance(child, dict):
+                                    continue
+                                child_id = child.get("id")
+                                status = (child.get("status") or {}).get("value")
+                                if not child_id or child_id not in cache or status not in ("loaded", "ready"):
+                                    continue
+                                pr = requests.get(
+                                    base + "/v1/props", params={"model": child_id},
+                                    headers=headers, timeout=5, verify=_verify)
+                                if not pr.ok:
+                                    pr = requests.get(
+                                        base + "/props", params={"model": child_id},
+                                        headers=headers, timeout=5, verify=_verify)
+                                if pr.ok:
+                                    child_ctx = (pr.json().get("default_generation_settings") or {}).get("n_ctx")
+                                    if child_ctx:
+                                        cache[child_id]["context_length"] = child_ctx
                 except Exception:
                     pass
 
             _endpoint_model_metadata_cache[normalized] = cache
             _endpoint_model_metadata_cache_time[normalized] = time.time()
+            if cache and not is_local_endpoint(normalized):
+                _endpoint_disk_cache_put(normalized, cache)
             return cache
         except Exception as exc:
             last_error = exc
@@ -2375,6 +2464,27 @@ def _query_local_context_length_uncached(model: str, base_url: str, api_key: str
                                     return int(ctx)
                             break
 
+            # llama.cpp: /props reports default_generation_settings.n_ctx —
+            # the RUNTIME window the server grants. Critically, the router
+            # answers this (from its preset) even for a model that is not
+            # currently loaded, while /v1/models reports meta=null until
+            # load. Without this probe, resolving a lazily-loaded model at
+            # session start finds no metadata and falls through to the
+            # name-pattern defaults, where a family catch-all (e.g. "qwen"
+            # = 131072) misreports a server launched at 262144.
+            if server_type == "llamacpp":
+                for props_path in (f"/props?model={model}", "/props"):
+                    try:
+                        resp = client.get(f"{server_url}{props_path}")
+                    except httpx.HTTPError:
+                        break
+                    if resp.status_code != 200:
+                        continue
+                    n_ctx = (resp.json().get("default_generation_settings")
+                             or {}).get("n_ctx")
+                    if isinstance(n_ctx, (int, float)) and n_ctx:
+                        return int(n_ctx)
+
             # LM Studio / vLLM / llama.cpp / Anthropic-compat proxies:
             # try /v1/models/{model}
             resp = client.get(f"{server_url}/v1/models/{model}")
@@ -3908,6 +4018,8 @@ def capture_usage_anchor(
 def anchored_context_tokens(
     messages: List[Dict[str, Any]],
     anchor: Optional[Dict[str, Any]],
+    *,
+    charge_stale_thinking: bool = True,
 ) -> Optional[int]:
     """Context size anchored on the last provider-reported usage.
 
@@ -3917,6 +4029,13 @@ def anchored_context_tokens(
     estimation). The assistant reply produced by the anchored response
     (first appended message after the base) is skipped: its cost is already
     counted exactly by ``completion_tokens``.
+
+    ``charge_stale_thinking`` is forwarded to the delta estimate — pass
+    ``False`` to exclude transient ``reasoning``/``reasoning_content`` text
+    on all but the newest assistant message in the delta (the durable-
+    transcript view used by display surfaces; see the turn-base anchor in
+    ``agent/conversation_loop.py``). Default ``True`` preserves the
+    conservative full charge for request-size callers.
     """
     if not isinstance(anchor, dict) or not isinstance(messages, list):
         return None
@@ -3938,7 +4057,9 @@ def anchored_context_tokens(
             # completion_tokens above.
             delta = delta[1:]
     if delta:
-        total += estimate_messages_tokens_rough(delta)
+        total += estimate_messages_tokens_rough(
+            delta, charge_stale_thinking=charge_stale_thinking
+        )
     return total
 
 
diff --git a/agent/outbound_webhooks.py b/agent/outbound_webhooks.py
index f437b809f3..cd600832cb 100644
--- a/agent/outbound_webhooks.py
+++ b/agent/outbound_webhooks.py
@@ -98,8 +98,12 @@ _TOOL_SCOPED_EVENTS = {"pre_tool_call", "post_tool_call"}
 # kwargs promoted to top-level payload keys (mirrors shell hooks wire).
 _TOP_LEVEL_PAYLOAD_KEYS = {"tool_name", "args", "session_id", "parent_session_id"}
 
-# (event, url) pairs already wired to the plugin manager in this process.
-_registered: Set[Tuple[str, str]] = set()
+# (home, event, url) triples already wired to the plugin manager in this
+# process. Home is part of the key so a multiplexed gateway's secondary
+# profiles — each with their own plugin manager (see
+# hermes_cli.plugins.get_plugin_manager) — can register identical webhook
+# targets without the first profile's registration shadowing the rest.
+_registered: Set[Tuple[str, str, str]] = set()
 _registered_lock = threading.Lock()
 
 _delivery_queue: "queue.Queue[Optional[Dict[str, Any]]]" = queue.Queue(
@@ -180,15 +184,17 @@ def register_from_config(cfg: Optional[Dict[str, Any]]) -> List[WebhookTarget]:
         return []
 
     from hermes_cli.plugins import get_plugin_manager
+    from hermes_constants import get_hermes_home
 
     manager = get_plugin_manager()
+    home_key = str(get_hermes_home().expanduser().resolve())
 
     registered: List[WebhookTarget] = []
     with _registered_lock:
         for target in targets:
             wired_any = False
             for event in target.events:
-                key = (event, target.url)
+                key = (home_key, event, target.url)
                 if key in _registered:
                     continue
                 manager._hooks.setdefault(event, []).append(
@@ -231,6 +237,29 @@ def flush(timeout: float = 5.0) -> bool:
         return _delivery_queue.unfinished_tasks == 0
 
 
+def re_register_config_hooks() -> None:
+    """Re-register outbound webhooks from config after a plugin force-reload.
+
+    Mirrors ``agent.shell_hooks.re_register_config_hooks``: config-owned
+    outbound-webhook callbacks live in the same ``_hooks`` dict that
+    ``PluginManager.discover_and_load(force=True)`` clears via ``unload()``,
+    so without this the force-reloaded profile's outbound webhooks go
+    silently inert (#92682 review). Only the current home's idempotence
+    keys are cleared so a force-reload in one profile cannot invalidate
+    another profile's still-live registration.
+    """
+    from hermes_cli.config import load_config
+    from hermes_constants import get_hermes_home
+
+    home_key = str(get_hermes_home().expanduser().resolve())
+    with _registered_lock:
+        _registered.difference_update(
+            {key for key in _registered if key[0] == home_key}
+        )
+
+    register_from_config(load_config())
+
+
 def reset_for_tests() -> None:
     """Clear the idempotence set and drain the queue.  Test-only helper."""
     with _registered_lock:
@@ -416,8 +445,13 @@ def _serialize_payload(
         cwd = str(Path.cwd())
     except OSError:
         cwd = ""
+    # Resolved at fire time from the bound home so a multiplexed gateway's
+    # receivers can tell which profile emitted the event (#92674).
+    from hermes_cli.profiles import get_active_profile_name
+
     payload = {
         "hook_event_name": event,
+        "profile": get_active_profile_name(),
         "tool_name": kwargs.get("tool_name"),
         "tool_input": kwargs.get("args") if isinstance(kwargs.get("args"), dict) else None,
         "session_id": kwargs.get("session_id") or kwargs.get("parent_session_id") or "",
diff --git a/agent/process_bootstrap.py b/agent/process_bootstrap.py
index 7ef4cf2df8..341126c919 100644
--- a/agent/process_bootstrap.py
+++ b/agent/process_bootstrap.py
@@ -269,6 +269,49 @@ def _enable_happy_eyeballs(transport) -> None:
         pool._network_backend = _HappyEyeballsSyncBackend()
 
 
+def enable_happy_eyeballs_on_client(client) -> None:
+    """Install the sync racing backend on every direct transport of a client.
+
+    Covers a ready-built ``httpx.Client`` (its default transport plus any
+    mounts), for callers that construct clients inline instead of going
+    through :func:`build_keepalive_http_client` — e.g. the Codex OAuth token
+    refresh / device-login / usage-probe clients in ``hermes_cli.auth``.
+
+    Proxy-backed transports (``httpcore.HTTPProxy`` / SOCKS pools) are left
+    untouched: with a proxy in play the TCP connect goes to the proxy host,
+    which is out of scope for the direct-transport racing added in #94388.
+    Async clients are also left untouched — httpcore's async backend already
+    performs RFC 8305 racing natively via
+    ``anyio.connect_tcp(happy_eyeballs_delay=0.25)``.
+
+    Best-effort and hasattr-guarded like ``_enable_happy_eyeballs``; on an
+    incompatible httpx/httpcore this silently keeps the default backend.
+    """
+    try:
+        import httpcore
+
+        proxy_pool_types = tuple(
+            t
+            for t in (
+                getattr(httpcore, "HTTPProxy", None),
+                getattr(httpcore, "SOCKSProxy", None),
+            )
+            if t is not None
+        )
+    except Exception:
+        return
+
+    transports = [getattr(client, "_transport", None)]
+    transports.extend((getattr(client, "_mounts", None) or {}).values())
+    for transport in transports:
+        pool = getattr(transport, "_pool", None)
+        if pool is None or not hasattr(pool, "_network_backend"):
+            continue
+        if proxy_pool_types and isinstance(pool, proxy_pool_types):
+            continue
+        pool._network_backend = _HappyEyeballsSyncBackend()
+
+
 def _load_openai_cls() -> type:
     """Import and cache ``openai.OpenAI``."""
     global _OPENAI_CLS_CACHE
@@ -421,6 +464,10 @@ def build_keepalive_http_client(
         if proxy is None:
             http_transport = transport_cls(verify=verify)
             https_transport = transport_cls(verify=verify)
+            # Async transports need no explicit racing: httpcore's anyio
+            # backend already implements RFC 8305 natively
+            # (``anyio.connect_tcp(happy_eyeballs_delay=0.25)``), covered by
+            # tests/agent/test_codex_happy_eyeballs.py.
             if not async_mode and _uses_codex_cloud_transport(base_url):
                 _enable_happy_eyeballs(http_transport)
                 _enable_happy_eyeballs(https_transport)
@@ -459,4 +506,5 @@ __all__ = [
     "_get_proxy_from_env",
     "_get_proxy_for_base_url",
     "build_keepalive_http_client",
+    "enable_happy_eyeballs_on_client",
 ]
diff --git a/agent/prompt_builder.py b/agent/prompt_builder.py
index d636e78be8..508c118a95 100644
--- a/agent/prompt_builder.py
+++ b/agent/prompt_builder.py
@@ -1173,6 +1173,24 @@ _WINDOWS_BASH_SHELL_HINT = (
 )
 
 
+def _tenv_read(name: str, default: str = "") -> str:
+    """Scope-aware TERMINAL_* read (tools.terminal_scope.terminal_env).
+
+    The per-turn terminal scope installed by the multiplexing gateway carries
+    the active profile's terminal settings; a raw os.getenv would read a value
+    a previous profile's turn pinned into the process env.
+
+    Only an import failure falls back: an active refusal scope must raise —
+    swapping it for the ambient process value would defeat the fail-closed
+    boundary.
+    """
+    try:
+        from tools.terminal_scope import terminal_env
+    except ImportError:
+        return os.getenv(name, default)
+    return terminal_env(name, default)
+
+
 def _probe_remote_backend(env_type: str) -> str | None:
     """Run a tiny introspection command inside the active terminal backend.
 
@@ -1181,7 +1199,7 @@ def _probe_remote_backend(env_type: str) -> str | None:
     per process. Used only for non-local backends where the agent's tools
     operate on a different machine than the host Hermes runs on.
     """
-    cwd_hint = os.getenv("TERMINAL_CWD", "")
+    cwd_hint = _tenv_read("TERMINAL_CWD", "")
     cache_key = (env_type, cwd_hint)
     cached = _BACKEND_PROBE_CACHE.get(cache_key)
     if cached is not None:
@@ -1330,7 +1348,7 @@ def build_environment_hints() -> str:
 
     hints: list[str] = []
 
-    backend = (os.getenv("TERMINAL_ENV") or "local").strip().lower()
+    backend = (_tenv_read("TERMINAL_ENV") or "local").strip().lower()
     is_remote_backend = backend in _REMOTE_TERMINAL_BACKENDS or _plugin_backend_is_remote(backend)
 
     if not is_remote_backend:
diff --git a/agent/redact.py b/agent/redact.py
index 50e263cee3..f192b9e721 100644
--- a/agent/redact.py
+++ b/agent/redact.py
@@ -270,6 +270,16 @@ _KEY_KEYWORD_RE = re.compile(
     re.IGNORECASE,
 )
 
+# Key names that are credential-specific even when their values are short or
+# human-readable. Bare ``token`` / ``key`` are intentionally absent: those
+# words also describe model limits, tensor names, cache keys, and other public
+# technical values. Their assignments are gated on value shape below.
+_STRONG_KEY_KEYWORD_RE = re.compile(
+    r"(?:api|auth|access|refresh|session|id|bearer)[ _.\\-]?(?:key|token)"
+    r"|key[ _.\\-]?material|secret|passwd|password|pass|pw|credential|auth|bearer",
+    re.IGNORECASE,
+)
+
 
 def _is_word_start(s: str, i: int) -> bool:
     """True if position ``i`` in ``s`` begins a word (not mid-word)."""
@@ -326,6 +336,42 @@ def _key_has_secret_keyword(key: str) -> bool:
             return True
     return False
 
+
+def _key_has_strong_secret_keyword(key: str) -> bool:
+    """Return whether ``key`` names an unambiguously credential-bearing field."""
+    for match in _STRONG_KEY_KEYWORD_RE.finditer(key):
+        if _is_word_start(key, match.start()) and _is_word_end(key, match.end()):
+            return True
+    return False
+
+
+def _looks_like_opaque_credential(value: str) -> bool:
+    """Return whether an ambiguous token/key value has credential-like shape.
+
+    Known vendor prefixes and JWTs have dedicated redactors. This catches the
+    remaining opaque family without treating short technical scalars such as
+    ``CPU``, ``local``, or training captions as secrets merely because their
+    key contains ``token`` or ``key``.
+    """
+    if value == "***" or value.startswith("«redacted:"):
+        return True
+    if len(value) >= 16 and re.fullmatch(r"[A-Fa-f0-9]+", value):
+        return True
+    if len(value) >= 20 and re.fullmatch(r"[A-Za-z0-9_./+=-]+", value):
+        return True
+    if len(value) < 12:
+        return False
+    classes = sum(
+        bool(re.search(pattern, value))
+        for pattern in (r"[a-z]", r"[A-Z]", r"[0-9]")
+    )
+    return classes >= 2
+
+
+def _assignment_value_requires_redaction(key: str, value: str) -> bool:
+    """Apply value-aware gating to key-name-only assignment matches."""
+    return _key_has_strong_secret_keyword(key) or _looks_like_opaque_credential(value)
+
 # JSON field patterns: "apiKey": "value", "token": "value", etc.
 _JSON_KEY_NAMES = r"(?:api_?[Kk]ey|token|secret|password|access_token|refresh_token|auth_token|bearer|secret_value|raw_secret|secret_input|key_material)"
 _JSON_FIELD_RE = re.compile(
@@ -870,6 +916,8 @@ def redact_sensitive_text(
                 # embedded matching inside the helper.
                 if not _key_has_secret_keyword(name):
                     return m.group(0)
+                if not _assignment_value_requires_redaction(name, value):
+                    return m.group(0)
                 return f"{name}={quote}{_mask_token(value)}{quote}"
             text = _ENV_ASSIGN_RE.sub(_redact_env, text)
             # Lowercase env names (``openai_key=…``). Skip URLs — the query
@@ -905,6 +953,8 @@ def redact_sensitive_text(
                 # not a leaked secret value.
                 if _ENV_LOOKUP_VALUE_RE.match(value):
                     return m.group(0)
+                if not _assignment_value_requires_redaction(key, value):
+                    return m.group(0)
                 return f'{key}: "{_mask_token(value)}"'
             text = _JSON_FIELD_RE.sub(_redact_json, text)
 
@@ -924,6 +974,8 @@ def redact_sensitive_text(
                 # document text, not credentials (nearai/ironclaw#6129).
                 if not _key_has_secret_keyword(key):
                     return m.group(0)
+                if not _assignment_value_requires_redaction(key, value):
+                    return m.group(0)
                 return f"{key}{sep}{_mask_token(value)}"
             text = _YAML_ASSIGN_RE.sub(_redact_yaml, text)
 
diff --git a/agent/review_idle_queue.py b/agent/review_idle_queue.py
new file mode 100644
index 0000000000..2d31501c8e
--- /dev/null
+++ b/agent/review_idle_queue.py
@@ -0,0 +1,291 @@
+"""Idle deferral for background reviews on the managed local runtime.
+
+The post-turn review fork replays the whole conversation on the review
+runtime. On a cloud provider that costs seconds and runs concurrently
+with whatever the user does next. When the review runtime IS the managed
+llama-server, the same fork monopolizes the GPU the user's next prompt
+needs, for minutes — and the next live turn cancels it, so an active
+session tends to pay the decode cost AND lose the learning.
+
+This module keeps the decision to learn exactly where it was (turn end,
+nudge intervals, full-strength model, full transcript) and moves only
+the execution moment: reviews bound for the managed local endpoint are
+queued and dispatched when the machine is quiet. Everything else runs
+immediately, as before.
+
+Policy (auxiliary.background_review.defer):
+    auto  (default) — defer exactly when the resolved review runtime
+                      targets the managed local server.
+    never           — old behavior everywhere.
+Explicit /refine (focus set) never defers: an explicit ask runs now,
+matching its bypass of the enabled gate.
+
+Queue semantics:
+- One slot per session, newest snapshot wins. A review replays the whole
+  conversation, so a newer snapshot strictly supersedes an older one —
+  coalescing is deduplication, not loss.
+- Preempted (cancelled-by-live-turn) reviews are requeued by the spawn
+  wrapper observing the run token's cancel flag, not killed-and-forgotten.
+- Aged-out events (defer_max_age_s, default 30 min) dispatch regardless
+  of idleness — deferral may delay learning, never lose it.
+- In-memory, best-effort: dropped on process exit, the same durability
+  contract the immediate daemon-thread fork always had.
+
+Idle truth comes from the supervisor's /slots (machine-level: it sees
+every client of the managed server, including other Hermes profiles) and
+must hold for a settle window so a review is not launched into the gap
+between two quick prompts. Local in-process turn liveness is tracked via
+note_turn_started/note_turn_finished from run_conversation.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+import time
+import urllib.request
+from typing import Any, Callable, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+# Sustained-quiet window before dispatch. Long enough that "typed two
+# prompts back to back" does not look idle; short enough that walking
+# away for coffee runs the queue.
+_IDLE_SETTLE_S = 15.0
+# Poll cadence while the queue is non-empty. The thread parks when empty.
+_POLL_INTERVAL_S = 5.0
+# Age at which a queued review dispatches regardless of idleness.
+_MAX_AGE_DEFAULT_S = 30.0 * 60.0
+
+
+def defer_mode(task_cfg: Optional[Dict[str, Any]]) -> str:
+    """'auto' (default) or 'never' from auxiliary.background_review.defer."""
+    raw = str((task_cfg or {}).get("defer", "auto")).strip().lower()
+    return raw if raw in ("auto", "never") else "auto"
+
+
+def defer_max_age_s(task_cfg: Optional[Dict[str, Any]]) -> float:
+    raw = (task_cfg or {}).get("defer_max_age_s", _MAX_AGE_DEFAULT_S)
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return _MAX_AGE_DEFAULT_S
+    return value if value > 0 else _MAX_AGE_DEFAULT_S
+
+
+def review_targets_managed_local(agent: Any,
+                                 task_cfg: Optional[Dict[str, Any]]) -> bool:
+    """Would this review fork decode on the llama-server WE manage?
+
+    Resolves the review runtime the same way the fork itself will and
+    exact-matches its netloc against the supervisor state file — the
+    matcher that cannot false-positive on external local servers. Any
+    failure reads False: immediate spawn is always the safe default.
+
+    Order matters: the netloc probe (one TTL-cached state-file read)
+    runs FIRST, so machines with no managed server — every cloud-only
+    install — return False without resolving the review runtime at all.
+    This wrapper runs on the turn's tail; runtime resolution belongs on
+    that path only when a managed server actually exists.
+    """
+    try:
+        from agent.auxiliary_client import (
+            _is_managed_local_endpoint,
+            _managed_local_netloc,
+        )
+
+        if not _managed_local_netloc():
+            return False
+        from agent.background_review import _resolve_review_runtime
+
+        runtime = _resolve_review_runtime(agent, task_cfg)
+        return _is_managed_local_endpoint(runtime.get("base_url"))
+    except Exception:  # noqa: BLE001
+        return False
+
+
+class _PendingReview:
+    __slots__ = ("agent", "kwargs", "enqueued_at", "session_key")
+
+    def __init__(self, agent: Any, session_key: str, kwargs: Dict[str, Any]):
+        self.agent = agent
+        self.session_key = session_key
+        self.kwargs = kwargs
+        self.enqueued_at = time.monotonic()
+
+
+class ReviewIdleQueue:
+    """Session-coalescing queue + idle-gated dispatcher thread."""
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._pending: Dict[str, _PendingReview] = {}
+        self._wake = threading.Event()
+        self._thread: Optional[threading.Thread] = None
+        self._live_turns = 0
+        self._quiet_since: Optional[float] = None
+        # Test seams — replaced by unit tests, never in production.
+        self._now: Callable[[], float] = time.monotonic
+        self._server_idle: Callable[[], bool] = _managed_server_idle
+
+    # ── turn liveness (this process) ────────────────────────────
+
+    def note_turn_started(self) -> None:
+        with self._lock:
+            self._live_turns += 1
+            self._quiet_since = None
+
+    def note_turn_finished(self) -> None:
+        with self._lock:
+            self._live_turns = max(0, self._live_turns - 1)
+            if self._live_turns == 0:
+                self._quiet_since = self._now()
+        self._wake.set()
+
+    # ── queue ────────────────────────────────────────────────────
+
+    def enqueue(self, agent: Any, session_key: str,
+                kwargs: Dict[str, Any]) -> None:
+        """Add (or replace — newest snapshot wins) a session's pending review."""
+        with self._lock:
+            existing = self._pending.get(session_key)
+            item = _PendingReview(agent, session_key, kwargs)
+            # Stamp through the queue's clock (test seam); keep the ORIGINAL
+            # enqueue time on coalesce so a busy session cannot push its
+            # review's age-out forever.
+            item.enqueued_at = (existing.enqueued_at if existing is not None
+                                else self._now())
+            self._pending[session_key] = item
+        self._ensure_thread()
+        self._wake.set()
+        logger.info("Background review deferred (session=%s, queued=%d)",
+                    session_key[-12:], len(self._pending))
+
+    def pending_count(self) -> int:
+        with self._lock:
+            return len(self._pending)
+
+    # ── dispatcher ───────────────────────────────────────────────
+
+    def _ensure_thread(self) -> None:
+        with self._lock:
+            if self._thread is None or not self._thread.is_alive():
+                self._thread = threading.Thread(
+                    target=self._run, daemon=True, name="bg-review-idle-queue")
+                self._thread.start()
+
+    def _quiet_for(self) -> float:
+        """Seconds this process has been turn-free (0 while a turn runs)."""
+        with self._lock:
+            if self._live_turns > 0 or self._quiet_since is None:
+                return 0.0
+            return self._now() - self._quiet_since
+
+    def _pop_dispatchable(self) -> Optional[_PendingReview]:
+        """Oldest aged-out item, else any item once quiet+idle hold."""
+        with self._lock:
+            if not self._pending:
+                return None
+            items = sorted(self._pending.values(),
+                           key=lambda p: p.enqueued_at)
+            aged = [p for p in items
+                    if self._now() - p.enqueued_at
+                    >= defer_max_age_s(p.kwargs.get("task_cfg"))]
+            candidate = aged[0] if aged else None
+        if candidate is None:
+            if self._quiet_for() < _IDLE_SETTLE_S:
+                return None
+            if not self._server_idle():
+                return None
+            with self._lock:
+                if not self._pending:
+                    return None
+                candidate = min(self._pending.values(),
+                                key=lambda p: p.enqueued_at)
+        with self._lock:
+            return self._pending.pop(candidate.session_key, None)
+
+    def _run(self) -> None:
+        while True:
+            self._wake.wait()
+            with self._lock:
+                if not self._pending:
+                    self._wake.clear()
+                    continue
+            item = None
+            try:
+                item = self._pop_dispatchable()
+                if item is not None:
+                    if not self._still_enabled(item):
+                        logger.info(
+                            "Deferred background review dropped: reviews "
+                            "were disabled while it was queued (session=%s)",
+                            item.session_key[-12:])
+                        continue
+                    logger.info(
+                        "Dispatching deferred background review "
+                        "(session=%s, waited=%.0fs, queued=%d)",
+                        item.session_key[-12:],
+                        self._now() - item.enqueued_at,
+                        self.pending_count())
+                    item.agent._spawn_background_review_now(**item.kwargs)
+            except Exception:  # noqa: BLE001 — dispatcher must survive anything
+                logger.warning("Deferred review dispatch failed",
+                               exc_info=True)
+            if item is None:
+                time.sleep(_POLL_INTERVAL_S)
+
+    @staticmethod
+    def _still_enabled(item: _PendingReview) -> bool:
+        """Re-check the enabled gate at DISPATCH time.
+
+        The entry wrapper gates at enqueue time, but minutes may pass in
+        the queue — a user who sets background_review.enabled: false while
+        a review waits means it, and the dispatch must not resurrect it.
+        Fail-open like the gate itself (a broken config never silently
+        disables reviews)."""
+        try:
+            from agent.background_review import load_background_review_settings
+
+            enabled, _ = load_background_review_settings()
+            return enabled
+        except Exception:  # noqa: BLE001
+            return True
+
+
+def _managed_server_idle() -> bool:
+    """Machine-level idle: no processing slot on any loaded model of the
+    managed router. Unreachable/no state file reads idle (nothing to
+    contend with). One /models + one /slots call per loaded model."""
+    try:
+        from hermes_cli.local_runtime.supervisor import state_path
+
+        state = json.loads(state_path().read_text(encoding="utf-8"))
+        base = str(state.get("base_url", "")).rsplit("/v1", 1)[0]
+        key = str(state.get("api_key", ""))
+        if not base:
+            return True
+        headers = {"Authorization": f"Bearer {key}"}
+        req = urllib.request.Request(f"{base}/models", headers=headers)
+        with urllib.request.urlopen(req, timeout=3) as r:
+            models = json.loads(r.read())
+        loaded = [m["id"] for m in models.get("data", [])
+                  if (m.get("status") or {}).get("value") in ("loaded", "ready")]
+        from urllib.parse import quote
+
+        for mid in loaded:
+            req = urllib.request.Request(f"{base}/slots?model={quote(mid)}",
+                                         headers=headers)
+            with urllib.request.urlopen(req, timeout=3) as r:
+                slots = json.loads(r.read())
+            if any(s.get("is_processing") for s in slots
+                   if isinstance(s, dict)):
+                return False
+        return True
+    except Exception:  # noqa: BLE001
+        return True
+
+
+# Module singleton — one queue per process, like the load-progress watcher.
+QUEUE = ReviewIdleQueue()
diff --git a/agent/runtime_cwd.py b/agent/runtime_cwd.py
index 712e38ed13..bcd776e65b 100644
--- a/agent/runtime_cwd.py
+++ b/agent/runtime_cwd.py
@@ -57,6 +57,31 @@ def _session_cwd_override() -> str:
     return str(value).strip()
 
 
+def _terminal_cwd_env() -> str:
+    """Scope-aware TERMINAL_CWD read (tools.terminal_scope.terminal_env).
+
+    Under gateway multiplexing the per-turn terminal scope carries the active
+    profile's cwd; the process-global env var may hold another profile's
+    value. Only an import failure falls back: an active refusal scope must
+    raise, not silently resolve the launch profile's cwd.
+    """
+    try:
+        from tools.terminal_scope import terminal_env
+    except ImportError:
+        return os.environ.get("TERMINAL_CWD", "")
+    return terminal_env("TERMINAL_CWD", "")
+
+
+def scope_terminal_cwd() -> str:
+    """Public wrapper — the scope-aware TERMINAL_CWD value (may be empty).
+
+    Shared by agent_init / skill_utils / code_execution_tool so every cwd
+    consumer reads through the per-turn terminal scope under gateway
+    multiplexing instead of the process-global env var.
+    """
+    return _terminal_cwd_env()
+
+
 def resolve_agent_cwd() -> Path:
     override = _session_cwd_override()
     if override:
@@ -64,7 +89,7 @@ def resolve_agent_cwd() -> Path:
         if p.is_dir():
             return p
         logger.warning("configured working directory does not exist: %s", override)
-    raw = os.environ.get("TERMINAL_CWD", "").strip()
+    raw = _terminal_cwd_env().strip()
     if raw:
         p = Path(raw).expanduser()
         if p.is_dir():
@@ -90,7 +115,7 @@ def resolve_context_cwd() -> Path | None:
         else:
             return p
         return None
-    raw = os.environ.get("TERMINAL_CWD", "").strip()
+    raw = _terminal_cwd_env().strip()
     if raw:
         p = Path(raw).expanduser()
         if not p.is_dir():
diff --git a/agent/shell_hooks.py b/agent/shell_hooks.py
index 8751aeb6fd..49dfa9301e 100644
--- a/agent/shell_hooks.py
+++ b/agent/shell_hooks.py
@@ -182,13 +182,17 @@ _BLOCKING_EVENTS = frozenset({"pre_tool_call"})
 _STDERR_MESSAGE_LIMIT = 400
 
 
-# (event, matcher, command) triples that have been wired to the plugin
+# (home, event, matcher, command) tuples that have been wired to the plugin
 # manager in the current process.  Matcher is part of the key because
 # the same script can legitimately register for different matchers under
-# the same event (e.g. one entry per tool the user wants to gate).
-# Second registration attempts for the exact same triple become no-ops
+# the same event (e.g. one entry per tool the user wants to gate). Home is
+# part of the key so a multiplexed gateway's secondary profiles — each with
+# their own plugin manager (see hermes_cli.plugins.get_plugin_manager) — can
+# register identical hook triples without the first profile's registration
+# silently shadowing the rest.
+# Second registration attempts for the exact same tuple become no-ops
 # so the CLI and gateway can both call register_from_config() safely.
-_registered: Set[Tuple[str, Optional[str], str]] = set()
+_registered: Set[Tuple[str, str, Optional[str], str]] = set()
 _registered_lock = threading.Lock()
 
 # Intra-process lock for allowlist read-modify-write on platforms that
@@ -289,13 +293,14 @@ def register_from_config(
     from hermes_cli.plugins import get_plugin_manager
 
     manager = get_plugin_manager()
+    home_key = str(get_hermes_home().expanduser().resolve())
 
     # Idempotence + allowlist read happen under the lock; the TTY
     # prompt runs outside so other threads aren't parked on a blocking
     # input().  Mutation re-takes the lock with a defensive idempotence
     # re-check in case two callers ever race through the prompt.
     for spec in specs:
-        key = (spec.event, spec.matcher, spec.command)
+        key = (home_key, spec.event, spec.matcher, spec.command)
         with _registered_lock:
             if key in _registered:
                 continue
@@ -349,11 +354,20 @@ def re_register_config_hooks() -> None:
     are wired again (#60036 / PR #60267; tracking #64178 — salvaged from
     PR #64188).
 
+    Only the idempotence keys for the *current* Hermes home are cleared —
+    ``discover_and_load(force=True)`` only unloads the manager scoped to
+    that one home, so clearing every home's keys would make a force-reload
+    in profile A drop profile B's still-live registration from the ledger
+    and duplicate it on B's next registration call (#92682 review).
+
     Commands already allowlisted stay allowlisted, so this never re-prompts
     at a TTY for hooks the user previously approved.
     """
+    home_key = str(get_hermes_home().expanduser().resolve())
     with _registered_lock:
-        _registered.clear()
+        _registered.difference_update(
+            {key for key in _registered if key[0] == home_key}
+        )
     from hermes_cli.config import load_config
 
     register_from_config(load_config())
diff --git a/agent/skill_commands.py b/agent/skill_commands.py
index 6b776e1f68..9851fdb750 100644
--- a/agent/skill_commands.py
+++ b/agent/skill_commands.py
@@ -236,7 +236,7 @@ def _load_skill_payload(skill_identifier: str, task_id: str | None = None) -> tu
         return None
 
     try:
-        from tools.skills_tool import SKILLS_DIR, skill_view
+        from tools.skills_tool import _skills_dir, skill_view
         from agent.skill_utils import normalize_skill_lookup_name
 
         normalized = normalize_skill_lookup_name(raw_identifier)
@@ -262,7 +262,7 @@ def _load_skill_payload(skill_identifier: str, task_id: str | None = None) -> tu
         skill_dir = Path(abs_skill_dir)
     elif skill_path:
         try:
-            skill_dir = SKILLS_DIR / Path(skill_path).parent
+            skill_dir = _skills_dir() / Path(skill_path).parent
         except Exception:
             skill_dir = None
 
@@ -317,7 +317,7 @@ def _build_skill_message(
     session_id: str | None = None,
 ) -> str:
     """Format a loaded skill into a user/system message payload."""
-    from tools.skills_tool import SKILLS_DIR
+    from tools.skills_tool import _skills_dir
 
     content = str(loaded_skill.get("content") or "")
 
@@ -386,7 +386,7 @@ def _build_skill_message(
 
     if supporting and skill_dir:
         try:
-            skill_view_target = str(skill_dir.relative_to(SKILLS_DIR))
+            skill_view_target = str(skill_dir.relative_to(_skills_dir()))
         except ValueError:
             # Skill is from an external dir — use the skill name instead
             skill_view_target = skill_dir.name
@@ -441,7 +441,7 @@ def scan_skill_commands() -> Dict[str, Dict[str, Any]]:
     # each naming the same skill as its own incumbent (#74574).
     commands: Dict[str, Dict[str, Any]] = {}
     try:
-        from tools.skills_tool import SKILLS_DIR, _parse_frontmatter, skill_matches_platform, skill_matches_environment, _get_disabled_skill_names
+        from tools.skills_tool import _skills_dir, _parse_frontmatter, skill_matches_platform, skill_matches_environment, _get_disabled_skill_names
         from agent.skill_utils import (
             get_external_skills_dirs,
             get_project_skills_dirs,
@@ -456,8 +456,12 @@ def scan_skill_commands() -> Dict[str, Dict[str, Any]]:
         # Project dirs iterate through the quarantine chokepoint.
         project_dirs = list(get_project_skills_dirs())
         dirs_to_scan = list(project_dirs)
-        if SKILLS_DIR.exists():
-            dirs_to_scan.append(SKILLS_DIR)
+        # Resolve at call time: the import-time SKILLS_DIR is frozen to the
+        # launch home, so a multiplexed profile scope (set_hermes_home_override)
+        # would still scan the default profile's skills (#67277).
+        skills_dir = _skills_dir()
+        if skills_dir.exists():
+            dirs_to_scan.append(skills_dir)
         dirs_to_scan.extend(get_external_skills_dirs())
 
         for scan_dir in dirs_to_scan:
diff --git a/agent/skill_utils.py b/agent/skill_utils.py
index 47837d14e4..a3ab4133ec 100644
--- a/agent/skill_utils.py
+++ b/agent/skill_utils.py
@@ -755,7 +755,9 @@ def find_project_root(start: Optional[Path] = None) -> Optional[Path]:
     """
     try:
         if start is None:
-            env_cwd = os.environ.get("TERMINAL_CWD")
+            from agent.runtime_cwd import scope_terminal_cwd
+
+            env_cwd = scope_terminal_cwd()
             start = Path(env_cwd) if env_cwd else Path.cwd()
         cur = Path(start).resolve()
     except OSError:
@@ -994,12 +996,15 @@ def normalize_skill_lookup_name(identifier: str) -> str:
     # Look the primary skills root up on tools.skills_tool at CALL time
     # (not via get_skills_dir()): callers and tests patch
     # ``tools.skills_tool.SKILLS_DIR`` and skill_view() itself resolves
-    # against that module attribute, so normalization must agree with the
-    # exact root skill_view() will enforce.  Import deferred to avoid a
-    # module cycle (tools.skills_tool imports agent.skill_utils).
+    # against ``_skills_dir()`` — which honors that patch and otherwise
+    # follows the live profile-scoped HERMES_HOME (the import-time
+    # SKILLS_DIR is frozen to the launch home, #67277) — so normalization
+    # must agree with the exact root skill_view() will enforce.  Import
+    # deferred to avoid a module cycle (tools.skills_tool imports
+    # agent.skill_utils).
     try:
         from tools import skills_tool as _skills_tool
-        primary_root = Path(_skills_tool.SKILLS_DIR)
+        primary_root = _skills_tool._skills_dir()
     except Exception:
         primary_root = get_skills_dir()
 
diff --git a/agent/tool_executor.py b/agent/tool_executor.py
index 5ee9da8444..f1a04c3718 100644
--- a/agent/tool_executor.py
+++ b/agent/tool_executor.py
@@ -1151,6 +1151,10 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
     parsed_calls = []
     for tool_call in tool_calls:
         function_name = tool_call.function.name
+        # Legacy tool-name aliases (2026-08 renames) — map BEFORE the
+        # agent-loop branches (todo_list etc. dispatch above the registry).
+        from model_tools import _LEGACY_TOOL_ALIASES as _lta
+        function_name = _lta.get(function_name, function_name)
 
         function_args, malformed_args_result = _parse_tool_arguments(
             tool_call.function.arguments
@@ -1192,9 +1196,9 @@ def execute_tool_calls_concurrent(agent, assistant_message, messages: list, effe
                 _underlying, _underlying_args, _err = _ts.resolve_underlying_call(function_args)
                 if not _err and _underlying:
                     if _underlying in _tool_search_scoped_names(agent):
-                        # Probe-validate before unwrapping (ironclaw#5149):
-                        # missing required args return the parameter schema
-                        # instead of dispatching into an opaque failure.
+                        # Validate before unwrapping: the generic bridge hides
+                        # the concrete parameter schema from provider-native
+                        # tool-call validation.
                         _probe_err = _ts.validate_deferred_call_args(_underlying, _underlying_args)
                         if _probe_err is not None:
                             _ts_scope_block = _probe_err
@@ -2007,6 +2011,10 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
             break
 
         function_name = tool_call.function.name
+        # Legacy tool-name aliases (2026-08 renames) — map BEFORE the
+        # agent-loop branches (todo_list etc. dispatch above the registry).
+        from model_tools import _LEGACY_TOOL_ALIASES as _lta
+        function_name = _lta.get(function_name, function_name)
 
         function_args, malformed_args_result = _parse_tool_arguments(
             tool_call.function.arguments
@@ -2048,9 +2056,9 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
                 _underlying, _underlying_args, _err = _ts.resolve_underlying_call(function_args)
                 if not _err and _underlying:
                     if _underlying in _tool_search_scoped_names(agent):
-                        # Probe-validate before unwrapping (ironclaw#5149):
-                        # missing required args return the parameter schema
-                        # instead of dispatching into an opaque failure.
+                        # Validate before unwrapping: the generic bridge hides
+                        # the concrete parameter schema from provider-native
+                        # tool-call validation.
                         _probe_err = _ts.validate_deferred_call_args(_underlying, _underlying_args)
                         if _probe_err is not None:
                             # This path wraps _block_msg in {"error": ...} —
@@ -2081,7 +2089,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
 
         tool_start_time = time.time()
 
-        if function_name == "todo":
+        if function_name == "todo_list":
             def _execute(next_args: dict) -> Any:
                 from tools.todo_tool import todo_tool as _todo_tool
                 return _todo_tool(
@@ -2101,7 +2109,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
             ))
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
-                agent._vprint(f"  {_get_cute_tool_message_impl('todo', function_args, tool_duration, result=function_result)}")
+                agent._vprint(f"  {_get_cute_tool_message_impl('todo_list', function_args, tool_duration, result=function_result)}")
         elif function_name == "message_agent":
             # Bot Mode teammate DM (tools/bot_mode_dm.py) — injected, not
             # registered: only a canonical Bot Chat session carries the
@@ -2336,7 +2344,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
                 agent._vprint(f"  {_get_cute_tool_message_impl('read_window_below', function_args, tool_duration, result=function_result)}")
-        elif function_name == "tour":
+        elif function_name == "gui_tour":
             def _execute(next_args: dict) -> Any:
                 from tools.tour_tool import tour_tool as _tour_tool
                 return _tour_tool(
@@ -2362,7 +2370,7 @@ def execute_tool_calls_sequential(agent, assistant_message, messages: list, effe
             ))
             tool_duration = time.time() - tool_start_time
             if agent._should_emit_quiet_tool_messages():
-                agent._vprint(f"  {_get_cute_tool_message_impl('tour', function_args, tool_duration, result=function_result)}")
+                agent._vprint(f"  {_get_cute_tool_message_impl('gui_tour', function_args, tool_duration, result=function_result)}")
         elif function_name == "setup_mcp":
             def _execute(next_args: dict) -> Any:
                 from tools.setup_mcp_tool import setup_mcp_tool as _setup_mcp_tool
diff --git a/agent/tool_guardrails.py b/agent/tool_guardrails.py
index ff30ee516c..b432c21d9f 100644
--- a/agent/tool_guardrails.py
+++ b/agent/tool_guardrails.py
@@ -24,6 +24,8 @@ IDEMPOTENT_TOOL_NAMES = frozenset(
         "web_search",
         "web_extract",
         "session_search",
+        "skill_view",
+        "skills_list",
         "browser_snapshot",
         "browser_console",
         "browser_get_images",
@@ -44,7 +46,7 @@ MUTATING_TOOL_NAMES = frozenset(
         "execute_code",
         "write_file",
         "patch",
-        "todo",
+        "todo_list",
         "memory",
         "skill_manage",
         "browser_click",
@@ -53,9 +55,9 @@ MUTATING_TOOL_NAMES = frozenset(
         "browser_scroll",
         "browser_navigate",
         "send_message",
-        "cronjob",
+        "cronjob_manage",
         "delegate_task",
-        "process",
+        "process_manage",
     }
 )
 
@@ -67,7 +69,7 @@ MUTATING_TOOL_NAMES = frozenset(
 # unannotated.
 STALL_GUARD_REPEATABLE_TOOLS = frozenset(
     {
-        "process",
+        "process_manage",
     }
 )
 
@@ -98,6 +100,49 @@ IDENTICAL_RESULT_STUB_MIN_CHARS = 512
 _RESULT_STUB_ARGS_PREVIEW_CHARS = 120
 
 
+# Tools whose "failure" is a normal, informative outcome of legitimate work:
+# a red test run, a grep with no matches, a failing build during a fix loop, a
+# page that times out. Hard stops never fire on these from failure counts of
+# DIFFERENT commands (same_tool_failure) — only an exact-args replay with NO
+# intervening change, or an identical-result streak, can halt them.
+FAILURE_TOLERANT_TOOL_NAMES = frozenset(
+    {
+        "terminal",
+        "execute_code",
+        "process_manage",
+        "process",
+        "browser_navigate",
+        "web_extract",
+    }
+)
+
+# A landed mutation between two attempts means the retry is a NEW experiment
+# (edit -> re-run) rather than a replay. A successful call to one of these
+# marks progress for every failing signature still being counted this turn.
+PROGRESS_RESET_TOOL_NAMES = frozenset(
+    {
+        "write_file",
+        "patch",
+        "terminal",
+        "execute_code",
+        "browser_click",
+        "browser_type",
+        "browser_press",
+        "browser_navigate",
+        "process_manage",
+        "process",
+        "delegate_task",
+        "send_message",
+        "cronjob",
+        "cronjob_manage",
+        "todo",
+        "todo_list",
+        "memory",
+        "skill_manage",
+    }
+)
+
+
 def is_stall_guard_repeatable(tool_name: str) -> bool:
     """Whether a tool is exempt from the identical-call loop notice."""
     if tool_name in STALL_GUARD_REPEATABLE_TOOLS:
@@ -110,12 +155,14 @@ class ToolCallGuardrailConfig:
     """Thresholds for per-turn tool-call loop detection.
 
     Warnings are enabled by default and never prevent tool execution. Hard stops
-    are explicit opt-in so interactive CLI/TUI sessions get a gentle nudge unless
-    the user enables circuit-breaker behavior in config.yaml.
+    stay opt-in for interactive CLI/TUI/Desktop/ACP sessions, but default on for
+    non-interactive gateway/cron platforms where nobody is present to interrupt
+    a model that ignores loop warnings.
     """
 
     warnings_enabled: bool = True
     hard_stop_enabled: bool = False
+    non_interactive_hard_stop_enabled: bool = True
     exact_failure_warn_after: int = 2
     exact_failure_block_after: int = 5
     same_tool_failure_warn_after: int = 3
@@ -127,10 +174,15 @@ class ToolCallGuardrailConfig:
     loop_caps: "LoopCapConfig" = field(default_factory=lambda: LoopCapConfig())
 
     @classmethod
-    def from_mapping(cls, data: Mapping[str, Any] | None) -> "ToolCallGuardrailConfig":
+    def from_mapping(
+        cls,
+        data: Mapping[str, Any] | None,
+        *,
+        platform: str | None = None,
+    ) -> "ToolCallGuardrailConfig":
         """Build config from the `tool_loop_guardrails` config.yaml section."""
         if not isinstance(data, Mapping):
-            return cls()
+            data = {}
 
         warn_after = data.get("warn_after")
         if not isinstance(warn_after, Mapping):
@@ -140,9 +192,18 @@ class ToolCallGuardrailConfig:
             hard_stop_after = {}
 
         defaults = cls()
+        hard_stop_enabled = _as_bool(data.get("hard_stop_enabled"), defaults.hard_stop_enabled)
+        non_interactive_hard_stop_enabled = _as_bool(
+            data.get("non_interactive_hard_stop_enabled"),
+            defaults.non_interactive_hard_stop_enabled,
+        )
+        if _is_non_interactive_platform(platform) and non_interactive_hard_stop_enabled:
+            hard_stop_enabled = True
+
         return cls(
             warnings_enabled=_as_bool(data.get("warnings_enabled"), defaults.warnings_enabled),
-            hard_stop_enabled=_as_bool(data.get("hard_stop_enabled"), defaults.hard_stop_enabled),
+            hard_stop_enabled=hard_stop_enabled,
+            non_interactive_hard_stop_enabled=non_interactive_hard_stop_enabled,
             exact_failure_warn_after=_positive_int(
                 warn_after.get("exact_failure", data.get("exact_failure_warn_after")),
                 defaults.exact_failure_warn_after,
@@ -218,6 +279,25 @@ class LoopCapConfig:
         )
 
 
+_INTERACTIVE_PLATFORMS = frozenset({"cli", "tui", "desktop", "acp"})
+
+# Platforms that are not chat gateways but whose work is a bounded, supervised
+# task loop: a subagent inherits its parent's budget and is stopped by the
+# parent; api_server runs have a live client holding the request. Both do
+# real edit -> re-run work, so they keep the interactive (warn-only) default.
+_SUPERVISED_TASK_PLATFORMS = frozenset({"subagent", "api_server"})
+
+
+def _is_non_interactive_platform(platform: str | None) -> bool:
+    """Return true for gateway/cron sessions where tool loops are unattended."""
+    if not isinstance(platform, str) or not platform.strip():
+        return False
+    key = platform.strip().lower()
+    if key in _INTERACTIVE_PLATFORMS or key in _SUPERVISED_TASK_PLATFORMS:
+        return False
+    return True
+
+
 @dataclass(frozen=True)
 class IdenticalCallObservation:
     """Outcome of observing one completed tool call for the stall guards.
@@ -340,6 +420,8 @@ class ToolCallGuardrailController:
     def reset_for_turn(self) -> None:
         self._exact_failure_counts: dict[ToolCallSignature, int] = {}
         self._same_tool_failure_counts: dict[str, int] = {}
+        # signature -> a mutating call succeeded since its last failure
+        self._progress_since_failure: dict[ToolCallSignature, bool] = {}
         self._no_progress: dict[ToolCallSignature, tuple[str, int]] = {}
         self._halt_decision: ToolGuardrailDecision | None = None
         # Identical-call loop-breaker state (agent.stall_guards): tracks the
@@ -389,6 +471,10 @@ class ToolCallGuardrailController:
             return ToolGuardrailDecision(tool_name=tool_name, signature=signature)
 
         exact_count = self._exact_failure_counts.get(signature, 0)
+        if self._progress_since_failure.get(signature):
+            # Something landed since this call last failed — let it run; the
+            # streak restarts in after_call if it fails again.
+            exact_count = 0
         if exact_count >= self.config.exact_failure_block_after:
             decision = ToolGuardrailDecision(
                 action="block",
@@ -441,6 +527,12 @@ class ToolCallGuardrailController:
             failed, _ = classify_tool_failure(tool_name, result)
 
         if failed:
+            # An identical failing call is only a REPLAY if nothing landed in
+            # between. If any mutating call succeeded since the previous
+            # identical failure (edit -> re-run pytest, click -> re-snapshot),
+            # the retry is a new experiment: restart the exact-args streak.
+            if self._progress_since_failure.pop(signature, False):
+                self._exact_failure_counts.pop(signature, None)
             exact_count = self._exact_failure_counts.get(signature, 0) + 1
             self._exact_failure_counts[signature] = exact_count
             self._no_progress.pop(signature, None)
@@ -448,7 +540,17 @@ class ToolCallGuardrailController:
             same_count = self._same_tool_failure_counts.get(tool_name, 0) + 1
             self._same_tool_failure_counts[tool_name] = same_count
 
-            if self.config.hard_stop_enabled and same_count >= self.config.same_tool_failure_halt_after:
+            # same_tool_failure counts DIFFERENT args on one tool. For tools
+            # whose non-zero exit is ordinary work output (terminal,
+            # execute_code, pollers) a run of distinct red commands is
+            # diagnosis, not a loop — warn, never halt. The exact-args replay
+            # path still applies to them.
+            same_tool_halt_eligible = tool_name not in FAILURE_TOLERANT_TOOL_NAMES
+            if (
+                self.config.hard_stop_enabled
+                and same_tool_halt_eligible
+                and same_count >= self.config.same_tool_failure_halt_after
+            ):
                 decision = ToolGuardrailDecision(
                     action="halt",
                     code="same_tool_failure_halt",
@@ -492,6 +594,16 @@ class ToolCallGuardrailController:
         self._exact_failure_counts.pop(signature, None)
         self._same_tool_failure_counts.pop(tool_name, None)
 
+        # A successful mutation is progress for every failing signature still
+        # being counted this turn: the next identical retry runs against
+        # changed state, so it is a fresh attempt rather than a replay. Pure
+        # loops never mutate anything between attempts, so the replay detector
+        # keeps its teeth.
+        if tool_name in PROGRESS_RESET_TOOL_NAMES or file_mutation_result_landed(tool_name, result):
+            for sig in list(self._exact_failure_counts):
+                self._progress_since_failure[sig] = True
+            self._same_tool_failure_counts.clear()
+
         if not self._is_idempotent(tool_name):
             self._no_progress.pop(signature, None)
             return ToolGuardrailDecision(tool_name=tool_name, signature=signature)
@@ -604,6 +716,31 @@ class ToolCallGuardrailController:
                 "Do not repeat it — change arguments, use a different tool, or "
                 "proceed with what you have.]"
             )
+            # Hard-stop widening (#89069 / #100849 bundle): the per-turn
+            # no-progress BLOCK above only covers tools in idempotent_tools, so
+            # a model replaying the same successful `terminal`/`skill_view`
+            # call with a byte-identical result ran until the iteration budget.
+            # The consecutive-identical streak is tool-agnostic; when hard
+            # stops are enabled, halt at the same idempotent_no_progress
+            # threshold. Pollers stay exempt (an unchanged poll is progress).
+            if (
+                self.config.hard_stop_enabled
+                and count >= self.config.no_progress_block_after
+                and self._halt_decision is None
+            ):
+                self._halt_decision = ToolGuardrailDecision(
+                    action="halt",
+                    code="identical_call_streak_halt",
+                    message=(
+                        f"Stopped {tool_name}: the same call with identical arguments "
+                        f"returned the same result {count} times in a row. Stop "
+                        "repeating it unchanged; use the result already provided or "
+                        "change strategy."
+                    ),
+                    tool_name=tool_name,
+                    count=count,
+                    signature=signature,
+                )
 
         stub = None
         if (
diff --git a/agent/transports/chat_completions.py b/agent/transports/chat_completions.py
index d2284b64d2..25b41be44d 100644
--- a/agent/transports/chat_completions.py
+++ b/agent/transports/chat_completions.py
@@ -767,9 +767,18 @@ class ChatCompletionsTransport(ProviderTransport):
                     extra_body["reasoning"] = gh_reasoning
             else:
                 _effort = "medium"
+                _enabled = True
                 if reasoning_config and isinstance(reasoning_config, dict):
                     _effort = reasoning_config.get("effort", "medium") or "medium"
-                extra_body["reasoning"] = {"enabled": True, "effort": _effort}
+                    # Honor an explicit "thinking off" (agent.reasoning_effort:
+                    # none / the one-shot length-continuation override) the same
+                    # way the provider-profile path does — never re-enable it.
+                    if reasoning_config.get("enabled") is False or _effort == "none":
+                        _enabled = False
+                if _enabled:
+                    extra_body["reasoning"] = {"enabled": True, "effort": _effort}
+                else:
+                    extra_body["reasoning"] = {"enabled": False, "effort": "none"}
 
         if provider_name == "gemini":
             raw_thinking_config = _build_gemini_thinking_config(model, reasoning_config)
diff --git a/agent/transports/codex.py b/agent/transports/codex.py
index ff8979edce..99bd2f65e6 100644
--- a/agent/transports/codex.py
+++ b/agent/transports/codex.py
@@ -59,7 +59,7 @@ def _bounded_prompt_cache_key(value: Any) -> Optional[str]:
 # A function literally named ``web_search`` collides with Grok's native
 # server-side tool (incomplete hang or HTTP 400 duplicate names); this alias
 # avoids that while still dispatching through Hermes's configured provider
-# (Firecrawl / Exa / …). Mapped back to ``web_search`` in normalize_response.
+# (Firecrawl / Tavily / …). Mapped back to ``web_search`` in normalize_response.
 _XAI_CLIENT_WEB_SEARCH_ALIAS = "hermes_web_search"
 
 # OpenCode's /v1/responses endpoints (Zen and Go, including custom providers
@@ -661,7 +661,7 @@ class ResponsesApiTransport(ProviderTransport):
         #    fails): drop the client ``web_search`` function and declare
         #    xAI's built-in instead. 1:1 swap only when client ``web_search``
         #    was already present — never an additive grant.
-        # 2. **Client** (Firecrawl / Keenable / Exa / … configured or resolved):
+        # 2. **Client** (Firecrawl / Tavily / Exa / … configured or resolved):
         #    keep Hermes dispatch so ``web.backend`` / ``web.search_backend``
         #    is honored, but rename the wire tool to
         #    ``hermes_web_search`` so Grok cannot hijack the name. The alias
diff --git a/agent/tts_provider.py b/agent/tts_provider.py
index c19166a702..075cab3f40 100644
--- a/agent/tts_provider.py
+++ b/agent/tts_provider.py
@@ -241,6 +241,22 @@ class TTSProvider(abc.ABC):
             "if your backend supports it."
         )
 
+    def warm(self) -> None:
+        """Speech output was just turned on; pre-load so the first reply is hot.
+
+        Optional. Called from the TTS lease path (Desktop read-aloud / voice
+        conversation, ``/voice tts``) when this provider is the configured
+        ``tts.provider`` — e.g. ask a local model server to load its model.
+        Best-effort: exceptions are logged at debug and ignored. Default: no-op.
+        """
+
+    def release(self) -> None:
+        """The last speech-output lease was released; free resident resources.
+
+        Optional counterpart of :meth:`warm` — e.g. tell a local model server
+        to unload. Best-effort; default: no-op.
+        """
+
     @property
     def voice_compatible(self) -> bool:
         """Whether output is suitable for voice-bubble delivery.
diff --git a/agent/turn_context.py b/agent/turn_context.py
index d14d584553..691b1de9c0 100644
--- a/agent/turn_context.py
+++ b/agent/turn_context.py
@@ -635,13 +635,18 @@ def build_turn_context(
     # Between-turns MCP refresh: an MCP server that finished connecting since
     # the previous turn (slow HTTP/OAuth servers routinely take 2-6s on a cold
     # connect, missing the bounded startup wait) lands in THIS turn's tool
-    # snapshot.  This is cache-safe by construction: it runs in the per-turn
+    # snapshot.  Timing is cache-safe by construction: it runs in the per-turn
     # prologue, before this turn's first API call assembles ``tools=``, so it
-    # only ever extends a fresh request prefix — it never mutates the cached
-    # prefix of an in-flight turn.  No-op when no MCP servers are registered
-    # (the common case, gated by the cheap ``has_registered_mcp_tools`` check)
-    # or when the tool set is unchanged (``refresh_agent_mcp_tools`` diffs by
-    # name and leaves the snapshot untouched on no-change).
+    # never mutates the prefix of an in-flight turn.  ``preserve_prefix`` makes
+    # the *content* cache-safe too (#100336): a plain rebuild re-derives the
+    # array from live availability, so a flapping ``check_fn`` silently drops a
+    # tool and a late arrival splices into sorted position — either one forks
+    # the tool block and re-prefills the whole history behind it, every turn it
+    # happens.  With the flag the live order is authoritative and the array
+    # only ever grows.  No-op when no MCP servers are registered (the common
+    # case, gated by the cheap ``has_registered_mcp_tools`` check) or when the
+    # tool set is unchanged (``refresh_agent_mcp_tools`` diffs by name and
+    # leaves the snapshot untouched on no-change).
     try:
         if not getattr(agent, "_skip_mcp_refresh", False):
             # Import-cost gate: ``tools.mcp_tool`` pulls in the whole ``mcp``
@@ -656,7 +661,9 @@ def build_turn_context(
             if "tools.mcp_tool" in _sys.modules:
                 from tools.mcp_tool import has_registered_mcp_tools, refresh_agent_mcp_tools
                 if has_registered_mcp_tools():
-                    refresh_agent_mcp_tools(agent, quiet_mode=True)
+                    refresh_agent_mcp_tools(
+                        agent, quiet_mode=True, preserve_prefix=True,
+                    )
     except Exception:
         logger.debug("between-turns MCP tool refresh skipped", exc_info=True)
 
@@ -1128,6 +1135,34 @@ def build_turn_context(
                         _compress_block_reason = _info(_preflight_tokens)[1]
                     except Exception:
                         _compress_block_reason = None
+        if _should_compress_now:
+            # Managed local runtime: growing the window beats compressing —
+            # the ladder's design order (same seam as the conversation
+            # loop's pre-API gate; see _maybe_grow_local_window there).
+            try:
+                from agent.conversation_loop import _maybe_grow_local_window
+
+                _grown = _maybe_grow_local_window(
+                    agent, _compressor, _preflight_tokens
+                )
+            except Exception:
+                _grown = None
+            if _grown:
+                _compressor.update_model(
+                    agent.model,
+                    _grown,
+                    base_url=getattr(agent, "base_url", "") or "",
+                    api_key=getattr(agent, "api_key", "") or "",
+                    provider=getattr(agent, "provider", "") or "",
+                    api_mode=getattr(agent, "api_mode", "") or "",
+                )
+                agent._buffer_status(
+                    f"📈 Context window grown to {_grown // 1024}K "
+                    f"(local model; conversation continues uncompressed)"
+                )
+                _should_compress_now = _compressor.should_compress(
+                    _preflight_tokens
+                )
         if _should_compress_now:
             _preflight_compressed = True
             # Compression is actually running (block cleared / was never
diff --git a/agent/turn_finalizer.py b/agent/turn_finalizer.py
index 193c56461d..93506f680c 100644
--- a/agent/turn_finalizer.py
+++ b/agent/turn_finalizer.py
@@ -126,6 +126,15 @@ def _drop_verification_continuation_scaffolding(messages) -> None:
     ]
 
 
+def _clone_background_review_messages(messages):
+    """Copy the review input without aliasing the live transcript."""
+    # Import lazily: conversation_loop imports this module during turn
+    # finalization, so a module-level import would create a cycle.
+    from agent.conversation_loop import _clone_message_for_send
+
+    return [_clone_message_for_send(message) for message in messages]
+
+
 def finalize_turn(
     agent,
     *,
@@ -810,6 +819,8 @@ def finalize_turn(
         and (_should_review_memory or _should_review_skills)
     ):
         try:
+            # _spawn_background_review clones the snapshot structurally so
+            # the fork's in-place sanitizers can't reach the live transcript.
             agent._spawn_background_review(
                 messages_snapshot=list(messages),
                 review_memory=_should_review_memory,
diff --git a/agent/turn_summary.py b/agent/turn_summary.py
index f4440afb50..5953629eb9 100644
--- a/agent/turn_summary.py
+++ b/agent/turn_summary.py
@@ -69,7 +69,7 @@ _VERB_GROUPS: dict[str, tuple[str, str, str]] = {
     "skill_view": ("read", "skill", "skills"),
     "skill_manage": ("updated", "skill", "skills"),
     "skills_list": ("listed skills", "time", "times"),
-    "todo": ("updated", "task list", "task lists"),
+    "todo_list": ("updated", "task list", "task lists"),
     "delegate_task": ("delegated", "task", "tasks"),
     "memory": ("updated", "memory", "memories"),
 }
diff --git a/agent/web_search_provider.py b/agent/web_search_provider.py
index f1abcc9b63..66cab340b6 100644
--- a/agent/web_search_provider.py
+++ b/agent/web_search_provider.py
@@ -13,8 +13,8 @@ Providers live in ``<repo>/plugins/web/<name>/`` (built-in, auto-loaded as
 ``plugins.enabled``).
 
 This ABC is the SINGLE plugin-facing surface for web providers — every
-provider in the tree (brave-free, ddgs, searxng, exa, parallel, keenable,
-firecrawl) implements it. The legacy in-tree ``tools.web_providers.base``
+provider in the tree (brave-free, ddgs, searxng, exa, parallel, tavily,
+keenable, firecrawl) implements it. The legacy in-tree ``tools.web_providers.base``
 ABCs were deleted in PR #25182 along with the per-vendor inline helpers
 in ``tools/web_tools.py``; the response-shape contract documented below
 is preserved bit-for-bit so the tool wrapper does not have to translate.
@@ -93,7 +93,7 @@ class WebSearchProvider(abc.ABC):
     :meth:`search` / :meth:`extract`. The :meth:`supports_search` /
     :meth:`supports_extract` capability flags let the registry route each
     tool call to the right provider, and let multi-capability providers
-    (Firecrawl, Keenable, Exa, …) advertise multiple capabilities from a
+    (Firecrawl, Tavily, Exa, …) advertise multiple capabilities from a
     single class.
     """
 
diff --git a/agent/web_search_registry.py b/agent/web_search_registry.py
index 5260272133..7f60ea838e 100644
--- a/agent/web_search_registry.py
+++ b/agent/web_search_registry.py
@@ -16,7 +16,7 @@ The active provider is chosen by configuration with this precedence:
 2. ``web.backend`` (shared fallback).
 3. If exactly one capability-eligible provider is registered AND available,
    use it.
-4. Legacy preference order — ``firecrawl`` → ``parallel`` →
+4. Legacy preference order — ``firecrawl`` → ``parallel`` → ``tavily`` →
    ``exa`` → ``searxng`` → ``brave-free`` → ``ddgs`` — filtered by
    availability. Matches the historic ``tools.web_tools._get_backend()``
    candidate order so installs that never set a config key keep landing
@@ -159,6 +159,7 @@ def _read_config_key(*path: str) -> Optional[str]:
 _LEGACY_PREFERENCE = (
     "firecrawl",
     "parallel",
+    "tavily",
     "exa",
     "searxng",
     "brave-free",
@@ -167,7 +168,7 @@ _LEGACY_PREFERENCE = (
 
 # Keyless free-tier walk — strictly LAST-resort, tried only after the
 # availability-filtered legacy walk finds nothing (i.e. the user has zero
-# web credentials and no importable ddgs). All five vendors expose public
+# web credentials and no importable ddgs). Ring vendors expose public
 # anonymous free tiers (see plugins/web/keyless_mcp.py). Unpinned keyless
 # traffic round-robins across the ring per request (the ring cursor lives
 # in keyless_mcp; an explicit `hermes tools` pick bypasses this walk
@@ -220,7 +221,7 @@ def _resolve(configured: Optional[str], *, capability: str) -> Optional[WebSearc
        supports *capability* AND ``is_available()`` reports True, return it.
 
     3. **Legacy preference walk, filtered by availability.** Walk the
-       :data:`_LEGACY_PREFERENCE` order (firecrawl → parallel →
+       :data:`_LEGACY_PREFERENCE` order (firecrawl → parallel → tavily →
        exa → searxng → brave-free → ddgs) looking for a provider whose
        ``supports_<capability>()`` is True AND whose ``is_available()`` is
        True. Matches the historic ``tools.web_tools._get_backend()``
diff --git a/apps/desktop/e2e/bot-mode-closed-chat-stays-closed.spec.ts b/apps/desktop/e2e/bot-mode-closed-chat-stays-closed.spec.ts
deleted file mode 100644
index 2a226c9a1b..0000000000
--- a/apps/desktop/e2e/bot-mode-closed-chat-stays-closed.spec.ts
+++ /dev/null
@@ -1,208 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-import {
-  buildAppEnv,
-  createSandbox,
-  launchDesktop,
-  type MockBackendFixture,
-  waitForAppReady,
-  writeEnvFile,
-  writeMockProviderConfig
-} from './fixtures'
-import { MOCK_REPLY, startMockServer } from '../../../tests-js/scripts/mock-server'
-import { RealSessionBuilder } from './real-session-builder'
-import { expect, test } from './test'
-
-// A bot row click is "go to this bot", not "open its Bot Chat". Before the
-// fix, every click resolved the canonical chat by name and opened it as a tab
-// again — a Bot Chat the user had closed came back beside every newer thread
-// on every bot switch, because nothing records a close (the plugin keeps no
-// closed set; core's tile bucket only forgets). Now a bot whose workspace
-// already holds tabs comes back to the one the user left; the forever-chat is
-// re-opened only by the explicit asks (row menu "Open Bot Chat", Bots home
-// "Open chat").
-
-type Page = MockBackendFixture['page']
-
-let fixture: MockBackendFixture | null = null
-
-async function openBots(page: Page): Promise<void> {
-  const tab = page
-    .getByRole('button', { name: 'Bots', exact: true })
-    .or(page.getByRole('tab', { name: 'Bots', exact: true }))
-    .first()
-
-  await tab.click()
-  await expect(page.getByRole('button', { name: 'New bot or group chat' })).toBeVisible()
-}
-
-/** A bot's backend spawns on its first open; give the wake a real chance to
- *  clear before the next gesture races it. Tolerant: the mock backend can
- *  keep a tile's "Waking up…" notice around. */
-async function settle(page: Page, timeout = 90_000): Promise<void> {
-  await page
-    .getByText(/Waking up/i)
-    .first()
-    .waitFor({ state: 'hidden', timeout })
-    .catch(() => undefined)
-  await page.waitForTimeout(500)
-}
-
-/** A first open right after a bot's backend spawned can strand on the
- *  profile socket (a separate, pre-existing reconnect race); a newer click
- *  supersedes it. Retry the gesture like a user would before giving up. */
-async function openUntil(action: () => Promise<void>, expected: () => Promise<void>, attempts = 3): Promise<void> {
-  for (let attempt = 1; ; attempt += 1) {
-    await action()
-
-    try {
-      await expected()
-
-      return
-    } catch (error) {
-      if (attempt >= attempts) {
-        throw error
-      }
-    }
-  }
-}
-
-const SCREENSHOT_DIR = process.env.BOT_MODE_SCREENSHOT_DIR
-
-async function snap(page: Page, name: string): Promise<void> {
-  if (SCREENSHOT_DIR) {
-    await page.screenshot({ path: `${SCREENSHOT_DIR}/${name}.png` })
-  }
-}
-
-/** The session tabs on the main strip (the Bots home tab may sit beside them). */
-const mainTabs = (page: Page) =>
-  page.evaluate(() =>
-    [...document.querySelectorAll<HTMLElement>('[data-zone-tabstrip="grp-main"] [data-tree-tab]')]
-      .map(element => element.getAttribute('data-tree-tab') ?? '')
-      .filter(id => id.startsWith('session-tile:'))
-  )
-
-/** Bots are profiles. Seeding one on disk before launch — with the mock
- *  provider so its own backend can answer, and a real, durable "Bot Chat"
- *  row (the plugin's canonical forever-chat, found by exact title) — keeps
- *  in-app creation and the intro turn it fires out of a scenario that is
- *  about the row click. With the row present, the click takes the open-as-
- *  tab path; without it, it would mint the chat into the workspace pane. */
-async function seedBot(hermesHome: string, mockUrl: string, name: string): Promise<void> {
-  const dir = path.join(hermesHome, 'profiles', name)
-  fs.mkdirSync(dir, { recursive: true })
-  writeMockProviderConfig(dir, mockUrl)
-  writeEnvFile(dir)
-
-  const builder = await RealSessionBuilder.start(dir)
-
-  try {
-    await builder.createSession({ title: 'Bot Chat', turns: [`Hello ${name}`] })
-  } finally {
-    await builder.close()
-  }
-}
-
-test.beforeAll(async () => {
-  const mock = await startMockServer()
-  const sandbox = createSandbox('bots')
-  writeMockProviderConfig(sandbox.hermesHome, mock.url)
-  writeEnvFile(sandbox.hermesHome)
-  await seedBot(sandbox.hermesHome, mock.url, 'alpha')
-  await seedBot(sandbox.hermesHome, mock.url, 'beta')
-
-  const { app, page } = await launchDesktop(buildAppEnv(sandbox))
-
-  fixture = {
-    app,
-    page,
-    mock,
-    mockUrl: mock.url,
-    sandbox,
-    cleanup: async () => {
-      await app.close().catch(() => undefined)
-      await mock.close()
-      sandbox.cleanup()
-    }
-  }
-  await waitForAppReady(fixture, 120_000)
-})
-
-test.afterAll(async () => {
-  await fixture?.cleanup()
-  fixture = null
-})
-
-test('a bot row click returns to the open thread and does not re-open a closed Bot Chat', async () => {
-  test.setTimeout(300_000)
-  const page = fixture!.page
-
-  await openBots(page)
-
-  const alphaRow = page.getByRole('button', { name: /^alpha\b/i }).filter({ visible: true }).first()
-  const betaRow = page.getByRole('button', { name: /^beta\b/i }).filter({ visible: true }).first()
-  await expect(alphaRow).toBeVisible({ timeout: 30_000 })
-  await expect(betaRow).toBeVisible({ timeout: 30_000 })
-  const botChatTab = page.getByRole('tab', { name: /Bot Chat/ }).filter({ visible: true })
-
-  // The first click on a bot with nothing open lands on its canonical chat.
-  await openUntil(
-    () => alphaRow.click(),
-    () => expect(botChatTab.first()).toBeVisible({ timeout: 45_000 })
-  )
-  await settle(page, 15_000)
-  await snap(page, '01-first-click-opens-bot-chat')
-
-  // Close it, then start a fresh thread for Alpha (⌘/Ctrl+T — the strip's
-  // "+" leaves with the zone's last tab).
-  await botChatTab.first().hover()
-  await botChatTab.first().getByRole('button', { name: 'Close' }).click({ force: true })
-  await expect(botChatTab).toHaveCount(0)
-
-  await page.keyboard.press('Control+t')
-  const composer = page.locator('[data-slot="composer-root"] [contenteditable="true"]').filter({ visible: true }).first()
-  await expect(composer).toBeVisible({ timeout: 15_000 })
-  await composer.click()
-  await composer.fill('hello alpha thread')
-  await page.keyboard.press('Enter')
-  await expect(page.getByText('hello alpha thread').filter({ visible: true }).first()).toBeVisible({ timeout: 15_000 })
-  // The reply also becomes the tab's (clipped) title — match the visible copy.
-  await expect(page.getByText(MOCK_REPLY).filter({ visible: true }).first()).toBeVisible({ timeout: 60_000 })
-  await snap(page, '02-closed-bot-chat-new-thread')
-
-  const threadTabs = await mainTabs(page)
-  expect(threadTabs).toHaveLength(1)
-  const [threadTab] = threadTabs
-  expect(threadTab).toMatch(/^session-tile:/)
-
-  // Switch to Beta: Alpha's thread leaves the strip (scoped away, not closed).
-  await betaRow.click()
-  await expect(page.locator(`[data-zone-tabstrip="grp-main"] [data-tree-tab="${threadTab}"]`)).toHaveCount(0, {
-    timeout: 60_000
-  })
-  await settle(page)
-
-  // Back to Alpha: the thread is fronted, and the closed Bot Chat STAYS closed.
-  await alphaRow.click()
-  const threadTabLocator = page.locator(`[data-zone-tabstrip="grp-main"] [data-tree-tab="${threadTab}"]`)
-  await expect(threadTabLocator).toBeVisible({ timeout: 30_000 })
-  await expect(threadTabLocator).toHaveAttribute('aria-selected', 'true')
-  await page.waitForTimeout(3000)
-  await expect(botChatTab).toHaveCount(0)
-  expect(await mainTabs(page)).toEqual([threadTab])
-  await snap(page, '03-back-to-alpha-bot-chat-stays-closed')
-
-  // The explicit ask still opens the forever-chat, beside the thread.
-  await openUntil(
-    async () => {
-      await alphaRow.click({ button: 'right' })
-      await page.getByRole('menuitem', { name: 'Open Bot Chat' }).click()
-    },
-    () => expect(botChatTab.first()).toBeVisible({ timeout: 45_000 })
-  )
-  expect(await mainTabs(page)).toHaveLength(2)
-  expect(await mainTabs(page)).toContain(threadTab)
-  await snap(page, '04-explicit-open-bot-chat')
-})
diff --git a/apps/desktop/e2e/bot-mode-row-click-mirrors-registry.spec.ts b/apps/desktop/e2e/bot-mode-row-click-mirrors-registry.spec.ts
new file mode 100644
index 0000000000..1ea609318b
--- /dev/null
+++ b/apps/desktop/e2e/bot-mode-row-click-mirrors-registry.spec.ts
@@ -0,0 +1,158 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import {
+  buildAppEnv,
+  createSandbox,
+  launchDesktop,
+  type MockBackendFixture,
+  waitForAppReady,
+  writeEnvFile,
+  writeMockProviderConfig
+} from './fixtures'
+import { MOCK_REPLY, startMockServer } from '../../../tests-js/scripts/mock-server'
+import { RealSessionBuilder } from './real-session-builder'
+import { expect, test } from './test'
+
+// A bot row previews the bot's canonical Bot Chat (the gateway resolves it by
+// name on every roster poll). Clicking the row must land on THAT conversation.
+// Before this fix a plain click fronted whatever bots-workspace tile the user
+// last had open for that bot — a `+` side thread outlived every restart in
+// Local Storage and won every click forever, while the row kept previewing the
+// Bot Chat. The user saw the sidebar and the center describe two different
+// conversations ("sessions not in sync"; support thread 1544460286084391043).
+
+type Page = MockBackendFixture['page']
+
+let fixture: MockBackendFixture | null = null
+
+async function openBots(page: Page): Promise<void> {
+  const tab = page
+    .getByRole('button', { name: 'Bots', exact: true })
+    .or(page.getByRole('tab', { name: 'Bots', exact: true }))
+    .first()
+
+  await tab.click()
+  await expect(page.getByRole('button', { name: 'New bot or group chat' })).toBeVisible()
+}
+
+async function settle(page: Page, timeout = 90_000): Promise<void> {
+  await page
+    .getByText(/Waking up/i)
+    .first()
+    .waitFor({ state: 'hidden', timeout })
+    .catch(() => undefined)
+  await page.waitForTimeout(500)
+}
+
+async function openUntil(action: () => Promise<void>, expected: () => Promise<void>, attempts = 3): Promise<void> {
+  for (let attempt = 1; ; attempt += 1) {
+    await action()
+
+    try {
+      await expected()
+
+      return
+    } catch (error) {
+      if (attempt >= attempts) {
+        throw error
+      }
+    }
+  }
+}
+
+async function seedBot(hermesHome: string, mockUrl: string, name: string): Promise<void> {
+  const dir = path.join(hermesHome, 'profiles', name)
+  fs.mkdirSync(dir, { recursive: true })
+  writeMockProviderConfig(dir, mockUrl)
+  writeEnvFile(dir)
+
+  const builder = await RealSessionBuilder.start(dir)
+
+  try {
+    await builder.createSession({ title: 'Bot Chat', turns: [`Hello ${name}`] })
+  } finally {
+    await builder.close()
+  }
+}
+
+test.beforeAll(async () => {
+  const mock = await startMockServer()
+  const sandbox = createSandbox('bots-sync')
+  writeMockProviderConfig(sandbox.hermesHome, mock.url)
+  writeEnvFile(sandbox.hermesHome)
+  await seedBot(sandbox.hermesHome, mock.url, 'alpha')
+  await seedBot(sandbox.hermesHome, mock.url, 'beta')
+
+  const { app, page } = await launchDesktop(buildAppEnv(sandbox))
+
+  fixture = {
+    app,
+    page,
+    mock,
+    mockUrl: mock.url,
+    sandbox,
+    cleanup: async () => {
+      await app.close().catch(() => undefined)
+      await mock.close()
+      sandbox.cleanup()
+    }
+  }
+  await waitForAppReady(fixture, 120_000)
+})
+
+test.afterAll(async () => {
+  await fixture?.cleanup()
+  fixture = null
+})
+
+test('a bot row click lands on the Bot Chat the row previews, not a side thread', async () => {
+  test.setTimeout(300_000)
+  const page = fixture!.page
+
+  await openBots(page)
+
+  const alphaRow = page.getByRole('button', { name: /^alpha\b/i }).filter({ visible: true }).first()
+  const betaRow = page.getByRole('button', { name: /^beta\b/i }).filter({ visible: true }).first()
+  await expect(alphaRow).toBeVisible({ timeout: 30_000 })
+  await expect(betaRow).toBeVisible({ timeout: 30_000 })
+  const seededTurn = page.getByText('Hello alpha', { exact: true }).filter({ visible: true })
+
+  await openUntil(
+    () => alphaRow.click(),
+    () => expect(seededTurn.first()).toBeVisible({ timeout: 45_000 })
+  )
+  await settle(page, 15_000)
+
+  // A `+` side thread for alpha, with a real turn so it is a persisted tile.
+  await page.keyboard.press('Control+t')
+  const composer = page.locator('[data-slot="composer-root"] [contenteditable="true"]').filter({ visible: true }).first()
+  await expect(composer).toBeVisible({ timeout: 15_000 })
+  await composer.click()
+  await composer.fill('hello alpha thread')
+  await page.keyboard.press('Enter')
+  await expect(page.getByText(MOCK_REPLY).filter({ visible: true }).first()).toBeVisible({ timeout: 60_000 })
+
+  // Leave alpha on the side thread, go to beta, come back via the row.
+  await betaRow.click()
+  await expect(page.getByText('Hello beta', { exact: true }).filter({ visible: true }).first()).toBeVisible({
+    timeout: 60_000
+  })
+  await settle(page)
+
+  await alphaRow.click()
+  // The row previews the Bot Chat; the click must front it.
+  await expect(seededTurn.first()).toBeVisible({ timeout: 45_000 })
+  // The side thread is still open beside it (scoped to alpha), not closed.
+  await expect
+    .poll(
+      () =>
+        page.evaluate(() =>
+          [...document.querySelectorAll<HTMLElement>('[data-zone-tabstrip="grp-main"] [data-tree-tab]')]
+            .map(element => element.getAttribute('data-tree-tab') ?? '')
+            .filter(id => id.startsWith('session-tile:')).length
+        ),
+      { timeout: 15_000 }
+    )
+    .toBe(1)
+})
diff --git a/apps/desktop/e2e/bot-mode-tab-shows-bot-name.spec.ts b/apps/desktop/e2e/bot-mode-tab-shows-bot-name.spec.ts
new file mode 100644
index 0000000000..8eac23c5a1
--- /dev/null
+++ b/apps/desktop/e2e/bot-mode-tab-shows-bot-name.spec.ts
@@ -0,0 +1,137 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import {
+  buildAppEnv,
+  createSandbox,
+  launchDesktop,
+  type MockBackendFixture,
+  waitForAppReady,
+  writeEnvFile,
+  writeMockProviderConfig
+} from './fixtures'
+import { MOCK_REPLY, startMockServer } from '../../../tests-js/scripts/mock-server'
+import { RealSessionBuilder } from './real-session-builder'
+import { expect, test } from './test'
+
+// Every bot's canonical chat is STORED under the same title ("Bot Chat" — the
+// name the gateway resolves it by), so the main tab strip captioned every open
+// bot chat identically and two bots' tabs were indistinguishable (#99152). The
+// tab must read the bot's display name while the stored title stays canonical.
+
+type Page = MockBackendFixture['page']
+
+let fixture: MockBackendFixture | null = null
+
+async function openBots(page: Page): Promise<void> {
+  const tab = page
+    .getByRole('button', { name: 'Bots', exact: true })
+    .or(page.getByRole('tab', { name: 'Bots', exact: true }))
+    .first()
+
+  await tab.click()
+  await expect(page.getByRole('button', { name: 'New bot or group chat' })).toBeVisible()
+}
+
+async function openUntil(action: () => Promise<void>, expected: () => Promise<void>, attempts = 3): Promise<void> {
+  for (let attempt = 1; ; attempt += 1) {
+    await action()
+
+    try {
+      await expected()
+
+      return
+    } catch (error) {
+      if (attempt >= attempts) {
+        throw error
+      }
+    }
+  }
+}
+
+async function seedBot(hermesHome: string, mockUrl: string, name: string): Promise<void> {
+  const dir = path.join(hermesHome, 'profiles', name)
+  fs.mkdirSync(dir, { recursive: true })
+  writeMockProviderConfig(dir, mockUrl)
+  writeEnvFile(dir)
+
+  const builder = await RealSessionBuilder.start(dir)
+
+  try {
+    await builder.createSession({ title: 'Bot Chat', turns: [`Hello ${name}`] })
+  } finally {
+    await builder.close()
+  }
+}
+
+/** Every tab caption in the main strip (the main `workspace` tab + tiles). */
+function mainStripTabTitles(page: Page): Promise<string[]> {
+  return page.evaluate(() =>
+    [...document.querySelectorAll<HTMLElement>('[data-zone-tabstrip="grp-main"] [data-tree-tab]')].map(element =>
+      (element.textContent ?? '').trim()
+    )
+  )
+}
+
+test.beforeAll(async () => {
+  const mock = await startMockServer()
+  const sandbox = createSandbox('bots-tabname')
+  writeMockProviderConfig(sandbox.hermesHome, mock.url)
+  writeEnvFile(sandbox.hermesHome)
+  await seedBot(sandbox.hermesHome, mock.url, 'alpha')
+  await seedBot(sandbox.hermesHome, mock.url, 'beta')
+
+  const { app, page } = await launchDesktop(buildAppEnv(sandbox))
+
+  fixture = {
+    app,
+    page,
+    mock,
+    mockUrl: mock.url,
+    sandbox,
+    cleanup: async () => {
+      await app.close().catch(() => undefined)
+      await mock.close()
+      sandbox.cleanup()
+    }
+  }
+  await waitForAppReady(fixture, 120_000)
+})
+
+test.afterAll(async () => {
+  await fixture?.cleanup()
+  fixture = null
+})
+
+test("an open Bot Chat's tab reads the bot's name, not the canonical 'Bot Chat' title", async () => {
+  test.setTimeout(300_000)
+  const page = fixture!.page
+
+  await openBots(page)
+
+  const alphaRow = page.getByRole('button', { name: /^alpha\b/i }).filter({ visible: true }).first()
+  await expect(alphaRow).toBeVisible({ timeout: 30_000 })
+
+  await openUntil(
+    () => alphaRow.click(),
+    () =>
+      expect(page.getByText('Hello alpha', { exact: true }).filter({ visible: true }).first()).toBeVisible({
+        timeout: 45_000
+      })
+  )
+
+  // A `+` side thread beside the Bot Chat gives the main zone a tab strip —
+  // the surface where every bot chat used to read "Bot Chat".
+  await page.keyboard.press('Control+t')
+  const composer = page.locator('[data-slot="composer-root"] [contenteditable="true"]').filter({ visible: true }).first()
+  await expect(composer).toBeVisible({ timeout: 15_000 })
+  await composer.click()
+  await composer.fill('hello alpha thread')
+  await page.keyboard.press('Enter')
+  await expect(page.getByText(MOCK_REPLY).filter({ visible: true }).first()).toBeVisible({ timeout: 60_000 })
+
+  await expect.poll(() => mainStripTabTitles(page), { timeout: 15_000 }).toHaveLength(2)
+  const captions = await mainStripTabTitles(page)
+  expect(captions.some(caption => /alpha/i.test(caption))).toBe(true)
+  expect(captions.some(caption => /bot chat/i.test(caption))).toBe(false)
+})
diff --git a/apps/desktop/e2e/bot-roster-user-sections.spec.ts b/apps/desktop/e2e/bot-roster-user-sections.spec.ts
new file mode 100644
index 0000000000..7439777cce
--- /dev/null
+++ b/apps/desktop/e2e/bot-roster-user-sections.spec.ts
@@ -0,0 +1,254 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import {
+  buildAppEnv,
+  createSandbox,
+  launchDesktop,
+  type MockBackendFixture,
+  waitForAppReady,
+  writeEnvFile,
+  writeMockProviderConfig
+} from './fixtures'
+import { startMockServer } from '../../../tests-js/scripts/mock-server'
+import { RealSessionBuilder } from './real-session-builder'
+import { expect, test } from './test'
+
+// User-made sections in the Bots roster: a bot is filed by dragging it onto a
+// section or through its row menu, the section is renamed through the same
+// dialog shape sessions use, and deleting a section returns its bots to
+// Unassigned (with an Undo toast, no confirmation). With no sections created
+// the roster is the plain list it always was.
+
+type Page = MockBackendFixture['page']
+
+let fixture: MockBackendFixture | null = null
+
+// BOT_SECTIONS_SCREENSHOT_DIR=<dir> saves full-window captures at the key
+// states — handy for design review; never part of the assertions.
+async function capture(page: Page, name: string): Promise<void> {
+  const dir = process.env.BOT_SECTIONS_SCREENSHOT_DIR
+
+  if (!dir) {
+    return
+  }
+
+  fs.mkdirSync(dir, { recursive: true })
+  await page.screenshot({ path: path.join(dir, `${name}.png`) })
+}
+
+async function seedBot(hermesHome: string, mockUrl: string, name: string): Promise<void> {
+  const dir = path.join(hermesHome, 'profiles', name)
+  fs.mkdirSync(dir, { recursive: true })
+  writeMockProviderConfig(dir, mockUrl)
+  writeEnvFile(dir)
+
+  const builder = await RealSessionBuilder.start(dir)
+
+  try {
+    await builder.createSession({ title: 'Bot Chat', turns: [`Hello ${name}`] })
+  } finally {
+    await builder.close()
+  }
+}
+
+const roster = (page: Page) => page.locator('[data-slot="bots-roster"]')
+const botRow = (page: Page, name: string) => roster(page).locator(`[data-roster-key="local::${name}"]`)
+
+/** A section's label span — the one node whose text is exactly the name. */
+const sectionLabel = (page: Page, name: string) =>
+  page.locator('span.truncate', { hasText: new RegExp(`^${name}$`, 'i') })
+
+/** The heading's fold button (label + count) — the ⋯ menu trigger is a sibling with no text. */
+const sectionHeading = (page: Page, name: string) =>
+  roster(page).locator('[data-slot="bots-section"] button[aria-expanded]').filter({ has: sectionLabel(page, name) })
+
+const sectionBlock = (page: Page, name: string) =>
+  roster(page).locator('[data-slot="bots-section"]').filter({ has: sectionLabel(page, name) })
+
+/** Section name → roster keys of the rows under it (the plain list has no sections). */
+async function layout(page: Page): Promise<Array<[string, string[]]>> {
+  return roster(page).locator('[data-slot="bots-section"]').evaluateAll(blocks =>
+    blocks.map(block => [
+      block.querySelector('button[aria-expanded] span.truncate')?.textContent?.trim() ?? '',
+      [...block.querySelectorAll<HTMLElement>('[data-roster-key]')].map(row => row.dataset.rosterKey ?? '')
+    ])
+  )
+}
+
+test.beforeAll(async () => {
+  const mock = await startMockServer()
+  const sandbox = createSandbox('bots-sections')
+  writeMockProviderConfig(sandbox.hermesHome, mock.url)
+  writeEnvFile(sandbox.hermesHome)
+
+  for (const name of ['alpha', 'beta', 'gamma']) {
+    await seedBot(sandbox.hermesHome, mock.url, name)
+  }
+
+  const { app, page } = await launchDesktop(buildAppEnv(sandbox))
+
+  fixture = {
+    app,
+    page,
+    mock,
+    mockUrl: mock.url,
+    sandbox,
+    cleanup: async () => {
+      await app.close().catch(() => undefined)
+      await mock.close()
+      sandbox.cleanup()
+    }
+  }
+  await waitForAppReady(fixture, 120_000)
+})
+
+test.afterAll(async () => {
+  await fixture?.cleanup()
+  fixture = null
+})
+
+test('file bots into user sections by menu and drag; rename; delete returns them to Unassigned', async () => {
+  test.setTimeout(300_000)
+  const page = fixture!.page
+
+  const tab = page
+    .getByRole('button', { name: 'Bots', exact: true })
+    .or(page.getByRole('tab', { name: 'Bots', exact: true }))
+    .first()
+
+  await tab.click()
+  await expect(page.getByRole('button', { name: 'New bot or group chat' })).toBeVisible()
+  await expect(botRow(page, 'alpha')).toBeVisible({ timeout: 30_000 })
+  await expect(botRow(page, 'beta')).toBeVisible({ timeout: 30_000 })
+
+  // No sections yet: the plain list, no section chrome at all.
+  await expect(roster(page).locator('[data-slot="bots-section"]')).toHaveCount(0)
+  await capture(page, '1-plain-roster')
+
+  // Right-click alpha → Move to section → New section… → name it → alpha is filed.
+  await botRow(page, 'alpha').click({ button: 'right' })
+  await page.getByRole('menuitem', { name: 'Move to section' }).hover()
+  await expect(page.getByRole('menuitem', { name: 'New section…' })).toBeVisible()
+  await capture(page, '2-row-menu-move-to-section')
+  await page.getByRole('menuitem', { name: 'New section…' }).click()
+  const nameField = page.getByRole('textbox', { name: 'Section name' })
+  await expect(nameField).toBeVisible()
+  await nameField.fill('Clients')
+  await capture(page, '3-new-section-dialog')
+  await page.getByRole('button', { name: 'Create' }).click()
+
+  await expect(sectionHeading(page, 'Clients')).toBeVisible()
+  await expect(sectionBlock(page, 'Clients').locator('[data-roster-key="local::alpha"]')).toBeVisible()
+  // The remainder is Unassigned, drawn last.
+  await expect
+    .poll(async () => (await layout(page)).map(([name, keys]) => [name, keys.length]))
+    .toEqual([
+      ['Clients', 1],
+      ['Unassigned', 3]
+    ])
+  await capture(page, '4-alpha-filed')
+
+  // Drag beta over the Clients block: the target highlights while over it.
+  // Escape cancels — nothing moves, nothing stays highlighted or faded.
+  const target = sectionBlock(page, 'Clients')
+  const from = (await botRow(page, 'beta').boundingBox())!
+  const to = (await sectionHeading(page, 'Clients').boundingBox())!
+
+  const dragBetaOverClients = async () => {
+    await page.mouse.move(from.x + from.width / 2, from.y + from.height / 2)
+    await page.mouse.down()
+    await page.mouse.move(from.x + from.width / 2, from.y + from.height / 2 - 10, { steps: 4 })
+    await page.mouse.move(to.x + to.width / 2, to.y + to.height / 2, { steps: 12 })
+    await expect(target).toHaveAttribute('data-drop-over', 'true')
+  }
+
+  await dragBetaOverClients()
+  await page.keyboard.press('Escape')
+  await page.mouse.up()
+  await expect(target).not.toHaveAttribute('data-drop-over', 'true')
+  await expect(botRow(page, 'beta')).toHaveCSS('opacity', '1')
+  expect((await layout(page)).map(([name, keys]) => [name, keys.length])).toEqual([
+    ['Clients', 1],
+    ['Unassigned', 3]
+  ])
+
+  // Drop it for real: the bot is filed.
+  await dragBetaOverClients()
+  await capture(page, '5-drag-over-clients')
+  await page.mouse.up()
+
+  await expect(target.locator('[data-roster-key="local::beta"]')).toBeVisible()
+  await expect(target).not.toHaveAttribute('data-drop-over', 'true')
+  // The moved row remounts under its new section; it must not stay faded.
+  await expect(botRow(page, 'beta')).toHaveCSS('opacity', '1')
+  await expect
+    .poll(async () => (await layout(page)).map(([name, keys]) => [name, keys.length]))
+    .toEqual([
+      ['Clients', 2],
+      ['Unassigned', 2]
+    ])
+  await capture(page, '6-beta-dropped')
+
+  // Rename through the heading's context menu — the same Dialog + Input
+  // + Save shape as a session rename.
+  await sectionHeading(page, 'Clients').click({ button: 'right' })
+  await page.getByRole('menuitem', { name: 'Rename…' }).click()
+  await expect(nameField).toHaveValue('Clients')
+  await nameField.fill('Customers')
+  await page.getByRole('button', { name: 'Save' }).click()
+  await expect(sectionHeading(page, 'Customers')).toBeVisible()
+  await expect(sectionHeading(page, 'Clients')).toHaveCount(0)
+  await capture(page, '7-renamed')
+
+  // A second, empty section from the + menu shows its drop hint; collapsing
+  // a section folds its rows like the gateway headings do.
+  await page.getByRole('button', { name: 'New bot or group chat' }).click()
+  await page.getByRole('menuitem', { name: 'New section' }).click()
+  await nameField.fill('Team')
+  await page.getByRole('button', { name: 'Create' }).click()
+  await expect(sectionBlock(page, 'Team').getByText('Drag bots here')).toBeVisible()
+  await sectionHeading(page, 'Customers').click()
+  await expect(sectionBlock(page, 'Customers').locator('[data-roster-key]')).toHaveCount(0)
+  await capture(page, '8-empty-section-and-collapsed')
+  await sectionHeading(page, 'Customers').click()
+  await expect(sectionBlock(page, 'Customers').locator('[data-roster-key]')).toHaveCount(2)
+
+  // Delete Customers: no confirmation, its two bots return to Unassigned,
+  // and the toast offers Undo.
+  await sectionHeading(page, 'Customers').click({ button: 'right' })
+  await page.getByRole('menuitem', { name: 'Delete' }).click()
+  await expect(sectionHeading(page, 'Customers')).toHaveCount(0)
+  const toast = page.getByRole('status').filter({ hasText: 'Deleted “Customers”' })
+  await expect(toast).toBeVisible()
+  await expect
+    .poll(async () => (await layout(page)).map(([name, keys]) => [name, keys.length]))
+    .toEqual([
+      ['Team', 0],
+      ['Unassigned', 4]
+    ])
+  await capture(page, '9-deleted-with-undo-toast')
+
+  await toast.getByRole('button', { name: 'Undo' }).click()
+  await expect(sectionHeading(page, 'Customers')).toBeVisible()
+  await expect
+    .poll(async () => (await layout(page)).map(([name, keys]) => [name, keys.length]))
+    .toEqual([
+      ['Customers', 2],
+      ['Team', 0],
+      ['Unassigned', 2]
+    ])
+
+  // Membership rides the bot's profile ui_meta, so it follows profile sync.
+  const alphaProfile = path.join(fixture!.sandbox.hermesHome, 'profiles', 'alpha', 'profile.yaml')
+  await expect.poll(() => (fs.existsSync(alphaProfile) ? fs.readFileSync(alphaProfile, 'utf8') : '')).toMatch(/sectionId:\s*sec-/)
+
+  // Delete both sections: the roster is the plain list again.
+  for (const name of ['Customers', 'Team']) {
+    await sectionHeading(page, name).click({ button: 'right' })
+    await page.getByRole('menuitem', { name: 'Delete' }).click()
+  }
+
+  await expect(roster(page).locator('[data-slot="bots-section"]')).toHaveCount(0)
+  await expect(botRow(page, 'alpha')).toBeVisible()
+})
diff --git a/apps/desktop/e2e/chat.spec.ts b/apps/desktop/e2e/chat.spec.ts
index 3d79c315e4..13c2168d21 100644
--- a/apps/desktop/e2e/chat.spec.ts
+++ b/apps/desktop/e2e/chat.spec.ts
@@ -106,7 +106,10 @@ test.describe('chat interaction with mock backend', () => {
 
     await composer.click()
     await composer.type('please answer tersely')
-    await expect(primary).toHaveAttribute('aria-label', /Steer/)
+    // Since "running is not busy" (3bc52fb9df) the primary keeps the Send
+    // affordance mid-turn — steer is routed through the submit engine, not a
+    // separate labeled button. Queue remains the explicit secondary action.
+    await expect(primary).toHaveAttribute('aria-label', 'Send')
     await expect(dictation).toBeVisible()
     await expect(speakReplies).toBeVisible()
     await expect(queue).toBeVisible()
@@ -119,11 +122,9 @@ test.describe('chat interaction with mock backend', () => {
     )
     expect(controlLabels.indexOf('Voice dictation')).toBeLessThan(speakRepliesIndex)
     expect(speakRepliesIndex).toBeLessThan(controlLabels.indexOf('Queue message'))
-    expect(controlLabels.indexOf('Queue message')).toBeLessThan(
-      controlLabels.findIndex(label => label?.startsWith('Steer'))
-    )
+    expect(controlLabels.indexOf('Queue message')).toBeLessThan(controlLabels.indexOf('Send'))
     await page.screenshot({ path: testInfo.outputPath('busy-composer-steer.png') })
-    await expect(primary.locator('svg.tabler-icon-steering-wheel')).toBeVisible()
+    await expect(primary.locator('.codicon-arrow-up')).toBeVisible()
 
     await queue.click()
     await expect(primary).toHaveAttribute('aria-label', 'Stop')
diff --git a/apps/desktop/e2e/correction-session-switch.spec.ts b/apps/desktop/e2e/correction-session-switch.spec.ts
index fc7e0359bc..2910c3afcf 100644
--- a/apps/desktop/e2e/correction-session-switch.spec.ts
+++ b/apps/desktop/e2e/correction-session-switch.spec.ts
@@ -45,7 +45,9 @@ async function steer(page: Page, text: string): Promise<void> {
   await composer.waitFor({ state: 'visible', timeout: 15_000 })
   await composer.click()
   await composer.type(text, { delay: 5 })
-  await expect(primary).toHaveAttribute('aria-label', /Steer/)
+  // Since "running is not busy" (3bc52fb9df) the primary keeps the Send label
+  // mid-turn; the submit engine still routes a text payload to steer.
+  await expect(primary).toHaveAttribute('aria-label', 'Send')
   await primary.click()
 }
 
@@ -209,17 +211,36 @@ test.describe('correction session switch', () => {
 
     // Reproduce the observed race: switch to another persisted session while
     // the foreground tool is live, then return before its redirect settles.
-    await openSidebarSession(page, MOCK_REPLY, OTHER_SESSION_PROMPT)
+    // Sidebar rows title by the session's first user prompt (auto-title is
+    // disabled in the e2e fixture config).
+    await openSidebarSession(page, OTHER_SESSION_PROMPT, OTHER_SESSION_PROMPT)
     await reopenOriginalSession(page)
-    await page.waitForTimeout(500)
+    // The warm resume first paints the persisted history and then reconciles
+    // the live turn (including a steer whose persistence may lag on a loaded
+    // runner) back in. Poll to the converged order instead of sampling one
+    // arbitrary mid-reconcile frame; the duplicate checks then pin the
+    // regression (the prompt/correction must appear exactly once).
+    await expect
+      .poll(async () => relevantOrder(await transcriptTextOrder(page)), {
+        message: 'correction should stay in place after the warm resume',
+        timeout: 30_000,
+      })
+      .toEqual(orderBeforeSwitch)
     await page.screenshot({ path: testInfo.outputPath('correction-after-warm-resume.png') })
 
-    expect(relevantOrder(await transcriptTextOrder(page))).toEqual(orderBeforeSwitch)
     expect(await textNodeOccurrences(page, ORIGINAL_PROMPT)).toBe(1)
     expect(await textNodeOccurrences(page, CORRECTION)).toBe(1)
 
     await waitForTranscriptText(page, CORRECTED_REPLY)
-    expect(steerTurnOrder(await transcriptMessageOrder(page))).toEqual([ORIGINAL_PROMPT, CORRECTION, CORRECTED_REPLY])
+    // The post-turn stored-history reconcile can momentarily repaint from a
+    // snapshot in which the steer's user row hasn't been folded back in yet —
+    // poll to the converged order instead of sampling one frame.
+    await expect
+      .poll(async () => steerTurnOrder(await transcriptMessageOrder(page)), {
+        message: 'steered turn should settle as prompt → correction → corrected reply',
+        timeout: 30_000,
+      })
+      .toEqual([ORIGINAL_PROMPT, CORRECTION, CORRECTED_REPLY])
   })
 
   test('keeps an inference-time correction visible through a warm session switch', async ({}, testInfo: TestInfo) => {
@@ -236,7 +257,7 @@ test.describe('correction session switch', () => {
     await send(page, INFERENCE_CORRECTION)
     await waitForTranscriptText(page, INFERENCE_CORRECTION)
 
-    await openSidebarSession(page, MOCK_REPLY, OTHER_SESSION_PROMPT)
+    await openSidebarSession(page, OTHER_SESSION_PROMPT, OTHER_SESSION_PROMPT)
     await reopenInferenceSession(page)
 
     expect(await textNodeOccurrences(page, INFERENCE_PROMPT)).toBe(1)
diff --git a/apps/desktop/e2e/fixtures.ts b/apps/desktop/e2e/fixtures.ts
index 2d177478e6..e5ae520223 100644
--- a/apps/desktop/e2e/fixtures.ts
+++ b/apps/desktop/e2e/fixtures.ts
@@ -170,6 +170,29 @@ export function writeMockProviderConfig(
     ? `\ndisplay:\n${extraDisplayConfig}\n`
     : ''
 
+  // Title generation rides the MAIN model since 87af576e60 (#83636), so every
+  // completed turn fires an extra background /v1/chat/completions at the mock.
+  // That request contains the whole conversation — trigger keywords included —
+  // which advances the mock's scripted-turn indices and trips hold-for-prompt
+  // matchers from a request no spec ever sent. Disable it by default (no e2e
+  // spec asserts on session titles); a test that passes its own `auxiliary:`
+  // section via extraConfig owns the whole section instead.
+  const autoTitleDefault = extraConfig?.includes('auxiliary:')
+    ? ''
+    : 'auxiliary:\n  title_generation:\n    enabled: false\n'
+
+  // The scripted turns run REAL terminal commands, and anything the guard
+  // classifies as dangerous (e.g. the sidebar sentinel-wait loop) parks the
+  // turn behind a Run/Reject approval card. The default 'smart' mode then
+  // fires an aux LLM approval call at the SAME mock provider — consuming a
+  // scripted-turn index and never resolving — so the turn stalls until the
+  // spec times out (the CI failure mode for the sidebar-dot family). No e2e
+  // spec asserts on the approval flow, so run gate-free by default; a test
+  // that passes its own `approvals:` section via extraConfig owns it.
+  const approvalsDefault = extraConfig?.includes('approvals:')
+    ? ''
+    : 'approvals:\n  mode: "off"\n'
+
   const config = `# Auto-generated by E2E test fixtures
 model:
   default: mock-model
@@ -183,7 +206,7 @@ ${modelContextLength ? `  context_length: ${modelContextLength}\n` : ''}provider
     models:
       mock-model: {}
     context_length: 4096
-${displaySection}${extraConfig ? `\n${extraConfig.trim()}\n` : ''}`
+${autoTitleDefault}${approvalsDefault}${displaySection}${extraConfig ? `\n${extraConfig.trim()}\n` : ''}`
 
   fs.writeFileSync(configPath, config, 'utf8')
 }
diff --git a/apps/desktop/e2e/glyph-spinner.spec.ts b/apps/desktop/e2e/glyph-spinner.spec.ts
index 9ef8790bd3..8d2e97f552 100644
--- a/apps/desktop/e2e/glyph-spinner.spec.ts
+++ b/apps/desktop/e2e/glyph-spinner.spec.ts
@@ -24,20 +24,46 @@ import { expect, type Page, test } from '@playwright/test'
 
 import { type MockBackendFixture, setupMockBackend, waitForAppReady } from './fixtures'
 
-const STRIP = '.glyph-spinner__strip'
+/* Scope to a spinner that is actually RUNNING. Turns from earlier tests in
+ * this file leave parked spinners mounted (kept-alive panes, swap overlays
+ * hold them with data-paused='true'), and document.querySelector returns the
+ * FIRST strip in the DOM — a stale parked one once two turns have run. */
+const STRIP = '.glyph-spinner:not([data-paused="true"]) .glyph-spinner__strip'
+
+/** Prompt the mock server holds open so the spinner runs for the whole file. */
+const SPINNER_PROMPT = 'E2E_GLYPH_SPINNER_HOLD'
 
 /**
- * Send a message so a turn is in flight — the composer status stack mounts a
- * GlyphSpinner while the agent is working. Resolves once a frame strip is in
- * the DOM.
+ * Get a RUNNING frame strip into the DOM deterministically.
+ *
+ * A turn is sent so the app is genuinely busy (the mock server holds the
+ * stream open), but which surface mounts a spinner mid-turn is app policy
+ * that has changed before and will again — the transcript, status stack and
+ * swap overlay all park/unmount theirs at different moments, which made this
+ * spec racy. The contract under test is the STYLESHEET (steps() animation,
+ * layer promotion, the data-paused and global pause gates), and that CSS is
+ * driven entirely by the `data-paused` attribute — the same attribute the
+ * parked assertions below already toggle. So: wait for any mounted spinner
+ * (the ChatSwapOverlay keeps one mounted, parked, after boot), then unpark it
+ * and assert against the running animation.
  */
 async function mountSpinner(page: Page): Promise<void> {
+  if (await page.locator(STRIP).count()) {
+    return
+  }
+
   const composer = page.locator('[contenteditable="true"]').first()
   await composer.waitFor({ state: 'visible', timeout: 10_000 })
   await composer.click()
-  await composer.type('hello from the glyph spinner spec', { delay: 10 })
+  await composer.type(SPINNER_PROMPT, { delay: 10 })
   await page.keyboard.press('Enter')
 
+  await page.waitForSelector('.glyph-spinner__strip', { state: 'attached', timeout: 20_000 })
+  await page.evaluate(() => {
+    for (const el of document.querySelectorAll('.glyph-spinner[data-paused]')) {
+      el.removeAttribute('data-paused')
+    }
+  })
   await page.waitForSelector(STRIP, { state: 'attached', timeout: 20_000 })
 }
 
@@ -45,11 +71,14 @@ test.describe('GlyphSpinner (compositor animation)', () => {
   let fixture: MockBackendFixture
 
   test.beforeAll(async () => {
-    fixture = await setupMockBackend()
+    fixture = await setupMockBackend({
+      mockServer: { holdFirstStreamForPrompt: SPINNER_PROMPT },
+    })
     await waitForAppReady(fixture)
   })
 
   test.afterAll(async () => {
+    fixture?.mock.releaseHeldStream()
     await fixture?.cleanup()
   })
 
@@ -93,8 +122,10 @@ test.describe('GlyphSpinner (compositor animation)', () => {
     // multiple of the frame count — not the single-frame interval.
     expect(observed.durationMs).toBeGreaterThan(0)
     // Length-typed travel, never a percentage: `translateY(-100%)` would keep
-    // the animation off the compositor.
-    expect(observed.travel).toContain('calc(')
+    // the animation off the compositor. Chromium has serialized the resolved
+    // keyframe both as the authored `calc(...)` and as an absolute `...px`
+    // length depending on version — accept any length, reject percentages.
+    expect(observed.travel).toMatch(/calc\(|px\)/)
     expect(observed.travel).not.toContain('%')
   })
 
diff --git a/apps/desktop/e2e/group-to-local-bot-handoff.spec.ts b/apps/desktop/e2e/group-to-local-bot-handoff.spec.ts
index 7d29753a5c..2f863d144f 100644
--- a/apps/desktop/e2e/group-to-local-bot-handoff.spec.ts
+++ b/apps/desktop/e2e/group-to-local-bot-handoff.spec.ts
@@ -32,7 +32,7 @@ test.afterAll(async () => {
 })
 
 test('local bot replaces an open group main workspace', async () => {
-  test.setTimeout(180_000)
+  test.setTimeout(240_000)
   const page = fixture!.page
 
   await openBots(page)
@@ -60,11 +60,21 @@ test('local bot replaces an open group main workspace', async () => {
   const programmer = page.getByRole('button', { name: /^Programmer\b/ }).filter({ visible: true }).first()
   await programmer.click()
 
-  const botChatTab = page.getByRole('tab', { name: /Bot Chat Close/ }).filter({ visible: true })
-  await expect(botChatTab).toBeVisible({ timeout: 30_000 })
-  await expect(botChatTab).toHaveAttribute('aria-selected', 'true')
+  // The bot's canonical chat opens INTO the main workspace pane (post
+  // design-system rework); as the lone pane in the zone it renders chromeless
+  // — no "Bot Chat" tab exists until a second pane joins the strip. The
+  // handoff is observed by the group surfaces leaving and the bot's chat
+  // (here a fresh one: its empty-state splash asks for a first message)
+  // taking the main workspace. The first open also spawns the bot's own
+  // backend, so give the "Loading session" phase a real chance to clear.
+  await expect(page.getByText('Say something to get started.').filter({ visible: true })).toBeVisible({
+    timeout: 120_000
+  })
   await expect(groupTab).toHaveCount(0)
   await expect(groupComposer).toHaveCount(0)
-  await expect(page.getByText(/Waking up Programmer/i)).toHaveCount(0)
+  // No "Waking up…" assertion: the mock backend can keep a bot's wake notice
+  // around indefinitely (see bot-mode-row-click-mirrors-registry's settle()),
+  // so its presence no longer distinguishes a stranded handoff. The splash
+  // and composer above are the proof the bot's chat took the workspace.
   await expect(page.locator('[data-slot="composer-root"] [contenteditable="true"]').filter({ visible: true }).first()).toBeVisible()
 })
diff --git a/apps/desktop/e2e/hidden-history-messages.spec.ts b/apps/desktop/e2e/hidden-history-messages.spec.ts
index 77241d3367..efaa009253 100644
--- a/apps/desktop/e2e/hidden-history-messages.spec.ts
+++ b/apps/desktop/e2e/hidden-history-messages.spec.ts
@@ -9,13 +9,11 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 
-import { expect, test } from './test'
-
 import {
-  type MockBackendFixture,
   buildAppEnv,
   createSandbox,
   launchDesktop,
+  type MockBackendFixture,
   waitForAppReady,
   writeEnvFile,
   writeMockProviderConfig,
@@ -27,6 +25,7 @@ import {
   VERIFICATION_STOP_TRIGGER,
 } from '../../../tests-js/scripts/mock-server'
 import { RealSessionBuilder } from './real-session-builder'
+import { expect, test } from './test'
 
 const SESSION_TITLE = 'E2E Hidden History Messages'
 const VISIBLE_USER_TEXT = 'E2E_VISIBLE_USER_HISTORY'
@@ -44,6 +43,7 @@ async function setupSeededMockBackend(): Promise<MockBackendFixture> {
   )
   writeEnvFile(sandbox.hermesHome)
   const builder = await RealSessionBuilder.start(sandbox.hermesHome)
+
   try {
     await builder.createSession({
       title: SESSION_TITLE,
@@ -83,6 +83,7 @@ test('resume hides real context-compaction handoffs', async ({}, testInfo) => {
       .locator('[data-slot="sidebar"] button')
       .filter({ hasText: SESSION_TITLE })
       .first()
+
     await sessionRow.click()
 
     const transcript = page.locator('[data-slot="aui_thread-viewport"]')
@@ -110,8 +111,20 @@ test('live verify-on-stop continuations stay out of the transcript', async ({},
   const mock = await startMockServer({ verificationWritePath: changedFile })
   writeMockProviderConfig(sandbox.hermesHome, mock.url)
   fs.appendFileSync(path.join(sandbox.hermesHome, 'config.yaml'), '\nagent:\n  verify_on_stop: true\n', 'utf8')
+  // Auto session titling (feat f726090d48) fires an auxiliary title_generation
+  // LLM call whose user snippet CONTAINS the trigger keyword, so the mock's
+  // isVerificationStopTrigger matches it and the title call steals a scripted
+  // verify-on-stop turn (the transcript then ends on 'The code edit is
+  // complete.' instead of the exhausted-verifier final). Disable the
+  // model-backed title upgrade so script indices track real chat turns.
+  fs.appendFileSync(
+    path.join(sandbox.hermesHome, 'config.yaml'),
+    '\nauxiliary:\n  title_generation:\n    enabled: false\n',
+    'utf8',
+  )
   writeEnvFile(sandbox.hermesHome)
   const { app, page } = await launchDesktop(buildAppEnv(sandbox))
+
   const fixture: MockBackendFixture = {
     app,
     page,
diff --git a/apps/desktop/e2e/image-attachment-resume.spec.ts b/apps/desktop/e2e/image-attachment-resume.spec.ts
index 4382e76035..be9943e581 100644
--- a/apps/desktop/e2e/image-attachment-resume.spec.ts
+++ b/apps/desktop/e2e/image-attachment-resume.spec.ts
@@ -27,8 +27,8 @@ import { type MockServer, startMockServer } from '../../../tests-js/scripts/mock
 import { RealSessionBuilder } from './real-session-builder'
 import { type ElectronApplication, expect, type Page, test } from './test'
 
-// A seeded session has no generated title, so every label falls back to the
-// session preview — the first 60 characters of the first user message.
+// The builder-provided title now labels the sidebar row directly (seeded
+// sessions no longer fall back to the first-user-message preview).
 const SESSION_TITLE = 'E2E attached image session'
 const CAPTION = 'E2E attached image must survive a relaunch'
 const IMAGE_DIR = 'Application Support/e2e shots'
@@ -90,7 +90,7 @@ async function setupSeededDesktop(): Promise<SeededFixture> {
 }
 
 function sessionRow(page: Page) {
-  return page.locator('[data-slot="sidebar"] button').filter({ hasText: CAPTION }).first()
+  return page.locator('[data-slot="sidebar"] button').filter({ hasText: SESSION_TITLE }).first()
 }
 
 // Inactive tabs stay mounted under a data-pane-hidden ancestor. Match the
@@ -172,13 +172,15 @@ test.describe('attached image resume', () => {
     fixture = await setupSeededDesktop()
     await waitForAppReady(fixture, 120_000)
 
-    // The sidebar labels a session by its preview, so the caption has to lead
-    // the persisted turn — a leading directive reads as a truncated file path.
+    // The sidebar labels a seeded session by its title. Whatever the label
+    // source, an attachment directive must never leak into it as a file path.
     const row = sessionRow(fixture.page)
     await row.waitFor({ state: 'visible', timeout: 60_000 })
 
     const label = (await row.textContent())?.trim() ?? ''
-    expect(label.startsWith(CAPTION), `sidebar label should open with the caption: ${label}`).toBe(true)
+    expect(label.startsWith(SESSION_TITLE), `sidebar label should open with the title: ${label}`).toBe(true)
+    expect(label, `sidebar label should not leak the image path: ${label}`).not.toContain(IMAGE_NAME)
+    expect(label, `sidebar label should not render the directive: ${label}`).not.toContain('@image:')
 
     await openSeededSession(fixture.page)
     await assertRendersThumbnail(fixture.page, 'first open')
diff --git a/apps/desktop/e2e/interim-messages.spec.ts b/apps/desktop/e2e/interim-messages.spec.ts
index 3837084985..29e78cd884 100644
--- a/apps/desktop/e2e/interim-messages.spec.ts
+++ b/apps/desktop/e2e/interim-messages.spec.ts
@@ -20,16 +20,24 @@
  *
  *   display.interim_assistant_messages: true (default)
  *     → ALL interim texts AND the final text must be visible in the
- *       transcript.
+ *       settled transcript.
  *
  *   display.interim_assistant_messages: false
- *     → only the final text is visible (no message.interim events emitted,
- *       so all streamed interim text is replaced at message.complete).
+ *     → no message.interim events are emitted, so no sealed interim bubbles
+ *       are created while streaming. Since the post-turn stored-history
+ *       reconcile (sessions.changed → reconcileActiveTranscript, commit
+ *       1a2b0ca8cb) converges the visible transcript to the persisted
+ *       transcript — which has ALWAYS contained the mid-turn commentary as
+ *       real assistant rows (that is what a resume shows, flag or no flag) —
+ *       the settled DOM shows the whole turn as ONE assistant message
+ *       containing commentary + final. The flag governs live sealing only.
+ *       The test pins that converged single-message shape: every text
+ *       appears exactly once, inside a single assistant message root.
  *
  * Prerequisite: `npm run build` must have been run so dist/ exists.
  */
 
-import { expect, test, type Page } from '@playwright/test'
+import { expect, type Page, test } from '@playwright/test'
 
 import {
   type MockBackendFixture,
@@ -40,6 +48,17 @@ import { INTERIM_TEXTS, restartMockServer } from '../../../tests-js/scripts/mock
 
 // ─── Helpers ──────────────────────────────────────────────────────────
 
+/**
+ * Auto session titling (feat f726090d48, 2026-08-08) issues an auxiliary
+ * `title_generation` LLM call against the SAME provider as the chat turn.
+ * The mock server counts every completion request as a script turn, so the
+ * title call races the chat turn and steals a scripted interim turn (the
+ * stolen turn's text then never streams to the transcript). Disable the
+ * model-backed title upgrade — the instant derived title needs no LLM call —
+ * so the mock's script indices line up with real chat turns again.
+ */
+const DISABLE_AUTO_TITLE = 'auxiliary:\n  title_generation:\n    enabled: false'
+
 /** Unique trigger keyword the mock server detects to switch to the script. */
 const TRIGGER = 'E2E_INTERIM_TRIGGER'
 
@@ -72,7 +91,7 @@ async function sendInterimMessage(page: Page): Promise<void> {
   )
 
   // Give the renderer a moment to settle any final state updates
-  // (hydration, session refresh) before asserting.
+  // (hydration, stored-history reconcile, session refresh) before asserting.
   await page.waitForTimeout(2000)
 }
 
@@ -90,11 +109,13 @@ async function countTranscriptMessagesContaining(page: Page, text: string): Prom
   return page.evaluate(
     (search) => {
       const viewport = document.querySelector('[data-slot="aui_thread-viewport"]')
+
       if (!viewport) {
         return 0
       }
 
       let count = 0
+
       const walker = document.createTreeWalker(
         viewport,
         NodeFilter.SHOW_ELEMENT,
@@ -102,29 +123,46 @@ async function countTranscriptMessagesContaining(page: Page, text: string): Prom
           acceptNode: (node) => {
             const el = node as HTMLElement
             const directText = el.textContent ?? ''
+
             if (!directText.includes(search)) {
               return NodeFilter.FILTER_SKIP
             }
+
             // Only count leaf-ish elements to avoid double-counting.
             const hasChildWithText = Array.from(el.children).some(
               (child) => (child.textContent ?? '').includes(search),
             )
+
             if (hasChildWithText) {
               return NodeFilter.FILTER_SKIP
             }
+
             return NodeFilter.FILTER_ACCEPT
           },
         },
       )
+
       while (walker.nextNode()) {
         count++
       }
+
       return count
     },
     text,
   )
 }
 
+/** Count assistant message roots in the settled transcript. */
+async function countAssistantMessageRoots(page: Page): Promise<number> {
+  return page.evaluate(() => {
+    const viewport = document.querySelector('[data-slot="aui_thread-viewport"]')
+
+    return viewport
+      ? viewport.querySelectorAll('[data-slot="aui_assistant-message-root"]').length
+      : 0
+  })
+}
+
 // ─── Flag ON: interim_assistant_messages = true (default) ─────────────
 
 test.describe('interim assistant messages — flag ON (default)', () => {
@@ -134,7 +172,7 @@ test.describe('interim assistant messages — flag ON (default)', () => {
 
   test.beforeAll(async () => {
     restartMockServer()
-    fixture = await setupMockBackend()
+    fixture = await setupMockBackend({ extraConfig: DISABLE_AUTO_TITLE })
     await waitForAppReady(fixture, 120_000)
   })
 
@@ -147,8 +185,10 @@ test.describe('interim assistant messages — flag ON (default)', () => {
     await sendInterimMessage(page)
 
     // Every interim text (turns with visible text + tool calls) must be
-    // present in the transcript as its own sealed message — NOT wiped by
-    // message.complete.
+    // present in the settled transcript — NOT wiped by message.complete.
+    // (Live, each seals as its own bubble; the post-turn stored-history
+    // reconcile then converges the turn into one assistant message that
+    // still carries all of them.)
     for (const interimText of INTERIM_TEXTS.interims) {
       await expect
         .poll(
@@ -165,6 +205,13 @@ test.describe('interim assistant messages — flag ON (default)', () => {
         { timeout: 15_000, message: 'final text should be visible' },
       )
       .toBeGreaterThanOrEqual(1)
+
+    // No duplicates: the reconcile must CONVERGE (replace the sealed live
+    // bubbles), never render a stored copy alongside a live one.
+    for (const text of [...INTERIM_TEXTS.interims, INTERIM_TEXTS.finalText]) {
+      const count = await countTranscriptMessagesContaining(page, text)
+      expect(count, `"${text}" must not be duplicated after reconcile`).toBe(1)
+    }
   })
 })
 
@@ -179,6 +226,7 @@ test.describe('interim assistant messages — flag OFF', () => {
     restartMockServer()
     fixture = await setupMockBackend({
       extraDisplayConfig: '  interim_assistant_messages: false',
+      extraConfig: DISABLE_AUTO_TITLE,
     })
     await waitForAppReady(fixture, 120_000)
   })
@@ -187,7 +235,7 @@ test.describe('interim assistant messages — flag OFF', () => {
     await fixture?.cleanup()
   })
 
-  test('only the final response is visible; all interim texts are wiped', async () => {
+  test('settled transcript converges to stored history as a single turn message', async () => {
     const page = fixture.page
     await sendInterimMessage(page)
 
@@ -199,17 +247,29 @@ test.describe('interim assistant messages — flag OFF', () => {
       )
       .toBeGreaterThanOrEqual(1)
 
-    // NONE of the interim texts should be visible — with the flag off,
-    // the tui_gateway never installs interim_assistant_callback, so no
-    // message.interim events are emitted. All streamed interim text is
-    // accumulated into the streaming bubble and replaced by
-    // message.complete.
-    for (const interimText of INTERIM_TEXTS.interims) {
-      const count = await countTranscriptMessagesContaining(page, interimText)
-      expect(
-        count,
-        `interim text "${interimText}" should NOT be visible when flag is off`,
-      ).toBe(0)
+    // With the flag off, the tui_gateway never installs
+    // interim_assistant_callback, so no message.interim events fire and no
+    // sealed interim bubbles are created while streaming. After
+    // message.complete, the stored-history reconcile (sessions.changed →
+    // reconcileActiveTranscript) converges the view to the persisted
+    // transcript, which contains the mid-turn commentary as real assistant
+    // rows — exactly what a resume of this session would show. Pin that
+    // converged shape: ONE assistant message root for the whole turn…
+    await expect
+      .poll(
+        () => countAssistantMessageRoots(page),
+        { timeout: 15_000, message: 'the settled turn should render as one assistant message' },
+      )
+      .toBe(1)
+
+    // …containing every commentary text and the final text exactly once.
+    for (const text of [...INTERIM_TEXTS.interims, INTERIM_TEXTS.finalText]) {
+      await expect
+        .poll(
+          () => countTranscriptMessagesContaining(page, text),
+          { timeout: 15_000, message: `"${text}" should appear exactly once in the converged turn` },
+        )
+        .toBe(1)
     }
   })
 })
diff --git a/apps/desktop/e2e/session-compression-and-queue-stop.spec.ts b/apps/desktop/e2e/session-compression-and-queue-stop.spec.ts
index 192fc8a45a..b9e195a932 100644
--- a/apps/desktop/e2e/session-compression-and-queue-stop.spec.ts
+++ b/apps/desktop/e2e/session-compression-and-queue-stop.spec.ts
@@ -57,6 +57,23 @@ test.describe('session compression', () => {
     await send(page, 'E2E_COMPRESSION_THIRD')
     await expect.poll(() => receivedUserTexts().filter(text => text === 'E2E_COMPRESSION_THIRD').length).toBe(1)
 
+    // The mock receiving the third prompt does not mean the TURN is over —
+    // /compress on a busy session errors with "session busy — /interrupt the
+    // current turn before /compress". Wait for the third reply to render and
+    // for the composer to leave its busy state (no Stop affordance) first.
+    await page.waitForFunction(
+      expected =>
+        ((document.querySelector('[data-slot="aui_thread-viewport"]')?.textContent ?? '').split(expected).length - 1) >= 3,
+      reply,
+      { timeout: 90_000 }
+    )
+    await expect
+      .poll(
+        () => page.locator('[data-slot="composer-root"] button[aria-label="Stop"]').count(),
+        { timeout: 30_000, message: 'turn should settle before /compress' }
+      )
+      .toBe(0)
+
     // This test covers compression and continuation, not slash completion.
     // Insert the complete command atomically and click Send so an async
     // completion response cannot consume Enter as a picker acceptance.
@@ -89,6 +106,8 @@ test.describe('session compression in progress', () => {
   protect_first_n: 0
   protect_last_n: 1
 auxiliary:
+  title_generation:
+    enabled: false
   compression:
     provider: custom
     model: mock-model`,
@@ -124,7 +143,11 @@ auxiliary:
     await expect(page.getByRole('status', { name: 'Summarizing thread' }).last()).toBeVisible()
 
     const primary = page.locator('[data-slot="composer-root"] button[type="submit"]')
-    await expect(primary).toHaveAttribute('aria-label', 'Queue message')
+    // Since "running is not busy" (3bc52fb9df) an empty composer mid-turn
+    // shows Stop — the Queue affordance appears once a payload is typed, and
+    // the Enter path below still queues instead of steering while compaction
+    // holds the turn.
+    await expect(primary).toHaveAttribute('aria-label', 'Stop')
 
     await send(page, queued)
     await expect(page.getByText('1 Queued')).toBeVisible()
diff --git a/apps/desktop/e2e/sidebar-states.spec.ts b/apps/desktop/e2e/sidebar-states.spec.ts
index d05a86f97e..8db11abde9 100644
--- a/apps/desktop/e2e/sidebar-states.spec.ts
+++ b/apps/desktop/e2e/sidebar-states.spec.ts
@@ -30,6 +30,18 @@ const SESSION_RUNNING_DOT_LABEL = 'Session running'
 /** Finished-unread dot aria-label. */
 const UNREAD_DOT_LABEL = 'Finished — unread'
 
+/**
+ * The auto-title auxiliary call hits the SAME mock provider as the chat turn,
+ * and its request carries the user's message — trigger keyword included. The
+ * mock's trigger matching is text-based, so the title call consumes a script
+ * index: the real chat turn then gets turn 2 (final answer, NO tool calls),
+ * the background process is never spawned, and the bg dot never appears.
+ * Whether that happens depends on which request lands first — the CI flake
+ * these specs had. Disable auto-title so script indices line up with real
+ * chat turns (same fix as interim-messages.spec.ts).
+ */
+const DISABLE_AUTO_TITLE = 'auxiliary:\n  title_generation:\n    enabled: false'
+
 /** Send a message and wait for the final response to appear. */
 async function sendMessageAndWait(
   page: Page,
@@ -67,7 +79,7 @@ test.describe('sidebar states — background process and subagent', () => {
 
   test.beforeAll(async () => {
     restartMockServer()
-    fixture = await setupMockBackend()
+    fixture = await setupMockBackend({ extraConfig: DISABLE_AUTO_TITLE })
     await waitForAppReady(fixture, 120_000)
   })
 
@@ -120,22 +132,32 @@ test.describe('sidebar states — subagent and background dot coexist', () => {
   test.describe.configure({ mode: 'serial' })
 
   let fixture: MockBackendFixture
+  // Hold the background process open until the test releases it. Without the
+  // sentinel the process is a bare `sleep 5` racing the agent turn (two model
+  // trips + a real subagent spawn): on a loaded runner the turn outlives the
+  // sleep, the process is reaped mid-turn, and the dot never appears at all —
+  // the CI flake this spec had.
+  const bgRelease = createBackgroundReleaseHandle()
 
   test.beforeAll(async () => {
     restartMockServer()
-    fixture = await setupMockBackend()
+    fixture = await setupMockBackend({
+      extraConfig: DISABLE_AUTO_TITLE,
+      mockServer: { backgroundReleasePath: bgRelease.path },
+    })
     await waitForAppReady(fixture, 120_000)
   })
 
   test.afterAll(async () => {
+    bgRelease.release()
     await fixture?.cleanup()
+    bgRelease.cleanup()
   })
 
   test('background dot visible while subagent runs', async () => {
     const page = fixture.page
 
-    // Start the turn but DON'T wait for the final answer yet — we want
-    // to assert the background dot is visible WHILE the subagent runs.
+    // Start the turn — a held background process plus a real subagent.
     const composer = page.locator('[contenteditable="true"]').first()
     await composer.waitFor({ state: 'visible', timeout: 10_000 })
     await composer.click()
@@ -149,29 +171,45 @@ test.describe('sidebar states — subagent and background dot coexist', () => {
       { timeout: 15_000 },
     )
 
-    // The background process (sleep 5) should show a "Background task
-    // running" dot while the subagent is also running.
-    await expect
-      .poll(
-        () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
-        { timeout: 30_000, message: 'background dot should appear while subagent runs' },
-      )
-      .toBeGreaterThan(0)
-
-    // Evidence: the background dot is visible while the subagent runs.
-    await page.screenshot({ path: 'test-results/bg-dot-while-subagent-runs.png' })
-
-    // Now wait for the final answer to appear.
+    // While the turn is busy the dot-state priority paints the session as
+    // "working" ('Session running') — that claim OUTRANKS 'background', so
+    // polling for the bg dot mid-turn races the turn length against the poll
+    // budget. Wait for the turn to END (final text + running dot cleared),
+    // then assert the background dot as a stable, sentinel-held state.
     await page.waitForFunction(
       (text) => (document.body.textContent ?? '').includes(text),
       SIDEBAR_CROSS_TEXTS.finalText,
       { timeout: 90_000 },
     )
+    await expect
+      .poll(
+        () => page.locator(`[aria-label="${SESSION_RUNNING_DOT_LABEL}"]`).count(),
+        { timeout: 30_000, message: 'session running dot should disappear after turn completes' },
+      )
+      .toBe(0)
 
-    // After the turn + auto-dismiss, the background dot should be gone.
-    await page.waitForTimeout(8000)
-    const bgCount = await page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count()
-    expect(bgCount, 'background dot should be gone after process exits').toBe(0)
+    // The background process is held open by the sentinel, so the bg dot is
+    // a stable state — poll only to absorb the event-driven flip landing a
+    // tick after the running dot clears.
+    await expect
+      .poll(
+        () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
+        { timeout: 30_000, message: 'background dot should be visible after turn completes' },
+      )
+      .toBeGreaterThan(0)
+
+    // Evidence: the background dot is visible while the process runs.
+    await page.screenshot({ path: 'test-results/bg-dot-while-subagent-runs.png' })
+
+    // Release the process; the dot should clear on the completion event —
+    // event-driven, not a fixed sleep.
+    bgRelease.release()
+    await expect
+      .poll(
+        () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
+        { timeout: 30_000, message: 'background dot should be gone after process exits' },
+      )
+      .toBe(0)
   })
 })
 
@@ -190,6 +228,7 @@ test.describe('sidebar states — cross-session dot transition', () => {
   test.beforeAll(async () => {
     restartMockServer()
     fixture = await setupMockBackend({
+      extraConfig: DISABLE_AUTO_TITLE,
       mockServer: { backgroundReleasePath: bgRelease.path },
     })
     await waitForAppReady(fixture, 120_000)
@@ -213,14 +252,13 @@ test.describe('sidebar states — cross-session dot transition', () => {
     await composer.type('E2E_SIDEBAR_CROSS', { delay: 20 })
     await page.keyboard.press('Enter')
 
-    // Wait for the background dot to appear.
-    await expect
-      .poll(
-        () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
-        { timeout: 30_000, message: 'background dot should appear' },
-      )
-      .toBeGreaterThan(0)
-
+    // While the turn is busy the dot-state priority paints the session as
+    // "working" ('Session running') — that claim OUTRANKS 'background', so
+    // polling for the bg dot mid-turn races the turn length (two model trips
+    // + a real subagent spawn) against the poll budget: the CI flake this
+    // spec had. Wait for the turn to END first, then assert the bg dot as a
+    // stable, sentinel-held state.
+    //
     // The final answer text streams before message.complete, so text visibility
     // alone is not a completion barrier. Wait for the foreground-running state
     // to clear before asserting the background-process state.
@@ -236,11 +274,16 @@ test.describe('sidebar states — cross-session dot transition', () => {
       )
       .toBe(0)
 
-    // The background dot must still be visible: the turn is done but the
+    // The background dot must be visible now: the turn is done but the
     // process is held open by the sentinel, so this is a stable state rather
-    // than a window we have to catch in time.
-    const bgDuringTurn = await page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count()
-    expect(bgDuringTurn, 'background dot should still be visible after turn completes').toBeGreaterThan(0)
+    // than a window we have to catch in time. Poll to absorb the event-driven
+    // flip landing a tick after the running dot clears.
+    await expect
+      .poll(
+        () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
+        { timeout: 30_000, message: 'background dot should be visible after turn completes' },
+      )
+      .toBeGreaterThan(0)
 
     // Evidence: bg dot visible on session A while its turn is done but the
     // background process hasn't exited yet.
diff --git a/apps/desktop/e2e/tile-unread-bug.spec.ts b/apps/desktop/e2e/tile-unread-bug.spec.ts
index 0c12701cfe..c242ef3461 100644
--- a/apps/desktop/e2e/tile-unread-bug.spec.ts
+++ b/apps/desktop/e2e/tile-unread-bug.spec.ts
@@ -36,6 +36,18 @@ const BG_DOT_LABEL = 'Background task running'
 /** Foreground turn-running dot aria-label. */
 const SESSION_RUNNING_DOT_LABEL = 'Session running'
 
+/**
+ * The auto-title auxiliary call hits the SAME mock provider as the chat turn,
+ * and its request carries the user's message — trigger keyword included. The
+ * mock's trigger matching is text-based, so the title call consumes a script
+ * index: the real chat turn then gets turn 2 (final answer, NO tool calls),
+ * the background process is never spawned, and the bg dot never appears.
+ * Whether that happens depends on which request lands first — the CI flake
+ * this spec had. Disable auto-title so script indices line up with real chat
+ * turns (same fix as interim-messages.spec.ts).
+ */
+const DISABLE_AUTO_TITLE = 'auxiliary:\n  title_generation:\n    enabled: false'
+
 /** Locate a session's sidebar row by its preview text. */
 function sessionRow(page: import('@playwright/test').Page, text: string) {
   return page.locator('[data-slot="sidebar"] button').filter({ hasText: text }).first()
@@ -59,13 +71,13 @@ async function startTurnAndSwitchAway(page: import('@playwright/test').Page) {
     { timeout: 15_000 },
   )
 
-  // Wait for the background dot — confirms the turn is running.
-  await expect
-    .poll(
-      () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
-      { timeout: 30_000, message: 'background dot should appear' },
-    )
-    .toBeGreaterThan(0)
+  // NOTE: while the turn is busy the dot-state priority paints the session as
+  // "working" ('Session running'), which OUTRANKS the background claim — the
+  // 'Background task running' dot only appears once the turn completes while
+  // the (sentinel-held) process is still alive. Polling for the bg dot mid-turn
+  // races the turn length (two model trips + a real subagent spawn) against
+  // the poll budget, which is exactly the flake this spec had on CI. So: wait
+  // for the turn to END first, then assert the bg dot as a stable state.
 
   // The final answer text streams before message.complete, so text visibility
   // alone is not a completion barrier. Wait for the foreground-running state
@@ -82,11 +94,17 @@ async function startTurnAndSwitchAway(page: import('@playwright/test').Page) {
     )
     .toBe(0)
 
-  // The background dot must still be visible: the turn is done but the
-  // process is held open by the sentinel, so this is a stable state rather
-  // than a window we have to catch in time.
-  const bgDuringTurn = await page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count()
-  expect(bgDuringTurn, 'background dot should still be visible after turn completes').toBeGreaterThan(0)
+  // The background dot must be visible now: the turn is done but the process
+  // is held open by the sentinel, so this is a stable state rather than a
+  // window we have to catch in time. Poll rather than sampling once — the
+  // dot flip is event-driven off the busy=false publish and can land a tick
+  // after the running dot clears.
+  await expect
+    .poll(
+      () => page.locator(`[aria-label="${BG_DOT_LABEL}"]`).count(),
+      { timeout: 30_000, message: 'background dot should be visible after turn completes' },
+    )
+    .toBeGreaterThan(0)
 
   // Switch to a new session — session A is no longer $selectedStoredSessionId.
   // This is required: openSessionTile bails if the session is already selected.
@@ -121,6 +139,7 @@ test.describe('sidebar states — tab (hidden) unread is correct', () => {
   test.beforeAll(async () => {
     restartMockServer()
     fixture = await setupMockBackend({
+      extraConfig: DISABLE_AUTO_TITLE,
       mockServer: { backgroundReleasePath: bgRelease.path },
     })
     await waitForAppReady(fixture, 120_000)
@@ -142,7 +161,10 @@ test.describe('sidebar states — tab (hidden) unread is correct', () => {
 
     // ⌃-click opens the session as a TAB (center dock = stacked, not visible
     // unless it's the active tab). The session is NOT on screen.
-    const row = sessionRow(page, SIDEBAR_CROSS_TEXTS.finalText)
+    //
+    // With auto-title disabled the sidebar row is titled by the user's
+    // message (the trigger keyword), not the assistant's final text.
+    const row = sessionRow(page, 'E2E_SIDEBAR_CROSS')
     await row.click({ modifiers: ['Control'] })
     await page.waitForTimeout(2000)
 
@@ -182,6 +204,7 @@ test.describe.skip('sidebar states — split (visible) unread bug (RED)', () =>
   test.beforeAll(async () => {
     restartMockServer()
     fixture = await setupMockBackend({
+      extraConfig: DISABLE_AUTO_TITLE,
       mockServer: { backgroundReleasePath: bgRelease.path },
     })
     await waitForAppReady(fixture, 120_000)
@@ -204,7 +227,8 @@ test.describe.skip('sidebar states — split (visible) unread bug (RED)', () =>
     // Drag the session row from the sidebar to the right edge of the workspace
     // zone to create a SPLIT (side-by-side) tile. This triggers the real
     // startSessionDrag → onCommit → openSessionTile(id, 'right', anchor) path.
-    const row = sessionRow(page, SIDEBAR_CROSS_TEXTS.finalText)
+    // With auto-title disabled the sidebar row is titled by the user's message.
+    const row = sessionRow(page, 'E2E_SIDEBAR_CROSS')
     const rowBox = await row.boundingBox()
     expect(rowBox, 'session row must be visible').not.toBeNull()
 
diff --git a/apps/desktop/e2e/warm-resume-jitter.spec.ts b/apps/desktop/e2e/warm-resume-jitter.spec.ts
index b8e95c199e..83f9fb3646 100644
--- a/apps/desktop/e2e/warm-resume-jitter.spec.ts
+++ b/apps/desktop/e2e/warm-resume-jitter.spec.ts
@@ -10,7 +10,7 @@
  * `syncSessionStateToView` to fire a second `setMessages` — a visual
  * flicker as the transcript DOM was updated.
  *
- * This test pre-seeds a 32-message session into state.db, boots the app,
+ * This test pre-seeds a session into state.db, boots the app,
  * clicks the session (cold resume — populates the warm cache), navigates
  * away to a new chat, then clicks back (warm resume). Two detectors run:
  *
@@ -50,8 +50,16 @@ const SESSION_TITLE = 'E2E Warm Resume Jitter Test'
 // renderer's keep-alive visibility policy instead of relying on DOM order.
 const SURFACE = '[data-composer-target]:not([data-pane-hidden] [data-composer-target])'
 const ALL_SURFACES = '[data-composer-target]'
-/** 32 messages (16 user/assistant pairs) — enough DOM churn for detection. */
-const MESSAGE_COUNT = 32
+/**
+ * 16 messages (8 user/assistant pairs) — enough DOM churn for detection while
+ * still fitting a hot-hidden pane's retention budget. A kept-alive pane keeps
+ * only its live tail (HIDDEN_TRANSCRIPT_RENDER_BUDGET = 40 weight units in
+ * thread/list.tsx); 16 short messages ≈ 32 units, so the whole transcript
+ * survives hiding. Above the budget, reveal legitimately backfills trimmed
+ * turns (additive DOM bursts) — that is paging, not the repaint bug this
+ * suite hunts, and it would drown the detectors.
+ */
+const MESSAGE_COUNT = 16
 /** Seeded PRNG so the generated content is deterministic across runs. */
 const RNG_SEED = 42
 
@@ -174,7 +182,16 @@ async function installRenderCounter(
       : surfaces.at(-1)
     const viewport = surface?.querySelector('[data-slot="aui_thread-viewport"]')
     if (!viewport) {
-      throw new Error('Thread viewport not found before warm resume')
+      const diag = [...document.querySelectorAll(allSelector)].map(s => ({
+        hidden: Boolean(s.closest('[data-pane-hidden]')),
+        target: s.getAttribute('data-composer-target'),
+        hasViewport: Boolean(s.querySelector('[data-slot="aui_thread-viewport"]')),
+        textLen: (s.querySelector('[data-slot="aui_thread-viewport"]')?.textContent ?? '').length,
+        head: (s.querySelector('[data-slot="aui_thread-viewport"]')?.textContent ?? '').slice(0, 80),
+        tail: (s.querySelector('[data-slot="aui_thread-viewport"]')?.textContent ?? '').slice(-80),
+        includesExpected: expected ? (s.querySelector('[data-slot="aui_thread-viewport"]')?.textContent ?? '').includes(expected) : null,
+      }))
+      throw new Error('Thread viewport not found before warm resume DIAG=' + JSON.stringify(diag) + ' expected=' + expected)
     }
 
     const state = { bursts: 0, mutations: 0, timeline: [] as number[], stopped: false, reconciles: 0 }
diff --git a/apps/desktop/electron/bundle-skew.test.ts b/apps/desktop/electron/bundle-skew.test.ts
index a4de52905b..cbf3453f5a 100644
--- a/apps/desktop/electron/bundle-skew.test.ts
+++ b/apps/desktop/electron/bundle-skew.test.ts
@@ -1,6 +1,11 @@
-import { describe, expect, it } from 'vitest'
+import { execFileSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
 
-import { detectBundleSkew, isFallbackCommit, type RunGit } from './bundle-skew'
+import { afterAll, describe, expect, it } from 'vitest'
+
+import { detectBundleSkew, isFallbackCommit, type RunGit, RUNTIME_PATHS } from './bundle-skew'
 
 const REPO = '/repo'
 const STAMP = { commit: 'a'.repeat(40), source: 'ci' }
@@ -9,6 +14,36 @@ function gitReturning(stdout: string, code = 0): RunGit {
   return async () => ({ code, stderr: '', stdout })
 }
 
+/**
+ * A git fake that answers per subcommand, so a test can say "ancestry fails,
+ * but the count would have claimed skew" — which is the shape of #92233.
+ */
+function gitAnswering(answers: Record<string, { code?: number; stderr?: string; stdout?: string }>): {
+  calls: string[][]
+  git: RunGit
+} {
+  const calls: string[][] = []
+
+  const git: RunGit = async args => {
+    calls.push(args)
+
+    const answer = answers[args[0]] ?? {}
+
+    return {
+      code: answer.code ?? 0,
+      stderr: answer.stderr ?? '',
+      stdout: answer.stdout ?? ''
+    }
+  }
+
+  return { calls, git }
+}
+
+/** Every subcommand succeeds; rev-list reports `count`. */
+function gitCounting(count: string): RunGit {
+  return gitAnswering({ 'merge-base': { code: 0 }, 'rev-list': { stdout: count } }).git
+}
+
 describe('isFallbackCommit', () => {
   it('matches the all-zero placeholder at any stamp length', () => {
     expect(isFallbackCommit('0'.repeat(40))).toBe(true)
@@ -19,27 +54,21 @@ describe('isFallbackCommit', () => {
 
 describe('detectBundleSkew', () => {
   it('reports stale when desktop commits landed after the stamp', async () => {
-    const result = await detectBundleSkew(STAMP, gitReturning('3\n'), REPO)
+    const result = await detectBundleSkew(STAMP, gitCounting('3\n'), REPO)
 
     expect(result).toEqual({ desktopCommitsBehind: 3, outOfSync: true })
   })
 
-  it('passes the stamp range scoped to apps/desktop', async () => {
-    let seen: string[] = []
-
-    const git: RunGit = async args => {
-      seen = args
-
-      return { code: 0, stderr: '', stdout: '0' }
-    }
+  it('counts only commits that touch runtime desktop paths', async () => {
+    const { calls, git } = gitAnswering({ 'merge-base': { code: 0 }, 'rev-list': { stdout: '0' } })
 
     await detectBundleSkew(STAMP, git, REPO)
 
-    expect(seen).toEqual(['rev-list', '--count', `${STAMP.commit}..HEAD`, '--', 'apps/desktop'])
+    expect(calls[1]).toEqual(['rev-list', '--count', `${STAMP.commit}..HEAD`, '--', ...RUNTIME_PATHS])
   })
 
   it('is quiet when no desktop commits follow the stamp', async () => {
-    const result = await detectBundleSkew(STAMP, gitReturning('0\n'), REPO)
+    const result = await detectBundleSkew(STAMP, gitCounting('0\n'), REPO)
 
     expect(result).toEqual({ desktopCommitsBehind: 0, outOfSync: false })
   })
@@ -79,9 +108,213 @@ describe('detectBundleSkew', () => {
   })
 
   it('is quiet on unparsable rev-list output', async () => {
-    expect(await detectBundleSkew(STAMP, gitReturning('fatal: bad object'), REPO)).toEqual({
+    expect(await detectBundleSkew(STAMP, gitCounting('fatal: bad object'), REPO)).toEqual({
       desktopCommitsBehind: null,
       outOfSync: false
     })
   })
+
+  // #92233: a ZIP-fallback update rewrites the tree into a synthetic root, so
+  // the stamp commit still RESOLVES but is unreachable from HEAD. `A..HEAD`
+  // then counts HEAD's own history instead of measuring skew, and reports a
+  // permanent 1 even though apps/desktop is byte-identical. The user gets an
+  // "App build out of date" warning that cannot go off, so no remedy clears it.
+  it('is quiet when the stamp is not an ancestor of HEAD', async () => {
+    const { git } = gitAnswering({
+      'merge-base': { code: 1 },
+      'rev-list': { stdout: '1\n' }
+    })
+
+    expect(await detectBundleSkew(STAMP, git, REPO)).toEqual({
+      desktopCommitsBehind: null,
+      outOfSync: false
+    })
+  })
+
+  it('does not consult the commit count once ancestry is refused', async () => {
+    const { calls, git } = gitAnswering({
+      'merge-base': { code: 1 },
+      'rev-list': { stdout: '9999\n' }
+    })
+
+    await detectBundleSkew(STAMP, git, REPO)
+
+    expect(calls.map(args => args[0])).toEqual(['merge-base'])
+  })
+
+  it('asks about ancestry before counting, against the same stamp', async () => {
+    const { calls, git } = gitAnswering({
+      'merge-base': { code: 0 },
+      'rev-list': { stdout: '2\n' }
+    })
+
+    const result = await detectBundleSkew(STAMP, git, REPO)
+
+    expect(calls[0]).toEqual(['merge-base', '--is-ancestor', STAMP.commit, 'HEAD'])
+    expect(calls[1]?.[0]).toBe('rev-list')
+    expect(result).toEqual({ desktopCommitsBehind: 2, outOfSync: true })
+  })
+
+  it('is quiet when git cannot answer the ancestry question at all', async () => {
+    const { git } = gitAnswering({
+      'merge-base': { code: 128 },
+      'rev-list': { stdout: '4\n' }
+    })
+
+    expect(await detectBundleSkew(STAMP, git, REPO)).toEqual({
+      desktopCommitsBehind: null,
+      outOfSync: false
+    })
+  })
+
+  // Shallow clones, measured against git 2.55 rather than assumed. A stamp
+  // commit from BEFORE the graft boundary is not an object the clone has, so
+  // `--is-ancestor` exits 128 with "Not a valid object name" — the same
+  // unknowable bucket as any other missing commit, not a shallow-specific
+  // failure. A stamp INSIDE the shallow graph is answered normally, so
+  // `--fetch-depth`-limited CI checkouts do not lose skew detection wholesale;
+  // only builds stamped deeper than the checkout goes do.
+  it('is quiet on a shallow clone whose stamp predates the graft boundary', async () => {
+    const { calls, git } = gitAnswering({
+      'merge-base': {
+        code: 128,
+        stderr: `fatal: Not a valid object name ${STAMP.commit}`
+      },
+      'rev-list': { stdout: '7\n' }
+    })
+
+    expect(await detectBundleSkew(STAMP, git, REPO)).toEqual({
+      desktopCommitsBehind: null,
+      outOfSync: false
+    })
+    expect(calls).toHaveLength(1)
+  })
+
+  it('still detects skew on a shallow clone when the stamp is in the graph', async () => {
+    const { git } = gitAnswering({
+      'merge-base': { code: 0 },
+      'rev-list': { stdout: '2\n' }
+    })
+
+    expect(await detectBundleSkew(STAMP, git, REPO)).toEqual({
+      desktopCommitsBehind: 2,
+      outOfSync: true
+    })
+  })
+})
+
+// Real-git integration: proves the pathspec discriminates docs/e2e-only
+// commits from runtime commits, and that a disconnected stamp goes quiet, in
+// an actual repository rather than against a hand-written fake.
+const scratchRepos: string[] = []
+
+afterAll(() => {
+  for (const dir of scratchRepos) {
+    rmSync(dir, { force: true, recursive: true })
+  }
+})
+
+function scratchGit(repoRoot: string) {
+  return (...args: string[]) =>
+    execFileSync('git', ['-c', 'user.email=skew@test', '-c', 'user.name=skew', ...args], {
+      cwd: repoRoot,
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+      .toString()
+      .trim()
+}
+
+function makeScratchRepo(): { base: string; repoRoot: string } {
+  const repoRoot = mkdtempSync(join(tmpdir(), 'bundle-skew-'))
+  scratchRepos.push(repoRoot)
+
+  const git = scratchGit(repoRoot)
+
+  git('init', '-q', '-b', 'main')
+  git('commit', '-q', '--allow-empty', '-m', 'base')
+
+  return { base: git('rev-parse', 'HEAD'), repoRoot }
+}
+
+function writeFiles(repoRoot: string, files: string[]) {
+  for (const file of files) {
+    const target = join(repoRoot, file)
+
+    mkdirSync(dirname(target), { recursive: true })
+    writeFileSync(target, '')
+  }
+}
+
+function realGitRun(root: string): RunGit {
+  return async (args, options) => {
+    try {
+      const stdout = execFileSync('git', args, {
+        cwd: options.cwd || root,
+        stdio: ['ignore', 'pipe', 'pipe']
+      }).toString()
+
+      return { code: 0, stderr: '', stdout }
+    } catch (error) {
+      const e = error as { status?: number; stderr?: Buffer; stdout?: Buffer }
+
+      return {
+        code: e.status ?? 1,
+        stderr: e.stderr?.toString() ?? '',
+        stdout: e.stdout?.toString() ?? ''
+      }
+    }
+  }
+}
+
+describe('detectBundleSkew against a real git repo', () => {
+  it('is quiet when only docs and e2e specs changed under apps/desktop', async () => {
+    const { base, repoRoot } = makeScratchRepo()
+    const git = scratchGit(repoRoot)
+
+    writeFiles(repoRoot, ['apps/desktop/AGENTS.md', 'apps/desktop/e2e/boot.spec.ts'])
+    git('add', '.')
+    git('commit', '-q', '-m', 'docs and e2e only')
+
+    const result = await detectBundleSkew({ commit: base, source: 'local' }, realGitRun(repoRoot), repoRoot)
+
+    expect(result).toEqual({ desktopCommitsBehind: 0, outOfSync: false })
+  })
+
+  it('warns when a renderer file changed under apps/desktop', async () => {
+    const { base, repoRoot } = makeScratchRepo()
+    const git = scratchGit(repoRoot)
+
+    writeFiles(repoRoot, ['apps/desktop/src/app/new-feature.tsx', 'apps/desktop/README.md'])
+    git('add', '.')
+    git('commit', '-q', '-m', 'renderer change')
+
+    const result = await detectBundleSkew({ commit: base, source: 'local' }, realGitRun(repoRoot), repoRoot)
+
+    expect(result).toEqual({ desktopCommitsBehind: 1, outOfSync: true })
+  })
+
+  // The #92233 install, reproduced: the update rewrote the tree onto a fresh
+  // orphan root, so the stamp resolves but is unreachable. Real git answers
+  // `rev-list` with a positive count here — ancestry is the only thing that
+  // keeps the banner off.
+  it('is quiet when the stamp sits on a disconnected root', async () => {
+    const { base, repoRoot } = makeScratchRepo()
+    const git = scratchGit(repoRoot)
+
+    git('checkout', '-q', '--orphan', 'rewritten')
+    writeFiles(repoRoot, ['apps/desktop/src/app/shell.tsx'])
+    git('add', '.')
+    git('commit', '-q', '-m', 'synthetic root after a ZIP-fallback update')
+
+    const runGit = realGitRun(repoRoot)
+
+    // Precondition: the raw count this function used to trust is nonzero.
+    const raw = await runGit(['rev-list', '--count', `${base}..HEAD`, '--', ...RUNTIME_PATHS], { cwd: repoRoot })
+
+    expect(Number.parseInt(raw.stdout.trim(), 10)).toBeGreaterThan(0)
+
+    const result = await detectBundleSkew({ commit: base, source: 'local' }, runGit, repoRoot)
+
+    expect(result).toEqual({ desktopCommitsBehind: null, outOfSync: false })
+  })
 })
diff --git a/apps/desktop/electron/bundle-skew.ts b/apps/desktop/electron/bundle-skew.ts
index 7c99c006d5..9f872008bd 100644
--- a/apps/desktop/electron/bundle-skew.ts
+++ b/apps/desktop/electron/bundle-skew.ts
@@ -10,20 +10,33 @@
  * Bot Mode update" reports).
  *
  * Detection: the packaged build carries install-stamp.json with the commit
- * it was built from. If commits touching `apps/desktop/` exist in the source
- * tree AFTER that stamp commit, the running renderer is provably missing
- * desktop changes the installed runtime has:
+ * it was built from. If commits touching the RUNTIME paths of apps/desktop
+ * exist in the source tree AFTER that stamp commit, the running renderer is
+ * provably missing desktop changes the installed runtime has:
  *
- *   git rev-list --count <stampCommit>..HEAD -- apps/desktop
+ *   git merge-base --is-ancestor <stampCommit> HEAD
+ *   git rev-list --count <stampCommit>..HEAD -- <RUNTIME_PATHS>
  *
- * Scoping to `apps/desktop/` keeps this quiet for the common case where the
- * repo advances with agent-only changes — a shell built before those is not
- * stale in any way the user can see.
+ * Ancestry has to come first, because `A..HEAD` only means "how far HEAD is
+ * ahead of A" when A is an ancestor of HEAD. When it is not, the range
+ * degenerates to HEAD's own history and the count stops describing skew at
+ * all: an update that rewrote the tree into a synthetic root leaves a stamp
+ * commit that still resolves but sits on a disconnected graph, so the count
+ * is a permanent >= 1 even when apps/desktop is byte-identical (#92233).
+ * Resolving the stamp is not enough — an unknown commit already exits
+ * non-zero below, but a merely *unrelated* one exits 0 with a positive count.
+ *
+ * Scoping to runtime paths keeps this quiet for the common cases where the
+ * repo advances without user-visible desktop changes: agent-only commits
+ * elsewhere in the repo, and docs / e2e spec / dev-script churn under
+ * apps/desktop that never reaches the shipped renderer or main process
+ * (#99832).
  *
  * Fail-quiet by design: no stamp (dev runs), a fallback all-zero stamp
  * (non-git build), an unknown commit (stamp predates a shallow clone's
- * history), or any git failure all report "not stale". This warning must
- * never false-positive — it tells users their install is torn.
+ * history), a stamp that is not an ancestor of HEAD, or any git failure all
+ * report "not stale". This warning must never false-positive — it tells
+ * users their install is torn.
  *
  * Pure + injectable so it is testable without booting Electron or git.
  */
@@ -35,7 +48,7 @@ export interface BundleSkewStamp {
 }
 
 export interface BundleSkewResult {
-  /** Commits under apps/desktop/ between the build stamp and HEAD (null = unknowable). */
+  /** Runtime-path commits between the build stamp and HEAD (null = unknowable). */
   desktopCommitsBehind: null | number
   /** True only on positive proof that the renderer predates desktop changes in the tree. */
   outOfSync: boolean
@@ -46,6 +59,23 @@ export type RunGit = (
   options: { cwd: string }
 ) => Promise<{ code: number; stderr: string; stdout: string }>
 
+/**
+ * The apps/desktop paths that actually reach the user: renderer sources,
+ * main-process sources, the HTML entry, the public/ assets Vite copies into
+ * the bundle, app icons, and the packaging config. Docs, e2e specs, scratch
+ * scripts, and dev tooling never reach the shipped app, so a delta confined
+ * to them is not a torn install in any way the user can see.
+ */
+export const RUNTIME_PATHS = [
+  'apps/desktop/src',
+  'apps/desktop/electron',
+  'apps/desktop/index.html',
+  'apps/desktop/public',
+  'apps/desktop/assets',
+  'apps/desktop/package.json',
+  'apps/desktop/vite.config.ts'
+] as const
+
 const NOT_STALE: BundleSkewResult = { desktopCommitsBehind: null, outOfSync: false }
 
 /** Matches write-build-stamp.mjs's all-zero placeholder for non-git builds. */
@@ -63,7 +93,26 @@ export async function detectBundleSkew(
   }
 
   try {
-    const result = await runGit(['rev-list', '--count', `${stamp.commit}..HEAD`, '--', 'apps/desktop'], {
+    // Exit 0 = ancestor, 1 = unrelated or diverged, anything else = git could
+    // not answer (unknown object, shallow clone, not a repo). Only the first
+    // makes the commit count below a statement about skew, and the other two
+    // are the same "unknowable" the branches above already answer quietly.
+    //
+    // Deliberately not falling back to comparing apps/desktop CONTENT here.
+    // Differing content would prove the build and the tree disagree, but not
+    // which way round: a user sitting on an older checkout than their build
+    // would be told "app build out of date" backwards. Ancestry is what makes
+    // this a proof that the renderer PREDATES the tree, which is the claim the
+    // warning actually makes.
+    const ancestry = await runGit(['merge-base', '--is-ancestor', stamp.commit, 'HEAD'], {
+      cwd: repoRoot
+    })
+
+    if (ancestry.code !== 0) {
+      return NOT_STALE
+    }
+
+    const result = await runGit(['rev-list', '--count', `${stamp.commit}..HEAD`, '--', ...RUNTIME_PATHS], {
       cwd: repoRoot
     })
 
diff --git a/apps/desktop/electron/bundle-swap.test.ts b/apps/desktop/electron/bundle-swap.test.ts
new file mode 100644
index 0000000000..8640b0657f
--- /dev/null
+++ b/apps/desktop/electron/bundle-swap.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+
+import { detectBundleSwap } from './bundle-swap'
+
+const RUNNING = { builtAt: '2026-08-29T04:00:00.000Z', commit: 'a'.repeat(40), source: 'local' }
+
+describe('detectBundleSwap', () => {
+  it('reports a swap when the on-disk stamp carries a different commit', () => {
+    const onDisk = { ...RUNNING, commit: 'b'.repeat(40) }
+
+    expect(detectBundleSwap(RUNNING, onDisk)).toBe(true)
+  })
+
+  it('reports a swap when the same commit was rebuilt (builtAt moved)', () => {
+    const onDisk = { ...RUNNING, builtAt: '2026-08-31T23:55:41.149Z' }
+
+    expect(detectBundleSwap(RUNNING, onDisk)).toBe(true)
+  })
+
+  // The Windows locked-binary case (#92233): the swap leg failed, so the
+  // bundle on disk is still the one we are running. A relaunch would repair
+  // nothing and cost the user their window.
+  it('is quiet when the on-disk stamp matches the running one', () => {
+    expect(detectBundleSwap(RUNNING, { ...RUNNING })).toBe(false)
+  })
+
+  it('is quiet without a running stamp (dev runs)', () => {
+    expect(detectBundleSwap(null, { ...RUNNING })).toBe(false)
+  })
+
+  it('is quiet without an on-disk stamp (unreadable resources)', () => {
+    expect(detectBundleSwap(RUNNING, null)).toBe(false)
+  })
+
+  it('is quiet on a fallback stamp on either side (non-git build)', () => {
+    const fallbackTagged = { ...RUNNING, source: 'fallback' }
+    const fallbackCommit = { ...RUNNING, commit: '0'.repeat(40) }
+
+    expect(detectBundleSwap(fallbackTagged, { ...RUNNING, commit: 'b'.repeat(40) })).toBe(false)
+    expect(detectBundleSwap(RUNNING, fallbackCommit)).toBe(false)
+  })
+
+  it('treats a missing builtAt on either side as unprovable at the same commit', () => {
+    const noBuiltAt = { commit: RUNNING.commit, source: 'local' }
+
+    expect(detectBundleSwap(noBuiltAt, { ...RUNNING })).toBe(false)
+    expect(detectBundleSwap(RUNNING, noBuiltAt)).toBe(false)
+  })
+})
diff --git a/apps/desktop/electron/bundle-swap.ts b/apps/desktop/electron/bundle-swap.ts
new file mode 100644
index 0000000000..48f2b3af8a
--- /dev/null
+++ b/apps/desktop/electron/bundle-swap.ts
@@ -0,0 +1,61 @@
+/**
+ * Swapped-bundle detection.
+ *
+ * The detached updater (scripts/desktop-update/posix.sh mac_swap /
+ * windows.ps1) rebuilds and swaps the packaged app on disk AFTER
+ * `hermes update` exits. An instance that was launched from the PRE-swap
+ * bundle — the user reopened Hermes mid-update, the #50238 gesture the boot
+ * gate exists for — would otherwise proceed to run the NEW runtime under the
+ * OLD renderer. The updater's own `open`/relaunch leg cannot rescue it: the
+ * single-instance lock turns that into a focus of the parked process, so no
+ * process ever loads the new build.
+ *
+ * That is the stale-renderer tail of a FULLY SUCCESSFUL update: the "App
+ * build out of date" banner appears right after the update, while the Updates
+ * card says "You're on the latest version" and so offers nothing that would
+ * clear it.
+ *
+ * Detection: compare the install stamp this process loaded at boot with the
+ * one on disk now. A different commit — or a different builtAt at the same
+ * commit (a dirty-tree or content-hash rebuild) — means the bundle under our
+ * feet is not the one we are running, and a plain relaunch loads it.
+ *
+ * Fail-quiet like bundle-skew: a missing stamp on either side (dev runs,
+ * unreadable resources) or a fallback all-zero commit reports "not swapped".
+ * This must never false-positive — a positive triggers an automatic relaunch.
+ *
+ * Pure so it is testable without booting Electron.
+ */
+
+import { isFallbackCommit } from './bundle-skew'
+
+export interface BundleSwapStamp {
+  /** write-build-stamp.mjs build timestamp — differs on every rebuild. */
+  builtAt?: null | string
+  commit: string
+  /** write-build-stamp.mjs source tag — 'fallback' means the commit is fake. */
+  source?: null | string
+}
+
+/** True only on positive proof that the bundle on disk is not the running one. */
+export function detectBundleSwap(running: BundleSwapStamp | null, onDisk: BundleSwapStamp | null): boolean {
+  if (!running?.commit || !onDisk?.commit) {
+    return false
+  }
+
+  if (running.source === 'fallback' || isFallbackCommit(running.commit)) {
+    return false
+  }
+
+  if (onDisk.source === 'fallback' || isFallbackCommit(onDisk.commit)) {
+    return false
+  }
+
+  if (running.commit !== onDisk.commit) {
+    return true
+  }
+
+  // Same commit: only a builtAt PRESENT ON BOTH sides can prove a rebuild —
+  // a missing timestamp (older stamp schema) proves nothing.
+  return Boolean(running.builtAt && onDisk.builtAt && running.builtAt !== onDisk.builtAt)
+}
diff --git a/apps/desktop/electron/connection-registry.test.ts b/apps/desktop/electron/connection-registry.test.ts
index f0af94e759..261671b816 100644
--- a/apps/desktop/electron/connection-registry.test.ts
+++ b/apps/desktop/electron/connection-registry.test.ts
@@ -697,10 +697,23 @@ test('registry local route: v1 REMOTE global mode forces a genuinely-local backe
   assert.notEqual(route.poolKey, backendScopeKey(LOCAL_CONNECTION_ID, 'default'))
 })
 
-test('registry local route: a per-profile remote override also forces local', () => {
+test('registry local route: a per-profile remote override delegates to the override (#90477)', () => {
+  // The per-profile SSH/remote override is the authoritative route for that
+  // profile. Forcing local here made the roster list the profile via its
+  // override but open the thread in a local child — which fails when the
+  // profile exists only on the remote. The override must win.
   const route = resolveRegistryLocalRoute('research', { profileRemoteOverride: true })
 
-  assert.deepEqual(route, { delegate: false, poolKey: 'conn:local::research' })
+  assert.deepEqual(route, { delegate: true, poolKey: 'research' })
+})
+
+test('registry local route: per-profile override wins when global remote is also active', () => {
+  const route = resolveRegistryLocalRoute('research', {
+    globalRemote: true,
+    profileRemoteOverride: true
+  })
+
+  assert.deepEqual(route, { delegate: true, poolKey: 'research' })
 })
 
 // --- shouldDeferLocalEnumeration (roster's connect-on-demand for 'local') ---
diff --git a/apps/desktop/electron/connection-registry.ts b/apps/desktop/electron/connection-registry.ts
index 8f72948f65..2875f53c66 100644
--- a/apps/desktop/electron/connection-registry.ts
+++ b/apps/desktop/electron/connection-registry.ts
@@ -493,7 +493,17 @@ export function resolveRegistryLocalRoute(
 ): RegistryLocalRoute {
   const profileKey = String(profile ?? '').trim() || 'default'
 
-  if (opts.globalRemote || opts.profileRemoteOverride) {
+  // A per-profile SSH/remote override is an explicit per-profile routing
+  // decision: the override owns this profile's backend, so the 'local' entry
+  // must delegate to the legacy profile route (which resolves the override),
+  // not spawn a forced-local child. Forcing local here is the #90477 split:
+  // the roster lists the profile via its override, but opening the thread
+  // spawned a local backend that fails when the profile doesn't exist locally.
+  if (opts.profileRemoteOverride) {
+    return { delegate: true, poolKey: profileKey }
+  }
+
+  if (opts.globalRemote) {
     return { delegate: false, poolKey: `${backendScopePrefix(LOCAL_CONNECTION_ID)}${profileKey}` }
   }
 
diff --git a/apps/desktop/electron/main.ts b/apps/desktop/electron/main.ts
index e32d9874d9..8a6a53e65a 100644
--- a/apps/desktop/electron/main.ts
+++ b/apps/desktop/electron/main.ts
@@ -88,6 +88,7 @@ import {
   buildBrowserWindowUrl
 } from './browser-windows'
 import { detectBundleSkew } from './bundle-skew'
+import { detectBundleSwap } from './bundle-swap'
 import { applyConnectionChange, sshQuitShouldBlock, teardownSshState } from './connection-apply'
 import {
   apiRequestRegistryConnectionId,
@@ -2156,6 +2157,59 @@ function updateGateDeps() {
   }
 }
 
+// One-shot guard for the automatic bundle-swap relaunch below: the relaunched
+// instance carries this flag so a stamp that still mismatches (unreadable
+// resources, exotic packaging) can never produce a relaunch loop.
+const BUNDLE_SWAP_RELAUNCH_FLAG = '--hermes-bundle-swap-relaunched'
+
+// How long the parked instance waits for its own scheduled exit to land before
+// giving up and booting the stale build anyway. Better a torn renderer with a
+// banner than a window that never comes back.
+const BUNDLE_SWAP_RELAUNCH_FAILSAFE_MS = 15_000
+
+// The detached updater swaps the packaged bundle on disk AFTER `hermes update`
+// exits (posix.sh mac_swap / windows.ps1). An instance reopened mid-update —
+// the #50238 gesture the gate above exists for — was launched from the
+// PRE-swap bundle, and the updater's `open` leg then merely focuses us (single
+// instance), so no process ever loads the new build. Letting boot proceed here
+// runs the new runtime under the old renderer: exactly the skew
+// detectRendererSkew() warns about, except the Updates card already says
+// "latest", so the warning's own remedy has nothing to run.
+//
+// This is the earliest point where the swap is PROVABLE — it happens while we
+// are parked on the gate, so checking any sooner (at `ready`, before the gate)
+// only ever compares a stamp with itself. Relaunching here also keeps the
+// boot-progress window up for the whole wait instead of leaving the user with
+// no window at all.
+//
+// Returns true when the relaunch was scheduled; the caller must park rather
+// than continue booting, because the process exits underneath it.
+function relaunchIntoSwappedBundle() {
+  if (!IS_PACKAGED || process.argv.includes(BUNDLE_SWAP_RELAUNCH_FLAG)) {
+    return false
+  }
+
+  if (!detectBundleSwap(INSTALL_STAMP, loadInstallStamp())) {
+    return false
+  }
+
+  rememberLog('[updates] app bundle was swapped during the update; relaunching into the new build')
+
+  try {
+    app.relaunch({
+      args: [...buildNoSandboxRelaunchArgs(process.argv.slice(1)), BUNDLE_SWAP_RELAUNCH_FLAG]
+    })
+  } catch (err) {
+    rememberLog(`[updates] bundle-swap relaunch failed: ${err?.message || err}; continuing with the current build`)
+
+    return false
+  }
+
+  void exitAfterBackendShutdown(0)
+
+  return true
+}
+
 // Block until no live update is in progress (or we hit the wait timeout).
 // Emits a boot-progress phase so the renderer shows "Update in progress…"
 // rather than a frozen splash. Returns true if it parked at all.
@@ -2218,6 +2272,14 @@ async function waitForUpdateToFinish() {
 
   if (outcome === 'timeout') {
     rememberLog('[updates] update still in progress after wait timeout; starting backend anyway')
+  } else if (relaunchIntoSwappedBundle()) {
+    await advanceBootProgress('backend.update-restart', 'Restarting Hermes to load the updated app…', 14)
+    // Park while the scheduled exit lands so this stale build never starts a
+    // backend; the failsafe below only runs if the exit somehow does not.
+    await new Promise(resolve => setTimeout(resolve, BUNDLE_SWAP_RELAUNCH_FAILSAFE_MS))
+    rememberLog(
+      `[updates] relaunch did not land within ${BUNDLE_SWAP_RELAUNCH_FAILSAFE_MS}ms; continuing with the current build`
+    )
   } else {
     rememberLog('[updates] update finished; proceeding with backend start')
   }
@@ -9460,6 +9522,7 @@ function isHermesProcess(pid) {
 function migrateActiveProfileIfMissing() {
   migrateActiveProfileIfMissingPure(DESKTOP_PROFILE_CONFIG_PATH, {
     legacyActivePath: path.join(HERMES_HOME, 'active_profile'),
+    hermesHome: HERMES_HOME,
     profilesRoot: path.join(HERMES_HOME, 'profiles'),
     existsSync: p => fs.existsSync(p),
     readFileSync: (p, enc) => fs.readFileSync(p, enc),
@@ -12990,7 +13053,11 @@ function focusWindow(win) {
   win.focus()
 }
 
-function spawnSecondaryWindow({ sessionId, watch }: { sessionId?: string; watch?: boolean } = {}) {
+function spawnSecondaryWindow({
+  sessionId,
+  profile,
+  watch
+}: { sessionId?: string; profile?: null | string; watch?: boolean } = {}) {
   const icon = getAppIconPath()
 
   const win = new BrowserWindow({
@@ -13052,6 +13119,7 @@ function spawnSecondaryWindow({ sessionId, watch }: { sessionId?: string; watch?
     win,
     buildSessionWindowUrl(sessionId, {
       devServer: DEV_SERVER,
+      profile,
       rendererIndexPath: DEV_SERVER ? undefined : resolveRendererIndex(),
       watch
     }),
@@ -13062,8 +13130,8 @@ function spawnSecondaryWindow({ sessionId, watch }: { sessionId?: string; watch?
 }
 
 // Open (or focus) a standalone window for a single chat session.
-function createSessionWindow(sessionId, { watch = false } = {}) {
-  return sessionWindows.openOrFocus(sessionId, () => spawnSecondaryWindow({ sessionId, watch }))
+function createSessionWindow(sessionId, { profile = null, watch = false } = {}) {
+  return sessionWindows.openOrFocus(sessionId, () => spawnSecondaryWindow({ sessionId, profile, watch }))
 }
 
 // Popped-out in-app Browser: same webview + address bar as a docked Browser
@@ -14550,7 +14618,10 @@ ipcMain.handle('hermes:window:openSession', async (_event, sessionId, opts) => {
     return { ok: false, error: 'invalid-session-id' }
   }
 
-  createSessionWindow(sessionId.trim(), { watch: opts?.watch === true })
+  createSessionWindow(sessionId.trim(), {
+    profile: typeof opts?.profile === 'string' ? opts.profile : null,
+    watch: opts?.watch === true
+  })
 
   return { ok: true }
 })
@@ -16740,6 +16811,15 @@ ipcMain.on('hermes:translucency:support', event => {
   event.returnValue = { glass: GLASS_SUPPORTED, translucency: TRANSLUCENCY_SUPPORTED }
 })
 
+// Launch-flag facts the renderer needs before first paint (same sendSync
+// pattern as translucency). `--local` gates every local-models GUI surface;
+// it arrives from `hermes desktop --local` or directly on Hermes.exe (a
+// shortcut edit), and survives self-relaunches because collectRelaunchArgs
+// only strips internal flags.
+ipcMain.on('hermes:launch-flags', event => {
+  event.returnValue = { localModels: process.argv.includes('--local') }
+})
+
 ipcMain.on('hermes:translucency', (_event, payload) => {
   const next = normalizeTranslucency(payload, GLASS_SUPPORTED)
   const previous = translucencyState
@@ -17169,10 +17249,26 @@ ipcMain.handle('hermes:version', async () => {
     platform: process.platform,
     hermesRoot: resolveUpdateRoot(),
     bundleOutOfSync: skew.outOfSync,
-    bundleCommitsBehind: skew.desktopCommitsBehind
+    bundleCommitsBehind: skew.desktopCommitsBehind,
+    // True when the bundle on disk is not the one this process loaded — a
+    // plain app restart (no rebuild, no installer) clears the skew above.
+    // Packaged only: a dev `--build-only` rewrites build/install-stamp.json
+    // under a running `npm start`, which is a rebuild the developer asked for,
+    // not a torn install to offer a restart for.
+    bundleSwapPending: IS_PACKAGED && detectBundleSwap(INSTALL_STAMP, loadInstallStamp())
   }
 })
 
+// The About page's "Restart Hermes" button (shown when bundleSwapPending):
+// load the already-swapped bundle without asking the user to quit manually.
+// app.relaunch() re-executes by path, so the fresh process picks up whatever
+// bundle now lives there.
+ipcMain.handle('hermes:app:relaunch', async () => {
+  rememberLog('[updates] renderer requested an app relaunch (swapped bundle pending)')
+  app.relaunch({ args: buildNoSandboxRelaunchArgs(process.argv.slice(1)) })
+  void exitAfterBackendShutdown(0)
+})
+
 // ===========================================================================
 // Uninstall — remove the Chat GUI (and optionally the agent / user data).
 // ===========================================================================
diff --git a/apps/desktop/electron/preload.ts b/apps/desktop/electron/preload.ts
index 03915d13e7..8176ebfc07 100644
--- a/apps/desktop/electron/preload.ts
+++ b/apps/desktop/electron/preload.ts
@@ -10,10 +10,14 @@ import { contextBridge, ipcRenderer, webFrame, webUtils } from 'electron'
 const translucencySupport = ipcRenderer.sendSync('hermes:translucency:support')
 const hudWindowing = ipcRenderer.sendSync('hermes:hud:windowing')
 const hudNativeDrag = hudWindowing?.nativeDrag === true
+const launchFlags = ipcRenderer.sendSync('hermes:launch-flags')
 
 contextBridge.exposeInMainWorld('hermesDesktop', {
   glassSupported: translucencySupport?.glass === true,
   translucencySupported: translucencySupport?.translucency === true,
+  // Launch-flag fact: the app was started with --local, so the renderer may
+  // show the local-models surfaces. Static for the window's lifetime.
+  localModelsEnabled: launchFlags?.localModels === true,
   getConnection: profile => ipcRenderer.invoke('hermes:connection', profile),
   // Registry-scoped backend resolution: { connectionId, profile } → descriptor.
   getConnectionFor: payload => ipcRenderer.invoke('hermes:connection:for', payload),
@@ -487,6 +491,7 @@ contextBridge.exposeInMainWorld('hermesDesktop', {
     return () => ipcRenderer.removeListener('hermes:bootstrap:event', listener)
   },
   getVersion: () => ipcRenderer.invoke('hermes:version'),
+  relaunchApp: () => ipcRenderer.invoke('hermes:app:relaunch'),
   getRemoteDisplayReason: () => ipcRenderer.invoke('hermes:get-remote-display-reason'),
   uninstall: {
     summary: () => ipcRenderer.invoke('hermes:uninstall:summary'),
diff --git a/apps/desktop/electron/profile-migration.test.ts b/apps/desktop/electron/profile-migration.test.ts
index 16caf61ed0..4996e28942 100644
--- a/apps/desktop/electron/profile-migration.test.ts
+++ b/apps/desktop/electron/profile-migration.test.ts
@@ -25,8 +25,12 @@ import {
   listProfileDirs,
   migrateActiveProfileIfMissing,
   PROFILE_SCORE_MIN_SIZE_BYTES,
+  profileGatewayPidPath,
+  profileStateDbPath,
+  readExistingPreference,
   readLegacyActiveProfile,
-  scoreStateDb
+  scoreStateDb,
+  withDefaultCandidate
 } from './profile-migration'
 
 // ---------------------------------------------------------------------------
@@ -136,6 +140,7 @@ function baseDeps(overrides: Record<string, unknown> = {}) {
 
   return {
     legacyActivePath: '/home/u/.hermes/active_profile',
+    hermesHome: '/home/u/.hermes',
     profilesRoot: '/home/u/.hermes/profiles',
     existsSync: fs.existsSync,
     readFileSync: fs.readFileSync,
@@ -377,10 +382,11 @@ test('decideMigration returns null when no candidate scores and legacy is invali
 test('decideMigration suppresses write when best is default (single-profile fallback)', () => {
   // The whole point of the migration is to migrate AWAY from default when a
   // better candidate exists. If 'default' wins the score, the install is
-  // single-profile and we leave it alone.
+  // default-primary and we leave it alone. Default's DB is $HERMES_HOME/state.db,
+  // not profiles/default/state.db.
   const deps = baseDeps()
 
-  const d = decideMigration(null, [], ['default', 'coder'], deps, p => (p.endsWith('/default/state.db') ? 99 : 50))
+  const d = decideMigration(null, [], ['default', 'coder'], deps, p => (p.endsWith('/.hermes/state.db') ? 99 : 50))
 
   assert.equal(d, null)
 })
@@ -397,11 +403,20 @@ test('decideMigration still flags _migrated when legacy is invalid (undefined) b
 // migrateActiveProfileIfMissing (orchestrator)
 // ---------------------------------------------------------------------------
 
-test('migrateActiveProfileIfMissing is a no-op when the preference file exists', () => {
+test('migrateActiveProfileIfMissing is a no-op when a user-selected preference file exists', () => {
+  // No `_migrated` flag = explicit user/CLI choice. Even a huge other profile
+  // must not steal the pin.
   let written: unknown = null
 
+  const fs = makeFs({
+    '/cfg/active-profile.json': { content: '{"profile":"coder"}' },
+    '/home/u/.hermes/profiles/coder': { dir: true },
+    '/home/u/.hermes/profiles/writer': { dir: true },
+    '/home/u/.hermes/profiles/writer/state.db': { size: 400 * 1024 * 1024, mtime: NOW - 86_400_000 }
+  })
+
   const deps = baseDeps({
-    existsSync: (p: string) => p === '/cfg/active-profile.json',
+    ...fs,
     writeJson: (_p: string, payload: unknown) => {
       written = payload
     }
@@ -453,10 +468,11 @@ test('migrateActiveProfileIfMissing writes heuristic choice with _migrated=true'
 test('migrateActiveProfileIfMissing is a no-op for single-profile (default-only) installs', () => {
   // No heuristic candidate can beat 'default', so the orchestrator must NOT
   // write a file — preserves legacy launch behavior for the 99% case.
+  // Production default DB is ~/.hermes/state.db, not profiles/default/state.db.
   let written: unknown = null
 
   const fs = makeFs({
-    '/home/u/.hermes/profiles/default/state.db': { size: 10 * 1024 * 1024, mtime: NOW - 86_400_000 }
+    '/home/u/.hermes/state.db': { size: 10 * 1024 * 1024, mtime: NOW - 86_400_000 }
   })
 
   const deps = baseDeps({
@@ -506,3 +522,166 @@ test('migrateActiveProfileIfMissing prefers a single running gateway over heuris
   assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), true)
   assert.deepEqual(written, { profile: 'coder' })
 })
+
+// ---------------------------------------------------------------------------
+// Production layout: default is ~/.hermes, not ~/.hermes/profiles/default
+// ---------------------------------------------------------------------------
+
+test('profileStateDbPath puts default at hermesHome, named under profilesRoot', () => {
+  assert.equal(profileStateDbPath('default', '/home/u/.hermes', '/home/u/.hermes/profiles'), '/home/u/.hermes/state.db')
+  assert.equal(
+    profileStateDbPath('conduit', '/home/u/.hermes', '/home/u/.hermes/profiles'),
+    '/home/u/.hermes/profiles/conduit/state.db'
+  )
+})
+
+test('profileGatewayPidPath puts default at hermesHome', () => {
+  assert.equal(
+    profileGatewayPidPath('default', '/home/u/.hermes', '/home/u/.hermes/profiles'),
+    '/home/u/.hermes/gateway.pid'
+  )
+  assert.equal(
+    profileGatewayPidPath('coder', '/home/u/.hermes', '/home/u/.hermes/profiles'),
+    '/home/u/.hermes/profiles/coder/gateway.pid'
+  )
+})
+
+test('withDefaultCandidate always leads with default and dedupes', () => {
+  assert.deepEqual(withDefaultCandidate([]), ['default'])
+  assert.deepEqual(withDefaultCandidate(['conduit']), ['default', 'conduit'])
+  assert.deepEqual(withDefaultCandidate(['default', 'conduit']), ['default', 'conduit'])
+})
+
+test('findRunningGatewayProfiles sees default gateway.pid at hermesHome', () => {
+  const fs = makeFs({
+    '/home/u/.hermes/gateway.pid': { content: '{"pid":99}' },
+    '/home/u/.hermes/profiles/coder/gateway.pid': { content: '{"pid":11}' }
+  })
+
+  assert.deepEqual(
+    findRunningGatewayProfiles('/home/u/.hermes/profiles', ['default', 'coder'], {
+      ...fs,
+      hermesHome: '/home/u/.hermes',
+      isHermesProcess: pid => pid === 99
+    }),
+    ['default']
+  )
+})
+
+test('migrateActiveProfileIfMissing does not pin a tiny named profile over a large default DB', () => {
+  // Regression for #100576: first-boot after update listed only
+  // ~/.hermes/profiles/<name>, never scored ~/.hermes/state.db, and wrote
+  // { profile: named, _migrated: true }.
+  let written: unknown = null
+
+  const fs = makeFs({
+    '/home/u/.hermes/profiles/conduit': { dir: true },
+    '/home/u/.hermes/state.db': { size: 409 * 1024 * 1024, mtime: NOW - 86_400_000 },
+    '/home/u/.hermes/profiles/conduit/state.db': { size: 2 * 1024 * 1024, mtime: NOW - 60_000 }
+  })
+
+  const deps = baseDeps({
+    ...fs,
+    writeJson: (_p: string, payload: unknown) => {
+      written = payload
+    }
+  })
+
+  assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), false)
+  assert.equal(written, null)
+})
+
+test('migrateActiveProfileIfMissing still pins a named profile that actually beats default', () => {
+  let written: unknown = null
+
+  const fs = makeFs({
+    '/home/u/.hermes/profiles/work': { dir: true },
+    '/home/u/.hermes/state.db': { size: 5 * 1024 * 1024, mtime: NOW - 86_400_000 },
+    '/home/u/.hermes/profiles/work/state.db': { size: 200 * 1024 * 1024, mtime: NOW - 86_400_000 }
+  })
+
+  const deps = baseDeps({
+    ...fs,
+    writeJson: (_p: string, payload: unknown) => {
+      written = payload
+    }
+  })
+
+  assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), true)
+  assert.deepEqual(written, { profile: 'work', _migrated: true })
+})
+
+test('migrateActiveProfileIfMissing does not pin default when only default gateway is running', () => {
+  let written: unknown = null
+
+  const fs = makeFs({
+    '/home/u/.hermes/gateway.pid': { content: '{"pid":7}' },
+    '/home/u/.hermes/state.db': { size: 10 * 1024 * 1024, mtime: NOW - 86_400_000 }
+  })
+
+  const deps = baseDeps({
+    ...fs,
+    isHermesProcess: (pid: number) => pid === 7,
+    writeJson: (_p: string, payload: unknown) => {
+      written = payload
+    }
+  })
+
+  assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), false)
+  assert.equal(written, null)
+})
+
+test('readExistingPreference treats _migrated as heuristic-owned', () => {
+  const fs = makeFs({
+    '/cfg/active-profile.json': { content: '{"profile":"conduit","_migrated":true}' }
+  })
+
+  assert.deepEqual(readExistingPreference('/cfg/active-profile.json', fs.readFileSync), {
+    profile: 'conduit',
+    migrated: true
+  })
+})
+
+test('migrateActiveProfileIfMissing repairs a pre-existing heuristic pin when default now wins', () => {
+  // Sol P1 / #100576: file already exists with _migrated:true so first-boot
+  // skip left affected installs stuck. Re-score and clear.
+  let written: unknown = null
+
+  const fs = makeFs({
+    '/cfg/active-profile.json': { content: '{"profile":"conduit","_migrated":true}' },
+    '/home/u/.hermes/profiles/conduit': { dir: true },
+    '/home/u/.hermes/state.db': { size: 409 * 1024 * 1024, mtime: NOW - 86_400_000 },
+    '/home/u/.hermes/profiles/conduit/state.db': { size: 2 * 1024 * 1024, mtime: NOW - 60_000 }
+  })
+
+  const deps = baseDeps({
+    ...fs,
+    writeJson: (_p: string, payload: unknown) => {
+      written = payload
+    }
+  })
+
+  assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), true)
+  assert.deepEqual(written, { profile: null })
+})
+
+test('migrateActiveProfileIfMissing leaves a still-correct heuristic pin alone', () => {
+  let written: unknown = null
+
+  const fs = makeFs({
+    '/cfg/active-profile.json': { content: '{"profile":"work","_migrated":true}' },
+    '/home/u/.hermes/profiles/work': { dir: true },
+    '/home/u/.hermes/state.db': { size: 5 * 1024 * 1024, mtime: NOW - 86_400_000 },
+    '/home/u/.hermes/profiles/work/state.db': { size: 200 * 1024 * 1024, mtime: NOW - 86_400_000 }
+  })
+
+  const deps = baseDeps({
+    ...fs,
+    writeJson: (_p: string, payload: unknown) => {
+      written = payload
+    }
+  })
+
+  assert.equal(migrateActiveProfileIfMissing('/cfg/active-profile.json', deps), false)
+  assert.equal(written, null)
+})
diff --git a/apps/desktop/electron/profile-migration.ts b/apps/desktop/electron/profile-migration.ts
index dcf12b722d..6ba0ca7c69 100644
--- a/apps/desktop/electron/profile-migration.ts
+++ b/apps/desktop/electron/profile-migration.ts
@@ -15,6 +15,9 @@ export const PROFILE_SCORE_MIN_SIZE_BYTES = 1024
 
 export interface MigrationDeps {
   legacyActivePath: string
+  /** Default profile home (`~/.hermes`). Default's state.db and gateway.pid live here. */
+  hermesHome: string
+  /** Named-profile root (`~/.hermes/profiles`). Does not contain `default`. */
   profilesRoot: string
   existsSync: (path: string) => boolean
   readFileSync: (path: string, encoding: 'utf8') => string
@@ -27,11 +30,38 @@ export interface MigrationDeps {
 }
 
 export interface MigrationDecision {
-  profile: string
+  profile: string | null
   /** True when chosen from the state.db heuristic (auto-detected), undefined when explicit. */
   _migrated?: boolean
 }
 
+/**
+ * Production layout: default IS `hermesHome`; named profiles are children of
+ * `profilesRoot`. There is no `profiles/default` directory on a normal install.
+ */
+export function profileStateDbPath(name: string, hermesHome: string, profilesRoot: string): string {
+  return name === 'default' ? `${hermesHome}/state.db` : `${profilesRoot}/${name}/state.db`
+}
+
+export function profileGatewayPidPath(name: string, hermesHome: string, profilesRoot: string): string {
+  return name === 'default' ? `${hermesHome}/gateway.pid` : `${profilesRoot}/${name}/gateway.pid`
+}
+
+function resolveHermesHome(profilesRoot: string, hermesHome?: string): string {
+  if (hermesHome) {
+    return hermesHome
+  }
+
+  // Tests that predate hermesHome pass only profilesRoot.
+  for (const suffix of ['/profiles', '\\profiles']) {
+    if (profilesRoot.endsWith(suffix)) {
+      return profilesRoot.slice(0, -suffix.length)
+    }
+  }
+
+  return profilesRoot
+}
+
 /**
  * Parse the legacy CLI-sticky file. Returns the trimmed name on success, null when
  * missing/unreadable/empty, undefined when present but invalid (so the caller can
@@ -70,16 +100,20 @@ export function readLegacyActiveProfile(
  * Return the profile names whose gateway.pid file points to a live hermes process.
  * Tolerates missing/malformed pid files and stale-but-recycled PIDs (the latter is
  * the whole reason we check both liveness AND cmdline identity).
+ *
+ * `hermesHome` is optional so existing call sites that only pass `profilesRoot`
+ * still work: it is derived as the parent of `…/profiles`.
  */
 export function findRunningGatewayProfiles(
   profilesRoot: string,
   allProfiles: string[],
-  deps: Pick<MigrationDeps, 'existsSync' | 'readFileSync' | 'isHermesProcess'>
+  deps: Pick<MigrationDeps, 'existsSync' | 'readFileSync' | 'isHermesProcess'> & { hermesHome?: string }
 ): string[] {
+  const hermesHome = resolveHermesHome(profilesRoot, deps.hermesHome)
   const running: string[] = []
 
   for (const name of allProfiles) {
-    const pidFile = `${profilesRoot}/${name}/gateway.pid`
+    const pidFile = profileGatewayPidPath(name, hermesHome, profilesRoot)
 
     if (!deps.existsSync(pidFile)) {
       continue
@@ -156,7 +190,7 @@ export function decideMigration(
   let maxScore = -Infinity
 
   for (const name of candidates) {
-    const s = score(`${deps.profilesRoot}/${name}/state.db`)
+    const s = score(profileStateDbPath(name, deps.hermesHome, deps.profilesRoot))
 
     if (s == null) {
       continue
@@ -176,8 +210,9 @@ export function decideMigration(
 }
 
 /**
- * List known profile directory names under `profilesRoot`. Accepts `default` and
- * any name passing the injected validator. Returns [] on missing dir or empty.
+ * List named profile directory names under `profilesRoot`. A directory named
+ * `default` is accepted if present (unusual) but production default is not a
+ * child of this folder — see `withDefaultCandidate`.
  */
 export function listProfileDirs(deps: MigrationDeps): string[] {
   let entries: Dirent[]
@@ -193,25 +228,59 @@ export function listProfileDirs(deps: MigrationDeps): string[] {
     .map(e => e.name)
 }
 
+/** Default is always a candidate; it is `$HERMES_HOME`, not `$HERMES_HOME/profiles/default`. */
+export function withDefaultCandidate(named: string[]): string[] {
+  return ['default', ...named.filter(name => name !== 'default')]
+}
+
 /**
- * Orchestrator. Idempotent: writes at most once when the preference file is
- * missing. Thin on top of the decision helpers above; the testable surface is
- * `decideMigration` + the individual rung helpers, this function just glues them
- * to the deps bag.
+ * Read an existing active-profile.json. Returns null when missing/malformed.
+ * `_migrated: true` means the first-boot heuristic wrote it (safe to re-score).
+ * Absence of that flag is a user/CLI choice and must not be overwritten.
+ */
+export function readExistingPreference(
+  desktopProfileConfigPath: string,
+  readFile: MigrationDeps['readFileSync']
+): { profile: string | null; migrated: boolean } | null {
+  let parsed: unknown
+
+  try {
+    parsed = JSON.parse(readFile(desktopProfileConfigPath, 'utf8'))
+  } catch {
+    return null
+  }
+
+  if (!parsed || typeof parsed !== 'object') {
+    return null
+  }
+
+  const rec = parsed as { profile?: unknown; _migrated?: unknown }
+  const raw = typeof rec.profile === 'string' ? rec.profile.trim() : ''
+
+  return {
+    profile: raw || null,
+    migrated: rec._migrated === true
+  }
+}
+
+/**
+ * First-boot seed, plus repair of heuristic-owned files (`_migrated: true`).
+ * User-selected files (no `_migrated`) are never overwritten. When a repaired
+ * heuristic would now pick default, write `{ profile: null }` so Desktop drops
+ * `--profile` instead of pinning `default`.
  */
 export function migrateActiveProfileIfMissing(desktopProfileConfigPath: string, deps: MigrationDeps): boolean {
-  if (deps.existsSync(desktopProfileConfigPath)) {
+  const existing = deps.existsSync(desktopProfileConfigPath)
+    ? readExistingPreference(desktopProfileConfigPath, deps.readFileSync)
+    : null
+
+  if (existing && !existing.migrated) {
     return false
   }
 
   const legacyActive = readLegacyActiveProfile(deps.legacyActivePath, deps.readFileSync, deps.isValidProfileName)
 
-  const allProfiles = listProfileDirs(deps)
-
-  if (allProfiles.length === 0) {
-    return false
-  }
-
+  const allProfiles = withDefaultCandidate(listProfileDirs(deps))
   const running = findRunningGatewayProfiles(deps.profilesRoot, allProfiles, deps)
   const candidates = running.length > 1 ? running : allProfiles
 
@@ -219,7 +288,20 @@ export function migrateActiveProfileIfMissing(desktopProfileConfigPath: string,
     scoreStateDb(dbPath, deps.now(), deps.statSync)
   )
 
-  if (!decision) {
+  // Same as the heuristic rung: pinning `default` into active-profile.json
+  // launches `hermes --profile default` and is worse than writing nothing
+  // (legacy sticky / implicit default). Covers a lone default gateway.pid.
+  if (!decision || decision.profile === 'default') {
+    if (existing?.migrated) {
+      deps.writeJson(desktopProfileConfigPath, { profile: null })
+
+      return true
+    }
+
+    return false
+  }
+
+  if (existing?.migrated && existing.profile === decision.profile) {
     return false
   }
 
diff --git a/apps/desktop/electron/session-windows.test.ts b/apps/desktop/electron/session-windows.test.ts
index c0a1178429..64a9d6fb12 100644
--- a/apps/desktop/electron/session-windows.test.ts
+++ b/apps/desktop/electron/session-windows.test.ts
@@ -68,6 +68,12 @@ test('buildSessionWindowUrl avoids a double slash when the dev server has a trai
   assert.equal(url, 'http://localhost:5173/?win=secondary#/abc123')
 })
 
+test('buildSessionWindowUrl carries the owning profile in the query before the hash (#82768)', () => {
+  const url = buildSessionWindowUrl('abc123', { devServer: 'http://localhost:5173', profile: 'work', watch: true })
+
+  assert.equal(url, 'http://localhost:5173/?win=secondary&watch=1&profile=work#/abc123')
+})
+
 test('buildSessionWindowUrl encodes the session id in the hash route', () => {
   const url = buildSessionWindowUrl('a b/c', { devServer: 'http://localhost:5173' })
 
diff --git a/apps/desktop/electron/session-windows.ts b/apps/desktop/electron/session-windows.ts
index 19be87ff1c..5fbd456a5b 100644
--- a/apps/desktop/electron/session-windows.ts
+++ b/apps/desktop/electron/session-windows.ts
@@ -64,8 +64,13 @@ function chatWindowWebPreferences(preloadPath: string) {
 // onboarding overlays and the global session sidebar. `watch=1` marks a
 // spectator window (e.g. a running subagent's session): the renderer resumes it
 // lazily so the gateway never builds an agent just to stream into it.
-function buildSessionWindowUrl(sessionId: string, { devServer, rendererIndexPath, watch }: any = {}) {
-  const query = `?win=secondary${watch ? '&watch=1' : ''}`
+// `profile` names the backend the window must boot against (same carry as the
+// HUD's buildHudWindowUrl): without it a pop-out/watch window adopts the
+// PRIMARY profile and resolves the session id against the wrong backend
+// (#82768, #61286). Absent → unchanged primary adoption.
+function buildSessionWindowUrl(sessionId: string, { devServer, profile, rendererIndexPath, watch }: any = {}) {
+  const profileKey = typeof profile === 'string' ? profile.trim() : ''
+  const query = `?win=secondary${watch ? '&watch=1' : ''}${profileKey ? `&profile=${encodeURIComponent(profileKey)}` : ''}`
   const route = `#/${encodeURIComponent(sessionId)}`
 
   if (devServer) {
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 049b230b32..ff1fe6e890 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -27,7 +27,7 @@
     "profile:main": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron --inspect=9229 .",
     "profile:main:cpu": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 NODE_OPTIONS=--cpu-prof HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron .",
     "start": "npm run build && electron .",
-    "prebuild": "npm run clean",
+    "prebuild": "node scripts/assert-root-install.mjs && npm run clean",
     "build": "node scripts/assert-root-install.mjs && node scripts/write-build-stamp.mjs && vite build && node scripts/bundle-electron-main.mjs && node scripts/stage-native-deps.mjs",
     "postbuild": "node scripts/assert-dist-built.mjs",
     "prebuilder": "node scripts/patch-electron-builder-mac-binary.mjs",
diff --git a/apps/desktop/scripts/assert-root-install.mjs b/apps/desktop/scripts/assert-root-install.mjs
index 3a11031a3a..c3d388eabd 100644
--- a/apps/desktop/scripts/assert-root-install.mjs
+++ b/apps/desktop/scripts/assert-root-install.mjs
@@ -1,35 +1,146 @@
-import { accessSync, readFileSync } from "fs"
+// Build-time guard: refuse to start a build the installed tree cannot finish.
+//
+// The desktop workspace's dependencies are hoisted to the repo-root
+// `node_modules`, so a root install that only covers *part* of the workspace
+// graph leaves this app importable-looking but unbuildable. The guard exists to
+// turn that into one actionable line ("run npm ci from the repo root") instead
+// of a failure deep inside vite.
+//
+// It runs from `prebuild`, ahead of `npm run clean`, so a tree that cannot
+// build is rejected before the build starts deleting its own outputs. `build`
+// re-runs it for anyone invoking the build steps directly; the check is pure
+// filesystem lookups, so paying for it twice costs nothing.
+
+import { existsSync, readFileSync } from "fs"
 import { createRequire } from "module"
-import { resolve, join } from "path"
+import { resolve, join, dirname } from "path"
+import { isMain } from "./utils.mjs"
 
-const app = resolve(import.meta.dirname, "..")
-const root = resolve(app, "..", "..")
+// Packages the build *consumes*, as opposed to merely declares. Each one is
+// load-bearing for a distinct build step, and each one has been observed
+// missing from a partial root install:
+//
+//   vite            — bundles the renderer (`vite build`).
+//   katex           — `src/styles.css` imports `katex/dist/katex.min.css`, so
+//                     the CSS transform fails before a single chunk is emitted.
+//   electron        — the runtime electron-builder packages; without it `pack`
+//                     cannot produce an unpacked app at all.
+//   electron-builder — the packager `npm run builder` shells out to.
+//
+// Checking only `vite` (the original guard) passes a tree missing any of the
+// others, which is how an incomplete install reached `vite build` and died on
+// an unresolved `katex/dist/katex.min.css` with no hint that the install — not
+// the source — was at fault (#86443).
+//
+// These four are the documented floor — always checked, even when the app's
+// package.json cannot be read. The full class is wider: EVERY non-optional
+// package the workspace manifest declares is something the build may import
+// (`vite.config.ts` pulls `@rolldown/plugin-babel`, `@vitejs/plugin-react`,
+// `@tailwindcss/vite`; `bundle-electron-main.mjs` pulls `esbuild`; the renderer
+// imports the rest). A hand-maintained list drifts the moment a new import
+// lands, so `checkRootInstall` unions the floor with the manifest's declared
+// `dependencies` + `devDependencies` — a partial install is refused whichever
+// package it happened to drop. `optionalDependencies` are excluded by design:
+// npm legitimately skips them (platform-gated natives like `get-windows`).
+const BUILD_CRITICAL_PACKAGES = ["vite", "katex", "electron", "electron-builder"]
+export { BUILD_CRITICAL_PACKAGES }
 
-try {
-  accessSync(join(root, "node_modules", "vite", "package.json"))
-} catch {
-  console.error(`Run from repo root: cd ${root} && npm ci`)
-  process.exit(1)
+// Resolve the way Node's own lookup does — walk `node_modules` upward — rather
+// than through `require.resolve`. A package whose `exports` map does not expose
+// `./package.json` is not resolvable by path even when correctly installed, and
+// that must not read as "missing". Scoped names (`@scope/name`) are a nested
+// directory under `node_modules`, which `join` handles.
+function packageIsInstalled(name, fromDir) {
+  let dir = fromDir
+  for (;;) {
+    if (existsSync(join(dir, "node_modules", name, "package.json"))) return true
+    const parent = dirname(dir)
+    if (parent === dir) return false
+    dir = parent
+  }
 }
 
-// `vite.config.ts` aliases react/react-dom to whatever this workspace resolves,
-// and React refuses to run when the two come from different installed copies
-// ("Minified React error #527" — it throws before the first paint, so the app
-// window stays blank). npm stays silent about the split because the hoisted
-// react still satisfies react-dom's caret peer range. Fail the build loudly
-// instead of shipping a white screen.
-const requireFromApp = createRequire(join(app, "package.json"))
-const installedVersion = (pkg) =>
-  JSON.parse(readFileSync(requireFromApp.resolve(`${pkg}/package.json`), "utf8")).version
-
-const react = installedVersion("react")
-const reactDom = installedVersion("react-dom")
-
-if (react !== reactDom) {
-  console.error(
-    `react@${react} / react-dom@${reactDom} version mismatch — React would fail ` +
-      `with error #527 and render a blank window. Pin both to the same version ` +
-      `in ${join(app, "package.json")}, then reinstall: cd ${root} && npm ci`
-  )
-  process.exit(1)
+// Every package the workspace manifest at `appDir` declares as required
+// (`dependencies` + `devDependencies`; never `optionalDependencies`). An
+// unreadable or malformed manifest yields [] — the floor still applies, and
+// the build's own manifest read fails loudly on its own.
+export function requiredPackages(appDir) {
+  try {
+    const manifest = JSON.parse(readFileSync(join(appDir, "package.json"), "utf8"))
+    return [
+      ...Object.keys(manifest.dependencies ?? {}),
+      ...Object.keys(manifest.devDependencies ?? {}),
+    ]
+  } catch {
+    return []
+  }
+}
+
+// Pure check — returns { ok: true } or { ok: false, error: "..." }.
+// Kept side-effect-free so it can be unit tested without spawning a process.
+export function checkRootInstall(appDir, rootDir) {
+  const wanted = [...new Set([...BUILD_CRITICAL_PACKAGES, ...requiredPackages(appDir)])]
+  const missing = wanted.filter(pkg => !packageIsInstalled(pkg, appDir))
+  if (missing.length > 0) {
+    return {
+      ok: false,
+      error:
+        `the desktop build needs ${missing.join(", ")}, which the current install ` +
+        `does not provide. A partial root install leaves the workspace looking ` +
+        `present while the build cannot complete. Reinstall from the repo root: ` +
+        `cd ${rootDir} && npm ci`
+    }
+  }
+
+  // `vite.config.ts` aliases react/react-dom to whatever this workspace resolves,
+  // and React refuses to run when the two come from different installed copies
+  // ("Minified React error #527" — it throws before the first paint, so the app
+  // window stays blank). npm stays silent about the split because the hoisted
+  // react still satisfies react-dom's caret peer range. Fail the build loudly
+  // instead of shipping a white screen.
+  const requireFromApp = createRequire(join(appDir, "package.json"))
+  const installedVersion = pkg =>
+    JSON.parse(readFileSync(requireFromApp.resolve(`${pkg}/package.json`), "utf8")).version
+
+  let react
+  let reactDom
+  try {
+    react = installedVersion("react")
+    reactDom = installedVersion("react-dom")
+  } catch (err) {
+    // Both are in BUILD_CRITICAL_PACKAGES' spirit but not its list: they are
+    // checked by version, and an unreadable package.json is a broken install
+    // rather than an absent one. Report it as such instead of throwing.
+    return {
+      ok: false,
+      error: `could not read the installed react/react-dom versions (${err.message}). Reinstall from the repo root: cd ${rootDir} && npm ci`
+    }
+  }
+
+  if (react !== reactDom) {
+    return {
+      ok: false,
+      error:
+        `react@${react} / react-dom@${reactDom} version mismatch — React would fail ` +
+        `with error #527 and render a blank window. Pin both to the same version ` +
+        `in ${join(appDir, "package.json")}, then reinstall: cd ${rootDir} && npm ci`
+    }
+  }
+
+  return { ok: true }
+}
+
+function main() {
+  const app = resolve(import.meta.dirname, "..")
+  const root = resolve(app, "..", "..")
+  const result = checkRootInstall(app, root)
+
+  if (!result.ok) {
+    console.error(`✗ assert-root-install: ${result.error}`)
+    process.exit(1)
+  }
+}
+
+if (isMain(import.meta.url)) {
+  main()
 }
diff --git a/apps/desktop/scripts/assert-root-install.test.mjs b/apps/desktop/scripts/assert-root-install.test.mjs
new file mode 100644
index 0000000000..0d7ea4af6f
--- /dev/null
+++ b/apps/desktop/scripts/assert-root-install.test.mjs
@@ -0,0 +1,197 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { test } from 'vitest'
+
+import { BUILD_CRITICAL_PACKAGES as BUILD_CRITICAL, checkRootInstall, requiredPackages } from '../scripts/assert-root-install.mjs'
+
+// Build a throwaway repo shaped like this one: an app workspace whose
+// dependencies are hoisted to the repo root, which is what the guard walks.
+// `manifest` is merged into the app's package.json so tests can declare
+// dependencies the guard is expected to read.
+function makeTree({ rootPackages = BUILD_CRITICAL, react = '19.2.7', reactDom = '19.2.7', manifest = {} } = {}) {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hermes-assert-root-'))
+  const appDir = path.join(tempRoot, 'apps', 'desktop')
+  fs.mkdirSync(appDir, { recursive: true })
+  fs.writeFileSync(path.join(appDir, 'package.json'), JSON.stringify({ name: 'desktop', ...manifest }), 'utf8')
+
+  const writePackage = (name, version) => {
+    const dir = path.join(tempRoot, 'node_modules', name)
+    fs.mkdirSync(dir, { recursive: true })
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name, version }), 'utf8')
+  }
+  for (const name of rootPackages) writePackage(name, '1.0.0')
+  if (react !== null) writePackage('react', react)
+  if (reactDom !== null) writePackage('react-dom', reactDom)
+
+  return { tempRoot, appDir }
+}
+
+test('checkRootInstall passes on a complete root install', () => {
+  const { tempRoot, appDir } = makeTree()
+  try {
+    assert.deepEqual(checkRootInstall(appDir, tempRoot), { ok: true })
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// The regression this guard was widened for: the updater's partial `npm install`
+// left katex out while vite was present, so the old vite-only check passed and
+// the build died on an unresolved `katex/dist/katex.min.css` (#86443).
+test('checkRootInstall fails when katex is missing but vite is present', () => {
+  const { tempRoot, appDir } = makeTree({
+    rootPackages: BUILD_CRITICAL.filter(name => name !== 'katex')
+  })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /katex/)
+    assert.match(result.error, /npm ci/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('checkRootInstall fails when electron is missing', () => {
+  const { tempRoot, appDir } = makeTree({
+    rootPackages: BUILD_CRITICAL.filter(name => name !== 'electron')
+  })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /electron/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('checkRootInstall reports every missing package at once', () => {
+  const { tempRoot, appDir } = makeTree({ rootPackages: ['vite'] })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    for (const name of ['katex', 'electron', 'electron-builder']) {
+      assert.match(result.error, new RegExp(name))
+    }
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// The original guard's only check — kept, so widening coverage cannot silently
+// drop the case it already handled.
+test('checkRootInstall still fails when vite is missing', () => {
+  const { tempRoot, appDir } = makeTree({
+    rootPackages: BUILD_CRITICAL.filter(name => name !== 'vite')
+  })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /vite/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('checkRootInstall fails on a react/react-dom version split', () => {
+  const { tempRoot, appDir } = makeTree({ react: '19.2.7', reactDom: '19.1.0' })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /#527/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// A package installed into the app's own node_modules rather than hoisted to the
+// root is still installed. The guard walks upward like Node does, so it must not
+// insist on the hoisted location.
+test('checkRootInstall accepts a package nested in the app workspace', () => {
+  const { tempRoot, appDir } = makeTree({
+    rootPackages: BUILD_CRITICAL.filter(name => name !== 'katex')
+  })
+  const nested = path.join(appDir, 'node_modules', 'katex')
+  fs.mkdirSync(nested, { recursive: true })
+  fs.writeFileSync(path.join(nested, 'package.json'), JSON.stringify({ name: 'katex' }), 'utf8')
+  try {
+    assert.deepEqual(checkRootInstall(appDir, tempRoot), { ok: true })
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// The class, not the four instances: the floor list is what a partial install
+// has been *seen* to drop, but any declared non-optional package can be the one
+// missing next (`vite.config.ts` imports `@rolldown/plugin-babel`, which the
+// floor never named). The guard must read the manifest so the list cannot drift
+// behind a new import.
+test('checkRootInstall fails when a declared devDependency outside the floor is missing', () => {
+  const { tempRoot, appDir } = makeTree({
+    manifest: { devDependencies: { '@rolldown/plugin-babel': '1.0.0', esbuild: '1.0.0' } },
+    rootPackages: [...BUILD_CRITICAL, 'esbuild']
+  })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /@rolldown\/plugin-babel/)
+    assert.doesNotMatch(result.error, /esbuild/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('checkRootInstall fails when a declared runtime dependency is missing', () => {
+  const { tempRoot, appDir } = makeTree({
+    manifest: { dependencies: { '@vscode/codicons': '1.0.0' } }
+  })
+  try {
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /@vscode\/codicons/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// npm skips optionalDependencies legitimately (platform-gated natives), so an
+// absent optional package is not a partial install.
+test('checkRootInstall ignores missing optionalDependencies', () => {
+  const { tempRoot, appDir } = makeTree({
+    manifest: { optionalDependencies: { 'get-windows': '9.3.0' } }
+  })
+  try {
+    assert.deepEqual(checkRootInstall(appDir, tempRoot), { ok: true })
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+test('checkRootInstall passes when every declared package is installed', () => {
+  const { tempRoot, appDir } = makeTree({
+    manifest: { dependencies: { '@scope/pkg': '1.0.0' }, devDependencies: { esbuild: '1.0.0' } },
+    rootPackages: [...BUILD_CRITICAL, '@scope/pkg', 'esbuild']
+  })
+  try {
+    assert.deepEqual(checkRootInstall(appDir, tempRoot), { ok: true })
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
+
+// The floor is unconditional: a manifest the guard cannot parse must not turn
+// the check off.
+test('checkRootInstall keeps the floor when the manifest is unreadable', () => {
+  const { tempRoot, appDir } = makeTree({ rootPackages: ['vite'] })
+  fs.writeFileSync(path.join(appDir, 'package.json'), '{not json', 'utf8')
+  try {
+    assert.deepEqual(requiredPackages(appDir), [])
+    const result = checkRootInstall(appDir, tempRoot)
+    assert.equal(result.ok, false)
+    assert.match(result.error, /katex/)
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
+})
diff --git a/apps/desktop/src/api/local-models.ts b/apps/desktop/src/api/local-models.ts
new file mode 100644
index 0000000000..39c883e75c
--- /dev/null
+++ b/apps/desktop/src/api/local-models.ts
@@ -0,0 +1,166 @@
+import type { LocalCatalogModel, LocalHardware, LocalModelsStatus, LocalRuntimeJob } from '@/types/hermes'
+
+import { hermesApi, profileScoped } from './client'
+
+// The desktop surface of the managed llama.cpp runtime: status/catalog
+// reads, download/install/activate jobs, and server control.
+
+export function getLocalModelsStatus(): Promise<LocalModelsStatus> {
+  return hermesApi<LocalModelsStatus>({
+    ...profileScoped(),
+    path: '/api/local-models/status'
+  })
+}
+
+export function getLocalHardware(): Promise<LocalHardware> {
+  return hermesApi<LocalHardware>({
+    ...profileScoped(),
+    path: '/api/local-models/hardware'
+  })
+}
+
+export function getLocalCatalog(): Promise<{ models: LocalCatalogModel[] }> {
+  return hermesApi<{ models: LocalCatalogModel[] }>({
+    ...profileScoped(),
+    path: '/api/local-models/catalog'
+  })
+}
+
+export function installLocalRuntime(backend?: string): Promise<{ backend: string; job_id: string; tag: string }> {
+  return hermesApi<{ backend: string; job_id: string; tag: string }>({
+    ...profileScoped(),
+    body: { backend: backend ?? null },
+    method: 'POST',
+    path: '/api/local-models/runtime/install'
+  })
+}
+
+export interface QuickstartResponse {
+  display_name: string
+  download_bytes: number
+  job_id: string
+  model_id: string
+  needs_download: boolean
+  needs_runtime: boolean
+}
+
+export function quickstartLocalModels(modelId?: string): Promise<QuickstartResponse> {
+  return hermesApi<QuickstartResponse>({
+    ...profileScoped(),
+    body: { model_id: modelId ?? null },
+    method: 'POST',
+    path: '/api/local-models/quickstart'
+  })
+}
+
+export function downloadLocalModel(modelId: string): Promise<{ already_downloaded?: boolean; job_id: null | string }> {
+  return hermesApi<{ already_downloaded?: boolean; job_id: null | string }>({
+    ...profileScoped(),
+    body: { model_id: modelId },
+    method: 'POST',
+    path: '/api/local-models/download'
+  })
+}
+
+export function deleteLocalModel(modelId: string): Promise<{ ok: boolean }> {
+  return hermesApi<{ ok: boolean }>({
+    ...profileScoped(),
+    method: 'DELETE',
+    path: `/api/local-models/models/${encodeURIComponent(modelId)}`
+  })
+}
+
+export function getLocalRuntimeJob(jobId: string): Promise<LocalRuntimeJob> {
+  return hermesApi<LocalRuntimeJob>({
+    ...profileScoped(),
+    path: `/api/local-models/jobs/${encodeURIComponent(jobId)}`
+  })
+}
+
+export function getLocalModelsJobs(): Promise<{ jobs: LocalRuntimeJob[] }> {
+  return hermesApi<{ jobs: LocalRuntimeJob[] }>({
+    ...profileScoped(),
+    path: '/api/local-models/jobs'
+  })
+}
+
+export function activateLocalModel(modelId: string): Promise<{ job_id: string }> {
+  return hermesApi<{ job_id: string }>({
+    ...profileScoped(),
+    body: { model_id: modelId },
+    method: 'POST',
+    path: '/api/local-models/activate'
+  })
+}
+
+export function ejectLocalModel(modelId: string): Promise<{ ok: boolean }> {
+  return hermesApi<{ ok: boolean }>({
+    ...profileScoped(),
+    body: { model_id: modelId },
+    method: 'POST',
+    path: '/api/local-models/eject'
+  })
+}
+
+export function setLocalServer(action: 'start' | 'stop'): Promise<{ ok: boolean }> {
+  return hermesApi<{ ok: boolean }>({
+    ...profileScoped(),
+    body: { action },
+    method: 'POST',
+    path: '/api/local-models/server'
+  })
+}
+
+// ── Hugging Face browser + sideload ─────────────────────────────
+
+export interface HFSearchHit {
+  repo: string
+  downloads: number
+  likes: number
+  updated: string
+  gated: boolean
+}
+
+export interface HFFileGroup {
+  label: string
+  paths: string[]
+  total_bytes: number
+  fit: 'fits-gpu' | 'needs-ram' | 'too-big' | 'unknown'
+}
+
+export function searchHFModels(q: string, limit = 20): Promise<{ hits: HFSearchHit[] }> {
+  return hermesApi<{ hits: HFSearchHit[] }>({
+    ...profileScoped(),
+    path: `/api/local-models/search?q=${encodeURIComponent(q)}&limit=${limit}`
+  })
+}
+
+export function listHFRepoFiles(repo: string): Promise<{ files: HFFileGroup[] }> {
+  return hermesApi<{ files: HFFileGroup[] }>({
+    ...profileScoped(),
+    path: `/api/local-models/search/files?repo=${encodeURIComponent(repo)}`
+  })
+}
+
+export function downloadBrowsedModel(
+  repo: string,
+  paths: string[]
+): Promise<{ already_downloaded?: boolean; job_id: null | string; model_id: string }> {
+  return hermesApi<{ already_downloaded?: boolean; job_id: null | string; model_id: string }>({
+    ...profileScoped(),
+    body: { paths, repo },
+    method: 'POST',
+    path: '/api/local-models/download-browsed'
+  })
+}
+
+export function sideloadLocalModel(
+  path: string
+): Promise<{ already_present?: boolean; model_id: string; ok: boolean }> {
+  return hermesApi<{ already_present?: boolean; model_id: string; ok: boolean }>({
+    ...profileScoped(),
+    body: { path },
+    method: 'POST',
+    path: '/api/local-models/sideload'
+  })
+}
diff --git a/apps/desktop/src/api/sessions.ts b/apps/desktop/src/api/sessions.ts
index 8c2f358a5d..61368921bc 100644
--- a/apps/desktop/src/api/sessions.ts
+++ b/apps/desktop/src/api/sessions.ts
@@ -148,6 +148,11 @@ export interface SidebarSessionSlice {
   /** Per-profile tokens and spend over every session, not just this window.
    *  Absent from the legacy per-slice endpoint, which has no aggregate. */
   profiles_usage?: Record<string, { cost_usd: number; tokens: number }>
+  /** Profiles whose scan for THIS slice failed. Batched `/sidebar` stamps the
+   *  same profile errors on every slice (one DB open). Legacy per-slice calls
+   *  stamp only the slice that actually failed, so a cron I/O error cannot
+   *  carry-forward recents. */
+  errors?: Array<{ profile: string; error: string }>
 }
 
 /** Which profiles filled their per-profile window in a returned page. The
@@ -216,16 +221,24 @@ async function listSidebarSessionsLegacy(req: SidebarSessionsRequest): Promise<S
     })
   ])
 
-  const errors = [...(recents.errors ?? []), ...(cron.errors ?? []), ...(messaging.errors ?? [])]
+  const recentsErrors = recents.errors ?? []
+  const cronErrors = cron.errors ?? []
+  const messagingErrors = messaging.errors ?? []
 
   return {
     recents: {
       profiles_truncated: profilesTruncatedFrom(recents.sessions, req.recentsLimit),
-      sessions: recents.sessions
+      sessions: recents.sessions,
+      ...(recentsErrors.length ? { errors: recentsErrors } : {})
     },
-    cron: { sessions: cron.sessions },
-    messaging: { sessions: messaging.sessions },
-    ...(errors.length ? { errors } : {})
+    cron: {
+      sessions: cron.sessions,
+      ...(cronErrors.length ? { errors: cronErrors } : {})
+    },
+    messaging: {
+      sessions: messaging.sessions,
+      ...(messagingErrors.length ? { errors: messagingErrors } : {})
+    }
   }
 }
 
@@ -288,9 +301,21 @@ export async function listSidebarSessions(req: SidebarSessionsRequest): Promise<
   }
 
   return {
-    recents: { ...result.recents, sessions: stampActiveConnectionOwner(result.recents?.sessions ?? []) },
-    cron: { ...result.cron, sessions: stampActiveConnectionOwner(result.cron?.sessions ?? []) },
-    messaging: { ...result.messaging, sessions: stampActiveConnectionOwner(result.messaging?.sessions ?? []) },
+    recents: {
+      ...result.recents,
+      sessions: stampActiveConnectionOwner(result.recents?.sessions ?? []),
+      ...(result.errors?.length ? { errors: result.errors } : {})
+    },
+    cron: {
+      ...result.cron,
+      sessions: stampActiveConnectionOwner(result.cron?.sessions ?? []),
+      ...(result.errors?.length ? { errors: result.errors } : {})
+    },
+    messaging: {
+      ...result.messaging,
+      sessions: stampActiveConnectionOwner(result.messaging?.sessions ?? []),
+      ...(result.errors?.length ? { errors: result.errors } : {})
+    },
     errors: result.errors
   }
 }
diff --git a/apps/desktop/src/api/system.ts b/apps/desktop/src/api/system.ts
index 678d09e549..ba2e0bbcca 100644
--- a/apps/desktop/src/api/system.ts
+++ b/apps/desktop/src/api/system.ts
@@ -3,6 +3,7 @@ import type {
   ActionStatusResponse,
   AudioSpeakResponse,
   AudioTranscriptionResponse,
+  AudioTtsLeaseResponse,
   BackendUpdateCheckResponse,
   CuratorStatusResponse,
   DebugShareResponse,
@@ -196,6 +197,26 @@ export function speakText(text: string): Promise<AudioSpeakResponse> {
   })
 }
 
+// Acquiring a lease pre-loads the configured TTS engine. For local engines
+// that is a model load and, on a fresh install, a voice download — well past
+// the default 15s Electron backend timeout.
+export const AUDIO_TTS_LEASE_REQUEST_TIMEOUT_MS = 180_000
+
+/**
+ * Tell the backend a speech-output toggle flipped so it can warm the TTS engine
+ * (`active: true`) or release it once no surface needs it (`active: false`).
+ * `lease` names the toggle — `desktop:read-aloud`, `desktop:conversation`.
+ */
+export function setTtsLease(lease: string, active: boolean): Promise<AudioTtsLeaseResponse> {
+  return hermesApi<AudioTtsLeaseResponse>({
+    ...profileScoped(),
+    path: '/api/audio/tts-lease',
+    method: 'POST',
+    body: { active, lease },
+    timeoutMs: AUDIO_TTS_LEASE_REQUEST_TIMEOUT_MS
+  })
+}
+
 export function getElevenLabsVoices(profile?: null | string): Promise<ElevenLabsVoicesResponse> {
   return hermesApi<ElevenLabsVoicesResponse>({
     path: '/api/audio/elevenlabs/voices',
diff --git a/apps/desktop/src/app/agents/index.tsx b/apps/desktop/src/app/agents/index.tsx
index eb74a2d2a7..5ac16a71fd 100644
--- a/apps/desktop/src/app/agents/index.tsx
+++ b/apps/desktop/src/app/agents/index.tsx
@@ -143,19 +143,56 @@ const flatten = (nodes: readonly SubagentNode[]): SubagentNode[] =>
 interface RootGroup {
   id: string
   delegationIndex: number
+  /** Short batch tag (`deleg_6a664903` → `6a66`) when the backend sent one. */
+  batchTag?: string
   nodes: SubagentNode[]
   taskCount: number
 }
 
+/** `deleg_6a664903` → `6a66`; mirrors tools.delegate_tool.format_batch_tag. */
+export const batchTagOf = (delegationId: string | undefined): string | undefined => {
+  if (!delegationId) {
+    return undefined
+  }
+
+  const short = delegationId.split('_').at(-1)?.slice(0, 4)
+
+  return short || undefined
+}
+
 function groupDelegations(roots: readonly SubagentNode[]): RootGroup[] {
   const groups: RootGroup[] = []
   let n = 0
 
   for (const node of roots) {
+    // Exact grouping when the backend tags workers with their batch id —
+    // concurrent or nested fan-outs of the same shape must not merge.
+    if (node.delegationId) {
+      const byId = groups.find(g => g.id === `delegation:${node.delegationId}`)
+
+      if (byId) {
+        byId.nodes.push(node)
+
+        continue
+      }
+
+      n += 1
+      groups.push({
+        id: `delegation:${node.delegationId}`,
+        delegationIndex: n,
+        batchTag: batchTagOf(node.delegationId),
+        nodes: [node],
+        taskCount: node.taskCount
+      })
+
+      continue
+    }
+
+    // Older backends (no delegation_id): heuristic grouping by shape + time.
     const prev = groups.at(-1)
     const prevTail = prev?.nodes.at(-1)
     const closeInTime = prevTail ? Math.abs(node.startedAt - prevTail.startedAt) <= 5_000 : false
-    const sameShape = prev && node.taskCount > 1 && prev.taskCount === node.taskCount
+    const sameShape = prev && !prev.batchTag && node.taskCount > 1 && prev.taskCount === node.taskCount
     const uniqueStep = prev ? !prev.nodes.some(item => item.taskIndex === node.taskIndex) : false
 
     if (prev && sameShape && closeInTime && uniqueStep) {
@@ -248,7 +285,10 @@ function DelegationGroup({ group, nowMs }: { group: RootGroup; nowMs: number })
   return (
     <section className="grid min-w-0 gap-3">
       <p className="text-[0.66rem] font-medium uppercase tracking-wider text-muted-foreground/70">
-        {group.delegationIndex > 0 ? t.agents.delegation(group.delegationIndex) : ''}{' '}
+        {group.delegationIndex > 0 ? t.agents.delegation(group.delegationIndex) : ''}
+        {group.batchTag ? (
+          <span className="ml-1 font-mono text-muted-foreground/60">[{group.batchTag}]</span>
+        ) : null}{' '}
         <span className="text-muted-foreground/50">·</span> {t.agents.workers(group.nodes.length)}
         {activeWorkers > 0 ? <span className="text-primary/85"> · {t.agents.workersActive(activeWorkers)}</span> : null}
       </p>
diff --git a/apps/desktop/src/app/chat/composer/composer-utils.test.ts b/apps/desktop/src/app/chat/composer/composer-utils.test.ts
index 746115002c..5f523e844f 100644
--- a/apps/desktop/src/app/chat/composer/composer-utils.test.ts
+++ b/apps/desktop/src/app/chat/composer/composer-utils.test.ts
@@ -7,6 +7,7 @@ import {
   isPendingDraftPersistCurrent,
   type PendingDraftPersist,
   pickPlaceholder,
+  shouldDisableComposerInput,
   slashArgStage,
   slashChipKindForItem,
   slashCommandToken,
@@ -16,6 +17,26 @@ import {
 const item = (group: string): Unstable_TriggerItem =>
   ({ id: 'x', type: 'slash', label: 'x', metadata: { group } }) as unknown as Unstable_TriggerItem
 
+describe('shouldDisableComposerInput', () => {
+  it.each(['idle', 'connecting', 'closed', 'error'] as const)(
+    'keeps the draft editable while the gateway is %s',
+    gatewayState => {
+      expect(shouldDisableComposerInput(true, gatewayState)).toBe(false)
+    }
+  )
+
+  it('fails closed when connection atoms disagree about an open gateway', () => {
+    expect(shouldDisableComposerInput(true, 'open')).toBe(true)
+  })
+
+  it.each(['idle', 'connecting', 'open', 'closed', 'error'] as const)(
+    'never disables an otherwise enabled composer while the gateway is %s',
+    gatewayState => {
+      expect(shouldDisableComposerInput(false, gatewayState)).toBe(false)
+    }
+  )
+})
+
 describe('slashArgStage', () => {
   it('is true only once the query is past the command name', () => {
     expect(slashArgStage('personality')).toBe(false)
diff --git a/apps/desktop/src/app/chat/composer/composer-utils.ts b/apps/desktop/src/app/chat/composer/composer-utils.ts
index 65b141a0de..97852c3133 100644
--- a/apps/desktop/src/app/chat/composer/composer-utils.ts
+++ b/apps/desktop/src/app/chat/composer/composer-utils.ts
@@ -1,4 +1,5 @@
 import type { Unstable_TriggerItem } from '@assistant-ui/core'
+import type { ConnectionState } from '@hermes/shared'
 
 import type { SlashChipKind } from '@/components/assistant-ui/directive-text'
 import type { ComposerAttachment } from '@/store/composer'
@@ -52,6 +53,18 @@ export const COMPOSER_FADE_BACKGROUND =
 // unmount/pagehide flushes bypass it.
 export const DRAFT_PERSIST_DEBOUNCE_MS = 400
 
+/**
+ * Keep a reconnecting draft editable so transient gateway dials cannot blur
+ * the editor and discard the user's caret. Submission still reads the
+ * independent `disabled` prop, so non-open states cannot send.
+ *
+ * An `open` state paired with `disabled=true` is a transient disagreement
+ * between the connection atoms; fail closed until they converge.
+ */
+export function shouldDisableComposerInput(disabled: boolean, gatewayState: ConnectionState): boolean {
+  return disabled && gatewayState === 'open'
+}
+
 export const pickPlaceholder = (pool: readonly string[]) => pool[Math.floor(Math.random() * pool.length)]
 
 /** Completion items can carry an `action` (set in use-slash-completions) that
diff --git a/apps/desktop/src/app/chat/composer/hooks/use-composer-voice.ts b/apps/desktop/src/app/chat/composer/hooks/use-composer-voice.ts
index ffe6c4707f..9a7db494ee 100644
--- a/apps/desktop/src/app/chat/composer/hooks/use-composer-voice.ts
+++ b/apps/desktop/src/app/chat/composer/hooks/use-composer-voice.ts
@@ -5,6 +5,7 @@ import { useI18n } from '@/i18n'
 import { chatMessageText, collectUnspokenTurnSpeech } from '@/lib/chat-messages'
 import { triggerHaptic } from '@/lib/haptics'
 import { markAssistantIdSpoken, resolveSpokenReply } from '@/lib/spoken-reply'
+import { CONVERSATION_LEASE, READ_ALOUD_LEASE, syncTtsLease } from '@/lib/tts-lease'
 import { clearWakeIndicator, syncWakeIndicatorWithVoice } from '@/lib/wake-indicator'
 import { $voiceConversationStartRequest, takeVoiceConversationStart } from '@/store/composer'
 import { resetBrowseState } from '@/store/composer-input-history'
@@ -265,6 +266,26 @@ export function useComposerVoice({
 
   useEffect(() => resumeWakeIfPaused, [resumeWakeIfPaused])
 
+  // Speech-output toggles are TTS warm-up / release signals. Entering a voice
+  // conversation acquires this window's lease (pre-loads the engine so the
+  // first spoken reply doesn't start with dead air); ending it releases the
+  // lease, and the backend unloads resident local models once no surface holds
+  // one. Fire-and-forget — the toggle never waits on or fails from this.
+  useEffect(() => {
+    void syncTtsLease(CONVERSATION_LEASE, voiceConversationActive)
+  }, [voiceConversationActive])
+
+  useEffect(() => () => void syncTtsLease(CONVERSATION_LEASE, false), [])
+
+  // "Read replies aloud" is the same signal, held for as long as the toggle is
+  // on (it mirrors voice.auto_tts, so this also warms at startup when the
+  // preference is already set).
+  const autoSpeakReplies = useStore($autoSpeakReplies)
+
+  useEffect(() => {
+    void syncTtsLease(READ_ALOUD_LEASE, autoSpeakReplies)
+  }, [autoSpeakReplies])
+
   // Explicit start/end for the on-screen conversation controls (the hotkey uses
   // the gated toggle above).
   const startConversation = useCallback(() => setVoiceConversationActive(true), [])
diff --git a/apps/desktop/src/app/chat/composer/index.tsx b/apps/desktop/src/app/chat/composer/index.tsx
index 3764633db6..b01381e41d 100644
--- a/apps/desktop/src/app/chat/composer/index.tsx
+++ b/apps/desktop/src/app/chat/composer/index.tsx
@@ -35,6 +35,7 @@ import {
   COMPOSER_FADE_BACKGROUND,
   implicitSlashAcceptIndex,
   type QueueEditState,
+  shouldDisableComposerInput,
   slashArgStage
 } from './composer-utils'
 import { ContextMenu } from './context-menu'
@@ -220,8 +221,8 @@ export function ChatBar({
 
   const { t } = useI18n()
   const gatewayState = useStore($gatewayState)
-  const reconnecting = gatewayState === 'closed' || gatewayState === 'error'
-  const inputDisabled = disabled && !reconnecting
+  const reconnecting = gatewayState !== 'open'
+  const inputDisabled = shouldDisableComposerInput(disabled, gatewayState)
 
   // The draft engine — detached source of truth (DOM + draftRef + edge
   // selectors); typing never re-renders the chrome. ChatBar owns `queueEditRef`
diff --git a/apps/desktop/src/app/chat/session-tile-owner-route.test.ts b/apps/desktop/src/app/chat/session-tile-owner-route.test.ts
deleted file mode 100644
index 31058c578d..0000000000
--- a/apps/desktop/src/app/chat/session-tile-owner-route.test.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { readFileSync } from 'node:fs'
-import { resolve } from 'node:path'
-
-import { describe, expect, it } from 'vitest'
-
-const source = readFileSync(resolve(process.cwd(), 'src/app/chat/session-tile.tsx'), 'utf8')
-
-describe('SessionTilePane owner-scoped listing', () => {
-  it('resolves a newly active tile on its persisted owner route', () => {
-    expect(source).toContain('void resolveStoredSession(storedSessionId, ownerRoute)')
-    expect(source).not.toMatch(/void resolveStoredSession\(storedSessionId\)\s*\n/)
-  })
-})
diff --git a/apps/desktop/src/app/chat/session-tile-owner.test.ts b/apps/desktop/src/app/chat/session-tile-owner.test.ts
new file mode 100644
index 0000000000..6df849b63a
--- /dev/null
+++ b/apps/desktop/src/app/chat/session-tile-owner.test.ts
@@ -0,0 +1,71 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+
+import { _resetSessionOwnerHintsForTests, setSessionOwnerHint } from '@/store/session'
+import type { SessionTile } from '@/store/session-states'
+import type { SessionInfo } from '@/types/hermes'
+
+import { tileOwnerRoute } from './session-tile-owner'
+
+const row = (over: Partial<SessionInfo>): SessionInfo => over as SessionInfo
+
+const tile = (over: Partial<SessionTile> & Pick<SessionTile, 'storedSessionId'>): SessionTile => over as SessionTile
+
+describe('tileOwnerRoute', () => {
+  beforeEach(() => {
+    _resetSessionOwnerHintsForTests()
+  })
+
+  it('prefers the tile own explicit route', () => {
+    const route = tileOwnerRoute(
+      [tile({ ownerRoute: { connectionId: 'pandora', profile: 'work' }, storedSessionId: 's1' })],
+      [row({ connection_id: 'other-box', id: 's1', profile: 'default' })],
+      's1'
+    )
+
+    expect(route).toEqual({ connectionId: 'pandora', profile: 'work' })
+  })
+
+  it('falls back to the session row owner when the tile carries no route', () => {
+    // How a branch child is opened: openSessionTile with no workspaceScope, so
+    // the tile route alone leaves the owner undefined and every RPC drops to
+    // the ambient socket.
+    const route = tileOwnerRoute(
+      [tile({ storedSessionId: 's1' })],
+      [row({ connection_id: 'rigremote', id: 's1', profile: 'default' })],
+      's1'
+    )
+
+    expect(route).toEqual({ connectionId: 'rigremote', profile: 'default' })
+  })
+
+  it('falls back to the owner hint when neither tile nor row is tagged', () => {
+    setSessionOwnerHint('s1', { connectionId: 'pandora', profile: 'work' })
+
+    expect(tileOwnerRoute([tile({ storedSessionId: 's1' })], [], 's1')).toMatchObject({ connectionId: 'pandora' })
+  })
+
+  it('carries a targetProfile through, and omits it when absent', () => {
+    const routed = tileOwnerRoute(
+      [tile({ ownerRoute: { connectionId: 'pandora', profile: 'work', targetProfile: 'ceo' }, storedSessionId: 's1' })],
+      [],
+      's1'
+    )
+
+    expect(routed).toEqual({ connectionId: 'pandora', profile: 'work', targetProfile: 'ceo' })
+    expect(
+      tileOwnerRoute([tile({ ownerRoute: { connectionId: 'p', profile: 'w' }, storedSessionId: 's1' })], [], 's1')
+    ).not.toHaveProperty('targetProfile')
+  })
+
+  it('narrows a bare profile owner away', () => {
+    // knownSessionOwner returns a bare profile string for a row that names a
+    // profile but no connection. It carries no backend identity, so handing it
+    // on as a route would resolve against whichever connection is active.
+    expect(tileOwnerRoute([], [row({ id: 's1', profile: 'work' })], 's1')).toBeUndefined()
+  })
+
+  it('is undefined for an untagged session, preserving ambient routing', () => {
+    expect(tileOwnerRoute([], [row({ id: 's1' })], 's1')).toBeUndefined()
+    expect(tileOwnerRoute([], [], 'missing')).toBeUndefined()
+  })
+})
diff --git a/apps/desktop/src/app/chat/session-tile-owner.ts b/apps/desktop/src/app/chat/session-tile-owner.ts
new file mode 100644
index 0000000000..7b768fd023
--- /dev/null
+++ b/apps/desktop/src/app/chat/session-tile-owner.ts
@@ -0,0 +1,37 @@
+import { knownSessionOwner } from '@/store/session'
+import type { SessionOwnerRoute, SessionOwnerScope } from '@/store/session-request-router'
+import type { SessionTile } from '@/store/session-states'
+import type { SessionInfo } from '@/types/hermes'
+
+/**
+ * The owner a session tile routes its own RPCs through — the tile's explicit
+ * route first, then the session row's `(connection, profile)` tag, with
+ * `knownSessionOwner` folding in the owner hint.
+ *
+ * A tile opened without an explicit route — a branch child, which
+ * `openSessionTile` creates with no `workspaceScope` — has no tile route, so
+ * the row/hint rung is the only thing keeping its model and composer RPCs on
+ * the backend that owns the session instead of the ambient one.
+ *
+ * A bare profile string carries no connection and is not a usable route:
+ * handing it to `requestForSessionProfile` would resolve it against whichever
+ * connection is active, which is the bug this ladder exists to avoid.
+ */
+export function tileOwnerRoute(
+  tiles: readonly SessionTile[],
+  rows: readonly SessionInfo[],
+  storedSessionId: string
+): SessionOwnerRoute | undefined {
+  const owner: SessionOwnerScope =
+    tiles.find(tile => tile.storedSessionId === storedSessionId)?.ownerRoute ?? knownSessionOwner(rows, storedSessionId)
+
+  if (!owner || typeof owner !== 'object' || !owner.connectionId) {
+    return undefined
+  }
+
+  return {
+    connectionId: owner.connectionId,
+    profile: owner.profile,
+    ...(owner.targetProfile ? { targetProfile: owner.targetProfile } : {})
+  }
+}
diff --git a/apps/desktop/src/app/chat/session-tile.test.ts b/apps/desktop/src/app/chat/session-tile.test.ts
index 3b93213855..46bd2f4043 100644
--- a/apps/desktop/src/app/chat/session-tile.test.ts
+++ b/apps/desktop/src/app/chat/session-tile.test.ts
@@ -1,6 +1,9 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import { sessionTileResumeFailure } from './session-tile'
+import { $gatewayState, $sessions, setSessions } from '@/store/session'
+import { $sessionTiles } from '@/store/session-states'
+
+import { sessionTileResumeFailure, startUnrestoredTileTitleBackfill } from './session-tile'
 
 describe('sessionTileResumeFailure', () => {
   it('keeps a confirmed durable session retryable instead of repeating a stale 404', () => {
@@ -17,3 +20,43 @@ describe('sessionTileResumeFailure', () => {
     expect(sessionTileResumeFailure('session not found', true, false)).toBeUndefined()
   })
 })
+
+describe('startUnrestoredTileTitleBackfill (#94167)', () => {
+  afterEach(() => {
+    $gatewayState.set('idle')
+    $sessionTiles.set([])
+    setSessions([])
+  })
+
+  it('backfills unlisted unrestored tiles by id via their ownerRoute once the gateway opens', async () => {
+    const ownerRoute = { connectionId: 'conn-a', profile: 'writer' }
+    setSessions([{ id: 'listed', title: 'Already listed' } as never])
+    $sessionTiles.set([
+      { ownerRoute, storedSessionId: 'old-chat' },
+      { storedSessionId: 'listed' },
+      { runtimeId: 'rt-live', storedSessionId: 'live' },
+      { storedSessionId: 'bot', workspaceTabTitle: 'Bot Chat' }
+    ])
+
+    const lookup = vi.fn(async (id: string) => {
+      const row = { id, title: 'Quarterly review' } as never
+      setSessions(prev => [row, ...prev])
+
+      return row
+    })
+
+    const stop = startUnrestoredTileTitleBackfill(lookup as never)
+    expect(lookup).not.toHaveBeenCalled()
+
+    $gatewayState.set('open')
+    await vi.waitFor(() => expect(lookup).toHaveBeenCalledTimes(1))
+    expect(lookup).toHaveBeenCalledWith('old-chat', ownerRoute)
+    expect($sessions.get().find(row => row.id === 'old-chat')?.title).toBe('Quarterly review')
+
+    // One-shot: a later reconnect does not re-probe.
+    $gatewayState.set('idle')
+    $gatewayState.set('open')
+    expect(lookup).toHaveBeenCalledTimes(1)
+    stop()
+  })
+})
diff --git a/apps/desktop/src/app/chat/session-tile.tsx b/apps/desktop/src/app/chat/session-tile.tsx
index 773263e3ff..30291a5ece 100644
--- a/apps/desktop/src/app/chat/session-tile.tsx
+++ b/apps/desktop/src/app/chat/session-tile.tsx
@@ -28,6 +28,7 @@ import { formatRefValue } from '@/components/assistant-ui/directive-text'
 import { CenteredThreadSpinner } from '@/components/assistant-ui/thread/status'
 import { findGroupOfPane } from '@/components/pane-shell/tree/model'
 import { $layoutTree, closeTreePane, moveTreePane, setTreeGroupTabStrip } from '@/components/pane-shell/tree/store'
+import { $workspaceOwnerLabels, workspaceOwnerTitle } from '@/components/pane-shell/workspace-scope'
 import { Button } from '@/components/ui/button'
 import { ConfirmDialog } from '@/components/ui/confirm-dialog'
 import { transcribeAudio } from '@/hermes'
@@ -41,7 +42,9 @@ import { $activeGatewayProfile } from '@/store/profile'
 import { $projectTree } from '@/store/projects'
 import { sessionAwaitingInput } from '@/store/prompts'
 import {
+  $cronSessions,
   $gatewayState,
+  $messagingSessions,
   $selectedStoredSessionId,
   $sessions,
   sessionMatchesStoredId,
@@ -55,8 +58,7 @@ import {
   closeSessionTile,
   patchSessionTile,
   type SessionTile,
-  sessionTileDelegate,
-  sessionTileOwnerRoute
+  sessionTileDelegate
 } from '@/store/session-states'
 import type { SessionInfo } from '@/types/hermes'
 
@@ -68,6 +70,7 @@ import { SessionDraftTitle } from './session-draft-title'
 import { startSessionDrag } from './session-drag'
 import { SessionStatusDot } from './session-status-dot'
 import { useSessionTileActions } from './session-tile-actions'
+import { tileOwnerRoute } from './session-tile-owner'
 import { type SessionView, SessionViewProvider } from './session-view'
 import { SessionContextMenu } from './sidebar/session-actions-menu'
 import { lastVisibleMessageIsUser } from './thread-loading'
@@ -157,7 +160,21 @@ function TileChat({
 }) {
   const { gateway, requestGateway } = useGatewayRequest()
   const queryClient = useQueryClient()
-  const ownerRoute = sessionTileOwnerRoute(storedSessionId)
+
+  // Owner ladder, same as useSessionTileActions (session-tile-actions.ts:99-103).
+  // Recomputed when the tile store or any owner-bearing session list changes,
+  // NOT on every render: this component re-renders per streamed token, and the
+  // lookup spreads three arrays before scanning them.
+  const tiles = useStore($sessionTiles)
+  const sessionRows = useStore($sessions)
+  const cronRows = useStore($cronSessions)
+  const messagingRows = useStore($messagingSessions)
+
+  const ownerRoute = useMemo(() => {
+    const rows = cronRows.length || messagingRows.length ? [...sessionRows, ...cronRows, ...messagingRows] : sessionRows
+
+    return tileOwnerRoute(tiles, rows, storedSessionId)
+  }, [cronRows, messagingRows, sessionRows, storedSessionId, tiles])
 
   const requestTileGateway = useCallback(
     <T,>(method: string, params?: Record<string, unknown>, timeoutMs?: number, signal?: AbortSignal): Promise<T> =>
@@ -461,6 +478,33 @@ export function tileStoredRow(storedSessionId: string): SessionInfo | undefined
   )
 }
 
+/** One-shot by-id title fill for restored tiles that never mount (#94167).
+ *  A restored background tab has no runtimeId and does not mount its pane, so
+ *  the resolution effect above never runs; when its row is outside the recents
+ *  page and project tree, `tileTitle()` reads "New session" until first click.
+ *  `resolveStoredSession` upserts the row into `$sessions`, which the tab strip
+ *  already watches — nothing is persisted. Runs once the gateway can answer. */
+export function startUnrestoredTileTitleBackfill(lookup = resolveStoredSession): () => void {
+  const run = () => {
+    if ($gatewayState.get() !== 'open') {
+      return
+    }
+
+    off()
+
+    for (const tile of $sessionTiles.get()) {
+      if (!tile.runtimeId && !tile.workspaceTabTitle && !tileStoredRow(tile.storedSessionId)) {
+        void lookup(tile.storedSessionId, tile.ownerRoute).catch(() => undefined)
+      }
+    }
+  }
+
+  const off = $gatewayState.listen(run)
+  run()
+
+  return off
+}
+
 /** The tab's REGISTERED name. Deliberately the bare placeholder for a draft
  *  rather than its live composer title (`tabTitle` renders that): re-registering
  *  per keystroke would re-render the strip, and holding the draft's text here
@@ -473,14 +517,23 @@ function tileTitle(storedSessionId: string): string {
   return stored ? sessionTitle(stored) : explicit || NEW_SESSION_TITLE
 }
 
+/** The tab's CAPTION: a bot chat's owner name over the canonical stored title
+ *  (#99152). The menu keeps `tileTitle` — rename/delete show the real row. */
+function tileCaption(storedSessionId: string): string {
+  return workspaceOwnerTitle(
+    tileTitle(storedSessionId),
+    $sessionTiles.get().find(tile => tile.storedSessionId === storedSessionId)
+  )
+}
+
 /** The `@session` link payload for a tile tab drag — id + owning profile + title.
  *  Resolved at drag time, so an unsent tab drags under its draft name. */
 function tileDragPayload(storedSessionId: string): SessionDragPayload {
   const stored = tileStoredRow(storedSessionId)
-  const explicit = $sessionTiles.get().find(tile => tile.storedSessionId === storedSessionId)?.workspaceTabTitle
-  const title = stored ? sessionTitle(stored) : explicit || draftTitleFor(storedSessionId) || NEW_SESSION_TITLE
+  const tile = $sessionTiles.get().find(candidate => candidate.storedSessionId === storedSessionId)
+  const title = stored ? sessionTitle(stored) : tile?.workspaceTabTitle || draftTitleFor(storedSessionId) || NEW_SESSION_TITLE
 
-  return { id: storedSessionId, profile: stored?.profile ?? '', title }
+  return { id: storedSessionId, profile: stored?.profile ?? '', title: workspaceOwnerTitle(title, tile) }
 }
 
 // ---------------------------------------------------------------------------
@@ -667,14 +720,14 @@ export const watchSessionTiles = paneMirror<SessionTile>({
   // $projectTree: a tile whose session is older than the recents page resolves
   // its title through the tree, which loads after the tiles register. (The tab's
   // status dot subscribes to color/state itself, so it needs no `also` entry.)
-  also: [$sessions, $projectTree],
+  also: [$sessions, $projectTree, $workspaceOwnerLabels],
   key: t => t.storedSessionId,
   prefix: 'session-tile',
   dir: t => t.dir,
   anchor: t => t.anchor,
   before: t => t.before,
   minWidth: '20rem',
-  title: tileTitle,
+  title: tileCaption,
   // The tab's status dot — the SAME primitive the sidebar row renders, keyed by
   // the stored id, so a session's status/color can never disagree between the
   // two surfaces. Self-subscribing (live state + resolved color), so the strip
diff --git a/apps/desktop/src/app/contrib/controller.tsx b/apps/desktop/src/app/contrib/controller.tsx
index 5c626d91b4..a1fa39755b 100644
--- a/apps/desktop/src/app/contrib/controller.tsx
+++ b/apps/desktop/src/app/contrib/controller.tsx
@@ -34,6 +34,7 @@ import {
   toggleTargetZoneTabStrip,
   watchContributedPanes
 } from '@/components/pane-shell/tree/store'
+import { $workspaceOwnerLabels, workspaceOwnerTitle } from '@/components/pane-shell/workspace-scope'
 import { SidebarProvider } from '@/components/ui/sidebar'
 import { discoverBundledPlugins } from '@/contrib/plugins'
 import { Slot } from '@/contrib/react/slot'
@@ -70,6 +71,7 @@ import {
 } from '@/store/review'
 import { $currentCwd, $selectedStoredSessionId, $sessions, $yoloActive, sessionMatchesStoredId } from '@/store/session'
 import { watchSessionPins } from '@/store/session-pin-sync'
+import { $botChatScopes } from '@/store/session-states'
 import { watchUnreadWriteGuard } from '@/store/session-unread-remote'
 import { $statusbarVisible } from '@/store/statusbar-prefs'
 import { isBrowserWindow, isHudWindow } from '@/store/windows'
@@ -82,6 +84,7 @@ import { startSessionDrag } from '../chat/session-drag'
 import {
   SessionTileCloseConfirm,
   stackSessionTilesIntoMain,
+  startUnrestoredTileTitleBackfill,
   watchSessionTiles,
   WorkspaceTabMenu
 } from '../chat/session-tile'
@@ -457,6 +460,7 @@ watchContributedPanes()
 // into the transparent overlay).
 if (!isBrowserWindow() && !isHudWindow()) {
   watchSessionTiles()
+  startUnrestoredTileTitleBackfill()
   watchRouteTiles()
   watchPreviewTiles()
 }
@@ -490,7 +494,12 @@ const syncWorkspaceTitle = () => {
     area: 'panes',
     // The placeholder, not the draft's live name — `tabTitle` below renders
     // that. Keeping it here would re-register the pane on every keystroke.
-    title: stored ? storedSessionTitle(stored) : NEW_SESSION_TITLE,
+    // A bot chat reads as its BOT: every canonical Bot Chat is stored under
+    // the same name, which told two open bots apart by nothing (#99152).
+    title: workspaceOwnerTitle(
+      stored ? storedSessionTitle(stored) : NEW_SESSION_TITLE,
+      selected ? $botChatScopes.get()[selected] : undefined
+    ),
     data: {
       // The tab's status dot — the SAME primitive the sidebar row and session
       // tiles render, so the main tab never disagrees with its sidebar row. A
@@ -515,6 +524,8 @@ const syncWorkspaceTitle = () => {
 
 $selectedStoredSessionId.listen(syncWorkspaceTitle)
 $sessions.listen(syncWorkspaceTitle)
+$botChatScopes.listen(syncWorkspaceTitle)
+$workspaceOwnerLabels.listen(syncWorkspaceTitle)
 $workspaceIsPage.listen(syncWorkspaceTitle)
 
 // Layout reset collapses every session tile into main as a tab (after the
diff --git a/apps/desktop/src/app/contrib/hooks/use-background-sync.test.ts b/apps/desktop/src/app/contrib/hooks/use-background-sync.test.ts
index 404f5b536d..346f47e280 100644
--- a/apps/desktop/src/app/contrib/hooks/use-background-sync.test.ts
+++ b/apps/desktop/src/app/contrib/hooks/use-background-sync.test.ts
@@ -8,15 +8,18 @@ import {
   $activeSessionId,
   $selectedStoredSessionId,
   setBusy,
+  setCronSessions,
   setMessagingSessions,
   setSessionOwnerHint,
   setSessions
 } from '@/store/session'
 import {
   $attentionSessionIds,
+  $sessionTiles,
   $stalledSessionIds,
   $workingSessionIds,
   clearAllSessionStates,
+  publishSessionState,
   SESSION_WATCHDOG_TIMEOUT_MS
 } from '@/store/session-states'
 
@@ -38,7 +41,13 @@ vi.mock('@/hermes', async importOriginal => ({
   getLatestSessionMessages: vi.fn()
 }))
 
+vi.mock('@/store/projects', async importOriginal => ({
+  ...(await importOriginal()),
+  refreshProjectTree: vi.fn(async () => undefined)
+}))
+
 const { getLatestSessionMessages } = await import('@/hermes')
+const { refreshProjectTree } = await import('@/store/projects')
 
 const ACTIVE_RUNTIME_ID = 'runtime-active'
 const ACTIVE_STORED_ID = 'stored-active'
@@ -91,11 +100,13 @@ function useSyncHarness({
   activeIsMessaging = false,
   activeSessionId,
   activeStoredSessionId,
+  gatewayState = 'open',
   refreshActiveTranscript
 }: {
   activeIsMessaging?: boolean
   activeSessionId: string | null
   activeStoredSessionId: string | null
+  gatewayState?: string
   refreshActiveTranscript: () => Promise<void>
 }) {
   const updateSessionState: Parameters<typeof useBackgroundSync>[0]['updateSessionState'] = vi.fn(
@@ -113,7 +124,7 @@ function useSyncHarness({
     activeSessionId,
     activeStoredSessionId,
     freshDraftReady: false,
-    gatewayState: 'open',
+    gatewayState,
     refreshActiveTranscript,
     refreshCronJobs: vi.fn(),
     refreshCurrentModel: vi.fn(),
@@ -125,17 +136,23 @@ function useSyncHarness({
   })
 }
 
-function renderSync(
-  refreshActiveTranscript: () => Promise<void>,
-  options: { activeIsMessaging?: boolean; activeSessionId?: null | string; activeStoredSessionId?: null | string } = {}
-) {
-  return renderHook(() =>
-    useSyncHarness({
-      activeSessionId: ACTIVE_RUNTIME_ID,
-      activeStoredSessionId: ACTIVE_STORED_ID,
-      refreshActiveTranscript,
-      ...options
-    })
+type SyncOptions = {
+  activeIsMessaging?: boolean
+  activeSessionId?: null | string
+  activeStoredSessionId?: null | string
+  gatewayState?: string
+}
+
+function renderSync(refreshActiveTranscript: () => Promise<void>, options: SyncOptions = {}) {
+  return renderHook(
+    (props: SyncOptions) =>
+      useSyncHarness({
+        activeSessionId: ACTIVE_RUNTIME_ID,
+        activeStoredSessionId: ACTIVE_STORED_ID,
+        refreshActiveTranscript,
+        ...props
+      }),
+    { initialProps: options }
   )
 }
 
@@ -153,11 +170,13 @@ afterEach(() => {
   $activeSessionId.set(null)
   $selectedStoredSessionId.set(null)
   setSessions([])
+  setCronSessions([])
   setMessagingSessions([])
   setBusy(false)
   vi.clearAllMocks()
   vi.restoreAllMocks()
   clearAllSessionStates()
+  $sessionTiles.set([])
   resetTypingActivityTracking()
 })
 
@@ -228,7 +247,6 @@ describe('active transcript refresh', () => {
 
     const signatureRef = { current: new Map<string, string>() }
     const requestSequenceRef = { current: 0 }
-    const busyRef = { current: false }
 
     vi.mocked(getLatestSessionMessages).mockImplementation(async (storedId: string) => {
       if (storedId === TILE_STORED_ID) {
@@ -250,7 +268,6 @@ describe('active transcript refresh', () => {
     await act(async () => {
       await reconcileTileTranscriptsForTest({
         tiles: [{ storedSessionId: TILE_STORED_ID, runtimeId: TILE_RUNTIME_ID }],
-        busyRef,
         requestSequenceRef,
         signatureRef,
         updateSessionState
@@ -259,7 +276,128 @@ describe('active transcript refresh', () => {
 
     // Behavior assertions:
     expect(updaterCallCount).toBeGreaterThan(0)
-    expect(getLatestSessionMessages).toHaveBeenCalledWith(TILE_STORED_ID)
+    expect(getLatestSessionMessages).toHaveBeenCalledWith(TILE_STORED_ID, undefined)
+  })
+
+  it('reconciles an idle tile while the main pane is busy', async () => {
+    const runtimeId = 'runtime-idle-tile'
+    const storedId = 'stored-idle-tile'
+    const idleState = createClientSessionState(storedId)
+
+    setBusy(true)
+    publishSessionState(runtimeId, idleState)
+    vi.mocked(getLatestSessionMessages).mockResolvedValue(transcript('idle tile update', storedId) as never)
+
+    const updateSessionState = vi.fn((sessionId: string, updater: (state: typeof idleState) => typeof idleState) => {
+      expect(sessionId).toBe(runtimeId)
+
+      return updater(idleState)
+    })
+
+    await reconcileTileTranscriptsForTest({
+      tiles: [{ runtimeId, storedSessionId: storedId }],
+      requestSequenceRef: { current: 0 },
+      signatureRef: { current: new Map() },
+      updateSessionState
+    })
+
+    expect(getLatestSessionMessages).toHaveBeenCalledWith(storedId, undefined)
+    expect(updateSessionState).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not reconcile a busy tile when the main pane is idle', async () => {
+    const runtimeId = 'runtime-busy-tile'
+    const storedId = 'stored-busy-tile'
+    const liveState = createClientSessionState(storedId)
+
+    liveState.busy = true
+    liveState.messages = [
+      {
+        id: 'live-assistant',
+        parts: [{ text: 'streaming answer', type: 'text' }],
+        pending: true,
+        role: 'assistant'
+      }
+    ]
+    publishSessionState(runtimeId, liveState)
+    vi.mocked(getLatestSessionMessages).mockResolvedValue({ messages: [], session_id: storedId } as never)
+
+    const updateSessionState = vi.fn()
+
+    await reconcileTileTranscriptsForTest({
+      tiles: [{ runtimeId, storedSessionId: storedId }],
+      requestSequenceRef: { current: 0 },
+      signatureRef: { current: new Map() },
+      updateSessionState
+    })
+
+    expect(getLatestSessionMessages).not.toHaveBeenCalled()
+    expect(updateSessionState).not.toHaveBeenCalled()
+  })
+
+  it('discards a tile snapshot when the tile closes during the read', async () => {
+    const runtimeId = 'runtime-closing-tile'
+    const storedId = 'stored-closing-tile'
+    let resolveRead: (value: unknown) => void = () => undefined
+
+    $sessionTiles.set([{ runtimeId, storedSessionId: storedId }])
+    publishSessionState(runtimeId, createClientSessionState(storedId))
+    vi.mocked(getLatestSessionMessages).mockReturnValueOnce(
+      new Promise(resolve => {
+        resolveRead = resolve
+      }) as never
+    )
+
+    const updateSessionState = vi.fn()
+
+    const reconcile = reconcileTileTranscriptsForTest({
+      requestSequenceRef: { current: 0 },
+      signatureRef: { current: new Map() },
+      updateSessionState
+    })
+
+    $sessionTiles.set([])
+    resolveRead(transcript('stale tile answer', storedId))
+    await reconcile
+
+    expect(updateSessionState).not.toHaveBeenCalled()
+  })
+
+  it('isolates tile transcript reads by connection and profile while preserving the legacy local path', async () => {
+    vi.mocked(getLatestSessionMessages).mockImplementation(async storedId => transcript(storedId, storedId) as never)
+
+    const updateSessionState: Parameters<typeof reconcileTileTranscriptsForTest>[0]['updateSessionState'] = vi.fn(
+      (_sessionId, updater) => updater({} as Parameters<typeof updater>[0])
+    )
+
+    await reconcileTileTranscriptsForTest({
+      tiles: [
+        {
+          ownerRoute: { connectionId: 'connection-a', mode: 'remote', profile: 'shared-profile', targetProfile: 'target-a' },
+          runtimeId: 'runtime-a',
+          storedSessionId: 'stored-a'
+        },
+        {
+          ownerRoute: { connectionId: 'connection-b', mode: 'remote', profile: 'shared-profile' },
+          runtimeId: 'runtime-b',
+          storedSessionId: 'stored-b'
+        },
+        { runtimeId: 'runtime-local', storedSessionId: 'stored-local' }
+      ],
+      requestSequenceRef: { current: 0 },
+      signatureRef: { current: new Map<string, string>() },
+      updateSessionState
+    })
+
+    expect(getLatestSessionMessages).toHaveBeenCalledWith('stored-a', { connectionId: 'connection-a', profile: 'target-a' })
+    expect(getLatestSessionMessages).toHaveBeenCalledWith('stored-b', {
+      connectionId: 'connection-b',
+      profile: 'shared-profile'
+    })
+    expect(getLatestSessionMessages).toHaveBeenCalledWith('stored-local', undefined)
+    expect(updateSessionState).toHaveBeenCalledWith('runtime-a', expect.any(Function), 'stored-a')
+    expect(updateSessionState).toHaveBeenCalledWith('runtime-b', expect.any(Function), 'stored-b')
+    expect(updateSessionState).toHaveBeenCalledWith('runtime-local', expect.any(Function), 'stored-local')
   })
 
   it('skips the tile fetch entirely when nothing changed (signature-gated)', async () => {
@@ -287,13 +425,11 @@ describe('active transcript refresh', () => {
     signatureRef.current.set(`tile:${TILE_STORED_ID}`, preSignature)
 
     const updateSessionState = vi.fn()
-    const busyRef = { current: false }
     const requestSequenceRef = { current: 0 }
 
     await act(async () => {
       await reconcileTileTranscriptsForTest({
         tiles: [{ storedSessionId: TILE_STORED_ID, runtimeId: TILE_RUNTIME_ID }],
-        busyRef,
         requestSequenceRef,
         signatureRef,
         updateSessionState
@@ -343,14 +479,15 @@ describe('active transcript refresh', () => {
     const refresh = vi.fn(async () => undefined)
 
     renderSync(refresh)
-    expect(refresh).not.toHaveBeenCalled()
+    // Exactly the one connect-time pull (#94779) — no timer after it.
+    expect(refresh).toHaveBeenCalledTimes(1)
 
     await act(async () => {
       vi.advanceTimersByTime(60_000)
       await Promise.resolve()
     })
 
-    expect(refresh).not.toHaveBeenCalled()
+    expect(refresh).toHaveBeenCalledTimes(1)
   })
 
   it('retains the existing periodic backstop for messaging sessions', async () => {
@@ -373,11 +510,12 @@ describe('active transcript refresh', () => {
 
   it('only defers an external tick while busy, then refreshes once after idle', async () => {
     $changeEventsAvailable.set(true)
-    setBusy(true)
     const refresh = vi.fn(async () => undefined)
 
     renderSync(refresh)
+    refresh.mockClear() // drop the connect-time pull; this test is about busy transitions
 
+    act(() => setBusy(true))
     act(() => setBusy(false))
     expect(refresh).not.toHaveBeenCalled()
     act(() => setBusy(true))
@@ -392,12 +530,31 @@ describe('active transcript refresh', () => {
     await waitFor(() => expect(refresh).toHaveBeenCalledTimes(1))
   })
 
+  it('pulls the open transcript once per (re)connect, not on session switches (#94779)', () => {
+    $changeEventsAvailable.set(true)
+    const refresh = vi.fn(async () => undefined)
+
+    const { rerender } = renderSync(refresh, { gatewayState: 'connecting' })
+    expect(refresh).not.toHaveBeenCalled()
+
+    rerender({ gatewayState: 'open' })
+    expect(refresh).toHaveBeenCalledTimes(1)
+
+    rerender({ activeSessionId: 'runtime-other', activeStoredSessionId: 'stored-other', gatewayState: 'open' })
+    expect(refresh).toHaveBeenCalledTimes(1)
+
+    rerender({ activeSessionId: 'runtime-other', activeStoredSessionId: 'stored-other', gatewayState: 'closed' })
+    rerender({ activeSessionId: 'runtime-other', activeStoredSessionId: 'stored-other', gatewayState: 'open' })
+    expect(refresh).toHaveBeenCalledTimes(2)
+  })
+
   it('coalesces a burst of global session-change ticks', async () => {
     vi.useFakeTimers()
     $changeEventsAvailable.set(true)
     const refresh = vi.fn(async () => undefined)
 
     renderSync(refresh)
+    refresh.mockClear() // drop the connect-time pull; this test is about tick coalescing
 
     act(() => {
       for (let index = 0; index < 20; index += 1) {
@@ -413,6 +570,16 @@ describe('active transcript refresh', () => {
 
     expect(refresh).toHaveBeenCalledTimes(1)
   })
+
+  it('refreshes the project tree on a sessions.changed tick, alongside the sessions list (#100354)', async () => {
+    $changeEventsAvailable.set(true)
+
+    renderSync(vi.fn(async () => undefined))
+
+    act(() => notifySessionsChanged())
+
+    await waitFor(() => expect(refreshProjectTree).toHaveBeenCalledTimes(1))
+  })
 })
 
 describe('reconcileActiveTranscript', () => {
@@ -435,6 +602,19 @@ describe('reconcileActiveTranscript', () => {
     })
   })
 
+  it('resolves and hydrates a cron session from the cron sessions store', async () => {
+    setCronSessions([{ id: ACTIVE_STORED_ID, profile: 'cron-profile', source: 'cron' } as never])
+    const fixture = makeRefresh(resolveActiveTranscriptSession)
+    vi.mocked(getLatestSessionMessages).mockResolvedValue(transcript('cron progress') as never)
+
+    await fixture.refresh()
+
+    expect(getLatestSessionMessages).toHaveBeenCalledWith(ACTIVE_STORED_ID, 'cron-profile')
+    expect(fixture.states.get(ACTIVE_RUNTIME_ID)?.messages.at(-1)?.parts[0]).toMatchObject({
+      text: 'cron progress'
+    })
+  })
+
   it('fails closed when a hidden session id has multiple owner hints', async () => {
     const ambiguousStoredSessionId = 'ambiguous-hidden-chat'
     setSessionOwnerHint(ambiguousStoredSessionId, {
diff --git a/apps/desktop/src/app/contrib/hooks/use-background-sync.ts b/apps/desktop/src/app/contrib/hooks/use-background-sync.ts
index 452e1ddb67..785f4f2027 100644
--- a/apps/desktop/src/app/contrib/hooks/use-background-sync.ts
+++ b/apps/desktop/src/app/contrib/hooks/use-background-sync.ts
@@ -9,14 +9,14 @@ import { sessionMessagesSignature } from '@/lib/session-signatures'
 import { $changeEventsAvailable, $cronChangeTick, $sessionsChangeTick } from '@/store/live-sync'
 import { $onBattery, batteryPollInterval } from '@/store/power'
 import { refreshActiveProfile } from '@/store/profile'
+import { refreshProjectTree } from '@/store/projects'
 import {
   $activeSessionId,
   $busy,
   $currentCwd,
-  $messagingSessions,
   $selectedStoredSessionId,
-  $sessions,
   getSessionOwnerHint,
+  ownerLookupSessionRows,
   sessionMatchesStoredId,
   setCurrentCwd
 } from '@/store/session'
@@ -39,9 +39,7 @@ interface ActiveTranscriptSession {
 
 /** Resolve an active transcript from visible rows or its unique hidden owner. */
 export function resolveActiveTranscriptSession(storedSessionId: string): ActiveTranscriptSession | undefined {
-  const visible =
-    $sessions.get().find(session => sessionMatchesStoredId(session, storedSessionId)) ??
-    $messagingSessions.get().find(session => sessionMatchesStoredId(session, storedSessionId))
+  const visible = ownerLookupSessionRows().find(session => sessionMatchesStoredId(session, storedSessionId))
 
   if (visible) {
     return { profile: visible.profile }
@@ -66,6 +64,22 @@ export interface ActiveTranscriptRefreshDeps {
   ) => ClientSessionState
 }
 
+function tileRuntimeOwnsLiveState(runtimeId: string): boolean {
+  const state = $sessionStates.get()[runtimeId]
+
+  return Boolean(state && (state.busy || state.awaitingResponse || state.needsInput || state.turnLive))
+}
+
+type TileTranscriptTarget = { ownerRoute?: SessionProfileRoute; storedSessionId: string; runtimeId?: string }
+
+/** Signature key per tile — carries the owner route so two connections/profiles
+ *  sharing a stored id (or a tile re-homed to another owner) never alias. */
+function tileTranscriptSignatureKey(tile: TileTranscriptTarget): string {
+  const route = tile.ownerRoute
+
+  return `tile:${route ? `${route.connectionId}:${route.targetProfile ?? route.profile}:` : ''}${tile.storedSessionId}`
+}
+
 /**
  * Reconcile the persisted transcripts of every open WORKSPACE TILE (#93942
  * slice 1). Bot canonical chats live here — never in $sessions /
@@ -84,15 +98,13 @@ export interface ActiveTranscriptRefreshDeps {
  */
 export async function reconcileTileTranscripts({
   requestSequenceRef,
-  busyRef,
   signatureRef,
   updateSessionState,
   tiles: tilesOverride
 }: {
-  busyRef: MutableRefObject<boolean>
   requestSequenceRef: MutableRefObject<number>
   signatureRef: MutableRefObject<Map<string, string>>
-  tiles?: Array<{ storedSessionId: string; runtimeId?: string }>
+  tiles?: TileTranscriptTarget[]
   updateSessionState: (
     sessionId: string,
     updater: (state: ClientSessionState) => ClientSessionState,
@@ -100,6 +112,13 @@ export async function reconcileTileTranscripts({
   ) => ClientSessionState
 }): Promise<void> {
   const tiles = tilesOverride ?? $sessionTiles.get()
+  const openSignatureKeys = new Set(tiles.map(tileTranscriptSignatureKey))
+
+  for (const signatureKey of signatureRef.current.keys()) {
+    if (!openSignatureKeys.has(signatureKey)) {
+      signatureRef.current.delete(signatureKey)
+    }
+  }
 
   for (const tile of tiles) {
     const storedSessionId = tile.storedSessionId
@@ -110,7 +129,7 @@ export async function reconcileTileTranscripts({
       continue
     }
 
-    if (!storedSessionId || !runtimeSessionId || busyRef.current) {
+    if (!storedSessionId || !runtimeSessionId || tileRuntimeOwnsLiveState(runtimeSessionId)) {
       continue
     }
 
@@ -123,23 +142,32 @@ export async function reconcileTileTranscripts({
 
     // With a tiles override (test path), the live $sessionTiles check can't
     // see the synthetic tile — treat override tiles as present.
-    const stillPresent = tilesOverride
-      ? tilesOverride.some(t => t.storedSessionId === storedSessionId && t.runtimeId === runtimeSessionId)
-      : $sessionTiles.get().some(t => t.storedSessionId === storedSessionId && t.runtimeId === runtimeSessionId)
+    const tileStillPresent = () =>
+      tilesOverride
+        ? tilesOverride.some(t => t.storedSessionId === storedSessionId && t.runtimeId === runtimeSessionId)
+        : $sessionTiles.get().some(t => t.storedSessionId === storedSessionId && t.runtimeId === runtimeSessionId)
+
+    // Bot tiles are pinned to an exact owner (connection + target profile);
+    // read from that backend, not whichever profile is foreground. Tiles
+    // without a route keep the legacy local read.
+    const profileScope: ProfileScope = tile.ownerRoute
+      ? { connectionId: tile.ownerRoute.connectionId, profile: tile.ownerRoute.targetProfile ?? tile.ownerRoute.profile }
+      : undefined
+
+    const signatureKey = tileTranscriptSignatureKey(tile)
 
     try {
-      const latest = await getLatestSessionMessages(storedSessionId)
+      const latest = await getLatestSessionMessages(storedSessionId, profileScope)
 
-      if (requestId !== requestSequenceRef.current || busyRef.current || !stillPresent) {
+      if (requestId !== requestSequenceRef.current || tileRuntimeOwnsLiveState(runtimeSessionId) || !tileStillPresent()) {
         // Tile closed or superseded mid-read — discard AND prune its
         // signature so the map doesn't grow one entry per ever-opened tile
         // for the app's lifetime (#94255 review point 3).
-        signatureRef.current.delete(`tile:${storedSessionId}`)
+        signatureRef.current.delete(signatureKey)
 
         continue
       }
 
-      const signatureKey = `tile:${storedSessionId}`
       const signature = sessionMessagesSignature(latest.messages)
 
       if (signatureRef.current.get(signatureKey) === signature) {
@@ -547,10 +575,8 @@ export function useBackgroundSync({
   // transcript signatures, so no-change ticks and closed tiles cost nothing.
   const tileRequestSequenceRef = useRef(0)
   const tileSignatureRef = useRef(new Map<string, string>())
-  // Read $busy.get() directly inside the reconcile loop instead of mirroring
-  // the atom into a ref (lint: no-restricted-syntax — refs synced from atoms
-  // lag one render). The reconcile runs on tick, not render, so .get() is
-  // always current.
+  // Tile reconciliation reads each runtime's live state directly from
+  // $sessionStates; the primary chat's $busy atom has no authority over tiles.
 
   const requestActiveTranscriptRefresh = useCallback(
     (preservePending: boolean) => {
@@ -624,6 +650,19 @@ export function useBackgroundSync({
     }
   }, [activeConnectionId, activeGatewayProfile, gatewayState, refreshCurrentModel, refreshSessions, requestGateway])
 
+  // Reconnect backstop (#94779): turns that finished while the socket was
+  // down never replay their sessions.changed tick, so the open transcript
+  // stayed stale until the user reopened it. Pull one signature-gated tail on
+  // every (re)connect — a no-change read costs nothing. Keyed on the
+  // connection, not the session, so a plain session switch adds no read;
+  // messaging transcripts already refresh on open in their own effect below.
+  useEffect(() => {
+    if (gatewayState === 'open' && !activeIsMessaging && activeSessionId && activeStoredSessionId) {
+      requestActiveTranscriptRefresh(true)
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- connect-scoped: session deps would fire on every switch
+  }, [activeConnectionId, activeGatewayProfile, gatewayState])
+
   // A reconnect loses renderer-only working/attention atoms while the backend
   // keeps the actual turns alive. Re-seed from the gateway's in-memory session
   // registry immediately, then re-pull on every sessions.changed broadcast; a
@@ -691,17 +730,17 @@ export function useBackgroundSync({
       lastRunAt = Date.now()
       void refreshSessions()
       void refreshMessagingSessions()
+      // The project tree is a grouping of the same stored rows, so a session
+      // created/deleted/renamed/re-homed outside this window goes stale in the
+      // Projects sidebar without this (#100354). refreshProjectTree() keeps the
+      // cached tree on failure, so a not-yet-ready backend costs nothing.
+      void refreshProjectTree()
       requestActiveTranscriptRefresh(true)
       // Bot canonical chats live in workspace tiles, never in the main-pane
       // selection — without this they never see background deliveries
       // (#93942 scenario A). Signature-gated per tile, so no-change ticks
       // cost nothing.
       void reconcileTileTranscripts({
-        busyRef: {
-          get current() {
-            return $busy.get()
-          }
-        },
         requestSequenceRef: tileRequestSequenceRef,
         signatureRef: tileSignatureRef,
         updateSessionState
diff --git a/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.test.tsx b/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.test.tsx
index 5dd54083cf..8bc399e67f 100644
--- a/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.test.tsx
+++ b/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.test.tsx
@@ -80,6 +80,8 @@ describe('useDesktopIntegrations', () => {
     locationPathname = '/',
     profileReady = false,
     resumeExhaustedSessionId = null as string | null,
+    // null = config record still loading (the hook takes undefined; null dodges the destructuring default).
+    resumeLastSession = true as boolean | null,
     routedSessionId = null as string | null,
     sessions = [] as readonly SessionInfo[]
   } = {}) {
@@ -89,6 +91,7 @@ describe('useDesktopIntegrations', () => {
         locationPathname,
         profileReady,
         resumeExhaustedSessionId,
+        resumeLastSession,
         routedSessionId,
         sessions
       }: {
@@ -96,6 +99,7 @@ describe('useDesktopIntegrations', () => {
         locationPathname: string
         profileReady: boolean
         resumeExhaustedSessionId: string | null
+        resumeLastSession: boolean | null
         routedSessionId: string | null
         sessions: readonly SessionInfo[]
       }) =>
@@ -108,6 +112,7 @@ describe('useDesktopIntegrations', () => {
           profileReady,
           refreshSessions: vi.fn(),
           resumeExhaustedSessionId,
+          resumeLastSession: resumeLastSession ?? undefined,
           routedSessionId,
           runtimeIdByStoredSessionId: { current: new Map() },
           sessions
@@ -118,6 +123,7 @@ describe('useDesktopIntegrations', () => {
           locationPathname,
           profileReady,
           resumeExhaustedSessionId,
+          resumeLastSession,
           routedSessionId,
           sessions
         }
@@ -171,6 +177,7 @@ describe('useDesktopIntegrations', () => {
         locationPathname: '/',
         profileReady: true,
         resumeExhaustedSessionId: null,
+        resumeLastSession: true,
         routedSessionId: null,
         sessions: [session({ id: 'remembered-session', profile: 'default' })]
       })
@@ -179,6 +186,53 @@ describe('useDesktopIntegrations', () => {
     })
   })
 
+  describe('display.resume_last_session', () => {
+    it('stays on the fresh chat when the setting is off, and keeps remembering the open chat', () => {
+      window.localStorage.setItem('hermes.desktop.lastRoute.profile.default', '/remembered-session')
+      window.localStorage.setItem('hermes.desktop.lastSessionId.profile.default', 'remembered-session')
+
+      const sessions = [session({ id: 'remembered-session', profile: 'default' })]
+      const result = render({ profileReady: true, resumeLastSession: false, sessions })
+
+      expect(navigate).not.toHaveBeenCalled()
+
+      // The user opens another chat: it is still remembered for the next launch
+      // (and for notifications), so flipping the switch back on resumes it.
+      result.rerender({
+        activeProfile: 'default',
+        locationPathname: '/other-session',
+        profileReady: true,
+        resumeExhaustedSessionId: null,
+        resumeLastSession: false,
+        routedSessionId: 'other-session',
+        sessions: [...sessions, session({ id: 'other-session', profile: 'default' })]
+      })
+
+      expect(window.localStorage.getItem('hermes.desktop.lastSessionId.profile.default')).toBe('other-session')
+    })
+
+    it('holds the restore until the config record answers, then restores when on', () => {
+      window.localStorage.setItem('hermes.desktop.lastSessionId.profile.default', 'remembered-session')
+
+      const sessions = [session({ id: 'remembered-session', profile: 'default' })]
+      const result = render({ profileReady: true, resumeLastSession: null, sessions })
+
+      expect(navigate).not.toHaveBeenCalled()
+
+      result.rerender({
+        activeProfile: 'default',
+        locationPathname: '/',
+        profileReady: true,
+        resumeExhaustedSessionId: null,
+        resumeLastSession: true,
+        routedSessionId: null,
+        sessions
+      })
+
+      expect(navigate).toHaveBeenCalledWith('/remembered-session', { replace: true })
+    })
+  })
+
   describe('ownership validation', () => {
     it('refuses to restore a session route owned by another profile', () => {
       window.localStorage.setItem('hermes.desktop.lastRoute.profile.default', '/ai-session')
@@ -329,6 +383,7 @@ describe('useDesktopIntegrations', () => {
         locationPathname: '/ops-session',
         profileReady: true,
         resumeExhaustedSessionId: null,
+        resumeLastSession: true,
         routedSessionId: 'ops-session',
         sessions
       })
@@ -395,6 +450,7 @@ describe('useDesktopIntegrations', () => {
         locationPathname: '/settings',
         profileReady: true,
         resumeExhaustedSessionId: null,
+        resumeLastSession: true,
         routedSessionId: null,
         sessions: []
       })
diff --git a/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.ts b/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.ts
index 9cd069c253..6d8cef2ec1 100644
--- a/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.ts
+++ b/apps/desktop/src/app/contrib/hooks/use-desktop-integrations.ts
@@ -41,6 +41,8 @@ interface DesktopIntegrationsParams {
   navigate: (to: string, options?: { replace?: boolean }) => void
   profileReady: boolean
   refreshSessions: () => Promise<unknown> | unknown
+  /** `display.resume_last_session`; `undefined` while the config record is still loading. */
+  resumeLastSession: boolean | undefined
   resumeExhaustedSessionId: null | string
   routedSessionId: null | string
   runtimeIdByStoredSessionId: { readonly current: Map<string, string> }
@@ -60,6 +62,7 @@ export function useDesktopIntegrations({
   navigate,
   profileReady,
   refreshSessions,
+  resumeLastSession,
   resumeExhaustedSessionId,
   routedSessionId,
   runtimeIdByStoredSessionId,
@@ -73,7 +76,12 @@ export function useDesktopIntegrations({
     // Background MCP health: HTTP/SSE servers only (never spawns stdio),
     // notifies on transitions into needs-auth/error with a Sign in action.
     startMcpHealthChecker()
-    const unsubscribe = window.hermesDesktop?.onOpenUpdatesRequested?.(() => openUpdatesWindow())
+    // The native "Check for Updates…" menu item lives in the app menu next to
+    // "About Hermes" — it is the OS-standard affordance for updating THIS app,
+    // so it always opens the client overlay. Inheriting the connection-mode
+    // default pointed a Mac at its remote Linux backend and left the app itself
+    // silently stale (#70266).
+    const unsubscribe = window.hermesDesktop?.onOpenUpdatesRequested?.(() => openUpdatesWindow('client'))
 
     return () => {
       unsubscribe?.()
@@ -105,6 +113,20 @@ export function useDesktopIntegrations({
       // Only cold-start navigation at the default route is replaceable; a deep
       // link or hidden-then-shown window keeps its explicit destination.
       if (locationPathname === NEW_CHAT_ROUTE) {
+        // display.resume_last_session (#60812): hold the latch until the config
+        // record answers, then either restore below or stay on the fresh chat.
+        // Remembered ids keep being written either way, so flipping the switch
+        // back on resumes from the very next launch.
+        if (resumeLastSession === undefined) {
+          return
+        }
+
+        if (!resumeLastSession) {
+          restoredRef.current = true
+
+          return
+        }
+
         const route = getRememberedRoute(activeProfile)
         const routeSession = route ? routeSessionId(route) : null
         const last = getRememberedSessionId(activeProfile)
@@ -163,7 +185,7 @@ export function useDesktopIntegrations({
     } else if (!routedSessionId && !isOverlayView(appViewForPath(locationPathname))) {
       setRememberedRoute(locationPathname, activeProfile)
     }
-  }, [activeProfile, locationPathname, navigate, profileReady, routedSessionId, sessions])
+  }, [activeProfile, locationPathname, navigate, profileReady, resumeLastSession, routedSessionId, sessions])
 
   useEffect(() => {
     if (!profileReady || !resumeExhaustedSessionId) {
diff --git a/apps/desktop/src/app/contrib/session-rpc-dispatcher.test.ts b/apps/desktop/src/app/contrib/session-rpc-dispatcher.test.ts
index 8c6e83dcca..0c1645ccbc 100644
--- a/apps/desktop/src/app/contrib/session-rpc-dispatcher.test.ts
+++ b/apps/desktop/src/app/contrib/session-rpc-dispatcher.test.ts
@@ -38,6 +38,7 @@ vi.mock('@/store/session', async importActual => ({
 const { createSessionRpcDispatcher } = await import('./session-rpc-dispatcher')
 const { $connectionsRegistry } = await import('@/store/connection-registry-state')
 const { $profiles } = await import('@/store/profile')
+const { $removedSessionIds, $sessionMutationsInFlight } = await import('@/store/projects')
 
 const { _resetSessionOwnerHintsForTests, setCronSessions, setMessagingSessions, setSessionOwnerHint, setSessions } =
   await import('@/store/session')
@@ -75,6 +76,8 @@ afterEach(() => {
   setMessagingSessions([])
   $sessionTiles.set([])
   $profiles.set([])
+  $removedSessionIds.set(new Set())
+  $sessionMutationsInFlight.set(new Set())
   _resetSessionOwnerHintsForTests({ storage: true })
   sessionMocks.requestSessionResume.mockReset()
   vi.clearAllMocks()
@@ -233,6 +236,22 @@ describe('createSessionRpcDispatcher: stale runtime recovery', () => {
     expect(sessionMocks.requestSessionResume).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['tombstoned', $removedSessionIds],
+    ['being deleted', $sessionMutationsInFlight]
+  ])('does not rebind a selected session that is %s', async (_state, sessions) => {
+    setSessions([makeSessionInfo({ connection_id: 'local', id: 'stored-omar', profile: 'omar' })])
+    sessions.set(new Set(['stored-omar']))
+    gatewayMocks.requestGatewayForAgent.mockRejectedValueOnce(
+      Object.assign(new Error('session not found'), { code: 4001 })
+    )
+    const { request } = dispatcher(undefined, 'stored-omar')
+
+    await expect(request('process.list', { session_id: 'rt-omar' })).rejects.toThrow('session not found')
+
+    expect(sessionMocks.requestSessionResume).not.toHaveBeenCalled()
+  })
+
   it('does not interpret an unrelated coded RPC failure as a stale runtime', async () => {
     setSessions([makeSessionInfo({ connection_id: 'local', id: 'stored-omar', profile: 'omar' })])
     gatewayMocks.requestGatewayForAgent.mockRejectedValueOnce(
diff --git a/apps/desktop/src/app/contrib/session-rpc-dispatcher.ts b/apps/desktop/src/app/contrib/session-rpc-dispatcher.ts
index cf9bfd94b4..71f4d6e7a7 100644
--- a/apps/desktop/src/app/contrib/session-rpc-dispatcher.ts
+++ b/apps/desktop/src/app/contrib/session-rpc-dispatcher.ts
@@ -35,6 +35,7 @@ import type { MutableRefObject } from 'react'
 
 import { resolveSessionOwner } from '@/app/session/hooks/use-session-actions/utils'
 import type { ClientSessionState } from '@/app/types'
+import { $removedSessionIds, $sessionMutationsInFlight } from '@/store/projects'
 import { isSessionGoneForBackgroundPolling } from '@/store/runtime-gone'
 import { getSessionOwnerHint, knownSessionOwner, ownerLookupSessionRows, requestSessionResume } from '@/store/session'
 import { assertSessionOwnerResolved } from '@/store/session-owner-resolution'
@@ -112,6 +113,8 @@ export function createSessionRpcDispatcher(deps: SessionRpcDispatcherDeps): Ambi
         paramSessionId &&
         routingSessionId &&
         routingSessionId === selectedStoredSessionIdRef.current &&
+        !$removedSessionIds.get().has(routingSessionId) &&
+        !$sessionMutationsInFlight.get().has(routingSessionId) &&
         isSessionGoneForBackgroundPolling(error)
       ) {
         requestSessionResume(routingSessionId, typeof owner === 'object' && owner ? owner : undefined)
diff --git a/apps/desktop/src/app/contrib/wiring.tsx b/apps/desktop/src/app/contrib/wiring.tsx
index 03fdf6de9c..c80edb0cfa 100644
--- a/apps/desktop/src/app/contrib/wiring.tsx
+++ b/apps/desktop/src/app/contrib/wiring.tsx
@@ -93,6 +93,7 @@ import { CommandPalette } from '../command-palette'
 import { triggerAndRefreshCronJobs } from '../cron/cron-actions'
 import { useGatewayBoot } from '../gateway/hooks/use-gateway-boot'
 import { useGatewayRequest } from '../gateway/hooks/use-gateway-request'
+import { useHermesConfigRecord } from '../hooks/use-config-record'
 import { useKeybinds } from '../hooks/use-keybinds'
 import { useHudHandoff } from '../hud/handoff'
 import { ModelPickerOverlay } from '../model-picker-overlay'
@@ -842,6 +843,15 @@ export function ContribWiring({ children }: { children: ReactNode }) {
   // remembered-session restore, and cross-window session-list sync.
   const previewTarget = useStore($previewTarget)
 
+  // display.resume_last_session gates the cold-start restore. `undefined` while
+  // the record is still loading holds the restore latch open; a failed fetch
+  // falls back to the historical behavior (resume).
+  const configRecord = useHermesConfigRecord()
+
+  const resumeLastSession = configRecord.isPending
+    ? undefined
+    : (configRecord.data?.display as { resume_last_session?: unknown } | undefined)?.resume_last_session !== false
+
   useDesktopIntegrations({
     activeProfile: normalizeProfileKey(activeGatewayProfile),
     chatOpen,
@@ -850,6 +860,7 @@ export function ContribWiring({ children }: { children: ReactNode }) {
     navigate,
     profileReady: boot.phase === 'renderer.ready',
     refreshSessions,
+    resumeLastSession,
     resumeExhaustedSessionId,
     routedSessionId,
     runtimeIdByStoredSessionId: runtimeIdByStoredSessionIdRef,
diff --git a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
index 8d0b3ff9bf..29dd2c7a5a 100644
--- a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
+++ b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
@@ -44,6 +44,7 @@ import {
   isCurrentGatewaySwitch,
   registerGatewaySwitchLifecycle
 } from '@/store/gateway-switch'
+import { checkLocalRuntimeUpdate, watchLocalRuntimeJobs } from '@/store/local-runtime-jobs'
 import { notify, notifyError } from '@/store/notifications'
 import {
   $activeGatewayProfile,
@@ -663,6 +664,12 @@ export function useGatewayBoot({
 
         completeDesktopBoot()
         bootCompleted = true
+        // Rediscover local-runtime jobs (model downloads, runtime installs)
+        // that were running before a reload — the backend registry is the
+        // authority; this just resumes following it.
+        watchLocalRuntimeJobs()
+        // One-per-session engine-update pointer (enabled runtimes only).
+        void checkLocalRuntimeUpdate()
       } catch (err) {
         const mayPublishFailure =
           !cancelled && (switchToken === null ? !$gatewaySwitching.get() : isCurrentGatewaySwitch(switchToken))
diff --git a/apps/desktop/src/app/hud/hud-shell.tsx b/apps/desktop/src/app/hud/hud-shell.tsx
index 1d0d4cdd4a..c4d280dbc0 100644
--- a/apps/desktop/src/app/hud/hud-shell.tsx
+++ b/apps/desktop/src/app/hud/hud-shell.tsx
@@ -13,9 +13,9 @@ import { useHudClickThrough } from './click-through'
 import { useHudGameOverlay } from './game-overlay'
 import { useHudGlass } from './glass'
 import { useHudGoto, useReportHudSession } from './handoff'
-import { hudTranscriptHeight } from './layout'
 import { hudResizeDirections, useHudResizeHandle } from './resize-handle'
 import { useHudThreadFocus } from './thread-focus'
+import { useHudTranscriptBand } from './transcript-band'
 
 /** How long the transcript lingers at its glanceable opacity — after a turn
  *  lands, or after you let go of the composer — before it goes. This is the ONLY
@@ -39,11 +39,6 @@ const HUD_DIM_MS = Math.round(HUD_FADE_MS * 1.5)
  *  drawn down into the bar rather than the two dissolving in lockstep. */
 const HUD_COLLAPSE_MS = Math.round(HUD_FADE_MS * 0.66)
 
-/** Breathing room the sheet keeps above the first row, so the fade has
- *  somewhere to land. Folded into the measured height rather than added in CSS,
- *  so an empty transcript measures a true zero instead of a 12px strip. */
-const HUD_SHEET_OVERHANG_PX = 12
-
 /** Composer on top, transcript always hanging below it — Spotlight's shape,
  *  rather than flipping to follow the screen edge the HUD is parked against. */
 const HUD_THREAD_ALWAYS_BELOW = true
@@ -275,6 +270,8 @@ export function HudShell() {
     }
   }, [])
 
+  const rootRef = useRef<HTMLDivElement | null>(null)
+
   // Whether bar + band actually cover the window. Gates the frost, which is
   // native vibrancy and therefore the WINDOW's content view — it fills the whole
   // rectangle and nothing in the page can clip it to the sheet. Whenever the
@@ -282,91 +279,7 @@ export function HudShell() {
   // a grey slab hanging under the bar with nothing in it. Now that the band is
   // capped it almost never covers the window, so this is almost always false —
   // which is correct, and asking anything looser paints the slab back.
-  const [filled, setFilled] = useState(false)
-  const rootRef = useRef<HTMLDivElement | null>(null)
-
-  useEffect(() => {
-    const root = rootRef.current
-
-    if (!root) {
-      return
-    }
-
-    let viewport: HTMLElement | null = null
-    const ro = new ResizeObserver(() => measure())
-
-    const measure = () => {
-      const el = viewport ?? root.querySelector<HTMLElement>('[data-slot="aui_thread-viewport"]')
-
-      if (el !== viewport) {
-        viewport = el
-
-        if (el) {
-          ro.observe(el)
-
-          if (el.firstElementChild) {
-            ro.observe(el.firstElementChild)
-          }
-        }
-      }
-
-      // How tall the band actually needs to be — the tight bbox of the message
-      // rows only. Measuring to the viewport edge counted the full-window scroll
-      // container (min-height: 100%) as transcript and painted a empty slab almost
-      // the size of the HUD.
-      const rows = el?.querySelectorAll<HTMLElement>('[data-slot="aui_thread-content"] > *:not([data-slot])')
-
-      // Zero-height rows are not a transcript. A fresh thread still renders
-      // scaffolding inside the content box (clearance, empty state), so
-      // counting rows alone paid the overhang for nothing and left a sliver of
-      // sheet hanging under the bar with no text in it.
-      const text = !rows?.length
-        ? 0
-        : Math.max(0, rows[rows.length - 1].getBoundingClientRect().bottom - rows[0].getBoundingClientRect().top)
-
-      const contentSpan = text < 1 ? 0 : text + HUD_SHEET_OVERHANG_PX
-
-      // Once the HUD has a transcript, a resize must buy readable scrollback.
-      // The old glance-band ceiling froze this at 152px and turned every extra
-      // pixel of native window height into empty transparent chrome.
-      const visible = hudTranscriptHeight({
-        barHeight: root.querySelector<HTMLElement>('[data-slot="composer-dock"]')?.getBoundingClientRect().height ?? 0,
-        contentHeight: contentSpan,
-        viewportHeight: window.innerHeight
-      })
-
-      root.style.setProperty('--hud-band-height', `${visible}px`)
-
-      // …and the bar's real height, which is what the thread has to clear.
-      // --composer-measured-height would be the obvious source, but it is a
-      // surface var that never lands here, so the clearance silently fell back
-      // to the root estimate and reserved ~20px more than the bar occupies —
-      // a visible hole under the last message.
-      const bar = root.querySelector<HTMLElement>('[data-slot="composer-dock"]')
-      const barHeight = bar?.getBoundingClientRect().height ?? 0
-
-      if (bar) {
-        ro.observe(bar)
-        root.style.setProperty('--hud-bar-height', `${Math.round(barHeight)}px`)
-      }
-
-      setFilled(barHeight + visible >= window.innerHeight - 1)
-    }
-
-    // The viewport mounts async (lazy chat surface); poll briefly until it
-    // exists, then let the ResizeObserver own it. Window resize is separate:
-    // the transcript's rows may not change size, but the available scrollback
-    // must, so observing the rows alone cannot update the band.
-    measure()
-    const probe = setInterval(measure, 500)
-    window.addEventListener('resize', measure)
-
-    return () => {
-      clearInterval(probe)
-      window.removeEventListener('resize', measure)
-      ro.disconnect()
-    }
-  }, [])
+  const filled = useHudTranscriptBand(rootRef)
 
   useHudGlass(rootRef, filled)
   useHudClickThrough(rootRef)
diff --git a/apps/desktop/src/app/hud/transcript-band.test.tsx b/apps/desktop/src/app/hud/transcript-band.test.tsx
new file mode 100644
index 0000000000..adbca1f01c
--- /dev/null
+++ b/apps/desktop/src/app/hud/transcript-band.test.tsx
@@ -0,0 +1,64 @@
+import { act, render } from '@testing-library/react'
+import { useRef } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { stubResizeObserver } from '@/test/jsdom'
+
+import { useHudTranscriptBand } from './transcript-band'
+
+function Harness({ withViewport }: { withViewport: boolean }) {
+  const ref = useRef<HTMLDivElement | null>(null)
+
+  useHudTranscriptBand(ref)
+
+  return (
+    <div ref={ref}>
+      <div data-slot="composer-dock" />
+      {withViewport && (
+        <div data-slot="aui_thread-viewport">
+          <div data-slot="aui_thread-content">
+            <div>row</div>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+beforeEach(() => {
+  stubResizeObserver()
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useHudTranscriptBand', () => {
+  // The bug this replaced: the probe polled every 500ms for the lifetime of
+  // the HUD window, duplicating every measurement the ResizeObserver already
+  // owned once the viewport existed — a permanent idle timer firing re-renders
+  // forever instead of the "poll briefly, then hand off" the code documented.
+  it('stops polling once the viewport mounts', () => {
+    const measureSpy = vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect')
+    const { rerender } = render(<Harness withViewport={false} />)
+    const beforeWaiting = measureSpy.mock.calls.length
+
+    act(() => vi.advanceTimersByTime(500))
+    act(() => vi.advanceTimersByTime(500))
+    const whileWaiting = measureSpy.mock.calls.length
+
+    expect(whileWaiting).toBeGreaterThan(beforeWaiting)
+
+    rerender(<Harness withViewport />)
+    act(() => vi.advanceTimersByTime(500))
+    const justAfterFound = measureSpy.mock.calls.length
+
+    expect(justAfterFound).toBeGreaterThan(whileWaiting)
+
+    act(() => vi.advanceTimersByTime(10_000))
+    const muchLater = measureSpy.mock.calls.length
+
+    expect(muchLater).toBe(justAfterFound)
+  })
+})
diff --git a/apps/desktop/src/app/hud/transcript-band.ts b/apps/desktop/src/app/hud/transcript-band.ts
new file mode 100644
index 0000000000..ddde46a2c6
--- /dev/null
+++ b/apps/desktop/src/app/hud/transcript-band.ts
@@ -0,0 +1,117 @@
+import { type RefObject, useEffect, useState } from 'react'
+
+import { hudTranscriptHeight } from './layout'
+
+/** Breathing room the sheet keeps above the first row, so the fade has
+ *  somewhere to land. Folded into the measured height rather than added in CSS,
+ *  so an empty transcript measures a true zero instead of a 12px strip. */
+const HUD_SHEET_OVERHANG_PX = 12
+
+/**
+ * Measures the HUD's transcript band and publishes it as `--hud-band-height` /
+ * `--hud-bar-height` on the root, returning whether the band + bar fill the
+ * window (which gates the frost — see `useHudGlass`).
+ *
+ * The viewport mounts async (lazy chat surface); poll briefly until it exists,
+ * then let the ResizeObserver own it. Window resize is separate: the
+ * transcript's rows may not change size, but the available scrollback must, so
+ * observing the rows alone cannot update the band.
+ */
+export function useHudTranscriptBand(rootRef: RefObject<HTMLDivElement | null>): boolean {
+  const [filled, setFilled] = useState(false)
+
+  useEffect(() => {
+    const root = rootRef.current
+
+    if (!root) {
+      return
+    }
+
+    let viewport: HTMLElement | null = null
+    const ro = new ResizeObserver(() => measure())
+
+    const measure = () => {
+      const el = viewport ?? root.querySelector<HTMLElement>('[data-slot="aui_thread-viewport"]')
+
+      if (el !== viewport) {
+        viewport = el
+
+        if (el) {
+          ro.observe(el)
+
+          if (el.firstElementChild) {
+            ro.observe(el.firstElementChild)
+          }
+        }
+      }
+
+      // How tall the band actually needs to be — the tight bbox of the message
+      // rows only. Measuring to the viewport edge counted the full-window scroll
+      // container (min-height: 100%) as transcript and painted a empty slab almost
+      // the size of the HUD.
+      const rows = el?.querySelectorAll<HTMLElement>('[data-slot="aui_thread-content"] > *:not([data-slot])')
+
+      // Zero-height rows are not a transcript. A fresh thread still renders
+      // scaffolding inside the content box (clearance, empty state), so
+      // counting rows alone paid the overhang for nothing and left a sliver of
+      // sheet hanging under the bar with no text in it.
+      const text = !rows?.length
+        ? 0
+        : Math.max(0, rows[rows.length - 1].getBoundingClientRect().bottom - rows[0].getBoundingClientRect().top)
+
+      const contentSpan = text < 1 ? 0 : text + HUD_SHEET_OVERHANG_PX
+
+      // Once the HUD has a transcript, a resize must buy readable scrollback.
+      // The old glance-band ceiling froze this at 152px and turned every extra
+      // pixel of native window height into empty transparent chrome.
+      const visible = hudTranscriptHeight({
+        barHeight: root.querySelector<HTMLElement>('[data-slot="composer-dock"]')?.getBoundingClientRect().height ?? 0,
+        contentHeight: contentSpan,
+        viewportHeight: window.innerHeight
+      })
+
+      root.style.setProperty('--hud-band-height', `${visible}px`)
+
+      // …and the bar's real height, which is what the thread has to clear.
+      // --composer-measured-height would be the obvious source, but it is a
+      // surface var that never lands here, so the clearance silently fell back
+      // to the root estimate and reserved ~20px more than the bar occupies —
+      // a visible hole under the last message.
+      const bar = root.querySelector<HTMLElement>('[data-slot="composer-dock"]')
+      const barHeight = bar?.getBoundingClientRect().height ?? 0
+
+      if (bar) {
+        ro.observe(bar)
+        root.style.setProperty('--hud-bar-height', `${Math.round(barHeight)}px`)
+      }
+
+      setFilled(barHeight + visible >= window.innerHeight - 1)
+    }
+
+    measure()
+
+    // Once the viewport has mounted, the ResizeObserver above owns every
+    // future measurement — a probe that never stops re-runs this on every
+    // tick forever, which is exactly the sustained idle CPU / re-render loop
+    // the HUD must not have.
+    const probe = window.setInterval(() => {
+      if (viewport) {
+        window.clearInterval(probe)
+
+        return
+      }
+
+      measure()
+    }, 500)
+
+    window.addEventListener('resize', measure)
+
+    return () => {
+      window.clearInterval(probe)
+      window.removeEventListener('resize', measure)
+      ro.disconnect()
+    }
+  }, [rootRef])
+
+  return filled
+}
diff --git a/apps/desktop/src/app/session/hooks/branch-owner-routing.integration.test.ts b/apps/desktop/src/app/session/hooks/branch-owner-routing.integration.test.ts
new file mode 100644
index 0000000000..d4a8f0fb8a
--- /dev/null
+++ b/apps/desktop/src/app/session/hooks/branch-owner-routing.integration.test.ts
@@ -0,0 +1,127 @@
+/**
+ * End-to-end owner routing for BRANCH (the #97764-adjacent strand).
+ *
+ * The unit tests in use-session-actions.test.tsx mock `@/store/gateway`, so
+ * they prove the branch path ASKS for the right route. They cannot prove the
+ * routing layer HONOURS it. This file mocks nothing inside the router: the real
+ * `requestGatewayForAgent` runs against a fake Electron bridge + transport, so
+ * a regression that re-collapses a registry route onto the ambient socket fails
+ * here even if the call-site assertions still pass.
+ *
+ * Reproduces the reported shape: a session owned by a remote connection
+ * ("pandora") is branched while a different backend is active. Before the fix
+ * the create rode the ambient socket and the child was created on the wrong
+ * backend (or nowhere), stranding an optimistic sidebar row on an id no backend
+ * owned — "Couldn't load this session".
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Every socket the registry dials, and every RPC that travelled over one.
+const dialed: { connectionId: string; profile: string }[] = []
+const sent: { method: string; params: Record<string, unknown>; url: string }[] = []
+
+class FakeHermesGateway {
+  connectionState = 'closed'
+  private url = ''
+
+  async connect(wsUrl: string) {
+    if (typeof wsUrl !== 'string' || !wsUrl.startsWith('ws')) {
+      throw new Error(`bad ws url: ${String(wsUrl)}`)
+    }
+
+    this.url = wsUrl
+    this.connectionState = 'open'
+  }
+
+  async request<T>(method: string, params: Record<string, unknown> = {}): Promise<T> {
+    sent.push({ method, params, url: this.url })
+
+    if (method === 'session.create' || method === 'session.branch') {
+      return { session_id: 'branch-runtime', stored_session_id: 'branch-stored' } as T
+    }
+
+    return {} as T
+  }
+
+  close() {
+    this.connectionState = 'closed'
+  }
+
+  onEvent(_listener: (event: unknown) => void) {
+    return () => undefined
+  }
+
+  onState(_listener: (state: unknown) => void) {
+    return () => undefined
+  }
+
+  onStateChange(_listener: (state: unknown) => void) {
+    return () => undefined
+  }
+
+  on() {}
+  off() {}
+  addEventListener() {}
+  removeEventListener() {}
+}
+
+vi.mock('@/hermes', async importOriginal => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  HermesGateway: FakeHermesGateway,
+  setApiRequestConnection: vi.fn()
+}))
+
+describe('branch owner routing (real router, faked transport)', () => {
+  beforeEach(() => {
+    dialed.length = 0
+    sent.length = 0
+    vi.resetModules()
+
+    // A registry with two backends exposing the SAME profile name — the exact
+    // ambiguity that makes profile-only routing wrong.
+    ;(window as unknown as { hermesDesktop: unknown }).hermesDesktop = {
+      getConnection: async () => ({ mode: 'local' }),
+      getConnectionFor: async ({ connectionId, profile }: { connectionId: string; profile: string }) => {
+        dialed.push({ connectionId, profile })
+
+        return { connectionId, mode: 'remote', profile }
+      },
+      getGatewayWsUrlFor: async ({ connectionId, profile }: { connectionId: string; profile: string }) =>
+        `ws://${connectionId}/gateway?profile=${profile}`,
+      touchBackend: async () => undefined
+    }
+  })
+
+  it('dials the parent connection and sends the create over that socket', async () => {
+    const { requestGatewayForAgent } = await import('@/store/gateway')
+
+    await requestGatewayForAgent('pandora', 'default', 'session.create', {
+      parent_session_id: 'stored-parent',
+      source: 'desktop'
+    })
+
+    // The registry resolved a socket for the PARENT's connection...
+    expect(dialed).toContainEqual({ connectionId: 'pandora', profile: 'default' })
+
+    // ...and the create actually travelled over that socket.
+    const create = sent.find(entry => entry.method === 'session.create')
+    expect(create).toBeDefined()
+    expect(create!.url).toContain('pandora')
+    expect(create!.params).toMatchObject({ parent_session_id: 'stored-parent' })
+  })
+
+  it('keeps two same-named profiles on separate sockets', async () => {
+    const { requestGatewayForAgent } = await import('@/store/gateway')
+
+    await requestGatewayForAgent('pandora', 'default', 'session.create', { source: 'desktop' })
+    await requestGatewayForAgent('other-box', 'default', 'session.create', { source: 'desktop' })
+
+    const urls = sent.filter(entry => entry.method === 'session.create').map(entry => entry.url)
+
+    expect(urls).toHaveLength(2)
+    // Same profile name, different backends — they must NOT share a socket.
+    expect(new Set(urls).size).toBe(2)
+    expect(urls.some(url => url.includes('pandora'))).toBe(true)
+    expect(urls.some(url => url.includes('other-box'))).toBe(true)
+  })
+})
diff --git a/apps/desktop/src/app/session/hooks/use-message-stream/compaction-event.test.tsx b/apps/desktop/src/app/session/hooks/use-message-stream/compaction-event.test.tsx
index 7152d9eba5..6a72ea9705 100644
--- a/apps/desktop/src/app/session/hooks/use-message-stream/compaction-event.test.tsx
+++ b/apps/desktop/src/app/session/hooks/use-message-stream/compaction-event.test.tsx
@@ -1,6 +1,7 @@
 import { act, cleanup } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { createClientSessionState } from '@/lib/chat-runtime'
 import { $compactingSessions, setSessionCompacting } from '@/store/compaction'
 import type { RpcEvent } from '@/types/hermes'
 
@@ -56,6 +57,31 @@ describe('useMessageStream compaction lifecycle', () => {
     expect($compactingSessions.get()).toEqual({ [OTHER_SID]: true })
   })
 
+  // #97948: a manual /compress whose RPC answered `pending` (the compute host
+  // outlived the gateway's wait) has no turn-end hydrate — the `compacted`
+  // edge is the only signal the transcript changed.
+  it('rehydrates the idle active session on the compacted edge', () => {
+    const hydrateFromStoredSession = vi.fn(async () => undefined)
+    const states = new Map([[SID, { ...createClientSessionState(), storedSessionId: 'stored-1' }]])
+
+    stream = renderMessageStream(SID, { hydrateFromStoredSession, states })
+
+    emit('status.update', { kind: 'compacted' })
+
+    expect(hydrateFromStoredSession).toHaveBeenCalledWith(3, 'stored-1', SID)
+  })
+
+  it('leaves the transcript to the turn settle path when compaction ends mid-turn', () => {
+    const hydrateFromStoredSession = vi.fn(async () => undefined)
+    const states = new Map([[SID, { ...createClientSessionState(), busy: true, storedSessionId: 'stored-1' }]])
+
+    stream = renderMessageStream(SID, { hydrateFromStoredSession, states })
+
+    emit('status.update', { kind: 'compacted' })
+
+    expect(hydrateFromStoredSession).not.toHaveBeenCalled()
+  })
+
   it('reconciles a reconnecting compaction only from trusted terminal server state', () => {
     mountStream()
     emit('status.update', { kind: 'compacting' })
diff --git a/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/index.ts b/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/index.ts
index df11da34be..8c86f65d81 100644
--- a/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/index.ts
+++ b/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/index.ts
@@ -12,6 +12,7 @@ import { $gateway, activeGatewayConnectionId } from '@/store/gateway'
 import { $activeGatewayProfile, normalizeProfileKey } from '@/store/profile'
 import { replayPendingApproval } from '@/store/prompts'
 import { setSessionProviderWait } from '@/store/provider-wait'
+import { isSessionGone } from '@/store/session-gone-latch'
 import { setSessionDraftingTool } from '@/store/tool-drafting'
 import type { RpcEvent } from '@/types/hermes'
 
@@ -195,7 +196,10 @@ export function useGatewayEventHandler(deps: GatewayEventDeps) {
 
       const isActiveEvent = !!sessionId && sessionId === activeSessionIdRef.current
 
-      const replaySessionId = approvalReplaySessionId(event.type, activeSessionIdRef.current, sessionId)
+      const replaySessionId = approvalReplaySessionId(event.type, activeSessionIdRef.current, sessionId, {
+        explicit: Boolean(explicitSid),
+        isGone: isSessionGone
+      })
 
       if (replaySessionId) {
         void replayPendingApproval($gateway.get(), replaySessionId).catch(() => undefined)
diff --git a/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/status.ts b/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/status.ts
index 76b1b40a20..3fb0ff7e75 100644
--- a/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/status.ts
+++ b/apps/desktop/src/app/session/hooks/use-message-stream/gateway-event/status.ts
@@ -21,7 +21,16 @@ import type { GatewayEventContext } from './types'
  *  error — the status-and-notice tail of the dispatcher. */
 export function handleStatusEvent(ctx: GatewayEventContext): boolean {
   const { deps, event, payload, sessionId, isActiveEvent, occurredAt } = ctx
-  const { compactedTurnRef, failAssistantMessage, flushQueuedDeltas, queryClient, updateSessionState } = deps
+
+  const {
+    compactedTurnRef,
+    failAssistantMessage,
+    flushQueuedDeltas,
+    hydrateFromStoredSession,
+    queryClient,
+    sessionStateByRuntimeIdRef,
+    updateSessionState
+  } = deps
 
   if (event.type === 'status.update') {
     if (sessionId && payload?.kind === 'compacting') {
@@ -30,6 +39,17 @@ export function handleStatusEvent(ctx: GatewayEventContext): boolean {
     } else if (sessionId && payload?.kind === 'compacted') {
       reconcileSessionCompacting(sessionId, 'terminal')
       compactedTurnRef.current.delete(sessionId)
+
+      // A compress that finished with no live turn (manual /compress whose
+      // RPC answered `pending` because the compute host outlived the wait,
+      // #97948) has no turn-end hydrate to refresh the transcript — the
+      // summarized bubbles would stay on screen forever. Mid-turn compaction
+      // still defers to the turn's own settle path.
+      const state = sessionStateByRuntimeIdRef.current.get(sessionId)
+
+      if (isActiveEvent && state && !state.busy && !state.awaitingResponse && !state.streamId) {
+        void hydrateFromStoredSession(3, state.storedSessionId, sessionId)
+      }
     } else if (sessionId && payload?.kind === 'process') {
       // The gateway's notification poller announces background process
       // completions / watch matches here — re-sync the status stack.
diff --git a/apps/desktop/src/app/session/hooks/use-model-controls.test.tsx b/apps/desktop/src/app/session/hooks/use-model-controls.test.tsx
index 7d6a610d16..42421589a1 100644
--- a/apps/desktop/src/app/session/hooks/use-model-controls.test.tsx
+++ b/apps/desktop/src/app/session/hooks/use-model-controls.test.tsx
@@ -275,7 +275,7 @@ describe('useModelControls', () => {
     })
   })
 
-  it('persists an active primary-session picker change as the profile default via config.set --global', async () => {
+  it('sends an active primary-session picker change without a scope flag so the gateway decides persistence', async () => {
     $activeSessionId.set('session-1')
     const requestGateway = vi.fn(async () => ({ key: 'model', value: 'claude-sonnet-4.6' }) as never)
     let controls!: Controls
@@ -289,13 +289,13 @@ describe('useModelControls', () => {
       })
     ).resolves.toBe(true)
 
-    // The primary main agent's pick IS the profile default, so it persists to
-    // config.yaml (model.default + model.provider) — which is what lets a
-    // chosen subscription provider outrank a leftover OPENAI_API_KEY env var.
+    // No hardcoded --global (#90235): resolve_persist_behavior on the gateway
+    // owns the policy — session-only unless model.persist_switch_by_default
+    // is set or no default has ever been configured (#86414's first pick).
     expect(requestGateway).toHaveBeenCalledWith('config.set', {
       session_id: 'session-1',
       key: 'model',
-      value: 'claude-sonnet-4.6 --provider anthropic --global'
+      value: 'claude-sonnet-4.6 --provider anthropic'
     })
     expect(requestGateway).not.toHaveBeenCalledWith('slash.exec', expect.anything())
   })
@@ -376,7 +376,7 @@ describe('useModelControls', () => {
       confirm_expensive_model: true,
       key: 'model',
       session_id: 'session-1',
-      value: 'muse-spark-1.2-contributor --provider opencode-go --global'
+      value: 'muse-spark-1.2-contributor --provider opencode-go'
     })
     expect($currentModel.get()).toBe('muse-spark-1.2-contributor')
     expect($currentProvider.get()).toBe('opencode-go')
diff --git a/apps/desktop/src/app/session/hooks/use-model-controls.ts b/apps/desktop/src/app/session/hooks/use-model-controls.ts
index 4d0d63b058..8f28e1cf8e 100644
--- a/apps/desktop/src/app/session/hooks/use-model-controls.ts
+++ b/apps/desktop/src/app/session/hooks/use-model-controls.ts
@@ -256,13 +256,13 @@ export function useModelControls({
         return true
       }
 
-      // The PRIMARY profile's main agent is the profile's default — its
-      // model/provider choice IS the default, so persist it to config.yaml
-      // (model.default + model.provider) via --global. This is what makes
-      // the selection "stick": a set model.provider outranks a leftover
-      // OPENAI_API_KEY env var in resolve_provider(), so the main agent
-      // keeps the chosen (e.g. subscription) provider across restarts
-      // instead of silently falling back to an env key.
+      // The PRIMARY profile's main agent lets the gateway decide persistence
+      // (resolve_persist_behavior): session-only by default, persisted when
+      // model.persist_switch_by_default is true or when no default has ever
+      // been configured (the first-ever pick, so resolve_provider never falls
+      // through to a leftover OPENAI_API_KEY env var — #86414). A plain pick
+      // no longer silently rewrites config.yaml (#90235); Settings → Model
+      // remains the explicit "set as default" door.
       //
       // Two things stay --session, deliberately:
       //  - a SECONDARY chat tile: picking a model there must not rewrite the
@@ -270,14 +270,13 @@ export function useModelControls({
       //  - MoA (mixture-of-agents) presets: a transient orchestration choice
       //    that must never become the persisted global gateway default.
       const isSessionOnlyPreset = (selection.provider || '').toLowerCase() === 'moa'
-      const persistsAsDefault = touchesPrimary && !isSessionOnlyPreset
-      const scope = persistsAsDefault ? '--global' : '--session'
+      const scope = touchesPrimary && !isSessionOnlyPreset ? '' : ' --session'
 
       const requestSwitch = (confirmExpensiveModel = false) =>
         requestGateway<ModelSwitchResponse>('config.set', {
           session_id: liveSessionId,
           key: 'model',
-          value: `${selection.model} --provider ${selection.provider} ${scope}`,
+          value: `${selection.model} --provider ${selection.provider}${scope}`,
           ...(confirmExpensiveModel ? { confirm_expensive_model: true } : {})
         })
 
diff --git a/apps/desktop/src/app/session/hooks/use-prompt-actions/index.test.tsx b/apps/desktop/src/app/session/hooks/use-prompt-actions/index.test.tsx
index 59e7182195..0673798c18 100644
--- a/apps/desktop/src/app/session/hooks/use-prompt-actions/index.test.tsx
+++ b/apps/desktop/src/app/session/hooks/use-prompt-actions/index.test.tsx
@@ -31,6 +31,7 @@ import { $wakeWord, resetWakeWordState } from '@/store/wake-word'
 import type { SessionInfo } from '@/types/hermes'
 
 import { clearSingleFlightSessionResumeState } from './single-flight-resume'
+import { SESSION_COMPRESS_TIMEOUT_MS } from './slash'
 import type { SubmitTextOptions } from './utils'
 
 import { uploadComposerAttachment, usePromptActions } from '.'
@@ -692,7 +693,7 @@ describe('usePromptActions /compress', () => {
     vi.restoreAllMocks()
   })
 
-  it('routes through session.compress (not slash.exec) with a 120s timeout and renders the summary', async () => {
+  it('routes through session.compress (not slash.exec) with the compute-host ceiling timeout and renders the summary', async () => {
     const seeds: Record<string, unknown>[] = []
 
     const requestGateway = vi.fn(async (method: string, _params?: Record<string, unknown>, _timeoutMs?: number) => {
@@ -728,7 +729,7 @@ describe('usePromptActions /compress', () => {
     expect(requestGateway).toHaveBeenCalledWith(
       'session.compress',
       expect.objectContaining({ session_id: RUNTIME_SESSION_ID }),
-      120_000
+      SESSION_COMPRESS_TIMEOUT_MS
     )
     expect(requestGateway).not.toHaveBeenCalledWith('slash.exec', expect.anything())
     expect(requestGateway).not.toHaveBeenCalledWith('command.dispatch', expect.anything())
@@ -862,7 +863,7 @@ describe('usePromptActions /compress', () => {
     expect(requestGateway).toHaveBeenCalledWith(
       'session.compress',
       expect.objectContaining({ focus_topic: 'the auth refactor' }),
-      120_000
+      SESSION_COMPRESS_TIMEOUT_MS
     )
   })
 
@@ -969,7 +970,9 @@ describe('usePromptActions /compress', () => {
     act(() => {
       submitted = handle!.submitTextRaw('/compress')
     })
-    await waitFor(() => expect(requestGateway).toHaveBeenCalledWith('session.compress', expect.anything(), 120_000))
+    await waitFor(() =>
+      expect(requestGateway).toHaveBeenCalledWith('session.compress', expect.anything(), SESSION_COMPRESS_TIMEOUT_MS)
+    )
 
     // Switch to session B before compression resolves.
     activeSessionIdRef.current = RUNTIME_SESSION_B
@@ -1028,7 +1031,9 @@ describe('usePromptActions /compress', () => {
     act(() => {
       submitted = handle!.submitTextRaw('/compress')
     })
-    await waitFor(() => expect(requestGateway).toHaveBeenCalledWith('session.compress', expect.anything(), 120_000))
+    await waitFor(() =>
+      expect(requestGateway).toHaveBeenCalledWith('session.compress', expect.anything(), SESSION_COMPRESS_TIMEOUT_MS)
+    )
     activeSessionIdRef.current = RUNTIME_SESSION_B
     storedSessionIdRef.current = 'stored-b'
     rejectCompress(new Error('compression failed'))
diff --git a/apps/desktop/src/app/session/hooks/use-prompt-actions/slash.ts b/apps/desktop/src/app/session/hooks/use-prompt-actions/slash.ts
index 770f02ae9b..a06b6b1643 100644
--- a/apps/desktop/src/app/session/hooks/use-prompt-actions/slash.ts
+++ b/apps/desktop/src/app/session/hooks/use-prompt-actions/slash.ts
@@ -74,9 +74,13 @@ import {
 } from './utils'
 
 // Manual compression is LLM-bound and routinely outlives the desktop's 30s
-// default WS request timeout on large sessions — give it the TUI client's
-// 120s RPC budget (HERMES_TUI_RPC_TIMEOUT_MS default) instead.
-const SESSION_COMPRESS_TIMEOUT_MS = 120_000
+// default WS request timeout on large sessions. The gateway blocks its own
+// compute-host wait for up to compression.context_total_ceiling_seconds + 30s
+// (capped at 630s, tui_gateway/server.py _COMPUTE_HOST_COMPRESS_WAIT_CAP_SECS)
+// and then answers `status: 'pending'` rather than an error, so this budget
+// must sit above that cap or the desktop reports a false timeout while the
+// host is still compressing (#97948).
+export const SESSION_COMPRESS_TIMEOUT_MS = 660_000
 const WAKE_START_TIMEOUT_MS = 180_000
 
 const wakeDeviceLabel = (device?: WakeInputDeviceStatus): string => {
@@ -666,6 +670,16 @@ export function useSlashCommand(deps: SlashCommandDeps) {
 
             sessionId = liveSessionId
 
+            // The gateway's compute-host wait expired but compression is still
+            // running there; it pushes session.info + a `compacted` status edge
+            // when the host finishes. Not an error (#97948).
+            if (result?.status === 'pending') {
+              const pendingMessage = result.message || 'compression still running in the background'
+              notify({ durationMs: 8_000, id: noticeId, kind: 'info', message: pendingMessage })
+
+              return
+            }
+
             // Replace the transcript with the post-compress history so the
             // summarized bubbles actually disappear. `messages` is the same
             // shape session.resume returns (_history_to_messages), so
diff --git a/apps/desktop/src/app/session/hooks/use-session-actions.test.tsx b/apps/desktop/src/app/session/hooks/use-session-actions.test.tsx
index 256975b652..d203de8e71 100644
--- a/apps/desktop/src/app/session/hooks/use-session-actions.test.tsx
+++ b/apps/desktop/src/app/session/hooks/use-session-actions.test.tsx
@@ -77,7 +77,7 @@ import { $sessionSeenCounts, $unreadFinishedMarkers } from '@/store/session-unre
 
 import sessionResumeActiveTurn from '../../../../../../tests/fixtures/session-resume-active-turn.json'
 import { deferred } from '../../../test/deferred'
-import { sessionRoute } from '../../routes'
+import { NEW_CHAT_ROUTE, sessionRoute } from '../../routes'
 import type { ClientSessionState } from '../../types'
 
 import { useSessionActions } from './use-session-actions'
@@ -118,6 +118,7 @@ const RUNTIME_SESSION_ID = 'rt-new-001'
 type HarnessHandle = Pick<
   ReturnType<typeof useSessionActions>,
   | 'archiveSession'
+  | 'branchStoredSession'
   | 'createBackendSessionForSend'
   | 'openNewSessionTile'
   | 'removeSession'
@@ -146,22 +147,26 @@ function storedSession(overrides: Partial<SessionInfo> = {}): SessionInfo {
 
 function Harness({
   activeSessionId = null,
+  activeSessionIdRef: activeSessionIdRefOverride,
   navigate = vi.fn(),
   onReady,
   requestGateway,
-  selectedStoredSessionId = null
+  selectedStoredSessionId = null,
+  selectedStoredSessionIdRef: selectedStoredSessionIdRefOverride
 }: {
   activeSessionId?: null | string
+  activeSessionIdRef?: MutableRefObject<null | string>
   navigate?: ReturnType<typeof vi.fn>
   onReady: (handle: HarnessHandle) => void
   requestGateway: <T>(method: string, params?: Record<string, unknown>) => Promise<T>
   selectedStoredSessionId?: null | string
+  selectedStoredSessionIdRef?: MutableRefObject<null | string>
 }) {
   const ref = <T,>(value: T): MutableRefObject<T> => ({ current: value })
 
   const actions = useSessionActions({
     activeSessionId,
-    activeSessionIdRef: ref(activeSessionId),
+    activeSessionIdRef: activeSessionIdRefOverride ?? ref(activeSessionId),
     busyRef: ref(false),
     creatingSessionRef: ref(false),
     ensureSessionState: () => ({}) as ClientSessionState,
@@ -172,7 +177,7 @@ function Harness({
     resetViewSync: vi.fn(),
     runtimeIdByStoredSessionIdRef: ref(new Map<string, string>()),
     selectedStoredSessionId,
-    selectedStoredSessionIdRef: ref(selectedStoredSessionId),
+    selectedStoredSessionIdRef: selectedStoredSessionIdRefOverride ?? ref(selectedStoredSessionId),
     sessionStateByRuntimeIdRef: ref(new Map<string, ClientSessionState>()),
     syncSessionStateToView: vi.fn(),
     updateSessionState: () => ({}) as ClientSessionState
@@ -185,6 +190,134 @@ function Harness({
   return null
 }
 
+describe('desktop branch creation idempotency', () => {
+  afterEach(() => {
+    cleanup()
+    setSessions([])
+    vi.clearAllMocks()
+  })
+
+  it('coalesces duplicate stored-session branch attempts onto one backend child', async () => {
+    const createReady = deferred<{ session_id: string; stored_session_id: string }>()
+
+    const requestGateway = vi.fn(async (method: string, params?: Record<string, unknown>) => {
+      if (method === 'session.create') {
+        return createReady.promise as never
+      }
+
+      return {} as never
+    })
+
+    let actions: HarnessHandle | null = null
+
+    setSessions([storedSession({ id: 'parent', message_count: 2, title: 'Parent' })])
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [
+        { content: 'question', role: 'user', timestamp: 1 },
+        { content: 'answer', role: 'assistant', timestamp: 2 }
+      ],
+      session_id: 'parent'
+    } as never)
+
+    render(<Harness onReady={value => (actions = value)} requestGateway={requestGateway} />)
+    await waitFor(() => expect(actions).not.toBeNull())
+
+    let first!: Promise<boolean>
+    let second!: Promise<boolean>
+
+    act(() => {
+      first = actions!.branchStoredSession('parent')
+      second = actions!.branchStoredSession('parent')
+    })
+
+    await waitFor(() =>
+      expect(requestGateway.mock.calls.filter(([method]) => method === 'session.create')).toHaveLength(1)
+    )
+
+    await act(async () => {
+      createReady.resolve({ session_id: 'runtime-branch', stored_session_id: 'stored-branch' })
+      await expect(Promise.all([first, second])).resolves.toEqual([true, true])
+    })
+
+    expect(requestGateway.mock.calls.filter(([method]) => method === 'session.create')).toHaveLength(1)
+    expect(requestGateway).toHaveBeenCalledWith(
+      'session.create',
+      expect.objectContaining({
+        messages: [
+          { content: 'question', role: 'user' },
+          { content: 'answer', role: 'assistant' }
+        ],
+        parent_session_id: 'parent',
+        source: 'desktop'
+      })
+    )
+    expect($sessions.get().filter(session => session.id === 'stored-branch')).toHaveLength(1)
+  })
+
+  it('does not coalesce two same-id parents that live on different connections', async () => {
+    // Two backends each expose a session called `parent`. They are different
+    // conversations, so a route-blind flight key would collapse both branch
+    // actions onto ONE create and hand the second caller the other backend's
+    // child. Both creates are held open so the second call sees the first's
+    // flight still in the map — that is the only state the key guards.
+    const routedCreate = vi.mocked(requestGatewayForAgent)
+    const pandoraCreate = deferred<{ session_id: string; stored_session_id: string }>()
+    const otherCreate = deferred<{ session_id: string; stored_session_id: string }>()
+
+    routedCreate.mockImplementation((async (connectionId: string, _profile: string, method: string) => {
+      if (method !== 'session.create') {
+        return {} as never
+      }
+
+      return connectionId === 'pandora' ? pandoraCreate.promise : otherCreate.promise
+    }) as never)
+
+    let actions: HarnessHandle | null = null
+
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [{ content: 'question', role: 'user', timestamp: 1 }],
+      session_id: 'parent'
+    } as never)
+
+    render(<Harness onReady={value => (actions = value)} requestGateway={vi.fn(async () => ({}) as never)} />)
+    await waitFor(() => expect(actions).not.toBeNull())
+
+    // Same stored id, one owner at a time in the row cache — the branch resolves
+    // its owner from the row, so this is how the two owners reach forkBranch.
+    setSessions([storedSession({ connection_id: 'pandora', id: 'parent', message_count: 2, profile: 'default' })])
+
+    let first!: Promise<boolean>
+    let second!: Promise<boolean>
+
+    await act(async () => {
+      first = actions!.branchStoredSession('parent')
+      await waitFor(() => expect(routedCreate).toHaveBeenCalled())
+    })
+
+    setSessions([storedSession({ connection_id: 'other-box', id: 'parent', message_count: 2, profile: 'default' })])
+
+    await act(async () => {
+      second = actions!.branchStoredSession('parent')
+      await waitFor(() =>
+        expect(routedCreate.mock.calls.filter(([, , method]) => method === 'session.create')).toHaveLength(2)
+      )
+    })
+
+    await act(async () => {
+      pandoraCreate.resolve({ session_id: 'rt-pandora', stored_session_id: 'stored-pandora' })
+      otherCreate.resolve({ session_id: 'rt-other', stored_session_id: 'stored-other-box' })
+      await expect(Promise.all([first, second])).resolves.toEqual([true, true])
+    })
+
+    const creates = routedCreate.mock.calls.filter(([, , method]) => method === 'session.create')
+
+    expect(creates.map(([connectionId]) => connectionId)).toEqual(['pandora', 'other-box'])
+    // Two distinct children, not one child claimed twice.
+    expect($sessions.get().filter(session => session.id === 'stored-pandora')).toHaveLength(1)
+    expect($sessions.get().filter(session => session.id === 'stored-other-box')).toHaveLength(1)
+  })
+})
+
 describe('connection-qualified session deletion', () => {
   afterEach(() => {
     cleanup()
@@ -231,6 +364,44 @@ describe('connection-qualified session deletion', () => {
     })
     expect(requestGateway).not.toHaveBeenCalledWith('session.close', expect.anything())
   })
+
+  it('tears down the selected session from synchronous refs when render state is stale', async () => {
+    const navigate = vi.fn()
+    const requestGateway = vi.fn().mockResolvedValue({})
+    const activeSessionIdRef: MutableRefObject<null | string> = { current: 'runtime-shared' }
+    const selectedStoredSessionIdRef: MutableRefObject<null | string> = { current: 'shared-session' }
+    let actions: HarnessHandle | null = null
+
+    setSessions([storedSession({ connection_id: 'source-a', id: 'shared-session', profile: 'worker' })])
+    vi.mocked(deleteSession).mockResolvedValue({ ok: true })
+    vi.mocked(requestGatewayForAgent).mockResolvedValue({} as never)
+
+    render(
+      <Harness
+        activeSessionId={null}
+        activeSessionIdRef={activeSessionIdRef}
+        navigate={navigate}
+        onReady={value => {
+          actions = value
+        }}
+        requestGateway={requestGateway}
+        selectedStoredSessionId={null}
+        selectedStoredSessionIdRef={selectedStoredSessionIdRef}
+      />
+    )
+    await waitFor(() => expect(actions).not.toBeNull())
+
+    await act(async () => {
+      await actions?.removeSession('shared-session')
+    })
+
+    expect(navigate).toHaveBeenCalledWith(NEW_CHAT_ROUTE, { replace: true })
+    expect(requestGatewayForAgent).toHaveBeenCalledWith('source-a', 'worker', 'session.close', {
+      session_id: 'runtime-shared'
+    })
+    expect(selectedStoredSessionIdRef.current).toBeNull()
+    expect(activeSessionIdRef.current).toBeNull()
+  })
 })
 
 function StoredIdRotationHarness({
@@ -1098,6 +1269,44 @@ describe('resumeSession failure recovery', () => {
     expect($messages.get().length).toBeGreaterThan(0)
   })
 
+  it('paints the REST transcript before a cold session.resume settles and keeps it when resume rejects', async () => {
+    // A cold profile build (skills/MCP/memory) can keep session.resume pending
+    // past the hydration budget; the already-available REST history must not
+    // wait for it (#90130), and a later resume failure must not blank it.
+    const runtimeResume = deferred<never>()
+
+    const requestGateway = vi.fn((method: string) =>
+      method === 'session.resume' ? runtimeResume.promise : Promise.resolve({} as never)
+    ) as <T>(method: string, params?: Record<string, unknown>) => Promise<T>
+
+    vi.mocked(getLatestSessionMessages).mockResolvedValue({
+      messages: [
+        { content: 'older question', role: 'user', timestamp: 1 },
+        { content: 'history visible before runtime', role: 'assistant', timestamp: 2 }
+      ],
+      session_id: 'stored-1'
+    } as never)
+
+    let resume: ((storedSessionId: string, replaceRoute?: boolean) => Promise<unknown>) | null = null
+    render(<ResumeHarness onReady={r => (resume = r)} requestGateway={requestGateway} />)
+    await waitFor(() => expect(resume).not.toBeNull())
+
+    let settled = false
+    const pending = resume!('stored-1', true).finally(() => (settled = true))
+
+    await waitFor(() => expect(JSON.stringify($messages.get())).toContain('history visible before runtime'))
+    expect(settled).toBe(false)
+    const painted = $messages.get()
+
+    await act(async () => {
+      runtimeResume.reject(new Error('request timed out: session.resume'))
+      await pending
+    })
+
+    expect($messages.get()).toBe(painted)
+    expect($resumeFailedSessionId.get()).toBeNull()
+  })
+
   it('preserves an optimistic user message during a same-session reconnect', async () => {
     setMessages([
       {
@@ -1672,8 +1881,11 @@ describe('branchStoredSession desktop source tagging', () => {
     await expect(branchStoredSession!('stored-parent')).resolves.toBe(true)
 
     // The branch becomes the primary session — this is what routes the main
-    // workspace area to it, not just a new sidebar row.
+    // workspace area to it, not just a new sidebar row. Selection alone is not
+    // enough: leaving the URL on the parent makes chat/index see a permanent
+    // routeSessionMismatch and keeps the central loader mounted.
     expect($selectedStoredSessionId.get()).toBe('branch-stored')
+    expect(navigate).toHaveBeenCalledWith(sessionRoute('branch-stored'), { replace: true })
     // It must not ALSO exist as a tile: a session is either the main thread or
     // a tile, never both (resumeSession closes any tile with the same id).
     expect($sessionTiles.get().some(tile => tile.storedSessionId === 'branch-stored')).toBe(false)
@@ -1725,6 +1937,7 @@ describe('branchStoredSession desktop source tagging', () => {
     // Branching a session that is not the one currently open must not steal
     // the user's active view — "stored-other" stays selected.
     expect($selectedStoredSessionId.get()).toBe('stored-other')
+    expect(navigate).not.toHaveBeenCalled()
     // The branch instead opens as its own tile.
     expect($sessionTiles.get().some(tile => tile.storedSessionId === 'branch-stored')).toBe(true)
   })
@@ -1760,6 +1973,162 @@ describe('branchStoredSession desktop source tagging', () => {
     })
   })
 
+  // A branch belongs to the backend that OWNS its parent. Routing on profile
+  // alone silently sends session.create to whatever socket is active, so a
+  // remote-owned parent branched while another connection is active creates
+  // the child on the wrong backend — or nowhere — while the sidebar still
+  // paints an optimistic row that can never hydrate ("Couldn't load this
+  // session"). Same ownership contract removeSession already honours.
+  it('routes a connection-tagged parent branch through its owning connection', async () => {
+    const ambientRequest = vi.fn(async () => ({}) as never)
+
+    vi.mocked(requestGatewayForAgent).mockImplementation((async (
+      _connectionId: null | string,
+      _profile: string,
+      method: string
+    ) => {
+      if (method === 'session.create') {
+        return { session_id: 'branch-runtime', stored_session_id: 'branch-stored' } as never
+      }
+
+      return {} as never
+    }) as never)
+
+    setSessions([
+      storedSession({ connection_id: 'pandora', id: 'stored-parent', message_count: 1, profile: 'default' })
+    ])
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [{ content: 'branch me', role: 'user', timestamp: 1 }],
+      session_id: 'stored-parent'
+    } as never)
+
+    let branchStoredSession: ((storedSessionId: string) => Promise<boolean>) | null = null
+    render(<BranchHarness onReady={branch => (branchStoredSession = branch)} requestGateway={ambientRequest} />)
+    await waitFor(() => expect(branchStoredSession).not.toBeNull())
+
+    await expect(branchStoredSession!('stored-parent')).resolves.toBe(true)
+
+    // The create must ride the parent's own (connection, profile) socket...
+    expect(requestGatewayForAgent).toHaveBeenCalledWith(
+      'pandora',
+      'default',
+      'session.create',
+      expect.objectContaining({ parent_session_id: 'stored-parent', source: 'desktop' })
+    )
+    // ...and never the ambient socket, which may serve a different machine.
+    expect(ambientRequest).not.toHaveBeenCalledWith('session.create', expect.anything())
+  })
+
+  // The parent transcript read must land on the owning backend too: reading it
+  // from the ambient socket returns nothing for a foreign-owned parent, which
+  // aborts the branch as "nothing to branch" before any create is attempted.
+  it('reads a connection-tagged parent transcript from its owning connection', async () => {
+    const ambientRequest = vi.fn(async () => ({}) as never)
+
+    vi.mocked(requestGatewayForAgent).mockImplementation((async (
+      _connectionId: null | string,
+      _profile: string,
+      method: string
+    ) => {
+      if (method === 'session.create') {
+        return { session_id: 'branch-runtime', stored_session_id: 'branch-stored' } as never
+      }
+
+      return {} as never
+    }) as never)
+
+    setSessions([
+      storedSession({ connection_id: 'pandora', id: 'stored-parent', message_count: 1, profile: 'default' })
+    ])
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [{ content: 'branch me', role: 'user', timestamp: 1 }],
+      session_id: 'stored-parent'
+    } as never)
+
+    let branchStoredSession: ((storedSessionId: string) => Promise<boolean>) | null = null
+    render(<BranchHarness onReady={branch => (branchStoredSession = branch)} requestGateway={ambientRequest} />)
+    await waitFor(() => expect(branchStoredSession).not.toBeNull())
+
+    await expect(branchStoredSession!('stored-parent')).resolves.toBe(true)
+
+    expect(getAllSessionMessages).toHaveBeenCalledWith('stored-parent', {
+      connectionId: 'pandora',
+      profile: 'default'
+    })
+  })
+
+  // The create landing on the right backend is only half the job: the sidebar
+  // row must be TAGGED with that owner too. An untagged optimistic row inherits
+  // the ambient profile, so every later owner lookup (resume/hydrate/prompt)
+  // routes to the wrong backend and the chat pane spins forever on a session
+  // that backend never had.
+  it('tags the optimistic branch row with the parent connection owner', async () => {
+    const ambientRequest = vi.fn(async () => ({}) as never)
+
+    vi.mocked(requestGatewayForAgent).mockImplementation((async (
+      _connectionId: null | string,
+      _profile: string,
+      method: string
+    ) => {
+      if (method === 'session.create') {
+        return { session_id: 'branch-runtime', stored_session_id: 'branch-stored' } as never
+      }
+
+      return {} as never
+    }) as never)
+
+    setSessions([
+      storedSession({ connection_id: 'pandora', id: 'stored-parent', message_count: 1, profile: 'default' })
+    ])
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [{ content: 'branch me', role: 'user', timestamp: 1 }],
+      session_id: 'stored-parent'
+    } as never)
+
+    let branchStoredSession: ((storedSessionId: string) => Promise<boolean>) | null = null
+    render(<BranchHarness onReady={branch => (branchStoredSession = branch)} requestGateway={ambientRequest} />)
+    await waitFor(() => expect(branchStoredSession).not.toBeNull())
+
+    await expect(branchStoredSession!('stored-parent')).resolves.toBe(true)
+
+    const row = $sessions.get().find(session => session.id === 'branch-stored')
+    expect(row).toBeDefined()
+    expect(row!.connection_id).toBe('pandora')
+    expect(row!.profile).toBe('default')
+  })
+
+  // An untagged row (single-backend users, the overwhelmingly common case)
+  // must keep the ambient path exactly as before — no behaviour change.
+  it('keeps an untagged parent branch on the ambient socket', async () => {
+    let createParams: Record<string, unknown> | undefined
+
+    const ambientRequest = vi.fn(async (method: string, params?: Record<string, unknown>) => {
+      if (method === 'session.create') {
+        createParams = params
+
+        return { session_id: 'branch-runtime', stored_session_id: 'branch-stored' } as never
+      }
+
+      return {} as never
+    })
+
+    vi.mocked(requestGatewayForAgent).mockClear()
+    setSessions([storedSession({ id: 'stored-parent', message_count: 1 })])
+    vi.mocked(getAllSessionMessages).mockResolvedValue({
+      messages: [{ content: 'branch me', role: 'user', timestamp: 1 }],
+      session_id: 'stored-parent'
+    } as never)
+
+    let branchStoredSession: ((storedSessionId: string) => Promise<boolean>) | null = null
+    render(<BranchHarness onReady={branch => (branchStoredSession = branch)} requestGateway={ambientRequest} />)
+    await waitFor(() => expect(branchStoredSession).not.toBeNull())
+
+    await expect(branchStoredSession!('stored-parent')).resolves.toBe(true)
+
+    expect(createParams).toMatchObject({ parent_session_id: 'stored-parent', source: 'desktop' })
+    expect(requestGatewayForAgent).not.toHaveBeenCalled()
+  })
+
   it('branches an open live chat via session.branch with a trimmed message count (bug #1/#3 fix)', async () => {
     let branchParams: Record<string, unknown> | undefined
 
@@ -2347,7 +2716,7 @@ describe('resumeSession warm-cache mapping integrity', () => {
     expect(sessionStateByRuntimeIdRef.current.has('rt-recycled')).toBe(false)
   })
 
-  it('paints the bounded latest transcript after the deferred resume acknowledgement', async () => {
+  it('paints the bounded latest transcript before the deferred resume acknowledgement without rebuilding it', async () => {
     const latestPage = Array.from({ length: 500 }, (_, index) => ({
       content: `message-${index}`,
       role: index % 2 === 0 ? ('user' as const) : ('assistant' as const),
@@ -2382,7 +2751,8 @@ describe('resumeSession warm-cache mapping integrity', () => {
 
     await waitFor(() => expect(getLatestSessionMessages).toHaveBeenCalledTimes(1))
     expect(getLatestSessionMessages).toHaveBeenCalledWith('stored-A', undefined)
-    expect($messages.get()).toHaveLength(0)
+    await waitFor(() => expect($messages.get()).toHaveLength(500))
+    const paintedTranscript = $messages.get()
     expect(requestGatewayMock).toHaveBeenCalledWith(
       'session.resume',
       expect.objectContaining({
@@ -2400,7 +2770,7 @@ describe('resumeSession warm-cache mapping integrity', () => {
       info: {}
     })
     await resumePromise
-    expect($messages.get()).toHaveLength(500)
+    expect($messages.get()).toBe(paintedTranscript)
   })
 
   it('honours a warm cache entry whose stored id matches and refreshes its persisted transcript', async () => {
diff --git a/apps/desktop/src/app/session/hooks/use-session-actions/index.ts b/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
index 635880cae6..a1224f0aa2 100644
--- a/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
+++ b/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
@@ -101,6 +101,8 @@ import {
 import { isSessionOwnerResolutionError } from '@/store/session-owner-resolution'
 import {
   requestForSessionProfile,
+  type SessionOwnerRoute,
+  sessionOwnerRouteFromRow,
   type SessionOwnerScope,
   type SessionProfileRoute
 } from '@/store/session-request-router'
@@ -146,6 +148,7 @@ import {
   applyRuntimeInfo,
   applyStoredSessionPreviewRuntimeInfo,
   type BranchMessage,
+  cachedSessionRow,
   chatMessageArraysEquivalent,
   dedupeInflightUserAgainstTranscript,
   dropListedSession,
@@ -202,6 +205,42 @@ interface SessionActionsOptions {
 // (NOT in this set) still legitimately drops to a draft.
 const createdThisRun = new Set<string>()
 
+const branchMessagesFingerprint = (messages: BranchMessage[]): string =>
+  JSON.stringify(messages.map(({ content, role }) => [role, content]))
+
+// Identity of one branch create, so a re-entered branch action (a retried
+// renderer transition, a double right-click) rides the create already in
+// flight instead of minting a second child. The OWNER is part of the identity:
+// the same parent id served by two connections is two different sessions.
+function branchCreateKey({
+  branchCount,
+  branchMessages,
+  cwd,
+  ownerRoute,
+  parentStoredId,
+  profile,
+  sourceSessionId
+}: {
+  branchCount?: number
+  branchMessages: BranchMessage[]
+  cwd?: string
+  ownerRoute?: SessionOwnerRoute
+  parentStoredId: null | string
+  profile?: null | string
+  sourceSessionId: null | string
+}): string {
+  return JSON.stringify({
+    branchCount: branchCount ?? null,
+    connectionId: ownerRoute?.connectionId || null,
+    cwd: cwd?.trim() || null,
+    messages: sourceSessionId ? null : branchMessagesFingerprint(branchMessages),
+    ownerProfile: ownerRoute?.profile || null,
+    parentStoredId,
+    profile: profile?.trim() || null,
+    sourceSessionId
+  })
+}
+
 // Reflect a stored row's persisted token counts into the live usage atom
 // (total is derived, so callers can't drift it out of sync with input/output).
 function applyStoredUsage(stored: { input_tokens?: number | null; output_tokens?: number | null }) {
@@ -341,6 +380,7 @@ export function useSessionActions({
   const { t } = useI18n()
   const copy = t.desktop
   const resumeRequestRef = useRef(0)
+  const branchCreateFlightsRef = useRef(new Map<string, Promise<SessionCreateResponse>>())
 
   // Follow auto-compression's stored-id rotation only while the exact runtime,
   // selection, and route intent still belong to the rotating conversation.
@@ -1507,9 +1547,6 @@ export function useSessionActions({
         // keeps it from surfacing as unhandled while the prefetch settles.
         resumePromise.catch(() => undefined)
 
-        // Keep both requests concurrent, but do not paint the REST result until
-        // the runtime resume has also settled. An eager prefetch paint followed
-        // by the runtime projection rebuilds large transcripts during resume.
         let prefetchedResult: { messages: SessionMessage[]; session_id?: string } | null = null
 
         try {
@@ -1520,13 +1557,15 @@ export function useSessionActions({
           // Non-fatal: gateway resume below can still hydrate the session.
         }
 
-        const resumed = await resumePromise
-
-        if (!isCurrentResume()) {
-          return
-        }
-
-        if (prefetchedResult) {
+        // Paint the persisted transcript as soon as REST returns instead of
+        // holding it until the runtime resume settles. A cold profile build
+        // (skills, MCP, memory) can keep `session.resume` pending far longer
+        // than the hydration budget while the complete history is already in
+        // hand — holding it stranded Bot Chats on the loader (#90130). The
+        // runtime path below grafts only its live projection onto this same
+        // snapshot, so an unchanged acknowledgement keeps reference identity
+        // and never rebuilds the transcript a second time.
+        if (prefetchedResult && isCurrentResume()) {
           const previousMessages = resumedSameSelectedSession
             ? preserveLocalPendingTurnMessages(viewMessagesForReconcile(), resumeStartMessages)
             : viewMessagesForReconcile()
@@ -1541,6 +1580,16 @@ export function useSessionActions({
           localSnapshot = reconcileAuthoritativeChatMessages(graftedPrefetch, previousMessages)
           prefetchApplied = true
           prefetchedStoredSessionId = prefetchedResult.session_id || storedSessionId
+
+          if (!chatMessageArraysEquivalent($messages.get(), localSnapshot)) {
+            setMessages(localSnapshot)
+          }
+        }
+
+        const resumed = await resumePromise
+
+        if (!isCurrentResume()) {
+          return
         }
 
         const currentMessages = viewMessagesForReconcile()
@@ -1707,12 +1756,25 @@ export function useSessionActions({
         const visibleMessagesForView =
           pendingClarifyProjection?.messages ?? clearedClarifyProjection?.messages ?? messagesForView
 
+        // The eagerly painted REST page is persisted-display authority: stamp
+        // its provenance so the next warm switch to this session paints it
+        // immediately instead of holding it as an unproven runtime tail.
+        const transcriptProvenance =
+          prefetchApplied && prefetchMatchesResumedSession && stored
+            ? createPersistedDisplayTranscriptProvenance({
+                lineageRootId: stored._lineage_root_id ?? null,
+                scope: sessionRestScope,
+                storedSessionId
+              })
+            : undefined
+
         updateSessionState(
           resumed.session_id,
           state => ({
             ...state,
             ...(runtimeInfo ?? {}),
             messages: visibleMessagesForView,
+            transcriptProvenance,
             busy: resumedRunning,
             awaitingResponse: resumedRunning && !recoveredInFlightTail,
             // Backend reported this turn running at resume time — live proof.
@@ -1800,7 +1862,10 @@ export function useSessionActions({
             reconcileAuthoritativeMessages(fallback.messages, previousMessages)
           )
 
-          setMessages(fallbackRecovery.messages)
+          // The eager prefetch paint above may already show this transcript.
+          if (!chatMessageArraysEquivalent($messages.get(), fallbackRecovery.messages)) {
+            setMessages(fallbackRecovery.messages)
+          }
         } catch (e) {
           // Fallback also failed: nothing to paint. Leave whatever messages are
           // already shown and fall through to arm the resume-failure latch so
@@ -1954,34 +2019,82 @@ export function useSessionActions({
       parentStoredId: null | string,
       cwd?: string,
       profile?: null | string,
-      branchCount?: number
+      branchCount?: number,
+      ownerRoute?: SessionOwnerRoute
     ): Promise<boolean> => {
       creatingSessionRef.current = true
 
       try {
-        // A branch belongs to its parent's OWNING profile. Swapping the live
-        // gateway first AND passing `profile` on the create mirrors
-        // desktopSessionCreateParams/resumeSession: in app-global remote mode
-        // one backend serves every profile, so an omitted profile silently
-        // lands the branch on the launch (default) profile — the "session
-        // jumps between profiles after branching" bug. The swap also makes
-        // upsertOptimisticSession's $activeGatewayProfile stamp correct.
-        await ensureGatewayProfile(profile)
+        // A branch belongs to its parent's OWNING backend. Two facets, and both
+        // matter once more than one connection is configured:
+        //
+        // 1. PROFILE — passing `profile` on the create mirrors
+        //    desktopSessionCreateParams/resumeSession: in app-global remote mode
+        //    one backend serves every profile, so an omitted profile silently
+        //    lands the branch on the launch (default) profile — the "session
+        //    jumps between profiles after branching" bug.
+        // 2. CONNECTION — a profile name alone does not identify a backend when
+        //    several connections expose the same name. Routing on profile only
+        //    sends session.create to whatever socket happens to be active, so
+        //    branching a remote-owned parent from another connection creates the
+        //    child on the wrong backend (or nowhere), while the optimistic
+        //    sidebar row below still points at an id no backend owns — the
+        //    "Couldn't load this session" strand. removeSession already routes
+        //    by (connection, profile); this is the same ownership contract.
+        //
+        // An untagged parent keeps the historic profile-only path exactly.
+        if (ownerRoute) {
+          await ensureGatewayAgent(ownerRoute.connectionId, ownerRoute.profile)
+        } else {
+          await ensureGatewayProfile(profile)
+        }
+
+        const requestBranchGateway = <T>(method: string, params: Record<string, unknown>): Promise<T> =>
+          ownerRoute
+            ? requestGatewayForAgent<T>(ownerRoute.connectionId, ownerRoute.profile, method, params)
+            : requestGateway<T>(method, params)
+
+        // The owner is part of the identity: the same parent id on two
+        // connections is two different sessions, so a route-blind key would
+        // coalesce them onto one create.
+        const createKey = branchCreateKey({
+          branchCount,
+          branchMessages,
+          cwd,
+          ownerRoute,
+          parentStoredId,
+          profile,
+          sourceSessionId
+        })
+
+        let createFlight = branchCreateFlightsRef.current.get(createKey)
 
         // No title: the backend auto-names the branch from its parent's lineage.
-        const branched = sourceSessionId
-          ? await requestGateway<SessionCreateResponse>('session.branch', {
-              session_id: sourceSessionId,
-              ...(branchCount !== undefined ? { count: branchCount } : {})
-            })
-          : await requestGateway<SessionCreateResponse>('session.create', {
-              cols: 96,
-              source: 'desktop',
-              ...(cwd && { cwd }),
-              ...(profile ? { profile } : {}),
-              messages: branchMessages.map(({ content, role }) => ({ content, role })),
-              ...(parentStoredId && { parent_session_id: parentStoredId })
-            })
+        if (!createFlight) {
+          createFlight = (
+            sourceSessionId
+              ? requestBranchGateway<SessionCreateResponse>('session.branch', {
+                  session_id: sourceSessionId,
+                  ...(branchCount !== undefined ? { count: branchCount } : {})
+                })
+              : requestBranchGateway<SessionCreateResponse>('session.create', {
+                  cols: 96,
+                  source: 'desktop',
+                  ...(cwd && { cwd }),
+                  ...(profile ? { profile } : {}),
+                  messages: branchMessages.map(({ content, role }) => ({ content, role })),
+                  ...(parentStoredId && { parent_session_id: parentStoredId })
+                })
+          ).catch(err => {
+            // Drop the flight so a genuine retry re-issues the create; a
+            // resolved flight is cleared once the child is fully published.
+            branchCreateFlightsRef.current.delete(createKey)
+            throw err
+          })
+          branchCreateFlightsRef.current.set(createKey, createFlight)
+        }
+
+        const branched = await createFlight
 
         const responseBranchMessages =
           sourceSessionId && branched.messages?.length ? toBranchMessages(toChatMessages(branched.messages)) : []
@@ -1989,6 +2102,19 @@ export function useSessionActions({
         const effectiveBranchMessages = responseBranchMessages.length ? responseBranchMessages : branchMessages
         const routedSessionId = branched.stored_session_id ?? branched.session_id
         const preview = effectiveBranchMessages.map(({ content }) => content).find(Boolean) ?? null
+
+        // Record the exact owner and pin its socket THE MOMENT the create
+        // returns, before the optimistic row / tile publication can lose a
+        // race with the gateway pruner. A draft branch child exists only as a
+        // runtime on the owning backend (the stored row lands on first turn),
+        // so a prune in this gap orphan-reaps it and the tile enters the
+        // resume→reclaim flicker loop (#93892 shape). Mirrors the two routed
+        // creates at the top of this file.
+        if (ownerRoute) {
+          setSessionOwnerHint(routedSessionId, ownerRoute)
+          holdSessionOwnerUntilForeground(routedSessionId, ownerRoute)
+        }
+
         // Draft until submit: nest under the parent at the parent's recency so it
         // doesn't bubble to the top until a real message lands (backend persists
         // + auto-names it then). The selected row survives refreshes (sessionsToKeep).
@@ -2000,13 +2126,22 @@ export function useSessionActions({
           : 0
 
         setFreshDraftReady(false)
+        // Stamp the optimistic row with the branch's EXACT owner. Without it the
+        // row inherits $activeGatewayProfile and carries no connection_id, so a
+        // child correctly created on the parent's remote backend is listed as
+        // belonging to whichever backend happens to be active. Every later
+        // owner lookup off that row (resume, hydrate, prompt) then routes to the
+        // wrong machine and the chat pane spins on a session that backend never
+        // had — the create is right, the row is a lie. Mirrors the routed
+        // creates at the top of this file, which already pass their route here.
         upsertOptimisticSession(
           branched,
           routedSessionId,
           copy.branchTitle(siblings + 1).toLowerCase(),
           preview,
           parentStoredId,
-          parent ? parent.last_active || parent.started_at : undefined
+          parent ? parent.last_active || parent.started_at : undefined,
+          ownerRoute ?? null
         )
         ensureSessionState(branched.session_id, routedSessionId)
         updateSessionState(
@@ -2034,13 +2169,25 @@ export function useSessionActions({
         // unconditionally). resumeSession reuses the runtime warm-cached above
         // (ensureSessionState/updateSessionState) instead of an extra resume RPC.
         if (parentStoredId !== null && selectedStoredSessionIdRef.current === parentStoredId) {
+          navigate(sessionRoute(routedSessionId), { replace: true })
           await resumeSession(routedSessionId)
         } else {
-          openSessionTile(routedSessionId, 'center')
+          // Carry the exact owner onto the tile: its persisted ownerRoute is
+          // what pins the owning backend's socket in the gateway keep-set
+          // (openTileGatewayScopes) for the tile's whole lifetime. Without it
+          // a remote-owned branch child's tile pinned nothing, the pruner
+          // closed the owner socket, the backend reaped the draft runtime,
+          // and the tile looped resume→reclaim until the storm breaker
+          // latched "Couldn't open this session".
+          openSessionTile(routedSessionId, 'center', undefined, null, {
+            ownerRoute,
+            workspaceMode: 'sessions'
+          })
           patchSessionTile(routedSessionId, { runtimeId: branched.session_id })
           revealTreePane(`session-tile:${routedSessionId}`)
         }
 
+        branchCreateFlightsRef.current.delete(createKey)
         broadcastSessionsChanged()
 
         return true
@@ -2058,6 +2205,7 @@ export function useSessionActions({
       copy,
       creatingSessionRef,
       ensureSessionState,
+      navigate,
       requestGateway,
       resumeSession,
       selectedStoredSessionIdRef,
@@ -2094,9 +2242,15 @@ export function useSessionActions({
       let authoritativeMessages: ChatMessage[] | null = null
       const profile = await resolveSessionProfile(storedSessionId)
 
+      // The open chat's exact owner, when its row carries a connection tag.
+      // Same contract as branchStoredSession: the transcript read and the
+      // branch RPC must both land on the backend that owns the parent, not on
+      // whichever socket is active.
+      const ownerRoute = storedSessionId ? sessionOwnerRouteFromRow(cachedSessionRow(storedSessionId)) : undefined
+
       if (storedSessionId) {
         try {
-          const persisted = await getAllSessionMessages(storedSessionId, profile)
+          const persisted = await getAllSessionMessages(storedSessionId, ownerRoute ?? profile)
           const hydrated = toChatMessages(persisted.messages)
 
           if (hydrated.length) {
@@ -2144,7 +2298,8 @@ export function useSessionActions({
         storedSessionId,
         startingCwd,
         profile,
-        messageId ? branchMessages.length : undefined
+        messageId ? branchMessages.length : undefined,
+        ownerRoute
       )
     },
     [activeSessionIdRef, busyRef, copy, forkBranch, getRouteToken, selectedStoredSessionIdRef]
@@ -2160,15 +2315,30 @@ export function useSessionActions({
       // Right-clicking a session outside the paginated sidebar window is a cache
       // miss: resolve it (cache → active backend → cross-profile) so the branch
       // is created on the parent's OWNING profile, not whichever is live (#67603).
+      // cachedSessionRow spans Recents, cron/messaging and the profile-scoped
+      // project tree, and prefers the self-describing row — an ownerless legacy
+      // Recents copy of the same id must not mask the row carrying the owner.
       const stored =
-        $sessions.get().find(session => sessionMatchesStoredId(session, storedSessionId)) ??
-        (sessionProfile ? undefined : await resolveStoredSession(storedSessionId))
+        cachedSessionRow(storedSessionId) ?? (sessionProfile ? undefined : await resolveStoredSession(storedSessionId))
 
       const profile = sessionProfile ?? stored?.profile
 
+      // An exact owner from the parent row — connection AND profile. Undefined
+      // for an untagged row, which keeps the ambient/profile-only path.
+      const ownerRoute = sessionOwnerRouteFromRow(stored)
+
       try {
-        await ensureGatewayProfile(profile)
-        const { messages } = await getAllSessionMessages(storedSessionId, profile)
+        if (ownerRoute) {
+          await ensureGatewayAgent(ownerRoute.connectionId, ownerRoute.profile)
+        } else {
+          await ensureGatewayProfile(profile)
+        }
+
+        // Read the parent transcript from the backend that OWNS it. A bare
+        // profile scope resolves against the active connection, which for a
+        // foreign-owned parent holds no such session: the read comes back empty
+        // and the branch aborts as "nothing to branch" before any create.
+        const { messages } = await getAllSessionMessages(storedSessionId, ownerRoute ?? profile)
         const branchMessages = toBranchMessages(toChatMessages(messages))
 
         if (!branchMessages.length) {
@@ -2177,7 +2347,15 @@ export function useSessionActions({
           return false
         }
 
-        return await forkBranch(branchMessages, null, stored?.id ?? storedSessionId, stored?.cwd?.trim(), profile)
+        return await forkBranch(
+          branchMessages,
+          null,
+          stored?.id ?? storedSessionId,
+          stored?.cwd?.trim(),
+          profile,
+          undefined,
+          ownerRoute
+        )
       } catch (err) {
         notifyError(err, copy.branchFailed)
 
@@ -2220,8 +2398,12 @@ export function useSessionActions({
         return
       }
 
-      const wasSelected = selectedStoredSessionId === storedSessionId
-      const closingRuntimeId = wasSelected ? activeSessionId : null
+      // Selection and runtime refs are updated synchronously at routing
+      // boundaries. React props can still describe the previous render when a
+      // delete lands in the same tick, which used to leave the doomed route in
+      // place and let the generic 4001 recovery rebind it.
+      const wasSelected = selectedStoredSessionIdRef.current === storedSessionId
+      const closingRuntimeId = wasSelected ? activeSessionIdRef.current : null
       const previousMessages = $messages.get()
       const previousPinned = $pinnedSessionIds.get()
 
@@ -2323,13 +2505,11 @@ export function useSessionActions({
       }
     },
     [
-      activeSessionId,
       activeSessionIdRef,
       copy,
       navigate,
       requestGateway,
       runtimeIdByStoredSessionIdRef,
-      selectedStoredSessionId,
       selectedStoredSessionIdRef,
       sessionStateByRuntimeIdRef,
       startFreshSessionDraft
@@ -2356,7 +2536,7 @@ export function useSessionActions({
         return
       }
 
-      const wasSelected = selectedStoredSessionId === storedSessionId
+      const wasSelected = selectedStoredSessionIdRef.current === storedSessionId
       const previousPinned = $pinnedSessionIds.get()
       // Pins are keyed on the durable lineage-root id; the stored id may be the
       // live tip after compression. Drop both so the pin can't linger.
@@ -2401,7 +2581,13 @@ export function useSessionActions({
         endSessionMutation(archivedIds)
       }
     },
-    [copy, runtimeIdByStoredSessionIdRef, selectedStoredSessionId, sessionStateByRuntimeIdRef, startFreshSessionDraft]
+    [
+      copy,
+      runtimeIdByStoredSessionIdRef,
+      selectedStoredSessionIdRef,
+      sessionStateByRuntimeIdRef,
+      startFreshSessionDraft
+    ]
   )
 
   return {
diff --git a/apps/desktop/src/app/session/hooks/use-session-actions/resolve-stored-session.test.ts b/apps/desktop/src/app/session/hooks/use-session-actions/resolve-stored-session.test.ts
index 468936f5b6..cccb323317 100644
--- a/apps/desktop/src/app/session/hooks/use-session-actions/resolve-stored-session.test.ts
+++ b/apps/desktop/src/app/session/hooks/use-session-actions/resolve-stored-session.test.ts
@@ -3,10 +3,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as HermesModule from '@/hermes'
 import { getSession } from '@/hermes'
 import { $activeGatewayProfile, $profiles } from '@/store/profile'
+import { $projectTree } from '@/store/projects'
 import { $cronSessions, $messagingSessions, $sessions } from '@/store/session'
 import type { SessionInfo } from '@/types/hermes'
 
-import { resolveSessionProfile, resolveStoredSession } from './utils'
+import { cachedSessionRow, resolveSessionProfile, resolveStoredSession } from './utils'
 
 vi.mock('@/hermes', async importActual => ({
   ...(await importActual<typeof HermesModule>()),
@@ -24,6 +25,7 @@ describe('resolveStoredSession profile ownership', () => {
     $cronSessions.set([])
     $messagingSessions.set([])
     $sessions.set([])
+    $projectTree.set([])
     $profiles.set(profiles('default', 'meta'))
     $activeGatewayProfile.set('meta')
     mockGetSession.mockReset()
@@ -33,6 +35,7 @@ describe('resolveStoredSession profile ownership', () => {
     $cronSessions.set([])
     $messagingSessions.set([])
     $sessions.set([])
+    $projectTree.set([])
     $profiles.set([])
     $activeGatewayProfile.set('default')
   })
@@ -144,3 +147,50 @@ describe('resolveStoredSession profile ownership', () => {
     await expect(resolveSessionProfile('s1')).resolves.toBe('default')
   })
 })
+
+describe('cachedSessionRow owner preference', () => {
+  const projectNode = (sessions: SessionInfo[], preview: SessionInfo[] = []) =>
+    ({
+      previewSessions: preview,
+      repos: [{ groups: [{ sessions }] }]
+    }) as never
+
+  beforeEach(() => {
+    $cronSessions.set([])
+    $messagingSessions.set([])
+    $sessions.set([])
+    $projectTree.set([])
+    mockGetSession.mockReset()
+  })
+
+  afterEach(() => {
+    $cronSessions.set([])
+    $messagingSessions.set([])
+    $sessions.set([])
+    $projectTree.set([])
+  })
+
+  it('prefers a self-describing project-tree row over an ownerless Recents duplicate', () => {
+    // The same conversation, listed twice: a legacy Recents row with no owner
+    // and the profile-scoped project-tree row the gateway stamped. Picking the
+    // Recents copy throws away the only routing information there is, and the
+    // branch then creates its child on whichever backend is active.
+    $sessions.set([session({ cwd: '/wrong', id: 's1' })])
+    $projectTree.set([projectNode([session({ connection_id: 'pandora', cwd: '/right', id: 's1', profile: 'work' })])])
+
+    expect(cachedSessionRow('s1')).toMatchObject({ connection_id: 'pandora', cwd: '/right', profile: 'work' })
+  })
+
+  it('finds a project-tree preview row when the session is in no other list', () => {
+    $projectTree.set([projectNode([], [session({ connection_id: 'rigremote', id: 's1', profile: 'default' })])])
+
+    expect(cachedSessionRow('s1')).toMatchObject({ connection_id: 'rigremote' })
+  })
+
+  it('keeps the plain Recents row when nothing carries an owner', () => {
+    $sessions.set([session({ cwd: '/only', id: 's1' })])
+
+    expect(cachedSessionRow('s1')).toMatchObject({ cwd: '/only' })
+    expect(cachedSessionRow('missing')).toBeUndefined()
+  })
+})
diff --git a/apps/desktop/src/app/session/hooks/use-session-actions/utils.ts b/apps/desktop/src/app/session/hooks/use-session-actions/utils.ts
index 83e599b589..113539132b 100644
--- a/apps/desktop/src/app/session/hooks/use-session-actions/utils.ts
+++ b/apps/desktop/src/app/session/hooks/use-session-actions/utils.ts
@@ -8,6 +8,7 @@ import { isMessagingSource, normalizeSessionSource } from '@/lib/session-source'
 import { reconcileApprovalModeForProfile } from '@/store/approval-mode'
 import { requestDesktopOnboardingForCredentialWarning } from '@/store/onboarding'
 import { $activeGatewayProfile, $profiles, normalizeProfileKey } from '@/store/profile'
+import { $projectTree } from '@/store/projects'
 import {
   $cronSessions,
   $currentCwd,
@@ -1387,13 +1388,43 @@ function upsertResolvedSession(session: SessionInfo, storedSessionId: string) {
   ])
 }
 
+// Every session row reachable through the profile-scoped project tree —
+// preview rows on a collapsed project plus the drill-in lane rows. These are
+// the only rows guaranteed to name their owning profile (the gateway stamps
+// the request scope onto them), so owner resolution has to see them.
+function projectTreeSessions(): SessionInfo[] {
+  return $projectTree
+    .get()
+    .flatMap(project => [
+      ...(project.previewSessions ?? []),
+      ...project.repos.flatMap(repo => repo.groups.flatMap(group => group.sessions))
+    ])
+}
+
+// The best cached row for a stored id, across every list that can hold one.
+// "Best" means self-describing: the same conversation can appear both as an
+// ownerless legacy Recents copy and as a profile-stamped project-tree row, and
+// picking the ownerless one throws away the only routing information we have.
+export function cachedSessionRow(storedSessionId: string): SessionInfo | undefined {
+  const candidates = [
+    ...$sessions.get(),
+    ...$cronSessions.get(),
+    ...$messagingSessions.get(),
+    ...projectTreeSessions()
+  ].filter(session => sessionMatchesStoredId(session, storedSessionId))
+
+  return (
+    candidates.find(session => session.connection_id?.trim()) ??
+    candidates.find(session => session.profile?.trim()) ??
+    candidates[0]
+  )
+}
+
 export async function resolveStoredSession(
   storedSessionId: string,
   ownerRoute?: SessionProfileRoute
 ): Promise<SessionInfo | undefined> {
-  const cached = [...$sessions.get(), ...$cronSessions.get(), ...$messagingSessions.get()].find(session =>
-    sessionMatchesStoredId(session, storedSessionId)
-  )
+  const cached = cachedSessionRow(storedSessionId)
 
   if (ownerRoute) {
     const scope = {
diff --git a/apps/desktop/src/app/session/hooks/use-session-list-actions.test.tsx b/apps/desktop/src/app/session/hooks/use-session-list-actions.test.tsx
index 8a953a043a..1bcb6bb3da 100644
--- a/apps/desktop/src/app/session/hooks/use-session-list-actions.test.tsx
+++ b/apps/desktop/src/app/session/hooks/use-session-list-actions.test.tsx
@@ -216,6 +216,57 @@ describe('refreshSessions identity + loading hygiene', () => {
     expect($sessions.get().map(s => s.id)).toEqual(['a'])
   })
 
+  it('keeps idle recents when the sidebar returns an empty page plus profile errors', async () => {
+    // Backend contract on disk I/O / lock: HTTP 200, recents=[], errors=[{profile}].
+    // mergeSessionPage only keeps working/pinned/selected, so Yesterday/This-week
+    // idle rows must be carried forward from the previous list — not clobbered.
+    const idle = [row('yesterday'), row('week')]
+    listSidebarSessions.mockResolvedValue(sidebar({ sessions: idle }))
+
+    const { result } = renderHook(() => useSessionListActions({ profileScope: 'default' }))
+
+    await act(async () => {
+      await result.current.refreshSessions()
+    })
+
+    expect($sessions.get().map(s => s.id)).toEqual(['yesterday', 'week'])
+
+    setSessionProfilesTruncated({ default: true })
+    setSessionProfilesUsage({ default: { cost_usd: 3, tokens: 30 } })
+    setMessagingTruncated(true)
+
+    listSidebarSessions.mockResolvedValue({
+      ...sidebar({ sessions: [] }),
+      errors: [{ error: 'disk I/O error', profile: 'default' }]
+    })
+
+    await act(async () => {
+      await result.current.refreshSessions()
+    })
+
+    expect($sessions.get().map(s => s.id)).toEqual(['yesterday', 'week'])
+    expect($sessionProfilesTruncated.get()).toEqual({ default: true })
+    expect($sessionProfilesUsage.get()).toEqual({ default: { cost_usd: 3, tokens: 30 } })
+    expect($messagingTruncated.get()).toBe(true)
+  })
+
+  it('still accepts a genuine empty recents page when the backend reported no errors', async () => {
+    listSidebarSessions.mockResolvedValue(sidebar({ sessions: [row('a')] }))
+    const { result } = renderHook(() => useSessionListActions({ profileScope: 'default' }))
+
+    await act(async () => {
+      await result.current.refreshSessions()
+    })
+
+    listSidebarSessions.mockResolvedValue(sidebar({ sessions: [] }))
+
+    await act(async () => {
+      await result.current.refreshSessions()
+    })
+
+    expect($sessions.get()).toEqual([])
+  })
+
   it('drops tombstoned rows from the messaging slice and per-platform paging too (#50928)', async () => {
     // The same delete race exists on every ingestion point: the batched
     // refresh's messaging slice and the per-platform "load more" pager must
diff --git a/apps/desktop/src/app/session/hooks/use-session-list-actions.ts b/apps/desktop/src/app/session/hooks/use-session-list-actions.ts
index 255e85189b..935fb745e6 100644
--- a/apps/desktop/src/app/session/hooks/use-session-list-actions.ts
+++ b/apps/desktop/src/app/session/hooks/use-session-list-actions.ts
@@ -24,7 +24,9 @@ import {
   $messagingSessions,
   $selectedStoredSessionId,
   $sessions,
+  carryForwardFailedProfileSessions,
   CRON_SECTION_LIMIT,
+  keepFailedProfileMeta,
   mergeSessionPage,
   MESSAGING_SECTION_LIMIT,
   setCronSessions,
@@ -36,7 +38,7 @@ import {
   setSessions,
   setSessionsLoading
 } from '@/store/session'
-import { $workingSessionIds, getRecentlySettledSessionIds } from '@/store/session-states'
+import { $sessionTiles, $workingSessionIds, getRecentlySettledSessionIds } from '@/store/session-states'
 
 import { refreshCronJobs as refreshCronJobsStore } from '../../cron/cron-actions'
 
@@ -80,6 +82,15 @@ function sessionsToKeep(scope?: string): Set<string> {
     ...getRecentlySettledSessionIds()
   ])
 
+  // Open tiles are user-visible state exactly like the selected row: a branch
+  // child is a DRAFT until its first real turn, so the aggregator can't return
+  // it — without this the next background refresh silently dropped the
+  // optimistic `draft: branch #N` row while its tab was open, and the sidebar
+  // showed no trace of the branch until first send.
+  for (const tile of $sessionTiles.get()) {
+    keep.add(tile.storedSessionId)
+  }
+
   const active = $selectedStoredSessionId.get()
 
   if (active) {
@@ -198,7 +209,11 @@ export function useSessionListActions({ profileScope }: UseSessionListActionsArg
 
       setMessagingSessions(prev => [
         ...prev.filter(s => !inPlatform(s)),
-        ...mergeSessionPage(prev.filter(inPlatform), incoming, sessionsToKeep())
+        ...mergeSessionPage(
+          prev.filter(inPlatform),
+          carryForwardFailedProfileSessions(prev.filter(inPlatform), incoming, result.errors),
+          sessionsToKeep()
+        )
       ])
 
       const total = result.total ?? incoming.length
@@ -282,13 +297,15 @@ export function useSessionListActions({ profileScope }: UseSessionListActionsArg
           // in-flight mutation and the backend page still carries the doomed row.
           // Honoring the optimistic tombstone keeps the removal from flashing back
           // (the tombstone self-clears once projects.tree confirms the delete).
-          const incoming = dropTombstoned(recents.sessions)
-
           // Signature-gate the swap (same pattern as cron/messaging): a refresh
           // that returns content-identical rows must keep the previous array
           // identity, or every sidebar memo keyed on $sessions recomputes and the
           // whole list re-renders once per turn/broadcast for nothing.
           setSessions(prev => {
+            const incoming = dropTombstoned(
+              carryForwardFailedProfileSessions(prev, recents.sessions ?? [], recents.errors ?? result.errors)
+            )
+
             const next = mergeSessionPage(prev, incoming, sessionsToKeep())
 
             return sameCronSignature(prev, next) ? prev : next
@@ -298,8 +315,9 @@ export function useSessionListActions({ profileScope }: UseSessionListActionsArg
           // top of the rows it already read (the old exact totals ran a COUNT(*)
           // per profile DB on every refresh). Reference-stable when unchanged so
           // the sidebar's group memos don't recompute per refresh.
+          const recentsErrors = recents.errors ?? result.errors
           setSessionProfilesTruncated(prev => {
-            const next = recents.profiles_truncated ?? {}
+            const next = keepFailedProfileMeta(prev, recents.profiles_truncated ?? {}, recentsErrors)
             const prevKeys = Object.keys(prev)
 
             return prevKeys.length === Object.keys(next).length && prevKeys.every(key => prev[key] === next[key])
@@ -309,7 +327,7 @@ export function useSessionListActions({ profileScope }: UseSessionListActionsArg
           // Same identity gate: these totals only move when a session bills, and
           // a fresh object every refresh would repaint every profile header.
           setSessionProfilesUsage(prev => {
-            const next = recents.profiles_usage ?? {}
+            const next = keepFailedProfileMeta(prev, recents.profiles_usage ?? {}, recentsErrors)
             const prevKeys = Object.keys(prev)
 
             return prevKeys.length === Object.keys(next).length &&
@@ -322,16 +340,35 @@ export function useSessionListActions({ profileScope }: UseSessionListActionsArg
 
           // Cron section: latest N cron sessions (kept so a pinned cron run still
           // resolves via sessionByAnyId), signature-gated like above.
-          setCronSessions(prev => (sameCronSignature(prev, result.cron.sessions) ? prev : result.cron.sessions))
+          setCronSessions(prev => {
+            const incoming = carryForwardFailedProfileSessions(
+              prev,
+              result.cron.sessions ?? [],
+              result.cron.errors ?? result.errors
+            )
+
+            return sameCronSignature(prev, incoming) ? prev : incoming
+          })
 
           // Messaging sections: drop any non-messaging source the broad exclude
           // didn't catch (custom sources stay in local recents), then split per
           // platform in the UI.
-          const messagingRows = dropTombstoned(result.messaging.sessions.filter(s => isMessagingSource(s.source)))
+          const messagingErrors = result.messaging.errors ?? result.errors
+          setMessagingSessions(prev => {
+            const messagingRows = dropTombstoned(
+              carryForwardFailedProfileSessions(
+                prev,
+                (result.messaging.sessions ?? []).filter(s => isMessagingSource(s.source)),
+                messagingErrors
+              )
+            )
 
-          setMessagingSessions(prev => (sameCronSignature(prev, messagingRows) ? prev : messagingRows))
+            return sameCronSignature(prev, messagingRows) ? prev : messagingRows
+          })
           // Hit the cap → at least one platform may have more on disk than loaded.
-          setMessagingTruncated(result.messaging.sessions.length >= MESSAGING_SECTION_LIMIT)
+          setMessagingTruncated(prev =>
+            messagingErrors?.length ? prev : result.messaging.sessions.length >= MESSAGING_SECTION_LIMIT
+          )
         }
       } finally {
         // Request identity preserves the zero-argument refresh contract across a
diff --git a/apps/desktop/src/app/session/workspace-session-target.test.ts b/apps/desktop/src/app/session/workspace-session-target.test.ts
index 852f83ab97..b50f91a61c 100644
--- a/apps/desktop/src/app/session/workspace-session-target.test.ts
+++ b/apps/desktop/src/app/session/workspace-session-target.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
+import { $activeGatewayProfile, $newChatProfile } from '@/store/profile'
 import { $projectScope, $projectTree, ALL_PROJECTS } from '@/store/projects'
 import {
   $currentBranch,
@@ -22,6 +23,8 @@ describe('startWorkspaceSession', () => {
     setNewChatWorkspaceTarget(undefined)
     $projectScope.set(ALL_PROJECTS)
     $projectTree.set([])
+    $activeGatewayProfile.set('default')
+    $newChatProfile.set(null)
     vi.restoreAllMocks()
   })
 
@@ -107,4 +110,22 @@ describe('startWorkspaceSession', () => {
     expect($newChatWorkspaceTarget.get()).toBeNull()
     expect($currentCwd.get()).toBe('')
   })
+
+  // #79005 flaw 3: the project "+" must pin the profile the tree is shown
+  // under; otherwise session.create reads $activeGatewayProfile after a swap.
+  it('pins the new chat to the profile the project tree is displayed under', () => {
+    $activeGatewayProfile.set('work')
+    $newChatProfile.set(null)
+
+    startWorkspaceSession({
+      activeSessionIdRef: { current: null },
+      path: '/workspace-work',
+      requestGateway: vi.fn(() => new Promise<never>(() => {})),
+      startFreshSessionDraft: vi.fn()
+    })
+
+    $activeGatewayProfile.set('personal')
+
+    expect($newChatProfile.get()).toBe('work')
+  })
 })
diff --git a/apps/desktop/src/app/session/workspace-session-target.ts b/apps/desktop/src/app/session/workspace-session-target.ts
index 868b7c404a..fb0dae1591 100644
--- a/apps/desktop/src/app/session/workspace-session-target.ts
+++ b/apps/desktop/src/app/session/workspace-session-target.ts
@@ -1,6 +1,7 @@
 import type { MutableRefObject } from 'react'
 
-import { followActiveSessionCwd, resolveNewSessionCwd } from '@/store/projects'
+import { pinNewChatProfile } from '@/store/profile'
+import { followActiveSessionCwd, projectProfile, resolveNewSessionCwd } from '@/store/projects'
 import {
   $newChatWorkspaceTargetGeneration,
   type NewChatWorkspaceTarget,
@@ -26,6 +27,16 @@ export function startWorkspaceSession({
   requestGateway,
   startFreshSessionDraft
 }: WorkspaceSessionOptions): void {
+  // The project tree is rendered under one profile; the "+" belongs to it.
+  // Pin that intent now — otherwise desktopSessionCreateParams falls back to
+  // $activeGatewayProfile, which a still-settling profile swap can move
+  // between this click and Send (#79005). All-profiles view has no owner.
+  const profile = projectProfile()
+
+  if (profile) {
+    pinNewChatProfile(profile)
+  }
+
   // Home's "+" passes path=null on purpose ("no folder"). That must stay
   // detached — do NOT fall through to resolveNewSessionCwd(), which can still
   // return a default/remembered project folder and re-attach the last repo
diff --git a/apps/desktop/src/app/settings/about-settings.tsx b/apps/desktop/src/app/settings/about-settings.tsx
index fa358a08dc..281f75d2c6 100644
--- a/apps/desktop/src/app/settings/about-settings.tsx
+++ b/apps/desktop/src/app/settings/about-settings.tsx
@@ -107,27 +107,50 @@ export function AboutSettings() {
             {version?.appVersion ? a.version(version.appVersion) : a.versionUnavailable}
           </p>
         </div>
-        {version?.bundleOutOfSync && (
+        {(version?.bundleOutOfSync || version?.bundleSwapPending) && (
           <div className="mx-auto w-full max-w-2xl rounded-xl border border-amber-500/40 bg-amber-500/10 px-4 py-3 text-left text-sm">
             <div className="flex items-start gap-2">
               <AlertTriangle className="mt-0.5 size-4 shrink-0 text-amber-600 dark:text-amber-400" />
               <div className="min-w-0">
-                <p className="font-medium">{a.bundleOutOfSync}</p>
-                <p className="mt-1 text-xs text-muted-foreground">{a.bundleOutOfSyncDesc}</p>
-                <Button asChild className="mt-2" size="sm" variant="textStrong">
-                  <a
-                    href={INSTALLER_URL}
-                    onClick={event => {
-                      event.preventDefault()
-                      void window.hermesDesktop?.openExternal?.(INSTALLER_URL)
-                    }}
-                    rel="noreferrer"
-                    target="_blank"
-                  >
-                    <ExternalLink className="size-3" />
-                    {a.bundleOutOfSyncAction}
-                  </a>
-                </Button>
+                {version?.bundleSwapPending ? (
+                  // The updated app is already on disk — the updater swapped it
+                  // under this running process — so a restart loads it. Saying
+                  // "App build out of date" here would repeat the contradiction
+                  // this banner is meant to resolve: the Updates card below
+                  // already reports the runtime as current.
+                  <>
+                    <p className="font-medium">{a.bundleSwapPending}</p>
+                    <p className="mt-1 text-xs text-muted-foreground">{a.bundleSwapPendingDesc}</p>
+                    <Button
+                      className="mt-2"
+                      onClick={() => void window.hermesDesktop?.relaunchApp?.()}
+                      size="sm"
+                      variant="textStrong"
+                    >
+                      <RefreshCw className="size-3" />
+                      {a.bundleSwapPendingAction}
+                    </Button>
+                  </>
+                ) : (
+                  <>
+                    <p className="font-medium">{a.bundleOutOfSync}</p>
+                    <p className="mt-1 text-xs text-muted-foreground">{a.bundleOutOfSyncDesc}</p>
+                    <Button asChild className="mt-2" size="sm" variant="textStrong">
+                      <a
+                        href={INSTALLER_URL}
+                        onClick={event => {
+                          event.preventDefault()
+                          void window.hermesDesktop?.openExternal?.(INSTALLER_URL)
+                        }}
+                        rel="noreferrer"
+                        target="_blank"
+                      >
+                        <ExternalLink className="size-3" />
+                        {a.bundleOutOfSyncAction}
+                      </a>
+                    </Button>
+                  </>
+                )}
               </div>
             </div>
           </div>
@@ -176,7 +199,7 @@ export function AboutSettings() {
                 <Button onClick={() => startActiveUpdate()} size="sm">
                   {a.updateNow}
                 </Button>
-                <Button onClick={() => openUpdatesWindow()} size="sm" variant="textStrong">
+                <Button onClick={() => openUpdatesWindow('client')} size="sm" variant="textStrong">
                   {a.seeWhatsNew}
                 </Button>
               </>
diff --git a/apps/desktop/src/app/settings/appearance-settings.tsx b/apps/desktop/src/app/settings/appearance-settings.tsx
index c007ea937b..64c3be3245 100644
--- a/apps/desktop/src/app/settings/appearance-settings.tsx
+++ b/apps/desktop/src/app/settings/appearance-settings.tsx
@@ -7,6 +7,7 @@ import { LanguageSwitcher } from '@/components/language-switcher'
 import { Button } from '@/components/ui/button'
 import { SegmentedControl } from '@/components/ui/segmented-control'
 import type { DesktopMarketplaceSearchItem } from '@/global'
+import { saveHermesConfig } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { triggerHaptic } from '@/lib/haptics'
 import { Check, Download, Loader2, Palette, Trash2 } from '@/lib/icons'
@@ -17,6 +18,7 @@ import { $backdrop, setBackdrop } from '@/store/backdrop'
 import { $composerPopoutGesturesEnabled, setComposerPopoutGesturesEnabled } from '@/store/composer-popout'
 import { $embedAllowed, $embedMode, clearEmbedAllowed, type EmbedMode, setEmbedMode } from '@/store/embed-consent'
 import { $introSplash, setIntroSplash } from '@/store/intro-splash'
+import { notifyError } from '@/store/notifications'
 import { $activeGatewayProfile, $profiles, normalizeProfileKey } from '@/store/profile'
 import { $reactionsEnabled, setReactionsEnabled } from '@/store/reactions-enabled'
 import { $reasoningCollapsedByDefault, setReasoningCollapsedByDefault } from '@/store/reasoning-disclosure'
@@ -53,13 +55,57 @@ import { installVscodeThemeFromMarketplace } from '@/themes/install'
 import type { DesktopTheme } from '@/themes/types'
 import { $marketplaceInstalls, isUserTheme, removeUserTheme } from '@/themes/user-themes'
 
+import { setHermesConfigCache, useHermesConfigRecord } from '../hooks/use-config-record'
+
 import { MODE_OPTIONS } from './constants'
+import { setNested } from './helpers'
 import { PetSettings } from './pet-settings'
 import { ListRow, SectionHeading, SettingsContent, ToggleRow } from './primitives'
 import { APPEARANCE_SETTING_IDS } from './settings-search'
 import { TerminalFontSetting } from './terminal-font-setting'
 import { useDeepLinkHighlight } from './use-deep-link-highlight'
 
+// display.resume_last_session lives in the backend config record (shared with
+// config.yaml and the cold-start restore in use-desktop-integrations), not a
+// renderer store. Saves write through the shared react-query cache so the
+// restore gate sees the new value on the next launch.
+function ResumeLastSessionSetting() {
+  const { t } = useI18n()
+  const a = t.settings.appearance
+  const configQuery = useHermesConfigRecord()
+  const config = configQuery.data
+  const checked = (config?.display as { resume_last_session?: unknown } | undefined)?.resume_last_session !== false
+
+  const update = (on: boolean) => {
+    if (!config) {
+      return
+    }
+
+    const next = setNested(config, 'display.resume_last_session', on)
+    setHermesConfigCache(next)
+    void saveHermesConfig(next)
+      .then(result => {
+        if (!result.ok) {
+          throw new Error(t.settings.config.autosaveFailed)
+        }
+      })
+      .catch(error => {
+        setHermesConfigCache(config)
+        notifyError(error, t.settings.config.autosaveFailed)
+      })
+  }
+
+  return (
+    <ToggleRow
+      checked={checked}
+      description={a.resumeLastSessionDesc}
+      disabled={!config}
+      label={a.resumeLastSessionTitle}
+      onChange={update}
+    />
+  )
+}
+
 function ThemePreview({ name, mode }: { name: string; mode: 'light' | 'dark' }) {
   // Preview in the *current* mode: the dark palette in Dark, and the light
   // palette in Light — synthesizing one for dark-only themes — so every card
@@ -742,6 +788,8 @@ export function AppearanceSettings() {
             onChange={setComposerPopoutGesturesEnabled}
           />
 
+          <ResumeLastSessionSetting />
+
           <ListRow
             action={
               <SegmentedControl
diff --git a/apps/desktop/src/app/settings/index.tsx b/apps/desktop/src/app/settings/index.tsx
index 82cc8a0147..38a6bf0e37 100644
--- a/apps/desktop/src/app/settings/index.tsx
+++ b/apps/desktop/src/app/settings/index.tsx
@@ -12,6 +12,7 @@ import {
   Archive,
   BarChart3,
   Bell,
+  Cpu,
   Download,
   Globe,
   Info,
@@ -31,6 +32,7 @@ import { cn } from '@/lib/utils'
 import { $commandPaletteOpen, openCommandPalettePage } from '@/store/command-palette'
 import { confirm } from '@/store/confirm'
 import { bindingsFor } from '@/store/keybinds'
+import { $localModelsEnabled } from '@/store/local-models-flag'
 import { notifyError } from '@/store/notifications'
 
 import { useRouteEnumParam } from '../hooks/use-route-enum-param'
@@ -217,7 +219,22 @@ export function SettingsView({ onClose, onConfigSaved, onMainModelChanged }: Set
             id: 'pview:custom-endpoints',
             label: t.settings.nav.providerCustomEndpoints,
             onSelect: () => openProviderView('custom-endpoints')
-          }
+          },
+          // Local models ships behind the --local launch flag: no flag, no
+          // nav entry (the pane itself also refuses to render, so a stale
+          // ?pview=local deep link falls back to accounts-shaped emptiness
+          // rather than a hidden feature).
+          ...($localModelsEnabled.get()
+            ? [
+                {
+                  active: activeView === 'providers' && providerView === 'local',
+                  icon: Cpu,
+                  id: 'pview:local',
+                  label: t.settings.nav.providerLocalModels,
+                  onSelect: () => openProviderView('local')
+                }
+              ]
+            : [])
         ],
         gapBefore: true,
         icon: Zap,
diff --git a/apps/desktop/src/app/settings/local-models-settings.test.tsx b/apps/desktop/src/app/settings/local-models-settings.test.tsx
new file mode 100644
index 0000000000..b779434d6c
--- /dev/null
+++ b/apps/desktop/src/app/settings/local-models-settings.test.tsx
@@ -0,0 +1,556 @@
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { MemoryRouter, useLocation } from 'react-router'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { I18nProvider } from '@/i18n'
+import { $localRuntimeJobs } from '@/store/local-runtime-jobs'
+import type { LocalCatalogModel, LocalHardware, LocalModelsStatus, LocalRuntimeJob } from '@/types/hermes'
+
+import { LocalModelsSettings } from './local-models-settings'
+
+// Mock the API layer — the pane's contract is what it RENDERS from these
+// payloads, not transport.
+vi.mock('@/hermes', () => ({
+  activateLocalModel: vi.fn(),
+  deleteLocalModel: vi.fn(),
+  downloadBrowsedModel: vi.fn(),
+  downloadLocalModel: vi.fn(),
+  ejectLocalModel: vi.fn(),
+  getLocalCatalog: vi.fn(),
+  getLocalHardware: vi.fn(),
+  getLocalModelsJobs: vi.fn(),
+  getLocalModelsStatus: vi.fn(),
+  getLocalRuntimeJob: vi.fn(),
+  installLocalRuntime: vi.fn(),
+  listHFRepoFiles: vi.fn(),
+  quickstartLocalModels: vi.fn(),
+  searchHFModels: vi.fn(),
+  sideloadLocalModel: vi.fn()
+}))
+
+import * as hermes from '@/hermes'
+
+const mocked = vi.mocked(hermes)
+
+const BASE_STATUS: LocalModelsStatus = {
+  enabled: true,
+  tag: 'b10290',
+  configured_tag: 'b10290',
+  update_available: false,
+  runtime_installed: false,
+  runtime_backend: null,
+  server_running: false,
+  server_base_url: null,
+  active_model_id: null,
+  loaded_models: {},
+  models: [],
+  models_dir: 'C:/somewhere/models'
+}
+
+const BASE_HARDWARE: LocalHardware = {
+  uma: false,
+  vram_total_bytes: 32 * 2 ** 30,
+  vram_usable_bytes: 26 * 2 ** 30,
+  ram_total_bytes: 256 * 2 ** 30,
+  ram_available_bytes: 200 * 2 ** 30,
+  vram_label: '32.0 GB',
+  gpu_name: 'NVIDIA GeForce RTX 5090',
+  gpu_util_percent: 12,
+  vram_used_bytes: 6 * 2 ** 30
+}
+
+const FITTING_MODEL: LocalCatalogModel = {
+  id: 'Qwen3.6-27B-UD-Q4_K_XL',
+  display_name: 'Qwen3.6 27B',
+  description: 'Best all-round agent model; long context stays fast',
+  size_bytes: 17.6 * 2 ** 30,
+  size_label: '17.6 GB',
+  native_context: 262144,
+  native_context_label: '256K',
+  recommended: true,
+  downloaded: false,
+  mtp: false,
+  fits: true,
+  fit_summary: 'runs at its full 256K context',
+  start_window: 262144,
+  start_window_label: '256K',
+  spilled: false
+}
+
+const SPILLED_MODEL: LocalCatalogModel = {
+  ...FITTING_MODEL,
+  id: 'Spilled-Model',
+  display_name: 'Spilled Model',
+  recommended: false,
+  fits: true,
+  spilled: true,
+  start_window: 65536,
+  start_window_label: '64K',
+  fit_summary: 'starts at 64K and grows toward 256K as you use it (larger than your GPU memory — runs slower)'
+}
+
+const REFUSED_MODEL: LocalCatalogModel = {
+  ...FITTING_MODEL,
+  id: 'Huge-Model',
+  display_name: 'Huge Model',
+  recommended: false,
+  fits: false,
+  fit_summary: 'Needs more memory than this machine has',
+  fit_detail: 'needs ~60 GiB at the 64K floor',
+  start_window: undefined,
+  start_window_label: undefined
+}
+
+function renderPane() {
+  return render(
+    <MemoryRouter>
+      <I18nProvider>
+        <LocalModelsSettings />
+      </I18nProvider>
+    </MemoryRouter>
+  )
+}
+
+// The fresh-machine states these tests exercise now lead with the
+// quickstart card; the full pane (runtime rows, model list, browser)
+// is one 'Configure…' click away. Render and click through.
+async function renderFullPane() {
+  const result = renderPane()
+  const configure = await screen.findByRole('button', { name: /configure/i })
+
+  fireEvent.click(configure)
+
+  return result
+}
+
+beforeEach(() => {
+  mocked.getLocalModelsStatus.mockResolvedValue(BASE_STATUS)
+  mocked.getLocalHardware.mockResolvedValue(BASE_HARDWARE)
+  mocked.getLocalCatalog.mockResolvedValue({ models: [FITTING_MODEL, SPILLED_MODEL, REFUSED_MODEL] })
+  mocked.getLocalModelsJobs.mockResolvedValue({ jobs: [] })
+  $localRuntimeJobs.set([])
+})
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('LocalModelsSettings', () => {
+  it('offers the runtime install with a plain-language explanation', async () => {
+    await renderFullPane()
+
+    expect(await screen.findByText('Install the local runtime')).toBeTruthy()
+    expect(screen.getByText(/runs? entirely on this machine/i)).toBeTruthy()
+    expect(screen.getByRole('button', { name: /install runtime/i })).toBeTruthy()
+  })
+
+  it('shows every catalog model with fit pills; unaffordable ones stay visible with the reason', async () => {
+    await renderFullPane()
+
+    expect(await screen.findByText('Qwen3.6 27B')).toBeTruthy()
+    // The fitting model reads as pills, not prose: green memory pill +
+    // green full-context pill (start_window == native, resident on GPU).
+    expect(screen.getByText('Fits your GPU')).toBeTruthy()
+    expect(screen.getByText('Full 256K context').className).toContain('emerald')
+
+    // The refused model is NOT hidden (discoverability rule): red memory
+    // pill, plus the ceiling it would have had.
+    expect(screen.getByText('Huge Model')).toBeTruthy()
+    expect(screen.getByText('Too big for this machine')).toBeTruthy()
+
+    // The spilled model reads amber + ONE quiet ceiling pill — the same
+    // 'Up to' shape the refused row wears; no start/grow pair.
+    expect(screen.getByText('Spilled Model')).toBeTruthy()
+    expect(screen.getByText('Uses system RAM')).toBeTruthy()
+    expect(screen.getAllByText('Up to 256K context').length).toBe(2)
+    expect(screen.queryByText(/Starts at/)).toBeNull()
+
+    // Its download button is disabled; the fitting model's is enabled once
+    // the runtime exists (here runtime_installed=false, so both disabled —
+    // asserted separately below).
+    const buttons = screen.getAllByRole('button', { name: /download · 17\.6 GB/i })
+    expect(buttons.every(b => (b as HTMLButtonElement).disabled)).toBe(true)
+  })
+
+  it('orders the catalog by fit: resident first, then spilled, then too-big', async () => {
+    // Scrambled input — the pane, not the backend, owns display order.
+    mocked.getLocalCatalog.mockResolvedValue({ models: [REFUSED_MODEL, SPILLED_MODEL, FITTING_MODEL] })
+    await renderFullPane()
+    await screen.findByText('Qwen3.6 27B')
+
+    // The matched element is the row-title span; the recommended row's
+    // includes its nested pill copy — strip it before comparing order.
+    const names = screen
+      .getAllByText(/^(Qwen3\.6 27B|Spilled Model|Huge Model)$/)
+      .map(el => el.textContent?.replace('Recommended', ''))
+
+    expect(names).toEqual(['Qwen3.6 27B', 'Spilled Model', 'Huge Model'])
+  })
+
+  it('never greens the full-context pill on a system-RAM model', async () => {
+    // Full native window, but earned by spilling into system RAM: the
+    // pill must not wear the green that would recommend exactly the
+    // wrong model.
+    const spilledFull: LocalCatalogModel = {
+      ...FITTING_MODEL,
+      id: 'Spilled-Full',
+      display_name: 'Spilled Full',
+      recommended: false,
+      spilled: true,
+      fit_summary: 'runs its full 256K context, partly from system RAM'
+    }
+
+    mocked.getLocalCatalog.mockResolvedValue({ models: [spilledFull] })
+    await renderFullPane()
+    await screen.findByText('Spilled Full')
+
+    expect(screen.getByText('Full 256K context').className).not.toContain('emerald')
+  })
+
+  it('explains the Recommended pick on hover', async () => {
+    // The tooltip is the resolver's own reason, and it must actually OPEN:
+    // Tip works by asChild-cloning hover handlers onto the pill, so a Pill
+    // that swallows its rest props kills the tooltip silently (the pill
+    // still renders, nothing appears on hover).
+    mocked.getLocalCatalog.mockResolvedValue({
+      models: [{ ...FITTING_MODEL, recommended_reason: 'speed-gated-quality' }]
+    })
+    await renderFullPane()
+    await screen.findByText('Qwen3.6 27B')
+
+    fireEvent.pointerMove(screen.getByText('Recommended'))
+    fireEvent.pointerEnter(screen.getByText('Recommended'))
+
+    await waitFor(() =>
+      expect(screen.getAllByText(/would respond too slowly on its memory bandwidth/).length).toBeGreaterThan(0)
+    )
+  })
+
+  it('enables downloads only once the runtime is installed', async () => {
+    mocked.getLocalModelsStatus.mockResolvedValue({
+      ...BASE_STATUS,
+      runtime_installed: true,
+      runtime_backend: 'cuda'
+    })
+    await renderFullPane()
+
+    await screen.findByText('Qwen3.6 27B')
+    const [fittingButton] = screen.getAllByRole('button', { name: /download · 17\.6 GB/i })
+    expect((fittingButton as HTMLButtonElement).disabled).toBe(false)
+  })
+
+  it('shows hardware facts after backfill', async () => {
+    await renderFullPane()
+
+    expect(await screen.findByText('NVIDIA GeForce RTX 5090')).toBeTruthy()
+    expect(screen.getByText(/32\.0 GB GPU memory/)).toBeTruthy()
+    expect(screen.getByText(/256\.0 GB RAM/)).toBeTruthy()
+  })
+
+  it('tracks a download job to completion and refreshes', async () => {
+    mocked.getLocalModelsStatus.mockResolvedValue({
+      ...BASE_STATUS,
+      runtime_installed: true,
+      runtime_backend: 'cuda'
+    })
+    mocked.downloadLocalModel.mockResolvedValue({ job_id: 'j1' })
+
+    const running: LocalRuntimeJob = {
+      job_id: 'j1',
+      kind: 'model-download',
+      target: 'Qwen3.6 27B',
+      model_id: FITTING_MODEL.id,
+      status: 'running',
+      phase: 'downloading',
+      detail: 'Qwen3.6 27B — 17.6 GB',
+      total_bytes: 100,
+      done_bytes: 40,
+      percent: 40,
+      error: null
+    }
+
+    mocked.getLocalModelsJobs
+      .mockResolvedValueOnce({ jobs: [running] })
+      .mockResolvedValue({ jobs: [{ ...running, status: 'done', phase: 'done', done_bytes: 100, percent: 100 }] })
+
+    await renderFullPane()
+    await screen.findByText('Qwen3.6 27B')
+
+    const [download] = screen.getAllByRole('button', { name: /download · 17\.6 GB/i })
+    download.click()
+
+    // The app-level watcher follows the job; when it settles the pane
+    // refreshes (status + catalog re-fetched).
+    await waitFor(() => {
+      expect(mocked.getLocalModelsJobs).toHaveBeenCalled()
+      expect(mocked.getLocalModelsStatus.mock.calls.length).toBeGreaterThanOrEqual(2)
+    })
+  })
+
+  it('renders progress for a download discovered from the store (survives pane remount)', async () => {
+    mocked.getLocalModelsStatus.mockResolvedValue({
+      ...BASE_STATUS,
+      runtime_installed: true,
+      runtime_backend: 'cuda'
+    })
+    // A running job already in the app-level store — as after closing and
+    // reopening the pane mid-download.
+    $localRuntimeJobs.set([
+      {
+        job_id: 'j9',
+        kind: 'model-download',
+        target: 'Qwen3.6 27B',
+        model_id: FITTING_MODEL.id,
+        status: 'running',
+        phase: 'downloading',
+        detail: '',
+        total_bytes: 100,
+        done_bytes: 62,
+        percent: 62,
+        error: null
+      }
+    ])
+
+    await renderFullPane()
+    await screen.findByText('Qwen3.6 27B')
+
+    // The fitting row shows byte progress; the remaining download
+    // buttons belong to the other rows (spilled + refused).
+    expect(screen.getAllByText(/0\.0 GB of 0\.0 GB|of/).length).toBeGreaterThan(0)
+    const remaining = screen.queryAllByRole('button', { name: /download · 17\.6 GB/i })
+    expect(remaining.length).toBe(2)
+    expect(remaining.some(b => (b as HTMLButtonElement).disabled)).toBe(true)
+  })
+
+  it('surfaces a failed download with the backend message', async () => {
+    mocked.getLocalModelsStatus.mockResolvedValue({
+      ...BASE_STATUS,
+      runtime_installed: true,
+      runtime_backend: 'cuda'
+    })
+    $localRuntimeJobs.set([
+      {
+        job_id: 'j2',
+        kind: 'model-download',
+        target: 'Qwen3.6 27B',
+        model_id: FITTING_MODEL.id,
+        status: 'error',
+        phase: 'verifying',
+        detail: '',
+        total_bytes: 100,
+        done_bytes: 100,
+        error: 'Downloaded file failed its integrity check and was removed — try again'
+      }
+    ])
+
+    await renderFullPane()
+    await screen.findByText('Qwen3.6 27B')
+
+    expect(await screen.findByText(/integrity check/)).toBeTruthy()
+  })
+})
+
+describe('quickstart', () => {
+  it('leads with one button on a fresh machine and fires the quickstart job', async () => {
+    mocked.quickstartLocalModels.mockResolvedValue({
+      display_name: 'Qwen3.6 27B',
+      download_bytes: FITTING_MODEL.size_bytes,
+      job_id: 'q1',
+      model_id: 'qwen3.6-27b',
+      needs_download: true,
+      needs_runtime: true
+    })
+    renderPane()
+
+    // The card names the recommended model and the one-click action; the
+    // runtime/model machinery is NOT on screen.
+    expect(await screen.findByRole('button', { name: /set up for me/i })).toBeTruthy()
+    expect(screen.queryByText('Install the local runtime')).toBeNull()
+
+    fireEvent.click(screen.getByRole('button', { name: /set up for me/i }))
+    await waitFor(() => {
+      expect(mocked.quickstartLocalModels).toHaveBeenCalled()
+    })
+  })
+
+  it('pins the quickstart progress view while the job runs', async () => {
+    $localRuntimeJobs.set([
+      {
+        job_id: 'q1',
+        kind: 'quickstart',
+        target: 'Qwen3.6 27B',
+        model_id: 'qwen3.6-27b',
+        status: 'running',
+        phase: 'downloading',
+        detail: 'Qwen3.6 27B — 17.6 GB',
+        total_bytes: 100,
+        done_bytes: 30,
+        percent: 30,
+        error: null
+      }
+    ])
+    renderPane()
+
+    expect(await screen.findByText('Qwen3.6 27B — 17.6 GB')).toBeTruthy()
+    // One job, one view: no Set up / Configure buttons while it runs.
+    expect(screen.queryByRole('button', { name: /set up for me/i })).toBeNull()
+  })
+
+  it('skips the card entirely once a model is staged', async () => {
+    mocked.getLocalModelsStatus.mockResolvedValue({
+      ...BASE_STATUS,
+      runtime_installed: true,
+      runtime_backend: 'cuda',
+      models: [{ id: 'Qwen3.6-27B-UD-Q4_K_XL', size_bytes: 17 * 2 ** 30, size_label: '17.6 GB' }]
+    })
+    renderPane()
+
+    // Straight to the full pane — no quickstart hero for a working setup.
+    expect(await screen.findByText('Qwen3.6 27B')).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /set up for me/i })).toBeNull()
+  })
+})
+
+describe('BrowseSection', () => {
+  it('searches HF after a pause and shows fit-priced files on demand', async () => {
+    vi.useFakeTimers()
+
+    try {
+      vi.mocked(hermes.searchHFModels).mockResolvedValue({
+        hits: [{ downloads: 872724, gated: false, likes: 47, repo: 'unsloth/Qwen3.8-27B-GGUF', updated: '2026-08-18' }]
+      })
+      vi.mocked(hermes.listHFRepoFiles).mockResolvedValue({
+        files: [
+          { fit: 'fits-gpu', label: 'Q4_K_M', paths: ['Qwen3.8-27B-Q4_K_M.gguf'], total_bytes: 17 * 2 ** 30 },
+          { fit: 'too-big', label: 'F16', paths: ['Qwen3.8-27B-F16.gguf'], total_bytes: 56 * 2 ** 30 }
+        ]
+      })
+
+      render(
+        <MemoryRouter>
+          <I18nProvider>
+            <LocalModelsSettings />
+          </I18nProvider>
+        </MemoryRouter>
+      )
+      await act(async () => {
+        await vi.runOnlyPendingTimersAsync()
+      })
+      // Fresh machine leads with the quickstart card — enter the full pane.
+      fireEvent.click(screen.getByRole('button', { name: /configure/i }))
+
+      const box = screen.getByPlaceholderText(/search models/i)
+      fireEvent.change(box, { target: { value: 'qwen' } })
+      // Debounce: no call until the pause elapses.
+      expect(hermes.searchHFModels).not.toHaveBeenCalled()
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(400)
+      })
+      expect(hermes.searchHFModels).toHaveBeenCalledWith('qwen')
+      expect(screen.getByText('unsloth/Qwen3.8-27B-GGUF')).toBeTruthy()
+
+      fireEvent.click(screen.getByRole('button', { name: /show files/i }))
+      await act(async () => {
+        await vi.runOnlyPendingTimersAsync()
+      })
+      expect(screen.getByText('Q4_K_M')).toBeTruthy()
+      // Each tile has an explicit download button; the too-big quant's is
+      // disabled, the fitting one is live and starts the download.
+      const q4Btn = screen.getByRole('button', { name: 'Download Q4_K_M' })
+      const f16Btn = screen.getByRole('button', { name: 'Download F16' })
+      expect((f16Btn as HTMLButtonElement).disabled).toBe(true)
+      expect((q4Btn as HTMLButtonElement).disabled).toBe(false)
+
+      vi.mocked(hermes.downloadBrowsedModel).mockResolvedValue({ job_id: 'j1', model_id: 'Qwen3.8-27B-Q4_K_M' })
+      fireEvent.click(q4Btn)
+      await act(async () => {
+        await vi.runOnlyPendingTimersAsync()
+      })
+      expect(hermes.downloadBrowsedModel).toHaveBeenCalledWith('unsloth/Qwen3.8-27B-GGUF', ['Qwen3.8-27B-Q4_K_M.gguf'])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+})
+
+describe('added-by-you rows', () => {
+  it('staged models outside the catalog get the full action set', async () => {
+    vi.mocked(hermes.getLocalModelsStatus).mockResolvedValue({
+      ...BASE_STATUS,
+      loaded_models: { 'Hermes-4.3-36B-Q5_K_M': 'loaded' },
+      models: [{ id: 'Hermes-4.3-36B-Q5_K_M', size_bytes: 25 * 2 ** 30, size_label: '25.0 GB' }],
+      placement: {
+        'Hermes-4.3-36B-Q5_K_M': {
+          granted_window_label: '96K',
+          spilled: false,
+          window: 98304,
+          window_label: '96K'
+        }
+      },
+      server_running: true
+    })
+    vi.mocked(hermes.getLocalCatalog).mockResolvedValue({ models: [] })
+
+    renderPane()
+    await screen.findByText('Hermes-4.3-36B-Q5_K_M')
+
+    // Full management surface: Use, eject, delete, live placement pill.
+    expect(screen.getByText(/added by you/i)).toBeTruthy()
+    expect(screen.getByRole('button', { name: /use/i })).toBeTruthy()
+    expect(screen.getByText(/96K/)).toBeTruthy()
+    const buttons = screen.getAllByRole('button')
+    expect(buttons.length).toBeGreaterThanOrEqual(3)
+  })
+})
+
+describe('quickstart completion navigation', () => {
+  it('lands on a new chat when a quickstart it watched finishes; stale done jobs on mount never navigate', async () => {
+    const routeProbe = vi.fn()
+
+    function Probe() {
+      const loc = useLocation()
+      routeProbe(loc.pathname)
+
+      return null
+    }
+
+    const doneJob: LocalRuntimeJob = {
+      done_bytes: 0,
+      detail: '',
+      error: null,
+      job_id: 'stale-done',
+      kind: 'quickstart',
+      model_id: 'qwen3.8-27b',
+      phase: 'done',
+      status: 'done',
+      target: 'Qwen3.8 27B',
+      total_bytes: null
+    }
+
+    // A finished quickstart already in history when the pane mounts —
+    // must NOT trigger navigation.
+    $localRuntimeJobs.set([doneJob])
+
+    render(
+      <MemoryRouter initialEntries={['/settings']}>
+        <I18nProvider>
+          <LocalModelsSettings />
+        </I18nProvider>
+        <Probe />
+      </MemoryRouter>
+    )
+    await act(async () => {})
+    expect(routeProbe).not.toHaveBeenCalledWith('/')
+
+    // A quickstart the pane SAW running that then completes -> navigate.
+    const running: LocalRuntimeJob = { ...doneJob, job_id: 'live-run', phase: 'downloading', status: 'running' }
+    await act(async () => {
+      $localRuntimeJobs.set([doneJob, running])
+    })
+    await act(async () => {
+      $localRuntimeJobs.set([doneJob, { ...running, phase: 'done', status: 'done' }])
+    })
+    expect(routeProbe).toHaveBeenCalledWith('/')
+  })
+})
diff --git a/apps/desktop/src/app/settings/local-models-settings.tsx b/apps/desktop/src/app/settings/local-models-settings.tsx
new file mode 100644
index 0000000000..f845bfeacd
--- /dev/null
+++ b/apps/desktop/src/app/settings/local-models-settings.tsx
@@ -0,0 +1,1106 @@
+import { useStore } from '@nanostores/react'
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { useNavigate } from 'react-router'
+
+import { NEW_CHAT_ROUTE } from '@/app/routes'
+import { Button } from '@/components/ui/button'
+import { Tip } from '@/components/ui/tooltip'
+import {
+  activateLocalModel,
+  deleteLocalModel,
+  downloadBrowsedModel,
+  downloadLocalModel,
+  ejectLocalModel,
+  getLocalCatalog,
+  getLocalHardware,
+  getLocalModelsStatus,
+  type HFFileGroup,
+  type HFSearchHit,
+  installLocalRuntime,
+  listHFRepoFiles,
+  quickstartLocalModels,
+  searchHFModels,
+  setLocalServer,
+  sideloadLocalModel
+} from '@/hermes'
+import { useI18n } from '@/i18n'
+import {
+  Check,
+  CheckCircle2,
+  Cpu,
+  Download,
+  Eject,
+  FolderOpen,
+  Loader2,
+  Monitor,
+  Package,
+  Search,
+  StopFilled,
+  Trash2,
+  Zap
+} from '@/lib/icons'
+import { cn } from '@/lib/utils'
+import {
+  $localRuntimeJobs,
+  runningDownloadFor,
+  runningRuntimeInstall,
+  watchLocalRuntimeJobs
+} from '@/store/local-runtime-jobs'
+import { notify, notifyError } from '@/store/notifications'
+import type { LocalCatalogModel, LocalHardware, LocalModelsStatus } from '@/types/hermes'
+
+import { ListRow, Pill, SettingsContent, SettingsSection, SettingsSkeleton } from './primitives'
+
+function ProgressBar({ percent }: { percent: number | undefined }) {
+  return (
+    <div className="h-1.5 w-full overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+      <div
+        className="h-full rounded-full bg-primary transition-[width] duration-300"
+        style={{ width: `${Math.max(2, Math.min(100, percent ?? 2))}%` }}
+      />
+    </div>
+  )
+}
+
+function gbLabel(bytes: number | null | undefined): string {
+  if (!bytes) {
+    return '—'
+  }
+
+  return `${(bytes / (1 << 30)).toFixed(1)} GB`
+}
+
+// Catalog display order: what runs well leads. Resident (all on GPU)
+// first, then spilled (works, slower), then doesn't-fit; catalog order
+// (recommended first) holds within each band.
+function fitRank(model: LocalCatalogModel): number {
+  if (model.fits && !model.spilled) {
+    return 0
+  }
+
+  if (model.fits) {
+    return 1
+  }
+
+  return 2
+}
+
+export function LocalModelsSettings() {
+  const { t } = useI18n()
+  const copy = t.settings.localModels
+  const [status, setStatus] = useState<LocalModelsStatus | null>(null)
+  const [hardware, setHardware] = useState<LocalHardware | null>(null)
+  const [catalog, setCatalog] = useState<LocalCatalogModel[] | null>(null)
+  const [deleting, setDeleting] = useState<null | string>(null)
+  const [serverBusy, setServerBusy] = useState(false)
+  // Quickstart escape hatch: true once the user asks for the full pane
+  // (model list, HF browser) instead of the one-button setup card.
+  const [configure, setConfigure] = useState(false)
+  // Jobs live in the app-level store (they must survive this pane
+  // unmounting); the pane just renders the slice it cares about.
+  const jobs = useStore($localRuntimeJobs)
+
+  const refresh = useCallback(() => {
+    void getLocalModelsStatus()
+      .then(setStatus)
+      .catch(() => setStatus(null))
+    void getLocalCatalog()
+      .then(data => setCatalog(data.models))
+      .catch(() => setCatalog([]))
+  }, [])
+
+  // Snappy first paint: status + catalog immediately; hardware (may shell out
+  // to nvidia-smi) backfills and pops in-place. The job watcher also kicks
+  // here so reopening the pane rediscovers work started before.
+  useEffect(() => {
+    refresh()
+    watchLocalRuntimeJobs()
+    void getLocalHardware()
+      .then(setHardware)
+      .catch(() => setHardware(null))
+  }, [refresh])
+
+  // The pane is LIVE while visible: residency changes without user action
+  // (boot warm finishing, idle sweep unloading, another surface ejecting),
+  // and a stale snapshot here reads as a broken feature — 'VRAM full but
+  // the pane says Not in memory'. The status route is built cheap for
+  // polling; setTimeout chain, never overlapping.
+  useEffect(() => {
+    let cancelled = false
+    let timer: number | undefined
+
+    const tick = async () => {
+      try {
+        const next = await getLocalModelsStatus()
+
+        if (!cancelled) {
+          setStatus(next)
+        }
+      } catch {
+        // Backend briefly unreachable — keep the last snapshot.
+      }
+
+      if (!cancelled) {
+        timer = window.setTimeout(() => void tick(), 4_000)
+      }
+    }
+
+    timer = window.setTimeout(() => void tick(), 4_000)
+
+    return () => {
+      cancelled = true
+
+      if (timer !== undefined) {
+        window.clearTimeout(timer)
+      }
+    }
+  }, [])
+
+  // A job finishing (download done, install done) changes what status/catalog
+  // should show — refresh whenever the running set shrinks.
+  const runningCount = jobs.filter(j => j.status === 'running').length
+  useEffect(() => {
+    refresh()
+  }, [refresh, runningCount])
+
+  async function handleInstallRuntime() {
+    try {
+      await installLocalRuntime()
+      watchLocalRuntimeJobs()
+    } catch (err) {
+      notifyError(err, copy.installFailed)
+    }
+  }
+
+  async function handleQuickstart() {
+    try {
+      await quickstartLocalModels()
+      watchLocalRuntimeJobs()
+    } catch (err) {
+      notifyError(err, copy.quickstartFailed)
+    }
+  }
+
+  async function handleDownload(model: LocalCatalogModel) {
+    try {
+      const res = await downloadLocalModel(model.id)
+
+      if (res.already_downloaded || !res.job_id) {
+        refresh()
+
+        return
+      }
+
+      watchLocalRuntimeJobs()
+    } catch (err) {
+      notifyError(err, copy.downloadFailed(model.display_name))
+    }
+  }
+
+  async function handleActivate(target: null | string, displayName: string) {
+    if (!target) {
+      return
+    }
+
+    try {
+      await activateLocalModel(target)
+      watchLocalRuntimeJobs()
+    } catch (err) {
+      notifyError(err, copy.activateFailed(displayName))
+    }
+  }
+
+  async function handleEject(modelId: string) {
+    try {
+      await ejectLocalModel(modelId)
+      notify({ durationMs: 3_000, kind: 'success', message: copy.ejected, title: copy.title })
+      refresh()
+    } catch (err) {
+      notifyError(err, copy.ejectFailed)
+    }
+  }
+
+  async function handleServer(action: 'start' | 'stop') {
+    setServerBusy(true)
+
+    try {
+      await setLocalServer(action)
+      notify({
+        durationMs: 3_500,
+        kind: 'success',
+        message: action === 'stop' ? copy.serverStopped : copy.serverStarted,
+        title: copy.title
+      })
+      refresh()
+    } catch (err) {
+      notifyError(err, action === 'stop' ? copy.serverStopFailed : copy.serverStartFailed)
+    } finally {
+      setServerBusy(false)
+    }
+  }
+
+  async function handleDelete(target: string, rowId: string) {
+    if (!window.confirm(copy.deleteConfirm(target))) {
+      return
+    }
+
+    setDeleting(rowId)
+
+    try {
+      await deleteLocalModel(target)
+      notify({ durationMs: 2_500, kind: 'success', message: copy.deleted(target), title: copy.title })
+      refresh()
+    } catch (err) {
+      notifyError(err, copy.deleteFailed)
+    } finally {
+      setDeleting(null)
+    }
+  }
+
+  // Setup flows end at the action, not the settings pane: when quickstart
+  // finishes while the user is still HERE watching it, land them on a new
+  // chat with the model ready to try. Unmount cancels the intent — a user
+  // who navigated away mid-download keeps their place (no focus theft).
+  // (Lives above the loading return: hooks run unconditionally.)
+  const navigate = useNavigate()
+  const seenQuickstarts = useRef(new Set<string>())
+
+  const runningQuickstart = jobs.find(j => j.kind === 'quickstart' && j.status === 'running')
+
+  useEffect(() => {
+    // Event detection, not value mirroring: the ref only remembers which
+    // job ids THIS mount saw running, so a 'done' already in the list on
+    // mount (stale history) never triggers a navigation.
+    const seen = seenQuickstarts.current
+
+    for (const j of jobs) {
+      if (j.kind !== 'quickstart') {
+        continue
+      }
+
+      if (j.status === 'running') {
+        seen.add(j.job_id)
+      } else if (j.status === 'done' && seen.has(j.job_id)) {
+        seen.delete(j.job_id)
+        navigate(NEW_CHAT_ROUTE)
+      }
+    }
+  }, [jobs, navigate])
+
+  if (!status || catalog === null) {
+    return <SettingsSkeleton sections={[{ rows: 2 }, { rows: 4 }]} />
+  }
+
+  const rJob = runningRuntimeInstall(jobs)
+  const lastError = jobs.find(j => j.status === 'error')
+
+  const sortedCatalog = [...catalog].sort((a, b) => fitRank(a) - fitRank(b))
+
+  // ── Quickstart: the dummy-proof front door ──
+  // Until something is servable (runtime + at least one model), the pane
+  // leads with a hero that does everything in one click; the full pane
+  // stays one 'Configure…' click away. A running quickstart pins this
+  // view so its progress has a home even after a remount.
+  const qJob = runningQuickstart ?? null
+
+  const needsSetup = !status.runtime_installed || status.models.length === 0
+  const heroModel = catalog.find(c => c.recommended && c.fits) ?? catalog.find(c => c.fits) ?? null
+
+  if (qJob || (needsSetup && !configure && heroModel)) {
+    // Stage rail derived from the job phase: engine -> model -> finish.
+    const phase = qJob?.phase ?? ''
+
+    const stageIndex = ['starting-server', 'setting-default'].includes(phase) ? 2 : phase === 'downloading' ? 1 : 0
+
+    const stages = [copy.quickstartStageEngine, copy.quickstartStageModel, copy.quickstartStageFinish]
+
+    // The model-download leg blanks job.detail on purpose (pane rows
+    // render their own byte counter) — compose one here instead of
+    // falling back to runtime copy that would misname the stage.
+    const liveDetail =
+      qJob &&
+      (qJob.detail ||
+        (qJob.total_bytes
+          ? copy.downloadProgress(gbLabel(qJob.done_bytes), gbLabel(qJob.total_bytes))
+          : copy.installing))
+
+    return (
+      <SettingsContent>
+        <div className="flex min-h-[60dvh] items-center justify-center">
+          <div className="w-full max-w-md text-center">
+            <div className="mx-auto mb-5 flex size-14 items-center justify-center rounded-2xl bg-primary/10">
+              {qJob ? (
+                <Loader2 className="size-7 animate-spin text-primary" />
+              ) : (
+                <Cpu className="size-7 text-primary" />
+              )}
+            </div>
+
+            <h2 className="text-lg font-semibold text-foreground">
+              {qJob ? qJob.target : (heroModel?.display_name ?? '')}
+            </h2>
+
+            {qJob ? (
+              <>
+                <p className="mt-2 min-h-10 text-[0.8rem] leading-5 text-muted-foreground">{liveDetail}</p>
+
+                <div className="mt-5">
+                  <ProgressBar percent={qJob.percent} />
+                </div>
+
+                {/* Stage rail: engine -> model -> finish. */}
+                <div className="mt-5 flex items-center justify-center gap-5">
+                  {stages.map((label, i) => (
+                    <span
+                      className={cn(
+                        'inline-flex items-center gap-1.5 text-[0.72rem]',
+                        i < stageIndex && 'text-(--ui-text-tertiary)',
+                        i === stageIndex && 'font-medium text-foreground',
+                        i > stageIndex && 'text-(--ui-text-tertiary) opacity-60'
+                      )}
+                      key={label}
+                    >
+                      {i < stageIndex ? (
+                        <CheckCircle2 className="size-3.5 text-primary" />
+                      ) : i === stageIndex ? (
+                        <Loader2 className="size-3.5 animate-spin" />
+                      ) : (
+                        <span className="size-1.5 rounded-full bg-current" />
+                      )}
+                      {label}
+                    </span>
+                  ))}
+                </div>
+              </>
+            ) : heroModel ? (
+              <>
+                <p className="mt-2 text-[0.8rem] leading-5 text-muted-foreground">
+                  {heroModel.downloaded
+                    ? copy.quickstartDetailReady(heroModel.display_name)
+                    : copy.quickstartDetail(heroModel.display_name, heroModel.size_label)}
+                </p>
+
+                <div className="mt-6 flex items-center justify-center gap-3">
+                  <Button onClick={() => setConfigure(true)} size="sm" variant="outline">
+                    {copy.quickstartConfigure}
+                  </Button>
+                  <Button onClick={() => void handleQuickstart()} size="default">
+                    <Zap />
+                    {copy.quickstartAction}
+                  </Button>
+                </div>
+              </>
+            ) : null}
+
+            {lastError?.kind === 'quickstart' && !qJob && (
+              <p className="mt-4 text-[0.75rem] text-destructive">{lastError.error}</p>
+            )}
+          </div>
+        </div>
+      </SettingsContent>
+    )
+  }
+
+  // Up to date = the authority (status) says the configured tag is what's
+  // serving. Shown whenever true — not only right after an update.
+  const updateApplied = status.runtime_installed && !status.update_available && status.tag === status.configured_tag
+
+  return (
+    <SettingsContent>
+      {/* ── Runtime ── */}
+      <SettingsSection
+        aside={
+          status.runtime_installed ? (
+            <Pill tone="primary">
+              {status.server_running ? copy.serverRunning : copy.runtimeReady(status.runtime_backend ?? '')}
+            </Pill>
+          ) : undefined
+        }
+        icon={Zap}
+        meta={status.tag}
+        title={copy.runtimeTitle}
+      >
+        {status.runtime_installed ? (
+          <ListRow
+            action={
+              status.server_running ? (
+                <Button
+                  className={cn(serverBusy && '[&_svg]:animate-spin')}
+                  disabled={serverBusy}
+                  onClick={() => void handleServer('stop')}
+                  size="sm"
+                  variant="outline"
+                >
+                  {serverBusy ? <Loader2 /> : <StopFilled />}
+                  {copy.stopServer}
+                </Button>
+              ) : (
+                <Button
+                  className={cn(serverBusy && '[&_svg]:animate-spin')}
+                  disabled={serverBusy}
+                  onClick={() => void handleServer('start')}
+                  size="sm"
+                  variant="outline"
+                >
+                  {serverBusy ? <Loader2 /> : <Zap />}
+                  {copy.startServer}
+                </Button>
+              )
+            }
+            description={
+              status.server_running
+                ? copy.runtimeRunningDetail
+                : copy.runtimeInstalledDetail(status.tag, status.runtime_backend ?? 'cpu')
+            }
+            title={copy.runtimeInstalled}
+          />
+        ) : rJob ? (
+          <ListRow
+            below={<ProgressBar percent={rJob.percent} />}
+            description={rJob.detail || copy.installing}
+            title={
+              <span className="inline-flex items-center gap-2">
+                <Loader2 className="size-3.5 animate-spin" />
+                {copy.installing}
+              </span>
+            }
+          />
+        ) : (
+          <ListRow
+            action={
+              <Button onClick={() => void handleInstallRuntime()} size="sm">
+                <Download />
+                {copy.installAction}
+              </Button>
+            }
+            description={copy.installDetail}
+            title={copy.installTitle}
+          />
+        )}
+
+        {status.update_available && !rJob && (
+          <ListRow
+            action={
+              <Button onClick={() => void handleInstallRuntime()} size="sm">
+                <Download />
+                {copy.updateAction}
+              </Button>
+            }
+            description={copy.updateDetail(status.configured_tag, status.tag)}
+            title={copy.updateTitle}
+          />
+        )}
+
+        {rJob && status.runtime_installed && (
+          <ListRow
+            below={<ProgressBar percent={rJob.percent} />}
+            description={rJob.detail || copy.updating}
+            title={
+              <span className="inline-flex items-center gap-2">
+                <Loader2 className="size-3.5 animate-spin" />
+                {copy.updating}
+              </span>
+            }
+          />
+        )}
+
+        {updateApplied && (
+          <ListRow
+            description={copy.upToDateDetail(status.tag, status.runtime_backend ?? 'cpu')}
+            title={
+              <span className="inline-flex items-center gap-2">
+                <CheckCircle2 className="size-4 text-emerald-600 dark:text-emerald-400" />
+                {copy.upToDateTitle}
+              </span>
+            }
+          />
+        )}
+
+        {lastError?.kind === 'runtime-install' && <p className="text-[0.75rem] text-destructive">{lastError.error}</p>}
+      </SettingsSection>
+
+      {/* ── This machine ── */}
+      <SettingsSection icon={Monitor} title={copy.hardwareTitle}>
+        {hardware ? (
+          <div className="flex flex-wrap items-center gap-x-5 gap-y-1 py-1 text-[length:var(--conversation-caption-font-size)] text-muted-foreground">
+            {hardware.gpu_name && (
+              <span className="inline-flex items-center gap-1.5">
+                <Zap className="size-3.5" />
+                {hardware.gpu_name}
+              </span>
+            )}
+
+            <span className="inline-flex items-center gap-1.5">
+              <Cpu className="size-3.5" />
+              {copy.vram(gbLabel(hardware.vram_total_bytes))}
+            </span>
+
+            <span className="inline-flex items-center gap-1.5">
+              <Package className="size-3.5" />
+              {copy.ram(gbLabel(hardware.ram_total_bytes))}
+            </span>
+
+            {hardware.uma && <Pill>{copy.unifiedMemory}</Pill>}
+          </div>
+        ) : (
+          <p className="py-1 text-[length:var(--conversation-caption-font-size)] text-muted-foreground">
+            {copy.hardwareLoading}
+          </p>
+        )}
+      </SettingsSection>
+
+      {/* ── Models ── */}
+      <SettingsSection icon={Download} meta={`${catalog.length}`} title={copy.modelsTitle}>
+        <div className="grid gap-1">
+          {sortedCatalog.map(model => {
+            const dJob = runningDownloadFor(jobs, model.id)
+            const anyDownloadRunning = jobs.some(j => j.kind === 'model-download' && j.status === 'running')
+            const activateTarget = model.downloaded_model_id ?? model.model_id
+            const isActive = Boolean(activateTarget && status.active_model_id === activateTarget)
+            const residency = activateTarget ? status.loaded_models[activateTarget] : undefined
+            const isLoaded = residency === 'loaded' || residency === 'ready'
+            const isLoadingNow = residency === 'loading'
+            const livePlacement = activateTarget ? status.placement?.[activateTarget] : undefined
+
+            const aJob = jobs.find(
+              j => j.kind === 'model-activate' && j.status === 'running' && j.model_id === activateTarget
+            )
+
+            const anyActivateRunning = jobs.some(j => j.kind === 'model-activate' && j.status === 'running')
+
+            return (
+              <ListRow
+                action={
+                  model.downloaded ? (
+                    <div className="flex items-center justify-end gap-2">
+                      {isLoaded && livePlacement && (
+                        <Tip label={livePlacement.spilled ? copy.placementSpilledTip : copy.placementResidentTip}>
+                          <Pill tone={livePlacement.spilled ? 'warn' : 'success'}>
+                            <Cpu className="mr-1 size-3" />
+                            {livePlacement.granted_window_label ?? livePlacement.window_label ?? ''}
+                            {' · '}
+                            {livePlacement.spilled ? copy.placementSpilled : copy.placementResident}
+                          </Pill>
+                        </Tip>
+                      )}
+                      {isLoaded && !livePlacement && <Pill>{copy.loadedPill}</Pill>}
+
+                      {isLoadingNow && (
+                        <Pill>
+                          <Loader2 className="mr-1 size-3 animate-spin" />
+                          {copy.loadingPill}
+                        </Pill>
+                      )}
+
+                      {isActive ? (
+                        <Tip label={copy.activeDetail}>
+                          <Pill tone="primary">
+                            <Check className="mr-1 size-3" />
+                            {copy.activePill}
+                          </Pill>
+                        </Tip>
+                      ) : (
+                        <Button
+                          className={cn(aJob && '[&_svg]:animate-spin')}
+                          disabled={anyActivateRunning}
+                          onClick={() => void handleActivate(activateTarget ?? null, model.display_name)}
+                          size="sm"
+                        >
+                          {aJob ? <Loader2 /> : <Check />}
+                          {aJob ? copy.activating : copy.useAction}
+                        </Button>
+                      )}
+
+                      {isLoaded && (
+                        <Tip label={copy.ejectTip}>
+                          <Button
+                            onClick={() => void handleEject(activateTarget ?? model.id)}
+                            size="icon"
+                            variant="ghost"
+                          >
+                            <Eject />
+                          </Button>
+                        </Tip>
+                      )}
+
+                      <Tip label={copy.deleteAction}>
+                        <Button
+                          className={cn(deleting === model.id && '[&_svg]:animate-spin')}
+                          onClick={() => void handleDelete(model.downloaded_model_id ?? model.id, model.id)}
+                          size="icon"
+                          variant="ghost"
+                        >
+                          {deleting === model.id ? <Loader2 /> : <Trash2 />}
+                        </Button>
+                      </Tip>
+                    </div>
+                  ) : dJob ? undefined : (
+                    <Button
+                      disabled={!model.fits || anyDownloadRunning || !status.runtime_installed}
+                      onClick={() => void handleDownload(model)}
+                      size="sm"
+                      variant="outline"
+                    >
+                      <Download />
+                      {copy.downloadAction(model.size_label)}
+                    </Button>
+                  )
+                }
+                below={
+                  dJob ? (
+                    <div className="mt-2 grid gap-1">
+                      <ProgressBar percent={dJob.percent} />
+
+                      <p className="text-[0.68rem] text-muted-foreground">
+                        {!dJob.done_bytes && dJob.detail
+                          ? dJob.detail
+                          : copy.downloadProgress(gbLabel(dJob.done_bytes), gbLabel(dJob.total_bytes))}
+                      </p>
+                    </div>
+                  ) : undefined
+                }
+                description={
+                  <>
+                    {model.description}
+
+                    <span className="mt-1.5 flex flex-wrap items-center gap-1.5">
+                      {/* Memory: the traffic light. Green = runs fully on
+                          the GPU; amber = spills to system RAM (works,
+                          slower); red = doesn't fit this machine at all.
+                          Detail prose lives in the tooltip. */}
+                      {!model.fits ? (
+                        <Tip label={model.fit_detail ?? model.fit_summary}>
+                          <Pill tone="destructive">
+                            <Cpu className="mr-1 size-3" />
+                            {copy.pillTooBig}
+                          </Pill>
+                        </Tip>
+                      ) : model.spilled ? (
+                        <Tip label={model.quant_reason ?? model.fit_summary}>
+                          <Pill tone="warn">
+                            <Cpu className="mr-1 size-3" />
+                            {copy.pillUsesRam}
+                          </Pill>
+                        </Tip>
+                      ) : (
+                        <Tip label={model.quant_reason ?? model.fit_summary}>
+                          <Pill tone="success">
+                            <Cpu className="mr-1 size-3" />
+                            {copy.pillFitsGpu}
+                          </Pill>
+                        </Tip>
+                      )}
+
+                      {/* Context: one pill. Green 'Full X context' only when
+                          the model earned its complete window resident on the
+                          GPU — a big context served from system RAM is slow,
+                          and a green badge there would sell exactly the wrong
+                          model, so a spilled full window goes gray. Anything
+                          starting below its native window gets one quiet
+                          'Up to' pill instead of a start/grow pair. */}
+                      {model.fits &&
+                        model.start_window_label &&
+                        (model.start_window && model.start_window >= model.native_context ? (
+                          <Tip label={copy.pillFullContextTip}>
+                            <Pill tone={model.spilled ? 'muted' : 'success'}>
+                              {copy.pillFullContext(model.native_context_label)}
+                            </Pill>
+                          </Tip>
+                        ) : (
+                          <Tip label={copy.pillGrowsTip}>
+                            <Pill>{copy.pillUpTo(model.native_context_label)}</Pill>
+                          </Tip>
+                        ))}
+
+                      {!model.fits && <Pill>{copy.pillUpTo(model.native_context_label)}</Pill>}
+
+                      {model.vision && <Pill>{copy.pillVision}</Pill>}
+                    </span>
+
+                    {isActive && !isLoaded && !isLoadingNow && status.server_running && (
+                      <span className="mt-0.5 block text-(--ui-text-tertiary)">{copy.activeNotLoaded}</span>
+                    )}
+                  </>
+                }
+                key={model.id}
+                title={
+                  <span className="inline-flex items-center gap-2">
+                    {model.display_name}
+
+                    {model.recommended &&
+                      (model.recommended_reason ? (
+                        // The why, straight from the resolver: the tooltip is
+                        // the branch that picked this model, so the shown
+                        // rationale can never drift from the actual decision.
+                        <Tip label={copy.recommendedReason[model.recommended_reason]}>
+                          <Pill tone="primary">{copy.recommended}</Pill>
+                        </Tip>
+                      ) : (
+                        <Pill tone="primary">{copy.recommended}</Pill>
+                      ))}
+                  </span>
+                }
+              />
+            )
+          })}
+
+          {status.models
+            .filter(m => !catalog.some(c => c.downloaded_model_id === m.id || c.model_id === m.id))
+            .map(m => {
+              const isActive = status.active_model_id === m.id
+              const residency = status.loaded_models[m.id]
+              const isLoaded = residency === 'loaded' || residency === 'ready'
+              const isLoadingNow = residency === 'loading'
+              const livePlacement = status.placement?.[m.id]
+
+              const aJob = jobs.find(j => j.kind === 'model-activate' && j.status === 'running' && j.model_id === m.id)
+
+              const anyActivateRunning = jobs.some(j => j.kind === 'model-activate' && j.status === 'running')
+
+              return (
+                <ListRow
+                  action={
+                    <div className="flex items-center justify-end gap-2">
+                      {isLoaded && livePlacement && (
+                        <Tip label={livePlacement.spilled ? copy.placementSpilledTip : copy.placementResidentTip}>
+                          <Pill tone={livePlacement.spilled ? 'warn' : 'success'}>
+                            <Cpu className="mr-1 size-3" />
+                            {livePlacement.granted_window_label ?? livePlacement.window_label ?? ''}
+                            {' · '}
+                            {livePlacement.spilled ? copy.placementSpilled : copy.placementResident}
+                          </Pill>
+                        </Tip>
+                      )}
+                      {isLoaded && !livePlacement && <Pill>{copy.loadedPill}</Pill>}
+
+                      {isLoadingNow && (
+                        <Pill>
+                          <Loader2 className="mr-1 size-3 animate-spin" />
+                          {copy.loadingPill}
+                        </Pill>
+                      )}
+
+                      {isActive ? (
+                        <Pill tone="primary">
+                          <CheckCircle2 className="mr-1 size-3" />
+                          {copy.activePill}
+                        </Pill>
+                      ) : (
+                        <Button
+                          className={cn(aJob && '[&_svg]:animate-spin')}
+                          disabled={anyActivateRunning}
+                          onClick={() => void handleActivate(m.id, m.id)}
+                          size="sm"
+                        >
+                          {aJob ? <Loader2 /> : <Check />}
+                          {copy.useAction}
+                        </Button>
+                      )}
+
+                      {isLoaded && (
+                        <Tip label={copy.ejectTip}>
+                          <Button onClick={() => void handleEject(m.id)} size="icon" variant="ghost">
+                            <Eject />
+                          </Button>
+                        </Tip>
+                      )}
+
+                      <Tip label={copy.deleteAction}>
+                        <Button
+                          className={cn(deleting === m.id && '[&_svg]:animate-spin')}
+                          onClick={() => void handleDelete(m.id, m.id)}
+                          size="icon"
+                          variant="ghost"
+                        >
+                          {deleting === m.id ? <Loader2 /> : <Trash2 />}
+                        </Button>
+                      </Tip>
+                    </div>
+                  }
+                  description={<span>{copy.addedByYou}</span>}
+                  key={m.id}
+                  title={
+                    <span className="inline-flex items-center gap-2">
+                      <span className="truncate font-mono text-[0.8rem]">{m.id}</span>
+
+                      <span className="text-[0.68rem] font-normal text-muted-foreground">{m.size_label}</span>
+                    </span>
+                  }
+                />
+              )
+            })}
+        </div>
+
+        {lastError?.kind === 'model-download' && <p className="text-[0.75rem] text-destructive">{lastError.error}</p>}
+      </SettingsSection>
+
+      <BrowseSection onChanged={refresh} />
+    </SettingsContent>
+  )
+}
+
+function fitTone(fit: HFFileGroup['fit']): 'destructive' | 'muted' | 'success' | 'warn' {
+  if (fit === 'fits-gpu') {
+    return 'success'
+  }
+
+  if (fit === 'needs-ram') {
+    return 'warn'
+  }
+
+  if (fit === 'too-big') {
+    return 'destructive'
+  }
+
+  return 'muted'
+}
+
+function browsedModelId(group: HFFileGroup): string {
+  // Mirrors the backend's derivation: first file's name, split-part
+  // suffix stripped — the id the download job carries.
+  const first = group.paths[0].split('/').pop() ?? group.paths[0]
+
+  return first.replace(/-\d{5}-of-\d{5}\.gguf$/i, '').replace(/\.gguf$/i, '')
+}
+
+function BrowseSection({ onChanged }: { onChanged: () => void }) {
+  const { t } = useI18n()
+  const copy = t.settings.localModels
+  const jobs = useStore($localRuntimeJobs)
+  const [query, setQuery] = useState('')
+  const [hits, setHits] = useState<HFSearchHit[]>([])
+  const [searching, setSearching] = useState(false)
+  const [openRepo, setOpenRepo] = useState<null | string>(null)
+  const [files, setFiles] = useState<HFFileGroup[]>([])
+  const [listing, setListing] = useState(false)
+  const [error, setError] = useState<null | string>(null)
+  // Guard against the past: a stale search result must never overwrite a
+  // newer query's hits (the desktop guide's out-of-order rule).
+  const searchSeq = useRef(0)
+
+  useEffect(() => {
+    const q = query.trim()
+
+    if (q.length < 2) {
+      setHits([])
+      setSearching(false)
+
+      return
+    }
+
+    const seq = ++searchSeq.current
+    setSearching(true)
+
+    const handle = setTimeout(() => {
+      searchHFModels(q)
+        .then(r => {
+          if (searchSeq.current === seq) {
+            setHits(r.hits)
+            setError(null)
+          }
+        })
+        .catch((e: Error) => {
+          if (searchSeq.current === seq) {
+            setError(e.message)
+          }
+        })
+        .finally(() => {
+          if (searchSeq.current === seq) {
+            setSearching(false)
+          }
+        })
+    }, 350)
+
+    return () => clearTimeout(handle)
+  }, [query])
+
+  const openFiles = useCallback((repo: string) => {
+    setOpenRepo(repo)
+    setFiles([])
+    setListing(true)
+    listHFRepoFiles(repo)
+      .then(r => setFiles(r.files))
+      .catch((e: Error) => setError(e.message))
+      .finally(() => setListing(false))
+  }, [])
+
+  const startBrowsedDownload = useCallback(
+    (repo: string, group: HFFileGroup) => {
+      downloadBrowsedModel(repo, group.paths)
+        .then(r => {
+          if (r.already_downloaded) {
+            notify({ durationMs: 3_000, kind: 'info', message: copy.browseAlreadyDownloaded, title: copy.browseTitle })
+
+            return
+          }
+
+          // Same feedback loop as catalog downloads: the job store polls
+          // and the tile renders live progress from it.
+          watchLocalRuntimeJobs()
+          notify({
+            durationMs: 3_000,
+            kind: 'info',
+            message: copy.browseDownloadStarted.replace('{name}', r.model_id),
+            title: copy.browseTitle
+          })
+          onChanged()
+        })
+        .catch((e: Error) => notifyError(e, copy.browseTitle))
+    },
+    [copy.browseAlreadyDownloaded, copy.browseDownloadStarted, copy.browseTitle, onChanged]
+  )
+
+  const sideload = useCallback(() => {
+    window.hermesDesktop
+      .selectPaths({ filters: [{ extensions: ['gguf'], name: 'GGUF models' }], title: copy.sideloadTitle })
+      .then(paths => {
+        if (!paths.length) {
+          return
+        }
+
+        return sideloadLocalModel(paths[0]).then(r => {
+          notify({
+            durationMs: 3_000,
+            kind: 'success',
+            message: r.already_present ? copy.sideloadAlreadyPresent : copy.sideloadDone.replace('{name}', r.model_id),
+            title: copy.browseTitle
+          })
+          onChanged()
+        })
+      })
+      .catch((e: Error) => notifyError(e, copy.browseTitle))
+  }, [copy.browseTitle, copy.sideloadAlreadyPresent, copy.sideloadDone, copy.sideloadTitle, onChanged])
+
+  return (
+    <SettingsSection
+      aside={
+        <Button onClick={sideload} size="sm" variant="outline">
+          <FolderOpen className="mr-1 size-3.5" />
+          {copy.sideloadButton}
+        </Button>
+      }
+      icon={Search}
+      title={copy.browseTitle}
+    >
+      <p className="text-[0.75rem] text-muted-foreground">{copy.browseHint}</p>
+
+      <div className="relative">
+        <Search className="pointer-events-none absolute left-2.5 top-1/2 size-3.5 -translate-y-1/2 text-muted-foreground" />
+        <input
+          className="w-full rounded-md border border-(--ui-border) bg-transparent py-1.5 pl-8 pr-3 text-[0.8rem] outline-none placeholder:text-muted-foreground focus:border-primary"
+          onChange={e => setQuery(e.target.value)}
+          placeholder={copy.browsePlaceholder}
+          value={query}
+        />
+      </div>
+
+      {searching && (
+        <p className="flex items-center gap-2 text-[0.75rem] text-muted-foreground">
+          <Loader2 className="size-3 animate-spin" />
+          {copy.browseSearching}
+        </p>
+      )}
+
+      {error && <p className="text-[0.75rem] text-destructive">{error}</p>}
+
+      <div className="grid gap-1">
+        {hits.map(hit => (
+          <div key={hit.repo}>
+            <ListRow
+              action={
+                <Button onClick={() => openFiles(hit.repo)} size="sm" variant="ghost">
+                  {openRepo === hit.repo ? copy.browseRefresh : copy.browseShowFiles}
+                </Button>
+              }
+              description={
+                <span>
+                  {Intl.NumberFormat().format(hit.downloads)} {copy.browseDownloads}
+                  {' · '}
+                  {Intl.NumberFormat().format(hit.likes)} {copy.browseLikes}
+                  {hit.gated ? ` · ${copy.browseGated}` : ''}
+                </span>
+              }
+              title={<span className="font-mono text-[0.8rem]">{hit.repo}</span>}
+            />
+
+            {openRepo === hit.repo && (
+              <div className="ml-4 grid grid-cols-[repeat(auto-fill,minmax(11rem,1fr))] gap-1.5 border-l border-(--ui-border) py-1 pl-3">
+                {listing && (
+                  <p className="col-span-full flex items-center gap-2 py-1 text-[0.75rem] text-muted-foreground">
+                    <Loader2 className="size-3 animate-spin" />
+                    {copy.browseListing}
+                  </p>
+                )}
+
+                {!listing && files.length === 0 && (
+                  <p className="col-span-full py-1 text-[0.75rem] text-muted-foreground">{copy.browseNoGguf}</p>
+                )}
+
+                {files.map(group => {
+                  const dJob = runningDownloadFor(jobs, browsedModelId(group))
+
+                  return (
+                    <div
+                      className={cn(
+                        'flex flex-col gap-1 rounded-md border border-(--ui-border) px-2.5 py-1.5',
+                        group.fit === 'too-big' && 'opacity-45'
+                      )}
+                      key={group.label}
+                    >
+                      <span className="flex w-full items-center justify-between gap-2">
+                        <span className="truncate font-mono text-[0.75rem]">
+                          {group.label}
+                          {group.paths.length > 1 ? ` ×${group.paths.length}` : ''}
+                        </span>
+
+                        <Button
+                          aria-label={copy.browseDownloadAria.replace('{name}', group.label)}
+                          className="h-6 shrink-0 px-2"
+                          disabled={group.fit === 'too-big' || Boolean(dJob)}
+                          onClick={() => startBrowsedDownload(hit.repo, group)}
+                          size="sm"
+                          variant="ghost"
+                        >
+                          {dJob ? <Loader2 className="size-3.5 animate-spin" /> : <Download className="size-3.5" />}
+                        </Button>
+                      </span>
+
+                      {dJob ? (
+                        <>
+                          <ProgressBar percent={dJob.percent} />
+
+                          <span className="text-[0.68rem] text-muted-foreground">
+                            {!dJob.done_bytes && dJob.detail
+                              ? dJob.detail
+                              : copy.downloadProgress(gbLabel(dJob.done_bytes), gbLabel(dJob.total_bytes))}
+                          </span>
+                        </>
+                      ) : (
+                        <span className="flex items-center justify-between gap-2">
+                          <Pill tone={fitTone(group.fit)}>
+                            <Cpu className="mr-1 size-3" />
+                            {group.fit === 'fits-gpu'
+                              ? copy.pillFitsGpu
+                              : group.fit === 'needs-ram'
+                                ? copy.pillUsesRam
+                                : group.fit === 'too-big'
+                                  ? copy.pillTooBig
+                                  : copy.browseFitUnknown}
+                          </Pill>
+
+                          <span className="shrink-0 text-[0.7rem] text-muted-foreground">
+                            {gbLabel(group.total_bytes)}
+                          </span>
+                        </span>
+                      )}
+                    </div>
+                  )
+                })}
+              </div>
+            )}
+          </div>
+        ))}
+      </div>
+    </SettingsSection>
+  )
+}
diff --git a/apps/desktop/src/app/settings/primitives.tsx b/apps/desktop/src/app/settings/primitives.tsx
index ab875ed703..4ae6368913 100644
--- a/apps/desktop/src/app/settings/primitives.tsx
+++ b/apps/desktop/src/app/settings/primitives.tsx
@@ -1,4 +1,4 @@
-import type { ReactNode } from 'react'
+import type { ComponentProps, ReactNode } from 'react'
 
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
@@ -22,10 +22,28 @@ export function SettingsContent({ children, bare = false }: { children: ReactNod
   )
 }
 
-const PILL_VARIANT = { muted: 'muted', primary: 'default', warn: 'warn' } as const
+const PILL_VARIANT = {
+  muted: 'muted',
+  primary: 'default',
+  success: 'success',
+  warn: 'warn',
+  destructive: 'destructive'
+} as const
 
-export function Pill({ tone = 'muted', children }: { tone?: keyof typeof PILL_VARIANT; children: ReactNode }) {
-  return <Badge variant={PILL_VARIANT[tone]}>{children}</Badge>
+// Rest props spread through to the Badge's DOM node — REQUIRED for Radix
+// `asChild` composition (wrapping a Pill in `Tip` clones it with the hover
+// handlers and ref as props; swallowing them left every tooltip on a Pill
+// silently dead).
+export function Pill({
+  tone = 'muted',
+  children,
+  ...props
+}: { tone?: keyof typeof PILL_VARIANT; children: ReactNode } & Omit<ComponentProps<typeof Badge>, 'variant'>) {
+  return (
+    <Badge variant={PILL_VARIANT[tone]} {...props}>
+      {children}
+    </Badge>
+  )
 }
 
 export function SectionHeading({
diff --git a/apps/desktop/src/app/settings/providers-settings.tsx b/apps/desktop/src/app/settings/providers-settings.tsx
index 982b39b6ce..a061330fc3 100644
--- a/apps/desktop/src/app/settings/providers-settings.tsx
+++ b/apps/desktop/src/app/settings/providers-settings.tsx
@@ -7,6 +7,7 @@ import {
   FEATURED_ID,
   FeaturedProviderRow,
   FireworksProviderRow,
+  LocalModelsProviderRow,
   OpenRouterProviderRow,
   ProviderRow,
   providerTitle,
@@ -21,6 +22,7 @@ import { Check, ChevronDown, ChevronRight, KeyRound, Loader2, Terminal, Trash2 }
 import { normalize } from '@/lib/text'
 import { cn } from '@/lib/utils'
 import { confirm } from '@/store/confirm'
+import { $localModelsEnabled } from '@/store/local-models-flag'
 import { notify, notifyError } from '@/store/notifications'
 import { $desktopOnboarding, startManualLocalEndpoint, startManualProviderOAuth } from '@/store/onboarding'
 import type { EnvVarInfo, OAuthProvider } from '@/types/hermes'
@@ -29,6 +31,7 @@ import { isKeyVar, ProviderKeyRows } from './credential-key-ui'
 import { CustomEndpointsSettings } from './custom-endpoints-settings'
 import { SettingsCategoryHeading, useEnvCredentials } from './env-credentials'
 import { providerGroup, providerMeta, providerPriority } from './helpers'
+import { LocalModelsSettings } from './local-models-settings'
 import { SettingsContent, SettingsSkeleton } from './primitives'
 
 // The embedded terminal (and thus the "run disconnect command" path) only
@@ -46,7 +49,7 @@ function GroupLabel({ children }: { children: ReactNode }) {
 }
 
 // Sub-views surfaced as a sidebar subnav: account sign-in vs raw API keys.
-export const PROVIDER_VIEWS = ['accounts', 'keys', 'custom-endpoints'] as const
+export const PROVIDER_VIEWS = ['accounts', 'keys', 'custom-endpoints', 'local'] as const
 
 export type ProviderView = (typeof PROVIDER_VIEWS)[number]
 
@@ -117,24 +120,26 @@ function buildProviderKeyGroups(vars: Record<string, EnvVarInfo>): ProviderKeyGr
 
 // Deliberately a near-1:1 replica of the first-run onboarding picker
 // (`Picker` in desktop-onboarding-overlay): same recommended card, same
-// Fireworks #2 quick-key row, same provider rows, same "Other providers"
-// disclosure, same OpenRouter quick-key row, and the same bottom-right
-// "I have an API key" affordance. The leaf cards are the exact shared
-// components, so the two surfaces stay visually identical. Selecting a
-// provider hands off to the shared onboarding overlay, which runs that
-// provider's real sign-in flow; the key affordances open the API-key
-// catalog below.
+// always-visible Local models row, same provider rows, same "Other
+// providers" disclosure (Fireworks and OpenRouter quick-key rows live
+// inside it on both surfaces), and the same bottom-right "I have an API
+// key" affordance. The leaf cards are the exact shared components, so
+// the two surfaces stay visually identical. Selecting a provider hands
+// off to the shared onboarding overlay, which runs that provider's real
+// sign-in flow; the key affordances open the API-key catalog below.
 function OAuthPicker({
   disconnecting,
   onDisconnect,
   onTerminalDisconnect,
   onWantApiKey,
+  onWantLocalModels,
   providers
 }: {
   disconnecting: null | string
   onDisconnect: (provider: OAuthProvider) => void
   onTerminalDisconnect: (provider: OAuthProvider) => void
   onWantApiKey: () => void
+  onWantLocalModels: () => void
   providers: OAuthProvider[]
 }) {
   const { t } = useI18n()
@@ -176,8 +181,9 @@ function OAuthPicker({
         {p.intro}
       </p>
       {featured && <FeaturedProviderRow onSelect={select} provider={featured} />}
-      {/* Slot #2 — always visible, matching onboarding / CANONICAL_PROVIDERS. */}
-      <FireworksProviderRow onClick={onWantApiKey} />
+      {/* Slot #2 — the no-account path, matching onboarding. Behind the
+          --local launch flag like every local-models surface. */}
+      {$localModelsEnabled.get() && <LocalModelsProviderRow onClick={onWantLocalModels} />}
       {connected.length > 0 && (
         <>
           <GroupLabel>{p.connected}</GroupLabel>
@@ -199,6 +205,7 @@ function OAuthPicker({
           {others.map(p => (
             <ProviderRow key={p.id} onSelect={select} provider={p} />
           ))}
+          <FireworksProviderRow onClick={onWantApiKey} />
           <OpenRouterProviderRow onClick={onWantApiKey} />
         </>
       )}
@@ -507,6 +514,13 @@ export function ProvidersSettings({
     return <CustomEndpointsSettings onConfigSaved={onConfigSaved} onMainModelChanged={onMainModelChanged} />
   }
 
+  if (view === 'local') {
+    // Strict --local gate: without the launch flag the pane doesn't render
+    // even when local models are configured — a stale ?pview=local deep link
+    // (or an old shortcut) lands on the accounts view instead.
+    return $localModelsEnabled.get() ? <LocalModelsSettings /> : null
+  }
+
   return (
     <SettingsContent>
       <OAuthPicker
@@ -514,6 +528,7 @@ export function ProvidersSettings({
         onDisconnect={provider => void handleDisconnect(provider)}
         onTerminalDisconnect={provider => void handleTerminalDisconnect(provider)}
         onWantApiKey={() => onViewChange('keys')}
+        onWantLocalModels={() => onViewChange('local')}
         providers={oauthProviders}
       />
     </SettingsContent>
diff --git a/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx b/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
index b9d9eff4e7..f2bcf39fd2 100644
--- a/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
+++ b/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
@@ -8,14 +8,27 @@ import { useApprovalModeStatusbarItem } from '@/app/shell/approval-mode-menu'
 import { ContextUsagePanel } from '@/app/shell/context-usage-panel'
 import { GatewayMenuPanel } from '@/app/shell/gateway-menu-panel'
 import { useContextBreakdown } from '@/app/shell/hooks/use-context-breakdown'
+import { useSystemResourcesStatusbarItem } from '@/app/shell/system-resources-statusbar'
 import { $paneVisible, togglePaneVisible } from '@/components/pane-shell/tree/store'
 import { Codicon } from '@/components/ui/codicon'
 import { GlyphSpinner } from '@/components/ui/glyph-spinner'
 import { useI18n } from '@/i18n'
 import { displayPath, pathLeaf } from '@/lib/display-path'
-import { Activity, AlertCircle, Clock, Command, FolderOpen, Globe, Hash, Loader2, Terminal } from '@/lib/icons'
+import {
+  Activity,
+  AlertCircle,
+  Clock,
+  Command,
+  FolderOpen,
+  Globe,
+  Hash,
+  Layers3,
+  Loader2,
+  Terminal,
+  Zap
+} from '@/lib/icons'
 import { runtimeReadinessDisplay, type RuntimeReadinessResult } from '@/lib/runtime-readiness'
-import { contextBarLabel, LiveDuration, usageContextLabel } from '@/lib/statusbar'
+import { cacheHitLabel, contextBarLabel, LiveDuration, tokensPerSecondLabel, usageContextLabel } from '@/lib/statusbar'
 import { useStoreSelector } from '@/lib/use-session-slice'
 import { cn } from '@/lib/utils'
 import { resolveVersionStatus } from '@/lib/version-status'
@@ -266,8 +279,13 @@ export function useStatusbarItems({
 
   const contextUsage = useMemo(() => usageContextLabel(gaugeUsage), [gaugeUsage])
   const contextBar = useMemo(() => contextBarLabel(gaugeUsage), [gaugeUsage])
+  // Both ride the same usage payload the context meter does (session.usage
+  // ticks mid-turn, message.complete after) — no extra RPC, no polling.
+  const cacheHit = cacheHitLabel(currentUsage)
+  const tokensPerSecond = tokensPerSecondLabel(currentUsage)
 
   const approvalModeItem = useApprovalModeStatusbarItem(activeGatewayProfile, requestGateway)
+  const systemResourcesItem = useSystemResourcesStatusbarItem()
 
   const gatewayMenuContent = useMemo(
     () => (close: () => void) => (
@@ -546,9 +564,12 @@ export function useStatusbarItems({
       },
       {
         detail: contextBar || undefined,
-        hidden: !contextUsage,
+        // Never self-hide: the user opted this item in (it's hidden-by-
+        // default), so an empty label must render as a waiting placeholder,
+        // not a vanished item — an enabled-but-invisible toggle reads as
+        // "another item took its spot".
         id: 'context-usage',
-        label: contextUsage,
+        label: contextUsage || '—',
         menuAlign: 'end',
         menuClassName: 'w-auto border-(--ui-stroke-secondary) p-0',
         menuContent: (
@@ -557,6 +578,24 @@ export function useStatusbarItems({
         toggleLabel: copy.toggleContextUsage,
         variant: 'menu'
       },
+      {
+        icon: <Layers3 className="size-3" />,
+        id: 'cache-hit-rate',
+        // Same never-self-hide rule as the context meter: opted in means a
+        // placeholder until the first cached turn reports, not a vanished item.
+        label: cacheHit || '—',
+        title: copy.cacheHitRateTitle,
+        toggleLabel: copy.toggleCacheHitRate,
+        variant: 'text'
+      },
+      {
+        icon: <Zap className="size-3" />,
+        id: 'tokens-per-second',
+        label: tokensPerSecond || '—',
+        title: copy.tokensPerSecondTitle,
+        toggleLabel: copy.toggleTokensPerSecond,
+        variant: 'text'
+      },
       {
         detail: <LiveDuration since={sessionStartedAt} />,
         hidden: !sessionStartedAt,
@@ -565,6 +604,7 @@ export function useStatusbarItems({
         toggleLabel: copy.toggleSessionTimer,
         variant: 'text'
       },
+      systemResourcesItem,
       {
         ...approvalModeItem,
         hidden: gatewayState !== 'open',
@@ -588,6 +628,7 @@ export function useStatusbarItems({
       approvalModeItem,
       backendVersionItem,
       busy,
+      cacheHit,
       chatOpen,
       clientVersionItem,
       contextBar,
@@ -598,7 +639,9 @@ export function useStatusbarItems({
       gaugeUsage,
       sessionStartedAt,
       gatewayState,
+      systemResourcesItem,
       terminalShowing,
+      tokensPerSecond,
       turnStartedAt
     ]
   )
diff --git a/apps/desktop/src/app/shell/model-catalog-menu.test.tsx b/apps/desktop/src/app/shell/model-catalog-menu.test.tsx
index 9f1a70e8c4..ae42a4a36c 100644
--- a/apps/desktop/src/app/shell/model-catalog-menu.test.tsx
+++ b/apps/desktop/src/app/shell/model-catalog-menu.test.tsx
@@ -1,8 +1,10 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { DropdownMenu, DropdownMenuContent } from '@/components/ui/dropdown-menu'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $localRuntimeJobs } from '@/store/local-runtime-jobs'
 import {
   $modelVisibilityOpen,
   $visibleModels,
@@ -10,6 +12,7 @@ import {
   setModelVisibilityOpen,
   setVisibleModels
 } from '@/store/model-visibility'
+import type { LocalRuntimeJob } from '@/types/hermes'
 
 import { ModelCatalogMenu, type ModelMenuController } from './model-catalog-menu'
 
@@ -24,11 +27,23 @@ const getGlobalModelOptions = vi.fn()
 
 vi.mock('@/hermes', () => ({
   getGlobalModelOptions: (...args: unknown[]) => getGlobalModelOptions(...args),
+  // The menu kicks the app-level job poller on mount; echo the store so a
+  // poll can't wipe the jobs a test staged (the real backend is authority,
+  // and here the store plays that part).
+  getLocalModelsJobs: vi.fn(async () => {
+    const { $localRuntimeJobs } = await import('@/store/local-runtime-jobs')
+
+    return { jobs: [...$localRuntimeJobs.get()] }
+  }),
+  getLocalModelsStatus: vi.fn().mockResolvedValue({ loading: {} }),
   setApiRequestProfile: vi.fn()
 }))
 
 beforeEach(() => {
   $visibleModels.set(null)
+  $localRuntimeJobs.set([])
+  // These suites exercise the local-models rows, which ship behind --local.
+  $localModelsEnabled.set(true)
   setModelVisibilityOpen(false)
   getGlobalModelOptions.mockResolvedValue({
     providers: [{ models: ['gemini-3.1-pro', 'gemini-2.5-flash'], name: 'Google', slug: 'google' }]
@@ -106,3 +121,77 @@ describe('the catalog owns model curation', () => {
     expect($modelVisibilityOpen.get()).toBe(true)
   })
 })
+
+describe('in-flight local downloads', () => {
+  const DOWNLOAD_JOB: LocalRuntimeJob = {
+    job_id: 'dl1',
+    kind: 'model-download',
+    target: 'Qwen3.8 Flash Next (UD-Q4_K_XL)',
+    model_id: 'qwen3.8-flash-next',
+    status: 'running',
+    phase: 'downloading',
+    detail: '',
+    total_bytes: 100,
+    done_bytes: 41,
+    percent: 41,
+    error: null
+  }
+
+  it('shows a downloading model as a disabled progress row in its own Local group', async () => {
+    // No llamacpp provider in the catalog (first-ever download).
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderMenu()
+    await screen.findByText(/Gemini 3\.1 Pro/i)
+
+    const row = screen.getByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')
+
+    expect(row).toBeTruthy()
+    expect(screen.getByText('41%')).toBeTruthy()
+    expect(row.closest('[role="menuitem"]')?.getAttribute('aria-disabled')).toBe('true')
+  })
+
+  it('shows the download inside the Local provider group when it exists', async () => {
+    getGlobalModelOptions.mockResolvedValue({
+      providers: [
+        { models: ['Qwen3.6-27B-UD-Q4_K_XL'], name: 'Local', slug: 'llamacpp' },
+        { models: ['gemini-3.1-pro'], name: 'Google', slug: 'google' }
+      ]
+    })
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderMenu()
+
+    await screen.findByText(/Qwen3\.6 27B/i)
+    expect(screen.getByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeTruthy()
+    // One Local heading — the trailing fallback group must not double up.
+    expect(screen.getAllByText('Local').length).toBe(1)
+  })
+
+  it('drops the placeholder row once the download settles', async () => {
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderMenu()
+    await screen.findByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')
+
+    $localRuntimeJobs.set([{ ...DOWNLOAD_JOB, status: 'done', phase: 'done' }])
+    await waitFor(() => {
+      expect(screen.queryByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeNull()
+    })
+  })
+
+  it('hides the local provider group and download rows without the --local flag (strict)', async () => {
+    $localModelsEnabled.set(false)
+    getGlobalModelOptions.mockResolvedValue({
+      providers: [
+        { models: ['Qwen3.6-27B-UD-Q4_K_XL'], name: 'Local', slug: 'llamacpp' },
+        { models: ['gemini-3.1-pro'], name: 'Google', slug: 'google' }
+      ]
+    })
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderMenu()
+
+    // Staged models exist and a download is running — none of it shows.
+    await screen.findByText(/Gemini 3\.1 Pro/i)
+    expect(screen.queryByText(/Qwen3\.6 27B/i)).toBeNull()
+    expect(screen.queryByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeNull()
+    expect(screen.queryByText('Local')).toBeNull()
+  })
+})
diff --git a/apps/desktop/src/app/shell/model-catalog-menu.tsx b/apps/desktop/src/app/shell/model-catalog-menu.tsx
index 83deb56e77..3cde3cd229 100644
--- a/apps/desktop/src/app/shell/model-catalog-menu.tsx
+++ b/apps/desktop/src/app/shell/model-catalog-menu.tsx
@@ -19,12 +19,16 @@ import { HighlightMatches } from '@/components/ui/highlight-matches'
 import { usePointerQuiet } from '@/components/ui/keyboard-first'
 import { Skeleton } from '@/components/ui/skeleton'
 import type { HermesGateway } from '@/hermes'
+import { getLocalModelsStatus } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { modelOptionsQueryKey, requestModelOptions } from '@/lib/model-options'
 import { displayModelName, modelDisplayParts } from '@/lib/model-status-label'
 import { DEFAULT_REASONING_EFFORT, reasoningEffortLabel } from '@/lib/reasoning-effort'
 import { normalize } from '@/lib/text'
+import { useStoreSelector } from '@/lib/use-session-slice'
 import { cn } from '@/lib/utils'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $localRuntimeJobs, runningModelDownloads, watchLocalRuntimeJobs } from '@/store/local-runtime-jobs'
 import {
   $visibleModels,
   collapseModelFamilies,
@@ -36,7 +40,7 @@ import {
 } from '@/store/model-visibility'
 import { $collapsedProviders, toggleCollapsedProvider } from '@/store/provider-collapse'
 import { $defaultReasoningEffort } from '@/store/session'
-import type { ModelOptionProvider, ModelOptionsResponse } from '@/types/hermes'
+import type { LocalModelLoadProgress, ModelOptionProvider, ModelOptionsResponse } from '@/types/hermes'
 
 import { type FastControl, ModelEditSubmenu, resolveFastControl } from './model-edit-submenu'
 
@@ -134,6 +138,7 @@ export function ModelCatalogMenu({
 }: ModelCatalogMenuProps) {
   const { t } = useI18n()
   const copy = t.shell.modelMenu
+  const copyPicker = t.modelPicker
   const closeMenu = useContext(ModelMenuCloseContext)
   const [search, setSearch] = useState('')
   const collapsedProviders = useStoreCollapsed()
@@ -154,6 +159,78 @@ export function ModelCatalogMenu({
 
   const loading = modelOptions.isPending && !modelOptions.data
 
+  // Every local-models read in this menu sits behind the --local launch
+  // flag: no status polling, no download rows, and the llamacpp provider
+  // group hides even when models are staged (the flag is strict).
+  const localModelsEnabled = $localModelsEnabled.get()
+
+  // Live load state for the managed local server: which model is loading
+  // into memory right now, with a REAL percent (per-tensor callback relayed
+  // over the router's SSE stream). Polled only while this menu is mounted
+  // (it unmounts on close); errors read as "nothing loading" — remote-only
+  // installs have no local-models routes.
+  const localStatus = useQuery({
+    queryKey: ['local-models-loading', profile],
+    queryFn: () => getLocalModelsStatus(),
+    enabled: localModelsEnabled,
+    refetchInterval: 2_000,
+    retry: false
+  })
+
+  const loadingModels: Record<string, LocalModelLoadProgress> = localStatus.data?.loading ?? {}
+
+  // Models on their way into the local library (downloads + quickstart runs
+  // still fetching bytes) — rendered as disabled progress rows so the user
+  // sees the model coming instead of wondering where it went. The jobs store
+  // republishes every ~700ms with fresh byte counts while anything runs; a
+  // whole-store subscription here would re-render the entire menu per tick
+  // (breaking open submenus and focus — the #72163 class). Subscribe to a
+  // STABLE identity projection instead: it changes only when a download
+  // starts or ends. Each row selects its own percent scalar.
+  const downloadsKey = useStoreSelector($localRuntimeJobs, jobs =>
+    localModelsEnabled
+      ? runningModelDownloads(jobs)
+          .map(job => `${job.job_id}\u0000${job.target}`)
+          .join('\u0001')
+      : ''
+  )
+
+  const downloads = useMemo(
+    () =>
+      downloadsKey === ''
+        ? []
+        : downloadsKey.split('\u0001').map(pair => {
+            const [jobId, target] = pair.split('\u0000')
+
+            return { jobId, target }
+          }),
+    [downloadsKey]
+  )
+
+  useEffect(() => {
+    if (localModelsEnabled) {
+      watchLocalRuntimeJobs()
+    }
+  }, [localModelsEnabled])
+
+  // A finished download turns into a real selectable model: refetch the
+  // catalog so the placeholder row is replaced while the menu is open.
+  const refetchOptions = modelOptions.refetch
+
+  useEffect(() => {
+    let prevActive = runningModelDownloads($localRuntimeJobs.get()).length > 0
+
+    return $localRuntimeJobs.listen(next => {
+      const active = runningModelDownloads(next).length > 0
+
+      if (prevActive && !active) {
+        void refetchOptions()
+      }
+
+      prevActive = active
+    })
+  }, [refetchOptions])
+
   const error = modelOptions.error
     ? modelOptions.error instanceof Error
       ? modelOptions.error.message
@@ -170,12 +247,27 @@ export function ModelCatalogMenu({
   )
 
   const pickerProviders = useMemo(
-    () => providers?.filter(provider => provider.slug.toLowerCase() !== 'moa') ?? [],
-    [providers]
+    () =>
+      providers?.filter(
+        provider =>
+          provider.slug.toLowerCase() !== 'moa' &&
+          // Strict --local gate: staged local models exist on disk, but
+          // without the flag the GUI doesn't offer them.
+          (localModelsEnabled || provider.slug !== LOCAL_PROVIDER_SLUG)
+      ) ?? [],
+    [providers, localModelsEnabled]
   )
 
   const current = controller.current
 
+  const q = normalize(search)
+
+  // In-flight downloads render inside the Local provider group when it
+  // exists, else as their own trailing 'Local' group (first download —
+  // nothing staged yet, so the catalog has no local provider row).
+  const shownDownloads = q ? downloads.filter(job => (job.target || '').toLowerCase().includes(q)) : downloads
+  const hasLocalGroup = pickerProviders.some(provider => provider.slug === LOCAL_PROVIDER_SLUG)
+
   // Resolve visibility HERE, against the catalog we actually fetched: an empty
   // provider list would otherwise resolve to an empty key set that reads as
   // "user hid everything" and blanks the menu on first open.
@@ -189,8 +281,6 @@ export function ModelCatalogMenu({
     [pickerProviders, search, current.model, current.provider, shownKeys]
   )
 
-  const q = normalize(search)
-
   // Presets are searchable rows like everything else — an unfiltered preset
   // sitting under zero model matches would otherwise become the "first match"
   // Enter commits.
@@ -367,7 +457,7 @@ export function ModelCatalogMenu({
         <DropdownMenuItem className={dropdownMenuRow} disabled>
           {error}
         </DropdownMenuItem>
-      ) : groups.length === 0 && moaPresets.length === 0 ? (
+      ) : groups.length === 0 && moaPresets.length === 0 && shownDownloads.length === 0 ? (
         <DropdownMenuItem className={dropdownMenuRow} disabled>
           {copy.noModels}
         </DropdownMenuItem>
@@ -413,6 +503,12 @@ export function ModelCatalogMenu({
                     const name = modelDisplayParts(family.id).name
                     const caps = group.provider.capabilities?.[family.id]
 
+                    // Managed local model loading into memory right now:
+                    // real load percent, keyed by exact model id (remote
+                    // providers never collide with GGUF stems).
+                    const loadProgress =
+                      loadingModels[family.id] ?? (family.fastId ? loadingModels[family.fastId] : undefined)
+
                     // Effective settings for this row: the live choice when it's
                     // the active model, otherwise its remembered preset. Row
                     // label AND submenu read from these so they never disagree.
@@ -461,8 +557,28 @@ export function ModelCatalogMenu({
                             <HighlightMatches query={search} text={name} />
                             {meta ? <span className="text-(--ui-text-tertiary)"> {meta}</span> : null}
                           </span>
+                          {loadProgress ? (
+                            <span
+                              className="ml-auto flex shrink-0 items-center gap-1.5"
+                              title={copyPicker.loadingIntoMemory}
+                            >
+                              <span className="h-1 w-14 overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+                                <span
+                                  className="block h-full rounded-full bg-primary transition-[width] duration-500"
+                                  style={{ width: `${Math.max(2, loadProgress.percent)}%` }}
+                                />
+                              </span>
+                              <span className="text-[0.62rem] tabular-nums text-(--ui-text-tertiary)">
+                                {loadProgress.percent}%
+                              </span>
+                            </span>
+                          ) : null}
                           {isCurrent ? (
-                            <Codicon className="ml-auto text-foreground" name="check" size="0.75rem" />
+                            <Codicon
+                              className={cn('text-foreground', loadProgress ? 'ml-1' : 'ml-auto')}
+                              name="check"
+                              size="0.75rem"
+                            />
                           ) : null}
                         </DropdownMenuSubTrigger>
                         <ModelEditSubmenu
@@ -486,9 +602,24 @@ export function ModelCatalogMenu({
                       </DropdownMenuSub>
                     )
                   })}
+                {!collapsed &&
+                  slug === LOCAL_PROVIDER_SLUG &&
+                  shownDownloads.map(job => (
+                    <DownloadingModelRow jobId={job.jobId} key={job.jobId} target={job.target} />
+                  ))}
               </DropdownMenuGroup>
             )
           })}
+          {!hasLocalGroup && shownDownloads.length > 0 && (
+            <DropdownMenuGroup className="py-0.5" key="local-downloads">
+              <DropdownMenuLabel className="px-2 pb-0.5 pt-0.5 text-[0.625rem] font-semibold uppercase tracking-wider text-(--ui-text-tertiary)">
+                {copyPicker.localDownloadsHeading}
+              </DropdownMenuLabel>
+              {shownDownloads.map(job => (
+                <DownloadingModelRow jobId={job.jobId} key={job.jobId} target={job.target} />
+              ))}
+            </DropdownMenuGroup>
+          )}
         </div>
       )}
 
@@ -540,6 +671,44 @@ export function ModelCatalogMenu({
 /** Re-exported so callers building a footer row match the catalog's rows. */
 export { dropdownMenuRow }
 
+// The backend's provider row for staged local models (inventory.py's
+// _local_runtime_row). Downloads-in-flight attach to this group.
+const LOCAL_PROVIDER_SLUG = 'llamacpp'
+
+// A model still downloading: visible so the user knows it's coming (and
+// where it will land), disabled so it can't be selected early, with the
+// same byte progress the Local Models pane shows. Percent is selected HERE,
+// per row, so the 700ms byte ticks repaint this leaf only — the menu tree
+// above subscribes to download identity, not progress.
+function DownloadingModelRow({ jobId, target }: { jobId: string; target: string }) {
+  const { t } = useI18n()
+  const copy = t.modelPicker
+
+  const percent = useStoreSelector($localRuntimeJobs, jobs => jobs.find(job => job.job_id === jobId)?.percent ?? null)
+
+  return (
+    <DropdownMenuItem
+      className={cn(dropdownMenuRow, 'opacity-60')}
+      disabled
+      onSelect={event => event.preventDefault()}
+      textValue=""
+    >
+      <span className="min-w-0 flex-1 truncate">{target}</span>
+      <span className="ml-auto flex shrink-0 items-center gap-1.5" title={copy.downloading}>
+        <span className="h-1 w-14 overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+          <span
+            className="block h-full rounded-full bg-primary transition-[width] duration-500"
+            style={{ width: `${Math.max(2, percent ?? 0)}%` }}
+          />
+        </span>
+        <span className="text-[0.62rem] tabular-nums text-(--ui-text-tertiary)">
+          {typeof percent === 'number' ? `${percent}%` : copy.downloading}
+        </span>
+      </span>
+    </DropdownMenuItem>
+  )
+}
+
 // Collapsed we show the user's chosen models (or the curated default); typing
 // spans every available model so anything is reachable past the cut. A search
 // is itself a narrowing action, so we do NOT cap per-provider matches.
diff --git a/apps/desktop/src/app/shell/statusbar-visibility.test.tsx b/apps/desktop/src/app/shell/statusbar-visibility.test.tsx
index d558c11d11..1a078ba38b 100644
--- a/apps/desktop/src/app/shell/statusbar-visibility.test.tsx
+++ b/apps/desktop/src/app/shell/statusbar-visibility.test.tsx
@@ -99,21 +99,27 @@ describe('statusbar item visibility', () => {
     const statusbar = bar([
       item('running-timer', 'Turn timer', { variant: 'text' }),
       item('context-usage', 'Context meter', { variant: 'menu' }),
+      item('cache-hit-rate', 'Cache hit rate', { variant: 'text' }),
+      item('tokens-per-second', 'Tokens per second', { variant: 'text' }),
       item('session-timer', 'Session timer', { variant: 'text' }),
       item('gateway-health', 'Gateway')
     ])
 
-    for (const label of ['Turn timer', 'Context meter', 'Session timer']) {
+    for (const label of ['Turn timer', 'Context meter', 'Cache hit rate', 'Tokens per second', 'Session timer']) {
       expect(screen.queryByText(label)).toBeNull()
     }
 
     openContextMenu(statusbar)
 
-    const row = await screen.findByRole('menuitemcheckbox', { name: 'Session timer' })
-    fireEvent.click(row)
+    for (const [id, label] of [
+      ['session-timer', 'Session timer'],
+      ['cache-hit-rate', 'Cache hit rate']
+    ]) {
+      fireEvent.click(await screen.findByRole('menuitemcheckbox', { name: label }))
 
-    expect($statusbarHiddenIds.get()).not.toContain('session-timer')
-    expect(within(statusbar).getByText('Session timer')).toBeTruthy()
+      expect($statusbarHiddenIds.get()).not.toContain(id)
+      expect(within(statusbar).getByText(label)).toBeTruthy()
+    }
   })
 })
 
diff --git a/apps/desktop/src/app/shell/system-resources-statusbar.tsx b/apps/desktop/src/app/shell/system-resources-statusbar.tsx
new file mode 100644
index 0000000000..b4de162106
--- /dev/null
+++ b/apps/desktop/src/app/shell/system-resources-statusbar.tsx
@@ -0,0 +1,171 @@
+import { useStore } from '@nanostores/react'
+import { useEffect, useState } from 'react'
+
+import type { StatusbarItem } from '@/app/shell/statusbar-controls'
+import { getLocalHardware } from '@/hermes'
+import { useI18n } from '@/i18n'
+import { Activity } from '@/lib/icons'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $statusbarHiddenIds } from '@/store/statusbar-prefs'
+import type { LocalHardware } from '@/types/hermes'
+
+// Live host-resource readout for the bottom bar: GPU utilization + VRAM +
+// RAM, fed by /api/local-models/hardware. Hidden by default (an item most
+// users don't watch); the poll runs ONLY while the item is shown, so the
+// hidden default costs nothing. 5s cadence — resource numbers, not a
+// heartbeat.
+const POLL_MS = 5_000
+
+function gb(bytes: number | null | undefined): string {
+  return bytes ? `${(bytes / (1 << 30)).toFixed(0)}G` : '—'
+}
+
+function gbLong(bytes: number | null | undefined): string {
+  return bytes ? `${(bytes / (1 << 30)).toFixed(1)} GB` : '—'
+}
+
+function MeterRow({ label, percent, value }: { label: string; percent: number | null; value: string }) {
+  return (
+    <div className="grid gap-1">
+      <div className="flex items-baseline justify-between gap-2">
+        {/* Label yields, value never does: if anything ever narrows the row
+            again, a truncated label beats a clipped number — "15.2 GB" losing
+            its tail reads as a wrong number, not a cut one. */}
+        <span className="truncate text-muted-foreground">{label}</span>
+
+        <span className="shrink-0 whitespace-nowrap tabular-nums text-foreground">{value}</span>
+      </div>
+
+      {percent !== null && (
+        <div className="h-1.5 w-full overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+          <div
+            className="h-full rounded-full bg-primary transition-[width] duration-500"
+            style={{ width: `${Math.max(1, Math.min(100, percent))}%` }}
+          />
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function useSystemResourcesStatusbarItem(): StatusbarItem {
+  const { t } = useI18n()
+  const copy = t.shell.statusbar.systemResources
+  const hiddenIds = useStore($statusbarHiddenIds)
+  // Behind the --local launch flag: without it the item is absent from the
+  // bar AND from the customize menu (no toggleLabel), and never polls.
+  const enabled = $localModelsEnabled.get()
+  const shown = enabled && !hiddenIds.includes('system-resources')
+  const [hardware, setHardware] = useState<LocalHardware | null>(null)
+
+  useEffect(() => {
+    if (!shown) {
+      return
+    }
+
+    let cancelled = false
+    let timer: number | null = null
+
+    const poll = async () => {
+      try {
+        const next = await getLocalHardware()
+
+        if (!cancelled) {
+          setHardware(next)
+        }
+      } catch {
+        if (!cancelled) {
+          setHardware(null)
+        }
+      }
+
+      if (!cancelled) {
+        timer = window.setTimeout(() => void poll(), POLL_MS)
+      }
+    }
+
+    void poll()
+
+    return () => {
+      cancelled = true
+
+      if (timer !== null) {
+        window.clearTimeout(timer)
+      }
+    }
+  }, [shown])
+
+  const hasGpu = Boolean(hardware?.gpu_name)
+
+  const vramPercent =
+    hardware?.vram_used_bytes != null && hardware.vram_total_bytes
+      ? Math.round((hardware.vram_used_bytes / hardware.vram_total_bytes) * 100)
+      : null
+
+  const ramUsed = hardware ? hardware.ram_total_bytes - hardware.ram_available_bytes : null
+
+  const ramPercent =
+    hardware?.ram_total_bytes && ramUsed != null ? Math.round((ramUsed / hardware.ram_total_bytes) * 100) : null
+
+  // Compact bar label: the numbers a local-inference user glances at.
+  // "GPU 34% · 18G/32G" with a GPU; "RAM 41G/256G" without.
+  const label = hardware
+    ? hasGpu
+      ? `GPU ${hardware.gpu_util_percent ?? 0}%${
+          hardware.vram_used_bytes != null ? ` · ${gb(hardware.vram_used_bytes)}/${gb(hardware.vram_total_bytes)}` : ''
+        }`
+      : `RAM ${gb(ramUsed)}/${gb(hardware.ram_total_bytes)}`
+    : copy.loading
+
+  return {
+    detail: undefined,
+    hidden: !enabled,
+    icon: <Activity className="size-3" />,
+    id: 'system-resources',
+    label,
+    menuAlign: 'end',
+    menuClassName: 'w-64 p-0',
+    menuContent: (
+      <div className="grid grid-cols-[minmax(0,1fr)] gap-3 p-3 text-[0.75rem]" data-slot="system-resources-panel">
+        {/* min-w-0 everywhere a flex/grid child must shrink: grid items
+            default min-width:auto, so a long GPU name's nowrap min-content
+            props the track open past the w-64 box and overflow-x:hidden
+            shears off every right-aligned value. With the track clamped,
+            `truncate` can finally act. */}
+        <div className="flex min-w-0 items-baseline justify-between gap-2">
+          <p className="shrink-0 font-medium text-foreground">{copy.title}</p>
+
+          {hardware?.gpu_name && (
+            <span className="min-w-0 truncate text-[0.6875rem] text-muted-foreground">{hardware.gpu_name}</span>
+          )}
+        </div>
+
+        {hasGpu && (
+          <MeterRow
+            label={copy.gpuUtilization}
+            percent={hardware?.gpu_util_percent ?? null}
+            value={`${hardware?.gpu_util_percent ?? 0}%`}
+          />
+        )}
+
+        {hasGpu && (
+          <MeterRow
+            label={copy.gpuMemory}
+            percent={vramPercent}
+            value={`${gbLong(hardware?.vram_used_bytes)} / ${gbLong(hardware?.vram_total_bytes)}`}
+          />
+        )}
+
+        <MeterRow
+          label={copy.ram}
+          percent={ramPercent}
+          value={`${gbLong(ramUsed)} / ${gbLong(hardware?.ram_total_bytes)}`}
+        />
+
+        {hardware?.uma && <p className="text-[0.6875rem] text-muted-foreground">{copy.unifiedNote}</p>}
+      </div>
+    ),
+    toggleLabel: enabled ? copy.toggle : undefined,
+    variant: 'menu'
+  }
+}
diff --git a/apps/desktop/src/app/types.ts b/apps/desktop/src/app/types.ts
index 0931ecf879..57e85a0a9c 100644
--- a/apps/desktop/src/app/types.ts
+++ b/apps/desktop/src/app/types.ts
@@ -66,6 +66,10 @@ export interface SessionCompressResponse {
     usage?: Partial<UsageStats>
   }
   messages?: SessionMessage[]
+  /** Set with `status: 'pending'` when the gateway's compute-host wait expired
+   *  while compression is still running; the transcript refreshes from the
+   *  pushed session.info / `compacted` status edge (#97948). */
+  message?: string
   removed?: number
   status?: string
   summary?: {
diff --git a/apps/desktop/src/components/assistant-ui/thread/status.tsx b/apps/desktop/src/components/assistant-ui/thread/status.tsx
index d7ee789ba1..c3f40ac255 100644
--- a/apps/desktop/src/components/assistant-ui/thread/status.tsx
+++ b/apps/desktop/src/components/assistant-ui/thread/status.tsx
@@ -11,13 +11,17 @@ import { SCAFFOLD_LABEL_CLASS } from '@/components/chat/scaffold-row'
 import { Codicon } from '@/components/ui/codicon'
 import { Loader } from '@/components/ui/loader'
 import { StatusPulse } from '@/components/ui/status-pulse'
+import { getLocalModelsStatus } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { cn } from '@/lib/utils'
 import { $backgroundResume } from '@/store/background-delegation'
 import { sessionCompacting } from '@/store/compaction'
+import { $localModelsEnabled } from '@/store/local-models-flag'
 import { sessionAwaitingInput } from '@/store/prompts'
-import { sessionProviderWait } from '@/store/provider-wait'
+import { parseModelLoadWait, sessionProviderWait } from '@/store/provider-wait'
+import { $currentModel } from '@/store/session'
 import { type DraftingTool, sessionDraftingTool } from '@/store/tool-drafting'
+import type { LocalModelLoadProgress } from '@/types/hermes'
 
 // A status line is scaffolding like any other — "Editing" while the model
 // drafts a call is the same kind of line as "Explored 3 files" once it has run,
@@ -51,6 +55,100 @@ const HintText: FC<{ children: ReactNode }> = ({ children }) => (
   <span className={cn(SCAFFOLD_LABEL_CLASS, 'shimmer min-w-0 flex-1 truncate')}>{children}</span>
 )
 
+/** Renderer-side load synthesis: poll the local-models status while a turn
+ * is busy with NO progress frame from the backend. The backend's wait loop
+ * only narrates the MAIN chat request — a model load triggered while the
+ * gateway is still initializing, or one consumed by a parallel auxiliary
+ * call (title generation autoloads the same model), never gets a frame,
+ * and the load looked like nothing was happening. The status route reads
+ * the same SSE snapshot, so this bar carries the identical percent. */
+function useLocalModelLoad(active: boolean): (LocalModelLoadProgress & { model: string }) | null {
+  const model = useStore($currentModel)
+  const [progress, setProgress] = useState<(LocalModelLoadProgress & { model: string }) | null>(null)
+
+  // Behind the --local launch flag: without it, no status polling and no
+  // load bar (the local server can't be the current provider anyway).
+  const enabled = $localModelsEnabled.get()
+
+  useEffect(() => {
+    if (!enabled || !active || !model) {
+      setProgress(null)
+
+      return
+    }
+
+    let cancelled = false
+    let timer: number | undefined
+
+    const tick = async () => {
+      try {
+        const status = await getLocalModelsStatus()
+        const entry = status.loading?.[model]
+
+        if (!cancelled) {
+          setProgress(entry ? { ...entry, model } : null)
+        }
+      } catch {
+        if (!cancelled) {
+          setProgress(null)
+        }
+      }
+
+      if (!cancelled) {
+        timer = window.setTimeout(() => void tick(), 1_500)
+      }
+    }
+
+    void tick()
+
+    return () => {
+      cancelled = true
+
+      if (timer !== undefined) {
+        window.clearTimeout(timer)
+      }
+    }
+  }, [enabled, active, model])
+
+  return progress
+}
+
+/** Wait hint with a real progress bar for managed-local model loads and
+ * prompt processing. The percents come from llama-server itself (per-tensor
+ * load callback / live prefill counter, via the gateway's wait frames), so a
+ * determinate bar is honest — a 40s cold load or a long prefill reads as
+ * visible progress instead of an alarming stall. */
+const WaitHint: FC<{ hint: string }> = ({ hint }) => {
+  const { t } = useI18n()
+  const load = parseModelLoadWait(hint)
+
+  if (!load) {
+    return <HintText>{hint}</HintText>
+  }
+
+  const label =
+    load.kind === 'load' ? t.assistant.thread.loadingLocalModel(load.model) : t.assistant.thread.processingPrompt
+
+  return <ProgressHint label={label} percent={load.percent} />
+}
+
+const ProgressHint: FC<{ label: string; percent: null | number }> = ({ label, percent }) => (
+  <span className="flex min-w-0 flex-1 items-center gap-2">
+    <span className={cn(SCAFFOLD_LABEL_CLASS, 'shimmer min-w-0 shrink truncate')}>{label}</span>
+    {percent !== null && (
+      <>
+        <span className="h-1 w-24 shrink-0 overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+          <span
+            className="block h-full rounded-full bg-primary transition-[width] duration-500"
+            style={{ width: `${Math.max(2, percent)}%` }}
+          />
+        </span>
+        <span className={cn(SCAFFOLD_LABEL_CLASS, 'shrink-0 tabular-nums')}>{percent}%</span>
+      </>
+    )}
+  </span>
+)
+
 /** These indicators render inside whichever transcript mounted them, so every
  *  session-scoped signal comes from that surface's view — a tile must never
  *  show the primary chat's compaction, prompt-wait, or turn timer. */
@@ -147,6 +245,10 @@ export const ResponseLoadingIndicator: FC = () => {
   const { compacting, drafting, providerWait, turnStartedAt } = useThreadSessionStatus()
   const elapsed = useElapsedSeconds(true, undefined, turnStartedAt)
   const hint = useStatusHint(compacting, drafting, providerWait)
+  // Renderer-synthesized load bar: covers loads the backend's wait loop
+  // can't narrate (gateway still initializing, or an auxiliary call — not
+  // the main request — triggered the autoload). A real wait frame wins.
+  const localLoad = useLocalModelLoad(!hint)
 
   return (
     <StatusRow data-slot="aui_response-loading" label={hint || t.assistant.thread.loadingResponse}>
@@ -155,7 +257,11 @@ export const ResponseLoadingIndicator: FC = () => {
         className="dither inline-block size-3 rounded-[2px] text-midground/80"
         kind="opacity"
       />
-      {hint && <HintText>{hint}</HintText>}
+      {hint ? (
+        <WaitHint hint={hint} />
+      ) : localLoad ? (
+        <ProgressHint label={t.assistant.thread.loadingLocalModel(localLoad.model)} percent={localLoad.percent} />
+      ) : null}
       <ActivityTimerText seconds={elapsed} />
     </StatusRow>
   )
@@ -207,6 +313,7 @@ export const BackgroundResumeNotice: FC = () => {
 // so that per-token updates re-render only this leaf, not the whole
 // AssistantMessage subtree.
 export const TurnActivityIndicator: FC = () => {
+  const { t } = useI18n()
   const activity = useAuiState(s => activitySignature(s.message.content))
 
   // Timestamp of the last visible progress, held from the moment the quiet
@@ -227,6 +334,10 @@ export const TurnActivityIndicator: FC = () => {
   // turn of a fresh chat — so the row can't wait for the store to catch up.
   const messageRunning = useAuiState(s => s.message.status?.type === 'running')
 
+  // Renderer-synthesized load bar (see ResponseLoadingIndicator).
+  const working = busy || messageRunning
+  const localLoad = useLocalModelLoad(working && !hint && !toolNarrating)
+
   useEffect(() => {
     setQuietSince(undefined)
     const seenAt = Date.now()
@@ -240,8 +351,10 @@ export const TurnActivityIndicator: FC = () => {
   // TURN_QUIET_S first, or a run of quick calls would strobe a row between
   // each one. The two exemptions are waits already accounted for elsewhere: a
   // question the user is answering, and a tool call carrying its own timer.
-  const working = busy || messageRunning
-  const active = working && !awaitingInput && !toolNarrating && (Boolean(hint) || quietSince !== undefined)
+  // A live local-model load is a named wait too — it must not wait out the
+  // quiet window (the load IS the story from second one).
+  const active =
+    working && !awaitingInput && !toolNarrating && (Boolean(hint) || localLoad !== null || quietSince !== undefined)
 
   // Compaction owns the whole turn, so it keeps counting from the turn's start;
   // anything else counts from the moment the turn last produced something — the
@@ -263,7 +376,11 @@ export const TurnActivityIndicator: FC = () => {
         className="dither inline-block size-3 rounded-[2px] text-midground/80"
         kind="opacity"
       />
-      {hint && <HintText>{hint}</HintText>}
+      {hint ? (
+        <WaitHint hint={hint} />
+      ) : localLoad ? (
+        <ProgressHint label={t.assistant.thread.loadingLocalModel(localLoad.model)} percent={localLoad.percent} />
+      ) : null}
       <ActivityTimerText seconds={elapsed} />
     </StatusRow>
   )
diff --git a/apps/desktop/src/components/model-picker.test.tsx b/apps/desktop/src/components/model-picker.test.tsx
new file mode 100644
index 0000000000..8cc1b767a3
--- /dev/null
+++ b/apps/desktop/src/components/model-picker.test.tsx
@@ -0,0 +1,151 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { cleanup, render, screen, waitFor } from '@testing-library/react'
+import type { ReactElement } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { I18nProvider } from '@/i18n'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $localRuntimeJobs } from '@/store/local-runtime-jobs'
+import { stubMenuDomApis, stubResizeObserver } from '@/test/jsdom'
+import type { LocalRuntimeJob, ModelOptionsResponse } from '@/types/hermes'
+
+import { ModelPickerDialog } from './model-picker'
+
+vi.mock('@/hermes', () => ({
+  getLocalModelsStatus: vi.fn().mockResolvedValue({ loading: {} })
+}))
+vi.mock('@/lib/model-options', async importOriginal => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  requestModelOptions: vi.fn()
+}))
+
+import { requestModelOptions } from '@/lib/model-options'
+
+stubResizeObserver()
+stubMenuDomApis()
+
+const OPTIONS: ModelOptionsResponse = {
+  model: 'Qwen3.6-27B-UD-Q4_K_XL',
+  provider: 'llamacpp',
+  providers: [
+    {
+      slug: 'llamacpp',
+      name: 'Local',
+      models: ['Qwen3.6-27B-UD-Q4_K_XL'],
+      is_current: true,
+      authenticated: true
+    },
+    {
+      slug: 'nous',
+      name: 'Nous',
+      models: ['Hermes-4.5'],
+      authenticated: true
+    }
+  ]
+}
+
+const DOWNLOAD_JOB: LocalRuntimeJob = {
+  job_id: 'dl1',
+  kind: 'model-download',
+  target: 'Qwen3.8 Flash Next (UD-Q4_K_XL)',
+  model_id: 'qwen3.8-flash-next',
+  status: 'running',
+  phase: 'downloading',
+  detail: '',
+  total_bytes: 100,
+  done_bytes: 41,
+  percent: 41,
+  error: null
+}
+
+function renderPicker(ui?: Partial<Parameters<typeof ModelPickerDialog>[0]>) {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+
+  const element: ReactElement = (
+    <QueryClientProvider client={client}>
+      <I18nProvider>
+        <ModelPickerDialog
+          currentModel="Qwen3.6-27B-UD-Q4_K_XL"
+          currentProvider="llamacpp"
+          onOpenChange={() => undefined}
+          onSelect={() => undefined}
+          open
+          {...ui}
+        />
+      </I18nProvider>
+    </QueryClientProvider>
+  )
+
+  return render(element)
+}
+
+beforeEach(() => {
+  vi.mocked(requestModelOptions).mockResolvedValue(OPTIONS)
+  $localRuntimeJobs.set([])
+  // These suites exercise the local-models rows, which ship behind --local.
+  $localModelsEnabled.set(true)
+})
+
+afterEach(() => {
+  cleanup()
+  vi.clearAllMocks()
+})
+
+describe('ModelPickerDialog download rows', () => {
+  it('shows an in-flight download as a disabled progress row in the Local group', async () => {
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderPicker()
+
+    expect(await screen.findByText('Qwen3.6-27B-UD-Q4_K_XL')).toBeTruthy()
+
+    const row = screen.getByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')
+
+    expect(row).toBeTruthy()
+    expect(screen.getByText('41%')).toBeTruthy()
+
+    // Disabled: cmdk marks the item unselectable.
+    const item = row.closest('[cmdk-item]')
+
+    expect(item?.getAttribute('aria-disabled')).toBe('true')
+  })
+
+  it('shows a first-ever download under its own Local group when no local provider exists yet', async () => {
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    vi.mocked(requestModelOptions).mockResolvedValue({
+      providers: [OPTIONS.providers![1]]
+    })
+    renderPicker()
+
+    expect(await screen.findByText('Hermes-4.5')).toBeTruthy()
+    expect(screen.getByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeTruthy()
+    expect(screen.getByText('41%')).toBeTruthy()
+  })
+
+  it('quickstart shows while downloading but not during later phases', async () => {
+    const quickstart: LocalRuntimeJob = { ...DOWNLOAD_JOB, job_id: 'q1', kind: 'quickstart', phase: 'downloading' }
+
+    $localRuntimeJobs.set([quickstart])
+    renderPicker()
+    expect(await screen.findByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeTruthy()
+
+    // The model is staged once quickstart moves on to activating it — the
+    // placeholder row must leave rather than sit beside the real model.
+    $localRuntimeJobs.set([{ ...quickstart, phase: 'starting-server' }])
+    await waitFor(() => {
+      expect(screen.queryByText('Qwen3.8 Flash Next (UD-Q4_K_XL)')).toBeNull()
+    })
+  })
+
+  it('refetches the model options when a download it saw running completes', async () => {
+    $localRuntimeJobs.set([DOWNLOAD_JOB])
+    renderPicker()
+    await screen.findByText('Qwen3.6-27B-UD-Q4_K_XL')
+
+    expect(vi.mocked(requestModelOptions).mock.calls.length).toBe(1)
+
+    $localRuntimeJobs.set([{ ...DOWNLOAD_JOB, status: 'done', phase: 'done' }])
+    await waitFor(() => {
+      expect(vi.mocked(requestModelOptions).mock.calls.length).toBe(2)
+    })
+  })
+})
diff --git a/apps/desktop/src/components/model-picker.tsx b/apps/desktop/src/components/model-picker.tsx
index e0eaaf706a..f2d7283f17 100644
--- a/apps/desktop/src/components/model-picker.tsx
+++ b/apps/desktop/src/components/model-picker.tsx
@@ -1,12 +1,16 @@
 import { useQuery } from '@tanstack/react-query'
-import { useState } from 'react'
+import { useEffect, useMemo, useState } from 'react'
 
+import { getLocalModelsStatus } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { modelOptionsQueryKey, requestModelOptions } from '@/lib/model-options'
 import { modelSearchText } from '@/lib/model-search-text'
 import { currentPickerSelection } from '@/lib/model-status-label'
 import { normalize } from '@/lib/text'
-import type { ModelOptionProvider, ModelPricing } from '@/types/hermes'
+import { useStoreSelector } from '@/lib/use-session-slice'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $localRuntimeJobs, runningModelDownloads, watchLocalRuntimeJobs } from '@/store/local-runtime-jobs'
+import type { LocalModelLoadProgress, ModelOptionProvider, ModelPricing } from '@/types/hermes'
 
 import type { HermesGateway } from '../hermes'
 import { cn } from '../lib/utils'
@@ -67,6 +71,81 @@ export function ModelPickerDialog({
     enabled: open
   })
 
+  // Live load state for the managed local server: which model is loading
+  // into memory right now, with a REAL percent (per-tensor callback relayed
+  // over the router's SSE stream). Polled only while the picker is open —
+  // 2s idle cadence is enough for a bar under a ~40s load. Errors read as
+  // "nothing loading" (remote-only installs have no local-models routes).
+  // Every local-models read here sits behind the --local launch flag (strict:
+  // the llamacpp provider group hides even with staged models on disk).
+  const localModelsEnabled = $localModelsEnabled.get()
+
+  const localStatus = useQuery({
+    queryKey: ['local-models-loading', profile],
+    queryFn: () => getLocalModelsStatus(),
+    enabled: open && localModelsEnabled,
+    refetchInterval: 2_000,
+    retry: false
+  })
+
+  const loadingModels: Record<string, LocalModelLoadProgress> = localStatus.data?.loading ?? {}
+
+  // Models on their way into the local library right now (downloads +
+  // quickstart runs), rendered as grayed progress rows. The jobs store
+  // republishes every ~700ms with fresh byte counts while anything runs —
+  // and this dialog stays MOUNTED app-wide when closed — so subscribe only
+  // to download identity (changes when a download starts/ends, and never
+  // while closed); each row selects its own percent scalar (#72163 class).
+  const downloadsKey = useStoreSelector($localRuntimeJobs, jobs =>
+    open && localModelsEnabled
+      ? runningModelDownloads(jobs)
+          .map(job => `${job.job_id}\u0000${job.target}`)
+          .join('\u0001')
+      : ''
+  )
+
+  const downloads = useMemo(
+    () =>
+      downloadsKey === ''
+        ? []
+        : downloadsKey.split('\u0001').map(pair => {
+            const [jobId, target] = pair.split('\u0000')
+
+            return { jobId, target }
+          }),
+    [downloadsKey]
+  )
+
+  // Rediscover in-flight work on open: the poller idles when nothing was
+  // running, and a download can start from any surface.
+  useEffect(() => {
+    if (open && localModelsEnabled) {
+      watchLocalRuntimeJobs()
+    }
+  }, [open, localModelsEnabled])
+
+  // A finished download turns into a real selectable model — refetch the
+  // options so the placeholder row is replaced while the picker is open.
+  const refetchOptions = modelOptions.refetch
+
+  useEffect(() => {
+    if (!open) {
+      return
+    }
+
+    let prevActive = runningModelDownloads($localRuntimeJobs.get()).length > 0
+
+    return $localRuntimeJobs.listen(next => {
+      const active = runningModelDownloads(next).length > 0
+
+      if (prevActive && !active) {
+        void refetchOptions()
+      }
+
+      prevActive = active
+    })
+  }, [open, refetchOptions])
+
   const providers = modelOptions.data?.providers ?? []
 
   const { model: optionsModel, provider: optionsProvider } = currentPickerSelection(
@@ -117,8 +196,10 @@ export function ModelPickerDialog({
             <ModelResults
               currentModel={optionsModel || currentModel}
               currentProvider={optionsProvider || currentProvider}
+              downloads={downloads}
               error={error}
               loading={loading}
+              loadingModels={loadingModels}
               onSelectModel={selectModel}
               providers={providers}
               search={search}
@@ -145,6 +226,8 @@ function ModelResults({
   providers,
   currentModel,
   currentProvider,
+  downloads,
+  loadingModels,
   onSelectModel,
   search
 }: {
@@ -153,6 +236,8 @@ function ModelResults({
   providers: ModelOptionProvider[]
   currentModel: string
   currentProvider: string
+  downloads: { jobId: string; target: string }[]
+  loadingModels: Record<string, LocalModelLoadProgress>
   onSelectModel: (provider: ModelOptionProvider, model: string) => void
   search: string
 }) {
@@ -188,15 +273,29 @@ function ModelResults({
   // Only configured providers (those with curated models) are selectable
   // here. Switching to a NOT-yet-configured provider goes through the
   // "Add provider" footer button, which opens the full onboarding selector.
-  const configured = providers.filter(p => (p.models ?? []).length > 0)
+  // The local provider sits behind the --local launch flag (strict: staged
+  // models on disk don't show without it). Module-level read — a launch flag
+  // can't change mid-session.
+  const localModelsShown = $localModelsEnabled.get()
+
+  const configured = providers.filter(
+    p => (p.models ?? []).length > 0 && (localModelsShown || p.slug !== LOCAL_PROVIDER_SLUG)
+  )
+
+  // In-flight local downloads render as disabled progress rows: inside the
+  // Local group when it exists, else as their own group (first download —
+  // nothing staged yet, so the backend reports no Local provider at all).
+  const visibleDownloads = downloads.filter(job => !q || (job.target || '').toLowerCase().includes(q))
+  const hasLocalGroup = configured.some(p => p.slug === LOCAL_PROVIDER_SLUG)
 
   return (
     <>
       {configured.map(provider => {
         // Preserve the backend's curated order — filter in place, no re-sort.
         const models = (provider.models ?? []).filter(m => matches(provider, m))
+        const groupDownloads = provider.slug === LOCAL_PROVIDER_SLUG ? visibleDownloads : []
 
-        if (models.length === 0) {
+        if (models.length === 0 && groupDownloads.length === 0) {
           return null
         }
 
@@ -215,6 +314,10 @@ function ModelResults({
               const isCurrent = model === currentModel && provider.slug === currentProvider
               const price = provider.pricing?.[model]
               const locked = unavailable.has(model)
+              // Managed local model loading into memory right now: show the
+              // real load percent inline (keyed by exact model id — remote
+              // providers never match).
+              const loadProgress = loadingModels[model]
 
               return (
                 <CommandItem
@@ -236,6 +339,17 @@ function ModelResults({
                   <span className="min-w-0 flex-1 truncate">
                     <HighlightMatches query={search} text={model} />
                   </span>
+                  {loadProgress && (
+                    <span className="flex shrink-0 items-center gap-1.5" title={copy.loadingIntoMemory}>
+                      <span className="h-1 w-16 overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+                        <span
+                          className="block h-full rounded-full bg-primary transition-[width] duration-500"
+                          style={{ width: `${Math.max(2, loadProgress.percent)}%` }}
+                        />
+                      </span>
+                      <span className="text-[0.62rem] tabular-nums text-muted-foreground">{loadProgress.percent}%</span>
+                    </span>
+                  )}
                   {locked && (
                     <span className="shrink-0 text-[0.62rem] uppercase tracking-wide opacity-80">{copy.pro}</span>
                   )}
@@ -243,6 +357,9 @@ function ModelResults({
                 </CommandItem>
               )
             })}
+            {groupDownloads.map(job => (
+              <DownloadingModelRow jobId={job.jobId} key={job.jobId} target={job.target} />
+            ))}
             {unavailable.size > 0 && (
               <div className="px-6 pb-2 pt-1 text-[0.62rem] leading-relaxed text-muted-foreground">
                 {copy.proNeedsSubscription}
@@ -251,10 +368,49 @@ function ModelResults({
           </CommandGroup>
         )
       })}
+      {!hasLocalGroup && visibleDownloads.length > 0 && (
+        <CommandGroup heading={copy.localDownloadsHeading} key="local-downloads">
+          {visibleDownloads.map(job => (
+            <DownloadingModelRow jobId={job.jobId} key={job.jobId} target={job.target} />
+          ))}
+        </CommandGroup>
+      )}
     </>
   )
 }
 
+// The backend's provider row for staged local models (inventory.py's
+// _local_runtime_row). Downloads-in-flight attach to this group.
+const LOCAL_PROVIDER_SLUG = 'llamacpp'
+
+// A model still downloading: visible so the user knows it's coming (and
+// where it will land), disabled so it can't be selected early, with the
+// same byte progress the settings pane shows. Percent is selected here, per
+// row, so the poller's 700ms byte ticks repaint this leaf only.
+function DownloadingModelRow({ jobId, target }: { jobId: string; target: string }) {
+  const { t } = useI18n()
+  const copy = t.modelPicker
+
+  const percent = useStoreSelector($localRuntimeJobs, jobs => jobs.find(job => job.job_id === jobId)?.percent ?? null)
+
+  return (
+    <CommandItem className="flex items-center gap-2 pl-6 font-mono opacity-60" disabled value={`downloading:${jobId}`}>
+      <span className="min-w-0 flex-1 truncate">{target}</span>
+      <span className="flex shrink-0 items-center gap-1.5" title={copy.downloading}>
+        <span className="h-1 w-16 overflow-hidden rounded-full bg-(--ui-bg-tertiary)">
+          <span
+            className="block h-full rounded-full bg-primary transition-[width] duration-500"
+            style={{ width: `${Math.max(2, percent ?? 0)}%` }}
+          />
+        </span>
+        <span className="text-[0.62rem] tabular-nums text-muted-foreground">
+          {typeof percent === 'number' ? `${percent}%` : copy.downloading}
+        </span>
+      </span>
+    </CommandItem>
+  )
+}
+
 // Compact In/Out $/Mtok price tag, mirroring the CLI picker's price columns.
 // Renders nothing when pricing is unavailable for the model.
 function ModelPrice({ price, isCurrent }: { price?: ModelPricing; isCurrent: boolean }) {
diff --git a/apps/desktop/src/components/onboarding/index.tsx b/apps/desktop/src/components/onboarding/index.tsx
index 521a1a229c..def3899a8c 100644
--- a/apps/desktop/src/components/onboarding/index.tsx
+++ b/apps/desktop/src/components/onboarding/index.tsx
@@ -11,6 +11,7 @@ import { Check, ChevronDown, ChevronLeft, KeyRound, Loader2 } from '@/lib/icons'
 import { isProviderSetupErrorMessage } from '@/lib/provider-setup-errors'
 import { cn } from '@/lib/utils'
 import { $desktopBoot, type DesktopBootState } from '@/store/boot'
+import { $localModelsEnabled } from '@/store/local-models-flag'
 import {
   $desktopOnboarding,
   clearPendingProviderOAuth,
@@ -32,6 +33,7 @@ import { DocsLink, FlowPanel, Status } from './flow'
 import {
   FeaturedProviderRow,
   FireworksProviderRow,
+  LocalModelsProviderRow,
   OpenRouterProviderRow,
   ProviderRow,
   sortProviders
@@ -41,6 +43,7 @@ export {
   FeaturedProviderRow,
   FireworksProviderRow,
   KeyProviderRow,
+  LocalModelsProviderRow,
   OpenRouterProviderRow,
   ProviderRow,
   providerTitle,
@@ -478,10 +481,29 @@ export function Picker({ ctx }: { ctx: OnboardingContext }) {
   const collapsible = Boolean(featured)
   const showRest = !collapsible || showAll
 
+  // "Run models locally" leaves the picker for Settings -> Providers ->
+  // Local Models, where install/download live. First-run: persist the skip
+  // (same contract as ChooseLaterLink) so the blocking overlay never
+  // re-nags; manual mode just closes. window.location keeps this picker
+  // router-independent (it renders outside the route tree on first run).
+  const openLocalModels = () => {
+    if (manual) {
+      closeManualOnboarding()
+    } else {
+      dismissFirstRunOnboarding()
+    }
+
+    window.location.hash = '#/settings?tab=providers&pview=local'
+  }
+
   return (
     <div className="grid gap-2">
       <div className="grid max-h-[60dvh] gap-2 overflow-y-auto p-1">
         {featured ? <FeaturedProviderRow onSelect={select} provider={featured} /> : null}
+        {/* The no-account path: everything runs on this machine. Shipped
+            behind the --local launch flag. (Fireworks moved into the
+            expanded list on main.) */}
+        {$localModelsEnabled.get() ? <LocalModelsProviderRow onClick={openLocalModels} /> : null}
         {showRest ? (
           <>
             {/* Fireworks leads the expanded list, matching CANONICAL_PROVIDERS
diff --git a/apps/desktop/src/components/onboarding/providers.tsx b/apps/desktop/src/components/onboarding/providers.tsx
index 1240efa95e..2612989b2e 100644
--- a/apps/desktop/src/components/onboarding/providers.tsx
+++ b/apps/desktop/src/components/onboarding/providers.tsx
@@ -95,6 +95,16 @@ export function FireworksProviderRow({ onClick }: { onClick: () => void }) {
   return <KeyProviderRow onClick={onClick} pitch={t.onboarding.fireworksPitch} title="Fireworks AI" />
 }
 
+/** Onboarding row for the managed local runtime: no account, no key — the
+ *  destination is the Local Models pane where install/download live. */
+export function LocalModelsProviderRow({ onClick }: { onClick: () => void }) {
+  const { t } = useI18n()
+
+  return (
+    <KeyProviderRow onClick={onClick} pitch={t.onboarding.localModelsPitch} title={t.onboarding.localModelsTitle} />
+  )
+}
+
 export function OpenRouterProviderRow({ onClick }: { onClick: () => void }) {
   const { t } = useI18n()
 
diff --git a/apps/desktop/src/components/pane-shell/workspace-scope.test.ts b/apps/desktop/src/components/pane-shell/workspace-scope.test.ts
index e90d5cb02a..3e5b3ef6d0 100644
--- a/apps/desktop/src/components/pane-shell/workspace-scope.test.ts
+++ b/apps/desktop/src/components/pane-shell/workspace-scope.test.ts
@@ -9,7 +9,9 @@ import {
   rememberActivePane,
   resetRememberedActivePanes,
   resolveRememberedActivePane,
-  setWorkspaceScope
+  setWorkspaceOwnerLabel,
+  setWorkspaceScope,
+  workspaceOwnerTitle
 } from './workspace-scope'
 
 afterEach(() => {
@@ -67,6 +69,21 @@ describe('workspace scope', () => {
   })
 })
 
+describe('workspace owner title', () => {
+  it("captions a bot chat by its bot instead of the canonical stored title, and leaves everything else alone (#99152)", () => {
+    setWorkspaceOwnerLabel('bot:alpha', 'Alpha')
+    const botChat = { workspaceMode: 'bots' as const, workspaceOwnerKey: 'bot:alpha', workspaceTabTitle: 'Bot Chat' }
+
+    expect(workspaceOwnerTitle('Bot Chat', botChat)).toBe('Alpha')
+    // A `+` side thread under the same bot keeps its own title.
+    expect(workspaceOwnerTitle('Plan the launch', botChat)).toBe('Plan the launch')
+    // A Sessions tab titled the same way is not a bot chat.
+    expect(workspaceOwnerTitle('Bot Chat', { workspaceMode: 'sessions' })).toBe('Bot Chat')
+    // No label yet (roster not loaded): the stored title stands.
+    expect(workspaceOwnerTitle('Bot Chat', { ...botChat, workspaceOwnerKey: 'bot:beta' })).toBe('Bot Chat')
+  })
+})
+
 describe('remembered active panes', () => {
   beforeEach(() => resetRememberedActivePanes())
 
diff --git a/apps/desktop/src/components/pane-shell/workspace-scope.ts b/apps/desktop/src/components/pane-shell/workspace-scope.ts
index 7b62390908..4b0972265c 100644
--- a/apps/desktop/src/components/pane-shell/workspace-scope.ts
+++ b/apps/desktop/src/components/pane-shell/workspace-scope.ts
@@ -46,6 +46,33 @@ export type WorkspaceNewSessionTarget =
 /** Sessions uses its established ambient behavior (`null`). */
 export const $workspaceNewSessionTarget = atom<WorkspaceNewSessionTarget | null>(null)
 
+/** Display name per exact owner key, published by the workspace that owns the
+ *  key (Bot Mode: the roster's display name). Presentation only — never a
+ *  session title, which for a canonical Bot Chat is an identity the backend
+ *  resolves by name and must stay exactly as stored. */
+export const $workspaceOwnerLabels = atom<Readonly<Record<string, string>>>({})
+
+export function setWorkspaceOwnerLabel(ownerKey: string, label: string): void {
+  if ($workspaceOwnerLabels.get()[ownerKey] !== label) {
+    $workspaceOwnerLabels.set({ ...$workspaceOwnerLabels.get(), [ownerKey]: label })
+  }
+}
+
+/** The caption a workspace-owned tab shows: its owner's label while the stored
+ *  row still carries only the placeholder its opener registered — every bot's
+ *  canonical chat is stored under the same name, so the tab reads the bot's
+ *  (#99152). Any other title (a `+` side thread, a Sessions tab) is untouched. */
+export function workspaceOwnerTitle(
+  title: string,
+  scope: { workspaceMode?: WorkspaceMode; workspaceOwnerKey?: string; workspaceTabTitle?: string } | undefined
+): string {
+  if (scope?.workspaceMode !== 'bots' || !scope.workspaceOwnerKey || title !== scope.workspaceTabTitle) {
+    return title
+  }
+
+  return $workspaceOwnerLabels.get()[scope.workspaceOwnerKey] ?? title
+}
+
 /** One key for window-local active-pane memory. Owner keys stay opaque. */
 export function workspaceScopeKey(mode: WorkspaceMode, ownerKey: string | null): string {
   return mode === 'sessions' ? 'sessions' : `bots:${ownerKey ?? ''}`
diff --git a/apps/desktop/src/components/tips/index.tsx b/apps/desktop/src/components/tips/index.tsx
index 0c95f25ff5..480f889b7c 100644
--- a/apps/desktop/src/components/tips/index.tsx
+++ b/apps/desktop/src/components/tips/index.tsx
@@ -98,6 +98,7 @@ export function TipHost() {
 
   return (
     <TipBubble
+      action={tip.action}
       anchor={anchor}
       keybind={tip.keybind}
       onClose={retireActiveTip}
diff --git a/apps/desktop/src/components/tips/local-setup-offer.test.ts b/apps/desktop/src/components/tips/local-setup-offer.test.ts
new file mode 100644
index 0000000000..251873d687
--- /dev/null
+++ b/apps/desktop/src/components/tips/local-setup-offer.test.ts
@@ -0,0 +1,144 @@
+/**
+ * The campaign offer against the live stores: eligibility fetch, the showTip
+ * wiring (button included), retirement, the reshow clock, and the cursor
+ * guard that keeps a campaign showing from restarting the rotation's walk.
+ */
+
+import { cleanup } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const getLocalModelsStatus = vi.fn()
+const getLocalCatalog = vi.fn()
+
+vi.mock('@/hermes', () => ({
+  getLocalCatalog: (...args: unknown[]) => getLocalCatalog(...args),
+  getLocalModelsStatus: (...args: unknown[]) => getLocalModelsStatus(...args)
+}))
+
+import { en } from '@/i18n/en'
+import { LOCAL_SETUP_TIP_ID } from '@/lib/tips/local-cta'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $connection } from '@/store/session'
+import { $activeTip, $lastTipId, $retiredTips, $tipShownAt } from '@/store/tips'
+
+import { offerLocalSetupTip, resetLocalSetupOfferCache } from './local-setup-offer'
+
+function primeEligibleBackend() {
+  getLocalModelsStatus.mockResolvedValue({ models: [], runtime_installed: false })
+  getLocalCatalog.mockResolvedValue({ models: [{ fits: true, id: 'qwen3.8-27b' }] })
+}
+
+async function flushFetch() {
+  await Promise.resolve()
+  await Promise.resolve()
+  await Promise.resolve()
+}
+
+describe('offerLocalSetupTip', () => {
+  beforeEach(() => {
+    resetLocalSetupOfferCache()
+    // The campaign ships behind --local like every local-models surface.
+    $localModelsEnabled.set(true)
+    $activeTip.set(null)
+    $retiredTips.set([])
+    $tipShownAt.set({})
+    $lastTipId.set(null)
+    $connection.set({ mode: 'local' } as never)
+    getLocalModelsStatus.mockReset()
+    getLocalCatalog.mockReset()
+  })
+
+  afterEach(() => {
+    cleanup()
+  })
+
+  it('holds the first quiet moment while the read flies, then shows on the next', async () => {
+    primeEligibleBackend()
+
+    const openLocalModels = vi.fn()
+
+    // First offer: fetch in flight — the moment is HELD (true, so the
+    // rotation's walk cannot take it and arm the cooldown ahead of the
+    // campaign), but nothing is on screen yet.
+    expect(offerLocalSetupTip(en.tips, openLocalModels)).toBe(true)
+    expect($activeTip.get()).toBeNull()
+    await flushFetch()
+
+    // Second offer: cached yes — bubble goes up with the CTA wired.
+    expect(offerLocalSetupTip(en.tips, openLocalModels)).toBe(true)
+
+    const tip = $activeTip.get()
+
+    expect(tip?.tipId).toBe(LOCAL_SETUP_TIP_ID)
+    expect(tip?.action?.label).toBe(en.tips.items['local-setup'].action)
+
+    tip?.action?.onSelect()
+    expect(openLocalModels).toHaveBeenCalledTimes(1)
+    // The CTA closes the bubble on its way to the pane.
+    expect($activeTip.get()).toBeNull()
+  })
+
+  it('never restarts the rotation walk: the campaign id stays out of the cursor', async () => {
+    primeEligibleBackend()
+    $lastTipId.set('cron')
+
+    offerLocalSetupTip(en.tips, vi.fn())
+    await flushFetch()
+    offerLocalSetupTip(en.tips, vi.fn())
+
+    expect($activeTip.get()?.tipId).toBe(LOCAL_SETUP_TIP_ID)
+    expect($lastTipId.get()).toBe('cron')
+  })
+
+  it('stays quiet on an ineligible machine without refetching', async () => {
+    getLocalModelsStatus.mockResolvedValue({ models: [{ id: 'staged' }], runtime_installed: true })
+    getLocalCatalog.mockResolvedValue({ models: [{ fits: true, id: 'qwen3.8-27b' }] })
+
+    offerLocalSetupTip(en.tips, vi.fn())
+    await flushFetch()
+
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    expect($activeTip.get()).toBeNull()
+    expect(getLocalModelsStatus).toHaveBeenCalledTimes(1)
+  })
+
+  it('honors the ✕ forever and the ignored-bubble clock for a week', async () => {
+    primeEligibleBackend()
+
+    $retiredTips.set([LOCAL_SETUP_TIP_ID])
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    expect(getLocalModelsStatus).not.toHaveBeenCalled()
+
+    $retiredTips.set([])
+    $tipShownAt.set({ [LOCAL_SETUP_TIP_ID]: Date.now() - 60_000 })
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    expect(getLocalModelsStatus).not.toHaveBeenCalled()
+  })
+
+  it('asks nothing of a remote backend', () => {
+    $connection.set({ mode: 'remote' } as never)
+
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    expect(getLocalModelsStatus).not.toHaveBeenCalled()
+  })
+
+  it('never runs without the --local launch flag (strict), even on an eligible machine', () => {
+    $localModelsEnabled.set(false)
+
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    // Declined before any read: no fetch, no held moment, no cooldown spent.
+    expect(getLocalModelsStatus).not.toHaveBeenCalled()
+    expect($activeTip.get()).toBeNull()
+  })
+
+  it('a failed read stands down for the session instead of retrying', async () => {
+    getLocalModelsStatus.mockRejectedValue(new Error('backend gone'))
+    getLocalCatalog.mockRejectedValue(new Error('backend gone'))
+
+    offerLocalSetupTip(en.tips, vi.fn())
+    await flushFetch()
+
+    expect(offerLocalSetupTip(en.tips, vi.fn())).toBe(false)
+    expect(getLocalModelsStatus).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/apps/desktop/src/components/tips/local-setup-offer.ts b/apps/desktop/src/components/tips/local-setup-offer.ts
new file mode 100644
index 0000000000..e8abdf2a82
--- /dev/null
+++ b/apps/desktop/src/components/tips/local-setup-offer.ts
@@ -0,0 +1,126 @@
+/**
+ * The local-setup campaign: one bubble on the model pill for machines that
+ * could run local models and haven't set them up.
+ *
+ * Not a rotation tip — a campaign the rotation CONSULTS first at each quiet
+ * due moment (use-tip-rotation.ts): conditional (most machines qualify or
+ * don't, permanently), actionable (it carries the one button a tip may
+ * have), and perishable (setting up local models — or the ✕ — ends it).
+ * A live "your GPU can run this, free and private" outranks the walk's
+ * "the model name is a button" whenever both are true, and an ignored
+ * bubble may return in a week rather than walking on forever.
+ *
+ * Eligibility is fetched, not assumed: the backend's own fit check (the
+ * same catalog `fits` the Local Models pane prices its hero with) decides
+ * whether this machine qualifies. Reads are lazy — nothing polls for a
+ * bubble. The first quiet due moment kicks one status+catalog read and
+ * holds the turn (no walk tip may spend the cooldown ahead of a pending
+ * campaign); the cached answer serves every later one. Completing
+ * setup flips the next read to ineligible, so the campaign retires itself
+ * without bookkeeping — and the cache dies with a connection change,
+ * because eligibility is a fact about the backend's machine.
+ */
+
+import { getLocalCatalog, getLocalModelsStatus } from '@/hermes'
+import type { Translations } from '@/i18n/types'
+import { LOCAL_SETUP_TIP_ID, localSetupDue, localSetupEligible } from '@/lib/tips/local-cta'
+import { $localModelsEnabled } from '@/store/local-models-flag'
+import { $connection } from '@/store/session'
+import { $retiredTips, $tipShownAt, dismissTip, showTip } from '@/store/tips'
+
+/** The pill the bubble points at — the same handle the rotation's
+ *  model-switch tip uses, so the two can never drift to different anchors. */
+const MODEL_PILL_TARGETS = ['[data-tour="model-pill"]'] as const
+
+let eligibilityCache: { eligible: boolean } | null = null
+let eligibilityInFlight = false
+let boundToConnection = false
+
+/** Reset the session cache — tests only. */
+export function resetLocalSetupOfferCache(): void {
+  eligibilityCache = null
+  eligibilityInFlight = false
+}
+
+/**
+ * Offer the campaign the current quiet moment. True = it put its bubble up
+ * and the moment is spent; false = the rotation's walk may have it.
+ */
+export function offerLocalSetupTip(copy: Translations['tips'], openLocalModels: () => void): boolean {
+  // Local models ship behind the --local launch flag; without it there is
+  // no Local Models pane for the button to open, so the campaign never runs
+  // (and never spends a status/catalog read).
+  if (!$localModelsEnabled.get()) {
+    return false
+  }
+
+  if ($retiredTips.get().includes(LOCAL_SETUP_TIP_ID)) {
+    return false
+  }
+
+  if (!localSetupDue(Date.now(), $tipShownAt.get()[LOCAL_SETUP_TIP_ID])) {
+    return false
+  }
+
+  // Local backends only: on a remote connection (cloud resolves to remote)
+  // the models would run on the far machine, and "stays on your computer"
+  // would be promising someone else's computer. Checked before the cache so
+  // a re-home mid-session can't serve a stale yes.
+  if (($connection.get()?.mode ?? null) !== 'local') {
+    return false
+  }
+
+  if (!boundToConnection) {
+    boundToConnection = true
+    $connection.listen(() => resetLocalSetupOfferCache())
+  }
+
+  if (!eligibilityCache) {
+    if (!eligibilityInFlight) {
+      eligibilityInFlight = true
+
+      void Promise.all([getLocalModelsStatus(), getLocalCatalog()])
+        .then(([status, catalog]) => {
+          eligibilityCache = {
+            eligible: localSetupEligible($connection.get()?.mode ?? null, status, catalog.models)
+          }
+        })
+        .catch(() => {
+          // No backend answer, no campaign this session. The next launch —
+          // or the next connection — asks again.
+          eligibilityCache = { eligible: false }
+        })
+        .finally(() => {
+          eligibilityInFlight = false
+        })
+    }
+
+    // Hold the moment while the read flies: nothing shows and no cooldown
+    // arms, so the next tick answers from the cache. Handing this moment to
+    // the rotation instead would put a walk tip up first and park the
+    // campaign behind the six-hour cooldown — the exact inversion of the
+    // priority. Costs an ineligible machine one 30s tick, once per session.
+    return true
+  }
+
+  if (!eligibilityCache.eligible) {
+    return false
+  }
+
+  showTip({
+    action: {
+      label: copy.items['local-setup'].action,
+      onSelect: () => {
+        dismissTip()
+        openLocalModels()
+      }
+    },
+    side: 'top',
+    targets: MODEL_PILL_TARGETS,
+    text: copy.items['local-setup'].text,
+    tipId: LOCAL_SETUP_TIP_ID,
+    title: copy.items['local-setup'].title
+  })
+
+  return true
+}
diff --git a/apps/desktop/src/components/tips/tip-bubble.tsx b/apps/desktop/src/components/tips/tip-bubble.tsx
index 103e39a45e..760a758b2a 100644
--- a/apps/desktop/src/components/tips/tip-bubble.tsx
+++ b/apps/desktop/src/components/tips/tip-bubble.tsx
@@ -21,8 +21,11 @@ import { useI18n } from '@/i18n'
 import { iconSize, X } from '@/lib/icons'
 import { useKeybindHint } from '@/lib/keybinds/use-keybind-hint'
 import type { TipSide } from '@/lib/tips/catalog'
+import type { ActiveTip } from '@/store/tips'
 
 export interface TipBubbleProps {
+  /** A call to action rendered as the bubble's one button. See ActiveTip. */
+  action?: ActiveTip['action']
   /** The element the arrow points at. */
   anchor: HTMLElement
   /** Keybind action id; its live combo prints under the text. */
@@ -34,7 +37,7 @@ export interface TipBubbleProps {
   title?: string
 }
 
-export function TipBubble({ anchor, keybind, onClose, side, text, title }: TipBubbleProps) {
+export function TipBubble({ action, anchor, keybind, onClose, side, text, title }: TipBubbleProps) {
   const { t } = useI18n()
   const combo = useKeybindHint(keybind ?? '')
   const anchorRef = useRef<HTMLElement | null>(anchor)
@@ -81,6 +84,19 @@ export function TipBubble({ anchor, keybind, onClose, side, text, title }: TipBu
               {text}
             </p>
             {combo && <KbdCombo className="mt-2" combo={combo} size="sm" variant="inverted" />}
+            {action && (
+              // The CTA: still not a focus trap — the button is tabbable when
+              // reached but nothing steals the caret to get there. Inverted
+              // fill against the accent surface, same currentColor discipline
+              // as the rest of the bubble.
+              <button
+                className="mt-2.5 inline-flex cursor-pointer items-center rounded-md bg-current/15 px-2.5 py-1 text-[length:var(--conversation-caption-font-size)] font-semibold transition-colors hover:bg-current/25"
+                onClick={action.onSelect}
+                type="button"
+              >
+                {action.label}
+              </button>
+            )}
           </div>
           <button
             aria-label={t.tips.close}
diff --git a/apps/desktop/src/components/tips/use-tip-rotation.ts b/apps/desktop/src/components/tips/use-tip-rotation.ts
index ff8fe433df..53a7310ab7 100644
--- a/apps/desktop/src/components/tips/use-tip-rotation.ts
+++ b/apps/desktop/src/components/tips/use-tip-rotation.ts
@@ -20,7 +20,9 @@
  */
 
 import { useEffect } from 'react'
+import { useNavigate } from 'react-router'
 
+import { SETTINGS_ROUTE } from '@/app/routes'
 import type { Translations } from '@/i18n/types'
 import { resolveTipAnchor } from '@/lib/tips/anchor'
 import { TIP_CATALOG } from '@/lib/tips/catalog'
@@ -28,6 +30,8 @@ import { nextTip } from '@/lib/tips/rotation'
 import { $awaitingResponse, $busy } from '@/store/session'
 import { $activeTip, $lastTipId, $nextTipAt, $retiredTips, $tipsEnabled, showTip } from '@/store/tips'
 
+import { offerLocalSetupTip } from './local-setup-offer'
+
 const TICK_MS = 30_000
 /** Nothing in the first stretch of a launch, however long the cooldown says
  *  it's been: you opened the app to do a thing, and the tip can wait until
@@ -60,6 +64,8 @@ function appIsQuiet(lastTypedAt: number): boolean {
 
 /** Drive the ambient rotation for as long as the host is mounted. */
 export function useTipRotation(copy: Translations['tips']) {
+  const navigate = useNavigate()
+
   useEffect(() => {
     let lastTypedAt = 0
     let settledAt = Date.now() + SETTLE_MIN_MS + Math.random() * SETTLE_SPREAD_MS
@@ -83,6 +89,18 @@ export function useTipRotation(copy: Translations['tips']) {
         return
       }
 
+      // Campaigns outrank the walk: a conditional, actionable tip that is
+      // live right now (the local-setup CTA) says something about THIS
+      // machine, which beats the catalog's standing introduction. It shares
+      // the cooldown, so taking the moment still costs it the usual hours.
+      if (
+        offerLocalSetupTip(copy, () => {
+          navigate(`${SETTINGS_ROUTE}?tab=providers&pview=local`)
+        })
+      ) {
+        return
+      }
+
       // Only tips with something on screen to point at are candidates, so the
       // rotation never burns a turn on a pane the user isn't showing.
       const onScreen = TIP_CATALOG.filter(tip => resolveTipAnchor(document, tip.targets))
@@ -128,5 +146,5 @@ export function useTipRotation(copy: Translations['tips']) {
       window.clearInterval(timer)
       window.removeEventListener('keydown', noteTyping, true)
     }
-  }, [copy])
+  }, [copy, navigate])
 }
diff --git a/apps/desktop/src/components/ui/badge.tsx b/apps/desktop/src/components/ui/badge.tsx
index d3a8a50449..3d8c43d8f8 100644
--- a/apps/desktop/src/components/ui/badge.tsx
+++ b/apps/desktop/src/components/ui/badge.tsx
@@ -13,6 +13,7 @@ const badgeVariants = cva(
       variant: {
         default: 'bg-primary/10 text-primary',
         muted: 'bg-muted text-muted-foreground',
+        success: 'bg-emerald-500/10 text-emerald-600 dark:text-emerald-300',
         warn: 'bg-amber-500/10 text-amber-600 dark:text-amber-300',
         destructive: 'bg-destructive/10 text-destructive',
         outline: 'border border-(--ui-stroke-secondary) text-muted-foreground',
diff --git a/apps/desktop/src/global.d.ts b/apps/desktop/src/global.d.ts
index 3c0bc4de93..8067308df7 100644
--- a/apps/desktop/src/global.d.ts
+++ b/apps/desktop/src/global.d.ts
@@ -52,7 +52,10 @@ declare global {
       // with an error code when the sessionId is empty/invalid. `watch` opens
       // a spectator window (lazy resume — no agent build) for live-streaming
       // a running subagent's session.
-      openSessionWindow: (sessionId: string, opts?: { watch?: boolean }) => Promise<{ ok: boolean; error?: string }>
+      openSessionWindow: (
+        sessionId: string,
+        opts?: { profile?: null | string; watch?: boolean }
+      ) => Promise<{ ok: boolean; error?: string }>
       // Resume this session in the user's own terminal emulator (`hermes --tui
       // --resume <id>`) — the external terminal, not the in-app pane.
       openSessionInTerminal: (
@@ -301,6 +304,9 @@ declare global {
       glassSupported?: boolean
       /** Main-process fact: this OS can do any translucency at all (not Linux). */
       translucencySupported?: boolean
+      /** Launch flag: the app was started with --local, enabling the
+       *  local-models GUI surfaces. Absent/false = every local surface hides. */
+      localModelsEnabled?: boolean
       setTranslucency?: (payload: TranslucencyState) => void
       setKeepAwake?: (on: boolean) => void
       setDisableF12?: (blocked: boolean) => void
@@ -499,6 +505,8 @@ declare global {
       cancelBootstrap: () => Promise<{ ok: boolean; cancelled: boolean }>
       onBootstrapEvent: (callback: (payload: DesktopBootstrapEvent) => void) => () => void
       getVersion: () => Promise<DesktopVersionInfo>
+      /** Restart the app in place — loads the swapped bundle when bundleSwapPending. */
+      relaunchApp?: () => Promise<void>
       getRemoteDisplayReason?: () => Promise<string | null>
       updates: {
         check: () => Promise<DesktopUpdateStatus>
@@ -579,6 +587,9 @@ export interface DesktopVersionInfo {
   bundleOutOfSync?: boolean
   /** Commits under apps/desktop/ the running bundle is missing (null unknown). */
   bundleCommitsBehind?: null | number
+  /** True when the bundle on disk is newer than the running process — a plain
+   *  app restart (no rebuild, no installer) is enough to load it. */
+  bundleSwapPending?: boolean
 }
 
 export type DesktopUninstallMode = 'full' | 'gui' | 'lite'
diff --git a/apps/desktop/src/hermes.test.ts b/apps/desktop/src/hermes.test.ts
index 00611c6f68..ec9b94ada6 100644
--- a/apps/desktop/src/hermes.test.ts
+++ b/apps/desktop/src/hermes.test.ts
@@ -290,6 +290,41 @@ describe('Hermes REST helpers', () => {
     expect(paths).toContainEqual(expect.stringContaining('exclude_sources=cron%2Ctool'))
   })
 
+  it('keeps per-slice errors on the legacy fallback so a cron failure does not taint recents', async () => {
+    resetSidebarBatchCapability()
+    const row = (id: string) => ({ id, title: id, profile: 'default' })
+
+    api.mockImplementation(({ path }: { path: string }) => {
+      if (path.startsWith('/api/profiles/sessions/sidebar')) {
+        return Promise.reject(new Error('404: {"detail":"No such API endpoint: /api/profiles/sessions/sidebar"}'))
+      }
+
+      if (path.includes('source=cron')) {
+        return Promise.resolve({
+          ...emptySessionsResponse,
+          sessions: [],
+          errors: [{ profile: 'default', error: 'disk I/O error' }]
+        })
+      }
+
+      return Promise.resolve({ ...emptySessionsResponse, sessions: [row('recent-1')] })
+    })
+
+    const result = await listSidebarSessions({
+      recentsProfile: 'default',
+      recentsLimit: 20,
+      recentsExclude: [],
+      cronLimit: 50,
+      messagingLimit: 100,
+      messagingExclude: []
+    })
+
+    expect(result.recents.sessions.map(s => s.id)).toEqual(['recent-1'])
+    expect(result.recents.errors).toBeUndefined()
+    expect(result.cron.errors).toEqual([{ profile: 'default', error: 'disk I/O error' }])
+    expect(result.errors).toBeUndefined()
+  })
+
   it('remembers endpoint-missing and skips re-probing the batched route on later refreshes', async () => {
     api.mockImplementation(({ path }: { path: string }) =>
       path.startsWith('/api/profiles/sessions/sidebar')
diff --git a/apps/desktop/src/hermes.ts b/apps/desktop/src/hermes.ts
index 6242ef5998..f5fb2ee7bd 100644
--- a/apps/desktop/src/hermes.ts
+++ b/apps/desktop/src/hermes.ts
@@ -18,6 +18,7 @@ export {
 export type { ProfileScope } from './api/client'
 export * from './api/config'
 export * from './api/cron'
+export * from './api/local-models'
 export * from './api/mcp'
 export * from './api/messaging'
 export * from './api/models'
@@ -39,6 +40,7 @@ export type {
   AnalyticsTotals,
   AudioSpeakResponse,
   AudioTranscriptionResponse,
+  AudioTtsLeaseResponse,
   AutomationBlueprint,
   AutomationBlueprintField,
   AuxiliaryModelsResponse,
diff --git a/apps/desktop/src/i18n/ar.ts b/apps/desktop/src/i18n/ar.ts
index 656414a5e2..295cc157b0 100644
--- a/apps/desktop/src/i18n/ar.ts
+++ b/apps/desktop/src/i18n/ar.ts
@@ -487,6 +487,8 @@ export const ar = defineLocale({
       embedsAlways: 'دائما',
       embedsOff: 'إيقاف',
       embedsReset: count => `إعادة تعيين ${count} ${count === 1 ? 'خدمة مسموح بها' : 'خدمة مسموح بها'}`,
+      resumeLastSessionTitle: 'إعادة فتح آخر محادثة عند التشغيل',
+      resumeLastSessionDesc: 'متابعة من حيث توقفت عند بدء التطبيق. أوقفه للبدء دائمًا بمحادثة جديدة.',
       product: 'مبسط',
       productDesc: 'عرض أنظف يركز على النتيجة.',
       technical: 'تقني',
@@ -672,6 +674,10 @@ export const ar = defineLocale({
       bundleOutOfSyncDesc:
         'تم تحديث وقت تشغيل Hermes، لكن تطبيق سطح المكتب نفسه لا يزال إصدارًا قديمًا — لن تظهر ميزات الواجهة الجديدة (مثل Bot Mode) حتى يتم تحديث التطبيق. شغّل التحديث أدناه لإعادة بناء التطبيق. إذا لم يختفِ هذا التحذير، فأعد التثبيت من أحدث مثبّت لسطح المكتب.',
       bundleOutOfSyncAction: 'الحصول على المثبّت',
+      bundleSwapPending: 'أعد التشغيل لإكمال التحديث',
+      bundleSwapPendingDesc:
+        'تم تثبيت التطبيق المحدَّث بالفعل — يكفي إعادة تشغيل Hermes لتحميله. لن تتأثر المحادثات أو الإعدادات.',
+      bundleSwapPendingAction: 'إعادة تشغيل Hermes',
       updates: 'التحديثات',
       checkNow: 'التحقق الآن',
       checking: 'جار التحقق...',
@@ -2886,9 +2892,10 @@ export const ar = defineLocale({
         title: 'المرفقات والأوامر',
         text: 'اكتب @ لإحضار ملف إلى المحادثة، و / لتشغيل أمر.'
       },
-      'model-switch': {
-        title: 'بدّل النموذج أثناء المحادثة',
-        text: 'اسم النموذج زر. غيّره كلما تغيّرت طبيعة العمل.'
+      'local-setup': {
+        title: 'هذا الجهاز يمكنه تشغيل النماذج محليًا',
+        text: 'عتادك قادر على تشغيل نموذج محلي. تبقى محادثاتك على جهازك ولا تكلف شيئًا.',
+        action: 'إعداد الآن'
       },
       'right-pane': {
         title: 'لوحة العمل',
diff --git a/apps/desktop/src/i18n/en.ts b/apps/desktop/src/i18n/en.ts
index a06c363c3e..0428072086 100644
--- a/apps/desktop/src/i18n/en.ts
+++ b/apps/desktop/src/i18n/en.ts
@@ -395,6 +395,7 @@ export const en: Translations = {
       providerAccounts: 'Accounts',
       providerApiKeys: 'API keys',
       providerCustomEndpoints: 'Custom Endpoints',
+      providerLocalModels: 'Local Models',
       gateway: 'Gateways',
       apiKeys: 'Tools & Keys',
       keybinds: 'Keyboard Shortcuts',
@@ -607,6 +608,8 @@ export const en: Translations = {
       embedsAlways: 'Always',
       embedsOff: 'Off',
       embedsReset: (count: number) => `Reset ${count} allowed ${count === 1 ? 'service' : 'services'}`,
+      resumeLastSessionTitle: 'Reopen Last Chat on Launch',
+      resumeLastSessionDesc: 'When enabled, the app reopens your most recent chat on cold start. Turn off to always start with a fresh new chat.',
       product: 'Product',
       productDesc: 'Human-friendly tool activity with concise summaries.',
       technical: 'Technical',
@@ -674,6 +677,10 @@ export const en: Translations = {
       bundleOutOfSyncDesc:
         'The Hermes runtime was updated, but the desktop app itself is still an older build — new interface features (like Bot Mode) will be missing until it updates. Run the update below to rebuild the app. If that doesn\u2019t clear this warning, reinstall from the latest desktop installer.',
       bundleOutOfSyncAction: 'Get the installer',
+      bundleSwapPending: 'Restart to finish the update',
+      bundleSwapPendingDesc:
+        'The updated app is already installed — Hermes only needs to restart to load it. Chats and settings are untouched.',
+      bundleSwapPendingAction: 'Restart Hermes',
       updates: 'Updates',
       checkNow: 'Check now',
       checking: 'Checking…',
@@ -1117,6 +1124,124 @@ export const en: Translations = {
         curator: { label: 'Curator', hint: 'Skill-usage review' }
       }
     },
+    localModels: {
+      title: 'Local Models',
+      runtimeTitle: 'Local runtime',
+      runtimeReady: backend => `Ready · ${backend}`,
+      serverRunning: 'Running',
+      runtimeInstalled: 'llama.cpp runtime installed',
+      runtimeInstalledDetail: (tag, backend) =>
+        `Build ${tag}, ${backend} backend. Hermes starts and manages the server for you.`,
+      installTitle: 'Install the local runtime',
+      installDetail:
+        'Downloads the llama.cpp inference engine (a few hundred MB). Models you download run entirely on this machine — no account, nothing leaves your computer.',
+      installAction: 'Install runtime',
+      installing: 'Installing runtime…',
+      installFailed: 'Runtime install failed',
+      hardwareTitle: 'This machine',
+      hardwareLoading: 'Checking your hardware…',
+      vram: label => `${label} GPU memory`,
+      ram: label => `${label} RAM`,
+      unifiedMemory: 'Unified memory',
+      modelsTitle: 'Models',
+      recommended: 'Recommended',
+      /* The Recommended badge's tooltip, keyed by the resolver branch that
+         made the pick. Qualitative on purpose: predictions order candidates,
+         they are not promises to print. */
+      recommendedReason: {
+        'best-quality-resident':
+          'The highest-quality model that runs entirely on your GPU at full speed. Picks weigh quality against predicted speed on this hardware.',
+        'speed-gated-quality':
+          'A higher-quality model fits this machine but would respond too slowly on its memory bandwidth — this is the best model that stays fast.',
+        'fastest-resident':
+          'No model reaches full speed on this hardware; this one comes closest while running entirely in GPU memory.',
+        'least-painful-spilled': 'No model fits entirely in GPU memory here — this one runs best from system RAM.'
+      } as Record<string, string>,
+      downloaded: 'Downloaded',
+      downloadAction: size => `Download · ${size}`,
+      downloadProgress: (done, total) => `Downloading ${done} of ${total}`,
+      downloadDoneToast: model => `${model} is ready.`,
+      installDoneToast: 'Local runtime installed and ready.',
+      quickstartTitle: 'Run a model on this machine',
+      quickstartDetail: (model, size) =>
+        `One click sets everything up: the local engine, ${model} (${size} download), and your default for new chats. Nothing leaves this computer.`,
+      quickstartDetailReady: model =>
+        `One click makes ${model} your default for new chats. Everything runs on this machine.`,
+      quickstartAction: 'Set up for me',
+      quickstartConfigure: 'Configure…',
+      quickstartDoneToast: model => `${model} is set up — new chats run on this machine.`,
+      quickstartFailed: 'Local model setup failed',
+      quickstartStageEngine: 'Engine',
+      quickstartStageModel: 'Model',
+      quickstartStageFinish: 'Finish',
+      useAction: 'Use',
+      activePill: 'Default',
+      updateTitle: 'Engine update available',
+      updateDetail: (next, current) =>
+        `A newer llama.cpp build (${next}) is ready to install — you're on ${current}. Models keep working during the download.`,
+      updateAction: 'Update engine',
+      updating: 'Updating engine…',
+      upToDateTitle: 'Engine up to date',
+      upToDateDetail: (tag, backend) => `Running llama.cpp ${tag} (${backend}) — the latest build Hermes ships.`,
+      updateToast: next => `A newer local engine build (${next}) is available. Update from Settings → Local Models.`,
+      activeDetail: 'New chats use this model — it loads when you send your first message',
+      activeNotLoaded: 'Loads on your first message',
+      loadedPill: 'In memory',
+      placementResident: 'all on GPU',
+      placementSpilled: 'partly in RAM',
+      placementResidentTip: 'Running entirely in GPU memory at this context window — full speed.',
+      placementSpilledTip:
+        'Part of this model runs from system RAM — it works, but slower. A more compact build or a smaller context would fit fully.',
+      loadingPill: 'Loading…',
+      ejectTip: 'Free GPU memory (loads again on the next message)',
+      ejected: 'Model unloaded — GPU memory freed.',
+      ejectFailed: 'Could not unload the model',
+      stopServer: 'Turn off',
+      startServer: 'Turn on',
+      runtimeRunningDetail:
+        'The local server is running. Turning it off frees all GPU memory and stops new chats from using local models until you turn it back on.',
+      serverStopped: 'Local server stopped — GPU memory freed.',
+      serverStarted: 'Local server running.',
+      serverStopFailed: 'Could not stop the local server',
+      serverStartFailed: 'Could not start the local server',
+      activating: 'Starting…',
+      activateFailed: model => `Could not switch to ${model}`,
+      activateDoneToast: model => `New chats use ${model}.`,
+      downloadFailed: model => `Download of ${model} failed`,
+      pillFitsGpu: 'Fits your GPU',
+      pillUsesRam: 'Uses system RAM',
+      pillTooBig: 'Too big for this machine',
+      browseTitle: 'Find more models',
+      browseHint:
+        'Search all of Hugging Face. Models you download here are sized to your machine automatically, but not tested by us.',
+      browsePlaceholder: 'Search models by name or author…',
+      browseSearching: 'Searching Hugging Face',
+      browseListing: 'Reading model files',
+      browseShowFiles: 'Show files',
+      browseRefresh: 'Refresh',
+      browseDownloads: 'downloads',
+      browseLikes: 'likes',
+      browseGated: 'requires Hugging Face sign-in',
+      browseNoGguf: 'No compatible model files found.',
+      browseFitUnknown: 'Fit unknown',
+      browseAlreadyDownloaded: 'Already downloaded.',
+      addedByYou: 'Added by you',
+      browseDownloadStarted: 'Downloading {name}',
+      browseDownloadAria: 'Download {name}',
+      sideloadButton: 'Add model file',
+      sideloadTitle: 'Choose a GGUF model file',
+      sideloadDone: 'Added {name}.',
+      sideloadAlreadyPresent: 'Already in your library.',
+      pillFullContext: max => `Full ${max} context`,
+      pillFullContextTip: "Runs at the model's complete context window from the start",
+      pillUpTo: max => `Up to ${max} context`,
+      pillGrowsTip: 'Grows automatically as your conversation needs more room',
+      pillVision: 'Sees images',
+      deleteAction: 'Delete model',
+      deleteConfirm: model => `Delete ${model} from disk?`,
+      deleted: model => `${model} deleted.`,
+      deleteFailed: 'Delete failed'
+    },
     providers: {
       connectAccount: 'Connect an account',
       haveApiKey: 'Have an API key instead?',
@@ -2762,6 +2887,8 @@ export const en: Translations = {
     connected: 'Connected',
     featuredPitch: 'One subscription, 300+ frontier models — the recommended way to run Hermes',
     fireworksPitch: 'Direct model API — Fireworks-hosted frontier models',
+    localModelsTitle: 'Run models locally',
+    localModelsPitch: 'No account needed — download a model and run it on this machine',
     openRouterPitch: 'One key, hundreds of models — a solid default',
     apiKeyOptions: {
       fireworks: {
@@ -2835,6 +2962,9 @@ export const en: Translations = {
     noModels: 'No models found.',
     addProvider: 'Add provider',
     loadFailed: 'Could not load models',
+    loadingIntoMemory: 'Loading into memory',
+    downloading: 'Downloading',
+    localDownloadsHeading: 'Local',
     noAuthenticatedProviders: 'No authenticated providers.',
     pro: 'Pro',
     proNeedsSubscription: 'Pro models need a paid Nous subscription.',
@@ -2940,13 +3070,17 @@ export const en: Translations = {
       resetStatusbar: 'Reset to defaults',
       toggleApprovalMode: 'Approvals',
       toggleBackendVersion: 'Backend version',
+      toggleCacheHitRate: 'Cache hit rate',
       toggleCommandCenter: 'Command Center',
       toggleContextUsage: 'Context meter',
       toggleRunningTimer: 'Turn timer',
       toggleSessionTimer: 'Session timer',
       toggleTerminal: 'Terminal',
+      toggleTokensPerSecond: 'Tokens per second',
       toggleVersion: 'Version & updates',
       toggleWorkspace: 'Workspace',
+      cacheHitRateTitle: 'Prompt cache hit rate this session — cached tokens cost less, so higher is cheaper',
+      tokensPerSecondTitle: 'Output tokens per second, averaged over the last 10 model calls',
       agents: 'Agents',
       closeAgents: 'Close agents',
       openAgents: 'Open agents',
@@ -2961,6 +3095,15 @@ export const en: Translations = {
       openStarmap: 'Open memory graph',
       turnRunning: 'Running',
       contextUsage: 'Context usage',
+      systemResources: {
+        title: 'System Resources',
+        loading: 'Resources…',
+        gpuUtilization: 'GPU utilization',
+        gpuMemory: 'GPU memory',
+        ram: 'RAM',
+        unifiedNote: 'Unified memory — the GPU and system share this pool.',
+        toggle: 'System resources'
+      },
       contextUsagePanel: {
         categories: {
           conversation: 'Conversation',
@@ -3217,6 +3360,8 @@ export const en: Translations = {
       loadingSession: 'Loading session',
       showEarlier: 'Show earlier messages',
       loadingResponse: 'Hermes is loading a response',
+      loadingLocalModel: model => `Loading ${model} into memory`,
+      processingPrompt: 'Processing prompt',
       resumeWhenBackgroundDone: count =>
         count === 1
           ? 'Will resume when the background task finishes'
@@ -3541,9 +3686,10 @@ export const en: Translations = {
         title: 'Attach and command',
         text: 'Type @ to bring a file into the conversation, / to run a command.'
       },
-      'model-switch': {
-        title: 'Switch models mid-thread',
-        text: 'The model name is a button. Change it whenever the work changes shape.'
+      'local-setup': {
+        title: 'This machine can run models locally',
+        text: 'Your hardware can serve a local model. Chats stay on your computer and cost nothing.',
+        action: 'Set it up'
       },
       'right-pane': {
         title: 'The working pane',
diff --git a/apps/desktop/src/i18n/ja.ts b/apps/desktop/src/i18n/ja.ts
index 585f229a83..81675d1d4b 100644
--- a/apps/desktop/src/i18n/ja.ts
+++ b/apps/desktop/src/i18n/ja.ts
@@ -278,6 +278,7 @@ export const ja = defineLocale({
       providerAccounts: 'アカウント',
       providerApiKeys: 'API キー',
       providerCustomEndpoints: 'カスタムエンドポイント',
+      providerLocalModels: 'ローカルモデル',
       gateway: 'ゲートウェイ',
       apiKeys: 'ツールとキー',
       keybinds: 'キーボードショートカット',
@@ -431,6 +432,8 @@ export const ja = defineLocale({
       embedsAlways: '常に',
       embedsOff: 'オフ',
       embedsReset: (count: number) => `許可した${count}件のサービスをリセット`,
+      resumeLastSessionTitle: '起動時に前回のチャットを再開',
+      resumeLastSessionDesc: 'オンの場合、コールドスタート時に直近のチャットを再び開きます。オフにすると常に新しいチャットから始まります。',
       product: 'プロダクト',
       productDesc: '読みやすいツール活動と簡潔な要約を表示します。',
       technical: 'テクニカル',
@@ -721,6 +724,10 @@ export const ja = defineLocale({
       bundleOutOfSyncDesc:
         'Hermes ランタイムは更新されましたが、デスクトップアプリ自体は古いビルドのままです。アプリを更新するまで、新しいインターフェース機能(Bot Mode など)は表示されません。下の更新を実行してアプリを再ビルドしてください。それでもこの警告が消えない場合は、最新のデスクトップインストーラーから再インストールしてください。',
       bundleOutOfSyncAction: 'インストーラーを入手',
+      bundleSwapPending: '再起動して更新を完了',
+      bundleSwapPendingDesc:
+        '更新されたアプリはすでにインストール済みです。Hermes を再起動するだけで新しいビルドが読み込まれます。チャットや設定はそのまま保持されます。',
+      bundleSwapPendingAction: 'Hermes を再起動',
       updates: '更新',
       checkNow: '今すぐ確認',
       checking: '確認中…',
@@ -1023,6 +1030,111 @@ export const ja = defineLocale({
         curator: { label: 'キュレーター', hint: 'スキル使用レビュー' }
       }
     },
+    localModels: {
+      title: 'ローカルモデル',
+      runtimeTitle: 'ローカルランタイム',
+      runtimeReady: backend => `準備完了 · ${backend}`,
+      serverRunning: '実行中',
+      runtimeInstalled: 'llama.cpp ランタイムをインストール済み',
+      runtimeInstalledDetail: (tag, backend) =>
+        `ビルド ${tag}、${backend} バックエンド。サーバーは Hermes が起動・管理します。`,
+      installTitle: 'ローカルランタイムをインストール',
+      installDetail:
+        'llama.cpp 推論エンジン（数百 MB）をダウンロードします。ダウンロードしたモデルはすべてこのマシン上で動作します——アカウント不要、データが外部に送られることはありません。',
+      installAction: 'ランタイムをインストール',
+      installing: 'ランタイムをインストール中…',
+      installFailed: 'ランタイムのインストールに失敗しました',
+      hardwareTitle: 'このマシン',
+      hardwareLoading: 'ハードウェアを確認中…',
+      vram: label => `GPU メモリ ${label}`,
+      ram: label => `RAM ${label}`,
+      unifiedMemory: 'ユニファイドメモリ',
+      modelsTitle: 'モデル',
+      recommended: 'おすすめ',
+      recommendedReason: {
+        'best-quality-resident':
+          'GPU に完全に載り、フルスピードで動くモデルの中で最高品質です。おすすめは品質とこのハードウェアでの予測速度を両立させて選ばれます。',
+        'speed-gated-quality':
+          'より高品質なモデルもこのマシンに載りますが、メモリ帯域の制約で応答が遅くなります — これは速度を保てる最良のモデルです。',
+        'fastest-resident':
+          'このハードウェアでフルスピードに達するモデルはありません。GPU メモリ内で動くものの中で最速です。',
+        'least-painful-spilled':
+          'GPU メモリに完全に収まるモデルはありません — システム RAM からの実行で最も快適なモデルです。'
+      } as Record<string, string>,
+      downloaded: 'ダウンロード済み',
+      downloadAction: size => `ダウンロード · ${size}`,
+      downloadProgress: (done, total) => `ダウンロード中 ${done} / ${total}`,
+      downloadDoneToast: model => `${model} の準備ができました。`,
+      installDoneToast: 'ローカルランタイムのインストールが完了しました。',
+      useAction: '使用する',
+      activePill: 'デフォルト',
+      updateTitle: 'エンジンの更新があります',
+      updateDetail: (next, current) =>
+        `新しい llama.cpp ビルド（${next}）をインストールできます——現在は ${current} です。ダウンロード中もモデルは引き続き使えます。`,
+      updateAction: 'エンジンを更新',
+      updating: 'エンジンを更新中…',
+      upToDateTitle: 'エンジンは最新です',
+      upToDateDetail: (tag, backend) => `llama.cpp ${tag}（${backend}）で動作中——Hermes が提供する最新ビルドです。`,
+      updateToast: next =>
+        `ローカルエンジンの新しいビルド（${next}）があります。設定 → ローカルモデル から更新できます。`,
+      activeDetail: '新しいチャットはこのモデルを使用——最初のメッセージ送信時に読み込みます',
+      activeNotLoaded: '最初のメッセージで読み込みます',
+      loadedPill: '読み込み済み',
+      placementResident: 'すべて GPU 上',
+      placementSpilled: '一部 RAM 上',
+      placementResidentTip: 'このコンテキストウィンドウで GPU メモリ内で完全に動作しています — フルスピード。',
+      placementSpilledTip:
+        'モデルの一部がシステム RAM から動作しています — 動作しますが遅くなります。よりコンパクトなビルドか小さいコンテキストなら完全に収まります。',
+      loadingPill: '読み込み中…',
+      ejectTip: 'GPU メモリを解放（必要時に再読み込み）',
+      ejected: 'モデルをアンロードしました——GPU メモリを解放しました。',
+      ejectFailed: 'モデルをアンロードできませんでした',
+      stopServer: 'オフにする',
+      startServer: 'オンにする',
+      runtimeRunningDetail:
+        'ローカルサーバーが実行中です。オフにすると GPU メモリを全て解放し、再度オンにするまで新しいチャットはローカルモデルを使用しません。',
+      serverStopped: 'ローカルサーバーを停止しました——GPU メモリを解放しました。',
+      serverStarted: 'ローカルサーバー実行中。',
+      serverStopFailed: 'ローカルサーバーを停止できませんでした',
+      serverStartFailed: 'ローカルサーバーを起動できませんでした',
+      activating: '起動中…',
+      activateFailed: model => `${model} への切り替えに失敗しました`,
+      activateDoneToast: model => `新しいチャットは ${model} を使用します。`,
+      downloadFailed: model => `${model} のダウンロードに失敗しました`,
+      pillFitsGpu: 'GPU に完全に収まります',
+      pillUsesRam: 'システム RAM を使用',
+      pillTooBig: 'このマシンには大きすぎます',
+      browseTitle: 'さらにモデルを探す',
+      browseHint:
+        'Hugging Face 全体を検索できます。ここでダウンロードしたモデルは自動でマシンに合わせて動作しますが、当方でのテストは行われていません。',
+      browsePlaceholder: 'モデル名または作者で検索…',
+      browseSearching: 'Hugging Face を検索中',
+      browseListing: 'モデルファイルを読み込み中',
+      browseShowFiles: 'ファイルを表示',
+      browseRefresh: '更新',
+      browseDownloads: 'ダウンロード',
+      browseLikes: 'いいね',
+      browseGated: 'Hugging Face へのサインインが必要',
+      browseNoGguf: '互換性のあるモデルファイルが見つかりません。',
+      browseFitUnknown: '適合状況は不明',
+      browseAlreadyDownloaded: 'ダウンロード済みです。',
+      addedByYou: 'あなたが追加',
+      browseDownloadStarted: '{name} をダウンロード中',
+      browseDownloadAria: '{name} をダウンロード',
+      sideloadButton: 'モデルファイルを追加',
+      sideloadTitle: 'GGUF モデルファイルを選択',
+      sideloadDone: '{name} を追加しました。',
+      sideloadAlreadyPresent: '既にライブラリにあります。',
+      pillFullContext: max => `フル ${max} コンテキスト`,
+      pillFullContextTip: '最初からモデルの完全なコンテキストウィンドウで動作します',
+      pillUpTo: max => `最大 ${max} コンテキスト`,
+      pillGrowsTip: '会話が必要とするにつれて自動的に拡張します',
+      pillVision: '画像対応',
+      deleteAction: 'モデルを削除',
+      deleteConfirm: model => `${model} をディスクから削除しますか？`,
+      deleted: model => `${model} を削除しました。`,
+      deleteFailed: '削除に失敗しました'
+    },
     providers: {
       connectAccount: 'アカウントを接続',
       haveApiKey: 'API キーをお持ちですか？',
@@ -2406,6 +2518,8 @@ export const ja = defineLocale({
     connected: '接続済み',
     featuredPitch: '1 つのサブスクリプションで 300 以上の最先端モデル — Hermes を実行するための推奨方法',
     fireworksPitch: '直接モデル API — Fireworks がホストする最先端モデル',
+    localModelsTitle: 'モデルをローカルで実行',
+    localModelsPitch: 'アカウント不要——モデルをダウンロードしてこのマシンで実行',
     openRouterPitch: '1 つのキーで数百のモデル — 堅実なデフォルト',
     apiKeyOptions: {
       fireworks: {
@@ -2479,6 +2593,8 @@ export const ja = defineLocale({
     noModels: 'モデルが見つかりません。',
     addProvider: 'プロバイダーを追加',
     loadFailed: 'モデルを読み込めませんでした',
+    downloading: 'ダウンロード中',
+    localDownloadsHeading: 'ローカル',
     noAuthenticatedProviders: '認証済みプロバイダーがありません。',
     pro: 'Pro',
     proNeedsSubscription: 'Pro モデルには有料の Nous サブスクリプションが必要です。',
@@ -2591,6 +2707,15 @@ export const ja = defineLocale({
       openStarmap: 'メモリグラフを開く',
       turnRunning: '実行中',
       contextUsage: 'コンテキスト使用状況',
+      systemResources: {
+        title: 'システムリソース',
+        loading: 'リソース…',
+        gpuUtilization: 'GPU 使用率',
+        gpuMemory: 'GPU メモリ',
+        ram: 'RAM',
+        unifiedNote: 'ユニファイドメモリ——GPU とシステムがこのプールを共有します。',
+        toggle: 'システムリソース'
+      },
       contextUsagePanel: {
         categories: {
           conversation: '会話',
@@ -3156,9 +3281,10 @@ export const ja = defineLocale({
         title: 'ファイルとコマンド',
         text: '@ でファイルを会話に取り込み、/ でコマンドを実行できます。'
       },
-      'model-switch': {
-        title: '会話の途中でモデルを変更',
-        text: 'モデル名はボタンです。作業の性質が変わったら切り替えてください。'
+      'local-setup': {
+        title: 'このマシンはローカルでモデルを実行できます',
+        text: 'お使いのハードウェアでローカルモデルを動かせます。会話はこのコンピュータから出ず、料金もかかりません。',
+        action: 'セットアップ'
       },
       'right-pane': {
         title: '作業用ペイン',
diff --git a/apps/desktop/src/i18n/ru.ts b/apps/desktop/src/i18n/ru.ts
index 3442cc5ae9..d9bf0a06db 100644
--- a/apps/desktop/src/i18n/ru.ts
+++ b/apps/desktop/src/i18n/ru.ts
@@ -593,6 +593,8 @@ export const ru = defineLocale({
       embedsOff: 'Выкл',
       embedsReset: count =>
         `Сбросить ${count} ${RU_NOUN(count, 'разрешённый сервис', 'разрешённых сервиса', 'разрешённых сервисов')}`,
+      resumeLastSessionTitle: 'Открывать последний чат при запуске',
+      resumeLastSessionDesc: 'Продолжайте с того места, где остановились. Выключите, чтобы всегда начинать с нового чата.',
       product: 'Продукт',
       productDesc: 'Дружелюбная активность инструментов с краткими сводками.',
       technical: 'Технический',
@@ -3095,13 +3097,17 @@ export const ru = defineLocale({
       resetStatusbar: 'Сбросить к значениям по умолчанию',
       toggleApprovalMode: 'Подтверждения',
       toggleBackendVersion: 'Версия бэкенда',
+      toggleCacheHitRate: 'Попадания в кэш',
       toggleCommandCenter: 'Командный центр',
       toggleContextUsage: 'Шкала контекста',
       toggleRunningTimer: 'Таймер хода',
       toggleSessionTimer: 'Таймер сеанса',
       toggleTerminal: 'Терминал',
+      toggleTokensPerSecond: 'Токенов в секунду',
       toggleVersion: 'Версия и обновления',
       toggleWorkspace: 'Рабочее пространство',
+      cacheHitRateTitle: 'Доля попаданий в кэш промпта за сеанс — кэшированные токены дешевле, чем выше, тем дешевле',
+      tokensPerSecondTitle: 'Выходных токенов в секунду, среднее за последние 10 вызовов модели',
       agents: 'Агенты',
       closeAgents: 'Закрыть агентов',
       openAgents: 'Открыть агентов',
diff --git a/apps/desktop/src/i18n/types.ts b/apps/desktop/src/i18n/types.ts
index cbb990042f..ed6933b437 100644
--- a/apps/desktop/src/i18n/types.ts
+++ b/apps/desktop/src/i18n/types.ts
@@ -338,6 +338,7 @@ export interface Translations {
       providerAccounts: string
       providerApiKeys: string
       providerCustomEndpoints: string
+      providerLocalModels: string
       gateway: string
       apiKeys: string
       keybinds: string
@@ -496,6 +497,8 @@ export interface Translations {
       embedsAlways: string
       embedsOff: string
       embedsReset: (count: number) => string
+      resumeLastSessionTitle: string
+      resumeLastSessionDesc: string
       product: string
       productDesc: string
       technical: string
@@ -559,6 +562,9 @@ export interface Translations {
       bundleOutOfSync: string
       bundleOutOfSyncDesc: string
       bundleOutOfSyncAction: string
+      bundleSwapPending: string
+      bundleSwapPendingDesc: string
+      bundleSwapPendingAction: string
       updates: string
       checkNow: string
       checking: string
@@ -966,6 +972,107 @@ export interface Translations {
       notInCatalog: string
       tasks: Record<string, AuxTaskCopy>
     }
+    localModels: {
+      title: string
+      runtimeTitle: string
+      runtimeReady: (backend: string) => string
+      serverRunning: string
+      runtimeInstalled: string
+      runtimeInstalledDetail: (tag: string, backend: string) => string
+      installTitle: string
+      installDetail: string
+      installAction: string
+      installing: string
+      installFailed: string
+      hardwareTitle: string
+      hardwareLoading: string
+      vram: (label: string) => string
+      ram: (label: string) => string
+      unifiedMemory: string
+      modelsTitle: string
+      recommended: string
+      /** Recommended-badge tooltip by resolver branch; unknown keys (newer
+       *  backend) simply show no tooltip. */
+      recommendedReason: Record<string, string>
+      downloaded: string
+      downloadAction: (size: string) => string
+      downloadProgress: (done: string, total: string) => string
+      downloadDoneToast: (model: string) => string
+      installDoneToast: string
+      quickstartTitle: string
+      quickstartDetail: (model: string, size: string) => string
+      quickstartDetailReady: (model: string) => string
+      quickstartAction: string
+      quickstartConfigure: string
+      quickstartDoneToast: (model: string) => string
+      quickstartFailed: string
+      quickstartStageEngine: string
+      quickstartStageModel: string
+      quickstartStageFinish: string
+      useAction: string
+      activePill: string
+      updateTitle: string
+      updateDetail: (next: string, current: string) => string
+      updateAction: string
+      updating: string
+      upToDateTitle: string
+      upToDateDetail: (tag: string, backend: string) => string
+      updateToast: (next: string) => string
+      activeDetail: string
+      activeNotLoaded: string
+      loadedPill: string
+      placementResident: string
+      placementSpilled: string
+      placementResidentTip: string
+      placementSpilledTip: string
+      loadingPill: string
+      ejectTip: string
+      ejected: string
+      ejectFailed: string
+      stopServer: string
+      startServer: string
+      runtimeRunningDetail: string
+      serverStopped: string
+      serverStarted: string
+      serverStopFailed: string
+      serverStartFailed: string
+      activating: string
+      activateFailed: (model: string) => string
+      activateDoneToast: (model: string) => string
+      downloadFailed: (model: string) => string
+      pillFitsGpu: string
+      pillUsesRam: string
+      pillTooBig: string
+      browseTitle: string
+      browseHint: string
+      browsePlaceholder: string
+      browseSearching: string
+      browseListing: string
+      browseShowFiles: string
+      browseRefresh: string
+      browseDownloads: string
+      browseLikes: string
+      browseGated: string
+      browseNoGguf: string
+      browseFitUnknown: string
+      browseAlreadyDownloaded: string
+      addedByYou: string
+      browseDownloadStarted: string
+      browseDownloadAria: string
+      sideloadButton: string
+      sideloadTitle: string
+      sideloadDone: string
+      sideloadAlreadyPresent: string
+      pillFullContext: (max: string) => string
+      pillFullContextTip: string
+      pillUpTo: (max: string) => string
+      pillGrowsTip: string
+      pillVision: string
+      deleteAction: string
+      deleteConfirm: (model: string) => string
+      deleted: (model: string) => string
+      deleteFailed: string
+    }
     providers: {
       connectAccount: string
       haveApiKey: string
@@ -2350,6 +2457,8 @@ export interface Translations {
     connected: string
     featuredPitch: string
     fireworksPitch: string
+    localModelsTitle: string
+    localModelsPitch: string
     openRouterPitch: string
     apiKeyOptions: Record<string, { short: string; description: string }>
     backToSignIn: string
@@ -2400,6 +2509,9 @@ export interface Translations {
     noModels: string
     addProvider: string
     loadFailed: string
+    loadingIntoMemory: string
+    downloading: string
+    localDownloadsHeading: string
     noAuthenticatedProviders: string
     pro: string
     proNeedsSubscription: string
@@ -2505,13 +2617,17 @@ export interface Translations {
       resetStatusbar: string
       toggleApprovalMode: string
       toggleBackendVersion: string
+      toggleCacheHitRate: string
       toggleCommandCenter: string
       toggleContextUsage: string
       toggleRunningTimer: string
       toggleSessionTimer: string
       toggleTerminal: string
+      toggleTokensPerSecond: string
       toggleVersion: string
       toggleWorkspace: string
+      cacheHitRateTitle: string
+      tokensPerSecondTitle: string
       agents: string
       closeAgents: string
       openAgents: string
@@ -2526,6 +2642,15 @@ export interface Translations {
       openStarmap: string
       turnRunning: string
       contextUsage: string
+      systemResources: {
+        title: string
+        loading: string
+        gpuUtilization: string
+        gpuMemory: string
+        ram: string
+        unifiedNote: string
+        toggle: string
+      }
       contextUsagePanel: {
         categories: {
           conversation: string
@@ -2777,6 +2902,8 @@ export interface Translations {
       loadingSession: string
       showEarlier: string
       loadingResponse: string
+      loadingLocalModel: (model: string) => string
+      processingPrompt: string
       resumeWhenBackgroundDone: (count: number) => string
       thinking: string
       thought: string
@@ -3027,8 +3154,12 @@ export interface Translations {
 
   tips: {
     close: string
-    /** Keyed by `TipId`, so a new tip without copy is a type error. */
-    items: Record<TipId, { title: string; text: string }>
+    /** Keyed by `TipId`, so a new tip without copy is a type error. Plus the
+     *  campaign tips, which live outside the rotation's catalog: they carry
+     *  a button, and `action` is its label. */
+    items: Record<TipId, { title: string; text: string }> & {
+      'local-setup': { title: string; text: string; action: string }
+    }
   }
 
   errors: {
diff --git a/apps/desktop/src/i18n/zh-hant.ts b/apps/desktop/src/i18n/zh-hant.ts
index 277ed010a0..8e3dc7c2eb 100644
--- a/apps/desktop/src/i18n/zh-hant.ts
+++ b/apps/desktop/src/i18n/zh-hant.ts
@@ -269,6 +269,7 @@ export const zhHant = defineLocale({
       providerAccounts: '帳號',
       providerApiKeys: 'API 金鑰',
       providerCustomEndpoints: '自訂端點',
+      providerLocalModels: '本地模型',
       gateway: '閘道',
       apiKeys: '工具與金鑰',
       keybinds: '鍵盤快捷鍵',
@@ -417,6 +418,8 @@ export const zhHant = defineLocale({
       embedsAlways: '一律',
       embedsOff: '關閉',
       embedsReset: (count: number) => `重設 ${count} 個已允許的服務`,
+      resumeLastSessionTitle: '啟動時恢復上次會話',
+      resumeLastSessionDesc: '開啟後，應用冷啟動時重新打開最近的聊天。關閉則始終從空白新會話開始。',
       product: '產品',
       productDesc: '易讀的工具活動與精簡摘要。',
       technical: '技術',
@@ -703,6 +706,10 @@ export const zhHant = defineLocale({
       bundleOutOfSyncDesc:
         'Hermes 執行環境已更新,但桌面應用程式本身仍是舊建置——在應用程式更新之前,新的介面功能(如 Bot Mode)不會顯示。請執行下方的更新以重新建置應用程式。如果此警告仍未消除,請從最新的桌面安裝程式重新安裝。',
       bundleOutOfSyncAction: '取得安裝程式',
+      bundleSwapPending: '重新啟動以完成更新',
+      bundleSwapPendingDesc:
+        '更新後的應用程式已安裝完成，只需重新啟動 Hermes 即可載入新版本。聊天記錄和設定不會受到影響。',
+      bundleSwapPendingAction: '重新啟動 Hermes',
       updates: '更新',
       checkNow: '立即檢查',
       checking: '檢查中…',
@@ -986,6 +993,103 @@ export const zhHant = defineLocale({
         curator: { label: '策展器', hint: '技能使用審查' }
       }
     },
+    localModels: {
+      title: '本地模型',
+      runtimeTitle: '本地執行環境',
+      runtimeReady: backend => `就緒 · ${backend}`,
+      serverRunning: '執行中',
+      runtimeInstalled: '已安裝 llama.cpp 執行環境',
+      runtimeInstalledDetail: (tag, backend) => `組建 ${tag}，${backend} 後端。Hermes 會為您啟動並管理伺服器。`,
+      installTitle: '安裝本地執行環境',
+      installDetail: '下載 llama.cpp 推理引擎（數百 MB）。下載的模型完全在本機執行——無需帳號，資料不會離開您的電腦。',
+      installAction: '安裝執行環境',
+      installing: '正在安裝執行環境…',
+      installFailed: '執行環境安裝失敗',
+      hardwareTitle: '本機配置',
+      hardwareLoading: '正在檢測硬體…',
+      vram: label => `${label} 顯示記憶體`,
+      ram: label => `${label} 記憶體`,
+      unifiedMemory: '統一記憶體',
+      modelsTitle: '模型',
+      recommended: '推薦',
+      recommendedReason: {
+        'best-quality-resident': '在完全駐留 GPU 且保持全速的模型中品質最高。推薦會在品質與該硬體的預計速度之間權衡。',
+        'speed-gated-quality':
+          '有更高品質的模型可以裝入這台機器，但受記憶體頻寬限制回應會太慢——這是保持流暢的最佳模型。',
+        'fastest-resident': '沒有模型能在該硬體上達到全速；這是完全駐留 GPU 記憶體中最快的一個。',
+        'least-painful-spilled': '沒有模型能完全裝入 GPU 記憶體——這是從系統記憶體執行表現最好的一個。'
+      } as Record<string, string>,
+      downloaded: '已下載',
+      downloadAction: size => `下載 · ${size}`,
+      downloadProgress: (done, total) => `正在下載 ${done} / ${total}`,
+      downloadDoneToast: model => `${model} 已就緒。`,
+      installDoneToast: '本地執行環境已安裝就緒。',
+      useAction: '使用',
+      activePill: '預設',
+      updateTitle: '引擎有可用更新',
+      updateDetail: (next, current) =>
+        `新的 llama.cpp 組建（${next}）可以安裝——目前為 ${current}。下載期間模型仍可正常使用。`,
+      updateAction: '更新引擎',
+      updating: '正在更新引擎…',
+      upToDateTitle: '引擎已是最新',
+      upToDateDetail: (tag, backend) => `正在執行 llama.cpp ${tag}（${backend}）——Hermes 提供的最新組建。`,
+      updateToast: next => `本地引擎有新組建（${next}）。可在 設定 → 本地模型 中更新。`,
+      activeDetail: '新對話使用此模型——傳送首條訊息時載入',
+      activeNotLoaded: '首條訊息時載入',
+      loadedPill: '已載入',
+      placementResident: '全部在 GPU',
+      placementSpilled: '部分在記憶體',
+      placementResidentTip: '完全在 GPU 記憶體中以此上下文視窗執行——全速。',
+      placementSpilledTip:
+        '模型的一部分從系統記憶體執行——可用但較慢。更緊湊的版本或更小的上下文可以完全放入顯示記憶體。',
+      loadingPill: '載入中…',
+      ejectTip: '釋放顯示記憶體（需要時重新載入）',
+      ejected: '模型已卸載——顯示記憶體已釋放。',
+      ejectFailed: '無法卸載模型',
+      stopServer: '關閉',
+      startServer: '開啟',
+      runtimeRunningDetail: '本地伺服器執行中。關閉後將釋放全部顯示記憶體，新對話將不再使用本地模型，直到您重新開啟。',
+      serverStopped: '本地伺服器已停止——顯示記憶體已釋放。',
+      serverStarted: '本地伺服器執行中。',
+      serverStopFailed: '無法停止本地伺服器',
+      serverStartFailed: '無法啟動本地伺服器',
+      activating: '啟動中…',
+      activateFailed: model => `無法切換到 ${model}`,
+      activateDoneToast: model => `新對話將使用 ${model}。`,
+      downloadFailed: model => `${model} 下載失敗`,
+      pillFitsGpu: '完全在 GPU 上執行',
+      pillUsesRam: '使用系統記憶體',
+      pillTooBig: '超出本機記憶體',
+      browseTitle: '發現更多模型',
+      browseHint: '搜尋整個 Hugging Face。在這裡下載的模型會自動適配你的機器，但未經我們測試。',
+      browsePlaceholder: '按名稱或作者搜尋模型…',
+      browseSearching: '正在搜尋 Hugging Face',
+      browseListing: '正在讀取模型檔案',
+      browseShowFiles: '查看檔案',
+      browseRefresh: '重新整理',
+      browseDownloads: '次下載',
+      browseLikes: '個讚',
+      browseGated: '需要登入 Hugging Face',
+      browseNoGguf: '未找到相容的模型檔案。',
+      browseFitUnknown: '適配情況未知',
+      browseAlreadyDownloaded: '已下載。',
+      addedByYou: '由你新增',
+      browseDownloadStarted: '正在下載 {name}',
+      browseDownloadAria: '下載 {name}',
+      sideloadButton: '新增模型檔案',
+      sideloadTitle: '選擇 GGUF 模型檔案',
+      sideloadDone: '已新增 {name}。',
+      sideloadAlreadyPresent: '已在你的庫中。',
+      pillFullContext: max => `完整 ${max} 上下文`,
+      pillFullContextTip: '從一開始就以模型的完整上下文視窗執行',
+      pillUpTo: max => `最高 ${max} 上下文`,
+      pillGrowsTip: '隨著對話需要更多空間自動增長',
+      pillVision: '識圖',
+      deleteAction: '刪除模型',
+      deleteConfirm: model => `從磁碟刪除 ${model}？`,
+      deleted: model => `已刪除 ${model}。`,
+      deleteFailed: '刪除失敗'
+    },
     providers: {
       connectAccount: '連結帳號',
       haveApiKey: '改用 API 金鑰？',
@@ -2323,6 +2427,8 @@ export const zhHant = defineLocale({
     connected: '已連線',
     featuredPitch: '一個訂閱，300+ 前沿模型 — 執行 Hermes 的建議方式',
     fireworksPitch: '直接模型 API — Fireworks 託管的前沿模型',
+    localModelsTitle: '本地執行模型',
+    localModelsPitch: '無需帳號——下載模型，在本機執行',
     openRouterPitch: '一個金鑰，數百個模型 — 穩定的預設選擇',
     apiKeyOptions: {
       fireworks: { short: '直接模型 API', description: '直接存取 Fireworks AI 託管的模型。' },
@@ -2387,6 +2493,8 @@ export const zhHant = defineLocale({
     noModels: '找不到模型。',
     addProvider: '新增提供方',
     loadFailed: '無法載入模型',
+    downloading: '下載中',
+    localDownloadsHeading: '本地',
     noAuthenticatedProviders: '沒有已驗證的提供方。',
     pro: 'Pro',
     proNeedsSubscription: 'Pro 模型需要付費 Nous 訂閱。',
@@ -2499,6 +2607,15 @@ export const zhHant = defineLocale({
       openStarmap: '開啟記憶圖譜',
       turnRunning: '執行中',
       contextUsage: '上下文使用量',
+      systemResources: {
+        title: '系統資源',
+        loading: '資源…',
+        gpuUtilization: 'GPU 使用率',
+        gpuMemory: '顯示記憶體',
+        ram: '記憶體',
+        unifiedNote: '統一記憶體——GPU 與系統共享此記憶體池。',
+        toggle: '系統資源'
+      },
       contextUsagePanel: {
         categories: {
           conversation: '對話',
@@ -3034,9 +3151,10 @@ export const zhHant = defineLocale({
         title: '附件與指令',
         text: '輸入 @ 把檔案帶入對話，輸入 / 執行指令。'
       },
-      'model-switch': {
-        title: '對話中隨時換模型',
-        text: '模型名稱就是按鈕。工作性質變了就換一個。'
+      'local-setup': {
+        title: '這台電腦可以本地執行模型',
+        text: '你的硬體可以執行本地模型。對話不離開你的電腦，而且完全免費。',
+        action: '立即設定'
       },
       'right-pane': {
         title: '工作面板',
diff --git a/apps/desktop/src/i18n/zh.ts b/apps/desktop/src/i18n/zh.ts
index 9bd1fdaeb8..73a0956da9 100644
--- a/apps/desktop/src/i18n/zh.ts
+++ b/apps/desktop/src/i18n/zh.ts
@@ -382,6 +382,7 @@ export const zh: Translations = {
       providerAccounts: '账号',
       providerApiKeys: 'API 密钥',
       providerCustomEndpoints: '自定义端点',
+      providerLocalModels: '本地模型',
       gateway: '网关',
       apiKeys: '工具与密钥',
       keybinds: '键盘快捷键',
@@ -591,6 +592,8 @@ export const zh: Translations = {
       embedsAlways: '总是',
       embedsOff: '关闭',
       embedsReset: (count: number) => `重置 ${count} 个已允许的服务`,
+      resumeLastSessionTitle: '启动时恢复上次会话',
+      resumeLastSessionDesc: '开启后，应用冷启动时重新打开最近的聊天。关闭则始终从空白新会话开始。',
       product: '产品',
       productDesc: '易读的工具活动与简洁摘要。',
       technical: '技术',
@@ -877,6 +880,9 @@ export const zh: Translations = {
       bundleOutOfSyncDesc:
         'Hermes 运行时已更新,但桌面应用本身仍是旧构建——在应用更新之前,新的界面功能(如 Bot Mode)不会显示。请运行下方的更新以重新构建应用。如果此警告仍未消除,请从最新的桌面安装程序重新安装。',
       bundleOutOfSyncAction: '获取安装程序',
+      bundleSwapPending: '重启以完成更新',
+      bundleSwapPendingDesc: '更新后的应用已安装完成，只需重启 Hermes 即可加载新版本。聊天记录和设置不会受到影响。',
+      bundleSwapPendingAction: '重启 Hermes',
       updates: '更新',
       checkNow: '立即检查',
       checking: '检查中…',
@@ -1311,6 +1317,112 @@ export const zh: Translations = {
         curator: { label: '维护器', hint: '技能使用审查' }
       }
     },
+    localModels: {
+      title: '本地模型',
+      runtimeTitle: '本地运行时',
+      runtimeReady: backend => `就绪 · ${backend}`,
+      serverRunning: '运行中',
+      runtimeInstalled: '已安装 llama.cpp 运行时',
+      runtimeInstalledDetail: (tag, backend) => `构建 ${tag}，${backend} 后端。Hermes 会为您启动并管理服务器。`,
+      installTitle: '安装本地运行时',
+      installDetail: '下载 llama.cpp 推理引擎（几百 MB）。下载的模型完全在本机运行——无需账号，数据不会离开您的电脑。',
+      installAction: '安装运行时',
+      installing: '正在安装运行时…',
+      installFailed: '运行时安装失败',
+      quickstartTitle: '在本机运行模型',
+      quickstartDetail: (model, size) =>
+        `一键完成所有设置：本地引擎、${model}（需下载 ${size}），并设为新会话的默认模型。数据不会离开这台电脑。`,
+      quickstartDetailReady: model => `一键将 ${model} 设为新会话的默认模型。所有内容都在本机运行。`,
+      quickstartAction: '为我设置',
+      quickstartConfigure: '自定义…',
+      quickstartDoneToast: model => `${model} 已就绪——新会话将在本机运行。`,
+      quickstartFailed: '本地模型设置失败',
+      quickstartStageEngine: '引擎',
+      quickstartStageModel: '模型',
+      quickstartStageFinish: '完成',
+      hardwareTitle: '本机配置',
+      hardwareLoading: '正在检测硬件…',
+      vram: label => `${label} 显存`,
+      ram: label => `${label} 内存`,
+      unifiedMemory: '统一内存',
+      modelsTitle: '模型',
+      recommended: '推荐',
+      recommendedReason: {
+        'best-quality-resident': '在完全驻留 GPU 且保持全速的模型中质量最高。推荐会在质量与该硬件的预计速度之间权衡。',
+        'speed-gated-quality': '有更高质量的模型可以装入这台机器，但受内存带宽限制响应会太慢——这是保持流畅的最佳模型。',
+        'fastest-resident': '没有模型能在该硬件上达到全速；这是完全驻留 GPU 内存中最快的一个。',
+        'least-painful-spilled': '没有模型能完全装入 GPU 内存——这是从系统内存运行表现最好的一个。'
+      } as Record<string, string>,
+      downloaded: '已下载',
+      downloadAction: size => `下载 · ${size}`,
+      downloadProgress: (done, total) => `正在下载 ${done} / ${total}`,
+      downloadDoneToast: model => `${model} 已就绪。`,
+      installDoneToast: '本地运行时已安装就绪。',
+      useAction: '使用',
+      activePill: '默认',
+      updateTitle: '引擎有可用更新',
+      updateDetail: (next, current) =>
+        `新的 llama.cpp 构建（${next}）可以安装——当前为 ${current}。下载期间模型仍可正常使用。`,
+      updateAction: '更新引擎',
+      updating: '正在更新引擎…',
+      upToDateTitle: '引擎已是最新',
+      upToDateDetail: (tag, backend) => `正在运行 llama.cpp ${tag}（${backend}）——Hermes 提供的最新构建。`,
+      updateToast: next => `本地引擎有新构建（${next}）。可在 设置 → 本地模型 中更新。`,
+      activeDetail: '新对话使用此模型——发送首条消息时加载',
+      activeNotLoaded: '首条消息时加载',
+      loadedPill: '已加载',
+      placementResident: '全部在 GPU',
+      placementSpilled: '部分在内存',
+      placementResidentTip: '完全在 GPU 显存中以此上下文窗口运行——全速。',
+      placementSpilledTip: '模型的一部分从系统内存运行——可用但较慢。更紧凑的版本或更小的上下文可以完全放入显存。',
+      loadingPill: '加载中…',
+      ejectTip: '释放显存（需要时重新加载）',
+      ejected: '模型已卸载——显存已释放。',
+      ejectFailed: '无法卸载模型',
+      stopServer: '关闭',
+      startServer: '开启',
+      runtimeRunningDetail: '本地服务器正在运行。关闭后将释放全部显存，新对话将不再使用本地模型，直到您重新开启。',
+      serverStopped: '本地服务器已停止——显存已释放。',
+      serverStarted: '本地服务器运行中。',
+      serverStopFailed: '无法停止本地服务器',
+      serverStartFailed: '无法启动本地服务器',
+      activating: '启动中…',
+      activateFailed: model => `无法切换到 ${model}`,
+      activateDoneToast: model => `新对话将使用 ${model}。`,
+      downloadFailed: model => `${model} 下载失败`,
+      pillFitsGpu: '完全在 GPU 上运行',
+      pillUsesRam: '使用系统内存',
+      pillTooBig: '超出本机内存',
+      browseTitle: '发现更多模型',
+      browseHint: '搜索整个 Hugging Face。在这里下载的模型会自动适配你的机器，但未经我们测试。',
+      browsePlaceholder: '按名称或作者搜索模型…',
+      browseSearching: '正在搜索 Hugging Face',
+      browseListing: '正在读取模型文件',
+      browseShowFiles: '查看文件',
+      browseRefresh: '刷新',
+      browseDownloads: '次下载',
+      browseLikes: '个赞',
+      browseGated: '需要登录 Hugging Face',
+      browseNoGguf: '未找到兼容的模型文件。',
+      browseFitUnknown: '适配情况未知',
+      browseAlreadyDownloaded: '已下载。',
+      addedByYou: '由你添加',
+      browseDownloadStarted: '正在下载 {name}',
+      browseDownloadAria: '下载 {name}',
+      sideloadButton: '添加模型文件',
+      sideloadTitle: '选择 GGUF 模型文件',
+      sideloadDone: '已添加 {name}。',
+      sideloadAlreadyPresent: '已在你的库中。',
+      pillFullContext: max => `完整 ${max} 上下文`,
+      pillFullContextTip: '从一开始就以模型的完整上下文窗口运行',
+      pillUpTo: max => `最高 ${max} 上下文`,
+      pillGrowsTip: '随着对话需要更多空间自动增长',
+      pillVision: '识图',
+      deleteAction: '删除模型',
+      deleteConfirm: model => `从磁盘删除 ${model}？`,
+      deleted: model => `已删除 ${model}。`,
+      deleteFailed: '删除失败'
+    },
     providers: {
       connectAccount: '连接账号',
       haveApiKey: '改用 API 密钥？',
@@ -2933,6 +3045,8 @@ export const zh: Translations = {
     connected: '已连接',
     featuredPitch: '一个订阅，300+ 前沿模型 — 运行 Hermes 的推荐方式',
     fireworksPitch: '直接模型 API — Fireworks 托管的前沿模型',
+    localModelsTitle: '本地运行模型',
+    localModelsPitch: '无需账号——下载模型，在本机运行',
     openRouterPitch: '一个密钥，数百个模型 — 稳妥的默认选择',
     apiKeyOptions: {
       fireworks: { short: '直接模型 API', description: '直接访问 Fireworks AI 托管的模型。' },
@@ -2998,6 +3112,9 @@ export const zh: Translations = {
     noModels: '未找到模型。',
     addProvider: '添加提供方',
     loadFailed: '无法加载模型',
+    loadingIntoMemory: '正在载入内存',
+    downloading: '下载中',
+    localDownloadsHeading: '本地',
     noAuthenticatedProviders: '没有已认证的提供方。',
     pro: 'Pro',
     proNeedsSubscription: 'Pro 模型需要付费 Nous 订阅。',
@@ -3103,13 +3220,17 @@ export const zh: Translations = {
       resetStatusbar: '恢复默认设置',
       toggleApprovalMode: '审批',
       toggleBackendVersion: '后端版本',
+      toggleCacheHitRate: '缓存命中率',
       toggleCommandCenter: '命令中心',
       toggleContextUsage: '上下文用量',
       toggleRunningTimer: '回合计时',
       toggleSessionTimer: '会话计时',
       toggleTerminal: '终端',
+      toggleTokensPerSecond: '每秒 token 数',
       toggleVersion: '版本与更新',
       toggleWorkspace: '工作区',
+      cacheHitRateTitle: '本会话的提示缓存命中率 — 缓存 token 更便宜，越高越省',
+      tokensPerSecondTitle: '每秒输出 token 数，取最近 10 次模型调用的平均值',
       agents: '代理',
       closeAgents: '关闭代理',
       openAgents: '打开代理',
@@ -3124,6 +3245,15 @@ export const zh: Translations = {
       openStarmap: '打开记忆图谱',
       turnRunning: '运行中',
       contextUsage: '上下文用量',
+      systemResources: {
+        title: '系统资源',
+        loading: '资源…',
+        gpuUtilization: 'GPU 利用率',
+        gpuMemory: '显存',
+        ram: '内存',
+        unifiedNote: '统一内存——GPU 与系统共享此内存池。',
+        toggle: '系统资源'
+      },
       contextUsagePanel: {
         categories: {
           conversation: '对话',
@@ -3377,6 +3507,8 @@ export const zh: Translations = {
       loadingSession: '正在加载会话',
       showEarlier: '显示更早的消息',
       loadingResponse: 'Hermes 正在加载回复',
+      loadingLocalModel: model => `正在将 ${model} 载入内存`,
+      processingPrompt: '正在处理提示词',
       resumeWhenBackgroundDone: count =>
         count === 1 ? '后台任务完成后将自动继续' : `${count} 个后台任务完成后将自动继续`,
       thinking: '思考中',
@@ -3684,9 +3816,10 @@ export const zh: Translations = {
         title: '附件与命令',
         text: '输入 @ 把文件带入对话，输入 / 运行命令。'
       },
-      'model-switch': {
-        title: '对话中随时换模型',
-        text: '模型名称就是按钮。工作性质变了就换一个。'
+      'local-setup': {
+        title: '这台电脑可以本地运行模型',
+        text: '你的硬件可以运行本地模型。对话不离开你的电脑，而且完全免费。',
+        action: '立即设置'
       },
       'right-pane': {
         title: '工作面板',
diff --git a/apps/desktop/src/lib/gateway-events.test.ts b/apps/desktop/src/lib/gateway-events.test.ts
index 5ec527d0bc..b9af988f8c 100644
--- a/apps/desktop/src/lib/gateway-events.test.ts
+++ b/apps/desktop/src/lib/gateway-events.test.ts
@@ -9,6 +9,18 @@ describe('gateway event routing', () => {
     expect(approvalReplaySessionId('message.delta', 'active-1', 'routed-1')).toBeNull()
   })
 
+  it('does not replay against an active runtime the gateway already reported gone', () => {
+    const isGone = (sid: string) => sid === 'dead-1'
+
+    // Unscoped fan-out attributed to a dead active session: skip.
+    expect(approvalReplaySessionId('session.info', 'dead-1', 'dead-1', { explicit: false, isGone })).toBeNull()
+    expect(approvalReplaySessionId('gateway.ready', 'dead-1', null, { explicit: false, isGone })).toBeNull()
+    // A live active session still replays.
+    expect(approvalReplaySessionId('session.info', 'live-1', 'live-1', { explicit: false, isGone })).toBe('live-1')
+    // An explicitly scoped frame is the runtime speaking for itself — never skipped.
+    expect(approvalReplaySessionId('session.info', 'dead-1', 'dead-1', { explicit: true, isGone })).toBe('dead-1')
+  })
+
   it('drops only unscoped subagent events (genuinely background work)', () => {
     expect(gatewayEventRequiresSessionId('subagent.progress')).toBe(true)
     expect(gatewayEventRequiresSessionId('subagent.start')).toBe(true)
diff --git a/apps/desktop/src/lib/gateway-events.ts b/apps/desktop/src/lib/gateway-events.ts
index 6375955510..7c994a71ce 100644
--- a/apps/desktop/src/lib/gateway-events.ts
+++ b/apps/desktop/src/lib/gateway-events.ts
@@ -80,20 +80,34 @@ export interface GatewayEventSessionRoute {
   sessionId: null | string
 }
 
+/** Which session (if any) to re-pull `approval.pending` for after `eventType`.
+ *
+ *  `gateway.ready` and `session.info` are the two rehydration points. An
+ *  UNSCOPED `session.info` (the approvals-loop / broadcast fan-out, no
+ *  `session_id` on the frame) reaches here attributed to the active session by
+ *  the routing fallback; when `isGone(activeSessionId)` — the gateway already
+ *  answered 4001 for that runtime — replaying would only re-send the dead id
+ *  on every fan-out tick (#100639), so return null. A frame that names the
+ *  session explicitly is the runtime speaking for itself and is never gone. */
 export function approvalReplaySessionId(
   eventType: string | undefined,
   activeSessionId: null | string,
-  routedSessionId: null | string
+  routedSessionId: null | string,
+  options?: { explicit?: boolean; isGone?: (sessionId: string) => boolean }
 ): null | string {
+  let target: null | string = null
+
   if (eventType === 'gateway.ready') {
-    return activeSessionId
+    target = activeSessionId
+  } else if (eventType === 'session.info') {
+    target = routedSessionId
   }
 
-  if (eventType === 'session.info') {
-    return routedSessionId
+  if (target && !options?.explicit && options?.isGone?.(target)) {
+    return null
   }
 
-  return null
+  return target
 }
 
 /**
diff --git a/apps/desktop/src/lib/icons.ts b/apps/desktop/src/lib/icons.ts
index 6d20b50d16..4c01becd7f 100644
--- a/apps/desktop/src/lib/icons.ts
+++ b/apps/desktop/src/lib/icons.ts
@@ -40,6 +40,7 @@ import {
   IconEar as Ear,
   IconEarOff as EarOff,
   IconEgg as Egg,
+  IconPlayerEjectFilled as Eject,
   IconExternalLink as ExternalLink,
   IconEye as Eye,
   IconEyeOff as EyeOff,
@@ -170,6 +171,7 @@ export {
   Ear,
   EarOff,
   Egg,
+  Eject,
   ExternalLink,
   Eye,
   EyeOff,
diff --git a/apps/desktop/src/lib/model-status-label.test.ts b/apps/desktop/src/lib/model-status-label.test.ts
index d1ad06fb73..f5dd3143ec 100644
--- a/apps/desktop/src/lib/model-status-label.test.ts
+++ b/apps/desktop/src/lib/model-status-label.test.ts
@@ -1,6 +1,11 @@
 import { describe, expect, it } from 'vitest'
 
-import { currentPickerSelection, displayModelName, formatModelStatusLabel } from './model-status-label'
+import {
+  currentPickerSelection,
+  displayModelName,
+  formatModelStatusLabel,
+  modelDisplayParts
+} from './model-status-label'
 import { reasoningEffortLabel } from './reasoning-effort'
 
 describe('model-status-label', () => {
@@ -16,6 +21,18 @@ describe('model-status-label', () => {
     expect(displayModelName('anthropic/claude-haiku-4-5-20251001')).toBe('Haiku 4 5')
   })
 
+  it('renders local GGUF ids as a clean name with a quant tag', () => {
+    expect(modelDisplayParts('Qwen3.6-27B-UD-Q4_K_XL')).toEqual({ name: 'Qwen3.6 27B', tag: 'Q4' })
+    expect(modelDisplayParts('Nemotron-3-Nano-30B-A3B-UD-Q4_K_XL')).toEqual({
+      name: 'Nemotron 3 Nano 30B A3B',
+      tag: 'Q4'
+    })
+    expect(modelDisplayParts('Qwen3-4B-Instruct-2507-UD-Q8_K_XL')).toEqual({ name: 'Qwen3 4B', tag: 'Q8' })
+    expect(modelDisplayParts('some-model-Q6_K')).toEqual({ name: 'Some Model', tag: 'Q6' })
+    // Cloud ids keep their existing behavior.
+    expect(modelDisplayParts('anthropic/claude-opus-4.8-fast').tag).toBe('Fast')
+  })
+
   it('maps reasoning effort to compact labels', () => {
     expect(reasoningEffortLabel('high')).toBe('High')
     expect(reasoningEffortLabel('xhigh')).toBe('XHigh')
diff --git a/apps/desktop/src/lib/model-status-label.ts b/apps/desktop/src/lib/model-status-label.ts
index 5dde20746f..62af16cd38 100644
--- a/apps/desktop/src/lib/model-status-label.ts
+++ b/apps/desktop/src/lib/model-status-label.ts
@@ -75,12 +75,26 @@ export function modelDisplayParts(model: string): { name: string; tag: string }
   let base = modelBaseId(model)
   let tag = ''
 
-  for (const [pattern, label] of VARIANT_TAGS) {
-    if (pattern.test(base)) {
-      tag = label
-      base = base.replace(pattern, '')
+  // Local GGUF ids carry a quant suffix (`…-UD-Q4_K_XL`, `…-Q8_0`). Render it
+  // as a quiet tag — "Qwen3.6 27B · Q4" — never as part of the name. Without
+  // this the composer pill reads raw quant soup ("Qwen3.6 27B UD Q4 K XL").
+  const quant = base.match(/-(?:UD-)?(Q\d(?:_[A-Z0-9]+)*|IQ\d(?:_[A-Z0-9]+)*|F16|BF16)$/i)
 
-      break
+  if (quant) {
+    tag = quant[1].split('_')[0].toUpperCase()
+    base = base.slice(0, -quant[0].length)
+    // Instruct/chat markers are noise once the quant confirmed a local build.
+    base = base.replace(/-(?:Instruct|Chat)(?:-\d{4})?$/i, '')
+  }
+
+  if (!tag) {
+    for (const [pattern, label] of VARIANT_TAGS) {
+      if (pattern.test(base)) {
+        tag = label
+        base = base.replace(pattern, '')
+
+        break
+      }
     }
   }
 
diff --git a/apps/desktop/src/lib/statusbar.test.ts b/apps/desktop/src/lib/statusbar.test.ts
new file mode 100644
index 0000000000..f4bbb5d995
--- /dev/null
+++ b/apps/desktop/src/lib/statusbar.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+
+import { cacheHitLabel, tokensPerSecondLabel } from '@/lib/statusbar'
+
+const base = { calls: 0, input: 0, output: 0, total: 0 }
+
+describe('statusbar usage readouts', () => {
+  it('paints the backend cache-hit and throughput fields, and stays blank when they are absent', () => {
+    // The backend omits both fields (rather than sending 0) when it has no data
+    // — a provider with no cache reads, or a session before its first call.
+    expect(cacheHitLabel(base)).toBe('')
+    expect(tokensPerSecondLabel(base)).toBe('')
+
+    expect(cacheHitLabel({ ...base, cache_hit_pct: 87 })).toBe('87%')
+    expect(tokensPerSecondLabel({ ...base, avg_tps: 41.6 })).toBe('42 t/s')
+  })
+})
diff --git a/apps/desktop/src/lib/statusbar.tsx b/apps/desktop/src/lib/statusbar.tsx
index 01ca3b645a..5b9670eef7 100644
--- a/apps/desktop/src/lib/statusbar.tsx
+++ b/apps/desktop/src/lib/statusbar.tsx
@@ -59,6 +59,22 @@ export function contextBarLabel(usage: UsageStats): string {
   return `[${contextBar(usage.context_percent)}] ${pct}%`
 }
 
+/** `87%` for a reported hit rate; '' when the backend omitted it (no cache
+ *  reads yet, or a provider that doesn't report them). The backend already
+ *  clamps and rounds, so this only guards a malformed/absent field. */
+export function cacheHitLabel(usage: UsageStats): string {
+  const pct = usage.cache_hit_pct
+
+  return typeof pct === 'number' && Number.isFinite(pct) ? `${Math.round(pct)}%` : ''
+}
+
+/** `42 t/s` for the rolling throughput; '' before the first completed call. */
+export function tokensPerSecondLabel(usage: UsageStats): string {
+  const tps = usage.avg_tps
+
+  return typeof tps === 'number' && Number.isFinite(tps) && tps > 0 ? `${Math.round(tps)} t/s` : ''
+}
+
 export function LiveDuration({ since }: { since: number | null | undefined }) {
   const [now, setNow] = useState(() => Date.now())
 
diff --git a/apps/desktop/src/lib/tips/catalog.ts b/apps/desktop/src/lib/tips/catalog.ts
index 69d3f434ec..157968c85e 100644
--- a/apps/desktop/src/lib/tips/catalog.ts
+++ b/apps/desktop/src/lib/tips/catalog.ts
@@ -35,7 +35,6 @@ export type TipId =
   | 'composer-mentions'
   | 'cron'
   | 'messaging'
-  | 'model-switch'
   | 'new-session'
   | 'profiles'
   | 'right-pane'
@@ -53,6 +52,5 @@ export const TIP_CATALOG: readonly TipDef[] = [
   { id: 'command-palette', keybind: 'nav.commandPalette', side: 'right', targets: ['[data-tour="sessions-sidebar"]'] },
   { id: 'profiles', keybind: 'profile.next', side: 'right', targets: ['[data-tour="profile-rail"]'] },
   { id: 'composer-mentions', side: 'top', targets: ['[data-tour="composer"]'] },
-  { id: 'model-switch', keybind: 'composer.modelPicker', side: 'top', targets: ['[data-tour="model-pill"]'] },
   { id: 'right-pane', keybind: 'view.toggleRightSidebar', side: 'bottom', targets: ['[data-tour="right-pane-toggle"]'] }
 ]
diff --git a/apps/desktop/src/lib/tips/local-cta.test.ts b/apps/desktop/src/lib/tips/local-cta.test.ts
new file mode 100644
index 0000000000..44c350e68b
--- /dev/null
+++ b/apps/desktop/src/lib/tips/local-cta.test.ts
@@ -0,0 +1,86 @@
+/**
+ * The local-setup campaign's policy, tested as the pure decisions they are:
+ * who qualifies (eligibility), when the bubble may return (the clock), and
+ * that the campaign cannot corrupt the rotation's cursor.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { TIP_CATALOG } from '@/lib/tips/catalog'
+import { LOCAL_SETUP_RESHOW_MS, LOCAL_SETUP_TIP_ID, localSetupDue, localSetupEligible } from '@/lib/tips/local-cta'
+import type { LocalCatalogModel, LocalModelsStatus } from '@/types/hermes'
+
+function status(overrides: Partial<LocalModelsStatus> = {}): LocalModelsStatus {
+  return {
+    active_model_id: null,
+    loading: {},
+    models: [],
+    models_dir: '',
+    placement: null,
+    runtime_installed: false,
+    server_running: false,
+    ...overrides
+  } as LocalModelsStatus
+}
+
+function fittingModel(): LocalCatalogModel {
+  return { fits: true, id: 'qwen3.8-27b' } as LocalCatalogModel
+}
+
+describe('localSetupEligible', () => {
+  it('offers setup to a local backend with a fitting model and nothing staged', () => {
+    expect(localSetupEligible('local', status(), [fittingModel()])).toBe(true)
+  })
+
+  it('never promises local privacy on a remote or cloud backend', () => {
+    for (const mode of ['remote', 'cloud', 'ssh', null]) {
+      expect(localSetupEligible(mode, status(), [fittingModel()])).toBe(false)
+    }
+  })
+
+  it('stays quiet when no catalog model fits the machine', () => {
+    expect(localSetupEligible('local', status(), [{ fits: false } as LocalCatalogModel])).toBe(false)
+    expect(localSetupEligible('local', status(), [])).toBe(false)
+  })
+
+  it('retires itself once the machine is set up', () => {
+    const setUp = status({
+      models: [{ id: 'qwen3.8-27b' }] as LocalModelsStatus['models'],
+      runtime_installed: true
+    })
+
+    expect(localSetupEligible('local', setUp, [fittingModel()])).toBe(false)
+  })
+
+  it('still offers when the runtime exists but no model is staged', () => {
+    expect(localSetupEligible('local', status({ runtime_installed: true }), [fittingModel()])).toBe(true)
+  })
+
+  it('answers false while state is still loading', () => {
+    expect(localSetupEligible('local', null, [fittingModel()])).toBe(false)
+    expect(localSetupEligible('local', status(), null)).toBe(false)
+  })
+})
+
+describe('localSetupDue', () => {
+  it('is due when never shown', () => {
+    expect(localSetupDue(Date.now(), undefined)).toBe(true)
+  })
+
+  it('holds for a week after an ignored showing, then returns', () => {
+    const now = Date.now()
+
+    expect(localSetupDue(now, now - LOCAL_SETUP_RESHOW_MS + 1000)).toBe(false)
+    expect(localSetupDue(now, now - LOCAL_SETUP_RESHOW_MS)).toBe(true)
+  })
+})
+
+describe('campaign identity', () => {
+  it('lives outside the rotation catalog — the walk must never land on it', () => {
+    // TipId already excludes the campaign id at the type level; this guards
+    // the runtime data against someone re-adding it as a catalog entry.
+    const ids: readonly string[] = TIP_CATALOG.map(def => def.id)
+
+    expect(ids).not.toContain(LOCAL_SETUP_TIP_ID)
+  })
+})
diff --git a/apps/desktop/src/lib/tips/local-cta.ts b/apps/desktop/src/lib/tips/local-cta.ts
new file mode 100644
index 0000000000..df667a56b8
--- /dev/null
+++ b/apps/desktop/src/lib/tips/local-cta.ts
@@ -0,0 +1,55 @@
+/**
+ * The local-setup call to action — eligibility as data in, data out.
+ *
+ * The one campaign tip the app currently runs: a machine that could serve a
+ * local model, on a backend that has none staged, gets one bubble on the
+ * model pill saying so, with the button that starts the already-built
+ * one-click setup. Everything here is a pure decision over fetched state so
+ * the policy is testable without a DOM or a backend.
+ *
+ * Why this is not a rotation tip: the rotation teaches the app the user
+ * already has, on a weeks-long walk. This tip is conditional (most machines
+ * either qualify or don't, permanently), actionable (it carries a button),
+ * and perishable (setting up local models — or ✕ — ends it forever). It
+ * outranks the walk when live because "your GPU can do this" beats "the
+ * model name is a button" every time both are true.
+ */
+
+import type { LocalCatalogModel, LocalModelsStatus } from '@/types/hermes'
+
+/** Retirement/shown-at ledger id. Not a `TipId` — the rotation never walks it. */
+export const LOCAL_SETUP_TIP_ID = 'local-setup'
+
+/** A CTA ignored (timed out) may return, but on a much longer clock than the
+ *  rotation's: it is the same message twice, not a tour moving on. */
+export const LOCAL_SETUP_RESHOW_MS = 7 * 24 * 60 * 60_000
+
+/**
+ * Machines qualify when the catalog has a model that FITS (the backend's
+ * physics check, same answer the pane's hero uses) and nothing is servable
+ * yet — no runtime or no staged models. A set-up machine never qualifies, so
+ * completing setup retires this tip without any bookkeeping.
+ *
+ * `connectionMode` must be 'local': on a remote backend (cloud resolves to
+ * remote) the models would run on the far machine, and a bubble promising
+ * "stays on your computer" would be promising someone else's computer.
+ */
+export function localSetupEligible(
+  connectionMode: null | string,
+  status: LocalModelsStatus | null,
+  catalog: readonly LocalCatalogModel[] | null
+): boolean {
+  if (connectionMode !== 'local' || !status || !catalog) {
+    return false
+  }
+
+  const needsSetup = !status.runtime_installed || status.models.length === 0
+
+  return needsSetup && catalog.some(model => model.fits)
+}
+
+/** Due = never shown, or shown long enough ago that repeating it reads as a
+ *  reminder rather than a nag. Retirement is the caller's ledger, not ours. */
+export function localSetupDue(now: number, shownAt: number | undefined): boolean {
+  return shownAt === undefined || now - shownAt >= LOCAL_SETUP_RESHOW_MS
+}
diff --git a/apps/desktop/src/lib/tts-lease.test.ts b/apps/desktop/src/lib/tts-lease.test.ts
new file mode 100644
index 0000000000..166c54ac9e
--- /dev/null
+++ b/apps/desktop/src/lib/tts-lease.test.ts
@@ -0,0 +1,99 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const setTtsLease = vi.fn(async (_lease: string, _active: boolean) => ({ ok: true }))
+
+vi.mock('@/hermes', () => ({
+  setTtsLease: (lease: string, active: boolean) => setTtsLease(lease, active)
+}))
+
+import { CONVERSATION_LEASE, READ_ALOUD_LEASE, resetTtsLeasesForTests, syncTtsLease } from './tts-lease'
+
+describe('syncTtsLease', () => {
+  beforeEach(() => {
+    resetTtsLeasesForTests()
+    setTtsLease.mockReset()
+    setTtsLease.mockImplementation(async () => ({ ok: true }))
+  })
+
+  afterEach(() => {
+    resetTtsLeasesForTests()
+  })
+
+  it('acquires on the first on and releases on off', async () => {
+    await syncTtsLease(READ_ALOUD_LEASE, true)
+    await syncTtsLease(READ_ALOUD_LEASE, false)
+
+    expect(setTtsLease.mock.calls).toEqual([
+      [READ_ALOUD_LEASE, true],
+      [READ_ALOUD_LEASE, false]
+    ])
+  })
+
+  it('skips an initial off — never releases a lease it did not hold', async () => {
+    await syncTtsLease(CONVERSATION_LEASE, false)
+
+    expect(setTtsLease).not.toHaveBeenCalled()
+  })
+
+  it('dedupes a repeat of the last sent state', async () => {
+    await syncTtsLease(READ_ALOUD_LEASE, true)
+    await syncTtsLease(READ_ALOUD_LEASE, true)
+    await syncTtsLease(READ_ALOUD_LEASE, true)
+
+    expect(setTtsLease).toHaveBeenCalledTimes(1)
+  })
+
+  it('queues an off behind an in-flight on so the wire never sees them reordered', async () => {
+    let finishAcquire: () => void = () => undefined
+    setTtsLease.mockImplementationOnce(
+      () =>
+        new Promise(resolve => {
+          finishAcquire = () => resolve({ ok: true })
+        })
+    )
+
+    const on = syncTtsLease(CONVERSATION_LEASE, true)
+    // Let the acquire actually go out (it runs on a microtask).
+    await Promise.resolve()
+    expect(setTtsLease.mock.calls).toEqual([[CONVERSATION_LEASE, true]])
+
+    const off = syncTtsLease(CONVERSATION_LEASE, false)
+    await Promise.resolve()
+    // Still only the acquire — the release waits for it to finish.
+    expect(setTtsLease).toHaveBeenCalledTimes(1)
+
+    finishAcquire()
+    await Promise.all([on, off])
+
+    expect(setTtsLease.mock.calls).toEqual([
+      [CONVERSATION_LEASE, true],
+      [CONVERSATION_LEASE, false]
+    ])
+  })
+
+  it('coalesces a flip that reverses before its call went out — latest intent wins', async () => {
+    const on = syncTtsLease(CONVERSATION_LEASE, true)
+    const off = syncTtsLease(CONVERSATION_LEASE, false)
+    await Promise.all([on, off])
+
+    // The acquire never had a chance to go out; only the terminal state is sent
+    // (a release of a never-held lease is a backend no-op).
+    expect(setTtsLease.mock.calls).toEqual([[CONVERSATION_LEASE, false]])
+  })
+
+  it('forgets the sent state on failure so the next flip retries', async () => {
+    setTtsLease.mockImplementationOnce(async () => {
+      throw new Error('backend not ready')
+    })
+
+    await expect(syncTtsLease(READ_ALOUD_LEASE, true)).resolves.toBeUndefined()
+    await syncTtsLease(READ_ALOUD_LEASE, true)
+
+    expect(setTtsLease).toHaveBeenCalledTimes(2)
+  })
+
+  it('conversation lease is per renderer, read-aloud lease is shared', () => {
+    expect(CONVERSATION_LEASE).toMatch(/^desktop:conversation:[a-z0-9]+$/)
+    expect(READ_ALOUD_LEASE).toBe('desktop:read-aloud')
+  })
+})
diff --git a/apps/desktop/src/lib/tts-lease.ts b/apps/desktop/src/lib/tts-lease.ts
new file mode 100644
index 0000000000..987d2765e1
--- /dev/null
+++ b/apps/desktop/src/lib/tts-lease.ts
@@ -0,0 +1,76 @@
+import { setTtsLease } from '@/hermes'
+
+// The desktop's speech-output toggles — "Read replies aloud" and voice
+// conversation mode — are the user telling us TTS is about to be needed (or no
+// longer is). The backend turns that into engine lifecycle: acquiring a lease
+// pre-loads the configured provider (a local piper/kittentts model, a lazily
+// installed SDK) so the first spoken reply starts hot instead of paying the load
+// as dead air; releasing the last lease unloads resident local models.
+//
+// This module is the renderer's single choke point for that signal. It dedupes
+// (several composers/tiles observe the same toggle), serializes per lease so a
+// fast on→off→on can't be reordered on the wire, and never surfaces failures —
+// warm-up is an optimization; the toggle itself must not depend on it.
+
+// Per-renderer id so two windows in conversation mode hold DISTINCT leases —
+// window A ending its conversation must not release the engine window B is
+// still speaking through. Read-aloud mirrors one config key shared by every
+// window, so it deliberately uses one shared lease name.
+const RENDERER_ID = Math.random().toString(36).slice(2, 10)
+
+export const READ_ALOUD_LEASE = 'desktop:read-aloud'
+export const CONVERSATION_LEASE = `desktop:conversation:${RENDERER_ID}`
+
+const sent = new Map<string, boolean>()
+const inFlight = new Map<string, Promise<void>>()
+
+/**
+ * Bring the backend's view of `lease` in line with `active`. Idempotent: a
+ * repeat of the last sent state is a no-op. The initial `false` (nothing was
+ * ever acquired) is also skipped — releasing a lease we never held would only
+ * churn the backend on app start.
+ */
+export function syncTtsLease(lease: string, active: boolean): Promise<void> {
+  const last = sent.get(lease)
+
+  if (last === active || (last === undefined && !active)) {
+    return inFlight.get(lease) ?? Promise.resolve()
+  }
+
+  sent.set(lease, active)
+
+  const previous = inFlight.get(lease) ?? Promise.resolve()
+
+  const next = previous
+    .then(async () => {
+      // Latest intent wins: if the toggle flipped again while we were queued,
+      // the newer call sends its own state and this one has nothing to say.
+      if (sent.get(lease) !== active) {
+        return
+      }
+
+      await setTtsLease(lease, active)
+    })
+    .catch(() => {
+      // Backend not up yet / older backend without the endpoint / warm-up
+      // failure: forget what we "sent" so the next flip retries honestly.
+      if (sent.get(lease) === active) {
+        sent.delete(lease)
+      }
+    })
+    .finally(() => {
+      if (inFlight.get(lease) === next) {
+        inFlight.delete(lease)
+      }
+    })
+
+  inFlight.set(lease, next)
+
+  return next
+}
+
+/** Test seam — forget every sent state. */
+export function resetTtsLeasesForTests() {
+  sent.clear()
+  inFlight.clear()
+}
diff --git a/apps/desktop/src/plugins/hermes-bots/bot-row-keeps-closed-chat.test.ts b/apps/desktop/src/plugins/hermes-bots/bot-row-keeps-closed-chat.test.ts
deleted file mode 100644
index a9928cb04a..0000000000
--- a/apps/desktop/src/plugins/hermes-bots/bot-row-keeps-closed-chat.test.ts
+++ /dev/null
@@ -1,291 +0,0 @@
-/**
- * A bot row click is "go to this bot", not "open its Bot Chat". Before this,
- * every click resolved the canonical chat by name and opened it as a tab — and
- * with no record of a close anywhere (this plugin keeps no closed set; core's
- * tile bucket only forgets), a Bot Chat the user closed came back beside every
- * newer thread on every bot switch. Now a bot whose workspace already holds
- * tabs comes back to the one the user left; the forever-chat is opened only
- * when nothing is open, or on the explicit ask (the row menu's "Open Bot Chat").
- *
- * Ported from tests/bot-row-keeps-closed-chat.test.mjs, which drove a `vm`
- * copy of plugin.js. Its two source-reading cases are dropped for real
- * assertions: the menu's call site is now a render in bot-row.test.tsx, and
- * the reclaim guard's text is asserted here as the claim-shape invariant the
- * guard actually reads.
- */
-
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-import type { RosterRow } from './types'
-
-const { openBotCanonicalChat, prepareBotSource } = vi.hoisted(() => ({
-  openBotCanonicalChat: vi.fn(),
-  prepareBotSource: vi.fn()
-}))
-
-vi.mock('./canonical-chat', () => ({
-  CANONICAL_CHAT_TITLE: 'Bot Chat',
-  ensureBotMetadata: vi.fn(async () => ({})),
-  notifyBotOpenFailure: vi.fn(),
-  openBotCanonicalChat,
-  prepareBotSource,
-  PROFILE_SESSION_LIST_LIMIT: 200
-}))
-
-const { host } = await import('@hermes/plugin-sdk')
-const { $openBotChat, $selectedBot } = await import('./bot-state')
-const { openRosterBot } = await import('./roster-actions')
-
-const bot = { connectionId: 'local', name: 'alpha' } as RosterRow
-
-/** Swap in a focus API for one test, restoring whatever the SDK really has —
- *  including its absence, which is the older-shell case. */
-function withFocusApi(impl: null | (() => null | string)) {
-  const had = Object.hasOwn(host, 'focusOpenWorkspaceSession')
-  const original = host.focusOpenWorkspaceSession
-
-  if (impl) {
-    host.focusOpenWorkspaceSession = impl
-  } else {
-    // @ts-expect-error — modelling a Desktop old enough to lack the verb.
-    delete host.focusOpenWorkspaceSession
-  }
-
-  return () => {
-    if (had) {
-      host.focusOpenWorkspaceSession = original
-    } else {
-      // @ts-expect-error — same.
-      delete host.focusOpenWorkspaceSession
-    }
-  }
-}
-
-beforeEach(() => {
-  vi.clearAllMocks()
-  prepareBotSource.mockResolvedValue(undefined)
-  openBotCanonicalChat.mockResolvedValue({ openedId: 'bot-chat', registryId: 'bot-chat' })
-  $openBotChat.set(null)
-  $selectedBot.set('')
-})
-
-describe('a row click returns to the tabs the bot already has open', () => {
-  it('fronts the remembered tab and resolves no canonical chat', async () => {
-    const focus = vi.fn(() => 'thread-2')
-    const restore = withFocusApi(focus)
-
-    try {
-      await expect(openRosterBot(bot)).resolves.toBe(true)
-
-      expect(focus).toHaveBeenCalledWith('bot:alpha', expect.any(Function))
-      expect(openBotCanonicalChat).not.toHaveBeenCalled()
-      // Open tabs need no source activation either — the bot is already live.
-      expect(prepareBotSource).not.toHaveBeenCalled()
-    } finally {
-      restore()
-    }
-  })
-
-  it('claims only the fronted tab, with no registry id', async () => {
-    const restore = withFocusApi(() => 'thread-2')
-
-    try {
-      await openRosterBot(bot)
-
-      expect($openBotChat.get()).toEqual({
-        key: 'local::alpha',
-        openedRegistryId: '',
-        openedSessionId: 'thread-2'
-      })
-    } finally {
-      restore()
-    }
-  })
-})
-
-describe('the canonical chat still opens when it is what was asked for', () => {
-  it('opens it when the bot has nothing open', async () => {
-    const restore = withFocusApi(() => null)
-
-    try {
-      await expect(openRosterBot(bot)).resolves.toBe(true)
-
-      expect(openBotCanonicalChat).toHaveBeenCalled()
-      expect($openBotChat.get()?.openedRegistryId).toBe('bot-chat')
-    } finally {
-      restore()
-    }
-  })
-
-  it('skips the open-tab shortcut on the explicit ask', async () => {
-    const focus = vi.fn(() => 'thread-2')
-    const restore = withFocusApi(focus)
-
-    try {
-      await expect(openRosterBot(bot, { canonical: true })).resolves.toBe(true)
-
-      expect(focus).not.toHaveBeenCalled()
-      expect($openBotChat.get()?.openedRegistryId).toBe('bot-chat')
-    } finally {
-      restore()
-    }
-  })
-})
-
-describe('the fronted-tab shortcut reconciles with the canonical registry (#90102)', () => {
-  // The stuck shape: a persisted "Bot Chat" tile names a session the
-  // registry no longer resolves to (superseded pointer-era row, re-minted
-  // canonical chat, stale finished session). The roster click must judge
-  // that tile against the server-resolved canonical_session and fall
-  // through to the authoritative registry open instead of fronting it.
-  const staleBot = {
-    connectionId: 'local',
-    name: 'alpha',
-    canonical_session: { id: 'bot-chat', resolved_id: 'bot-chat-tip' }
-  } as RosterRow
-
-  /** The probe openRosterBot hands the focus verb, captured. */
-  function captureProbe() {
-    let probe: ((tile: { storedSessionId: string; workspaceTabTitle?: string }) => boolean) | undefined
-
-    const focus = vi.fn((_key: string, isStaleTile?: typeof probe) => {
-      probe = isStaleTile
-
-      return null
-    })
-
-    return { focus, probe: () => probe }
-  }
-
-  it('classifies a canonical-titled tile at a foreign id as stale', async () => {
-    const { focus, probe } = captureProbe()
-    const restore = withFocusApi(focus as unknown as () => null | string)
-
-    try {
-      await openRosterBot(staleBot)
-
-      const isStale = probe()!
-      expect(isStale({ storedSessionId: 'old-finished-session', workspaceTabTitle: 'Bot Chat' })).toBe(true)
-    } finally {
-      restore()
-    }
-  })
-
-  it('keeps the tile that matches the registry row or its lineage tip', async () => {
-    const { focus, probe } = captureProbe()
-    const restore = withFocusApi(focus as unknown as () => null | string)
-
-    try {
-      await openRosterBot(staleBot)
-
-      const isStale = probe()!
-      expect(isStale({ storedSessionId: 'bot-chat', workspaceTabTitle: 'Bot Chat' })).toBe(false)
-      expect(isStale({ storedSessionId: 'bot-chat-tip', workspaceTabTitle: 'Bot Chat' })).toBe(false)
-    } finally {
-      restore()
-    }
-  })
-
-  it('never judges side-chat tabs — only canonical-titled tiles carry registry identity', async () => {
-    const { focus, probe } = captureProbe()
-    const restore = withFocusApi(focus as unknown as () => null | string)
-
-    try {
-      await openRosterBot(staleBot)
-
-      const isStale = probe()!
-      expect(isStale({ storedSessionId: 'scratch-thread', workspaceTabTitle: 'Group: writers' })).toBe(false)
-      expect(isStale({ storedSessionId: 'scratch-thread' })).toBe(false)
-    } finally {
-      restore()
-    }
-  })
-
-  it('an older gateway without canonical_session cannot judge — every tile survives', async () => {
-    const { focus, probe } = captureProbe()
-    const restore = withFocusApi(focus as unknown as () => null | string)
-
-    try {
-      await openRosterBot(bot) // no canonical_session on this row
-
-      const isStale = probe()!
-      expect(isStale({ storedSessionId: 'anything', workspaceTabTitle: 'Bot Chat' })).toBe(false)
-    } finally {
-      restore()
-    }
-  })
-
-  it('falls through to the authoritative canonical open when the stale tile was the only tab', async () => {
-    // The store discards the stale tile and reports null; the click must
-    // then resolve the registry — the backend-truth path — not give up.
-    const restore = withFocusApi(() => null)
-
-    try {
-      await expect(openRosterBot(staleBot)).resolves.toBe(true)
-
-      expect(openBotCanonicalChat).toHaveBeenCalled()
-      expect($openBotChat.get()?.openedRegistryId).toBe('bot-chat')
-    } finally {
-      restore()
-    }
-  })
-})
-
-describe('a shell that cannot report open tabs behaves as it did before', () => {
-  it('opens the canonical chat when the verb is missing', async () => {
-    const restore = withFocusApi(null)
-
-    try {
-      await expect(openRosterBot(bot)).resolves.toBe(true)
-
-      expect(openBotCanonicalChat).toHaveBeenCalled()
-    } finally {
-      restore()
-    }
-  })
-
-  it('opens the canonical chat when the verb throws', async () => {
-    const restore = withFocusApi(() => {
-      throw new Error('no tree yet')
-    })
-
-    try {
-      await expect(openRosterBot(bot)).resolves.toBe(true)
-
-      expect(openBotCanonicalChat).toHaveBeenCalled()
-    } finally {
-      restore()
-    }
-  })
-})
-
-describe('the claim a fronted tab records cannot resurrect the closed chat', () => {
-  // The reclaim listener re-resolves the canonical chat for a claim it owns,
-  // and guards on the registry id to avoid doing so for a fronted tab. That
-  // guard is only correct because a fronted-tab claim leaves the id empty
-  // while a real canonical open always fills it — the invariant asserted here.
-  it('leaves the registry id empty for a fronted tab', async () => {
-    const restore = withFocusApi(() => 'thread-2')
-
-    try {
-      await openRosterBot(bot)
-
-      expect($openBotChat.get()?.openedRegistryId).toBe('')
-      expect($openBotChat.get()?.openedSessionId).toBeTruthy()
-    } finally {
-      restore()
-    }
-  })
-
-  it('fills the registry id for a real canonical open', async () => {
-    const restore = withFocusApi(() => null)
-
-    try {
-      await openRosterBot(bot)
-
-      expect($openBotChat.get()?.openedRegistryId).toBeTruthy()
-    } finally {
-      restore()
-    }
-  })
-})
diff --git a/apps/desktop/src/plugins/hermes-bots/bot-row-opens-canonical-chat.test.ts b/apps/desktop/src/plugins/hermes-bots/bot-row-opens-canonical-chat.test.ts
new file mode 100644
index 0000000000..ca87583ff5
--- /dev/null
+++ b/apps/desktop/src/plugins/hermes-bots/bot-row-opens-canonical-chat.test.ts
@@ -0,0 +1,128 @@
+/**
+ * A bot row click lands on the bot's canonical Bot Chat — the session the row
+ * previews (`canonical_session`, resolved by name on every roster poll).
+ *
+ * The regression this pins: a plain click used to front whatever
+ * bots-workspace tab the user last had open for that bot. A `+` side thread
+ * persisted in Local Storage across restarts and won every click forever while
+ * the row kept previewing the Bot Chat — sidebar and center described two
+ * different conversations ("[Bots] - Sessions is not in sync again").
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { RosterRow } from './types'
+
+const { openBotCanonicalChat, prepareBotSource } = vi.hoisted(() => ({
+  openBotCanonicalChat: vi.fn(),
+  prepareBotSource: vi.fn()
+}))
+
+vi.mock('./canonical-chat', () => ({
+  CANONICAL_CHAT_TITLE: 'Bot Chat',
+  ensureBotMetadata: vi.fn(async () => ({})),
+  notifyBotOpenFailure: vi.fn(),
+  openBotCanonicalChat,
+  prepareBotSource,
+  PROFILE_SESSION_LIST_LIMIT: 200
+}))
+
+const { host } = await import('@hermes/plugin-sdk')
+const { $openBotChat, $selectedBot } = await import('./bot-state')
+const { openRosterBot, trackInboundActivity } = await import('./roster-actions')
+const { $selectedStoredSessionId } = await import('@/store/session')
+
+const bot = { connectionId: 'local', name: 'alpha' } as RosterRow
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  prepareBotSource.mockResolvedValue(undefined)
+  openBotCanonicalChat.mockResolvedValue({ openedId: 'bot-chat-tip', registryId: 'bot-chat' })
+  $openBotChat.set(null)
+  $selectedBot.set('')
+})
+
+describe('a row click lands on the canonical chat, never a remembered side tab', () => {
+  const canonicalBot = {
+    ...bot,
+    canonical_session: { id: 'bot-chat', resolved_id: 'bot-chat-tip' }
+  } as RosterRow
+
+  afterEach(() => {
+    // @ts-expect-error — restore the harness default (no focus verb).
+    delete host.focusOpenWorkspaceSession
+  })
+
+  it('fronts an open Bot Chat tab without a registry round-trip, side tabs excluded', async () => {
+    const focus = vi.fn((_key: string, _probe: unknown, only?: readonly string[]) =>
+      only?.includes('bot-chat-tip') ? 'bot-chat-tip' : null
+    )
+
+    host.focusOpenWorkspaceSession = focus as never
+
+    await expect(openRosterBot(canonicalBot)).resolves.toBe(true)
+
+    expect(focus).toHaveBeenCalledWith('bot:alpha', expect.any(Function), ['bot-chat', 'bot-chat-tip'])
+    expect(openBotCanonicalChat).not.toHaveBeenCalled()
+    expect($openBotChat.get()).toEqual({
+      key: 'local::alpha',
+      openedRegistryId: 'bot-chat',
+      openedSessionId: 'bot-chat-tip'
+    })
+  })
+
+  it('resolves the registry when only a side thread is open', async () => {
+    // The shell would happily front 'side-thread' — the allowlist excludes it.
+    host.focusOpenWorkspaceSession = vi.fn((_key: string, _probe: unknown, only?: readonly string[]) =>
+      only?.includes('side-thread') ? 'side-thread' : null
+    ) as never
+
+    await expect(openRosterBot(canonicalBot)).resolves.toBe(true)
+
+    expect(openBotCanonicalChat).toHaveBeenCalledWith(canonicalBot, expect.any(Function))
+    expect($openBotChat.get()?.openedSessionId).toBe('bot-chat-tip')
+  })
+
+  it('a failed open records no claim', async () => {
+    openBotCanonicalChat.mockRejectedValueOnce(new Error('gateway away'))
+
+    await expect(openRosterBot(bot)).resolves.toBe(false)
+
+    expect($openBotChat.get()).toBeNull()
+  })
+})
+
+describe('the open Bot Chat follows its session on the gateway', () => {
+  // The roster poll is the only signal for turns that never reach this
+  // window's stream (cron bot-chat deliveries, message_agent, group rounds).
+  // When the FOCUSED chat's canonical session moves, it re-resolves so the pane
+  // repaints from the gateway instead of waiting for a restart (#99393).
+  const activeBot = (lastActive: number) =>
+    ({
+      connectionId: 'local',
+      name: 'alpha',
+      canonical_session: { id: 'bot-chat', resolved_id: 'bot-chat-tip', last_active: lastActive }
+    }) as RosterRow
+
+  it('re-opens the focused Bot Chat when its canonical session advances', () => {
+    $selectedBot.set('alpha')
+    $selectedStoredSessionId.set('bot-chat-tip')
+    trackInboundActivity([activeBot(100)]) // seeds the watermark
+
+    trackInboundActivity([activeBot(200)])
+
+    expect(openBotCanonicalChat).toHaveBeenCalledTimes(1)
+    $selectedStoredSessionId.set(null)
+  })
+
+  it('leaves the center alone when the Bot Chat is not what is focused', () => {
+    $selectedBot.set('alpha')
+    $selectedStoredSessionId.set('some-group-room')
+    trackInboundActivity([activeBot(300)])
+
+    trackInboundActivity([activeBot(400)])
+
+    expect(openBotCanonicalChat).not.toHaveBeenCalled()
+    $selectedStoredSessionId.set(null)
+  })
+})
diff --git a/apps/desktop/src/plugins/hermes-bots/bot-row.test.tsx b/apps/desktop/src/plugins/hermes-bots/bot-row.test.tsx
index ce51a8fe97..55dcc8e2df 100644
--- a/apps/desktop/src/plugins/hermes-bots/bot-row.test.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/bot-row.test.tsx
@@ -59,7 +59,7 @@ vi.mock('./roster-actions', () => ({ openRosterBot }))
 const noop = () => undefined
 
 function renderRow(bot: RosterRow) {
-  render(<BotRow bot={bot} onDelete={noop} onEdit={noop} onGroup={noop} />)
+  render(<BotRow bot={bot} onDelete={noop} onEdit={noop} onGroup={noop} onNewSection={noop} />)
 
   return screen.getByRole('button')
 }
@@ -132,14 +132,14 @@ describe('the row delegates the open and claims no activation authority', () =>
   })
 })
 
-describe('the menu carries the explicit ask for the forever-chat', () => {
-  it('opens the canonical chat, which a plain row click deliberately does not', async () => {
+describe('the menu opens the same forever-chat a row click does', () => {
+  it('opens the canonical chat', async () => {
     const bot = { name: 'alpha' } as RosterRow
 
     fireEvent.contextMenu(renderRow(bot))
     fireEvent.click(await screen.findByText('Open Bot Chat'))
 
-    expect(openRosterBot.mock.calls).toEqual([[bot, { canonical: true }]])
+    expect(openRosterBot.mock.calls).toEqual([[bot]])
   })
 })
 
diff --git a/apps/desktop/src/plugins/hermes-bots/bot-row.tsx b/apps/desktop/src/plugins/hermes-bots/bot-row.tsx
index dad5305d9b..a89ef20169 100644
--- a/apps/desktop/src/plugins/hermes-bots/bot-row.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/bot-row.tsx
@@ -14,6 +14,9 @@ import {
   ContextMenuContent,
   ContextMenuItem,
   ContextMenuSeparator,
+  ContextMenuSub,
+  ContextMenuSubContent,
+  ContextMenuSubTrigger,
   ContextMenuTrigger,
   haptic,
   host,
@@ -62,6 +65,7 @@ import { openRosterBot } from './roster-actions'
 import { botRosterMeta, botWorkspaceOwnerKey, setBotsWorkspaceOwner } from './routing'
 import { A2A_PREFIX_RE, botCanonicalSessionId, botRowOwnsWorkspace, previewKind, workerActiveAt } from './row-helpers'
 import type { GroupMember, RosterRow, SidebarRowLabels } from './types'
+import { $botSections, $draggingBot, BOT_DRAG_MIME, botSectionId, moveBotsToSection } from './user-sections'
 
 // ── bot row ──────────────────────────────────────────────────────────────────
 
@@ -81,10 +85,12 @@ interface BotRowProps {
   onDelete: (bot: RosterRow) => void
   onEdit: (bot: RosterRow) => void
   onGroup: (bot: RosterRow) => void
+  /** Opens the New section dialog; the bot is filed into it on create. */
+  onNewSection: (bot: RosterRow) => void
   showHandle?: boolean
 }
 
-export function BotRow({ bot, onDelete, onEdit, onGroup, showHandle }: BotRowProps) {
+export function BotRow({ bot, onDelete, onEdit, onGroup, onNewSection, showHandle }: BotRowProps) {
   const { t } = useI18n()
   const b = useBots()
   const activeProfile = useValue(host.state.profile)
@@ -207,15 +213,35 @@ export function BotRow({ bot, onDelete, onEdit, onGroup, showHandle }: BotRowPro
   // activate a source and resolve the canonical Bot Chat.
   const open = () => void openRosterBot(bot)
 
+  // DRAG lives on the row button itself: it already takes pointer events, so
+  // the click that opens the bot and the drag that files it are one element's
+  // gestures. The drag carries the roster key under a private MIME type, so
+  // only a section block can accept it.
+  const rosterKey = botRosterKey(bot)
+  const sections = useValue($botSections)
+  const dragging = useValue($draggingBot) === rosterKey
+  const currentSectionId = botSectionId(bot, allMeta)
+
   const row = (
     <RowButton
       aria-label={rowTooltip}
       className={cn(
         'flex w-full min-w-0 max-w-full items-center gap-2.5 overflow-hidden rounded-md px-2 py-2 text-left transition-colors',
         'hover:bg-(--chrome-action-hover)',
-        isActive && 'bg-(--ui-row-active-background)'
+        isActive && 'bg-(--ui-row-active-background)',
+        // The row being dragged fades in place; the browser's drag image is
+        // the row itself, so the ghost under the pointer is the full row.
+        dragging && 'opacity-40'
       )}
+      data-roster-key={rosterKey}
+      draggable
       onClick={open}
+      onDragEnd={() => $draggingBot.set(null)}
+      onDragStart={event => {
+        event.dataTransfer.setData(BOT_DRAG_MIME, rosterKey)
+        event.dataTransfer.effectAllowed = 'move'
+        $draggingBot.set(rosterKey)
+      }}
       onPointerEnter={warm}
     >
       <div className={cn('shrink-0', !sourceStatus.available && 'grayscale opacity-60')}>
@@ -284,7 +310,7 @@ export function BotRow({ bot, onDelete, onEdit, onGroup, showHandle }: BotRowPro
     <ContextMenu>
       <ContextMenuTrigger asChild>{row}</ContextMenuTrigger>
       <ContextMenuContent>
-        <ContextMenuItem onSelect={() => void openRosterBot(bot, { canonical: true })}>
+        <ContextMenuItem onSelect={() => void openRosterBot(bot)}>
           {b.bot.openBotChat}
         </ContextMenuItem>
         <ContextMenuSeparator />
@@ -381,6 +407,36 @@ export function BotRow({ bot, onDelete, onEdit, onGroup, showHandle }: BotRowPro
         >
           {b.bot.newChatWith}
         </ContextMenuItem>
+        <ContextMenuSeparator />
+        {/* Filing. Membership is one field on the bot's meta (`sectionId`), so
+            this is a one-field write and no list anywhere has to be kept in
+            sync with it. */}
+        <ContextMenuSub>
+          <ContextMenuSubTrigger>{b.sections.moveTo}</ContextMenuSubTrigger>
+          <ContextMenuSubContent>
+            {sections.map(section => (
+              <ContextMenuItem
+                disabled={section.id === currentSectionId}
+                key={section.id}
+                onSelect={() => void moveBotsToSection([bot], section.id)}
+              >
+                <Codicon className="mr-1.5" name="folder" />
+                {section.name}
+              </ContextMenuItem>
+            ))}
+            {sections.length ? <ContextMenuSeparator /> : null}
+            <ContextMenuItem onSelect={() => onNewSection(bot)}>
+              <Codicon className="mr-1.5" name="new-folder" />
+              {b.sections.newSectionEllipsis}
+            </ContextMenuItem>
+            {currentSectionId ? (
+              <ContextMenuItem onSelect={() => void moveBotsToSection([bot], null)}>
+                <Codicon className="mr-1.5" name="inbox" />
+                {b.sections.removeFromSection}
+              </ContextMenuItem>
+            ) : null}
+          </ContextMenuSubContent>
+        </ContextMenuSub>
         {isDefaultBot(bot) ? null : <ContextMenuSeparator />}
         {isDefaultBot(bot) ? null : (
           <ContextMenuItem onSelect={() => onDelete(bot)} variant="destructive">
diff --git a/apps/desktop/src/plugins/hermes-bots/canonical-chat-registry.test.ts b/apps/desktop/src/plugins/hermes-bots/canonical-chat-registry.test.ts
index 03e34f8e6c..791b710dd3 100644
--- a/apps/desktop/src/plugins/hermes-bots/canonical-chat-registry.test.ts
+++ b/apps/desktop/src/plugins/hermes-bots/canonical-chat-registry.test.ts
@@ -280,4 +280,29 @@ describe('a failed lookup fails CLOSED — never "no chat exists"', () => {
     await expect(createCanonicalChat('ops')).rejects.toThrow(/Bot Chat registry/)
     expect(calls.some(call => call.method === 'session.create')).toBe(false)
   })
+
+  // #98383: a profile backend mid-restart can answer `session.list`
+  // SUCCESSFULLY with an empty list instead of throwing. `rows.find(...) ||
+  // null` used to read that identically to "this bot never had a chat",
+  // which minted a replacement and re-fired the kickoff on every click.
+  it('refuses to mint on an empty lookup when the roster already confirmed a canonical chat', async () => {
+    const calls = respondWith(method => {
+      if (method === 'session.list') {
+        return { sessions: [] }
+      }
+
+      if (method === 'session.create') {
+        throw new Error('must not create: an empty result is not confirmed absence')
+      }
+
+      return {}
+    })
+
+    const bot = { canonical_session: { id: 'forever-chat' }, name: 'ops' } as RosterRow
+    const { openBotCanonicalChat } = await loadModule()
+
+    await expect(openBotCanonicalChat(bot)).rejects.toThrow(/Bot Chat registry/)
+    expect(calls.some(call => call.method === 'session.create')).toBe(false)
+    expect(hostMock.openSession).not.toHaveBeenCalled()
+  })
 })
diff --git a/apps/desktop/src/plugins/hermes-bots/canonical-chat.ts b/apps/desktop/src/plugins/hermes-bots/canonical-chat.ts
index abac5a0c0e..f25c72963b 100644
--- a/apps/desktop/src/plugins/hermes-bots/canonical-chat.ts
+++ b/apps/desktop/src/plugins/hermes-bots/canonical-chat.ts
@@ -213,8 +213,25 @@ async function findExistingCanonicalChat(owner: RosterRow | string): Promise<Can
   }
 
   const rows = res?.sessions ?? []
+  const match = rows.find(row => isCanonicalBotChatHistory(row))
 
-  return rows.find(row => isCanonicalBotChatHistory(row)) || null
+  if (match) {
+    return match
+  }
+
+  // A zero-row result is NOT the same as a thrown error, but it is just as
+  // capable of forking the forever chat: a profile backend mid-restart can
+  // answer `session.list` successfully with an empty list rather than
+  // failing it, and `|| null` used to read that identically to "this bot
+  // never had a chat" (#98383). The roster's own `canonical_session` is the
+  // last positive confirmation this profile HAD one — when that exists,
+  // an empty lookup is unconfirmed absence, not confirmed absence, so fail
+  // closed the same way a thrown RPC error already does instead of minting.
+  if (bot?.canonical_session?.id) {
+    throw new Error(`Could not confirm ${name}'s Bot Chat registry — not starting a new chat`)
+  }
+
+  return null
 }
 
 interface CreateCanonicalChatOptions {
diff --git a/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx b/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
index 79c339d749..27a23a1a8c 100644
--- a/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
@@ -1271,7 +1271,7 @@ export function CreateGroupChatDialog({ open, roster, onClose, onCreated }: Crea
                 return (
                   <label
                     className={cn(
-                      'flex cursor-pointer items-center gap-2 rounded-md px-1.5 py-1 transition-colors hover:bg-(--chrome-action-hover)',
+                      'flex min-w-0 cursor-pointer items-center gap-2 rounded-md px-1.5 py-1 transition-colors hover:bg-(--chrome-action-hover)',
                       disabled && 'cursor-not-allowed opacity-50'
                     )}
                     key={botRosterKey(bot)}
diff --git a/apps/desktop/src/plugins/hermes-bots/create-group-chat-dialog.picker-row-truncate.test.tsx b/apps/desktop/src/plugins/hermes-bots/create-group-chat-dialog.picker-row-truncate.test.tsx
new file mode 100644
index 0000000000..99d0ff6909
--- /dev/null
+++ b/apps/desktop/src/plugins/hermes-bots/create-group-chat-dialog.picker-row-truncate.test.tsx
@@ -0,0 +1,89 @@
+/**
+ * The New Group Chat picker rows are `label` flex containers wrapping a
+ * `min-w-0 flex-1` text column whose lines are `truncate`. A flex/grid item
+ * defaults to `min-width: auto`, so without `min-w-0` on the label itself the
+ * row can never shrink below its longest line (`@handle · in "A", "B", …`),
+ * `truncate` never engages, and the list widens past the viewport. The first
+ * click then focuses a checkbox that sits off-screen and scrolls every name
+ * out of view (PR #90624: wrapper 593px in a 414px viewport, scrollLeft 0 →
+ * 178.38 on click; 414px / 0 → 0 with the class).
+ *
+ * jsdom does no layout, so this asserts the contract the layout engine needs:
+ * the row label must opt out of the auto minimum width.
+ */
+
+import type * as HermesSdk from '@hermes/plugin-sdk'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+
+import { translateBots } from './i18n-test-helper'
+import type { RosterRow } from './types'
+
+vi.mock('@hermes/plugin-sdk', async importOriginal => {
+  const original = await importOriginal<typeof HermesSdk>()
+
+  return {
+    ...original,
+    host: {
+      ...original.host,
+      connections: vi.fn(async () => []),
+      notify: vi.fn(),
+      notifyError: vi.fn(),
+      request: vi.fn(async () => ({})),
+      requestProfile: vi.fn(async () => ({}))
+    },
+    // The plugin bundle normally lands via `ctx.i18n.register` at load.
+    usePluginI18n: () => translateBots
+  }
+})
+
+vi.setConfig({ testTimeout: 30_000 })
+
+const LONG_NAME = 'An Extraordinarily Long Bot Name That Would Widen The Picker Row Past The Dialog Edge'
+
+const roster: RosterRow[] = [
+  { connectionId: 'local', display_name: LONG_NAME, name: 'long-bot' },
+  { connectionId: 'local', name: 'short' }
+]
+
+beforeAll(async () => {
+  // Radix Dialog reaches for APIs jsdom does not implement.
+  Element.prototype.scrollIntoView = () => undefined
+  Element.prototype.hasPointerCapture = () => false
+  Element.prototype.releasePointerCapture = () => undefined
+  Element.prototype.setPointerCapture = () => undefined
+  await import('./create-dialog')
+}, 120_000)
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('CreateGroupChatDialog picker rows', () => {
+  it('lets the row label shrink so long bot names truncate instead of widening the list', async () => {
+    const { CreateGroupChatDialog } = await import('./create-dialog')
+
+    render(<CreateGroupChatDialog onClose={() => undefined} onCreated={() => undefined} open roster={roster} />)
+
+    const nameCell = screen.getByText(LONG_NAME)
+    const label = nameCell.closest('label')
+
+    expect(label).not.toBeNull()
+    // The row is a flex container AND a grid item; both default to
+    // `min-width: auto`, which is what defeats the inner `truncate`.
+    expect(label!.className.split(/\s+/)).toContain('min-w-0')
+    expect(label!.className.split(/\s+/)).toContain('flex')
+    // The text column it wraps is the one that actually ellipsizes.
+    expect(nameCell.className.split(/\s+/)).toContain('truncate')
+    expect(nameCell.parentElement!.className.split(/\s+/)).toEqual(expect.arrayContaining(['min-w-0', 'flex-1']))
+
+    // Every row gets the same treatment, not just the long one.
+    const labels = screen.getAllByRole('checkbox').map(box => box.closest('label'))
+
+    expect(labels).toHaveLength(roster.length)
+
+    for (const row of labels) {
+      expect(row!.className.split(/\s+/)).toContain('min-w-0')
+    }
+  })
+})
diff --git a/apps/desktop/src/plugins/hermes-bots/cron-detail.test.tsx b/apps/desktop/src/plugins/hermes-bots/cron-detail.test.tsx
index f42b9808d1..57ebdf91a5 100644
--- a/apps/desktop/src/plugins/hermes-bots/cron-detail.test.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/cron-detail.test.tsx
@@ -28,7 +28,8 @@ vi.mock('@hermes/plugin-sdk', async importOriginal => {
   return { ...sdk, host: { ...sdk.host, request } }
 })
 
-const { RoutineDetailDialog, RoutineRow, routineDetailIssue, routineDetailRows } = await import('./cron')
+const { RoutineDetailDialog, RoutineRow, routineDetailIssue, routineDetailRows, routineLastResult } =
+  await import('./cron')
 
 const activeJob: RoutineJob = {
   deliver: 'bot-chat',
@@ -88,6 +89,22 @@ describe('the facts the row never showed', () => {
     expect(valueOf(passthrough, 'Schedule')).toBe('0 9 * * 1-5')
   })
 
+  it('spells out every last_status the scheduler writes', () => {
+    // The gateway's literal set is closed; each one gets a human reading, and
+    // delivery_failed in particular must not read as a success.
+    expect(routineLastResult('ok')).toBe('Succeeded')
+    expect(routineLastResult('error')).toBe('Failed')
+    expect(routineLastResult('delivery_failed')).toBe('Ran, but delivery failed')
+    expect(routineLastResult('blocked_config')).toBe('Blocked by configuration (not run)')
+    // Unknown literals pass through rather than vanish.
+    expect(routineLastResult('something_new')).toBe('something_new')
+    expect(routineLastResult(undefined)).toBeNull()
+
+    expect(valueOf(routineDetailRows({ ...activeJob, last_status: 'delivery_failed' }), 'Last result')).toBe(
+      'Ran, but delivery failed'
+    )
+  })
+
   it('explains a failing or scheduler-paused job in failure order', () => {
     expect(routineDetailIssue(activeJob)).toBeNull()
     expect(routineDetailIssue({ ...activeJob, paused_reason: 'too many failures' })).toBe('too many failures')
diff --git a/apps/desktop/src/plugins/hermes-bots/cron.tsx b/apps/desktop/src/plugins/hermes-bots/cron.tsx
index 4e25a957aa..931bd069ac 100644
--- a/apps/desktop/src/plugins/hermes-bots/cron.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/cron.tsx
@@ -331,6 +331,36 @@ function routineTimestamp(value: string | undefined): null | string {
   return Number.isFinite(ms) ? `${relativeTime(ms)} · ${new Date(ms).toLocaleString()}` : null
 }
 
+/** The scheduler's `last_status` literals, spelled out for the inspector. The
+ *  set is closed on the gateway side, so every literal is named here — an
+ *  unknown one is passed through verbatim rather than hidden. `delivery_failed`
+ *  means the agent run succeeded but the brief never reached its target; it
+ *  must read as a failure, not as a run result the user can trust. */
+export function routineLastResult(status: string | null | undefined): null | string {
+  const raw = String(status || '').trim()
+
+  if (!raw) {
+    return null
+  }
+
+  switch (raw) {
+    case 'ok':
+      return 'Succeeded'
+
+    case 'error':
+      return 'Failed'
+
+    case 'delivery_failed':
+      return 'Ran, but delivery failed'
+
+    case 'blocked_config':
+      return 'Blocked by configuration (not run)'
+
+    default:
+      return raw
+  }
+}
+
 /** The facts `cron.manage list` already sends with every job, as label/value
  *  rows. Pure so the detail contract is testable without a renderer, and so
  *  the dialog cannot invent a field the gateway never sent: an absent value
@@ -353,7 +383,7 @@ export function routineDetailRows(job: RoutineJob | null | undefined): Array<{ l
       ['Repeat', job?.repeat],
       ['Next run', paused ? null : routineTimestamp(job?.next_run_at)],
       ['Last run', routineTimestamp(job?.last_run_at)],
-      ['Last result', job?.last_status],
+      ['Last result', routineLastResult(job?.last_status)],
       ['Delivers to', job?.deliver],
       ['Model', job?.model],
       ['Working directory', job?.workdir]
diff --git a/apps/desktop/src/plugins/hermes-bots/group-bot-handoff.test.ts b/apps/desktop/src/plugins/hermes-bots/group-bot-handoff.test.ts
index 6a64a3852a..40153bb120 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-bot-handoff.test.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-bot-handoff.test.ts
@@ -76,6 +76,14 @@ async function loadRoom(): Promise<Room> {
 
 const BOT: RosterRow = { name: 'alpha', title: 'Alpha' }
 
+const REMOTE_BOT: RosterRow = {
+  connectionId: 'remote-1',
+  name: 'alpha',
+  remoteSource: true,
+  sourceScoped: true,
+  title: 'Alpha'
+}
+
 /** Seat a room and front it as a main-window tab, recording tab closes in
  *  the order they happen relative to the canonical open. */
 function registerGroup(room: Room, group: string, timeline: string[]) {
@@ -111,6 +119,22 @@ describe('opening a bot from a fronted room', () => {
     expect(room.panes.groupChatMainTabs.has('Core')).toBe(false)
   })
 
+  it('retires the group tab before opening a bot from another connection', async () => {
+    const timeline: string[] = []
+    const room = await loadRoom()
+    registerGroup(room, 'Core', timeline)
+    openBotCanonicalChat.mockImplementation(async () => {
+      timeline.push('canonicalOpen')
+
+      return { openedId: 'stored-chat', registryId: 'stored-chat' }
+    })
+
+    expect(await room.actions.openRosterBot(REMOTE_BOT)).toBe(true)
+    expect(timeline.filter(event => event.includes(':group:'))).toHaveLength(1)
+    expect(timeline.findIndex(event => event.includes(':group:'))).toBeLessThan(timeline.indexOf('canonicalOpen'))
+    expect(room.panes.groupChatMainTabs.has('Core')).toBe(false)
+  })
+
   it('is safe with no room fronted', async () => {
     const timeline: string[] = []
     const room = await loadRoom()
@@ -141,8 +165,9 @@ describe('a failed open must not steal the center', () => {
     registerGroup(room, 'Core', [])
     prepareBotSource.mockRejectedValue(new Error('source preparation failed'))
 
-    expect(await room.actions.openRosterBot({ ...BOT, connectionId: 'local', sourceScoped: true })).toBe(false)
+    expect(await room.actions.openRosterBot(REMOTE_BOT)).toBe(false)
     expect(room.chat.$groupChatWorkspace.get()).toBe('Core')
+    expect(room.panes.groupChatMainTabs.has('Core')).toBe(true)
   })
 
   it('restores the room by its immutable roomId, so a rename mid-open still finds it', async () => {
diff --git a/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts b/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
index 90b7deaef4..b956c4883c 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
@@ -271,6 +271,45 @@ describe('per-turn socket lease', () => {
   })
 })
 
+describe('push-woken poll', () => {
+  it("wakes on the member session's message.complete instead of sleeping out the backstop", async () => {
+    // Real timers here: the contract is about WHEN the poll re-reads.
+    vi.unstubAllGlobals()
+    const listeners = new Map<string, Set<(event: unknown) => void>>()
+    const room = await loadRoom({ pollsBusy: 1, turn: () => 'woken reply' })
+
+    host.onEvent = (type: string, listener: (event: unknown) => void) => {
+      const set = listeners.get(type) ?? new Set()
+      set.add(listener)
+      listeners.set(type, set)
+
+      return () => set.delete(listener)
+    }
+
+    const started = Date.now()
+    const turn = room.turns.runGroupChatMemberTurn('Room', LOCAL_MEMBER, 'hi', 't1', [])
+
+    // Let the submit land and the first poll wait attach its listeners, then
+    // fire the terminal frame for the runtime id the submit used.
+    await new Promise(resolve => setTimeout(resolve, 50))
+    // The harness mints a fresh runtime id on every resume; the frame carries
+    // whichever one the session currently answers to.
+    const runtime = room.gateway.sessions.get(room.gateway.calls[0]?.stored)?.runtime
+    expect(listeners.get('message.complete')?.size).toBe(1)
+
+    for (const listener of listeners.get('message.complete') ?? []) {
+      listener({ type: 'message.complete', session_id: runtime })
+    }
+
+    expect(await turn).toBe('woken reply')
+    // Two quick re-reads (busy once, then done) — well under one 5s backstop tick.
+    expect(Date.now() - started).toBeLessThan(2000)
+    // Every listener was disposed once the turn finished.
+    expect(listeners.get('message.complete')?.size ?? 0).toBe(0)
+    expect(listeners.get('error')?.size ?? 0).toBe(0)
+  })
+})
+
 // #94376: a Codex intent-ack continuation nudge can land a substantive
 // answer, then get a synthetic "(pass)" reply to the nudge itself.
 describe('reply selection (#94376)', () => {
diff --git a/apps/desktop/src/plugins/hermes-bots/group-turns.ts b/apps/desktop/src/plugins/hermes-bots/group-turns.ts
index b9bd3e172c..7a79a37c14 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-turns.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-turns.ts
@@ -231,7 +231,71 @@ export async function ensureGroupChatSession(group: string, member: GroupMember)
 }
 
 const GROUP_TURN_TIMEOUT_MS = 180000
-const GROUP_TURN_POLL_MS = 2000
+// Backstop cadence only. The turn normally wakes the instant the member's
+// session emits its terminal frame (message.complete / error) via host.onEvent;
+// this poll exists for hosts without the event tap, sessions whose events
+// ride a socket this window doesn't hold, and frames lost to a reconnect.
+const GROUP_TURN_POLL_MS = 5000
+const GROUP_TURN_SETTLE_RECHECK_MS = 250
+const GROUP_TURN_SETTLE_RECHECKS = 8
+
+/** Resolve as soon as the member's session reports a terminal frame for the
+ *  turn — or after `ms` as the backstop. Feature-detected: without
+ *  `host.onEvent` (older shells, the node test harness) this is a plain sleep.
+ *  `error` is terminal too (agent init failed → no message.complete follows). */
+function waitForTurnSignal(runtimeIds: string[], ms: number): Promise<boolean> {
+  const ids = new Set(runtimeIds.filter(id => id.length > 0))
+
+  return new Promise(resolve => {
+    const unsubs: Array<() => void> = []
+    let timer: null | ReturnType<typeof setTimeout> = null
+    let settled = false
+
+    const done = (signalled: boolean) => {
+      if (settled) {
+        return
+      }
+
+      settled = true
+
+      if (timer !== null) {
+        clearTimeout(timer)
+      }
+
+      for (const unsub of unsubs) {
+        try {
+          unsub()
+        } catch {
+          /* disposer already ran */
+        }
+      }
+
+      resolve(signalled)
+    }
+
+    // (The test harness runs timers inline — `done` may already have fired
+    // by the time this assignment lands, hence the `settled` guard below.)
+    timer = setTimeout(() => done(false), ms)
+
+    if (settled || typeof host.onEvent !== 'function' || !ids.size) {
+      return
+    }
+
+    for (const type of ['message.complete', 'error']) {
+      try {
+        unsubs.push(
+          host.onEvent(type, (event: { session_id?: string }) => {
+            if (ids.has(String(event?.session_id || ''))) {
+              done(true)
+            }
+          })
+        )
+      } catch {
+        /* event tap unavailable — the timer still resolves */
+      }
+    }
+  })
+}
 
 // --- group-turn session-lease helpers (#93602) ------------------------------
 // A member turn is a session-scoped RPC SEQUENCE (resume → attach → submit →
@@ -560,6 +624,9 @@ async function runGroupChatMemberTurnLeased(
 
   // Baseline: how many messages exist before our submit.
   let before = 0
+  // Every runtime id this turn has seen for the member's session. Terminal
+  // frames are keyed by runtime id, and a resume can hand back a fresh one.
+  const runtimeIds = new Set<string>([runtime])
 
   try {
     const pre = (await requestForBot(member, 'session.resume', {
@@ -568,6 +635,10 @@ async function runGroupChatMemberTurnLeased(
     })) as GroupSessionSnapshot
 
     before = Array.isArray(pre?.messages) ? pre.messages.length : pre?.message_count || 0
+
+    if (pre?.session_id) {
+      runtimeIds.add(pre.session_id)
+    }
   } catch {
     /* lazy session — zero messages */
   }
@@ -625,11 +696,20 @@ async function runGroupChatMemberTurnLeased(
   // minting and submitting. Tracks the runtime id the submit landed on so
   // the poll fallback below targets a live session.
   const liveRuntime = await submitGroupTurnPrompt(member, runtime, stored, turnText)
+  runtimeIds.add(liveRuntime)
   const started = Date.now()
   let deadline = started + GROUP_TURN_TIMEOUT_MS
+  // After the terminal frame fires, the gateway still has to flip
+  // session.running off in its turn `finally` — re-check quickly for a few
+  // beats instead of falling back to the slow backstop cadence.
+  let quickRechecks = 0
 
   while (Date.now() < deadline) {
-    await new Promise(resolve => setTimeout(resolve, GROUP_TURN_POLL_MS))
+    const signalled = quickRechecks
+      ? await waitForTurnSignal([], GROUP_TURN_SETTLE_RECHECK_MS)
+      : await waitForTurnSignal([...runtimeIds], GROUP_TURN_POLL_MS)
+
+    quickRechecks = signalled ? GROUP_TURN_SETTLE_RECHECKS : Math.max(0, quickRechecks - 1)
 
     // #91868/#94569: an explicit stop (stopGroupThread) bumped the epoch AND
     // held this member — the member's session was interrupted, so nothing is
@@ -654,6 +734,10 @@ async function runGroupChatMemberTurnLeased(
       continue
     }
 
+    if (state?.session_id) {
+      runtimeIds.add(state.session_id)
+    }
+
     const messages = Array.isArray(state?.messages) ? state.messages : []
     const busy = Boolean(state?.inflight || state?.running)
     // A clarify blocking inside the member's session is a question for the
diff --git a/apps/desktop/src/plugins/hermes-bots/i18n.ts b/apps/desktop/src/plugins/hermes-bots/i18n.ts
index 3c8e74a7f7..477dbef093 100644
--- a/apps/desktop/src/plugins/hermes-bots/i18n.ts
+++ b/apps/desktop/src/plugins/hermes-bots/i18n.ts
@@ -75,6 +75,27 @@ type BotsMessages = {
     rosterUnavailable: (reason: string) => string
     waitingForGateway: string
   }
+  /** User-made roster sections (folders the user files bots into). */
+  sections: {
+    newSection: string
+    newTitle: string
+    renameTitle: string
+    nameLabel: string
+    namePlaceholder: string
+    create: string
+    rename: string
+    moveUp: string
+    moveDown: string
+    unassigned: string
+    options: (name: string) => string
+    headingTip: string
+    emptyHint: string
+    moveTo: string
+    newSectionEllipsis: string
+    removeFromSection: string
+    deleted: (name: string, count: number) => string
+    undo: string
+  }
   /** Creating, editing and removing a bot. */
   bot: {
     newTitle: string
@@ -284,6 +305,29 @@ const en: BotsMessages = {
     waitingForGateway:
       'Waiting for the gateway connection… (remote gateways can take a few seconds; retries automatically)'
   },
+  sections: {
+    newSection: 'New section',
+    newTitle: 'New section',
+    renameTitle: 'Rename section',
+    nameLabel: 'Section name',
+    namePlaceholder: 'e.g. Clients',
+    create: 'Create',
+    rename: 'Rename…',
+    moveUp: 'Move up',
+    moveDown: 'Move down',
+    unassigned: 'Unassigned',
+    options: name => `${name} section options`,
+    headingTip: 'Drop bots here · double-click to rename',
+    emptyHint: 'Drag bots here',
+    moveTo: 'Move to section',
+    newSectionEllipsis: 'New section…',
+    removeFromSection: 'Remove from section',
+    deleted: (name, count) =>
+      count === 0
+        ? `Deleted “${name}”`
+        : `Deleted “${name}” — ${count} ${count === 1 ? 'bot' : 'bots'} moved to Unassigned`,
+    undo: 'Undo'
+  },
   bot: {
     newTitle: 'New bot',
     editTitle: 'Edit profile',
@@ -478,6 +522,27 @@ const ja: BotsMessages = {
       `名簿を取得できません: ${reason}。ゲートウェイが profiles.list より前の場合は、Hermes を更新してゲートウェイを再起動してください。`,
     waitingForGateway: 'ゲートウェイ接続を待っています…（リモートは数秒かかることがあります。自動で再試行します）'
   },
+  sections: {
+    newSection: '新しいセクション',
+    newTitle: '新しいセクション',
+    renameTitle: 'セクション名を変更',
+    nameLabel: 'セクション名',
+    namePlaceholder: '例: クライアント',
+    create: '作成',
+    rename: '名前を変更…',
+    moveUp: '上へ移動',
+    moveDown: '下へ移動',
+    unassigned: '未分類',
+    options: name => `${name} セクションのオプション`,
+    headingTip: 'ここにボットをドロップ · ダブルクリックで名前を変更',
+    emptyHint: 'ここにボットをドラッグ',
+    moveTo: 'セクションへ移動',
+    newSectionEllipsis: '新しいセクション…',
+    removeFromSection: 'セクションから外す',
+    deleted: (name, count) =>
+      count === 0 ? `「${name}」を削除しました` : `「${name}」を削除しました — ${count} 件のボットを未分類に移動しました`,
+    undo: '元に戻す'
+  },
   bot: {
     newTitle: '新しいボット',
     editTitle: 'プロファイルを編集',
@@ -671,6 +736,27 @@ const zh: BotsMessages = {
     rosterUnavailable: reason => `无法获取名单：${reason}。如果网关早于 profiles.list，请更新 Hermes 并重启网关。`,
     waitingForGateway: '正在等待网关连接…（远程网关可能需要几秒；会自动重试）'
   },
+  sections: {
+    newSection: '新建分区',
+    newTitle: '新建分区',
+    renameTitle: '重命名分区',
+    nameLabel: '分区名称',
+    namePlaceholder: '例如：客户',
+    create: '创建',
+    rename: '重命名…',
+    moveUp: '上移',
+    moveDown: '下移',
+    unassigned: '未分类',
+    options: name => `${name} 分区选项`,
+    headingTip: '将机器人拖放到此处 · 双击重命名',
+    emptyHint: '将机器人拖到此处',
+    moveTo: '移动到分区',
+    newSectionEllipsis: '新建分区…',
+    removeFromSection: '移出分区',
+    deleted: (name, count) =>
+      count === 0 ? `已删除“${name}”` : `已删除“${name}” — ${count} 个机器人已移至未分类`,
+    undo: '撤销'
+  },
   bot: {
     newTitle: '新建机器人',
     editTitle: '编辑配置档案',
@@ -864,6 +950,27 @@ const zhHant: BotsMessages = {
     rosterUnavailable: reason => `無法取得名單：${reason}。如果閘道早於 profiles.list，請更新 Hermes 並重新啟動閘道。`,
     waitingForGateway: '正在等待閘道連線…（遠端閘道可能需要幾秒；會自動重試）'
   },
+  sections: {
+    newSection: '新增分區',
+    newTitle: '新增分區',
+    renameTitle: '重新命名分區',
+    nameLabel: '分區名稱',
+    namePlaceholder: '例如：客戶',
+    create: '建立',
+    rename: '重新命名…',
+    moveUp: '上移',
+    moveDown: '下移',
+    unassigned: '未分類',
+    options: name => `${name} 分區選項`,
+    headingTip: '將機器人拖放到此處 · 雙擊重新命名',
+    emptyHint: '將機器人拖到此處',
+    moveTo: '移動到分區',
+    newSectionEllipsis: '新增分區…',
+    removeFromSection: '移出分區',
+    deleted: (name, count) =>
+      count === 0 ? `已刪除「${name}」` : `已刪除「${name}」— ${count} 個機器人已移至未分類`,
+    undo: '復原'
+  },
   bot: {
     newTitle: '新增機器人',
     editTitle: '編輯設定檔',
diff --git a/apps/desktop/src/plugins/hermes-bots/plugin.tsx b/apps/desktop/src/plugins/hermes-bots/plugin.tsx
index 577d7db2e8..02f52826a8 100644
--- a/apps/desktop/src/plugins/hermes-bots/plugin.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/plugin.tsx
@@ -71,6 +71,7 @@ import { botRosterMeta, botWorkspaceOwnerKey, setBotsWorkspaceOwner } from './ro
 import { startHideSweepScheduler } from './session-sweep'
 import { bumpBotOpenGeneration, getBotOpenGeneration, ID, setPluginCtx } from './shared'
 import type { GroupChat, RosterRow } from './types'
+import { loadBotSections } from './user-sections'
 
 // ── plugin ───────────────────────────────────────────────────────────────────
 
@@ -95,6 +96,9 @@ export default {
     'Bot Mode — a one-chat-per-agent roster with avatars, routines, group chats, and bot-to-bot messaging. Ships with the app; disable here if unwanted.',
   register(ctx: PluginContext) {
     setPluginCtx(ctx)
+    // The user's own roster sections. Read once at register; every mutation
+    // writes through.
+    loadBotSections()
     const disposeLocales = ctx.i18n.register(BOTS_LOCALES)
     setGroupChatSyncDisposed(false)
     startFaceClock()
@@ -551,10 +555,10 @@ export default {
                 return
               }
 
-              // A claim without a registry id is a fronted non-canonical tab
-              // (focusExistingBotTab / the draft fallback): re-resolving the
-              // canonical chat here would open the Bot Chat the user has
-              // closed. Its tile recovers on the next send like any tab.
+              // A claim without a registry id is the legacy newChat draft
+              // fallback: re-resolving the canonical chat here would replace
+              // a draft the user is typing into. Its tile recovers on the next
+              // send like any tab.
               if (!claim.openedRegistryId) {
                 return
               }
diff --git a/apps/desktop/src/plugins/hermes-bots/roster-actions.ts b/apps/desktop/src/plugins/hermes-bots/roster-actions.ts
index 06fec0ec36..8004b12153 100644
--- a/apps/desktop/src/plugins/hermes-bots/roster-actions.ts
+++ b/apps/desktop/src/plugins/hermes-bots/roster-actions.ts
@@ -71,6 +71,8 @@ export function trackInboundActivity(roster: RosterRow[]) {
     // Activity in the exact bot owner the user is currently looking at is
     // already visible — never badge the open chat or its same-named twin.
     if ($selectedBot.get() === key) {
+      refreshOpenBotChat(bot)
+
       continue
     }
 
@@ -105,29 +107,45 @@ export function trackInboundActivity(roster: RosterRow[]) {
   }
 }
 
-/** The tab this bot's workspace already has open, fronted — or null when it has
- *  none. A roster click consults this BEFORE the canonical registry so a bot
- *  with open tabs simply comes back to the one the user left. It is what lets a
- *  closed Bot Chat STAY closed: the click path used to re-open the forever-chat
- *  beside every newer thread on every bot switch, and nothing records a close
- *  (this plugin keeps no closed set; core's tile bucket only forgets), so the
- *  only honest signal is the open set itself. Feature-detected — older shells
- *  fall through to the canonical open.
+/** The open Bot Chat's canonical session moved on the gateway (a cron
+ *  `bot-chat:` delivery, a teammate's `message_agent`, a group round, a CLI
+ *  turn) — none of those arrive on this window's live stream, so the pane
+ *  kept painting a stale transcript until an app restart (#99393). Re-run the
+ *  same registry open the row click uses: it fronts the chat in place and
+ *  forceResume re-pulls the transcript. Only while that chat is the FOCUSED
+ *  session — a group room or another tab owning the center must not be
+ *  yanked away by background activity — and never mid-turn, when the
+ *  activity is the turn itself, already streaming. */
+function refreshOpenBotChat(bot: RosterRow) {
+  const canonicalIds = [bot.canonical_session?.id, bot.canonical_session?.resolved_id].filter(Boolean).map(String)
+  const focused = String(host.state.focusedStoredSessionId?.get?.() || '')
+
+  if (!focused || !canonicalIds.includes(focused) || host.state.busy.get()) {
+    return
+  }
+
+  const generation = getBotOpenGeneration()
+  void openBotCanonicalChat(bot, () => generation === getBotOpenGeneration()).catch(() => {
+    /* the next click or reclaim event re-resolves it */
+  })
+}
+
+/** Front the bot's canonical Bot Chat when it is ALREADY open as a tab —
+ *  presentation only, no registry round-trip. Returns the fronted stored id,
+ *  or null when the chat is not on screen (or this shell cannot tell) and the
+ *  caller must resolve the registry.
  *
- *  The open set is a Local Storage cache, and it must reconcile with backend
- *  truth before it wins (hermes-agent#90102): a persisted "Bot Chat" tile can
- *  name a session the registry no longer resolves to — a superseded row from
- *  the retired pointer design, a re-minted canonical chat, a stale finished
- *  session. Fronting it re-pinned the roster click to that stale (often
- *  hidden) session forever while the row's preview described the live one.
- *  The staleness probe compares each canonical-titled tile against the
- *  roster's server-resolved `canonical_session` (identity by NAME, resolved
- *  fresh on every profiles.list): a mismatch means the registry moved on, so
- *  the tile is discarded and the click falls through to the authoritative
- *  registry open. Side-chat tabs (any other title) carry no registry identity
- *  and are never judged; an older gateway without `canonical_session` cannot
- *  judge either — both keep the tile, the pre-#90102 behavior. */
-function focusExistingBotTab(bot: RosterRow): null | string {
+ *  Only the canonical chat qualifies: a tile whose stored id is the roster's
+ *  server-resolved `canonical_session` (registry row or its lineage tip). An
+ *  earlier version fronted whatever bots-workspace tab the user last had
+ *  active — a `+` side thread persisted in Local Storage across restarts and
+ *  won every click forever while the row kept previewing the Bot Chat, so
+ *  sidebar and center described two different conversations ("[Bots] -
+ *  Sessions is not in sync again"). Side tabs stay open; they never answer a
+ *  click aimed at the bot. Canonical-titled tiles at a foreign id are stale
+ *  (hermes-agent#90102) and are discarded. Without `canonical_session` (older
+ *  gateway) nothing can be verified, so nothing is fronted. */
+function focusExistingBotTab(bot: RosterRow): null | { registryId: string; storedSessionId: string } {
   if (typeof host.focusOpenWorkspaceSession !== 'function') {
     return null
   }
@@ -135,31 +153,36 @@ function focusExistingBotTab(bot: RosterRow): null | string {
   const canonical = bot?.canonical_session
   const canonicalIds = [canonical?.id, canonical?.resolved_id].filter(Boolean).map(String)
 
+  if (canonicalIds.length === 0) {
+    return null
+  }
+
   const isStaleTile = (tile: { storedSessionId: string; workspaceTabTitle?: string }) =>
-    canonicalIds.length > 0 &&
     typeof tile.workspaceTabTitle === 'string' &&
     tile.workspaceTabTitle === CANONICAL_CHAT_TITLE &&
     !canonicalIds.includes(String(tile.storedSessionId))
 
   try {
-    const focused = host.focusOpenWorkspaceSession(botWorkspaceOwnerKey(bot), isStaleTile)
+    const focused = host.focusOpenWorkspaceSession(botWorkspaceOwnerKey(bot), isStaleTile, canonicalIds)
 
-    return typeof focused === 'string' && focused ? focused : null
+    return typeof focused === 'string' && focused ? { registryId: String(canonical!.id), storedSessionId: focused } : null
   } catch {
     return null
   }
 }
 
-/** Select one exact roster owner, then open its named canonical chat only when
- *  the current Desktop can route that owner without guessing. The workspace
+/** Select one exact roster owner and open its canonical Bot Chat — the same
+ *  session the row previews. Resolution always goes through the owner
+ *  profile's "Bot Chat" title registry: an already-open canonical tab is
+ *  fronted (focusExistingBotTab), otherwise openBotCanonicalChat resolves and
+ *  opens it in place; side tabs the user opened with `+` stay open beside it. A click never fronts a side tab: an
+ *  earlier "return to the last open tab" shortcut left the center on a `+`
+ *  thread (persisted in Local Storage across restarts) while the row kept
+ *  previewing the Bot Chat — sidebar and center described two different
+ *  conversations ("[Bots] - Sessions is not in sync again"). The workspace
  *  remembers only this transient opened-view observation; it never stores or
- *  resolves a canonical-chat id.
- *
- *  `canonical`: the user asked for the forever-chat itself (the row menu's
- *  "Open Bot Chat"). A plain row click is "go to this bot": when its workspace
- *  already holds tabs, the one the user last had active is fronted and no chat
- *  is resolved or opened — see focusExistingBotTab. */
-export async function openRosterBot(bot: RosterRow, { canonical = false } = {}): Promise<boolean> {
+ *  resolves a canonical-chat id. */
+export async function openRosterBot(bot: RosterRow): Promise<boolean> {
   const generation = bumpBotOpenGeneration()
   const key = botRosterKey(bot)
   const meta = botRosterMeta(bot, $botMeta.get())
@@ -178,7 +201,7 @@ export async function openRosterBot(bot: RosterRow, { canonical = false } = {}):
   haptic('tap')
   saveSelectedRosterBot(bot)
   setBotsWorkspaceOwner(botWorkspaceOwnerKey(bot), bot)
-  const dismissedGroup = bot.remoteSource ? null : dismissGroupChatForLocalBotOpen()
+  const dismissedGroup = dismissGroupChatForBotOpen()
 
   if (!dismissedGroup) {
     $groupChatWorkspace.set(null)
@@ -213,18 +236,15 @@ export async function openRosterBot(bot: RosterRow, { canonical = false } = {}):
   // a bot open deliberately leaves the gateway on the launch profile.
   ackStoredSessionId(botCanonicalSessionId(bot), bot.name)
 
-  if (!canonical) {
-    const focused = focusExistingBotTab(bot)
+  const fronted = focusExistingBotTab(bot)
 
-    if (focused) {
-      // Open tabs win: no source activation, no registry consult, no open. The
-      // claim carries only the fronted tab so the focus edge it fires keeps it
-      // (releaseStaleOpenBotChat) and no registry id is recorded, because none
-      // was resolved.
-      $openBotChat.set({ key, openedRegistryId: '', openedSessionId: focused })
+  if (fronted) {
+    // The canonical chat is on screen: no source activation, no registry
+    // round-trip. Both identities are recorded so the reclaim listener and
+    // the roster-activity refresh treat it exactly like a registry open.
+    $openBotChat.set({ key, openedRegistryId: fronted.registryId, openedSessionId: fronted.storedSessionId })
 
-      return true
-    }
+    return true
   }
 
   try {
@@ -299,7 +319,7 @@ export async function openRosterBot(bot: RosterRow, { canonical = false } = {}):
 /** Bot-open handoff: capture the selected group and retire its registered
  * main tab (or clear the in-panel selection) before async source prep /
  * canonical open. */
-function dismissGroupChatForLocalBotOpen(): null | { group: string; roomId: string } {
+function dismissGroupChatForBotOpen(): null | { group: string; roomId: string } {
   const group = $groupChatWorkspace.get()
 
   if (!group) {
diff --git a/apps/desktop/src/plugins/hermes-bots/roster-pane.tsx b/apps/desktop/src/plugins/hermes-bots/roster-pane.tsx
index 60b561961d..b87c1062ef 100644
--- a/apps/desktop/src/plugins/hermes-bots/roster-pane.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/roster-pane.tsx
@@ -62,6 +62,7 @@ import { groupChatMemberBots, groupChatNames, groupLastActivity } from './group-
 import { $groupMainTabsRev, shouldRenderGroupChatInPane } from './group-panes'
 import { $showHiddenBots, isBotHidden, isBotPinned } from './hidden-bots'
 import { useBots } from './i18n'
+import { displayName } from './labels'
 import { deleteBot, mergeServerMeta, pullServerAvatars } from './profile-ops'
 import { $activityToasts, setActivityToasts, trackInboundActivity } from './roster-actions'
 import {
@@ -79,6 +80,18 @@ import { botRosterMeta, botWorkspaceOwnerKey, setBotsWorkspaceOwner } from './ro
 import { ACTIVE_WINDOW_S, activeBots, BOT_ROSTER_SEARCH_THRESHOLD, rosterActivityMatches } from './row-helpers'
 import { backfillMessagingProtocol } from './soul'
 import type { BotMeta, GatewaySource, GroupMember, RosterActivityFilter, RosterKindFilter, RosterRow } from './types'
+import {
+  $botSections,
+  $draggingBot,
+  createBotSection,
+  deleteBotSection,
+  groupRowsBySection,
+  moveBotSection,
+  moveBotsToSection,
+  renameBotSection,
+  UNASSIGNED_SECTION_KEY
+} from './user-sections'
+import { SectionDropZone, SectionNameDialog, useEscapeCancelsBotDrag, UserSectionHeader } from './user-sections-ui'
 
 /** Last source inventory returned by the desktop-wide agent roster. */
 const $lastSources = atom<GatewaySource[]>([])
@@ -251,6 +264,16 @@ export function BotsPane() {
   // it is not part of the shared RosterRow model, so it rides as an extra here.
   const [deleting, setDeleting] = useState<null | (RosterRow & { path?: string })>(null)
   const [deletingGroup, setDeletingGroup] = useState<null | { members: GroupMember[]; name: string }>(null)
+  const userSections = useValue($botSections)
+  const dragging = useValue($draggingBot)
+  useEscapeCancelsBotDrag()
+
+  // The one name dialog serves both New section (optionally filing the bot
+  // whose menu opened it) and Rename.
+  const [sectionDialog, setSectionDialog] = useState<
+    null | { bot?: RosterRow; mode: 'create' } | { id: string; mode: 'rename'; name: string }
+  >(null)
+
   const [grouping, setGrouping] = useState<null | RosterRow>(null)
   const [query, setQuery] = useState('')
   const [rowKindFilter, setRowKindFilter] = useState<RosterKindFilter>('all')
@@ -478,6 +501,11 @@ export function BotsPane() {
     // writes must settle after render: other subscribers of the same atoms
     // would otherwise be updated while BotsPane was still rendering.
     $lastRoster.set(roster.filter(row => !row?.ghost))
+    // Tabs caption a bot chat by its bot (#99152); republished with the
+    // roster so a rename follows and tiles restored at boot resolve.
+    roster.forEach(bot => {
+      host.setWorkspaceOwnerLabel?.(botWorkspaceOwnerKey(bot), displayName(bot, botRosterMeta(bot, allMeta)))
+    })
 
     if (Array.isArray(data?.sources)) {
       $lastSources.set(data.sources)
@@ -533,6 +561,7 @@ export function BotsPane() {
       onDelete={setDeleting}
       onEdit={setEditing}
       onGroup={setGrouping}
+      onNewSection={target => setSectionDialog({ bot: target, mode: 'create' })}
       showHandle={botNeedsHandleLabel(bot, roster, allMeta)}
     />
   )
@@ -549,6 +578,98 @@ export function BotsPane() {
     />
   )
 
+  const removeSection = (id: string) => {
+    const name = userSections.find(section => section.id === id)?.name || ''
+    const { members, undo } = deleteBotSection(id, roster)
+
+    // No confirmation: nothing is lost (the bots fall back to Unassigned) and
+    // the toast's Undo puts the section and its members back.
+    host.notify({
+      action: { label: b.sections.undo, onClick: undo },
+      durationMs: 8_000,
+      kind: 'info',
+      message: b.sections.deleted(name, members.length)
+    })
+  }
+
+  // USER SECTIONS — composed with the gateway sections, not instead of them.
+  // The gateway headings own the top level whenever the roster shows more
+  // than one connection (that axis answers "where does this run", which no
+  // folder name can, and a bot's membership lives in its profile on THAT
+  // gateway); user sections group the rows INSIDE each connection bucket,
+  // indented under it, and group the flat list when there is only one.
+  // `keyPrefix` keeps row keys unique across the gateway buckets.
+  type UserSectionRow = { bot: RosterRow; kind?: 'bot' } | RosterGroupRow
+
+  const renderUserSections = (rows: UserSectionRow[], keyPrefix = '') => {
+    // No sections made: the plain list, exactly as before this feature.
+    if (!userSections.length) {
+      return rows.map(row => (row.kind === 'group' ? renderGroupRow(row) : renderBotRow(row.bot, keyPrefix)))
+    }
+
+    const nested = Boolean(keyPrefix)
+    const blocks = groupRowsBySection(rows, userSections, allMeta)
+
+    return (
+      blocks
+        // An empty Unassigned is not worth a heading; an empty NAMED section
+        // is, because it is somewhere the user made and is about to drop into.
+        // Inside a gateway bucket the same empty section would repeat under
+        // every connection, so there it only appears while a drag is in flight
+        // (as the drop target it exists for); the row menu files into it
+        // regardless.
+        .filter(block => block.rows.length || (block.id && (!nested || dragging)))
+        .map(block => {
+          const key = `${keyPrefix}${block.id ? `user-section:${block.id}` : UNASSIGNED_SECTION_KEY}`
+          const collapsed = rosterSectionCollapsed(key)
+          const order = userSections.findIndex(section => section.id === block.id)
+
+          return (
+            <SectionDropZone
+              isSource={Boolean(dragging) && block.rows.some(row => row.kind !== 'group' && botRosterKey(row.bot) === dragging)}
+              key={key}
+              nested={nested}
+              onDropBot={rosterKey => {
+                const bot = roster.find(row => botRosterKey(row) === rosterKey)
+
+                // `block.id` is null for Unassigned, which is exactly the value
+                // moveBotsToSection wants for "clear the assignment".
+                if (bot) {
+                  void moveBotsToSection([bot], block.id)
+                }
+              }}
+            >
+              <UserSectionHeader
+                canMoveDown={order >= 0 && order < userSections.length - 1}
+                canMoveUp={order > 0}
+                collapsed={collapsed}
+                count={block.rows.length}
+                id={block.id}
+                name={block.name}
+                onDelete={() => block.id && removeSection(block.id)}
+                onMove={delta => block.id && moveBotSection(block.id, delta)}
+                onRename={() => block.id && setSectionDialog({ id: block.id, mode: 'rename', name: block.name })}
+                onToggle={() => toggleRosterSection(key)}
+              />
+              {collapsed ? null : block.rows.length ? (
+                <div className="grid min-w-0 gap-0.5">
+                  {block.rows.map(row =>
+                    row.kind === 'group' ? renderGroupRow(row) : renderBotRow(row.bot, `${key}:`)
+                  )}
+                </div>
+              ) : (
+                // Empty section: a quiet dashed slot that says what it is for,
+                // and doubles as a roomy drop target.
+                <div className="mx-1 mb-1 rounded-md border border-dashed border-(--ui-stroke-secondary) px-2 py-2 text-center text-[0.6875rem] text-(--ui-text-quaternary)">
+                  {b.sections.emptyHint}
+                </div>
+              )}
+            </SectionDropZone>
+          )
+        })
+    )
+  }
+
   const renderGatewaySection = (section: ResolvedRosterGatewaySection) => {
     const sectionId = `gateway:${section.id}`
     const collapsed = rosterSectionCollapsed(sectionId)
@@ -562,7 +683,9 @@ export function BotsPane() {
           option={section.option}
         />
         {collapsed ? null : (
-          <div className="grid min-w-0 gap-0.5">{section.rows.map(row => renderBotRow(row.bot, `${section.id}:`))}</div>
+          <div className="grid min-w-0 gap-0.5">
+            {renderUserSections(section.rows, `${section.id}:`)}
+          </div>
         )}
       </div>
     )
@@ -641,6 +764,11 @@ export function BotsPane() {
                 <Codicon className="mr-1.5" name="organization" />
                 {b.group.newTitle}
               </DropdownMenuItem>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={() => setSectionDialog({ mode: 'create' })}>
+                <Codicon className="mr-1.5" name="new-folder" />
+                {b.sections.newSection}
+              </DropdownMenuItem>
             </DropdownMenuContent>
           </DropdownMenu>
         </div>
@@ -808,14 +936,14 @@ export function BotsPane() {
           />
         </div>
       ) : (
-        <div className="min-h-0 flex-1 overflow-y-auto overscroll-contain">
+        <div className="min-h-0 flex-1 overflow-y-auto overscroll-contain" data-slot="bots-roster">
           <div className="grid w-full min-w-0 gap-0.5 px-1.5 pb-2">
             {showGatewaySections
               ? [
                   sortedGroupRows.length ? renderGroupChatSection() : null,
                   ...gatewaySections.sections.map(renderGatewaySection)
                 ].filter(Boolean)
-              : rosterRows.map(row => (row.kind === 'group' ? renderGroupRow(row) : renderBotRow(row.bot)))}
+              : renderUserSections(rosterRows)}
             {showHiddenSection ? (
               <div
                 className="mt-1 border-t border-(--ui-stroke-tertiary) pt-1"
@@ -870,6 +998,23 @@ export function BotsPane() {
         // registered connections — their turns route to their own machines.
         roster={roster}
       />
+      <SectionNameDialog
+        initialName={sectionDialog?.mode === 'rename' ? sectionDialog.name : ''}
+        mode={sectionDialog?.mode === 'rename' ? 'rename' : 'create'}
+        onOpenChange={open => {
+          if (!open) {
+            setSectionDialog(null)
+          }
+        }}
+        onSubmit={name => {
+          if (sectionDialog?.mode === 'rename') {
+            renameBotSection(sectionDialog.id, name)
+          } else {
+            createBotSection(name, sectionDialog?.bot ? [sectionDialog.bot] : [])
+          }
+        }}
+        open={Boolean(sectionDialog)}
+      />
       <EditProfileDialog
         bot={editing}
         onClose={() => {
diff --git a/apps/desktop/src/plugins/hermes-bots/roster-sections.tsx b/apps/desktop/src/plugins/hermes-bots/roster-sections.tsx
index dd4cd01378..fb1d1e3a6d 100644
--- a/apps/desktop/src/plugins/hermes-bots/roster-sections.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/roster-sections.tsx
@@ -7,7 +7,8 @@
  * without either half knowing about a bot row.
  */
 
-import { Codicon, ConnectionGlyph, DisclosureCaret, RowButton, Tip } from '@hermes/plugin-sdk'
+import { cn, Codicon, ConnectionGlyph, DisclosureCaret, RowButton, Tip } from '@hermes/plugin-sdk'
+import type { ReactNode } from 'react'
 
 import { botHandle, botRosterKey, botSourceStatus, filterBots } from './data'
 import { displayName } from './labels'
@@ -222,22 +223,28 @@ export function GatewayKindGlyph({ className, kind }: GatewayKindGlyphProps) {
 /** Foldable roster heading. It organizes rows visually but never supplies or
  * reconstructs ownership; every action still receives the full bot row. */
 interface RosterSectionHeaderProps {
+  /** Trailing control drawn beside the heading (outside its button — a
+   *  button cannot nest a button). User sections put their ⋯ menu here. */
+  action?: ReactNode
   collapsed: boolean
   count: number
   gatewayKind?: string
   icon?: string
   label: string
+  onDoubleClick?: () => void
   onToggle: () => void
   status?: { available: boolean; label: string }
   tip?: string
 }
 
 export function RosterSectionHeader({
+  action,
   collapsed,
   count,
   gatewayKind,
   icon,
   label,
+  onDoubleClick,
   onToggle,
   status,
   tip
@@ -245,8 +252,12 @@ export function RosterSectionHeader({
   const button = (
     <RowButton
       aria-expanded={!collapsed}
-      className="mt-1 flex w-full min-w-0 items-center gap-1.5 rounded-md px-2 py-1.5 text-left text-[0.6875rem] font-semibold uppercase tracking-wider text-(--ui-text-quaternary) transition-colors hover:bg-(--chrome-action-hover) hover:text-(--ui-text-secondary)"
+      className={cn(
+        'flex w-full min-w-0 items-center gap-1.5 rounded-md px-2 py-1.5 text-left text-[0.6875rem] font-semibold uppercase tracking-wider text-(--ui-text-quaternary) transition-colors hover:bg-(--chrome-action-hover) hover:text-(--ui-text-secondary)',
+        action ? 'flex-1' : 'mt-1'
+      )}
       onClick={onToggle}
+      onDoubleClick={onDoubleClick}
     >
       <DisclosureCaret open={!collapsed} />
       {gatewayKind ? (
@@ -269,7 +280,18 @@ export function RosterSectionHeader({
     </RowButton>
   )
 
-  return tip ? <Tip label={tip}>{button}</Tip> : button
+  const heading = tip ? <Tip label={tip}>{button}</Tip> : button
+
+  // With a trailing action, heading and action share one hover group so the
+  // action can reveal on hover of the whole row.
+  return action ? (
+    <div className="group/section mt-1 flex w-full min-w-0 items-center gap-1 pr-1">
+      {heading}
+      {action}
+    </div>
+  ) : (
+    heading
+  )
 }
 
 interface GatewaySectionHeadingProps {
diff --git a/apps/desktop/src/plugins/hermes-bots/types.ts b/apps/desktop/src/plugins/hermes-bots/types.ts
index e21298f544..7770c1b5d9 100644
--- a/apps/desktop/src/plugins/hermes-bots/types.ts
+++ b/apps/desktop/src/plugins/hermes-bots/types.ts
@@ -53,6 +53,12 @@ export interface SessionPreview {
 
 /** Per-bot presentation state, persisted in the profile's `ui_meta`. */
 export interface BotMeta {
+  /** Which user-made section this bot is filed under (`user-sections.ts`).
+   *  Membership lives on the BOT, not as a member list on the section: a bot
+   *  can only be in one place, deleting a section cannot orphan anybody, and
+   *  the assignment rides the same profile.yaml sync every other bot setting
+   *  already uses — so sections follow the profile to another machine. */
+  sectionId?: null | string
   color?: string
   /** Set when the user has customized the avatar, so defaults stop applying. */
   custom?: boolean
diff --git a/apps/desktop/src/plugins/hermes-bots/user-sections-ui.tsx b/apps/desktop/src/plugins/hermes-bots/user-sections-ui.tsx
new file mode 100644
index 0000000000..609f1a7a97
--- /dev/null
+++ b/apps/desktop/src/plugins/hermes-bots/user-sections-ui.tsx
@@ -0,0 +1,344 @@
+/**
+ * The chrome for user sections: the foldable heading (the roster's own
+ * `RosterSectionHeader`, with a ⋯ menu and a right-click menu that drive the
+ * same actions), the name dialog used for both New section and Rename (the
+ * same shape the app's session rename uses), and the drop zone a section
+ * block sits in. The model is in `user-sections.ts`; nothing here holds state
+ * that outlives a dialog.
+ */
+
+import {
+  Button,
+  cn,
+  Codicon,
+  ContextMenu,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuSeparator,
+  ContextMenuTrigger,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+  Input,
+  useI18n,
+  useValue
+} from '@hermes/plugin-sdk'
+import { type DragEvent, type ReactNode, useEffect, useRef, useState } from 'react'
+
+import { useBots } from './i18n'
+import { RosterSectionHeader } from './roster-sections'
+import { $draggingBot, BOT_DRAG_MIME } from './user-sections'
+
+// ── name dialog ──────────────────────────────────────────────────────────────
+
+interface SectionNameDialogProps {
+  /** Blank for New section, the current name for Rename. */
+  initialName: string
+  mode: 'create' | 'rename'
+  onOpenChange: (open: boolean) => void
+  onSubmit: (name: string) => void
+  open: boolean
+}
+
+/** One small dialog for both creating and renaming a section — the app renames
+ *  sessions through the same Dialog + Input + Cancel/Save shape, so a section
+ *  rename feels like every other rename. */
+export function SectionNameDialog({ initialName, mode, onOpenChange, onSubmit, open }: SectionNameDialogProps) {
+  const { t } = useI18n()
+  const b = useBots()
+  const [value, setValue] = useState(initialName)
+  const inputRef = useRef<HTMLInputElement>(null)
+
+  useEffect(() => {
+    if (open) {
+      setValue(initialName)
+      window.setTimeout(() => inputRef.current?.select(), 0)
+    }
+  }, [initialName, open])
+
+  const submit = () => {
+    const next = value.trim()
+
+    if (!next) {
+      return
+    }
+
+    onOpenChange(false)
+
+    if (mode === 'create' || next !== initialName.trim()) {
+      onSubmit(next)
+    }
+  }
+
+  return (
+    <Dialog onOpenChange={onOpenChange} open={open}>
+      <DialogContent className="max-w-sm">
+        <DialogHeader>
+          <DialogTitle>{mode === 'create' ? b.sections.newTitle : b.sections.renameTitle}</DialogTitle>
+        </DialogHeader>
+        <Input
+          aria-label={b.sections.nameLabel}
+          autoFocus
+          maxLength={40}
+          onChange={event => setValue(event.target.value)}
+          onKeyDown={event => {
+            if (event.key === 'Enter' && !event.nativeEvent.isComposing) {
+              event.preventDefault()
+              submit()
+            }
+          }}
+          placeholder={b.sections.namePlaceholder}
+          ref={inputRef}
+          value={value}
+        />
+        <DialogFooter>
+          <Button onClick={() => onOpenChange(false)} type="button" variant="ghost">
+            {t.common.cancel}
+          </Button>
+          <Button disabled={!value.trim()} onClick={submit} type="button">
+            {mode === 'create' ? b.sections.create : t.common.save}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+// ── heading ──────────────────────────────────────────────────────────────────
+
+interface UserSectionHeaderProps {
+  canMoveDown: boolean
+  canMoveUp: boolean
+  collapsed: boolean
+  count: number
+  /** null for Unassigned, which has no record and therefore no menu. */
+  id: null | string
+  name: string
+  onDelete: () => void
+  onMove: (delta: number) => void
+  onRename: () => void
+  onToggle: () => void
+}
+
+export function UserSectionHeader({
+  canMoveDown,
+  canMoveUp,
+  collapsed,
+  count,
+  id,
+  name,
+  onDelete,
+  onMove,
+  onRename,
+  onToggle
+}: UserSectionHeaderProps) {
+  const b = useBots()
+  const { t } = useI18n()
+
+  // Unassigned has no record to rename, reorder or delete — it is whatever is
+  // left over — so it gets the plain heading rather than a menu of disabled
+  // items.
+  if (!id) {
+    return (
+      <RosterSectionHeader
+        collapsed={collapsed}
+        count={count}
+        icon="inbox"
+        label={b.sections.unassigned}
+        onToggle={onToggle}
+      />
+    )
+  }
+
+  // RIGHT-CLICK IS THE SAME MENU. The ⋯ button only appears on hover and is a
+  // small target; right-clicking the heading is what people actually try
+  // first. Both drive the identical actions, so neither can drift.
+  const items = [
+    { icon: 'edit', label: b.sections.rename, onSelect: onRename },
+    { disabled: !canMoveUp, icon: 'arrow-up', label: b.sections.moveUp, onSelect: () => onMove(-1) },
+    { disabled: !canMoveDown, icon: 'arrow-down', label: b.sections.moveDown, onSelect: () => onMove(1) }
+  ]
+
+  const action = (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <button
+          aria-label={b.sections.options(name)}
+          className="shrink-0 rounded-md p-0.5 text-(--ui-text-quaternary) opacity-0 transition hover:text-foreground group-hover/section:opacity-100 focus-visible:opacity-100 data-[state=open]:opacity-100"
+          type="button"
+        >
+          <Codicon name="ellipsis" />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end">
+        {items.map(item => (
+          <DropdownMenuItem disabled={item.disabled} key={item.label} onSelect={item.onSelect}>
+            <Codicon className="mr-1.5" name={item.icon} />
+            {item.label}
+          </DropdownMenuItem>
+        ))}
+        <DropdownMenuSeparator />
+        <DropdownMenuItem onSelect={onDelete} variant="destructive">
+          <Codicon className="mr-1.5" name="trash" />
+          {t.common.delete}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+
+  return (
+    <ContextMenu>
+      <ContextMenuTrigger asChild>
+        <div data-section-id={id} data-slot="bots-section-heading">
+          <RosterSectionHeader
+            action={action}
+            collapsed={collapsed}
+            count={count}
+            icon="folder"
+            label={name}
+            onDoubleClick={onRename}
+            onToggle={onToggle}
+            tip={b.sections.headingTip}
+          />
+        </div>
+      </ContextMenuTrigger>
+      <ContextMenuContent>
+        {items.map(item => (
+          <ContextMenuItem disabled={item.disabled} key={item.label} onSelect={item.onSelect}>
+            {item.label}
+          </ContextMenuItem>
+        ))}
+        <ContextMenuSeparator />
+        <ContextMenuItem onSelect={onDelete} variant="destructive">
+          {t.common.delete}
+        </ContextMenuItem>
+      </ContextMenuContent>
+    </ContextMenu>
+  )
+}
+
+// ── drop zone ────────────────────────────────────────────────────────────────
+
+/** While a bot is in flight, Escape cancels the gesture. Mount once in the
+ *  roster pane. */
+export function useEscapeCancelsBotDrag(): void {
+  const dragging = useValue($draggingBot)
+
+  useEffect(() => {
+    if (!dragging) {
+      return
+    }
+
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.key === 'Escape') {
+        $draggingBot.set(null)
+      }
+    }
+
+    window.addEventListener('keydown', onKeyDown, true)
+
+    return () => window.removeEventListener('keydown', onKeyDown, true)
+  }, [dragging])
+}
+
+interface SectionDropZoneProps {
+  children: ReactNode
+  /** Whether the dragged bot is already filed here — then the zone is not a
+   *  target, and the OS shows the no-drop cursor instead of a highlight that
+   *  promises a move that would change nothing. */
+  isSource: boolean
+  /** Drawn inside a gateway bucket: indented under a hairline rail so the
+   *  two heading levels read as parent and child. */
+  nested?: boolean
+  onDropBot: (rosterKey: string) => void
+}
+
+/** A section block as a drop target: the whole block (heading + rows, or the
+ *  empty placeholder) lights up while a bot is over it. */
+export function SectionDropZone({ children, isSource, nested, onDropBot }: SectionDropZoneProps) {
+  const dragging = useValue($draggingBot)
+  const [over, setOver] = useState(false)
+  const armed = Boolean(dragging) && !isSource
+  const lit = armed && over
+
+  // Escape cancels the gesture: the in-flight key is cleared (see the
+  // keydown hook in the roster pane), so every zone disarms at once and a
+  // drop that still lands is refused below. Reset the hover so the next drag
+  // starts clean.
+  useEffect(() => {
+    if (!dragging) {
+      setOver(false)
+    }
+  }, [dragging])
+
+  const accepts = (event: DragEvent) => armed && event.dataTransfer.types.includes(BOT_DRAG_MIME)
+
+  return (
+    <div
+      className={cn(
+        'relative min-w-0 rounded-md transition-[background-color,box-shadow] duration-100',
+        nested && 'ml-2.5 border-l border-(--ui-stroke-tertiary) pl-1',
+        // While a drag is live, every valid target gets a faint outline so the
+        // user can see where a drop is allowed before hovering one.
+        armed && 'ring-1 ring-inset ring-(--ui-stroke-secondary)',
+        lit && 'bg-(--ui-accent)/10 ring-(--ui-accent)'
+      )}
+      data-drop-over={lit ? 'true' : undefined}
+      data-slot="bots-section"
+      onDragEnter={event => {
+        if (accepts(event)) {
+          event.preventDefault()
+          setOver(true)
+        }
+      }}
+      onDragLeave={event => {
+        // Only clear when the pointer leaves the BLOCK, not when it crosses
+        // between the rows inside it — dragleave fires on every child
+        // boundary, which otherwise strobes the highlight.
+        if (!event.currentTarget.contains(event.relatedTarget as Node | null)) {
+          setOver(false)
+        }
+      }}
+      onDragOver={event => {
+        if (!accepts(event)) {
+          return
+        }
+
+        // preventDefault is what MAKES this a drop target — without it the
+        // browser refuses the drop and the cursor stays "no entry".
+        event.preventDefault()
+        event.dataTransfer.dropEffect = 'move'
+
+        if (!over) {
+          setOver(true)
+        }
+      }}
+      onDrop={event => {
+        setOver(false)
+        // The dropped row remounts under its new section, so its own dragend
+        // never reaches the new node — clear the in-flight state here or the
+        // row stays faded after a successful drop.
+        $draggingBot.set(null)
+
+        const key = event.dataTransfer.getData(BOT_DRAG_MIME)
+
+        // No in-flight key means the user pressed Escape mid-drag: refuse.
+        if (!key || !dragging || isSource) {
+          return
+        }
+
+        event.preventDefault()
+        onDropBot(key)
+      }}
+    >
+      {children}
+    </div>
+  )
+}
diff --git a/apps/desktop/src/plugins/hermes-bots/user-sections.test.ts b/apps/desktop/src/plugins/hermes-bots/user-sections.test.ts
new file mode 100644
index 0000000000..a16ca4fccc
--- /dev/null
+++ b/apps/desktop/src/plugins/hermes-bots/user-sections.test.ts
@@ -0,0 +1,123 @@
+/**
+ * User sections — the three invariants that make membership-on-the-bot safe:
+ * filing persists through `saveBotMeta` (so it rides profile sync), every row
+ * lands in exactly one block with the remainder as Unassigned, and deleting a
+ * section returns its bots to Unassigned rather than losing them.
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { saveBotMeta, storage } = vi.hoisted(() => ({
+  saveBotMeta: vi.fn<(bot: { name: string }, patch: Record<string, unknown>) => Promise<unknown>>(),
+  storage: new Map<string, unknown>()
+}))
+
+vi.mock('./data', async () => {
+  const { atom } = await import('nanostores')
+  const $botMeta = atom<Record<string, { sectionId?: null | string }>>({})
+
+  saveBotMeta.mockImplementation(async (bot: { name: string }, patch: Record<string, unknown>) => {
+    $botMeta.set({ ...$botMeta.get(), [bot.name]: { ...$botMeta.get()[bot.name], ...patch } })
+
+    return { serverOutcome: 'persisted', serverPersisted: true }
+  })
+
+  return { $botMeta, saveBotMeta }
+})
+
+vi.mock('./routing', () => ({
+  botRosterMeta: (bot: { name: string }, meta: Record<string, unknown>) => meta[bot.name]
+}))
+
+vi.mock('./shared', () => ({
+  getPluginCtx: () => ({
+    storage: {
+      get: (key: string, fallback: unknown) => (storage.has(key) ? storage.get(key) : fallback),
+      set: (key: string, value: unknown) => storage.set(key, value)
+    }
+  })
+}))
+
+import { $botMeta } from './data'
+import type { RosterRow } from './types'
+import {
+  $botSections,
+  createBotSection,
+  deleteBotSection,
+  groupRowsBySection,
+  loadBotSections,
+  moveBotsToSection,
+  UNASSIGNED_SECTION_KEY
+} from './user-sections'
+
+const bot = (name: string) => ({ name }) as RosterRow
+const row = (name: string) => ({ bot: bot(name), kind: 'bot' as const })
+
+beforeEach(() => {
+  storage.clear()
+  $botMeta.set({})
+  $botSections.set([])
+  saveBotMeta.mockClear()
+})
+
+describe('user sections', () => {
+  it('filing writes one sectionId per bot through saveBotMeta and survives a reload', async () => {
+    const section = createBotSection('Clients', [bot('nanox'), bot('scout')])!
+
+    // Membership rides the bot's own meta write (profile ui_meta), one per bot.
+    await vi.waitFor(() => expect(saveBotMeta).toHaveBeenCalledTimes(2))
+    expect(saveBotMeta).toHaveBeenCalledWith(bot('nanox'), { sectionId: section.id })
+
+    // A no-op move (already there) writes nothing.
+    await moveBotsToSection([bot('nanox')], section.id)
+    expect(saveBotMeta).toHaveBeenCalledTimes(2)
+
+    // The section record itself persists in plugin storage.
+    $botSections.set([])
+    loadBotSections()
+    expect($botSections.get()).toEqual([{ id: section.id, name: 'Clients' }])
+  })
+
+  it('groups every row exactly once; unknown or missing sections fall to Unassigned, drawn last', () => {
+    const rows = [row('nanox'), row('scout'), row('ghost'), { kind: 'group' as const, name: 'Room' }]
+
+    const meta = {
+      nanox: { sectionId: 'sec-clients' },
+      scout: { sectionId: 'sec-workforce' },
+      ghost: { sectionId: 'sec-deleted' }
+    }
+
+    const blocks = groupRowsBySection(
+      rows,
+      [
+        { id: 'sec-clients', name: 'Clients' },
+        { id: 'sec-workforce', name: 'Workforce' }
+      ],
+      meta
+    )
+
+    expect(blocks.map(b => [b.key, b.rows.length])).toEqual([
+      ['section:sec-clients', 1],
+      ['section:sec-workforce', 1],
+      [UNASSIGNED_SECTION_KEY, 2]
+    ])
+    expect(blocks.flatMap(b => b.rows)).toHaveLength(rows.length)
+    expect(groupRowsBySection(rows, [], meta)).toEqual([{ id: null, key: UNASSIGNED_SECTION_KEY, name: '', rows }])
+  })
+
+  it('deleting a section returns its bots to Unassigned, and undo refiles them', async () => {
+    const section = createBotSection('Clients', [bot('nanox')])!
+    createBotSection('Team')
+    await vi.waitFor(() => expect($botMeta.get().nanox?.sectionId).toBe(section.id))
+
+    const { members, undo } = deleteBotSection(section.id, [bot('nanox'), bot('scout')])
+
+    expect(members).toEqual([bot('nanox')])
+    expect($botSections.get().map(s => s.name)).toEqual(['Team'])
+    await vi.waitFor(() => expect($botMeta.get().nanox?.sectionId).toBeNull())
+
+    undo()
+    expect($botSections.get().map(s => s.name)).toEqual(['Clients', 'Team'])
+    await vi.waitFor(() => expect($botMeta.get().nanox?.sectionId).toBe(section.id))
+  })
+})
diff --git a/apps/desktop/src/plugins/hermes-bots/user-sections.ts b/apps/desktop/src/plugins/hermes-bots/user-sections.ts
new file mode 100644
index 0000000000..d653475535
--- /dev/null
+++ b/apps/desktop/src/plugins/hermes-bots/user-sections.ts
@@ -0,0 +1,247 @@
+/**
+ * USER SECTIONS — folders the user makes, not folders the topology makes.
+ *
+ * The roster already had sections (`roster-sections.tsx`), but only AUTOMATIC
+ * ones: one per gateway connection, plus the group-chat bucket. Those answer
+ * "where does this bot run", which is not the question you are asking when you
+ * want two client bots filed together under "Clients".
+ *
+ * So this is a SECOND axis, and it composes with the first rather than
+ * replacing it. Two deliberate choices:
+ *
+ *   * The membership lives on the BOT (`sectionId` in its ui_meta), not as a
+ *     member list on the section. A bot can only be in one place, deleting a
+ *     section cannot orphan anybody, and the assignment rides the same
+ *     profile.yaml sync every other bot setting already uses — so sections
+ *     follow the profile to another machine.
+ *   * "Unassigned" is not a section. It is whatever is left, always drawn
+ *     last, and it is where members of a deleted section land. With no
+ *     sections at all the roster renders exactly as it did before.
+ *
+ * Pure model + session atoms. No JSX — the pane composes it.
+ */
+
+import { atom } from 'nanostores'
+
+import { $botMeta, saveBotMeta } from './data'
+import { botRosterMeta } from './routing'
+import { getPluginCtx } from './shared'
+import type { BotMeta, RosterRow } from './types'
+
+export const UNASSIGNED_SECTION_KEY = 'section:unassigned'
+export const BOT_SECTIONS_KEY = 'bot-sections-v1'
+
+export interface BotSection {
+  id: string
+  name: string
+}
+
+/** `[{ id, name }]`, in display order. */
+export const $botSections = atom<BotSection[]>([])
+
+/** Roster key of the bot in flight during a drag. Session-only, and cleared
+ *  on dragend even when the drop lands outside any target — a stuck
+ *  "dragging" state outlives the gesture and reads as a broken pane. */
+export const $draggingBot = atom<null | string>(null)
+
+export function normalizeBotSections(value: unknown): BotSection[] {
+  if (!Array.isArray(value)) {
+    return []
+  }
+
+  const seen = new Set<string>()
+  const out: BotSection[] = []
+
+  for (const entry of value) {
+    const id = String((entry as BotSection)?.id || '').trim()
+    const name = String((entry as BotSection)?.name || '').trim()
+
+    if (!id || !name || seen.has(id)) {
+      continue
+    }
+
+    seen.add(id)
+    out.push({ id, name })
+  }
+
+  return out
+}
+
+function persistBotSections(next: BotSection[]): void {
+  $botSections.set(next)
+
+  try {
+    getPluginCtx()?.storage?.set?.(BOT_SECTIONS_KEY, next)
+  } catch {
+    // No storage — sections live for this window only, which is strictly
+    // better than the pane throwing while the user drags a bot into a folder.
+  }
+}
+
+/** Read the persisted list back at plugin start. */
+export function loadBotSections(): void {
+  try {
+    $botSections.set(normalizeBotSections(getPluginCtx()?.storage?.get?.(BOT_SECTIONS_KEY, [])))
+  } catch {
+    $botSections.set([])
+  }
+}
+
+function newSectionId(): string {
+  return `sec-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 7)}`
+}
+
+/** Create a section and file `bots` into it. Returns the new section, or
+ *  null when the name is blank. */
+export function createBotSection(name: string, bots: RosterRow[] = []): BotSection | null {
+  const clean = String(name || '').trim()
+
+  if (!clean) {
+    return null
+  }
+
+  const section: BotSection = { id: newSectionId(), name: clean }
+
+  persistBotSections([...$botSections.get(), section])
+  void moveBotsToSection(bots, section.id)
+
+  return section
+}
+
+export function renameBotSection(id: string, name: string): void {
+  const clean = String(name || '').trim()
+
+  if (!clean) {
+    return
+  }
+
+  persistBotSections($botSections.get().map(s => (s.id === id ? { ...s, name: clean } : s)))
+}
+
+/**
+ * Delete the section only. Its members are not deleted and not hidden — they
+ * fall back to Unassigned, which is the whole reason membership lives on the
+ * bot rather than on the section. Returns an undo that puts the section back
+ * in its slot and refiles the same bots, so the delete needs no confirmation.
+ */
+export function deleteBotSection(id: string, roster: RosterRow[] = []): { members: RosterRow[]; undo: () => void } {
+  const list = $botSections.get()
+  const index = list.findIndex(s => s.id === id)
+  const section = list[index]
+  const members = (roster || []).filter(bot => botSectionId(bot, $botMeta.get()) === id)
+
+  persistBotSections(list.filter(s => s.id !== id))
+  void moveBotsToSection(members, null)
+
+  return {
+    members,
+    undo: () => {
+      if (!section) {
+        return
+      }
+
+      const current = $botSections.get().filter(s => s.id !== id)
+
+      current.splice(Math.min(index, current.length), 0, section)
+      persistBotSections(current)
+      void moveBotsToSection(members, id)
+    }
+  }
+}
+
+export function moveBotSection(id: string, delta: number): void {
+  const list = $botSections.get()
+  const from = list.findIndex(s => s.id === id)
+  const to = from + delta
+
+  if (from < 0 || to < 0 || to >= list.length) {
+    return
+  }
+
+  const next = list.slice()
+  const [moved] = next.splice(from, 1)
+
+  next.splice(to, 0, moved!)
+  persistBotSections(next)
+}
+
+/**
+ * `null` clears the assignment (back to Unassigned). One `saveBotMeta` per
+ * bot — membership is a field on each bot's own profile, so that IS one write
+ * per profile — and the writes run in sequence rather than fanned out, so the
+ * shared local snapshot is never committed by two saves at once.
+ */
+export async function moveBotsToSection(bots: RosterRow[], sectionId: null | string): Promise<void> {
+  for (const bot of bots || []) {
+    if (bot && botSectionId(bot, $botMeta.get()) !== (sectionId || null)) {
+      await saveBotMeta(bot, { sectionId: sectionId || null })
+    }
+  }
+}
+
+export function botSectionId(bot: RosterRow, metaByName: Record<string, BotMeta>): null | string {
+  const id = botRosterMeta(bot, metaByName)?.sectionId
+
+  return id ? String(id) : null
+}
+
+export interface SectionBlock<TRow> {
+  id: null | string
+  key: string
+  name: string
+  rows: TRow[]
+}
+
+/**
+ * Split roster rows into section blocks, in section order, with Unassigned
+ * last. Pure, and returns EVERY row exactly once: a row whose `sectionId`
+ * names a section that no longer exists lands in Unassigned rather than
+ * vanishing, which is what makes deleting a section safe.
+ */
+export function groupRowsBySection<TRow extends { bot?: RosterRow } | RosterRow>(
+  rows: TRow[],
+  sections: unknown,
+  metaByName: Record<string, BotMeta>
+): SectionBlock<TRow>[] {
+  const list = normalizeBotSections(sections)
+  const known = new Set(list.map(s => s.id))
+  const byId = new Map<string, TRow[]>(list.map(s => [s.id, [] as TRow[]]))
+  const loose: TRow[] = []
+
+  for (const row of rows || []) {
+    const bot = ((row as { bot?: RosterRow })?.bot || row) as RosterRow
+    const id = bot ? botSectionId(bot, metaByName) : null
+
+    if (id && known.has(id)) {
+      byId.get(id)!.push(row)
+    } else {
+      loose.push(row)
+    }
+  }
+
+  const blocks: SectionBlock<TRow>[] = list.map(section => ({
+    id: section.id,
+    key: `section:${section.id}`,
+    name: section.name,
+    rows: byId.get(section.id) || []
+  }))
+
+  blocks.push({ id: null, key: UNASSIGNED_SECTION_KEY, name: '', rows: loose })
+
+  return blocks
+}
+
+// ── drag and drop ────────────────────────────────────────────────────────────
+//
+// Filing a bot by dragging it onto a section, which is the gesture people
+// reach for first; the row's "Move to section" submenu is the same action
+// for anyone who does not.
+//
+// A CUSTOM MIME TYPE, not `text/plain`: the roster shares a window with the
+// composer, the transcript and the tab strip, all of which accept dropped
+// text. A private type means a bot dragged onto any of them is simply not a
+// valid payload there, instead of pasting its roster key into someone's
+// message. `dataTransfer.types` is readable during dragover (the DATA itself
+// is not, by design), so a drop target can still light up correctly.
+
+export const BOT_DRAG_MIME = 'application/x-hermes-bot-key'
diff --git a/apps/desktop/src/sdk/index.ts b/apps/desktop/src/sdk/index.ts
index 4ae9303e40..bf28c8fb16 100644
--- a/apps/desktop/src/sdk/index.ts
+++ b/apps/desktop/src/sdk/index.ts
@@ -36,6 +36,7 @@ import {
   $workspaceMode,
   $workspaceOwnerKey,
   setWorkspaceScope as publishWorkspaceScope,
+  setWorkspaceOwnerLabel,
   type WorkspaceNewSessionTarget
 } from '@/components/pane-shell/workspace-scope'
 import { onGatewayEvent } from '@/contrib/events'
@@ -1160,6 +1161,11 @@ export const host = {
     return close
   },
 
+  /** Name a workspace owner on its tabs (a bot's display name). A canonical
+   *  chat's STORED title is an identity the backend resolves by name; this is
+   *  the caption shown for it. Feature-detect on older desktops. */
+  setWorkspaceOwnerLabel,
+
   /** Switch the visible main-pane workspace without unregistering retained panes. */
   setWorkspaceScope: (
     mode: WorkspaceMode,
@@ -1217,8 +1223,9 @@ export const host = {
    *  caller falls through to its authoritative open path. */
   focusOpenWorkspaceSession: (
     workspaceOwnerKey: string,
-    isStaleTile?: (tile: { storedSessionId: string; workspaceTabTitle?: string }) => boolean
-  ): null | string => focusWorkspaceOwnerSessionTile(workspaceOwnerKey, isStaleTile),
+    isStaleTile?: (tile: { storedSessionId: string; workspaceTabTitle?: string }) => boolean,
+    onlyStoredIds?: readonly string[]
+  ): null | string => focusWorkspaceOwnerSessionTile(workspaceOwnerKey, isStaleTile, onlyStoredIds),
 
   /** Reactive on-screen visibility of a contributed pane: true while it is in
    *  the layout tree, not dismissed/hidden, its zone un-minimized, AND holding
@@ -1510,6 +1517,11 @@ export {
   ContextMenuContent,
   ContextMenuItem,
   ContextMenuSeparator,
+  // Submenus: Bot Mode files a bot into a user section from its row menu, and
+  // a flat list of every folder would swamp the items already there.
+  ContextMenuSub,
+  ContextMenuSubContent,
+  ContextMenuSubTrigger,
   ContextMenuTrigger
 } from '@/components/ui/context-menu'
 export { CopyButton } from '@/components/ui/copy-button'
diff --git a/apps/desktop/src/store/composer-status.test.ts b/apps/desktop/src/store/composer-status.test.ts
index d47103b0cb..547d269c26 100644
--- a/apps/desktop/src/store/composer-status.test.ts
+++ b/apps/desktop/src/store/composer-status.test.ts
@@ -7,9 +7,14 @@ import {
   isSessionGoneForBackgroundPolling,
   reconcileBackgroundProcesses,
   refreshBackgroundProcesses,
-  resetBackgroundPollingGuard
+  resetBackgroundPollingGuard,
+  stopBackgroundProcess
 } from './composer-status'
 import { $gateway } from './gateway'
+import { markSessionGone } from './runtime-gone'
+
+vi.mock('./notifications', () => ({ notifyError: vi.fn() }))
+import { notifyError } from './notifications'
 
 const SID = 'sess-1'
 
@@ -263,6 +268,52 @@ describe('refreshBackgroundProcesses dead-session guard', () => {
 
     expect(request).toHaveBeenCalledTimes(2)
   })
+
+  it('dismisses a stale process row when Stop is clicked after the runtime is gone', async () => {
+    reconcileBackgroundProcesses(SID, [running('stale')])
+    markSessionGone(SID)
+    $gateway.set({ request: vi.fn() } as never)
+
+    await stopBackgroundProcess(SID, 'stale')
+
+    expect(items()).toEqual([])
+  })
+
+  it('dismisses a stale process row while the gateway is disconnected', async () => {
+    reconcileBackgroundProcesses(SID, [running('disconnected')])
+    markSessionGone(SID)
+    $gateway.set(null as never)
+
+    await stopBackgroundProcess(SID, 'disconnected')
+
+    expect(items()).toEqual([])
+  })
+
+  it('keeps the row and reports failure when the gateway is disconnected', async () => {
+    reconcileBackgroundProcesses(SID, [running('unreachable')])
+    $gateway.set(null as never)
+    vi.mocked(notifyError).mockClear()
+
+    await stopBackgroundProcess(SID, 'unreachable')
+
+    expect(items()).toEqual([expect.objectContaining({ id: 'unreachable', state: 'running' })])
+    expect(notifyError).toHaveBeenCalledWith(expect.any(Error), 'Could not stop the process')
+  })
+
+  it('dismisses and latches when Stop discovers the runtime is gone', async () => {
+    const request = vi.fn(async () => {
+      throw new Error('session not found')
+    })
+
+    reconcileBackgroundProcesses(SID, [running('rejected')])
+    $gateway.set({ request } as never)
+
+    await stopBackgroundProcess(SID, 'rejected')
+    await stopBackgroundProcess(SID, 'rejected')
+
+    expect(items()).toEqual([])
+    expect(request).toHaveBeenCalledTimes(1)
+  })
 })
 
 // ── Review-thread hardenings on the guard (#94950) ───────────────────────────
diff --git a/apps/desktop/src/store/composer-status.ts b/apps/desktop/src/store/composer-status.ts
index ce891688e5..f6970880b6 100644
--- a/apps/desktop/src/store/composer-status.ts
+++ b/apps/desktop/src/store/composer-status.ts
@@ -10,7 +10,8 @@ import { dispatchNativeNotification } from './native-notifications'
 import { notifyError } from './notifications'
 import { isSessionGone, isSessionGoneForBackgroundPolling, markSessionGone, noteRuntimeAlive } from './runtime-gone'
 import { $sessions, lineageAliases } from './session'
-import { $sessionStates } from './session-states'
+import { ambientRequestFor } from './session-gone-latch'
+import { $sessionStates, requestForOwnedSession } from './session-states'
 import { $subagentsBySession, type SubagentProgress } from './subagents'
 import { $todosBySession } from './todos'
 
@@ -401,7 +402,12 @@ export async function refreshBackgroundProcesses(sid: string): Promise<void> {
   }
 
   try {
-    const result = await gateway.request<{ processes?: GatewayProcessEntry[] }>('process.list', { session_id: sid })
+    const result = await requestForOwnedSession<{ processes?: GatewayProcessEntry[] }>(
+      sid,
+      ambientRequestFor(gateway),
+      'process.list',
+      { session_id: sid }
+    )
 
     reconcileBackgroundProcesses(sid, result?.processes ?? [])
     // The binding answered, so it is healthy: refund the stored session's
@@ -441,10 +447,34 @@ export function dismissBackgroundProcess(sid: string, id: string) {
  *  row while the process lived on, stranding rogue tasks. On failure the row
  *  stays so the user can retry / see it didn't die. */
 export async function stopBackgroundProcess(sid: string, id: string): Promise<void> {
+  const gateway = $gateway.get()
+
+  if (isSessionGone(sid)) {
+    // The backend has already declared this runtime gone, so there is no
+    // authoritative process left to kill through this session. Remove the
+    // stale local row instead of leaving the Stop button permanently inert.
+    dismissBackgroundProcess(sid, id)
+
+    return
+  }
+
+  if (!gateway) {
+    notifyError(new Error('Gateway is not connected'), 'Could not stop the process')
+
+    return
+  }
+
   try {
-    await $gateway.get()?.request('process.kill', { process_id: id, session_id: sid })
+    await requestForOwnedSession(sid, ambientRequestFor(gateway), 'process.kill', { process_id: id, session_id: sid })
     dismissBackgroundProcess(sid, id)
   } catch (err) {
+    if (isSessionGoneForBackgroundPolling(err)) {
+      dismissBackgroundProcess(sid, id)
+      markSessionGone(sid)
+
+      return
+    }
+
     notifyError(err, 'Could not stop the process')
   }
 }
@@ -471,7 +501,16 @@ export function resetSessionBackground(sid: string) {
     dismissed.add(item.id)
 
     if (item.state === 'running') {
-      void gateway?.request('process.kill', { process_id: item.id, session_id: sid }).catch(() => undefined)
+      if (gateway && !isSessionGone(sid)) {
+        void requestForOwnedSession(sid, ambientRequestFor(gateway), 'process.kill', {
+          process_id: item.id,
+          session_id: sid
+        }).catch(error => {
+          if (isSessionGoneForBackgroundPolling(error)) {
+            markSessionGone(sid)
+          }
+        })
+      }
     }
   }
 
diff --git a/apps/desktop/src/store/gateway.ts b/apps/desktop/src/store/gateway.ts
index 7601ea258e..b07971d13f 100644
--- a/apps/desktop/src/store/gateway.ts
+++ b/apps/desktop/src/store/gateway.ts
@@ -530,19 +530,6 @@ async function openSecondary(entry: Secondary): Promise<void> {
         // Best effort for partial test/HMR graphs. Production always loads the
         // real store; a failed import must not make the transport unrecoverable.
       }
-
-      // Runtime re-mint also invalidates the status-stack gone-latch: ids
-      // the dead runtime 4001'd may be live again once tiles re-resume.
-      // Fire-and-forget: composer-status imports from this module, so the
-      // import must stay dynamic (cycle), and it must NOT sit on the timed
-      // redial path — awaiting the module load here pushed cold-start
-      // redials past test/waitFor budgets. The reset needs no ordering
-      // guarantee relative to the dial.
-      void import('@/store/composer-status')
-        .then(({ resetBackgroundPollingGuard }) => resetBackgroundPollingGuard())
-        .catch(() => {
-          // Best effort for partial test/HMR graphs, same as above.
-        })
     }
 
     // Registry-scoped entries dial through getConnectionFor when the bridge has
diff --git a/apps/desktop/src/store/goals.test.ts b/apps/desktop/src/store/goals.test.ts
index e355776f36..c69ab23b2d 100644
--- a/apps/desktop/src/store/goals.test.ts
+++ b/apps/desktop/src/store/goals.test.ts
@@ -1,3 +1,4 @@
+import { JsonRpcGatewayError } from '@hermes/shared'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { $gateway } from './gateway'
@@ -8,6 +9,8 @@ describe('goal store', () => {
   afterEach(() => {
     vi.useRealTimers()
     $goalsBySession.set({})
+    $gateway.set(null as never)
+    resetBackgroundPollingGuard()
   })
 
   it('stores active goals from /goal output', () => {
@@ -109,6 +112,19 @@ describe('goal store', () => {
 
     expect($goalsBySession.get().s2).toMatchObject({ status: 'paused', title: 'other work' })
   })
+
+  it('does not retry goal hydration for a runtime rejected as session-not-found', async () => {
+    const request = vi.fn(async () => {
+      throw new JsonRpcGatewayError('session not found', { code: 4001 })
+    })
+
+    $gateway.set({ request } as never)
+
+    await refreshSessionGoal('dead-runtime')
+    await refreshSessionGoal('dead-runtime')
+
+    expect(request).toHaveBeenCalledTimes(1)
+  })
 })
 
 describe('refreshSessionGoal dead-session guard', () => {
diff --git a/apps/desktop/src/store/goals.ts b/apps/desktop/src/store/goals.ts
index aa51be46ce..8bd1ba4a0b 100644
--- a/apps/desktop/src/store/goals.ts
+++ b/apps/desktop/src/store/goals.ts
@@ -4,6 +4,8 @@ import { keyedTimeouts } from '@/lib/keyed-timeouts'
 
 import { $gateway } from './gateway'
 import { isSessionGone, isSessionGoneForBackgroundPolling, markSessionGone } from './runtime-gone'
+import { ambientRequestFor } from './session-gone-latch'
+import { requestForOwnedSession } from './session-states'
 
 export type GoalStatus = 'active' | 'done' | 'paused' | 'waiting'
 
@@ -169,7 +171,10 @@ export async function refreshSessionGoal(sid: string): Promise<void> {
   }
 
   try {
-    const result = await gateway.request<{ output?: string }>('slash.exec', { command: 'goal status', session_id: sid })
+    const result = await requestForOwnedSession<{ output?: string }>(sid, ambientRequestFor(gateway), 'slash.exec', {
+      command: 'goal status',
+      session_id: sid
+    })
 
     applyGoalStatusText(sid, result?.output ?? '', { hydrate: true })
   } catch (error) {
diff --git a/apps/desktop/src/store/local-models-flag.test.ts b/apps/desktop/src/store/local-models-flag.test.ts
new file mode 100644
index 0000000000..36bbae2bac
--- /dev/null
+++ b/apps/desktop/src/store/local-models-flag.test.ts
@@ -0,0 +1,40 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+describe('$localModelsEnabled', () => {
+  beforeEach(() => {
+    vi.resetModules()
+  })
+
+  it('reads true when the preload bridge reports the --local launch flag', async () => {
+    Object.defineProperty(window, 'hermesDesktop', {
+      configurable: true,
+      value: { localModelsEnabled: true }
+    })
+
+    const { $localModelsEnabled } = await import('./local-models-flag')
+
+    expect($localModelsEnabled.get()).toBe(true)
+  })
+
+  it('defaults to false when the bridge omits the flag (older preload, web)', async () => {
+    Object.defineProperty(window, 'hermesDesktop', {
+      configurable: true,
+      value: {}
+    })
+
+    const { $localModelsEnabled } = await import('./local-models-flag')
+
+    expect($localModelsEnabled.get()).toBe(false)
+  })
+
+  it('defaults to false with no bridge at all', async () => {
+    Object.defineProperty(window, 'hermesDesktop', {
+      configurable: true,
+      value: undefined
+    })
+
+    const { $localModelsEnabled } = await import('./local-models-flag')
+
+    expect($localModelsEnabled.get()).toBe(false)
+  })
+})
diff --git a/apps/desktop/src/store/local-models-flag.ts b/apps/desktop/src/store/local-models-flag.ts
new file mode 100644
index 0000000000..d42625f520
--- /dev/null
+++ b/apps/desktop/src/store/local-models-flag.ts
@@ -0,0 +1,16 @@
+import { atom } from 'nanostores'
+
+/**
+ * Launch-flag gate for every local-models surface in the GUI.
+ *
+ * Local models ship on main behind `--local` (either `hermes desktop --local`
+ * or the flag on Hermes.exe itself). The flag is strict: without it the GUI
+ * shows no local-models surface at all, even on a machine where local models
+ * are configured and running — the backend routes stay live, only the
+ * desktop's presentation is gated. Read once from the preload bridge at
+ * module load; a launch flag can't change mid-session, so nothing rewrites
+ * it outside tests.
+ */
+export const $localModelsEnabled = atom<boolean>(
+  typeof window !== 'undefined' && window.hermesDesktop?.localModelsEnabled === true
+)
diff --git a/apps/desktop/src/store/local-runtime-jobs.ts b/apps/desktop/src/store/local-runtime-jobs.ts
new file mode 100644
index 0000000000..64c343f483
--- /dev/null
+++ b/apps/desktop/src/store/local-runtime-jobs.ts
@@ -0,0 +1,169 @@
+import { atom } from 'nanostores'
+
+import { getLocalModelsJobs, getLocalModelsStatus } from '@/hermes'
+import { translateNow } from '@/i18n'
+import { notify, notifyError } from '@/store/notifications'
+import type { LocalRuntimeJob } from '@/types/hermes'
+
+// App-level tracker for local-runtime jobs (runtime installs, model
+// downloads). The AUTHORITY is the backend job registry — this store is a
+// cache of it (desktop guide: server truth is cached, not owned). Living at
+// the store layer, not in the settings pane, is what makes a download
+// survive the pane unmounting: anything can start a job, the poller follows
+// it to completion, and completion/failure notify app-wide exactly once.
+
+export const $localRuntimeJobs = atom<readonly LocalRuntimeJob[]>([])
+
+const POLL_ACTIVE_MS = 700
+let timer: null | number = null
+let polling = false
+// Jobs we've already toasted for, so a poll race can't double-notify.
+const settledNotified = new Set<string>()
+
+function jobsEqual(a: readonly LocalRuntimeJob[], b: readonly LocalRuntimeJob[]) {
+  if (a.length !== b.length) {
+    return false
+  }
+
+  return a.every((job, i) => {
+    const other = b[i]
+
+    return (
+      job.job_id === other.job_id &&
+      job.status === other.status &&
+      job.phase === other.phase &&
+      job.done_bytes === other.done_bytes
+    )
+  })
+}
+
+function notifySettled(previous: readonly LocalRuntimeJob[], next: readonly LocalRuntimeJob[]) {
+  const wasRunning = new Set(previous.filter(j => j.status === 'running').map(j => j.job_id))
+
+  for (const job of next) {
+    if (job.status === 'running' || !wasRunning.has(job.job_id) || settledNotified.has(job.job_id)) {
+      continue
+    }
+
+    settledNotified.add(job.job_id)
+
+    if (job.status === 'done') {
+      notify({
+        durationMs: 6_000,
+        kind: 'success',
+        title: translateNow('settings.localModels.title'),
+        message:
+          job.kind === 'model-download'
+            ? translateNow('settings.localModels.downloadDoneToast', job.target)
+            : job.kind === 'model-activate'
+              ? translateNow('settings.localModels.activateDoneToast', job.target)
+              : job.kind === 'quickstart'
+                ? translateNow('settings.localModels.quickstartDoneToast', job.target)
+                : translateNow('settings.localModels.installDoneToast')
+      })
+    } else {
+      notifyError(
+        new Error(job.error ?? job.detail ?? 'failed'),
+        job.kind === 'model-download'
+          ? translateNow('settings.localModels.downloadFailed', job.target)
+          : job.kind === 'model-activate'
+            ? translateNow('settings.localModels.activateFailed', job.target)
+            : job.kind === 'quickstart'
+              ? translateNow('settings.localModels.quickstartFailed')
+              : translateNow('settings.localModels.installFailed')
+      )
+    }
+  }
+}
+
+async function poll() {
+  try {
+    const { jobs } = await getLocalModelsJobs()
+    const previous = $localRuntimeJobs.get()
+
+    if (!jobsEqual(previous, jobs)) {
+      notifySettled(previous, jobs)
+      $localRuntimeJobs.set(jobs)
+    }
+  } catch {
+    // Backend unreachable — keep the last snapshot; the next poll retries.
+  }
+
+  const anyRunning = $localRuntimeJobs.get().some(j => j.status === 'running')
+
+  if (anyRunning) {
+    timer = window.setTimeout(() => void poll(), POLL_ACTIVE_MS)
+  } else {
+    polling = false
+    timer = null
+  }
+}
+
+// Idempotent kick: start (or keep) the poll loop while work is in flight.
+// Call after starting a job AND on app boot (to rediscover work started
+// before a reload).
+export function watchLocalRuntimeJobs() {
+  if (polling) {
+    return
+  }
+
+  polling = true
+
+  if (timer !== null) {
+    window.clearTimeout(timer)
+  }
+
+  void poll()
+}
+
+// Selector: the running download job for a catalog model id, if any.
+export function runningDownloadFor(jobs: readonly LocalRuntimeJob[], modelId: string): LocalRuntimeJob | null {
+  return jobs.find(j => j.kind === 'model-download' && j.status === 'running' && j.model_id === modelId) ?? null
+}
+
+// Selector: every model on its way to the library right now — plain
+// downloads plus quickstart runs while they are still fetching bytes
+// (later quickstart phases mean the model is staged and activating).
+// The model picker renders these as disabled progress rows.
+const DOWNLOAD_PHASES = new Set(['starting', 'installing-runtime', 'downloading'])
+
+export function runningModelDownloads(jobs: readonly LocalRuntimeJob[]): LocalRuntimeJob[] {
+  return jobs.filter(
+    j =>
+      j.status === 'running' &&
+      (j.kind === 'model-download' || (j.kind === 'quickstart' && DOWNLOAD_PHASES.has(j.phase)))
+  )
+}
+
+export function runningRuntimeInstall(jobs: readonly LocalRuntimeJob[]): LocalRuntimeJob | null {
+  return jobs.find(j => j.kind === 'runtime-install' && j.status === 'running') ?? null
+}
+
+// One engine-update toast per app session: checked at boot (after the
+// gateway is ready), only when the user runs the local engine. The
+// download itself is always a button click in Local Models — this is a
+// pointer, not an installer.
+let updateNotified = false
+
+export async function checkLocalRuntimeUpdate() {
+  if (updateNotified) {
+    return
+  }
+
+  try {
+    const status = await getLocalModelsStatus()
+
+    if (status.enabled && status.update_available) {
+      updateNotified = true
+      notify({
+        durationMs: 10_000,
+        kind: 'info',
+        title: translateNow('settings.localModels.title'),
+        message: translateNow('settings.localModels.updateToast', status.configured_tag)
+      })
+    }
+  } catch {
+    // Backend without the endpoint (older runtime) or transient failure —
+    // silently skip; the pane still shows the update row when opened.
+  }
+}
diff --git a/apps/desktop/src/store/native-notifications.test.ts b/apps/desktop/src/store/native-notifications.test.ts
index c1fd51d30f..69adfb0df0 100644
--- a/apps/desktop/src/store/native-notifications.test.ts
+++ b/apps/desktop/src/store/native-notifications.test.ts
@@ -15,6 +15,7 @@ import {
 } from './native-notifications'
 import { __resetNativeNotifyBaselineForTests, markNativeNotifyBaseline } from './notify-baseline'
 import { $approvalRequest, setApprovalRequest } from './prompts'
+import { markSessionGone, resetBackgroundPollingGuard } from './runtime-gone'
 import { $activeSessionId, setActiveSessionId } from './session'
 
 const desktopWindow = window as unknown as { hermesDesktop?: Window['hermesDesktop'] }
@@ -47,6 +48,7 @@ beforeEach(() => {
   }
 
   setActiveSessionId(null)
+  resetBackgroundPollingGuard()
   setWindowState({ focused: false, hidden: true })
   __resetNativeNotifyBaselineForTests()
 })
@@ -59,6 +61,8 @@ afterEach(() => {
   } else {
     delete desktopWindow.hermesDesktop
   }
+
+  resetBackgroundPollingGuard()
 })
 
 describe('dispatchNativeNotification focus gating', () => {
@@ -339,4 +343,12 @@ describe('respondToApprovalAction', () => {
     await respondToApprovalAction('bg', 'approve')
     expect(request).not.toHaveBeenCalled()
   })
+
+  it('does not retry an approval action for a runtime already marked gone', async () => {
+    markSessionGone('bg')
+
+    await respondToApprovalAction('bg', 'approve')
+
+    expect(request).not.toHaveBeenCalled()
+  })
 })
diff --git a/apps/desktop/src/store/native-notifications.ts b/apps/desktop/src/store/native-notifications.ts
index 09edafc2bb..4a76acb8a0 100644
--- a/apps/desktop/src/store/native-notifications.ts
+++ b/apps/desktop/src/store/native-notifications.ts
@@ -6,6 +6,7 @@ import { persistString, storedString } from '@/lib/storage'
 import { $gateway } from './gateway'
 import { withinNativeNotifyBaseline } from './notify-baseline'
 import { clearApprovalRequest } from './prompts'
+import { isSessionGone, isSessionGoneForBackgroundPolling, markSessionGone } from './runtime-gone'
 import { $activeSessionId } from './session'
 import { requestForOwnedSession } from './session-states'
 
@@ -353,6 +354,10 @@ export async function respondToApprovalAction(sessionId: null | string, actionId
     return
   }
 
+  if (sessionId && isSessionGone(sessionId)) {
+    return
+  }
+
   const gateway = $gateway.get()
 
   if (!gateway) {
@@ -373,7 +378,11 @@ export async function respondToApprovalAction(sessionId: null | string, actionId
       { choice, session_id: sessionId ?? undefined }
     )
     clearApprovalRequest(sessionId)
-  } catch {
+  } catch (error) {
+    if (sessionId && isSessionGoneForBackgroundPolling(error)) {
+      markSessionGone(sessionId)
+    }
+
     // Leave the prompt parked so the user can still resolve it in-app.
   }
 }
diff --git a/apps/desktop/src/store/profile.test.ts b/apps/desktop/src/store/profile.test.ts
index a4c6d75e3d..e6825de85a 100644
--- a/apps/desktop/src/store/profile.test.ts
+++ b/apps/desktop/src/store/profile.test.ts
@@ -9,7 +9,7 @@ import type { ProfileInfo } from '@/types/hermes'
 const ensureGatewayForProfile = vi.fn(async () => undefined)
 const ensureGatewayForAgent = vi.fn(async () => undefined)
 const openGatewayForProfile = vi.fn(async (_profile: string) => undefined)
-const $gateway = atom<unknown>({ id: 'live-socket' })
+const $gateway = atom<unknown>({ id: 'live-socket', connectionState: 'open' })
 const resetStarmapGraph = vi.fn()
 
 vi.mock('@/store/gateway', () => ({ $gateway, ensureGatewayForAgent, ensureGatewayForProfile, openGatewayForProfile }))
@@ -55,7 +55,7 @@ beforeEach(() => {
   getConnection.mockReset()
   ensureGatewayForProfile.mockClear()
   openGatewayForProfile.mockClear()
-  $gateway.set({ id: 'live-socket' })
+  $gateway.set({ id: 'live-socket', connectionState: 'open' })
   $activeGatewayProfile.set('default')
   $connection.set(localConn())
   $profiles.set([])
@@ -115,6 +115,17 @@ describe('ensureGatewayProfile → $connection sync (#46651)', () => {
     expect(ensureGatewayForProfile).not.toHaveBeenCalled()
     expect($connection.get()?.mode).toBe('remote')
   })
+
+  it('reconnects when the target profile is active but its gateway socket is closed', async () => {
+    $activeGatewayProfile.set('vps-remote')
+    $connection.set(remoteConn())
+    $gateway.set({ connectionState: 'closed' })
+    getConnection.mockResolvedValue(remoteConn())
+
+    await ensureGatewayProfile('vps-remote')
+
+    expect(ensureGatewayForProfile).toHaveBeenCalledWith('vps-remote')
+  })
 })
 
 describe('profile-scoped cache invalidation', () => {
diff --git a/apps/desktop/src/store/profile.ts b/apps/desktop/src/store/profile.ts
index 09ab31619f..9c9fdaf29a 100644
--- a/apps/desktop/src/store/profile.ts
+++ b/apps/desktop/src/store/profile.ts
@@ -491,7 +491,7 @@ export async function ensureGatewayProfile(profile: string | null | undefined):
 
   const target = normalizeProfileKey(profile)
 
-  if (normalizeProfileKey($activeGatewayProfile.get()) === target && $gateway.get()) {
+  if (normalizeProfileKey($activeGatewayProfile.get()) === target && $gateway.get()?.connectionState === 'open') {
     return
   }
 
@@ -503,7 +503,7 @@ export async function ensureGatewayProfile(profile: string | null | undefined):
     await gatewaySwitch.catch(() => undefined)
   }
 
-  if (normalizeProfileKey($activeGatewayProfile.get()) === target && $gateway.get()) {
+  if (normalizeProfileKey($activeGatewayProfile.get()) === target && $gateway.get()?.connectionState === 'open') {
     return
   }
 
@@ -857,6 +857,18 @@ function activateOnCurrentSource(target: string): Promise<void> {
   return connectionId ? ensureGatewayAgent(connectionId, target) : ensureGatewayProfile(target)
 }
 
+// Pin the next new chat to `name` (legacy profile-only door) so session.create
+// reads the profile the user clicked "+" under, not whatever
+// $activeGatewayProfile holds once an in-flight profile swap settles (#79005).
+export function pinNewChatProfile(name: string): string {
+  const target = normalizeProfileKey(name)
+  $newChatProfile.set(target)
+  $newChatRoute.set(null)
+  captureNewChatSource(profilePickConnectionId(target))
+
+  return target
+}
+
 // Start a fresh session in `name` WITHOUT collapsing the "All profiles" browse
 // view. Unlike selectProfile, it leaves $showAllProfiles untouched, so the
 // unified sidebar stays put — used by the per-profile "+" in the all-profiles
@@ -864,10 +876,7 @@ function activateOnCurrentSource(target: string): Promise<void> {
 // is in. Points new chats at the profile and opens its backend so the next
 // message lands in the right place.
 export function newSessionInProfile(name: string): void {
-  const target = normalizeProfileKey(name)
-  $newChatProfile.set(target)
-  $newChatRoute.set(null)
-  captureNewChatSource(profilePickConnectionId(target))
+  const target = pinNewChatProfile(name)
   requestFreshSession()
   // #81094: surface the failed dial instead of failing silently.
   void activateOnCurrentSource(target).catch((error: unknown) => {
diff --git a/apps/desktop/src/store/projects.ts b/apps/desktop/src/store/projects.ts
index 59d9fcf8d7..5fc59ab4b7 100644
--- a/apps/desktop/src/store/projects.ts
+++ b/apps/desktop/src/store/projects.ts
@@ -208,7 +208,9 @@ export function goToProject(id: string, options?: { newSession?: boolean }): voi
 //
 // Priority (first hit wins):
 //   1. Explicit sidebar project scope (drilled into a project / Home bucket)
-//   2. Configured default project dir / remote remembered cwd (detached otherwise)
+//   2. Configured default project dir (detached otherwise — in BOTH local and
+//      remote mode; a bare new chat never inherits the sticky remembered cwd,
+//      #57911 / #84220)
 //
 // The "active project" is just an atom ($projectScope) — so inside a project a
 // new session (cmd-n, the trunk "+") starts at that project's root (its primary
@@ -347,7 +349,7 @@ async function gatewayRequest<T>(method: string, params: Record<string, unknown>
   return gateway.request<T>(method, params)
 }
 
-function projectProfile(): null | string {
+export function projectProfile(): null | string {
   const profile = normalizeProfileKey($activeGatewayProfile.get())
 
   return $profileScope.get() === ALL_PROFILES || profile === ALL_PROFILES ? null : profile
diff --git a/apps/desktop/src/store/prompts.test.ts b/apps/desktop/src/store/prompts.test.ts
index 9f0e761f71..3b9e4ac825 100644
--- a/apps/desktop/src/store/prompts.test.ts
+++ b/apps/desktop/src/store/prompts.test.ts
@@ -1,4 +1,5 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { JsonRpcGatewayError } from '@hermes/shared'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { clearClarifyRequest, setClarifyRequest } from './clarify'
 import {
@@ -16,8 +17,8 @@ import {
   setSecretRequest,
   setSudoRequest
 } from './prompts'
-import { resetBackgroundPollingGuard } from './runtime-gone'
-import { $activeSessionId } from './session'
+import { isSessionGone, resetBackgroundPollingGuard } from './runtime-gone'
+import { $activeSessionId, setActiveSessionId } from './session'
 
 // Prompts are parked per-session; the exported $*Request views are scoped to the
 // active session, so each test focuses the session it's asserting on.
@@ -29,6 +30,7 @@ afterEach(() => {
   clearAllPrompts()
   clearClarifyRequest()
   $activeSessionId.set(null)
+  resetBackgroundPollingGuard()
 })
 
 describe('approval prompt store', () => {
@@ -130,6 +132,64 @@ describe('approval prompt store', () => {
       ['approval.received', { request_id: 'r1', session_id: 's1' }]
     ])
   })
+
+  it('does not replay a pending approval after the runtime is rejected as gone', async () => {
+    const request = vi.fn(async () => {
+      throw new JsonRpcGatewayError('session not found', { code: 4001 })
+    })
+
+    await replayPendingApproval({ request }, 'dead-runtime')
+    await replayPendingApproval({ request }, 'dead-runtime')
+
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(isSessionGone('dead-runtime')).toBe(true)
+    expect($approvalRequest.get()).toBeNull()
+  })
+
+  it('propagates transient approval replay failures without latching the runtime', async () => {
+    const request = vi.fn(async () => {
+      throw new Error('gateway timed out')
+    })
+
+    await expect(replayPendingApproval({ request }, 'transient-runtime')).rejects.toThrow('gateway timed out')
+    expect(isSessionGone('transient-runtime')).toBe(false)
+  })
+
+  it('keeps approval receipt failures contained and marks the runtime gone', async () => {
+    const request = vi.fn(async () => {
+      throw new JsonRpcGatewayError('session not found', { code: 4001 })
+    })
+
+    $activeSessionId.set('dead-runtime')
+
+    await expect(
+      receiveApprovalRequest(
+        { request },
+        { command: 'x', description: 'd', requestId: 'r1', sessionId: 'dead-runtime' }
+      )
+    ).resolves.toBeUndefined()
+
+    expect(isSessionGone('dead-runtime')).toBe(true)
+    expect($approvalRequest.get()?.requestId).toBe('r1')
+  })
+
+  it('propagates transient approval receipt failures without latching the runtime', async () => {
+    const request = vi.fn(async () => {
+      throw new Error('gateway timed out')
+    })
+
+    setActiveSessionId('transient-runtime')
+
+    await expect(
+      receiveApprovalRequest(
+        { request },
+        { command: 'x', description: 'd', requestId: 'r2', sessionId: 'transient-runtime' }
+      )
+    ).rejects.toThrow('gateway timed out')
+
+    expect(isSessionGone('transient-runtime')).toBe(false)
+    expect($approvalRequest.get()?.requestId).toBe('r2')
+  })
 })
 
 describe('sudo prompt store', () => {
diff --git a/apps/desktop/src/store/prompts.ts b/apps/desktop/src/store/prompts.ts
index 4aca295ede..13637fc797 100644
--- a/apps/desktop/src/store/prompts.ts
+++ b/apps/desktop/src/store/prompts.ts
@@ -3,6 +3,8 @@ import { atom, computed, type ReadableAtom } from 'nanostores'
 import { $clarifyRequest, $clarifyRequests } from './clarify'
 import { isSessionGone, isSessionGoneForBackgroundPolling, markSessionGone } from './runtime-gone'
 import { $activeSessionId } from './session'
+import { ambientRequestFor } from './session-gone-latch'
+import { requestForOwnedSession } from './session-states'
 
 // Blocking interactive prompts the gateway raises mid-turn. Each maps to a
 // `*.request` event the Python side emits while it blocks the agent thread
@@ -120,10 +122,20 @@ export async function receiveApprovalRequest(gateway: ApprovalGateway | null, re
   setApprovalRequest(request)
 
   if (gateway && request.requestId && request.sessionId) {
-    await gateway.request('approval.received', {
-      request_id: request.requestId,
-      session_id: request.sessionId
-    })
+    try {
+      await requestForOwnedSession(request.sessionId, ambientRequestFor(gateway), 'approval.received', {
+        request_id: request.requestId,
+        session_id: request.sessionId
+      })
+    } catch (error) {
+      if (isSessionGoneForBackgroundPolling(error)) {
+        markSessionGone(request.sessionId)
+
+        return
+      }
+
+      throw error
+    }
   }
 }
 
@@ -135,7 +147,7 @@ export async function replayPendingApproval(gateway: ApprovalGateway | null, ses
   let rawResult: unknown
 
   try {
-    rawResult = await gateway.request('approval.pending', {
+    rawResult = await requestForOwnedSession(sessionId, ambientRequestFor(gateway), 'approval.pending', {
       session_id: sessionId
     })
   } catch (error) {
diff --git a/apps/desktop/src/store/provider-wait.test.ts b/apps/desktop/src/store/provider-wait.test.ts
new file mode 100644
index 0000000000..9c5e6bc143
--- /dev/null
+++ b/apps/desktop/src/store/provider-wait.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+
+import { parseModelLoadWait, providerWaitText } from './provider-wait'
+
+// The load-notice string is minted by the backend
+// (agent/chat_completion_helpers._managed_local_load_notice) and parsed
+// here — these tests pin the desktop side of that cross-language contract
+// (the backend pins its side in tests/hermes_cli/test_load_progress.py).
+describe('providerWaitText', () => {
+  it('accepts the managed-local load frame', () => {
+    const frame = '⏳ loading Qwen3.6-35B-A3B-UD-Q4_K_M into memory — 42% (responses start once the model is loaded)'
+
+    expect(providerWaitText(frame)).toBe(frame)
+  })
+
+  it('still accepts classic wait frames and rejects spinner noise', () => {
+    expect(providerWaitText('⏳ waiting on local-model — 30s with no output yet')).not.toBe('')
+    expect(providerWaitText('◉_◉ cogitating...')).toBe('')
+  })
+})
+
+describe('parseModelLoadWait', () => {
+  it('extracts model and percent from a load frame', () => {
+    expect(
+      parseModelLoadWait(
+        '⏳ loading Qwen3.6-35B-A3B-UD-Q4_K_M into memory — 42% (responses start once the model is loaded)'
+      )
+    ).toEqual({ kind: 'load', model: 'Qwen3.6-35B-A3B-UD-Q4_K_M', percent: 42 })
+  })
+
+  it('extracts the percent from a prefill frame', () => {
+    expect(parseModelLoadWait('⚙ processing prompt — 31%')).toEqual({
+      kind: 'prefill',
+      model: '',
+      percent: 31
+    })
+  })
+
+  it('parses a percentless prefill frame with a null percent (no fake bar)', () => {
+    expect(parseModelLoadWait('⚙ processing prompt')).toEqual({
+      kind: 'prefill',
+      model: '',
+      percent: null
+    })
+  })
+
+  it('returns null for every other wait frame', () => {
+    expect(parseModelLoadWait('⏳ waiting on qwen — 30s with no output yet')).toBeNull()
+    expect(parseModelLoadWait('⚠ no output from provider for 900s — reconnecting...')).toBeNull()
+    expect(parseModelLoadWait('')).toBeNull()
+  })
+
+  it('clamps out-of-range percents', () => {
+    expect(parseModelLoadWait('⏳ loading m into memory — 999%')?.percent).toBe(100)
+  })
+})
+
+describe('providerWaitText accepts prefill frames', () => {
+  it('passes the ⚙ processing-prompt frame through', () => {
+    const frame = '⚙ processing prompt — 31%'
+
+    expect(providerWaitText(frame)).toBe(frame)
+  })
+})
diff --git a/apps/desktop/src/store/provider-wait.ts b/apps/desktop/src/store/provider-wait.ts
index 696c07bb49..7ecaffb59f 100644
--- a/apps/desktop/src/store/provider-wait.ts
+++ b/apps/desktop/src/store/provider-wait.ts
@@ -45,5 +45,42 @@ export function clearAllProviderWaits(): void {
 export function providerWaitText(text: string): string {
   const value = text.trim()
 
-  return /^(?:⏳|⚠|↻)\s*(?:waiting on|no (?:output|response)|model returned)/i.test(value) ? value : ''
+  return /^(?:⏳|⚠|↻|⚙)\s*(?:waiting on|loading|processing prompt|no (?:output|response)|model returned)/i.test(value)
+    ? value
+    : ''
+}
+
+/** Parse a managed-local progress frame into bar-renderable parts, or null
+ * for every other wait frame. Two shapes, both minted by the backend's
+ * _managed_local_load_notice (the percents are real — per-tensor load
+ * callback / live prefill counter — so a determinate bar is honest):
+ *   "⏳ loading <model> into memory — 43% …"  -> kind: 'load'
+ *   "⚙ processing prompt — 31%"               -> kind: 'prefill'
+ * A percentless prefill frame ("⚙ processing prompt") parses with
+ * percent: null and renders as label-only, no fake bar. */
+export function parseModelLoadWait(
+  text: string
+): null | { kind: 'load' | 'prefill'; model: string; percent: null | number } {
+  const value = text.trim()
+  const load = /^⏳\s*loading\s+(.+?)\s+into memory\s+—\s+(\d{1,3})%/i.exec(value)
+
+  if (load) {
+    return {
+      kind: 'load',
+      model: load[1],
+      percent: Math.max(0, Math.min(100, Number(load[2])))
+    }
+  }
+
+  const prefill = /^⚙\s*processing prompt(?:\s+—\s+(\d{1,3})%)?/i.exec(value)
+
+  if (prefill) {
+    return {
+      kind: 'prefill',
+      model: '',
+      percent: prefill[1] === undefined ? null : Math.max(0, Math.min(100, Number(prefill[1])))
+    }
+  }
+
+  return null
 }
diff --git a/apps/desktop/src/store/runtime-gone.test.ts b/apps/desktop/src/store/runtime-gone.test.ts
index c7e5280616..48170769c3 100644
--- a/apps/desktop/src/store/runtime-gone.test.ts
+++ b/apps/desktop/src/store/runtime-gone.test.ts
@@ -1,8 +1,17 @@
+import { JsonRpcGatewayError } from '@hermes/shared'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 import { refreshBackgroundProcesses, resetBackgroundPollingGuard } from './composer-status'
 import { $gateway } from './gateway'
-import { markRuntimeGone, noteRuntimeAlive, resetRuntimeGoneHealing } from './runtime-gone'
+import {
+  isSessionGone,
+  isSessionGoneForBackgroundPolling,
+  markRuntimeGone,
+  markSessionGone,
+  noteRuntimeAlive,
+  resetBackgroundPollingGuardAfterRebind,
+  resetRuntimeGoneHealing
+} from './runtime-gone'
 import { $activeSessionId, $sessionResumeRequest } from './session'
 import { $sessionStates, $sessionTiles } from './session-states'
 
@@ -147,3 +156,64 @@ describe('refreshBackgroundProcesses recovery', () => {
     expect($sessionResumeRequest.get()).toBeNull()
   })
 })
+
+describe('gone-latch classifier and rebind seam', () => {
+  it('recognizes structured 4001 and bare legacy text without misclassifying coded errors', () => {
+    expect(isSessionGoneForBackgroundPolling(new JsonRpcGatewayError('gone', { code: 4001 }))).toBe(true)
+    expect(isSessionGoneForBackgroundPolling(new JsonRpcGatewayError('session not found', { code: 5007 }))).toBe(false)
+    expect(isSessionGoneForBackgroundPolling(new JsonRpcGatewayError('session not found'))).toBe(true)
+    expect(
+      isSessionGoneForBackgroundPolling(new Error("Error invoking remote method 'x': Error: session not found"))
+    ).toBe(true)
+    expect(isSessionGoneForBackgroundPolling(new Error('tool failed: upstream said session not found'))).toBe(false)
+  })
+
+  it('clears the latch only for ids a successful resume/activate rebound', () => {
+    markSessionGone('rt-dead')
+    markSessionGone('rt-other')
+
+    resetBackgroundPollingGuardAfterRebind('process.list', { session_id: 'rt-dead' }, { session_id: 'rt-dead' })
+    expect(isSessionGone('rt-dead')).toBe(true)
+
+    resetBackgroundPollingGuardAfterRebind('session.resume', { session_id: 'stored-1' }, { session_id: 'rt-dead' })
+    expect(isSessionGone('rt-dead')).toBe(false)
+    expect(isSessionGone('rt-other')).toBe(true)
+
+    resetBackgroundPollingGuardAfterRebind('session.activate', { session_id: 'rt-other' }, undefined)
+    expect(isSessionGone('rt-other')).toBe(false)
+  })
+
+  it('a respawned backend (global clear) also resets every heal budget', () => {
+    for (const rt of ['rt-1', 'rt-2', 'rt-3']) {
+      $sessionStates.set({ [rt]: cachedState(STORED) })
+      $sessionTiles.set([tile(STORED, rt)])
+      expect(markRuntimeGone(rt)).toBe(true)
+    }
+
+    resetBackgroundPollingGuard()
+
+    $sessionStates.set({ 'rt-4': cachedState(STORED) })
+    $sessionTiles.set([tile(STORED, 'rt-4')])
+    expect(markRuntimeGone('rt-4')).toBe(true)
+  })
+
+  it('refunds the stored session heal budget on a successful rebind', () => {
+    // Three reaps exhaust MAX_CONSECUTIVE_HEALS for STORED...
+    for (const rt of ['rt-1', 'rt-2', 'rt-3']) {
+      $sessionStates.set({ [rt]: cachedState(STORED) })
+      $sessionTiles.set([tile(STORED, rt)])
+      expect(markRuntimeGone(rt)).toBe(true)
+    }
+
+    $sessionStates.set({ 'rt-4': cachedState(STORED) })
+    $sessionTiles.set([tile(STORED, 'rt-4')])
+    expect(markRuntimeGone('rt-4')).toBe(false)
+
+    // ...but a rebind of STORED proves it alive, so the next reap heals again.
+    resetBackgroundPollingGuardAfterRebind('session.resume', { session_id: STORED }, { session_id: 'rt-5' })
+
+    $sessionStates.set({ 'rt-5': cachedState(STORED) })
+    $sessionTiles.set([tile(STORED, 'rt-5')])
+    expect(markRuntimeGone('rt-5')).toBe(true)
+  })
+})
diff --git a/apps/desktop/src/store/runtime-gone.ts b/apps/desktop/src/store/runtime-gone.ts
index 8d65c7d693..c529cbb8d9 100644
--- a/apps/desktop/src/store/runtime-gone.ts
+++ b/apps/desktop/src/store/runtime-gone.ts
@@ -1,41 +1,19 @@
 import { $activeSessionId, requestSessionResume } from './session'
+import {
+  healsByStoredId,
+  isSessionGone,
+  isSessionGoneForBackgroundPolling,
+  latchSessionGone,
+  resetBackgroundPollingGuard,
+  resetBackgroundPollingGuardAfterRebind
+} from './session-gone-latch'
 import { $sessionStates, $sessionTiles, unbindTileRuntime } from './session-states'
 
-/** Session ids the gateway has told us are gone. A session-scoped RPC against a
- *  runtime the gateway no longer holds fails 4001 "session not found" — terminal
- *  for THIS runtime id, not a transient socket loss.
- *
- *  Shared by every background poller (process.list, approval.pending, goal
- *  status). One set, one clear path: a fresh-runtime rebind calls
- *  {@link resetBackgroundPollingGuard} and every poller resumes. */
-const goneSessions = new Set<string>()
-
-/** Gateway JSON-RPC code for "session not found" (tui_gateway `_sess_nowait`). */
-const GATEWAY_SESSION_NOT_FOUND_CODE = 4001
-
-/** A gone session is unrecoverable for THIS runtime id; a timeout or transport
- *  blip is not. Only the former may stop a poll — misclassifying a transient
- *  failure would silently freeze a healthy session.
- *
- *  Match the gateway's 4001 code when the error carries one. The message
- *  fallback survives only for errors with no numeric code at all. */
-export function isSessionGoneForBackgroundPolling(error: unknown): boolean {
-  const code =
-    error && typeof error === 'object' && typeof (error as { code?: unknown }).code === 'number'
-      ? (error as { code: number }).code
-      : undefined
-
-  if (code !== undefined) {
-    return code === GATEWAY_SESSION_NOT_FOUND_CODE
-  }
-
-  const message = error instanceof Error ? error.message : String(error ?? '')
-
-  return /session not found/i.test(message)
-}
-
-export function isSessionGone(sid: string): boolean {
-  return goneSessions.has(sid)
+export {
+  isSessionGone,
+  isSessionGoneForBackgroundPolling,
+  resetBackgroundPollingGuard,
+  resetBackgroundPollingGuardAfterRebind
 }
 
 /** Latch `sid` off and heal the bound view. Safe to call on every 4001. */
@@ -44,23 +22,10 @@ export function markSessionGone(sid: string): void {
     return
   }
 
-  goneSessions.add(sid)
+  latchSessionGone(sid)
   markRuntimeGone(sid)
 }
 
-/** Clear the gone-latch. Called with a session id when a fresh runtime binds to
- *  it (so polling resumes), or with no argument to reset everything (tests /
- *  gateway reconnect). */
-export function resetBackgroundPollingGuard(sid?: string): void {
-  if (sid) {
-    goneSessions.delete(sid)
-
-    return
-  }
-
-  goneSessions.clear()
-}
-
 /** Heal a session view whose bound runtime id the gateway no longer holds.
  *
  *  The desktop learns a runtime is gone through two channels:
@@ -96,11 +61,12 @@ export function resetBackgroundPollingGuard(sid?: string): void {
  *  for the same id could only come from a duplicate report of the same death. */
 const healedRuntimes = new Set<string>()
 
-/** Consecutive heals per stored session id, reset by {@link noteRuntimeAlive}.
- *  A backend that reaps as fast as we resume would otherwise turn this into the
- *  very storm it exists to stop — one resume per poll tick, forever. Cap it and
- *  let the user's next action (which carries its own recovery) take over. */
-const healsByStoredId = new Map<string, number>()
+/** Consecutive heals per stored session id live in `session-gone-latch`
+ *  (`healsByStoredId`), reset by {@link noteRuntimeAlive} and by a successful
+ *  rebind. A backend that reaps as fast as we resume would otherwise turn this
+ *  into the very storm it exists to stop — one resume per poll tick, forever.
+ *  Cap it and let the user's next action (which carries its own recovery)
+ *  take over. */
 
 /** Enough to ride out a reap that races a resume, low enough that a backend
  *  reaping on sight cannot be turned into a resume loop. */
diff --git a/apps/desktop/src/store/session-gone-latch.ts b/apps/desktop/src/store/session-gone-latch.ts
new file mode 100644
index 0000000000..5e22ebf550
--- /dev/null
+++ b/apps/desktop/src/store/session-gone-latch.ts
@@ -0,0 +1,130 @@
+import { JsonRpcGatewayError } from '@hermes/shared'
+
+/** Session ids the gateway has told us are gone. A session-scoped RPC against a
+ *  runtime the gateway no longer holds fails 4001 "session not found" — terminal
+ *  for THIS runtime id, not a transient socket loss.
+ *
+ *  Shared by every background poller (process.list, approval.pending, goal
+ *  status) and by the owner-routed RPC seam that clears it. This module is a
+ *  dependency-free leaf on purpose: `session-request-router` (which every
+ *  store imports) must be able to clear the latch after a successful rebind
+ *  without pulling the session/tile stores into its import graph. Stores that
+ *  also need the heal levers import through `runtime-gone.ts` (which re-exports
+ *  this module); cycle-sensitive callers (the router, the gateway event loop)
+ *  import the leaf directly. */
+const goneSessions = new Set<string>()
+
+/** Gateway JSON-RPC code for "session not found" (tui_gateway `_sess_nowait`). */
+const GATEWAY_SESSION_NOT_FOUND_CODE = 4001
+
+/** Consecutive heals per stored session id (see `runtime-gone.ts`
+ *  `markRuntimeGone`). Lives here so the rebind seam below can refund it
+ *  without importing the heal module. */
+export const healsByStoredId = new Map<string, number>()
+
+/** A gone session is unrecoverable for THIS runtime id; a timeout or transport
+ *  blip is not. Only the former may stop a poll — misclassifying a transient
+ *  failure would silently freeze a healthy session.
+ *
+ *  Match the gateway's 4001 code when the error carries one. Codeless errors
+ *  (the frame's structure was lost across the IPC bridge or a wrapped rethrow)
+ *  are accepted only with a bare "session not found" body — a tool or report
+ *  string that merely mentions the phrase must not latch a live runtime. */
+export function isSessionGoneForBackgroundPolling(error: unknown): boolean {
+  if (error instanceof JsonRpcGatewayError && typeof error.code === 'number') {
+    return error.code === GATEWAY_SESSION_NOT_FOUND_CODE
+  }
+
+  const code =
+    error && typeof error === 'object' && typeof (error as { code?: unknown }).code === 'number'
+      ? (error as { code: number }).code
+      : undefined
+
+  if (code !== undefined) {
+    return code === GATEWAY_SESSION_NOT_FOUND_CODE
+  }
+
+  const message = (error instanceof Error ? error.message : String(error ?? ''))
+    .trim()
+    .replace(/^Error invoking remote method '[^']+':\s*Error:\s*/i, '')
+    .replace(/^Error:\s*/i, '')
+
+  return /^(?:4001\s*[:,-]?\s*)?session not found[.!]?$/i.test(message)
+}
+
+export function isSessionGone(sid: null | string | undefined): boolean {
+  return Boolean(sid && goneSessions.has(sid))
+}
+
+/** Latch `sid` off. Idempotent. */
+export function latchSessionGone(sid: string): void {
+  if (sid) {
+    goneSessions.add(sid)
+  }
+}
+
+/** Clear the gone-latch. Called with a session id when a fresh runtime binds to
+ *  it (so polling resumes), or with no argument to reset everything (tests /
+ *  a respawned backend that re-mints every runtime id). */
+export function resetBackgroundPollingGuard(sid?: string): void {
+  if (sid) {
+    goneSessions.delete(sid)
+
+    return
+  }
+
+  goneSessions.clear()
+  // Same lifetime as the latch: a respawned backend re-mints every runtime
+  // id, so every stored session's heal budget starts over too.
+  healsByStoredId.clear()
+}
+
+/** Ids a successful `session.resume` / `session.activate` just rebound — the
+ *  stored id it was asked for and the runtime id it answered with. Empty for
+ *  any other method: a socket reconnect is NOT a rebind (the backend may have
+ *  reaped the old runtime, and reopening a WebSocket does not make that id
+ *  valid again). Only a successful resume/activate response is proof. */
+function reboundSessionIds(method: string, params: Record<string, unknown>, result: unknown): string[] {
+  if (method !== 'session.activate' && method !== 'session.resume') {
+    return []
+  }
+
+  const ids: string[] = []
+
+  for (const value of [params.session_id, (result as { session_id?: unknown } | null)?.session_id]) {
+    if (typeof value === 'string' && value.trim()) {
+      ids.push(value.trim())
+    }
+  }
+
+  return ids
+}
+
+/** Un-latch the ids a successful `session.resume` / `session.activate` just
+ *  rebound and refund the stored session's heal budget: a rebind is proof of
+ *  life, so the NEXT reap can still be healed. Without the refund a backend
+ *  that reaps a detached runtime a few times (per-request lease sockets
+ *  closing between polls) exhausts the heal cap and the view is stuck on a
+ *  phantom id forever (#100639: 1,230 approval.pending 4001s on one runtime
+ *  id in 42 minutes, zero recovery). Called by the session request router on
+ *  every routed RPC result; a no-op for every method but resume/activate. */
+export function resetBackgroundPollingGuardAfterRebind(
+  method: string,
+  params: Record<string, unknown>,
+  result: unknown
+): void {
+  for (const id of reboundSessionIds(method, params, result)) {
+    goneSessions.delete(id)
+    healsByStoredId.delete(id)
+  }
+}
+
+/** Adapt a store-level gateway handle (`$gateway.get()` or the narrower
+ *  `ApprovalGateway` shape) to the ambient-request callback
+ *  `requestForOwnedSession` expects. The pollers never pass a deadline, so the
+ *  2-arg call shape is kept exactly (gateway.request callers assert on it). */
+export function ambientRequestFor(gateway: {
+  request: (method: string, params: Record<string, unknown>) => Promise<unknown>
+}): <R>(method: string, params?: Record<string, unknown>) => Promise<R> {
+  return <R>(method: string, params?: Record<string, unknown>) => gateway.request(method, params ?? {}) as Promise<R>
+}
diff --git a/apps/desktop/src/store/session-pin-sync.test.ts b/apps/desktop/src/store/session-pin-sync.test.ts
index f9c39e76b3..9abfad3c91 100644
--- a/apps/desktop/src/store/session-pin-sync.test.ts
+++ b/apps/desktop/src/store/session-pin-sync.test.ts
@@ -15,7 +15,7 @@ vi.mock('@/hermes', () => ({
 
 import { $pinnedSessionIds } from '@/store/layout'
 import { $activeGatewayProfile } from '@/store/profile'
-import { $sessions } from '@/store/session'
+import { $cronSessions, $messagingSessions, $sessions } from '@/store/session'
 
 import { $unconfirmedPinWrites, resetSessionPinMirror, watchSessionPins } from './session-pin-sync'
 
@@ -33,6 +33,8 @@ beforeAll(() => {
 
 beforeEach(() => {
   $sessions.set([])
+  $cronSessions.set([])
+  $messagingSessions.set([])
   $pinnedSessionIds.set([])
   // The mirror/pending/unconfirmed maps are module-global, so one test's
   // bookkeeping would otherwise suppress the next test's PATCH (or fence out
@@ -43,6 +45,8 @@ beforeEach(() => {
 
 afterEach(() => {
   $sessions.set([])
+  $cronSessions.set([])
+  $messagingSessions.set([])
   $pinnedSessionIds.set([])
 })
 
@@ -103,6 +107,51 @@ describe('watchSessionPins', () => {
 })
 
 describe('watchSessionPins remote pull', () => {
+  it('adopts and durably unpins a backend-only messaging pin', async () => {
+    $messagingSessions.set([row('photon-pin', { pinned: true, profile: 'messages', source: 'photon' })])
+    await flush()
+
+    expect($pinnedSessionIds.get()).toEqual(['photon-pin'])
+    patch.mockClear()
+
+    $pinnedSessionIds.set([])
+    await flush()
+
+    expect(patch).toHaveBeenCalledWith('photon-pin', false, 'messages')
+  })
+
+  it('adopts and durably unpins a backend-only cron pin', async () => {
+    $cronSessions.set([row('cron-pin', { pinned: true, profile: 'jobs', source: 'cron' })])
+    await flush()
+
+    expect($pinnedSessionIds.get()).toEqual(['cron-pin'])
+    patch.mockClear()
+
+    $pinnedSessionIds.set([])
+    await flush()
+
+    expect(patch).toHaveBeenCalledWith('cron-pin', false, 'jobs')
+  })
+
+  it('routes a cross-slice unpin to the active profile', async () => {
+    $activeGatewayProfile.set('work')
+
+    try {
+      $sessions.set([row('shared', { pinned: true, profile: 'default' })])
+      $messagingSessions.set([row('shared', { pinned: true, profile: 'work', source: 'photon' })])
+      await flush()
+      expect($pinnedSessionIds.get()).toEqual(['shared'])
+      patch.mockClear()
+
+      $pinnedSessionIds.set([])
+      await flush()
+
+      expect(patch).toHaveBeenCalledWith('shared', false, 'work')
+    } finally {
+      $activeGatewayProfile.set('default')
+    }
+  })
+
   it('adopts a pin another app made', async () => {
     $sessions.set([row('remote', { pinned: true })])
     await flush()
diff --git a/apps/desktop/src/store/session-pin-sync.ts b/apps/desktop/src/store/session-pin-sync.ts
index 8d162a7e83..95e71acca3 100644
--- a/apps/desktop/src/store/session-pin-sync.ts
+++ b/apps/desktop/src/store/session-pin-sync.ts
@@ -27,7 +27,13 @@ import { setSessionPinnedRemote } from '@/hermes'
 import { onConnectionScopeChange } from '@/lib/connection-scoped'
 import { $pinnedSessionIds, pinSession, unpinSession } from '@/store/layout'
 import { $activeGatewayProfile, normalizeProfileKey } from '@/store/profile'
-import { $sessions, sessionMatchesStoredId, sessionPinId } from '@/store/session'
+import {
+  $cronSessions,
+  $messagingSessions,
+  $sessions,
+  sessionMatchesStoredId,
+  sessionPinId
+} from '@/store/session'
 import type { SessionInfo } from '@/types/hermes'
 
 // pin ids we've successfully PATCHed pinned=true this session.
@@ -71,7 +77,24 @@ function publishUnconfirmed(): void {
 }
 
 function profileFor(pinId: string): null | string | undefined {
-  return $sessions.get().find(row => sessionMatchesStoredId(row, pinId))?.profile
+  return loadedRowFor(pinId)?.profile
+}
+
+function loadedSessionRows(): SessionInfo[] {
+  return [...$sessions.get(), ...$cronSessions.get(), ...$messagingSessions.get()]
+}
+
+/**
+ * The row a stored pin id resolves to, across every slice. Same tie-break as
+ * `rowsByPinId`: when two profiles share the id, the write must target the
+ * row the pull adopted — the active gateway's — or an unpin PATCHes the other
+ * profile and the next page re-adopts the pin.
+ */
+function loadedRowFor(pinId: string): SessionInfo | undefined {
+  const rows = loadedSessionRows().filter(row => sessionMatchesStoredId(row, pinId))
+  const gateway = normalizeProfileKey($activeGatewayProfile.get())
+
+  return rows.find(row => normalizeProfileKey(row.profile) === gateway) ?? rows[0]
 }
 
 /**
@@ -140,7 +163,7 @@ function writePin(id: string, pinned: boolean, profile?: null | string): Promise
 function pullRemotePins(): void {
   const local = new Set($pinnedSessionIds.get())
 
-  for (const row of rowsByPinId($sessions.get()).values()) {
+  for (const row of rowsByPinId(loadedSessionRows()).values()) {
     // A backend without the flag has no opinion; never act on `undefined`.
     if (typeof row.pinned !== 'boolean') {
       continue
@@ -190,8 +213,8 @@ function pullRemotePins(): void {
   }
 }
 
-// Re-entrancy guard: reconcile() is subscribed to BOTH $sessions and
-// $pinnedSessionIds, and pullRemotePins() mutates $pinnedSessionIds (via
+// Re-entrancy guard: reconcile() is subscribed to every loaded-session slice
+// and $pinnedSessionIds, and pullRemotePins() mutates $pinnedSessionIds (via
 // pinSession/unpinSession), which fires reconcile() again synchronously.
 // Without this guard, a session whose pin state oscillates — two rows with the
 // same durable id but conflicting `pinned` flags, possible when profile
@@ -247,9 +270,9 @@ function reconcileInner(): void {
   }
 
   // Flush whatever we can resolve now; unresolved ids (row not loaded yet)
-  // retry on the next $sessions change.
+  // retry on the next loaded-session slice change.
   for (const id of [...pending]) {
-    const row = $sessions.get().find(entry => sessionMatchesStoredId(entry, id))
+    const row = loadedRowFor(id)
 
     if (!row) {
       continue
@@ -276,6 +299,8 @@ export function watchSessionPins(): void {
   reconcile()
   $pinnedSessionIds.listen(reconcile)
   $sessions.listen(reconcile)
+  $cronSessions.listen(reconcile)
+  $messagingSessions.listen(reconcile)
 }
 
 /**
diff --git a/apps/desktop/src/store/session-request-router.test.ts b/apps/desktop/src/store/session-request-router.test.ts
index 3ec852e284..8c3261b402 100644
--- a/apps/desktop/src/store/session-request-router.test.ts
+++ b/apps/desktop/src/store/session-request-router.test.ts
@@ -1,5 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { isSessionGone, latchSessionGone, resetBackgroundPollingGuard } from './session-gone-latch'
+
 // Regression coverage for the #89206 wake-failure class: session-scoped RPCs
 // routed to a backend that does not own the session's profile. Three layers:
 //   1. The registry publishes the ACTIVE route's profile ($activeGatewayRoute)
@@ -105,6 +107,7 @@ beforeEach(() => {
   secondaryGateways.length = 0
   promptAckStatus = null
   $connectionsRegistry.set(null)
+  resetBackgroundPollingGuard()
   configureGatewayRegistry({ onEvent: vi.fn() })
   closeSecondaryGateways()
 })
@@ -112,6 +115,7 @@ beforeEach(() => {
 afterEach(() => {
   closeSecondaryGateways()
   vi.clearAllMocks()
+  resetBackgroundPollingGuard()
   delete (window as unknown as { hermesDesktop?: unknown }).hermesDesktop
 })
 
@@ -179,6 +183,62 @@ describe('sessionRpcNeedsProfileRoute', () => {
 })
 
 describe('requestForSessionProfile', () => {
+  it('clears a dead-runtime latch only after a successful resume or activate', async () => {
+    const ambient = vi.fn(async () => ({ session_id: 'rt-rebound' }))
+
+    latchSessionGone('rt-rebound')
+    expect(isSessionGone('rt-rebound')).toBe(true)
+
+    await requestForSessionProfile(null, ambient as never, 'session.activate', { session_id: 'rt-rebound' })
+    expect(isSessionGone('rt-rebound')).toBe(false)
+
+    latchSessionGone('rt-rebound')
+    await expect(
+      requestForSessionProfile(
+        null,
+        vi.fn(async () => {
+          throw new Error('resume failed')
+        }) as never,
+        'session.resume',
+        { session_id: 'rt-rebound' }
+      )
+    ).rejects.toThrow('resume failed')
+    expect(isSessionGone('rt-rebound')).toBe(true)
+  })
+
+  it('clears a dead-runtime latch through the bare profile owner route', async () => {
+    const primary = makePrimary()
+    setPrimaryGateway(primary as never, 'default')
+    installDesktop()
+    const ambient = vi.fn(async () => ({ ambient: true }))
+
+    latchSessionGone('profile-rebound')
+
+    await requestForSessionProfile('loki', ambient as never, 'session.resume', {
+      session_id: 'profile-rebound'
+    })
+
+    expect(isSessionGone('profile-rebound')).toBe(false)
+  })
+
+  it('clears a dead-runtime latch through an explicit connection owner route', async () => {
+    const primary = makePrimary()
+    setPrimaryGateway(primary as never, 'default')
+    installDesktop()
+    const ambient = vi.fn(async () => ({ ambient: true }))
+
+    latchSessionGone('connection-rebound')
+
+    await requestForSessionProfile(
+      { connectionId: 'source-a', profile: 'default' },
+      ambient as never,
+      'session.activate',
+      { session_id: 'connection-rebound' }
+    )
+
+    expect(isSessionGone('connection-rebound')).toBe(false)
+  })
+
   it('keeps routing a bare profile owner through its legacy profile pool when a connection registry exists', async () => {
     // A profile pick on the primary or the explicit `local` source takes the
     // legacy profile-only door (store/profile activateOnCurrentSource), so a
diff --git a/apps/desktop/src/store/session-request-router.ts b/apps/desktop/src/store/session-request-router.ts
index 3cb1993c33..943ed192e7 100644
--- a/apps/desktop/src/store/session-request-router.ts
+++ b/apps/desktop/src/store/session-request-router.ts
@@ -1,5 +1,7 @@
 import { requestGatewayForAgent, requestGatewayForProfile, retainGatewayForSessionTurn } from '@/store/gateway'
 
+import { resetBackgroundPollingGuardAfterRebind } from './session-gone-latch'
+
 /**
  * The ONE authoritative exact owner of a session: the registry connection whose
  * socket minted (or resumed) the runtime, plus the Desktop profile that selects
@@ -107,13 +109,14 @@ async function withRoutedTurnLease<T>(
   const sessionId = promptSessionId(method, params)
 
   if (!sessionId) {
-    return request()
+    return requestWithRebindGuard(method, params, request)
   }
 
   const release = await retainGatewayForSessionTurn(connectionId, profile, sessionId)
 
   try {
     const result = await request()
+    resetBackgroundPollingGuardAfterRebind(method, params, result)
 
     if (!turnKeepsRunning(result)) {
       release()
@@ -126,6 +129,17 @@ async function withRoutedTurnLease<T>(
   }
 }
 
+async function requestWithRebindGuard<T>(
+  method: string,
+  params: Record<string, unknown>,
+  request: () => Promise<T>
+): Promise<T> {
+  const result = await request()
+  resetBackgroundPollingGuardAfterRebind(method, params, result)
+
+  return result
+}
+
 /**
  * True when a session-scoped RPC must be pinned to `ownerProfile`'s own socket.
  *
@@ -193,14 +207,14 @@ export function requestForSessionProfile<T>(
     // for a deadline (the plugin host bridge in contrib/wiring is the only one
     // that does).
     if (signal !== undefined) {
-      return ambientRequest<T>(method, params, timeoutMs, signal)
+      return requestWithRebindGuard(method, params, () => ambientRequest<T>(method, params, timeoutMs, signal))
     }
 
     if (timeoutMs !== undefined) {
-      return ambientRequest<T>(method, params, timeoutMs)
+      return requestWithRebindGuard(method, params, () => ambientRequest<T>(method, params, timeoutMs))
     }
 
-    return ambientRequest<T>(method, params)
+    return requestWithRebindGuard(method, params, () => ambientRequest<T>(method, params))
   }
 
   const profile = normKey(ownerProfile)
diff --git a/apps/desktop/src/store/session-states-foreground-scopes.test.ts b/apps/desktop/src/store/session-states-foreground-scopes.test.ts
index 97ce973a14..2518a9fce4 100644
--- a/apps/desktop/src/store/session-states-foreground-scopes.test.ts
+++ b/apps/desktop/src/store/session-states-foreground-scopes.test.ts
@@ -69,6 +69,25 @@ describe('foregroundSessionScopes: owner hold across the create → foreground g
     expect(foregroundSessionScopes()).toEqual(new Set())
   })
 
+  it('does not retire a hold for a tile that carries neither the route nor a scoped runtime', () => {
+    const pandora = { connectionId: '100-125-133-71-9119', mode: 'remote' as const, profile: 'default' }
+
+    holdSessionOwnerUntilForeground('stored-branch', pandora)
+    // The pre-fix branch path: openSessionTile with no workspaceScope mints a
+    // route-less tile. It pins nothing, so its mere existence must not retire
+    // the hold — that reopened the create→foreground gap and the pruner closed
+    // the owner socket under the draft runtime (resume→reclaim loop, #93892).
+    $sessionTiles.set([{ storedSessionId: 'stored-branch' }])
+    expect(foregroundSessionScopes()).toEqual(new Set(['conn:100-125-133-71-9119::default']))
+
+    // Once the tile actually names the owner (persisted route), it covers the
+    // hold and the hold retires for good.
+    $sessionTiles.set([{ ownerRoute: pandora, storedSessionId: 'stored-branch' }])
+    expect(foregroundSessionScopes()).toEqual(new Set(['conn:100-125-133-71-9119::default']))
+    $sessionTiles.set([])
+    expect(foregroundSessionScopes()).toEqual(new Set())
+  })
+
   it('is released explicitly by the caller (failed create / drift close) and expires on its own', () => {
     vi.useFakeTimers()
 
diff --git a/apps/desktop/src/store/session-states-runtime-map.test.ts b/apps/desktop/src/store/session-states-runtime-map.test.ts
index 1b12f91a9a..8d8f5df9ed 100644
--- a/apps/desktop/src/store/session-states-runtime-map.test.ts
+++ b/apps/desktop/src/store/session-states-runtime-map.test.ts
@@ -1,14 +1,18 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { createClientSessionState } from '@/lib/chat-runtime'
+import { $connectionsRegistry } from '@/store/connection-registry-state'
+import { setPrimaryGateway, setPrimaryGatewayConnection } from '@/store/gateway'
 import { $profiles } from '@/store/profile'
 import { _resetSessionOwnerHintsForTests, setSessionOwnerHint, setSessions } from '@/store/session'
 import { isSessionOwnerResolutionError } from '@/store/session-owner-resolution'
 import {
   $sessionTiles,
   clearAllSessionStates,
+  dropSessionState,
   knownOwnerForSession,
   publishSessionState,
+  recordSessionEventScope,
   requestForOwnedSession,
   storedSessionIdForRuntimeId
 } from '@/store/session-states'
@@ -126,4 +130,85 @@ describe('knownOwnerForSession / requestForOwnedSession', () => {
     ).resolves.toEqual({ ok: true })
     expect(ambient).toHaveBeenCalledWith('approval.respond', { session_id: 'rt-orphan' })
   })
+
+  it('routes a connection-tagged orphan runtime through the owner its inbound event recorded (#97511)', () => {
+    // Registry topology, multiple profiles, no tile/hint/row binding for the
+    // runtime — the approval.request event itself proved the exact owner.
+    $profiles.set([{ name: 'default' }, { name: 'omar' }] as never)
+    recordSessionEventScope({ connectionId: 'homelab', profile: 'omar', session_id: 'rt-unbound' })
+
+    expect(knownOwnerForSession('rt-unbound')).toEqual({ connectionId: 'homelab', profile: 'omar' })
+
+    // An event without a profile tag still records the 'default' convention
+    // every other owner source uses.
+    recordSessionEventScope({ connectionId: 'homelab', session_id: 'rt-unprofiled' })
+    expect(knownOwnerForSession('rt-unprofiled')).toEqual({ connectionId: 'homelab', profile: 'default' })
+  })
+
+  it('still prefers the durable stored owner when a stale runtime ledger entry collides with a stored id (#97511)', () => {
+    // Pathological collision: some dead runtime's id equals a live stored id.
+    // The persisted hint (durable identity) must outrank the ledger entry.
+    setSessionOwnerHint('stored-live', { connectionId: 'local', profile: 'omar' })
+    recordSessionEventScope({ connectionId: 'spark', profile: 'default', session_id: 'stored-live' })
+
+    expect(knownOwnerForSession('stored-live')).toEqual({ connectionId: 'local', profile: 'omar' })
+  })
+
+  it('keeps failing closed for untagged or unknown runtimes in multi-profile topology (#97511)', () => {
+    $profiles.set([{ name: 'default' }, { name: 'omar' }] as never)
+    // Untagged events carry no connectionId and record nothing.
+    recordSessionEventScope({ profile: 'omar', session_id: 'rt-untagged' })
+
+    expect(knownOwnerForSession('rt-untagged')).toBeUndefined()
+    expect(knownOwnerForSession('rt-never-seen')).toBeUndefined()
+  })
+
+  it('drops the recorded event owner together with the runtime state (#97511)', () => {
+    recordSessionEventScope({ connectionId: 'homelab', profile: 'omar', session_id: 'rt-dropped' })
+    expect(knownOwnerForSession('rt-dropped')).toEqual({ connectionId: 'homelab', profile: 'omar' })
+
+    dropSessionState('rt-dropped')
+    expect(knownOwnerForSession('rt-dropped')).toBeUndefined()
+  })
+
+  it('answers an approval on a sole-local registry install through the primary socket (#96394)', async () => {
+    // The reported topology: a modern Desktop (connections bridge present,
+    // registry loaded with exactly one `local` connection), one profile, and
+    // an approval.request whose runtime id has no tile / hint / row binding.
+    // hasRegistryTopology() is true here, so the ambient escape hatch is
+    // closed by design — the exact owner must come from the event itself.
+    ;(window as unknown as { hermesDesktop: unknown }).hermesDesktop = { connections: { list: async () => null } }
+    $connectionsRegistry.set({
+      activeConnectionId: 'local',
+      connections: [{ id: 'local', kind: 'local', label: 'Local' }]
+    } as never)
+    $profiles.set([{ name: 'default' }] as never)
+
+    const primaryRequest = vi.fn(async (method: string, params: unknown) => ({ method, params, via: 'primary' }))
+
+    setPrimaryGateway({ onEvent: () => () => undefined, request: primaryRequest, state: 'open' } as never, 'default')
+    setPrimaryGatewayConnection({ connectionId: 'local' })
+
+    const ambient = vi.fn(async () => ({ via: 'ambient' }))
+
+    try {
+      // Before the event lands the owner is unknown and routing still fails closed.
+      await expect(
+        requestForOwnedSession('rt-approval', ambient as never, 'approval.respond', { session_id: 'rt-approval' })
+      ).rejects.toSatisfy(isSessionOwnerResolutionError)
+
+      // use-gateway-boot stamps every primary event with the active connection
+      // id (Electron resolves the sole local connection to `local`).
+      recordSessionEventScope({ connectionId: 'local', profile: 'default', session_id: 'rt-approval' })
+
+      await expect(
+        requestForOwnedSession('rt-approval', ambient as never, 'approval.respond', { session_id: 'rt-approval' })
+      ).resolves.toEqual({ method: 'approval.respond', params: { session_id: 'rt-approval' }, via: 'primary' })
+      expect(ambient).not.toHaveBeenCalled()
+    } finally {
+      setPrimaryGateway(null)
+      $connectionsRegistry.set(null)
+      delete (window as unknown as { hermesDesktop?: unknown }).hermesDesktop
+    }
+  })
 })
diff --git a/apps/desktop/src/store/session-states.test.ts b/apps/desktop/src/store/session-states.test.ts
index 4e2152a108..9c026b223d 100644
--- a/apps/desktop/src/store/session-states.test.ts
+++ b/apps/desktop/src/store/session-states.test.ts
@@ -200,6 +200,32 @@ describe('resetTileRuntimeBindings', () => {
     expect(invalidateRuntimeBindings).toHaveBeenCalledWith(new Set(['stored-barry-sibling-bot', 'stored-work-bot']))
   })
 
+  it('keeps an owner-routed SESSIONS tile (branch child) bound across an unrelated reconnect', () => {
+    const invalidateRuntimeBindings = vi.fn()
+    setSessionTileDelegate({ invalidateRuntimeBindings } as unknown as SessionTileDelegate)
+    $sessionTiles.set([
+      {
+        ownerRoute: { connectionId: '100-125-133-71-9119', mode: 'remote', profile: 'default' },
+        runtimeId: 'runtime-branch-live',
+        storedSessionId: 'stored-branch-child',
+        workspaceMode: 'sessions'
+      }
+    ])
+
+    // A flapping sibling connection reconnects; the branch child's runtime
+    // lives on its parent's backend and must keep its binding — dropping it
+    // re-arms the tile's resume, and repeated sibling flaps latch the
+    // resume-storm error card over a healthy session.
+    resetTileRuntimeBindings({ connectionId: 'other-ssh-source', profile: 'default' })
+
+    expect($sessionTiles.get()[0]?.runtimeId).toBe('runtime-branch-live')
+    expect(invalidateRuntimeBindings).toHaveBeenCalledWith(new Set(['stored-branch-child']))
+
+    // Its OWN connection reconnecting still drops the binding for re-resume.
+    resetTileRuntimeBindings({ connectionId: '100-125-133-71-9119', profile: 'default' })
+    expect($sessionTiles.get()[0]?.runtimeId).toBeUndefined()
+  })
+
   it('unknown restarted identity preserves only Bot runtimes owned by provably-live connections', () => {
     // Legacy remote primary: no registry connectionId to scope by. The dead
     // owner can't be named, so keep only owners we know are alive elsewhere —
@@ -244,6 +270,27 @@ describe('SessionTile workspace scope', () => {
     $sessionTiles.set([])
   })
 
+  it('persists a sessions-mode owner route so a branch child tile pins its owning socket', () => {
+    const ownerRoute = { connectionId: '100-125-133-71-9119', mode: 'remote' as const, profile: 'default' }
+
+    openSessionTile('branch-child', 'center', undefined, null, { ownerRoute, workspaceMode: 'sessions' })
+
+    expect($sessionTiles.get()).toEqual([
+      expect.objectContaining({ ownerRoute, storedSessionId: 'branch-child', workspaceMode: 'sessions' })
+    ])
+  })
+
+  it('keeps an existing sessions-mode owner route on a route-less re-scope', () => {
+    const ownerRoute = { connectionId: '100-125-133-71-9119', mode: 'remote' as const, profile: 'default' }
+
+    openSessionTile('branch-child', 'center', undefined, null, { ownerRoute, workspaceMode: 'sessions' })
+    // A plain sidebar re-open routes through setSessionTileWorkspaceScope with
+    // no route — absence of information, not a revocation.
+    setSessionTileWorkspaceScope('branch-child', { workspaceMode: 'sessions' })
+
+    expect($sessionTiles.get()).toEqual([expect.objectContaining({ ownerRoute, storedSessionId: 'branch-child' })])
+  })
+
   it('stores an exact Bot owner and keeps it through placement patches', () => {
     const ownerRoute = {
       connectionId: 'connection-a',
@@ -284,6 +331,24 @@ describe('SessionTile workspace scope', () => {
     expect(focusOpenSession('bot-chat', scope)).toBe('tile')
   })
 
+  it('fronts the existing tab when compaction rotated the tip id — never a duplicate', () => {
+    // The tile was opened when seg-2 was the tip; the conversation has since
+    // rotated to seg-3 (projected row carries the full chain). Opening the
+    // new tip must front that tile, not open the same chat twice.
+    setSessions([
+      { _lineage_ids: ['seg-1', 'seg-2', 'seg-3'], _lineage_root_id: 'seg-1', id: 'seg-3' } as never
+    ])
+    openSessionTile('seg-2')
+
+    expect(focusOpenSession('seg-3')).toBe('tile')
+    expect($sessionTiles.get().map(t => t.storedSessionId)).toEqual(['seg-2'])
+
+    // The open path dedupes through the same lineage test.
+    openSessionTile('seg-3')
+    expect($sessionTiles.get().map(t => t.storedSessionId)).toEqual(['seg-2'])
+    setSessions([])
+  })
+
   it('keeps Bot tabs while a profile publication swaps the Sessions bucket', () => {
     const scope = { workspaceMode: 'bots' as const, workspaceOwnerKey: 'connection-a::writer' }
 
@@ -317,6 +382,45 @@ describe('SessionTile workspace scope', () => {
     })
   })
 
+  it('preserves an existing Bot tile scope when moving it without an explicit scope', () => {
+    const scope = {
+      ownerRoute: {
+        connectionId: 'connection-a',
+        mode: 'remote' as const,
+        profile: 'default',
+        targetProfile: 'default'
+      },
+      workspaceMode: 'bots' as const,
+      workspaceOwnerKey: 'bot:connection-a::default',
+      workspaceTabTitle: 'Bot chat'
+    }
+
+    openSessionTile('bot-chat', 'right', undefined, undefined, scope)
+    $layoutTree.set(group(['workspace', 'session-tile:bot-chat'], { id: 'workspace-group' }))
+    // A split drag re-docks the tab with no scope (session-drag onCommit).
+    openSessionTile('bot-chat', 'left', 'workspace')
+
+    expect($sessionTiles.get()).toEqual([
+      expect.objectContaining({
+        anchor: 'workspace',
+        dir: 'left',
+        ownerRoute: scope.ownerRoute,
+        storedSessionId: 'bot-chat',
+        workspaceMode: 'bots',
+        workspaceOwnerKey: scope.workspaceOwnerKey,
+        workspaceTabTitle: 'Bot chat'
+      })
+    ])
+
+    // An explicit scope from the caller still wins over the tile's current one.
+    openSessionTile('bot-chat', 'right', 'workspace', undefined, { workspaceMode: 'sessions' })
+
+    expect($sessionTiles.get()).toEqual([
+      expect.objectContaining({ dir: 'right', storedSessionId: 'bot-chat', workspaceMode: 'sessions' })
+    ])
+    expect($sessionTiles.get()[0]).not.toHaveProperty('workspaceOwnerKey', scope.workspaceOwnerKey)
+  })
+
   it('preserves workspace scope while dropping a stale runtime binding', () => {
     $sessionTiles.set([
       {
diff --git a/apps/desktop/src/store/session-states.ts b/apps/desktop/src/store/session-states.ts
index d3402dc369..fd9cb8cf60 100644
--- a/apps/desktop/src/store/session-states.ts
+++ b/apps/desktop/src/store/session-states.ts
@@ -83,9 +83,22 @@ export const $sessionStates = atom<Record<string, ClientSessionState>>({})
 
 const sessionScopeByRuntimeId = new Map<string, string>()
 
+// Structured twin of the scope ledger: the same inbound events also carry the
+// exact (connectionId, profile) owner, which the composite scope string
+// cannot give back. Consumed as the LAST rung of knownOwnerForSession so a
+// runtime whose event source already proved its owner can still route
+// session-scoped RPCs (approval.respond) when every durable binding
+// (tile / hint / row) is absent — while durable stored identity keeps
+// outranking it (#97511).
+const sessionOwnerByRuntimeId = new Map<string, SessionOwnerRoute>()
+
 export function recordSessionEventScope(event: { connectionId?: string; profile?: string; session_id?: string }): void {
   if (event.session_id && event.connectionId) {
     sessionScopeByRuntimeId.set(event.session_id, registryBackendScopeKey(event.connectionId, event.profile))
+    sessionOwnerByRuntimeId.set(event.session_id, {
+      connectionId: event.connectionId,
+      profile: String(event.profile ?? '').trim() || 'default'
+    })
   }
 }
 
@@ -506,6 +519,7 @@ export function dropSessionState(runtimeId: string) {
   clearWatchdog(runtimeId)
   clearSessionProviderWait(runtimeId)
   sessionScopeByRuntimeId.delete(runtimeId)
+  sessionOwnerByRuntimeId.delete(runtimeId)
 
   const current = $sessionStates.get()
   setSessionStalled(current[runtimeId]?.storedSessionId, false)
@@ -532,6 +546,7 @@ export function clearAllSessionStates() {
   settledExpiry.clear()
   clearAllProviderWaits()
   sessionScopeByRuntimeId.clear()
+  sessionOwnerByRuntimeId.clear()
   $stalledSessionIds.set([])
   $sessionStates.set({})
 }
@@ -970,6 +985,13 @@ export function openTileGatewayScopes(): Set<string> {
  * `profile` stamp) was already loaded for the sidebar's cron section. The
  * hint outranks the row for the same reason as contrib/wiring's ladder: a
  * row can be stamped from the ambient profile and carries no connection.
+ * Last rung: the owner recorded from the inbound runtime event itself
+ * (sessionOwnerByRuntimeId, #97511) — an orphan runtime whose tile/hint/row
+ * binding is absent or stale still routes through the exact
+ * (connectionId, profile) its events proved, while every durable rung above
+ * keeps outranking it, so a stored-id collision never inherits a stale
+ * runtime ledger entry. Untagged events record nothing, so unknown owners in
+ * multi-profile topology still fail closed.
  * Returns undefined when no owner is known — the caller fails closed
  * (assertSessionOwnerResolved), never falls to "active".
  */
@@ -983,7 +1005,8 @@ export function knownOwnerForSession(sessionId: null | string | undefined): Sess
   return (
     sessionTileOwnerRoute(storedSessionId) ??
     getSessionOwnerHint(storedSessionId) ??
-    knownSessionOwner(ownerLookupSessionRows(), storedSessionId)
+    knownSessionOwner(ownerLookupSessionRows(), storedSessionId) ??
+    sessionOwnerByRuntimeId.get(sessionId)
   )
 }
 
@@ -1087,8 +1110,23 @@ export const $botChatSessionIds = atom<ReadonlySet<string>>(
   new Set((readJson<unknown>(BOT_CHAT_SCOPE_KEY) as unknown[] | null)?.filter(id => typeof id === 'string') ?? [])
 )
 
-function rememberBotChatScope(storedSessionId: string, isBotChat: boolean): void {
+/** The bot-mode scope each stored id was last opened under, for the main tab
+ *  (which has no tile to carry one). Window-local: the caption falls back to
+ *  the stored title until the chat is opened again. */
+export const $botChatScopes = atom<Readonly<Record<string, SessionTileWorkspaceScope>>>({})
+
+function rememberBotChatScope(storedSessionId: string, scope: SessionTileWorkspaceScope): void {
+  const isBotChat = scope.workspaceMode === 'bots'
   const current = $botChatSessionIds.get()
+  const { [storedSessionId]: previous, ...rest } = $botChatScopes.get()
+
+  const changed = isBotChat
+    ? previous?.workspaceOwnerKey !== scope.workspaceOwnerKey || previous?.workspaceTabTitle !== scope.workspaceTabTitle
+    : Boolean(previous)
+
+  if (changed) {
+    $botChatScopes.set(isBotChat ? { ...rest, [storedSessionId]: scope } : rest)
+  }
 
   if (current.has(storedSessionId) === isBotChat) {
     return
@@ -1118,11 +1156,16 @@ export function isBotChatSession(sessionId: null | string | undefined): boolean
 export function setSessionTileWorkspaceScope(storedSessionId: string, scope: SessionTileWorkspaceScope): boolean {
   // Before the tile lookup: openSession routes every open through here, and a
   // bot chat usually has no tile to record the scope on.
-  rememberBotChatScope(storedSessionId, scope.workspaceMode === 'bots')
+  rememberBotChatScope(storedSessionId, scope)
 
   const tile = $sessionTiles.get().find(candidate => candidate.storedSessionId === storedSessionId)
   const workspaceOwnerKey = scope.workspaceMode === 'bots' ? scope.workspaceOwnerKey : undefined
-  const ownerRoute = scope.workspaceMode === 'bots' ? scope.ownerRoute : undefined
+  // Sessions-mode re-opens (sidebar click on an already-tiled session) pass no
+  // route; that is absence of information, not a revocation — keep the exact
+  // owner the tile was opened with (a branch child's parent connection) so a
+  // plain re-open can't unpin the owning socket. Bot scopes stay authoritative
+  // both ways: they always name their route explicitly.
+  const ownerRoute = scope.workspaceMode === 'bots' ? scope.ownerRoute : (scope.ownerRoute ?? tile?.ownerRoute)
   const workspaceTabTitle = scope.workspaceMode === 'bots' ? scope.workspaceTabTitle : undefined
 
   if (
@@ -1206,8 +1249,15 @@ export function resetTileRuntimeBindings(
   const preservedStoredIds = new Set(
     tiles
       .filter(
+        // Any tile with an EXACT owner route — bot tabs always, and a
+        // sessions tile whose opener stamped one (a branch child on its
+        // parent's connection). Its runtime lives on that owner's socket,
+        // not the ambient gateway, so an unrelated connection's reconnect
+        // must not drop the binding: each drop re-arms the tile's resume,
+        // and a flapping sibling connection turns that into 4+ re-resumes
+        // inside the storm window — latching the "keeps losing its backend
+        // runtime" card over a session that is actually healthy.
         tile =>
-          tile.workspaceMode === 'bots' &&
           Boolean(tile.ownerRoute?.connectionId) &&
           (!(reconnected || liveConnectionIds) || !belongsToReconnectedRuntime(tile))
       )
@@ -1359,9 +1409,17 @@ export function openSessionTile(
   dir: TileDock = 'right',
   anchor?: string,
   before?: null | string,
-  workspaceScope: SessionTileWorkspaceScope = { workspaceMode: 'sessions' }
+  explicitScope?: SessionTileWorkspaceScope
 ) {
   const tiles = $sessionTiles.get()
+  const existing = tiles.find(t => t.storedSessionId === storedSessionId)
+
+  // No scope on an already-open tile is a MOVE (a split drag re-docking a tab),
+  // not a re-scope: keep the workspace it lives in instead of re-bucketing it
+  // into Sessions — a Bot tab used to vanish from the Bot workspace on drop.
+  const workspaceScope: SessionTileWorkspaceScope = explicitScope ?? {
+    workspaceMode: existing?.workspaceMode ?? 'sessions'
+  }
 
   // Opening a session in a tab/tile is "reading" it — clear its unread dot
   // exactly like main-thread resume does. Previously only
@@ -1371,7 +1429,9 @@ export function openSessionTile(
   markSessionRead(storedSessionId)
   ackStoredSessionId(storedSessionId)
 
-  if (workspaceScope.workspaceMode === 'sessions' && storedSessionId === $selectedStoredSessionId.get()) {
+  const aliases = lineageAliases(storedSessionId, $sessions.get())
+
+  if (workspaceScope.workspaceMode === 'sessions' && aliases.includes($selectedStoredSessionId.get() ?? '')) {
     return
   }
 
@@ -1379,14 +1439,22 @@ export function openSessionTile(
 
   const workspaceOwnerKey = workspaceScope.workspaceMode === 'bots' ? workspaceScope.workspaceOwnerKey : undefined
 
-  if (!tiles.some(t => t.storedSessionId === storedSessionId)) {
+  if (!tiles.some(t => aliases.includes(t.storedSessionId))) {
     saveTiles([
       ...tiles,
       {
         anchor: dock,
         before,
         dir,
-        ownerRoute: workspaceScope.workspaceMode === 'bots' ? workspaceScope.ownerRoute : undefined,
+        // The owner route pins the owning backend's socket in the gateway
+        // keep-set (openTileGatewayScopes / foregroundSessionScopes) for as
+        // long as the tile is open. Bot tabs always carry one; a sessions-mode
+        // tile carries one when its opener knows the exact owner — e.g. a
+        // branch child created on its parent's owning connection, whose
+        // draft runtime is otherwise orphan-reaped the moment the pruner
+        // closes the unpinned socket (the resume/reclaim flicker loop,
+        // #93892 shape).
+        ownerRoute: workspaceScope.ownerRoute,
         storedSessionId,
         workspaceMode: workspaceScope.workspaceMode,
         workspaceOwnerKey,
@@ -1399,7 +1467,9 @@ export function openSessionTile(
     return
   }
 
-  setSessionTileWorkspaceScope(storedSessionId, workspaceScope)
+  if (explicitScope) {
+    setSessionTileWorkspaceScope(storedSessionId, explicitScope)
+  }
 
   // Already open: relocate the existing pane to the drop target (pane-mirror
   // only docks on first adoption, so a re-drag must move the tree pane itself).
@@ -1467,8 +1537,16 @@ export function focusOpenSession(
   storedSessionId: string,
   workspaceScope: SessionTileWorkspaceScope = { workspaceMode: 'sessions' }
 ): 'main' | 'tile' | null {
-  if ($sessionTiles.get().some(t => t.storedSessionId === storedSessionId)) {
-    const paneId = `${TILE_PANE_PREFIX}${storedSessionId}`
+  // Compression rotates a conversation's tip id while tiles stay keyed by
+  // whichever segment id they were opened with. An exact-id test right after
+  // a rotation said "not open" for a conversation that IS on screen, and
+  // callers opened the same chat in a second tab. Match any id of the
+  // lineage instead, and front the tile under ITS key.
+  const aliases = lineageAliases(storedSessionId, $sessions.get())
+  const tile = $sessionTiles.get().find(t => aliases.includes(t.storedSessionId))
+
+  if (tile) {
+    const paneId = `${TILE_PANE_PREFIX}${tile.storedSessionId}`
     revealTreePane(paneId) // un-dismiss + adopt + front in its group
     const tree = $layoutTree.get()
     const group = tree ? findGroupOfPane(tree, paneId) : null
@@ -1482,7 +1560,7 @@ export function focusOpenSession(
 
   // Already the main session: front the workspace tab and drop tile focus so
   // the readouts + sidebar highlight come home (a no-op when main is focused).
-  if (workspaceScope.workspaceMode === 'sessions' && storedSessionId === $selectedStoredSessionId.get()) {
+  if (workspaceScope.workspaceMode === 'sessions' && aliases.includes($selectedStoredSessionId.get() ?? '')) {
     revealTreePane('workspace')
     noteActiveTreeGroup(null)
 
@@ -1514,7 +1592,8 @@ export function focusOpenSession(
  *  falls through to its authoritative open. No probe = the old behavior. */
 export function focusWorkspaceOwnerSessionTile(
   workspaceOwnerKey: string,
-  isStaleTile?: (tile: SessionTile) => boolean
+  isStaleTile?: (tile: SessionTile) => boolean,
+  onlyStoredIds?: readonly string[]
 ): null | string {
   const allOwned = $sessionTiles
     .get()
@@ -1539,6 +1618,13 @@ export function focusWorkspaceOwnerSessionTile(
     owned = allOwned.filter(tile => !stale.includes(tile))
   }
 
+  // `onlyStoredIds`: the sessions this call may front (Bot Mode passes the
+  // canonical chat's registry id + lineage tip). Other tabs in the owner's
+  // zone stay open; they are simply not what the caller asked for.
+  if (onlyStoredIds) {
+    owned = owned.filter(tile => onlyStoredIds.includes(tile.storedSessionId))
+  }
+
   if (owned.length === 0) {
     return null
   }
diff --git a/apps/desktop/src/store/session.test.ts b/apps/desktop/src/store/session.test.ts
index 22253f6f20..0a8de8e220 100644
--- a/apps/desktop/src/store/session.test.ts
+++ b/apps/desktop/src/store/session.test.ts
@@ -30,6 +30,7 @@ import {
   _resetLegacyDiscardForTests,
   _resetSessionOwnerHintsForTests,
   applyConfiguredDefaultProjectDir,
+  carryForwardFailedProfileSessions,
   commitWorkspaceCwdForSelectedSession,
   ensureDefaultWorkspaceCwd,
   forgetSessionOwnerHintsForConnection,
@@ -37,15 +38,19 @@ import {
   getConfiguredDefaultProjectDir,
   getRememberedRoute,
   getRememberedSessionId,
+  getRememberedWorkspaceCwd,
   getSessionOwnerHint,
   getSessionOwnerHints,
   hydrateSessionOwnerHints,
+  keepFailedProfileMeta,
   knownSessionOwner,
   knownSessionProfile,
+  lineageAliases,
   mergeSessionPage,
   rememberedSessionProfile,
   resolveComposerSessionKey,
   sessionBelongsToProfile,
+  sessionMatchesStoredId,
   sessionOwnerRouteFromRow,
   sessionPinId,
   setComposerSelectionOwner,
@@ -363,6 +368,20 @@ describe('sessionPinId', () => {
   })
 })
 
+describe('lineageAliases across a deep compression chain', () => {
+  it('aliases every segment, intermediates included', () => {
+    // The projected row carries the full chain: a tile or route can hold a
+    // MIDDLE segment's id from when IT was the tip.
+    const rows = [
+      session({ _lineage_ids: ['root', 'mid', 'tip'], _lineage_root_id: 'root', id: 'tip' })
+    ]
+
+    expect(lineageAliases('mid', rows).sort()).toEqual(['mid', 'root', 'tip'])
+    expect(lineageAliases('tip', rows).sort()).toEqual(['mid', 'root', 'tip'])
+    expect(sessionMatchesStoredId(rows[0], 'mid')).toBe(true)
+  })
+})
+
 describe('resolveComposerSessionKey', () => {
   it('keeps the lineage root across compression tip rotation', () => {
     const tipBefore = '20260720_062637_ad96b3'
@@ -672,6 +691,87 @@ describe('mergeSessionPage', () => {
   })
 })
 
+describe('carryForwardFailedProfileSessions', () => {
+  it('is a no-op when the backend reported no profile errors', () => {
+    const previous = [session({ id: 'yesterday', profile: 'default' })]
+    const incoming = [session({ id: 'today', profile: 'default' })]
+
+    expect(carryForwardFailedProfileSessions(previous, incoming, undefined)).toBe(incoming)
+    expect(carryForwardFailedProfileSessions(previous, incoming, [])).toBe(incoming)
+  })
+
+  it('re-attaches idle rows for a profile whose slice failed (empty 200 + errors)', () => {
+    // Repro: current session is running, sidebar scan hits disk I/O, backend
+    // returns recents=[] with errors=[{profile:default}]. mergeSessionPage then
+    // keeps only working/pinned/selected and Yesterday/This-week vanish.
+    const previous = [
+      session({ id: 'running', last_active: 300, profile: 'default', title: 'Now' }),
+      session({ id: 'yesterday', last_active: 200, profile: 'default', title: 'Yesterday' }),
+      session({ id: 'week', last_active: 100, profile: 'default', title: 'This week' })
+    ]
+
+    const carried = carryForwardFailedProfileSessions(previous, [], [{ profile: 'default', error: 'disk I/O error' }])
+
+    expect(carried.map(s => s.id)).toEqual(['running', 'yesterday', 'week'])
+    expect(carried[1]).toBe(previous[1])
+  })
+
+  it('does not resurrect a successful profile’s omitted rows, and does not duplicate', () => {
+    const previous = [
+      session({ id: 'work-old', profile: 'work' }),
+      session({ id: 'home-idle', profile: 'default' }),
+      session({ id: 'home-fresh', profile: 'default' })
+    ]
+
+    const incoming = [session({ id: 'home-fresh', message_count: 4, profile: 'default' })]
+
+    const carried = carryForwardFailedProfileSessions(previous, incoming, [{ profile: 'work' }])
+
+    expect(carried.map(s => `${s.profile}:${s.id}`)).toEqual(['default:home-fresh', 'work:work-old'])
+  })
+
+  it('re-ranks carried rows by recency instead of parking them at the tail', () => {
+    const previous = [
+      session({ id: 'idle-newer', last_active: 500, profile: 'work' }),
+      session({ id: 'idle-older', last_active: 50, profile: 'work' })
+    ]
+
+    const incoming = [session({ id: 'home', last_active: 100, profile: 'default' })]
+
+    expect(carryForwardFailedProfileSessions(previous, incoming, [{ profile: 'work' }]).map(s => s.id)).toEqual([
+      'idle-newer',
+      'home',
+      'idle-older'
+    ])
+  })
+
+  it('treats a missing profile tag on the error as default', () => {
+    const previous = [session({ id: 'idle', profile: 'default' })]
+
+    expect(carryForwardFailedProfileSessions(previous, [], [{ error: 'disk I/O error' }]).map(s => s.id)).toEqual([
+      'idle'
+    ])
+  })
+})
+
+describe('keepFailedProfileMeta', () => {
+  it('is a no-op when the backend reported no profile errors', () => {
+    const incoming = { default: { cost_usd: 1, tokens: 2 } }
+
+    expect(keepFailedProfileMeta({ default: { cost_usd: 9, tokens: 9 } }, incoming, [])).toBe(incoming)
+  })
+
+  it('restores previous usage/truncated flags for profiles whose slice failed', () => {
+    const previous = { default: { cost_usd: 4, tokens: 40 }, work: { cost_usd: 1, tokens: 10 } }
+    const incoming = { work: { cost_usd: 2, tokens: 20 } }
+
+    expect(keepFailedProfileMeta(previous, incoming, [{ profile: 'default' }])).toEqual({
+      default: { cost_usd: 4, tokens: 40 },
+      work: { cost_usd: 2, tokens: 20 }
+    })
+  })
+})
+
 describe('touchSessionActivity', () => {
   afterEach(() => {
     setSessions([])
@@ -814,16 +914,22 @@ describe('workspaceCwdForNewSession', () => {
     $currentCwd.set('/live/session/path')
     $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
 
+    // Bare new sessions are intentionally DETACHED across every mode
+    // (#57911): neither sticky local nor sticky remote cwd is an accept-
+    // able bare-default — only an explicit configured default pre-attaches.
+    // The per-backend memory itself stays isolated (asserted directly).
     expect(workspaceCwdForNewSession()).toBe('')
 
     setCurrentCwd('/backend/project-a')
-    expect(workspaceCwdForNewSession()).toBe('/backend/project-a')
-
-    $connection.set({ baseUrl: 'http://backend-b', mode: 'remote' } as never)
+    expect(getRememberedWorkspaceCwd()).toBe('/backend/project-a')
     expect(workspaceCwdForNewSession()).toBe('')
 
+    $connection.set({ baseUrl: 'http://backend-b', mode: 'remote' } as never)
+    expect(getRememberedWorkspaceCwd()).toBe('')
+
     setCurrentCwd('/backend/project-b')
-    expect(workspaceCwdForNewSession()).toBe('/backend/project-b')
+    expect(getRememberedWorkspaceCwd()).toBe('/backend/project-b')
+    expect(workspaceCwdForNewSession()).toBe('')
 
     // Back on local with no configured default: a bare new chat is detached and
     // never reads the remote keys (nor inherits the sticky local workspace).
@@ -832,20 +938,23 @@ describe('workspaceCwdForNewSession', () => {
   })
 
   it('remembers only the workspace the user picked, not the one they looked at', () => {
-    // The reported bug (#77496 / #80213): on a remote backend a new chat starts
-    // in the remembered workspace, and every session resume used to write that
-    // key — so opening a project chat silently made it the destination for the
-    // next "New session". Following a conversation must leave the memory alone.
+    // The reported bug (#77496 / #80213): every session resume used to write
+    // the remembered-workspace key — so opening a project chat silently moved
+    // the memory. Following a conversation must leave the memory alone.
+    // (Since #57911 a bare new session is detached in remote mode too, so the
+    // memory is asserted directly — its remaining consumer is resume seeding
+    // via ensureDefaultWorkspaceCwd.)
     $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
     setCurrentCwd('/backend/picked')
 
     setCurrentCwdTransient('/backend/some-other-project')
 
     expect($currentCwd.get()).toBe('/backend/some-other-project')
-    expect(workspaceCwdForNewSession()).toBe('/backend/picked')
+    expect(getRememberedWorkspaceCwd()).toBe('/backend/picked')
+    expect(workspaceCwdForNewSession()).toBe('')
   })
 
-  it('settling a resumed session does not move where the next new chat starts', () => {
+  it('settling a resumed session does not move the remembered workspace', () => {
     // The reporter's exact sequence: work in a project, open a chat from it,
     // then ask for a new session. Resume settling publishes the conversation's
     // cwd through commitWorkspaceCwdForSelectedSession — which must not claim
@@ -856,7 +965,33 @@ describe('workspaceCwdForNewSession', () => {
     setSelectedStoredSessionId('sess-in-project')
     commitWorkspaceCwdForSelectedSession('/backend/last-project')
 
-    expect(workspaceCwdForNewSession()).toBe('/backend/picked')
+    expect(getRememberedWorkspaceCwd()).toBe('/backend/picked')
+    expect(workspaceCwdForNewSession()).toBe('')
+  })
+
+  it('does not stick a previous remote workspace onto a bare new session (#57911)', () => {
+    // Repro: in remote mode the user attaches to project-A so the renderer
+    // persists /tradingview as the remembered cwd under the remote key. The
+    // user then presses Cmd+N *without* being scoped into any project. A bare
+    // new session must NOT inherit /tradingview — pre-fix this returned the
+    // sticky remembered cwd and the gateway mapped it back to the wrong
+    // project via project_tree.py.
+    $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
+    setCurrentCwd('/tradingview')
+    applyConfiguredDefaultProjectDir(null)
+
+    expect(workspaceCwdForNewSession()).toBe('')
+  })
+
+  it('respects an explicit configured default in remote mode (#57911)', () => {
+    // Symmetric guard: removing the remote branch must NOT regress users who
+    // *did* set a configured default — the explicit default pre-attaches
+    // identically across local and remote mode.
+    $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
+    setCurrentCwd('/tradingview')
+    applyConfiguredDefaultProjectDir('/home/user/configured')
+
+    expect(workspaceCwdForNewSession()).toBe('/home/user/configured')
   })
 })
 
diff --git a/apps/desktop/src/store/session.ts b/apps/desktop/src/store/session.ts
index b89d9e9a31..39e91c32cc 100644
--- a/apps/desktop/src/store/session.ts
+++ b/apps/desktop/src/store/session.ts
@@ -359,16 +359,19 @@ export const sessionPinId = (session: Pick<SessionInfo, '_lineage_root_id' | 'id
  *  the live id or the stable lineage root (see sessionPinId). The one place the
  *  "same conversation across compression" test lives. */
 export const sessionMatchesStoredId = (
-  session: Pick<SessionInfo, '_lineage_root_id' | 'id'>,
+  session: Pick<SessionInfo, '_lineage_ids' | '_lineage_root_id' | 'id'>,
   storedSessionId: string
-): boolean => session.id === storedSessionId || session._lineage_root_id === storedSessionId
+): boolean =>
+  session.id === storedSessionId ||
+  session._lineage_root_id === storedSessionId ||
+  Boolean(session._lineage_ids?.includes(storedSessionId))
 
 // Alias lookup, memoized per sessions-list reference. `lineageAliases` runs
 // per cached session state per status projection per message delta — an
 // O(sessions) scan there multiplies out to states × sessions × ~30Hz per busy
 // session, which is what made a populated recents list drag every stream. The
 // list is replaced wholesale (never mutated), so its reference is the cache key.
-type LineageRow = Pick<SessionInfo, '_lineage_root_id' | 'id'>
+type LineageRow = Pick<SessionInfo, '_lineage_ids' | '_lineage_root_id' | 'id'>
 const lineageIndexBySessions = new WeakMap<readonly LineageRow[], Map<string, string[]>>()
 
 function lineageIndex(sessions: readonly LineageRow[]): Map<string, string[]> {
@@ -398,6 +401,21 @@ function lineageIndex(sessions: readonly LineageRow[]): Map<string, string[]> {
       add(session._lineage_root_id, session.id)
       add(session._lineage_root_id, session._lineage_root_id)
     }
+
+    // Chains three+ segments deep: the projected row carries every id the
+    // conversation has answered to, so a surface keyed to a MIDDLE segment
+    // (it was the tip when the surface opened) still aliases to the rest.
+    // Without this, only tip↔root connect and such a surface reads as a
+    // different conversation — one chat open twice after a compaction.
+    const ids = session._lineage_ids
+
+    if (ids && ids.length > 1) {
+      for (const a of ids) {
+        for (const b of ids) {
+          add(a, b)
+        }
+      }
+    }
   }
 
   lineageIndexBySessions.set(sessions, index)
@@ -629,6 +647,85 @@ export function mergeSessionPage(
   return interleaved
 }
 
+function sidebarProfileKey(session: Pick<SessionInfo, 'profile'>): string {
+  return (session.profile ?? '').trim() || 'default'
+}
+
+function sessionListIdentity(session: Pick<SessionInfo, 'id' | 'profile'>): string {
+  return `${sidebarProfileKey(session)}::${session.id}`
+}
+
+/**
+ * Re-attach previous rows for profiles whose sidebar slice failed this refresh.
+ *
+ * The batched sidebar endpoint reports a disk I/O / lock failure as HTTP 200
+ * with `recents: []` and `errors: [{ profile }]`. `mergeSessionPage` only keeps
+ * working / pinned / selected ids, so idle Yesterday / This-week rows would
+ * otherwise vanish until a later successful scan (#73847, #88528).
+ *
+ * Successful profiles are left alone: their incoming page is still authoritative.
+ */
+export function carryForwardFailedProfileSessions(
+  previous: SessionInfo[],
+  incoming: SessionInfo[],
+  errors: Array<{ profile?: string; error?: string }> | undefined | null
+): SessionInfo[] {
+  if (!errors?.length || previous.length === 0) {
+    return incoming
+  }
+
+  const failed = new Set(errors.map(error => (error.profile ?? '').trim() || 'default'))
+  const incomingIds = new Set(incoming.map(sessionListIdentity))
+  const carried: SessionInfo[] = []
+
+  for (const session of previous) {
+    if (!failed.has(sidebarProfileKey(session)) || incomingIds.has(sessionListIdentity(session))) {
+      continue
+    }
+
+    carried.push(session)
+  }
+
+  if (carried.length === 0) {
+    return incoming
+  }
+
+  // Incoming-first concat parks the failed profile at the tail of an
+  // all-profiles list. Re-rank by the same recency key the backend uses.
+  const recency = (session: SessionInfo): number => Math.max(session.last_active || 0, session.started_at || 0)
+
+  return [...incoming, ...carried].sort((a, b) => recency(b) - recency(a))
+}
+
+/** Keep previous per-profile sidebar meta for profiles whose slice failed.
+ *
+ *  A failed scan returns `{}` / falsey truncated flags. Applying those
+ *  would zero usage and hide Load more under a list we just carried forward.
+ */
+export function keepFailedProfileMeta<T>(
+  previous: Record<string, T>,
+  incoming: Record<string, T>,
+  errors: Array<{ profile?: string; error?: string }> | undefined | null
+): Record<string, T> {
+  if (!errors?.length) {
+    return incoming
+  }
+
+  const next = { ...incoming }
+
+  for (const error of errors) {
+    const key = (error.profile ?? '').trim() || 'default'
+
+    if (Object.prototype.hasOwnProperty.call(previous, key)) {
+      next[key] = previous[key]
+    } else {
+      delete next[key]
+    }
+  }
+
+  return next
+}
+
 /** Raise a session in recents on user send (before stream / turn resolve). */
 export function touchSessionActivity(
   sessionId: string | null | undefined,
@@ -1349,16 +1446,19 @@ export const setNewChatWorkspaceTarget = (next: NewChatWorkspaceTarget): number
 }
 
 export const workspaceCwdForNewSession = (): string => {
-  if ($connection.get()?.mode === 'remote') {
-    return getRememberedWorkspaceCwd()
-  }
-
   // A bare new chat starts DETACHED — no inherited cwd, so the composer's coding
   // rail (which keys off $currentCwd) shows no branch and the first message runs
   // in the gateway's default rather than silently in the last repo you touched.
   // Only an explicit default-project-dir setting pre-attaches. Entering a
   // project/worktree attaches its cwd directly (startSessionInWorkspace), so the
   // "remember where I was when I'm in a project" case is unaffected.
+  //
+  // This must behave identically in local and remote mode: the remembered CWD
+  // under the remote-keyed workspaceCwdKey() can be from a *different* project
+  // than the one the user is currently scoped into, and bare-new-session in
+  // the wrong workspace was the #57911 symptom. Resume/restore still reads
+  // the remembered cwd via ensureDefaultWorkspaceCwd (where it remains
+  // remote-keyed and intentionally sticky).
   return getConfiguredDefaultProjectDir()
 }
 
diff --git a/apps/desktop/src/store/statusbar-prefs.ts b/apps/desktop/src/store/statusbar-prefs.ts
index 7318e18d7e..a82e91617d 100644
--- a/apps/desktop/src/store/statusbar-prefs.ts
+++ b/apps/desktop/src/store/statusbar-prefs.ts
@@ -16,16 +16,20 @@ export function toggleStatusbarVisible() {
 // bar's job is to answer "is the backend healthy, where am I, what's it doing" —
 // route shortcuts (cron/webhooks/agents), the terminal toggle, and the approval
 // pill are navigation, not status, so they start out of the way. The per-turn
-// session readouts (running/session timers, context meter) are diagnostics most
-// users don't watch, so they start hidden too and the bar stays quiet mid-turn.
+// session readouts (running/session timers, context meter, cache hit rate,
+// tokens/sec) are diagnostics most users don't watch, so they start hidden too
+// and the bar stays quiet mid-turn.
 export const STATUSBAR_HIDDEN_BY_DEFAULT: readonly string[] = [
   'agents',
   'approval-mode',
+  'cache-hit-rate',
   'context-usage',
   'cron',
   'running-timer',
   'session-timer',
+  'system-resources',
   'terminal',
+  'tokens-per-second',
   'webhooks'
 ]
 
diff --git a/apps/desktop/src/store/subagents.ts b/apps/desktop/src/store/subagents.ts
index 7196f14a47..ae923aae8d 100644
--- a/apps/desktop/src/store/subagents.ts
+++ b/apps/desktop/src/store/subagents.ts
@@ -18,6 +18,9 @@ export interface SubagentProgress {
   goal: string
   /** The child's own stored session id — lets UIs open its session window. */
   sessionId?: string
+  /** Batch (delegation) id — exact grouping key for one fan-out's workers,
+   *  so concurrent/nested batches never merge into one group. */
+  delegationId?: string
   model?: string
   status: SubagentStatus
   taskCount: number
@@ -189,6 +192,7 @@ function toProgress(payload: SubagentPayload, prev: SubagentProgress | undefined
     parentId: str(payload.parent_id) || prev?.parentId || null,
     goal: str(payload.goal) || prev?.goal || 'Subagent',
     sessionId: str(payload.child_session_id) || prev?.sessionId,
+    delegationId: str(payload.delegation_id) || prev?.delegationId,
     model: str(payload.model) || prev?.model,
     status,
     taskCount: num(payload.task_count) ?? prev?.taskCount ?? 1,
diff --git a/apps/desktop/src/store/tips.ts b/apps/desktop/src/store/tips.ts
index 1003e100d1..2dd7bcdb4e 100644
--- a/apps/desktop/src/store/tips.ts
+++ b/apps/desktop/src/store/tips.ts
@@ -26,7 +26,7 @@
 import { atom } from 'nanostores'
 
 import { Codecs, persistentAtom } from '@/lib/persisted'
-import type { TipSide } from '@/lib/tips/catalog'
+import { TIP_CATALOG, type TipSide } from '@/lib/tips/catalog'
 import { mirrorDisplayToggle } from '@/store/display-toggles'
 
 /** Hours, not minutes. The catalog is ten tips and it should take weeks. */
@@ -34,6 +34,11 @@ const COOLDOWN_MS = 6 * 60 * 60_000
 
 /** A tip as the bubble needs it: resolved copy, resolved anchor. */
 export interface ActiveTip {
+  /** A call to action: one button under the text. What separates a campaign
+   *  tip from the rotation's — the rotation teaches, this one offers to DO
+   *  the thing, and the button is the only path (an ambient bubble must
+   *  never make its whole face clickable). Clicking closes the tip. */
+  action?: { label: string; onSelect: () => void }
   /** Keybind action id whose live combo the bubble prints. */
   keybind?: string
   side: TipSide
@@ -65,6 +70,23 @@ export const $activeTip = atom<ActiveTip | null>(null)
 // model's schema entirely rather than staying on offer and being dropped.
 mirrorDisplayToggle('display.in_app_tips', ENABLED_KEY, $tipsEnabled)
 
+/** When each campaign tip (id outside the rotation catalog) last showed.
+ *  Campaign tips re-offer on their own long clock instead of walking on;
+ *  `$retiredTips` still owns the hard ✕. */
+export const $tipShownAt = persistentAtom<Record<string, number>>(
+  'hermes.desktop.tips.shownAt.v1',
+  {},
+  Codecs.json(value => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      return {}
+    }
+
+    return Object.fromEntries(
+      Object.entries(value).filter((entry): entry is [string, number] => typeof entry[1] === 'number')
+    )
+  })
+)
+
 export function setTipsEnabled(enabled: boolean): void {
   if (!enabled) {
     // Including whichever one is up: the switch is answering a bubble on
@@ -85,7 +107,14 @@ export function resetTips(): void {
 /** Put a tip on screen, replacing whatever was there. */
 export function showTip(tip: ActiveTip): void {
   if (tip.tipId) {
-    $lastTipId.set(tip.tipId)
+    // The cursor belongs to the rotation's walk. A campaign tip (an id the
+    // catalog doesn't hold) records when it showed but must not move the
+    // cursor — nextTip treats an unknown id as "start over at the top".
+    if (TIP_CATALOG.some(def => def.id === tip.tipId)) {
+      $lastTipId.set(tip.tipId)
+    }
+
+    $tipShownAt.set({ ...$tipShownAt.get(), [tip.tipId]: Date.now() })
   }
 
   // Any tip starts the cooldown, an agent's included: whoever just pointed at
diff --git a/apps/desktop/src/store/updates.test.ts b/apps/desktop/src/store/updates.test.ts
index cea46b004f..a3a7c9cc81 100644
--- a/apps/desktop/src/store/updates.test.ts
+++ b/apps/desktop/src/store/updates.test.ts
@@ -89,6 +89,8 @@ const {
   applyUpdates,
   applyEverythingUpdate,
   hasMultipleUpdateTargets,
+  openUpdatesWindow,
+  startActiveUpdate,
   $updateApply,
   $updateEverything,
   $updateOverlayOpen,
@@ -117,7 +119,7 @@ const status = (over: Partial<DesktopUpdateStatus> = {}): DesktopUpdateStatus =>
   ...over
 })
 
-const lastToast = () => notifySpy.mock.calls.at(-1)?.[0] as { onDismiss: () => void }
+const lastToast = () => notifySpy.mock.calls.at(-1)?.[0] as { action: { onClick: () => void }; onDismiss: () => void }
 
 const setRemote = (on: boolean) =>
   setConnection({
@@ -410,6 +412,102 @@ describe('requestActiveUpdate', () => {
   })
 })
 
+// Surface-bound update entry points. A surface that displays ONE target's
+// status must act on that target: the overlay has no target switcher, so
+// inheriting the connection-mode default silently pointed the user at the
+// other machine. This is what left a Mac desktop on a months-old build while
+// its remote Linux backend updated fine, with no error anywhere (#70266).
+describe('explicit update targets', () => {
+  const applyClientMock = vi.fn()
+  const checkClientMock = vi.fn()
+
+  beforeEach(() => {
+    storage.clear()
+    notifySpy.mockClear()
+    dismissSpy.mockClear()
+    applyClientMock.mockReset().mockResolvedValue({ ok: true, handedOff: true })
+    checkClientMock.mockReset().mockResolvedValue(status({ behind: 4, updateAvailable: true }))
+    updateHermesSpy.mockReset().mockResolvedValue({ ok: true, name: 'update' })
+    checkHermesUpdateSpy.mockReset().mockResolvedValue({
+      install_method: 'git',
+      current_version: '0.4.2',
+      behind: 0,
+      update_available: false,
+      can_apply: true,
+      update_command: null,
+      message: null
+    })
+    getActionStatusSpy.mockReset().mockResolvedValue({ lines: [], running: false, exit_code: 0 })
+    resetUpdateApplyState()
+    $updateStatus.set(null)
+    $backendUpdateStatus.set(null)
+    $updateOverlayOpen.set(false)
+    $updateOverlayTarget.set('backend')
+    $mockConnectionsRegistry.set(null)
+    setRemote(true)
+    ;(globalThis as unknown as { window: unknown }).window = {
+      hermesDesktop: { updates: { apply: applyClientMock, check: checkClientMock } }
+    }
+    vi.useRealTimers()
+  })
+
+  afterEach(async () => {
+    await vi.waitFor(() => expect($updateEverything.get().running).toBe(false), { timeout: 5000 })
+    await vi.waitFor(() => expect($backendUpdateApply.get().applying).toBe(false), { timeout: 5000 })
+    setRemote(false)
+    delete (globalThis as unknown as { window?: unknown }).window
+  })
+
+  // The macOS "Check for Updates…" app-menu item — the OS-standard affordance
+  // for updating THIS app — routes here via `hermes:open-updates`.
+  it('opens the client overlay on an explicit client target, even in remote mode', async () => {
+    openUpdatesWindow('client')
+
+    expect($updateOverlayTarget.get()).toBe('client')
+    await vi.waitFor(() => expect(checkClientMock).toHaveBeenCalledTimes(1))
+    expect(checkHermesUpdateSpy).not.toHaveBeenCalled()
+  })
+
+  it('still defaults to the connected machine when no target is named', async () => {
+    openUpdatesWindow()
+
+    expect($updateOverlayTarget.get()).toBe('backend')
+    await vi.waitFor(() => expect(checkHermesUpdateSpy).toHaveBeenCalled())
+    expect(checkClientMock).not.toHaveBeenCalled()
+  })
+
+  it('applies the client update on an explicit client target, without fanning out', async () => {
+    startActiveUpdate('client')
+
+    expect($updateOverlayTarget.get()).toBe('client')
+    await vi.waitFor(() => expect(applyClientMock).toHaveBeenCalledTimes(1))
+    expect(updateHermesSpy).not.toHaveBeenCalled()
+    expect($updateEverything.get().running).toBe(false)
+  })
+
+  it('keeps the everything-flow for the generic, target-less apply', async () => {
+    $backendUpdateStatus.set(status({ behind: 3 }))
+
+    startActiveUpdate()
+
+    await vi.waitFor(() => expect(updateHermesSpy).toHaveBeenCalled(), { timeout: 5000 })
+  })
+
+  // A toast raised by the CLIENT check must open the client overlay: the user
+  // was told the app is behind, so landing them on the backend's (current)
+  // status reads as the update having vanished.
+  it('opens the overlay for the target whose status raised the toast', () => {
+    maybeNotifyUpdateAvailable(status(), 'client')
+    lastToast().action.onClick()
+    expect($updateOverlayTarget.get()).toBe('client')
+
+    storage.clear() // clear the snooze the click just set
+    maybeNotifyUpdateAvailable(status({ targetSha: 'sha-b' }), 'backend')
+    lastToast().action.onClick()
+    expect($updateOverlayTarget.get()).toBe('backend')
+  })
+})
+
 // The everything-flow: on multi-target installs (remote mode / multi-connection
 // registry) "update" must mean every machine — active backend, other registered
 // sources via the Electron fan-out, and the client LAST. Before this flow,
@@ -564,6 +662,35 @@ describe('applyEverythingUpdate', () => {
     expect(updateAllMock).toHaveBeenCalledTimes(1)
   })
 
+  it('re-checks the client instead of trusting a stale cached status', async () => {
+    setRemote(true)
+    $backendUpdateStatus.set(status({ behind: 3 }))
+    // FAIL-BEFORE: `$updateStatus.get() ?? (await checkUpdates())` short-circuits
+    // on this cached row — captured up to a poll interval (30 min) ago, and
+    // before the backend leg ran — so the client apply was skipped and the app
+    // stayed stale. The live check says otherwise and must win.
+    $updateStatus.set(status({ behind: 0, updateAvailable: false }))
+    checkClientMock.mockResolvedValue(status({ behind: 7, updateAvailable: true }))
+
+    await applyEverythingUpdate()
+
+    expect(applyClientMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('falls back to the cached client status when the live re-check fails', async () => {
+    setRemote(true)
+    $backendUpdateStatus.set(status({ behind: 3 }))
+    $updateStatus.set(status({ behind: 7, updateAvailable: true }))
+    // `checkUpdates()` never rejects — it resolves with an error-status and
+    // overwrites the atom with it, so an unreachable bridge must not read as
+    // "client is current" and skip the leg.
+    checkClientMock.mockRejectedValue(new Error('bridge gone'))
+
+    await applyEverythingUpdate()
+
+    expect(applyClientMock).toHaveBeenCalledTimes(1)
+  })
+
   it('requestActiveUpdate routes through the everything-flow when EITHER target is behind', async () => {
     setRemote(true)
     // Backend current, client behind — the exact case the old remote-only
diff --git a/apps/desktop/src/store/updates.ts b/apps/desktop/src/store/updates.ts
index f6e977f975..327c31b0a6 100644
--- a/apps/desktop/src/store/updates.ts
+++ b/apps/desktop/src/store/updates.ts
@@ -205,8 +205,12 @@ export function reportInstallMethodWarning(message: string | undefined): void {
  * Closing the toast — dismissing it or opening the updates window from it —
  * (re)starts the cooldown, so a busy upstream branch doesn't re-spam the user
  * on every new commit. The snooze is persisted, so it survives relaunches too.
+ *
+ * `target` is the target whose status produced this toast. The overlay has no
+ * target switcher, so a client-status toast that opened the backend overlay
+ * showed the user a machine they weren't told about, with no way back.
  */
-export function maybeNotifyUpdateAvailable(status: DesktopUpdateStatus | null) {
+export function maybeNotifyUpdateAvailable(status: DesktopUpdateStatus | null, target: UpdateTarget = 'client') {
   if (!status || status.supported === false || status.error || !status.targetSha) {
     return
   }
@@ -232,7 +236,7 @@ export function maybeNotifyUpdateAvailable(status: DesktopUpdateStatus | null) {
       label: translateNow('notifications.seeWhatsNew'),
       onClick: () => {
         snoozeUpdateToast()
-        openUpdatesWindow()
+        openUpdateOverlayFor(target)
       }
     },
     durationMs: 0,
@@ -248,8 +252,24 @@ export function maybeNotifyUpdateAvailable(status: DesktopUpdateStatus | null) {
   })
 }
 
-export function openUpdatesWindow(): void {
-  openUpdateOverlayFor(isRemoteMode() ? 'backend' : 'client')
+/** The target a generic, surface-less update command acts on: the machine the
+ *  user is connected to. Surfaces that display one target's status must pass
+ *  that target explicitly instead of inheriting this. */
+function activeUpdateTarget(): UpdateTarget {
+  return isRemoteMode() ? 'backend' : 'client'
+}
+
+/**
+ * Open the updates overlay and kick off its check.
+ *
+ * Callers tied to a specific status surface pass its target; only genuinely
+ * generic entry points take the connection-mode default. The macOS "Check for
+ * Updates…" menu item is the former — it is the OS-standard affordance for
+ * updating *this app*, so in remote mode it checked the wrong machine and the
+ * Mac client silently drifted behind (#70266).
+ */
+export function openUpdatesWindow(target: UpdateTarget = activeUpdateTarget()): void {
+  openUpdateOverlayFor(target)
 }
 
 /**
@@ -263,19 +283,22 @@ export function openUpdatesWindow(): void {
  * through the everything-flow so "update" means every machine, not just the
  * active target — the single-target ternary is what left remote-mode users
  * updating the backend forever while the GUI itself went stale.
+ *
+ * An explicit `target` opts out of both: the caller is acting on one named
+ * machine's status and must not fan out to the others.
  */
-export function startActiveUpdate(): void {
-  if (hasMultipleUpdateTargets()) {
+export function startActiveUpdate(target?: UpdateTarget): void {
+  if (!target && hasMultipleUpdateTargets()) {
     $updateOverlayOpen.set(true)
     void applyEverythingUpdate()
 
     return
   }
 
-  const target: UpdateTarget = isRemoteMode() ? 'backend' : 'client'
-  $updateOverlayTarget.set(target)
+  const effective = target ?? activeUpdateTarget()
+  $updateOverlayTarget.set(effective)
   $updateOverlayOpen.set(true)
-  void (target === 'backend' ? applyBackendUpdate() : applyUpdates())
+  void (effective === 'backend' ? applyBackendUpdate() : applyUpdates())
 }
 
 /**
@@ -304,11 +327,11 @@ export function requestActiveUpdate(): void {
     }
   }
 
-  const target: UpdateTarget = isRemoteMode() ? 'backend' : 'client'
+  const target = activeUpdateTarget()
   const status = target === 'backend' ? $backendUpdateStatus.get() : $updateStatus.get()
 
   if ((status?.behind ?? 0) > 0 || status?.updateAvailable) {
-    startActiveUpdate()
+    startActiveUpdate(target)
 
     return
   }
@@ -373,7 +396,7 @@ export async function checkBackendUpdates(): Promise<DesktopUpdateStatus | null>
   try {
     const status = mapBackendCheck(await checkHermesUpdate(true))
     $backendUpdateStatus.set(status)
-    maybeNotifyUpdateAvailable(status)
+    maybeNotifyUpdateAvailable(status, 'backend')
 
     return status
   } catch (error) {
@@ -404,7 +427,7 @@ export async function checkUpdates(): Promise<DesktopUpdateStatus | null> {
   try {
     const status = await bridge.check()
     $updateStatus.set(status)
-    maybeNotifyUpdateAvailable(status)
+    maybeNotifyUpdateAvailable(status, 'client')
     void refreshDesktopVersion()
 
     return status
@@ -855,6 +878,12 @@ export function applyEverythingUpdate(): Promise<void> {
 async function runEverythingUpdate(): Promise<void> {
   $updateEverything.set({ running: true })
 
+  // Snapshot the client status before any leg runs: the backend leg's own
+  // post-update nudge re-checks the client and overwrites `$updateStatus`,
+  // including with an error row when the bridge is unreachable. Step 3 needs a
+  // pre-flow value to fall back on when its own live check can't answer.
+  const cachedClientStatus = $updateStatus.get()
+
   try {
     // 1. Active backend first (remote mode), with the detailed overlay flow.
     //    Its own finish path re-checks and nudges, but the everything-flow
@@ -911,7 +940,14 @@ async function runEverythingUpdate(): Promise<void> {
 
     // 3. The client last — its apply relaunches or hands off the app, so it
     //    must come after every dispatch above. Skipped when already current.
-    const clientStatus = $updateStatus.get() ?? (await checkUpdates())
+    //    Re-check rather than trusting `$updateStatus`: the cached value can be
+    //    up to a poll interval (30 min) old and was captured BEFORE the backend
+    //    update above, so a cached `behind: 0` would skip the client leg and
+    //    leave the app stale — the exact failure this flow exists to prevent.
+    //    `checkUpdates()` resolves with an error-status rather than rejecting,
+    //    so fall back to the pre-flow snapshot when the live check can't answer.
+    const freshClientStatus = await checkUpdates().catch(() => null)
+    const clientStatus = freshClientStatus?.error ? cachedClientStatus : (freshClientStatus ?? cachedClientStatus)
 
     if ((clientStatus?.behind ?? 0) > 0 || clientStatus?.updateAvailable) {
       $updateOverlayTarget.set('client')
diff --git a/apps/desktop/src/store/windows.test.ts b/apps/desktop/src/store/windows.test.ts
index 7c032a07f0..69402ae14b 100644
--- a/apps/desktop/src/store/windows.test.ts
+++ b/apps/desktop/src/store/windows.test.ts
@@ -1,5 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { $activeGatewayProfile } from './profile'
+import { $sessions } from './session'
 import {
   canOpenBrowserWindow,
   canOpenNewWindow,
@@ -88,23 +90,17 @@ describe('openSessionInNewWindow', () => {
     expect(notifyError).not.toHaveBeenCalled()
   })
 
-  it('invokes the bridge with the session id', async () => {
+  it('carries the owning profile: stamped row wins, an unstamped child inherits the viewed profile (#82768)', async () => {
     const open = vi.fn().mockResolvedValue({ ok: true })
     installBridge(open)
+    $activeGatewayProfile.set('work')
+    $sessions.set([{ id: 's1', profile: 'research' } as never])
 
     await openSessionInNewWindow('s1')
+    await openSessionInNewWindow('child-not-listed-yet', { watch: true })
 
-    expect(open).toHaveBeenCalledWith('s1', undefined)
-    expect(notifyError).not.toHaveBeenCalled()
-  })
-
-  it('forwards the watch flag for spectator (subagent) windows', async () => {
-    const open = vi.fn().mockResolvedValue({ ok: true })
-    installBridge(open)
-
-    await openSessionInNewWindow('s1', { watch: true })
-
-    expect(open).toHaveBeenCalledWith('s1', { watch: true })
+    expect(open).toHaveBeenCalledWith('s1', { profile: 'research' })
+    expect(open).toHaveBeenCalledWith('child-not-listed-yet', { profile: 'work', watch: true })
     expect(notifyError).not.toHaveBeenCalled()
   })
 
diff --git a/apps/desktop/src/store/windows.ts b/apps/desktop/src/store/windows.ts
index 8015893d88..77befcdb39 100644
--- a/apps/desktop/src/store/windows.ts
+++ b/apps/desktop/src/store/windows.ts
@@ -189,13 +189,26 @@ async function runWindowOpen(call: () => Promise<WindowOpenResult>, failMessage:
 // Open (or focus) a standalone OS window for a single chat session. No-ops
 // gracefully outside Electron so callers can wire it unconditionally.
 // `watch: true` opens a spectator window (lazy resume, live-mirror stream).
+// The window is a full renderer that adopts the PRIMARY profile unless told
+// otherwise, so the owning profile rides along (same ladder as openHud,
+// #82285): the session's stamped owner wins, and an unstamped/uncached id —
+// a brand-new subagent child — inherits the profile the user is looking at
+// (#82768, #61286).
 export async function openSessionInNewWindow(sessionId: string, opts?: { watch?: boolean }): Promise<void> {
   if (!sessionId || !canOpenSessionWindow()) {
     return
   }
 
+  // Lazy imports: `./profile` subscribes to the API client on load, so a
+  // static import here would drag it into every page that opens windows.
+  const [{ $activeGatewayProfile, normalizeProfileKey }, { $sessions, rememberedSessionProfile }] = await Promise.all([
+    import('./profile'),
+    import('./session')
+  ])
+  const profile = normalizeProfileKey(rememberedSessionProfile($sessions.get(), sessionId, $activeGatewayProfile.get()))
+
   await runWindowOpen(
-    () => window.hermesDesktop.openSessionWindow(sessionId, opts),
+    () => window.hermesDesktop.openSessionWindow(sessionId, { ...opts, profile }),
     'Could not open chat in a new window'
   )
 }
diff --git a/apps/desktop/src/types/hermes.ts b/apps/desktop/src/types/hermes.ts
index fdd2c81d70..5402baa746 100644
--- a/apps/desktop/src/types/hermes.ts
+++ b/apps/desktop/src/types/hermes.ts
@@ -29,6 +29,21 @@ export interface AudioSpeakResponse {
   provider?: string
 }
 
+/** `POST /api/audio/tts-lease` — TTS engine warm-up / release driven by speech toggles. */
+export interface AudioTtsLeaseResponse {
+  ok: boolean
+  lease: string
+  active: boolean
+  /** Live lease holders after this call (null when the backend call itself failed). */
+  leases: null | number
+  /** Warm-up outcome: `loaded` | `cached` | `installed` | `noop` | `error`. */
+  action?: string
+  provider?: string
+  /** Resident local models dropped (release path). */
+  released?: number
+  error?: string
+}
+
 export interface ElevenLabsVoice {
   label: string
   name: string
@@ -493,6 +508,10 @@ export interface SessionInfo {
    *  continuation tip. Stable across compressions — used as the durable id for
    *  pins so a pinned conversation survives auto-compression. */
   _lineage_root_id?: null | string
+  /** Every id on the compression chain (root, intermediates, tip) when this
+   *  entry is a projected continuation tip. Intermediates matter: a persisted
+   *  tile or route can hold a middle segment's id from when IT was the tip. */
+  _lineage_ids?: null | string[]
   input_tokens: number
   /** Spend for the session, straight off the `sessions` row. `actual` is set
    *  when the provider reported a price; `estimated` is our own pricing-table
@@ -716,6 +735,10 @@ export interface SessionRuntimeInfo {
 }
 
 export interface UsageStats {
+  /** Rolling tokens-per-second over the last ~10 API calls (tui_gateway `_get_usage`). */
+  avg_tps?: number
+  /** Session prompt-cache hit rate, 0–100. Omitted (not 0) when the provider reports no cache reads. */
+  cache_hit_pct?: number
   calls: number
   context_max?: number
   context_percent?: number
@@ -1237,6 +1260,97 @@ export interface StatusResponse {
   version: string
 }
 
+// ── Managed local runtime (llama.cpp) ──────────────────────────
+
+export interface LocalModelPlacement {
+  window?: number
+  window_label?: string
+  spilled?: boolean
+  granted_window?: number
+  granted_window_label?: string
+}
+
+export interface LocalModelLoadProgress {
+  stage: string
+  value: number
+  percent: number
+}
+
+export interface LocalModelsStatus {
+  enabled: boolean
+  tag: string
+  configured_tag: string
+  update_available: boolean
+  runtime_installed: boolean
+  runtime_backend: string | null
+  server_running: boolean
+  server_base_url: string | null
+  active_model_id: string | null
+  loaded_models: Record<string, string>
+  /** Models loading into memory right now: real per-tensor load percent. */
+  loading?: Record<string, LocalModelLoadProgress>
+  placement?: Record<string, LocalModelPlacement>
+  models: { id: string; size_bytes: number; size_label: string }[]
+  models_dir: string
+}
+
+export interface LocalHardware {
+  uma: boolean
+  vram_total_bytes: number
+  vram_usable_bytes: number
+  ram_total_bytes: number
+  ram_available_bytes: number
+  vram_label: string
+  gpu_name: string | null
+  gpu_util_percent: number | null
+  vram_used_bytes: number | null
+}
+
+export interface LocalCatalogModel {
+  id: string
+  display_name: string
+  description: string
+  size_bytes: number
+  size_label: string
+  native_context: number
+  native_context_label: string
+  recommended: boolean
+  /** Why the resolver picked this entry (recommended rows only):
+   *  best-quality-resident | speed-gated-quality | fastest-resident |
+   *  least-painful-spilled. Renders as the Recommended badge's tooltip. */
+  recommended_reason?: string | null
+  downloaded: boolean
+  downloaded_model_id?: string | null
+  downloaded_quant?: string | null
+  mtp: boolean
+  vision?: boolean
+  fits: boolean
+  fit_summary: string
+  fit_detail?: string
+  model_id?: string
+  quant?: string
+  quant_reason?: string
+  quant_validated?: boolean
+  variant_count?: number
+  start_window?: number
+  start_window_label?: string
+  spilled?: boolean
+}
+
+export interface LocalRuntimeJob {
+  job_id: string
+  kind: 'model-activate' | 'model-download' | 'quickstart' | 'runtime-install'
+  target: string
+  model_id: string | null
+  status: 'running' | 'done' | 'error'
+  phase: string
+  detail: string
+  total_bytes: number | null
+  done_bytes: number
+  percent?: number
+  error: string | null
+}
+
 export interface ActionResponse {
   name: string
   ok: boolean
diff --git a/cli-config.yaml.example b/cli-config.yaml.example
index c4025dc2b3..687badff7d 100644
--- a/cli-config.yaml.example
+++ b/cli-config.yaml.example
@@ -82,6 +82,17 @@ model:
   # api_key: "your-key-here"  # Uncomment to set here instead of .env
   base_url: "https://openrouter.ai/api/v1"
 
+  # Stream API responses from the provider (default: true). The agent core
+  # prefers streaming for every turn — subagents included — for liveness
+  # health-checking. Set false to force non-streaming requests for the whole
+  # session (persists across mid-session model switches). Escape hatch for
+  # self-hosted OpenAI-compatible servers whose streaming tool-call path is
+  # broken (e.g. vLLM with --tool-call-parser qwen3_xml + a reasoning parser
+  # can leak tool calls into plain text instead of returning tool_calls —
+  # #72901). Orthogonal to display.streaming, which controls token rendering
+  # only.
+  # streaming: true
+
   # Azure Foundry keyless auth example:
   # provider: "azure-foundry"
   # base_url: "https://<resource>.openai.azure.com/openai/v1"
@@ -522,12 +533,14 @@ browser:
 # Tool Loop Guardrails
 # =============================================================================
 # Soft warnings are enabled by default. They append guidance to repeated failed
-# or non-progressing tool results but still let the tool execute. Hard stops are
-# opt-in circuit breakers for autonomous/cron sessions where stopping a loop is
-# preferable to spending the full iteration budget.
+# or non-progressing tool results but still let the tool execute. Hard stops stay
+# opt-in for interactive CLI/TUI/Desktop/ACP sessions, but default on for unattended
+# gateway/cron sessions where nobody is present to interrupt a model that
+# ignores loop warnings.
 tool_loop_guardrails:
   warnings_enabled: true
   hard_stop_enabled: false
+  non_interactive_hard_stop_enabled: true
   warn_after:
     exact_failure: 2
     same_tool_failure: 3
@@ -688,6 +701,19 @@ compression:
   # summarization on a short idle thread. Example: 1800 = compact after 30 min idle.
   idle_compact_after_seconds: 0
 
+  # Gateway session-hygiene turn-hold budget (default: 10). Max seconds an
+  # arriving user turn is held while a still-streaming hygiene summary
+  # finishes. Distinct from hygiene_timeout_seconds (compressor inactivity
+  # budget): this bounds user-visible latency so chat transports (Telegram
+  # ~30s) do not drop a silent connection. On expiry the turn proceeds
+  # uncompressed; the detached worker keeps its commit admission (when the
+  # commit is watermark-fenced) and the summary is adopted at the next safe
+  # boundary. Thinking-model summarizers often need longer than 10s to emit
+  # the first content token — raise to 300 (or >= your summarizer's real
+  # time-to-first-content) only if you want THIS turn to wait for the
+  # compression instead of adopting it one turn late.
+  hygiene_max_turn_hold_seconds: 10
+
   # Proactive tool-result prune (default: 0 = disabled). Opt-in token trigger
   # for a deterministic, no-LLM prune of OLD tool-result payloads, run
   # independently of `threshold` above. On large-window models (512K/1M) the
@@ -922,6 +948,32 @@ max_concurrent_sessions: null
 # explicitly want one shared "room brain" per group/channel.
 group_sessions_per_user: true
 
+# =============================================================================
+# Session Storage Retention (state.db)
+# =============================================================================
+# ~/.hermes/state.db keeps every session, message, and tool call, plus the
+# FTS5 search indexes. Since #54189, auto-pruning is ON by default so the file
+# stays bounded: at CLI/gateway/cron startup (at most once per
+# min_interval_hours) Hermes deletes ENDED sessions whose last activity is
+# older than retention_days. Open, pinned, and in-progress sessions are never
+# deleted. Stale automation sessions (cron/kanban/subagent/one-shot CLI) whose
+# process died without closing them are first *closed*, then aged through a
+# further full retention window before removal.
+#
+# After a prune that removed rows, VACUUM reclaims disk space only when both
+# the time throttle (min_vacuum_interval_days) has elapsed AND more than 25%
+# of the file's pages are reclaimable — a dense database never pays for a full
+# rewrite to reclaim a few MB.
+#
+# Uncomment to change the defaults shown; set auto_prune: false to keep every
+# ended session forever (the pre-#54189 behavior).
+# sessions:
+#   auto_prune: true
+#   retention_days: 90
+#   vacuum_after_prune: true
+#   min_vacuum_interval_days: 30
+#   min_interval_hours: 24
+
 # Optional direct endpoint for autonomous Bot Mode rooms spanning gateways.
 # Leave unset for the safe default: Desktop coordinates cross-gateway rooms and
 # same-gateway rooms can still continue on their own. Set this only to the
@@ -1155,7 +1207,17 @@ agent:
   #   "claude-opus-4.6": "high"           # bare model name also works
   #   "deepseek/deepseek-v4-pro": "xhigh" # dots and dashes are interchangeable
   reasoning_overrides: {}
-  
+
+  # Fast mode (OpenAI Priority Processing / xAI Grok 4.6 / Anthropic Fast Mode
+  # on Opus 4.8+). Premium pricing; only sent to first-party endpoints.
+  #   "" / "normal" - off (default)
+  #   "fast"        - every request
+  #   "auto"        - only the first fast_auto_seconds of every turn
+  #   "cold"        - that window on the first turn of a session only
+  # Also: /fast normal|fast|auto|cold [--global]
+  service_tier: ""
+  fast_auto_seconds: 60
+
   # Custom personalities (use with /personality command).
   # Built-ins (helpful, concise, technical, creative, teacher, kawaii, catgirl,
   # pirate, shakespeare, surfer, noir, uwu, philosopher, hype) are always
@@ -1179,6 +1241,13 @@ gateway:
   # if an agent has not unwound. Keep it below the service-manager stop budget.
   # signal_interrupt_grace_timeout: 1
 
+  # Let platform adapters honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY (and
+  # SSL_CERT_FILE) from the process environment, plus macOS system-proxy
+  # auto-detection. Set to false when the gateway inherits a proxy it must not
+  # use (e.g. a Windows Scheduled Task picking up a local Clash/V2Ray proxy that
+  # isn't running). Explicit per-platform vars like DISCORD_PROXY still apply.
+  # trust_env: true
+
 # =============================================================================
 # Toolsets
 # =============================================================================
@@ -1277,6 +1346,10 @@ platform_toolsets:
 #       # Render live tool calls as Slack-native plan/task cards. This explicit
 #       # opt-in works even though Slack text tool_progress defaults to off.
 #       native_task_cards: false
+#       # Slack user IDs whose Web-API posts (user token, e.g. your own
+#       # dashboard/mobile front-end) count as human instead of being dropped
+#       # as app traffic. Narrower than allow_bots: all. Users only — never apps.
+#       api_human_users: ["U0AAAAAAA", "U0BBBBBBB"]
 #       # Suppress automatic link-preview cards without removing clickable links.
 #       # Omit either key to preserve Slack's default for that preview type.
 #       unfurl_links: false
@@ -1721,6 +1794,13 @@ display:
   #   false: Silent (default)
   bell_on_complete: false
 
+  # Play terminal bell when a blocking prompt opens and waits on you:
+  # clarify questions, dangerous-command approvals, sudo password, secret
+  # capture. Same mechanism as bell_on_complete (\a) — works over SSH.
+  #   true:  Ring whenever the agent is waiting for your input
+  #   false: Silent (default)
+  bell_on_prompt: false
+
   # Show model reasoning/thinking before each response.
   # When enabled, a dim box shows the model's thought process above the response.
   # Toggle at runtime with /reasoning show or /reasoning hide.
@@ -1870,15 +1950,31 @@ display:
 # =============================================================================
 # Shared metrics are disabled by default. When enabled, Hermes writes only
 # allowlisted aggregate counters and immutable JSON
-# packages under $HERMES_HOME/telemetry/shared_metrics; it does not upload them.
+# packages under $HERMES_HOME/telemetry/shared_metrics.
 # Packages include a random profile-scoped ID that stays stable until this
 # directory is deleted. It is not derived from hardware, account, or host data.
 # Successfully exported local history is retained for 30 days; pending deltas
 # are retained until they can be exported.
 # This profile-owned choice is not overridden by managed-scope configuration.
+#
+# Nothing is uploaded unless you also set `send: true`. That is a separate
+# opt-in and requires `enabled`; it never turns collection on by itself.
+# When sending is on:
+#   * only packages whose entire collection period falls within one
+#     continuous recorded consent window are ever sent. Consent windows open
+#     when you enable sending and close when you disable it, so data
+#     collected before you opted in — or during any gap between opt-ins —
+#     stays on this machine;
+#   * each package carries the profile-scoped ID as-is. It is a random UUID
+#     with no hardware, account, or host-derived content, and deleting the
+#     shared-metrics directory resets it.
+# See docs/observability/relay-shared-metrics.md (Appendix A) for the full
+# consent, identity, retention, and deletion decisions.
 telemetry:
   shared_metrics:
     enabled: false
+    send: false
+    # endpoint: https://telemetry.nousresearch.com/v1/telemetry
 
 
 # =============================================================================
diff --git a/cli.py b/cli.py
index d0ff845579..ab2f2d3d7f 100644
--- a/cli.py
+++ b/cli.py
@@ -402,12 +402,14 @@ def _parse_reasoning_config(effort) -> dict | None:
 
 
 def _parse_service_tier_config(raw: str) -> str | None:
-    """Parse a persisted service-tier preference into a Responses API value."""
+    """Parse a persisted fast-mode preference: None, "priority", "auto", or "cold"."""
     value = str(raw or "").strip().lower()
     if not value or value in {"normal", "default", "standard", "off", "none"}:
         return None
     if value in {"fast", "priority", "on"}:
         return "priority"
+    if value in {"auto", "cold"}:
+        return value
     logger.warning("Unknown service_tier '%s', ignoring", raw)
     return None
 
@@ -5257,6 +5259,9 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         self.resume_display = CLI_CONFIG["display"].get("resume_display", "full")
         # bell_on_complete: play terminal bell (\a) when agent finishes a response
         self.bell_on_complete = CLI_CONFIG["display"].get("bell_on_complete", False)
+        # bell_on_prompt: play terminal bell (\a) whenever a blocking prompt
+        # modal opens (clarify, approval, sudo password, secret capture)
+        self.bell_on_prompt = CLI_CONFIG["display"].get("bell_on_prompt", False)
         # show_reasoning: display model thinking/reasoning before the response
         self.show_reasoning = CLI_CONFIG["display"].get("show_reasoning", True)
         # reasoning_full: when reasoning display is on, print the post-response
@@ -5364,6 +5369,30 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         # clobber an explicit override with the session's stored model.
         self._explicit_model_override = bool(model)
         self.model = model or _config_model or _DEFAULT_CONFIG_MODEL
+        _startup_provider_override = ""
+        _startup_base_url_override = ""
+        _startup_api_key_override = ""
+        if self.model:
+            from hermes_cli.model_switch import resolve_startup_model_route
+
+            _startup_route = resolve_startup_model_route(
+                self.model,
+                explicit_provider=provider or "",
+                current_provider=(
+                    provider
+                    or _nested_provider
+                    or CLI_CONFIG["model"].get("provider")
+                    or os.getenv("HERMES_INFERENCE_PROVIDER")
+                    or ""
+                ),
+                user_providers=CLI_CONFIG.get("providers"),
+                custom_providers=CLI_CONFIG.get("custom_providers"),
+            )
+            if _startup_route is not None:
+                self.model = _startup_route.model
+                _startup_provider_override = _startup_route.provider
+                _startup_base_url_override = _startup_route.base_url
+                _startup_api_key_override = _startup_route.api_key
         # A ``moa:<preset>`` model string selects the MoA virtual provider in
         # one shot (parity with interactive ``/moa`` and the model picker). Do
         # this before provider resolution so ``-Q -m moa:<preset>`` routes
@@ -5400,13 +5429,16 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             not _config_model or _config_model == _DEFAULT_CONFIG_MODEL
         )
 
-        self._explicit_api_key = api_key
+        # An explicit --api-key wins; otherwise a URL-bearing startup alias
+        # carries its own credential for the alias host (#28660).
+        self._explicit_api_key = api_key or _startup_api_key_override or None
         self._explicit_base_url = base_url
 
         # Provider selection is resolved lazily at use-time via _ensure_runtime_credentials().
         self.requested_provider = (
             _moa_provider_override
             or provider
+            or _startup_provider_override
             or _nested_provider
             or CLI_CONFIG["model"].get("provider")
             or os.getenv("HERMES_INFERENCE_PROVIDER")
@@ -5440,6 +5472,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         self.acp_args: list[str] = []
         self.base_url = (
             base_url
+            or _startup_base_url_override
             or CLI_CONFIG["model"].get("base_url", "")
             or os.getenv("OPENROUTER_BASE_URL", "")
         ) or None
@@ -6639,6 +6672,29 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             context_tokens = getattr(compressor, "last_prompt_tokens", 0) or 0
             if context_tokens < 0:
                 context_tokens = 0
+            # Durable-transcript view: on reasoning models a long tool loop
+            # replays the current turn's thinking + scaffolding on every
+            # request, so the LAST request's prompt_tokens can exceed the
+            # durable transcript by hundreds of K — all of which evaporates
+            # at the turn boundary. Rendering that raw figure makes the bar
+            # sawtooth (e.g. 850K mid-turn -> 600K next turn) and reads as a
+            # broken compaction. Anchor the display on the turn's FIRST
+            # response (minimal replay) plus a delta estimate of messages
+            # appended since, excluding stale thinking. Display-only: the
+            # compression trigger keeps using real last-request usage.
+            try:
+                from agent.model_metadata import anchored_context_tokens
+
+                _msgs = getattr(agent, "_session_messages", None)
+                _anchored = anchored_context_tokens(
+                    _msgs if isinstance(_msgs, list) else [],
+                    getattr(agent, "_turn_base_usage_anchor", None),
+                    charge_stale_thinking=False,
+                )
+                if _anchored is not None and _anchored > 0:
+                    context_tokens = _anchored
+            except Exception:
+                pass
             context_length = getattr(compressor, "context_length", 0) or 0
             if context_length < 0:
                 context_length = 0
@@ -12035,7 +12091,8 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             if not providers:
                 _cprint("  No authenticated providers found.")
                 _cprint("")
-                _cprint("  /model <name>                        switch model (persists)")
+                _cprint("  /model <name>                        switch model (this session)")
+                _cprint("  /model <name> --global               switch model and persist as default")
                 _cprint("  /model <name> --once                 switch for the next turn only")
                 _cprint("  /model <name> --session              switch for this session only")
                 _cprint("  /model --provider <slug>             switch provider")
@@ -14707,7 +14764,9 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         sees the updated tools on the next turn.
         """
         try:
-            from tools.mcp_tool import shutdown_mcp_servers, discover_mcp_tools, _servers, _lock
+            from tools.mcp_tool import (
+                shutdown_mcp_servers, discover_mcp_tools, reprobe_tool_availability, _servers, _lock,
+            )
 
             # Capture old server names
             with _lock:
@@ -14719,6 +14778,8 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             # Shutdown existing connections
             shutdown_mcp_servers()
 
+            # Explicit reload also re-probes tool availability (check_fn).
+            reprobe_tool_availability()
             # Reconnect (reads config.yaml fresh)
             new_tools = discover_mcp_tools()
 
@@ -15714,6 +15775,10 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         # _voice_message_prefix property and its usage in _process_message().
 
         tts_status = " (TTS enabled)" if self._voice_tts else ""
+        if self._voice_tts:
+            # Speech output is on from the start — warm the engine now so the
+            # first spoken reply doesn't pay the model load as dead air.
+            self._tts_lease_async(True)
         # Use the startup-pinned cache so the advertised shortcut always
         # matches the live prompt_toolkit binding — reading live config
         # here would drift after a mid-session config edit (Copilot
@@ -15772,6 +15837,11 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             self._voice_tts = False
             self._voice_continuous = False
 
+        # Speech output is off with the mode — release the TTS engine lease so
+        # a resident local model (piper/kittentts) is freed once nothing else
+        # in this process still needs it.
+        self._tts_lease_async(False)
+
         # Shut down the persistent audio stream in background
         if recorder is not None:
             def _bg_shutdown(rec=recorder):
@@ -16019,6 +16089,29 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         if not owned:
             _cprint(f"  {_DIM}Enable with /wake on{_RST}")
 
+    def _tts_lease_async(self, active: bool) -> None:
+        """Acquire/release this CLI's TTS engine lease in the background.
+
+        The /voice tts toggle (and voice-mode on/off with speech output set)
+        is the "TTS is about to be needed / no longer needed" signal:
+        acquiring pre-loads the configured provider so the first reply starts
+        hot; releasing lets the last-holder path unload resident local models.
+        Never blocks the toggle and never fails it.
+        """
+
+        def _run():
+            try:
+                from tools.tts_tool import acquire_tts_lease, release_tts_lease
+
+                if active:
+                    acquire_tts_lease("cli:voice-tts")
+                else:
+                    release_tts_lease("cli:voice-tts")
+            except Exception as e:
+                logger.debug("voice: tts lease active=%s failed: %s", active, e)
+
+        threading.Thread(target=_run, name="tts-lease-cli", daemon=True).start()
+
     def _toggle_voice_tts(self):
         """Toggle TTS output for voice mode."""
         if not self._voice_mode:
@@ -16034,6 +16127,10 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             if not check_tts_requirements():
                 _cprint(f"{_DIM}Warning: No TTS provider available. Install edge-tts or set API keys.{_RST}")
 
+        # Toggle = warm-up / release signal for the TTS engine (see
+        # tools.tts_tool.acquire_tts_lease).
+        self._tts_lease_async(self._voice_tts)
+
         _cprint(f"{_ACCENT}Voice TTS {status}.{_RST}")
 
     def _show_voice_status(self):
@@ -16074,6 +16171,39 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             outcome = outcome[:119] + "…"
         _cprint(f"\n{_DIM}{icon} {label}: {detail} → {outcome}{_RST}")
 
+    def _ring_bell(self, prompt: bool = False, context: str = "", detail: str = "") -> None:
+        """Write a terminal bell (\\a) if the matching display.bell_* flag is on.
+
+        ``prompt=True`` is the blocking-modal variant (clarify / approval /
+        sudo / secret capture) gated by ``display.bell_on_prompt``; the default
+        is the end-of-turn bell gated by ``display.bell_on_complete``. Works
+        over SSH — the BEL propagates to the user's terminal.
+
+        The same flag also emits an OSC 9 desktop notification (Ghostty,
+        iTerm2, Kitty, WezTerm) and, inside a supporting Warp build, a
+        ``warp://cli-agent`` OSC 777 event — see ``hermes_cli.terminal_notify``.
+        ``context`` is the short notification body (e.g. "approval").
+        """
+        flag = "bell_on_prompt" if prompt else "bell_on_complete"
+        if not getattr(self, flag, False):
+            return
+        try:
+            sys.stdout.write("\a")
+            sys.stdout.flush()
+        except Exception:
+            pass
+        try:
+            from hermes_cli.terminal_notify import notify as _terminal_notify
+
+            _terminal_notify(
+                context or ("input needed" if prompt else "turn complete"),
+                prompt=prompt,
+                session_id=getattr(self, "session_id", "") or "",
+                detail=detail,
+            )
+        except Exception:
+            pass
+
     def _clarify_callback(self, question, choices, multi_select=False, questions=None):
         """
         Platform callback for the clarify tool. Called from the agent thread.
@@ -16121,6 +16251,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         self._clarify_freetext = is_open_ended
         self._clarify_multi_base = None
 
+        self._ring_bell(prompt=True, context="clarify")
         # Trigger an immediate prompt_toolkit repaint from this (non-main)
         # thread. Modal prompts must paint at once and must not be gated by the
         # _invalidate throttle / resize guard — see _paint_now / _invalidate (#41098).
@@ -16312,6 +16443,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
         self._clarify_state = state
         self._clarify_batch_set_active(state, 0)
         self._clarify_deadline = None if timeout <= 0 else _time.monotonic() + timeout
+        self._ring_bell(prompt=True, context="clarify")
         self._paint_now()
 
         _last_countdown_refresh = _time.monotonic()
@@ -16362,6 +16494,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             "response_queue": response_queue,
         }
         self._sudo_deadline = _time.monotonic() + timeout
+        self._ring_bell(prompt=True, context="sudo password")
 
         # Modal prompt — paint immediately, bypassing the throttle/resize guard
         # so the prompt can't be dropped and time out unseen (#41098).
@@ -16431,6 +16564,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
             }
             self._approval_deadline = _time.monotonic() + timeout
 
+            self._ring_bell(prompt=True, context="approval", detail=command)
             # Modal prompt — paint immediately, bypassing the throttle/resize
             # guard. A throttled paint here can be silently dropped (250ms
             # window collision or in-flight resize), leaving the panel unseen so
@@ -17574,9 +17708,7 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin, CLIBillingMixin):
 
             # Play terminal bell when agent finishes (if enabled).
             # Works over SSH — the bell propagates to the user's terminal.
-            if self.bell_on_complete:
-                sys.stdout.write("\a")
-                sys.stdout.flush()
+            self._ring_bell(context="turn complete")
 
             # Notify when iteration budget was hit
             if result and not result.get("completed") and not result.get("interrupted"):
diff --git a/contributors/emails/387700378@qq.com b/contributors/emails/387700378@qq.com
new file mode 100644
index 0000000000..4b6c348909
--- /dev/null
+++ b/contributors/emails/387700378@qq.com
@@ -0,0 +1 @@
+OmniaZ1
diff --git a/contributors/emails/TEDLANHAM@GMAIL.COM b/contributors/emails/TEDLANHAM@GMAIL.COM
new file mode 100644
index 0000000000..6de0474e18
--- /dev/null
+++ b/contributors/emails/TEDLANHAM@GMAIL.COM
@@ -0,0 +1 @@
+Backroads4Me
diff --git a/contributors/emails/contact@danteschrauwen.be b/contributors/emails/contact@danteschrauwen.be
new file mode 100644
index 0000000000..905026861f
--- /dev/null
+++ b/contributors/emails/contact@danteschrauwen.be
@@ -0,0 +1,2 @@
+deinte
+# PR #101090 salvage (cron timezone-migration catch-up)
diff --git a/contributors/emails/crdesign8@hotmail.com b/contributors/emails/crdesign8@hotmail.com
new file mode 100644
index 0000000000..fffa9b3583
--- /dev/null
+++ b/contributors/emails/crdesign8@hotmail.com
@@ -0,0 +1 @@
+crdesign8
diff --git a/contributors/emails/deathxdefeat@users.noreply.github.com b/contributors/emails/deathxdefeat@users.noreply.github.com
new file mode 100644
index 0000000000..3b4c4ee0dd
--- /dev/null
+++ b/contributors/emails/deathxdefeat@users.noreply.github.com
@@ -0,0 +1 @@
+deathxdefeat
diff --git a/contributors/emails/e2e@ikbi.test b/contributors/emails/e2e@ikbi.test
new file mode 100644
index 0000000000..361be65ed9
--- /dev/null
+++ b/contributors/emails/e2e@ikbi.test
@@ -0,0 +1 @@
+RootZ3n
diff --git a/contributors/emails/glitchbunny0@proton.me b/contributors/emails/glitchbunny0@proton.me
new file mode 100644
index 0000000000..5f679947b3
--- /dev/null
+++ b/contributors/emails/glitchbunny0@proton.me
@@ -0,0 +1,2 @@
+glitchbunny0
+# PR #58957 salvage
diff --git a/contributors/emails/gobeumsu@gmail.com b/contributors/emails/gobeumsu@gmail.com
new file mode 100644
index 0000000000..f217b336bf
--- /dev/null
+++ b/contributors/emails/gobeumsu@gmail.com
@@ -0,0 +1 @@
+GoBeromsu
diff --git a/contributors/emails/harsha@usethread.io b/contributors/emails/harsha@usethread.io
new file mode 100644
index 0000000000..78f9244a8c
--- /dev/null
+++ b/contributors/emails/harsha@usethread.io
@@ -0,0 +1,2 @@
+harshmoney123
+# PR #100805 salvage
diff --git a/contributors/emails/hello@augustinbrun.com b/contributors/emails/hello@augustinbrun.com
new file mode 100644
index 0000000000..50d9be338c
--- /dev/null
+++ b/contributors/emails/hello@augustinbrun.com
@@ -0,0 +1 @@
+gustbr
diff --git a/contributors/emails/ileocorp@gmail.com b/contributors/emails/ileocorp@gmail.com
new file mode 100644
index 0000000000..844b0fa0fa
--- /dev/null
+++ b/contributors/emails/ileocorp@gmail.com
@@ -0,0 +1,2 @@
+ComicBit
+# PR #90889 cherry-pick in #94248 salvage
diff --git a/contributors/emails/itsflownium@users.noreply.github.com b/contributors/emails/itsflownium@users.noreply.github.com
new file mode 100644
index 0000000000..2c08cb46fe
--- /dev/null
+++ b/contributors/emails/itsflownium@users.noreply.github.com
@@ -0,0 +1 @@
+itsflownium
diff --git a/contributors/emails/jackal991@users.noreply.github.com b/contributors/emails/jackal991@users.noreply.github.com
new file mode 100644
index 0000000000..8eda80766a
--- /dev/null
+++ b/contributors/emails/jackal991@users.noreply.github.com
@@ -0,0 +1 @@
+Jackal991
diff --git a/contributors/emails/joel.taylor@ccmschools.edu.au b/contributors/emails/joel.taylor@ccmschools.edu.au
new file mode 100644
index 0000000000..07f5a05228
--- /dev/null
+++ b/contributors/emails/joel.taylor@ccmschools.edu.au
@@ -0,0 +1 @@
+JoelMTaylor
diff --git a/contributors/emails/kaneko@pxls.co.jp b/contributors/emails/kaneko@pxls.co.jp
new file mode 100644
index 0000000000..9a1afa1685
--- /dev/null
+++ b/contributors/emails/kaneko@pxls.co.jp
@@ -0,0 +1,2 @@
+pxls-kaneko
+# PR #95647 salvage
diff --git a/contributors/emails/kbaicai@qq.com b/contributors/emails/kbaicai@qq.com
new file mode 100644
index 0000000000..c8052461d0
--- /dev/null
+++ b/contributors/emails/kbaicai@qq.com
@@ -0,0 +1,2 @@
+ifastcc
+# PR #34308 co-author
diff --git a/contributors/emails/leocamilo@me.com b/contributors/emails/leocamilo@me.com
new file mode 100644
index 0000000000..6adc1d27f3
--- /dev/null
+++ b/contributors/emails/leocamilo@me.com
@@ -0,0 +1 @@
+leomcamilo
diff --git a/contributors/emails/mariano.nicolini@lambdaclass.com b/contributors/emails/mariano.nicolini@lambdaclass.com
new file mode 100644
index 0000000000..e0ed36846c
--- /dev/null
+++ b/contributors/emails/mariano.nicolini@lambdaclass.com
@@ -0,0 +1 @@
+entropidelic
diff --git a/contributors/emails/michaelalexanderknaap@gmail.com b/contributors/emails/michaelalexanderknaap@gmail.com
new file mode 100644
index 0000000000..47b5623e70
--- /dev/null
+++ b/contributors/emails/michaelalexanderknaap@gmail.com
@@ -0,0 +1 @@
+fortun8te
diff --git a/contributors/emails/muhammad.gcs@gmail.com b/contributors/emails/muhammad.gcs@gmail.com
new file mode 100644
index 0000000000..d4d782ab1b
--- /dev/null
+++ b/contributors/emails/muhammad.gcs@gmail.com
@@ -0,0 +1 @@
+muhifni
diff --git a/contributors/emails/nate@atxlakescapes.com b/contributors/emails/nate@atxlakescapes.com
new file mode 100644
index 0000000000..66471fd497
--- /dev/null
+++ b/contributors/emails/nate@atxlakescapes.com
@@ -0,0 +1 @@
+Lakescape
diff --git a/contributors/emails/nguyenngoctinh011258@gmail.com b/contributors/emails/nguyenngoctinh011258@gmail.com
new file mode 100644
index 0000000000..aee57ffe94
--- /dev/null
+++ b/contributors/emails/nguyenngoctinh011258@gmail.com
@@ -0,0 +1 @@
+twotnguyen
diff --git a/contributors/emails/patryk.kopycinski@elastic.co b/contributors/emails/patryk.kopycinski@elastic.co
new file mode 100644
index 0000000000..c42cf72661
--- /dev/null
+++ b/contributors/emails/patryk.kopycinski@elastic.co
@@ -0,0 +1 @@
+patrykkopycinski
diff --git a/contributors/emails/praxis1244@gmail.com b/contributors/emails/praxis1244@gmail.com
new file mode 100644
index 0000000000..9613e9a467
--- /dev/null
+++ b/contributors/emails/praxis1244@gmail.com
@@ -0,0 +1 @@
+praxis1244-consulting
diff --git a/contributors/emails/rcarratalasanchez@gmail.com b/contributors/emails/rcarratalasanchez@gmail.com
new file mode 100644
index 0000000000..6fffcb4a82
--- /dev/null
+++ b/contributors/emails/rcarratalasanchez@gmail.com
@@ -0,0 +1 @@
+rcarrata
diff --git a/contributors/emails/tky.juani@gmail.com b/contributors/emails/tky.juani@gmail.com
new file mode 100644
index 0000000000..b921c7e4ea
--- /dev/null
+++ b/contributors/emails/tky.juani@gmail.com
@@ -0,0 +1 @@
+JuaniLezcano
diff --git a/contributors/emails/umit.ediz@hotmail.com b/contributors/emails/umit.ediz@hotmail.com
new file mode 100644
index 0000000000..35cc601087
--- /dev/null
+++ b/contributors/emails/umit.ediz@hotmail.com
@@ -0,0 +1 @@
+Edizzier
diff --git a/contributors/emails/vibecoder@example.com b/contributors/emails/vibecoder@example.com
new file mode 100644
index 0000000000..c2d1000c3e
--- /dev/null
+++ b/contributors/emails/vibecoder@example.com
@@ -0,0 +1 @@
+zoser69
diff --git a/cron/jobs.py b/cron/jobs.py
index f51ff497c6..385d747619 100644
--- a/cron/jobs.py
+++ b/cron/jobs.py
@@ -1248,7 +1248,8 @@ def _classify_dispatch_lateness(lateness_seconds: float, grace_seconds: int) ->
 # ``next_run_at`` to now so the next tick re-dispatches it, exactly like the
 # operator's force-run / mech_red_guard's ``cron resume`` but built-in.
 _persisted_error_recoveries: int = 0
-_PERSISTED_ERROR_RECOVERY_HISTORY = 20
+# Bounded in-memory history kept by every probe-visible fire-path counter.
+_TELEMETRY_RECENT_HISTORY = 20
 _persisted_error_recoveries_recent: list = []
 
 
@@ -1351,26 +1352,38 @@ def _schedule_cadence_seconds(schedule: Dict[str, Any]) -> Optional[float]:
 _cron_cadence_cache: Dict[str, Optional[float]] = {}
 
 
+def _append_telemetry_record(filename: str, entry: Dict[str, Any], recent: list) -> None:
+    """Keep ``entry`` in the bounded in-memory ``recent`` list and append it to
+    ``<cron_dir>/<filename>`` (best effort — telemetry must never break a tick).
+
+    Shared by the probe-visible fire-path counters (persisted-error recovery,
+    timezone-migration catch-up); each keeps its own module-level int counter
+    because tests reset those by name.
+    """
+    recent.append(entry)
+    del recent[:-_TELEMETRY_RECENT_HISTORY]
+    try:
+        path = _current_cron_store().cron_dir / filename
+        _ensure_cron_dir(path.parent)
+        with open(path, "a", encoding="utf-8") as fh:
+            fh.write(json.dumps(entry) + "\n")
+    except Exception as exc:
+        logger.debug("Could not append %s record: %s", filename, exc)
+
+
 def _record_persisted_error_recovery(job: Dict[str, Any], previous_next_run: str) -> None:
     """Persist a countable, probe-visible signal for one stale-error re-arm."""
     global _persisted_error_recoveries
-    now = _hermes_now()
     entry = {
         "job_id": job.get("id"),
         "name": job.get("name") or job.get("id"),
         "previous_next_run_at": previous_next_run,
-        "rearmed_at": now.isoformat(),
+        "rearmed_at": _hermes_now().isoformat(),
     }
     _persisted_error_recoveries += 1
-    _persisted_error_recoveries_recent.append(entry)
-    del _persisted_error_recoveries_recent[:-_PERSISTED_ERROR_RECOVERY_HISTORY]
-    try:
-        path = _current_cron_store().cron_dir / "persisted_error_recoveries.jsonl"
-        _ensure_cron_dir(path.parent)
-        with open(path, "a", encoding="utf-8") as fh:
-            fh.write(json.dumps(entry) + "\n")
-    except Exception as exc:  # never let telemetry break a tick
-        logger.debug("Could not append persisted-error-recovery record: %s", exc)
+    _append_telemetry_record(
+        "persisted_error_recoveries.jsonl", entry, _persisted_error_recoveries_recent
+    )
 
 
 def get_persisted_error_recovery_stats() -> Dict[str, Any]:
@@ -1410,6 +1423,95 @@ def _cron_next_run_matches_expr(
         return True
 
 
+# Classification results for a due cron instant that is NOT an occurrence of
+# the job's current expression (see _classify_stale_cron_next_run).
+STALE_CRON_MATCH = "match"
+STALE_CRON_TIMEZONE_MIGRATION = "timezone_migration"
+STALE_CRON_EXPR_EDIT = "expr_edit"
+
+
+def _classify_stale_cron_next_run(
+    schedule: Dict[str, Any],
+    raw_next_run_dt: datetime,
+    next_run_dt: datetime,
+) -> str:
+    """Explain WHY a stored ``next_run_at`` misses the current cron lattice.
+
+    ``_cron_next_run_matches_expr`` answers "does the stored instant occur in
+    the current expression?" but not "why not?", and the two answers call for
+    opposite actions:
+
+    * ``expr_edit`` — a direct ``jobs.json`` edit changed ``schedule.expr``
+      while leaving ``next_run_at`` computed under the old one (#93049). The
+      stored instant is a time the current expression *excludes*, so it must
+      be re-anchored WITHOUT firing.
+    * ``timezone_migration`` — the expression never changed; only the stored
+      value's *offset representation* did. Upgrading from a UTC-scheduling
+      build to one that honours the profile timezone leaves legacy rows like
+      ``2026-09-02T04:00:00+00:00`` for ``0 4 * * *``; normalizing to
+      Europe/Brussels turns that into ``06:00+02``, which the expression
+      excludes. Treating it as a stale edit re-anchored to tomorrow and
+      silently skipped a due occurrence that had never fired.
+
+    The discriminator is whether *normalization itself* moved the wall clock.
+    Cron expressions describe local wall-clock intent, so a stored instant
+    whose OWN wall clock is a legal occurrence, and which only left the
+    lattice because ``_ensure_aware`` converted it into a different offset, is
+    a representation migration — not a schedule edit. When the offsets agree
+    (the common case, including every value this build wrote) the wall clock
+    is unchanged, so a genuine ``expr`` edit can never be misread as a
+    migration.
+    """
+    if _cron_next_run_matches_expr(schedule, next_run_dt):
+        return STALE_CRON_MATCH
+    wall_clock_shifted = (
+        raw_next_run_dt.replace(tzinfo=None) != next_run_dt.replace(tzinfo=None)
+    )
+    if wall_clock_shifted and _cron_next_run_matches_expr(schedule, raw_next_run_dt):
+        return STALE_CRON_TIMEZONE_MIGRATION
+    return STALE_CRON_EXPR_EDIT
+
+
+# Durable, probe-visible counter for offset-representation migrations caught
+# on the fire path. Kept separate from `catch_up_occurrences` (runs skipped
+# past their grace window — a migrated row that is ALSO past grace increments
+# both) because this one means "an upgrade rewrote how next_run_at is
+# represented" — an operator seeing it climb after a deploy is seeing the
+# migration drain, and seeing it climb steadily afterwards is seeing a
+# timezone that keeps changing under the store.
+_timezone_migration_catchups: int = 0
+_timezone_migration_catchups_recent: list = []
+
+
+def _record_timezone_migration_catchup(
+    job: Dict[str, Any],
+    raw_next_run_dt: datetime,
+    next_run_dt: datetime,
+) -> None:
+    """Persist a countable signal for one offset-migration catch-up fire."""
+    global _timezone_migration_catchups
+    entry = {
+        "job_id": job.get("id"),
+        "name": job.get("name") or job.get("id"),
+        "expr": (job.get("schedule") or {}).get("expr"),
+        "stored_next_run_at": raw_next_run_dt.isoformat(),
+        "normalized_next_run_at": next_run_dt.isoformat(),
+        "fired_at": _hermes_now().isoformat(),
+    }
+    _timezone_migration_catchups += 1
+    _append_telemetry_record(
+        "timezone_migration_catchups.jsonl", entry, _timezone_migration_catchups_recent
+    )
+
+
+def get_timezone_migration_catchup_stats() -> Dict[str, Any]:
+    """Probe-visible snapshot of offset-migration catch-up fires."""
+    return {
+        "timezone_migration_catchups": _timezone_migration_catchups,
+        "recent": list(_timezone_migration_catchups_recent),
+    }
+
+
 def compute_next_run(schedule: Dict[str, Any], last_run_at: Optional[str] = None) -> Optional[str]:
     """
     Compute the next run time for a schedule.
@@ -2248,6 +2350,7 @@ def create_job(
     monitor_script: Optional[str] = None,
     monitor_url: Optional[str] = None,
     reasoning_effort: Optional[str] = None,
+    failure_deliver: Optional[str] = None,
 ) -> Dict[str, Any]:
     """
     Create a new cron job.
@@ -2350,6 +2453,18 @@ def create_job(
     normalized_no_agent = bool(no_agent)
     normalized_attach = attach_to_session if isinstance(attach_to_session, bool) else None
     normalized_reasoning_effort = _normalize_reasoning_effort(reasoning_effort)
+    # failure_deliver shares deliver's value grammar; the str/list
+    # flatten below mirrors the tool layer's _normalize_deliver_param for
+    # direct create_job callers (the tool pre-normalizes). Semantic
+    # validation happens at resolution time via the shared deliver path.
+    normalized_failure_deliver = (
+        str(failure_deliver).strip() if isinstance(failure_deliver, str) else None
+    )
+    if isinstance(failure_deliver, (list, tuple)):
+        normalized_failure_deliver = ",".join(
+            str(p).strip() for p in failure_deliver if str(p).strip()
+        )
+    normalized_failure_deliver = normalized_failure_deliver or None
     normalized_monitor_script = str(monitor_script).strip() if isinstance(monitor_script, str) else None
     normalized_monitor_script = normalized_monitor_script or None
     normalized_monitor_url = str(monitor_url).strip() if isinstance(monitor_url, str) else None
@@ -2450,6 +2565,9 @@ def create_job(
         "last_status": None,
         "last_error": None,
         "last_delivery_error": None,
+        # Live-adapter targets whose last send was acked with no message_id /
+        # raw_response (accepted, but UNVERIFIED — surfaced by cron list/doctor).
+        "last_delivery_unverified": None,
         "failure_streak": 0,
         # Delivery configuration
         "deliver": deliver,
@@ -2466,6 +2584,10 @@ def create_job(
     # absent key = job follows config resolution (pre-feature behavior).
     if normalized_reasoning_effort is not None:
         job["reasoning_effort"] = normalized_reasoning_effort
+    # Conditional-persist for failure_deliver too: absent key = failures
+    # follow deliver, byte-identical to pre-feature jobs (NS-788).
+    if normalized_failure_deliver is not None:
+        job["failure_deliver"] = normalized_failure_deliver
 
     with _jobs_lock():
         jobs = load_jobs()
@@ -3033,7 +3155,13 @@ def _mark_job_run_locked(
     ``delivery_error`` is tracked separately from the agent error — a job
     can succeed (agent produced output) but fail delivery (platform down).
 
-    ``status`` overrides the derived ``last_status`` ("ok"/"error") with a
+    A run that succeeded but failed delivery records
+    ``last_status = "delivery_failed"`` (never "ok") so the failure is
+    visible to every reader, while ``failure_streak`` stays untouched —
+    the agent did its job.
+
+    ``status`` overrides the derived ``last_status`` ("ok"/"error"/
+    "delivery_failed") with a
     specific terminal status for this run — e.g. ``"blocked_config"`` when
     the pre-dispatch configuration validation refused to run the agent
     (T1-26), so `cronjob list` distinguishes "your config is broken" from
@@ -3058,7 +3186,21 @@ def _mark_job_run_locked(
                 # The transient manual-run context is single-fire: whatever
                 # run just completed consumed it (or superseded it).
                 job.pop("manual_run_prompt", None)
-                job["last_status"] = status or ("ok" if success else "error")
+                # A run whose agent succeeded but whose delivery failed is NOT
+                # "ok": recording it as such hid last_delivery_error behind a
+                # green status in `cron list`/the UI and made a job that never
+                # reached the user look like a quiet success (#83993). It gets
+                # its own status so every reader that keys off "ok" (CLI list,
+                # doctor, cronjob_tools) sees the failure. An explicit
+                # ``status`` override (e.g. "blocked_config") still wins.
+                if status:
+                    job["last_status"] = status
+                elif not success:
+                    job["last_status"] = "error"
+                elif isinstance(delivery_error, str) and delivery_error.strip():
+                    job["last_status"] = "delivery_failed"
+                else:
+                    job["last_status"] = "ok"
                 job["last_error"] = error if not success else None
                 # A healthy run means the configuration validates again — drop
                 # the preflight alert-dedup marker so a FUTURE config break
@@ -4023,9 +4165,18 @@ def _get_due_jobs_locked() -> List[Dict[str, Any]]:
                 # so re-anchor before either can fire. Recomputation uses the
                 # current expression, so this converges — it cannot defer
                 # forever.
-                if not manual_run and kind == "cron" and not _cron_next_run_matches_expr(
-                    schedule, next_run_dt
-                ):
+                #
+                # Not every mismatch is an edit, though: an offset-representation
+                # migration (UTC-scheduling build -> profile-timezone build)
+                # moves a legacy instant off the lattice without the expression
+                # ever changing, and re-anchoring THAT silently swallowed a due
+                # occurrence. Classify first, and only the edit case skips.
+                stale_class = (
+                    _classify_stale_cron_next_run(schedule, raw_next_run_dt, next_run_dt)
+                    if not manual_run and kind == "cron"
+                    else STALE_CRON_MATCH
+                )
+                if stale_class == STALE_CRON_EXPR_EDIT:
                     new_next = compute_next_run(schedule, now.isoformat())
                     logger.info(
                         "Job '%s' next_run_at %s does not match its current "
@@ -4043,6 +4194,27 @@ def _get_due_jobs_locked() -> List[Dict[str, Any]]:
                                 needs_save = True
                                 break
                     continue
+                if stale_class == STALE_CRON_TIMEZONE_MIGRATION:
+                    # Fall through to the normal due path: the occurrence is
+                    # real and overdue, so it fires ONCE here and the usual
+                    # advance/mark_job_run re-anchor writes the value back in
+                    # the current offset. At-most-once is preserved because
+                    # nothing re-reads the legacy instant after that.
+                    logger.warning(
+                        "cron.timezone_migration.catch_up job='%s' id=%s expr=%r "
+                        "stored=%s normalized=%s — stored next_run_at carries a "
+                        "pre-migration UTC offset (%s, now %s) and is a legal "
+                        "occurrence at its own wall clock; firing the due run "
+                        "instead of re-anchoring past it.",
+                        job.get("name", job.get("id", "?")),
+                        job.get("id"),
+                        schedule.get("expr"),
+                        next_run,
+                        next_run_dt.isoformat(),
+                        raw_next_run_dt.utcoffset(),
+                        now.utcoffset(),
+                    )
+                    _record_timezone_migration_catchup(job, raw_next_run_dt, next_run_dt)
 
                 # For recurring jobs, check if the scheduled time is stale
                 # (gateway was down and missed the window). Fast-forward to
diff --git a/cron/notepad.py b/cron/notepad.py
index 339e9a8823..450b951661 100644
--- a/cron/notepad.py
+++ b/cron/notepad.py
@@ -26,23 +26,34 @@ from __future__ import annotations
 import sqlite3
 import threading
 from contextlib import contextmanager
+from pathlib import Path
 from typing import Any, Dict, Iterator, List, Optional
 
 from hermes_constants import get_hermes_home
 from hermes_time import now as _hermes_now
 
-NOTEPAD_FILE = get_hermes_home().resolve() / "cron" / "notepad.db"
+# Optional test override. Production resolves the path at transaction time so
+# multiplexed profile ticks (set_hermes_home_override) cannot leak one
+# profile's notepad rows into the import-time home — and remove_job's
+# clear_notepad cannot wipe the wrong profile's DB (#86519). Same pattern as
+# cron/executions.py.
+NOTEPAD_FILE: Optional[Path] = None
 MAX_VALUE_BYTES = 16 * 1024
 MAX_KEY_CHARS = 128
 MAX_JOB_TOTAL_BYTES = 64 * 1024
 _lock = threading.RLock()
 
 
+def _current_notepad_file() -> Path:
+    return NOTEPAD_FILE or (get_hermes_home().resolve() / "cron" / "notepad.db")
+
+
 def _connect() -> sqlite3.Connection:
     from cron.jobs import _ensure_cron_dir
 
-    _ensure_cron_dir(NOTEPAD_FILE.parent)
-    return sqlite3.connect(NOTEPAD_FILE, timeout=5)
+    path = _current_notepad_file()
+    _ensure_cron_dir(path.parent)
+    return sqlite3.connect(path, timeout=5)
 
 
 def _initialize_schema(conn: sqlite3.Connection) -> None:
@@ -157,7 +168,7 @@ def clear_notepad(job_id: str) -> int:
     Called from ``cron.jobs.remove_job`` so deleted jobs don't orphan their
     rows. No-ops without creating the DB when no notepad file exists yet.
     """
-    if not NOTEPAD_FILE.exists():
+    if not _current_notepad_file().exists():
         return 0
     with _transaction() as conn:
         cur = conn.execute(
diff --git a/cron/scheduler.py b/cron/scheduler.py
index d7f74126f5..ba2d0bde4b 100644
--- a/cron/scheduler.py
+++ b/cron/scheduler.py
@@ -2838,7 +2838,20 @@ def _expand_routing_tokens(part: str) -> List[str]:
     return expanded
 
 
-def _resolve_delivery_targets(job: dict) -> List[dict]:
+def _delivery_lane_value(job: dict, *, for_failure: bool = False):
+    """Raw deliver-lane value for a run outcome: the failure lane when
+    ``for_failure`` and the job overrides it, else ``deliver``. Keeps
+    delivery bookkeeping (outcome classification, unresolved-origin,
+    incident 'alerted' marking) reading the SAME lane the notice was
+    actually routed through (NS-788 review finding B1)."""
+    if for_failure:
+        failure_deliver = job.get("failure_deliver")
+        if failure_deliver is not None and str(failure_deliver).strip():
+            return failure_deliver
+    return job.get("deliver", "local")
+
+
+def _resolve_delivery_targets(job: dict, *, for_failure: bool = False) -> List[dict]:
     """Resolve all concrete auto-delivery targets for a cron job.
 
     Accepts the legacy comma-separated ``deliver`` string plus the
@@ -2847,8 +2860,17 @@ def _resolve_delivery_targets(job: dict) -> List[dict]:
     targets: ``origin,all`` and ``all,telegram:-100:17`` both work.
     Duplicate (platform, chat_id, thread_id) tuples are collapsed by the
     existing dedup pass.
+
+    ``for_failure=True`` resolves failure-category engine notices
+    (failure summaries, interrupted-run notices, drift/preflight
+    alerts): when the job carries a ``failure_deliver`` value, targets
+    resolve from it INSTEAD of ``deliver`` — ``failure_deliver: local``
+    is the structural opt-out for shared channels (NS-788, Coatue).
+    Absent ``failure_deliver``, failure delivery follows ``deliver``
+    exactly as before.
     """
-    deliver = _normalize_deliver_value(job.get("deliver", "local"))
+    deliver_raw = _delivery_lane_value(job, for_failure=for_failure)
+    deliver = _normalize_deliver_value(deliver_raw)
     if deliver == "local":
         return []
 
@@ -2984,7 +3006,7 @@ def _send_media_via_adapter(
     return errors
 
 
-def _confirm_adapter_delivery(send_result) -> bool:
+def _confirm_adapter_delivery(send_result, job_id: str = "?", unverified: Optional[list] = None) -> bool:
     """Return True only if ``send_result`` unambiguously confirms delivery.
 
     A live adapter that returns ``None`` (e.g. a swallowed exception, a busy
@@ -2993,16 +3015,54 @@ def _confirm_adapter_delivery(send_result) -> bool:
     scheduler to log ``"delivered to <chat> via live adapter"`` while the
     gateway never actually sees the message (#47056).
 
-    Likewise, an object missing a ``success`` attribute (e.g. a bare ``dict``
-    or a partial mock) is a contract violation: it does not actually tell us
-    whether the send succeeded.  Require an explicit, truthy ``success``
-    attribute to count as confirmed.
+    Likewise, a result carrying no ``success`` at all (a partial mock, or a
+    ``dict`` from a code path that never reached the adapter) is a contract
+    violation: it does not actually tell us whether the send succeeded.
+    Require an explicit, truthy ``success`` to count as confirmed.
+
+    Both shapes are inspected the same way, because ``_deliver_to_platform``
+    returns either a ``SendResult`` object or a plain ``dict``:
+
+    * ``delivered is False`` is a REJECTION even when ``success`` is truthy.
+      The silence-narration filter returns
+      ``{"success": True, "delivered": False}`` — a successfully *dropped*
+      message, not a delivered one.  Reading only ``success`` there is how a
+      cron brief was logged as delivered while the user got nothing (#77763).
+    * No ``message_id`` and no ``raw_response`` means we have no positive
+      evidence of a send.  That is not proof of failure either (some adapters
+      legitimately return a bare success), so it is still accepted — but
+      logged at WARNING so an UNVERIFIED delivery is visible in the log
+      instead of masquerading as a confirmed one.  Telegram ``SendResult``
+      objects carry ``message_id``; the dict-filter shape does not.
     """
     if send_result is None:
         return False
-    if not hasattr(send_result, "success"):
+    if isinstance(send_result, dict):
+        if "success" not in send_result:
+            return False
+        success = bool(send_result.get("success"))
+        delivered = send_result.get("delivered")
+        message_id = send_result.get("message_id")
+        raw_response = send_result.get("raw_response")
+    else:
+        if not hasattr(send_result, "success"):
+            return False
+        success = bool(getattr(send_result, "success"))
+        delivered = getattr(send_result, "delivered", None)
+        message_id = getattr(send_result, "message_id", None)
+        raw_response = getattr(send_result, "raw_response", None)
+    if not success or delivered is False:
         return False
-    return bool(getattr(send_result, "success"))
+    if message_id is None and not raw_response:
+        logger.warning(
+            "Job '%s': live adapter reported success with no delivery evidence "
+            "(no message_id, no raw_response) — treating as delivered but "
+            "UNVERIFIED",
+            job_id,
+        )
+        if unverified is not None:
+            unverified.append(True)
+    return True
 
 
 def _is_channel_dm_topic(
@@ -3061,7 +3121,51 @@ def _is_channel_dm_topic(
     return is_channel
 
 
-def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Optional[str]:
+def _cron_delivery_notify_enabled(cfg: Optional[dict]) -> bool:
+    """Resolve ``cron.delivery.notify`` (config.yaml). Default True.
+
+    Only an explicit boolean ``False`` (or a YAML ``false``/``off`` that parses
+    to it) disables the push notification; a missing/malformed section keeps
+    the default so a typo can never silently make cron briefs silent.
+    """
+    try:
+        cron_cfg = (cfg or {}).get("cron")
+        if not isinstance(cron_cfg, dict):
+            return True
+        delivery_cfg = cron_cfg.get("delivery")
+        if not isinstance(delivery_cfg, dict):
+            return True
+        return delivery_cfg.get("notify", True) is not False
+    except Exception:
+        return True
+
+
+def _record_delivery_verification(job: dict, unverified_targets: list) -> None:
+    """Persist the UNVERIFIED-delivery marker on the job record.
+
+    ``last_delivery_unverified`` is a list of ``platform:chat_id`` targets
+    whose live adapter acked the send with no message_id/raw_response, or
+    ``None`` once a run delivered with positive evidence (or to no live
+    target). Skips the write when nothing changed so the common verified
+    path costs no jobs.json save. Never raises — status bookkeeping must not
+    fail a delivery.
+    """
+    new_value = list(unverified_targets) or None
+    if (job.get("last_delivery_unverified") or None) == new_value:
+        return
+    try:
+        from cron.jobs import update_job
+
+        update_job(job["id"], {"last_delivery_unverified": new_value})
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.debug(
+            "Job '%s': could not record delivery verification: %s", job.get("id"), exc,
+        )
+
+
+def _deliver_result(
+    job: dict, content: str, adapters=None, loop=None, *, for_failure: bool = False
+) -> Optional[str]:
     """
     Deliver job output to the configured target(s) (origin chat, specific platform, etc.).
 
@@ -3070,11 +3174,16 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
     the standalone HTTP path cannot encrypt.  Falls back to standalone send if
     the adapter path fails or is unavailable.
 
+    ``for_failure=True`` routes failure-category engine notices through the
+    job's ``failure_deliver`` override when present (NS-788).
+
     Returns None on success, or an error string on failure.
     """
-    targets = _resolve_delivery_targets(job)
+    targets = _resolve_delivery_targets(job, for_failure=for_failure)
     if not targets:
-        deliver_value = _normalize_deliver_value(job.get("deliver", "local"))
+        deliver_value = _normalize_deliver_value(
+            _delivery_lane_value(job, for_failure=for_failure)
+        )
         if deliver_value == "local":
             return None  # local-only jobs don't deliver — not a failure
         # deliver=origin with no resolvable origin and no configured home
@@ -3108,6 +3217,18 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
     except Exception:
         pass
 
+    # cron.delivery.notify (default True): mark live-adapter cron sends as
+    # FINAL notifications so the platform pushes them (Telegram's "important"
+    # mode otherwise sends with disable_notification=True). Configurable so
+    # operators who prefer silent briefs can opt back out.
+    notify_delivery = _cron_delivery_notify_enabled(user_cfg)
+    # Set when a live adapter acked a send with NO delivery evidence (no
+    # message_id / raw_response — the Slack/Matrix/Mattermost bare
+    # SendResult(success=True) shape). Persisted on the job as
+    # ``last_delivery_unverified`` so `hermes cron list` shows the state
+    # instead of it living only in a WARNING log line.
+    unverified_targets: list = []
+
     if wrap_response:
         task_name = job.get("name", job["id"])
         job_id = job.get("id", "")
@@ -3261,7 +3382,14 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
 
         from gateway.delivery import resolve_delivery_transport
 
-        transport = resolve_delivery_transport(platform, config, adapters)
+        target_adapters = adapters
+        if isinstance(adapters, SharedRouteAdapters):
+            # Credentialless satellite: the primary adapter is a valid
+            # transport for THIS target only when an exact primary route maps
+            # it to this profile (#101113). Miss → fail closed below.
+            shared = adapters.get(platform, target)
+            target_adapters = {platform: shared} if shared is not None else {}
+        transport = resolve_delivery_transport(platform, config, target_adapters)
         if transport is not None:
             pconfig = transport.config
             runtime_adapter = transport.adapter
@@ -3483,10 +3611,14 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                 route_metadata = {
                     "direct_messages_topic_id": str(thread_id),
                     "job_id": job["id"],
+                    "notify": notify_delivery,
                 }
                 # Media metadata mirrors the text routing so attachments land in
                 # the same DM topic instead of the General lane (#22773).
-                media_metadata = {"direct_messages_topic_id": str(thread_id)}
+                media_metadata = {
+                    "direct_messages_topic_id": str(thread_id),
+                    "notify": notify_delivery,
+                }
             else:
                 # Forum-style topic (private chat / supergroup) or non-topic
                 # target: route via message_thread_id (#52060).  Put thread_id in
@@ -3497,10 +3629,12 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                 # anchor, so the metadata key bypasses that check and lets the
                 # adapter route via a plain message_thread_id.
                 route_thread_id = str(thread_id) if thread_id is not None else None
-                route_metadata = {"job_id": job["id"]}
+                route_metadata = {"job_id": job["id"], "notify": notify_delivery}
                 if route_thread_id:
                     route_metadata["thread_id"] = route_thread_id
-                media_metadata = {"thread_id": thread_id} if thread_id else None
+                media_metadata = {"notify": notify_delivery}
+                if thread_id:
+                    media_metadata["thread_id"] = thread_id
 
             # Relay egress needs a tenant discriminator on the frame: the
             # connector's fail-closed guard resolves the workspace/guild from
@@ -3530,10 +3664,23 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                 adapter_ok = True
                 timed_out = False
                 delivered_message_id = None
-                if text_to_send:
+                if not text_to_send and not media_files:
+                    # Nothing to hand the adapter at all.  This used to fall
+                    # straight through to the `if adapter_ok:` branch below and
+                    # log "delivered to <chat> via live adapter" for a send that
+                    # never happened (#77763).  Fail closed so the run reports
+                    # the empty payload instead.
+                    msg = (
+                        f"live adapter send skipped (empty text and no media) "
+                        f"for {platform_name}:{chat_id}"
+                    )
+                    logger.warning("Job '%s': %s", job["id"], msg)
+                    target_errors.append(msg)
+                    adapter_ok = False
+                elif text_to_send:
                     from agent.async_utils import safe_schedule_threadsafe
 
-                    router = DeliveryRouter(config, adapters)
+                    router = DeliveryRouter(config, target_adapters)
                     route_target = DeliveryTarget(
                         platform=platform,
                         chat_id=str(chat_id),
@@ -3623,19 +3770,32 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                             # {"success": True, "delivered": False, ...}.
                             # Normalize both shapes so a getattr default doesn't
                             # misread a dict, and so a None / success-less object
-                            # is NOT counted as delivered (#47056).
+                            # is NOT counted as delivered (#47056).  The
+                            # confirmation itself handles both shapes: a truthy
+                            # `success` with `delivered: False` is a drop, not a
+                            # delivery (#77763).
                             if isinstance(send_result, dict):
-                                send_success = bool(send_result.get("success", False))
                                 send_raw_response = send_result.get("raw_response")
                                 delivered_message_id = send_result.get("message_id")
                             else:
-                                send_success = _confirm_adapter_delivery(send_result)
                                 send_raw_response = getattr(send_result, "raw_response", None)
                                 delivered_message_id = getattr(send_result, "message_id", None)
+                            _evidence_gap: list = []
+                            send_success = _confirm_adapter_delivery(
+                                send_result, job["id"], _evidence_gap,
+                            )
+                            if send_success and _evidence_gap:
+                                unverified_targets.append(f"{platform_name}:{chat_id}")
 
                             if not send_success:
                                 if isinstance(send_result, dict):
-                                    err = send_result.get("error", "unknown")
+                                    # A filtered drop carries no "error" — name
+                                    # the filter instead of reporting "unknown".
+                                    err = (
+                                        send_result.get("error")
+                                        or send_result.get("filtered")
+                                        or "unknown"
+                                    )
                                     shape = "dict"
                                 elif send_result is not None:
                                     err = getattr(send_result, "error", None)
@@ -3712,7 +3872,16 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                     delivery_errors.append(msg)
 
                 if adapter_ok:
-                    logger.info("Job '%s': delivered to %s:%s via live adapter", job["id"], platform_name, chat_id)
+                    # Log WHERE it went, not just that it went: a ghost delivery
+                    # that landed in the wrong lane (General topic instead of the
+                    # routed thread) is indistinguishable from a real one without
+                    # the routing identity (#77763).
+                    logger.info(
+                        "Job '%s': delivered to %s:%s via live adapter thread=%s message_id=%s",
+                        job["id"], platform_name, chat_id,
+                        route_thread_id if route_thread_id is not None else "-",
+                        delivered_message_id if delivered_message_id is not None else "-",
+                    )
                     delivered = True
                     # Seed the thread session only now that delivery into it
                     # succeeded (deferred from thread-open above).
@@ -3826,6 +3995,22 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                 target_errors.append(msg)
                 delivery_errors.extend(target_errors)
                 continue
+            # The live lane already failed closed on an empty payload; the
+            # standalone senders do not. The Telegram adapter returns
+            # SendResult(success=True) for empty content WITHOUT an API call,
+            # so falling through here turns a phantom live delivery into a
+            # phantom standalone one and logs it as delivered (#77763). Both
+            # _send_to_platform call sites below are reached through this
+            # point, so one guard closes the lane.
+            if not cleaned_delivery_content.strip() and not media_files:
+                msg = (
+                    f"standalone send skipped (empty text and no media) "
+                    f"for {platform_name}:{chat_id}"
+                )
+                logger.warning("Job '%s': %s", job["id"], msg)
+                target_errors.append(msg)
+                delivery_errors.extend(target_errors)
+                continue
             # Standalone path: run the async send in a fresh event loop (safe from any thread)
             coro = _send_to_platform(platform, pconfig, chat_id, cleaned_delivery_content, thread_id=thread_id, media_files=media_files)
             try:
@@ -3856,7 +4041,19 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
                 try:
                     pool = concurrent.futures.ThreadPoolExecutor(max_workers=1)
                     try:
-                        future = pool.submit(asyncio.run, _send_to_platform(platform, pconfig, chat_id, cleaned_delivery_content, thread_id=thread_id, media_files=media_files))
+                        # The fallback worker is a fresh thread: it does NOT
+                        # inherit the multiplexed profile ContextVars (home
+                        # override + secret scope). Run inside a copy of the
+                        # active context so the standalone sender reads THIS
+                        # profile's bot token, not the process default's
+                        # (#100489) — same pattern as the session-db and
+                        # heartbeat workers in this module.
+                        _fallback_context = contextvars.copy_context()
+                        future = pool.submit(
+                            _fallback_context.run,
+                            asyncio.run,
+                            _send_to_platform(platform, pconfig, chat_id, cleaned_delivery_content, thread_id=thread_id, media_files=media_files),
+                        )
                         result = future.result(timeout=30)
                     finally:
                         pool.shutdown(wait=False)
@@ -3915,6 +4112,7 @@ def _deliver_result(job: dict, content: str, adapters=None, loop=None) -> Option
     if policy_drop_errors:
         # Filter-time drops apply to every target; report them once.
         delivery_errors.extend(policy_drop_errors)
+    _record_delivery_verification(job, unverified_targets)
     if delivery_errors:
         return "; ".join(delivery_errors)
     return None
@@ -5141,21 +5339,20 @@ def _preflight_check_provider_key(job: dict, cfg: dict) -> Optional[str]:
     return None
 
 
-def _delivery_platform_routed_from_primary_gateway(platform_name: str) -> bool:
-    """True when the primary gateway routes this platform to the profile the
-    scheduler is currently serving.
+def _primary_profile_routes_for_current_home() -> list:
+    """Primary gateway ``profile_routes`` that target the profile currently
+    being served, or ``[]`` (also when this IS the primary home).
 
     Under ``gateway.multiplex_profiles`` a satellite profile's cron jobs are
     ticked by the primary gateway's in-process ticker (#69377) and delivered
     through the primary gateway's live adapters — the satellite home never
     holds the platform credentials itself (giving it a token of its own is a
-    ``duplicate_credential`` fatal). ``_preflight_check_delivery`` loads the
-    gateway config of the job's OWN home, where such a platform correctly
-    reads as unconnected; consulting the primary home's ``profile_routes``
-    keeps routed satellite jobs from being permanently false-blocked (#97476).
-    Reads the primary config.yaml directly (both the top-level and nested
-    ``gateway.`` forms) instead of ``load_gateway_config()`` so no primary
-    platform config leaks into this process's environment.
+    ``duplicate_credential`` fatal). Reads the primary config.yaml directly
+    (both the top-level and nested ``gateway.`` forms) instead of
+    ``load_gateway_config()`` so no primary platform config leaks into this
+    process's environment. Shared by the preflight rescue (#97476) and the
+    delivery-time shared-transport resolver (#101113) so route semantics
+    cannot drift between the two halves.
     """
     try:
         from hermes_constants import get_default_hermes_root, get_hermes_home
@@ -5166,10 +5363,10 @@ def _delivery_platform_routed_from_primary_gateway(platform_name: str) -> bool:
             primary_home.expanduser().resolve(strict=False)
             == current_home.expanduser().resolve(strict=False)
         ):
-            return False  # this IS the primary home — nothing to consult
+            return []  # this IS the primary home — nothing to consult
         config_path = primary_home.expanduser() / "config.yaml"
         if not config_path.exists():
-            return False
+            return []
 
         import yaml
 
@@ -5179,25 +5376,75 @@ def _delivery_platform_routed_from_primary_gateway(platform_name: str) -> bool:
         if routes_raw is None and isinstance(raw.get("gateway"), dict):
             routes_raw = raw["gateway"].get("profile_routes")
         if not isinstance(routes_raw, list):
-            return False
+            return []
 
         from gateway.profile_routing import parse_profile_routes
         from hermes_cli.profiles import profile_matches_home
 
-        platform_key = platform_name.lower()
-        for route in parse_profile_routes(routes_raw):
-            if (
-                route.enabled
-                and str(route.platform).lower() == platform_key
-                and profile_matches_home(route.profile)
-            ):
-                return True
-        return False
+        return [
+            route
+            for route in parse_profile_routes(routes_raw)
+            if route.enabled and profile_matches_home(route.profile)
+        ]
     except Exception:
         logger.debug(
-            "preflight: primary-gateway profile-route lookup unavailable",
+            "primary-gateway profile-route lookup unavailable",
             exc_info=True,
         )
+        return []
+
+
+def _delivery_platform_routed_from_primary_gateway(platform_name: str) -> bool:
+    """True when the primary gateway routes this platform to the profile the
+    scheduler is currently serving (preflight rescue, #97476)."""
+    platform_key = platform_name.lower()
+    return any(
+        str(route.platform).lower() == platform_key
+        for route in _primary_profile_routes_for_current_home()
+    )
+
+
+class SharedRouteAdapters:
+    """Read-only adapter map for a credentialless satellite profile (#101113).
+
+    A satellite under ``gateway.profile_routes`` owns no bot credential and so
+    has no adapter map of its own; its inbound traffic arrives on the PRIMARY
+    adapter and is routed to it by an exact route. Its cron output must go
+    back out the same transport — but ONLY for targets an enabled primary
+    route maps to this profile. ``get(platform, target)`` resolves the primary
+    adapter iff the route matcher used by inbound routing
+    (``ProfileRoute.matches``) accepts the target's ``chat_id``/``thread_id``;
+    every other lookup is a miss, so an unmatched target, a disabled route, or
+    a route naming another profile still fails closed (never the default bot).
+    A plain ``get(platform)`` (no target) is always a miss: routing is
+    per-target, not per-platform.
+    """
+
+    def __init__(self, primary_adapters, routes) -> None:
+        self._primary = dict(primary_adapters or {})
+        self._routes = list(routes or [])
+
+    def __bool__(self) -> bool:
+        return bool(self._primary) and bool(self._routes)
+
+    def get(self, platform, target=None, default=None):
+        if not target:
+            return default
+        adapter = self._primary.get(platform)
+        if adapter is None:
+            return default
+        platform_key = str(getattr(platform, "value", platform)).lower()
+        chat_id = str(target.get("chat_id") or "") or None
+        thread_id = target.get("thread_id")
+        thread_id = str(thread_id) if thread_id else None
+        for route in self._routes:
+            if str(route.platform).lower() != platform_key:
+                continue
+            if not (route.chat_id or route.thread_id):
+                continue  # guild-only routes are not target-exact
+            if route.matches(str(route.platform), chat_id=chat_id, thread_id=thread_id):
+                return adapter
+        return default
         return False
 
 
@@ -5212,19 +5459,30 @@ def _preflight_check_delivery(job: dict) -> Optional[str]:
     the same source `cron_delivery_targets` uses). Gateway-config load
     failures fail OPEN so a transient config hiccup never wedges delivery
     that would have worked.
+
+    ``failure_deliver`` is checked with the same rules: a typo'd failure
+    platform would otherwise only surface when a failure occurs — exactly
+    when the notice must not be lost (NS-788 follow-up).
     """
     deliver_value = _normalize_deliver_value(job.get("deliver", "local"))
+    failure_deliver_value = _normalize_deliver_value(
+        _delivery_lane_value(job, for_failure=True)
+    )
+    lane_values = [deliver_value]
+    if failure_deliver_value != deliver_value:
+        lane_values.append(failure_deliver_value)
     platform_parts: list[str] = []
-    for part in deliver_value.split(","):
-        part = part.strip()
-        if not part or part.lower() in {"local", "origin", "all"}:
-            continue
-        # bot-chat targets need no gateway credentials — they deliver via a
-        # local chat subprocess. Unknown-profile failures surface per run in
-        # last_delivery_error (and are validated at create time).
-        if parse_bot_chat_deliver_token(part) is not None:
-            continue
-        platform_parts.append(part.split(":", 1)[0].strip())
+    for lane_value in lane_values:
+        for part in lane_value.split(","):
+            part = part.strip()
+            if not part or part.lower() in {"local", "origin", "all"}:
+                continue
+            # bot-chat targets need no gateway credentials — they deliver via a
+            # local chat subprocess. Unknown-profile failures surface per run in
+            # last_delivery_error (and are validated at create time).
+            if parse_bot_chat_deliver_token(part) is not None:
+                continue
+            platform_parts.append(part.split(":", 1)[0].strip())
     if not platform_parts:
         return None
 
@@ -7244,6 +7502,22 @@ def _run_one_job_body(
         _scope_token = set_secret_scope(
             build_profile_secret_scope(_get_hermes_home())
         )
+        # Same isolation for terminal settings (third profile seam; see
+        # gateway/run.py _profile_runtime_scope): installs the firing
+        # profile's COMPLETE terminal policy for this fire — run, delivery,
+        # and bookkeeping — resetting in this function's finally alongside
+        # the secret scope. Without it the ticker thread reads the
+        # process-global TERMINAL_* env vars a concurrent profile's turn may
+        # have pinned (#68559). Resolution failure installs a refusal scope:
+        # terminal execution inside the fire raises instead of falling back
+        # to the launch process's ambient policy.
+        from tools.terminal_scope import (
+            install_profile_terminal_scope,
+        )
+
+        _terminal_scope_token = install_profile_terminal_scope(
+            _get_hermes_home()
+        )
         # Defer the cron agent's async-resource teardown until AFTER delivery.
         # run_job normally closes the agent (and reaps stale async clients) in
         # its finally block; doing that before _deliver_result runs means the
@@ -7442,8 +7716,9 @@ def _run_one_job_body(
 
             if should_deliver:
                 unresolved_origin = (
-                    _normalize_deliver_value(job.get("deliver", "local")) == "origin"
-                    and not _resolve_delivery_targets(job)
+                    _normalize_deliver_value(_delivery_lane_value(job, for_failure=not success))
+                    == "origin"
+                    and not _resolve_delivery_targets(job, for_failure=not success)
                 )
                 try:
                     with _side_effect_fence() as owns_delivery:
@@ -7455,6 +7730,10 @@ def _run_one_job_body(
                             deliver_content,
                             adapters=adapters,
                             loop=loop,
+                            # Failure summaries (and drift/blocked-config alerts
+                            # composed into deliver_content on the failure path)
+                            # honor the job's failure_deliver override (NS-788).
+                            for_failure=not success,
                         )
                 except Exception as de:
                     if isinstance(de, _FireClaimLostDuringSideEffect):
@@ -7542,7 +7821,9 @@ def _run_one_job_body(
                 error="Fire claim ownership lost before terminal completion.",
             )
             return True
-        normalized_deliver = _normalize_deliver_value(job.get("deliver", "local"))
+        normalized_deliver = _normalize_deliver_value(
+            _delivery_lane_value(job, for_failure=not success)
+        )
         if delivery_error:
             delivery_outcome = "failed"
         elif should_deliver and unresolved_origin:
@@ -7599,7 +7880,7 @@ def _run_one_job_body(
             and not _fire_claim_ownership_lost()
         ):
             normalized_deliver = _normalize_deliver_value(
-                job.get("deliver", "local")
+                _delivery_lane_value(job, for_failure=True)
             )
             unresolved_origin = False
             # Durable failure incident: same ack gate as the normal failure
@@ -7625,6 +7906,7 @@ def _run_one_job_body(
                         + _failure_streak_nudge(job),
                         adapters=adapters,
                         loop=loop,
+                        for_failure=True,
                     )
                 except Exception as delivery_exc:
                     delivery_error = str(delivery_exc)
@@ -7632,7 +7914,9 @@ def _run_one_job_body(
                         "Delivery failed for job %s: %s", job["id"], delivery_exc
                     )
                 if not delivery_error and normalized_deliver == "origin":
-                    unresolved_origin = not _resolve_delivery_targets(job)
+                    unresolved_origin = not _resolve_delivery_targets(
+                        job, for_failure=True
+                    )
                 if delivery_error:
                     delivery_outcome = "failed"
                 elif unresolved_origin:
@@ -7677,6 +7961,10 @@ def _run_one_job_body(
         # _deliver_result unscoped — do not move it back in a tidy-up.
         if _scope_token is not None:
             reset_secret_scope(_scope_token)
+        if _terminal_scope_token is not None:
+            from tools.terminal_scope import reset_terminal_scope
+
+            reset_terminal_scope(_terminal_scope_token)
 
 
 def _notify_provider_jobs_changed() -> None:
diff --git a/cron/scheduler_provider.py b/cron/scheduler_provider.py
index 492a21b522..563cba345b 100644
--- a/cron/scheduler_provider.py
+++ b/cron/scheduler_provider.py
@@ -560,6 +560,7 @@ class InProcessCronScheduler(CronScheduler):
         profile_homes=None,
         profile_adapters=None,
         default_profile=None,
+        profile_gate=None,
     ):
         import logging
         from cron.scheduler import CronTickYielded
@@ -590,6 +591,7 @@ class InProcessCronScheduler(CronScheduler):
                 can_dispatch=can_dispatch,
                 profile_adapters=profile_adapters,
                 default_profile=default_profile,
+                profile_gate=profile_gate,
             )
             return
 
@@ -670,6 +672,7 @@ class InProcessCronScheduler(CronScheduler):
         can_dispatch=None,
         profile_adapters=None,
         default_profile=None,
+        profile_gate=None,
     ):
         """Tick every served profile's cron store when multiplex_profiles is on.
 
@@ -678,10 +681,20 @@ class InProcessCronScheduler(CronScheduler):
         agent execution to that profile's home — mirroring how
         ``_profile_runtime_scope`` scopes the multiplexed inbound path and
         ``web_server.py`` scopes per-profile cron API calls.
+
+        ``profile_gate(name, home) -> bool``, when given, is consulted every
+        cycle; a profile it rejects is neither ticked nor heartbeated that
+        cycle (the desktop ticker uses it to stand down for profiles whose
+        own gateway is running, #100489).
         """
         import logging
         from cron.scheduler import tick as cron_tick
-        from cron.scheduler import CronTickYielded
+        from cron.scheduler import (
+            CronTickYielded,
+            SharedRouteAdapters,
+            _is_fd_exhaustion,
+            _primary_profile_routes_for_current_home,
+        )
         from cron.jobs import (
             clear_ticker_error,
             record_ticker_error,
@@ -701,6 +714,8 @@ class InProcessCronScheduler(CronScheduler):
         # A profile may have been deleted since this snapshot was taken;
         # never recreate a deleted home's cron workspace via the heartbeat
         # below (#47368).
+        # One profile's broken store (corrupt executions.db, unreadable
+        # cron dir) must not abort startup for every other profile (#74878).
         for entry in _existing_profile_homes(profile_homes):
             home = entry[1] if isinstance(entry, tuple) else entry
             home_token = set_hermes_home_override(str(home))
@@ -714,6 +729,13 @@ class InProcessCronScheduler(CronScheduler):
                             home,
                         )
                     record_ticker_heartbeat()
+            except BaseException as e:
+                logger.error(
+                    "Cron startup recovery error for profile at %s: %s",
+                    home,
+                    e,
+                    exc_info=True,
+                )
             finally:
                 reset_hermes_home_override(home_token)
 
@@ -722,11 +744,24 @@ class InProcessCronScheduler(CronScheduler):
             ok = False
             _tick_error = None
             _profile_errors: dict[str, str] = {}
+            # Worst per-profile failure this cycle (fd exhaustion wins) so the
+            # #87644 backoff/reclaim is applied once per cycle, not per profile.
+            _cycle_exc: BaseException | None = None
+            cycle_homes = _existing_profile_homes(profile_homes)
+            if profile_gate is not None:
+                cycle_homes = [
+                    entry
+                    for entry in cycle_homes
+                    if profile_gate(
+                        entry[0] if isinstance(entry, tuple) else None,
+                        entry[1] if isinstance(entry, tuple) else entry,
+                    )
+                ]
             try:
                 if can_dispatch is not None and not can_dispatch():
                     logger.debug("Cron dispatch paused while gateway drains existing work")
                 else:
-                    for entry in _existing_profile_homes(profile_homes):
+                    for entry in cycle_homes:
                         _pname = entry[0] if isinstance(entry, tuple) else None
                         home = entry[1] if isinstance(entry, tuple) else entry
                         home_token = set_hermes_home_override(str(home))
@@ -745,6 +780,20 @@ class InProcessCronScheduler(CronScheduler):
                                     _tick_adapters = adapters
                                 else:
                                     _tick_adapters = (profile_adapters or {}).get(_pname) or {}
+                                    if not _tick_adapters and adapters:
+                                        # Credentialless satellite under
+                                        # gateway.profile_routes: no bot of its
+                                        # own, so its output may ride the
+                                        # PRIMARY adapter — but only for
+                                        # targets an exact enabled primary
+                                        # route maps to this profile
+                                        # (#101113). Unmatched targets still
+                                        # fail closed; this is not a default
+                                        # fallback.
+                                        _tick_adapters = SharedRouteAdapters(
+                                            adapters,
+                                            _primary_profile_routes_for_current_home(),
+                                        )
                                 cron_tick(
                                     verbose=False,
                                     adapters=_tick_adapters,
@@ -761,9 +810,26 @@ class InProcessCronScheduler(CronScheduler):
                             # only ticker in the same cycle.
                             logger.info("Cron tick yielded for profile at %s: %s", home, e)
                             _profile_errors[str(home)] = f"{type(e).__name__}: {e}"
+                        except BaseException as e:
+                            # Any other failure is THIS profile's failure
+                            # (#74878): record it against this profile's
+                            # status and keep ticking the remaining profiles.
+                            # BaseException for the same reason as the
+                            # single-profile loop (#32612).
+                            logger.error(
+                                "Cron tick error for profile at %s: %s",
+                                home,
+                                e,
+                                exc_info=True,
+                            )
+                            _profile_errors[str(home)] = f"{type(e).__name__}: {e}"
+                            if _cycle_exc is None or _is_fd_exhaustion(e):
+                                _cycle_exc = e
                         finally:
                             reset_hermes_home_override(home_token)
                     ok = not _profile_errors
+                    if _cycle_exc is not None:
+                        consecutive_failures = _note_tick_failure(_cycle_exc, consecutive_failures)
             except BaseException as e:
                 logger.error("Cron tick error: %s", e, exc_info=True)
                 _tick_error = f"{type(e).__name__}: {e}"
@@ -774,7 +840,7 @@ class InProcessCronScheduler(CronScheduler):
             # beat reflects its own outcome, so a yielding profile does not
             # darken healthy siblings — from an aborted one (exception), where
             # no profile completed and all beats are unsuccessful (#32612).
-            for entry in _existing_profile_homes(profile_homes):
+            for entry in cycle_homes:
                 home = entry[1] if isinstance(entry, tuple) else entry
                 home_token = set_hermes_home_override(str(home))
                 try:
diff --git a/cron/suggestions.py b/cron/suggestions.py
index d4e8107c20..afbd44dbda 100644
--- a/cron/suggestions.py
+++ b/cron/suggestions.py
@@ -45,8 +45,16 @@ logger = logging.getLogger(__name__)
 # Per-profile by design (issue #4707): suggestions live alongside the active
 # profile's cron store. Anchor on get_hermes_home() (profile home), not the
 # shared default root. See cron/jobs.py for the full rationale.
-CRON_DIR = get_hermes_home().resolve() / "cron"
-SUGGESTIONS_FILE = CRON_DIR / "suggestions.json"
+#
+# Optional test override. Production resolves the path at call time so
+# multiplexed profile ticks (set_hermes_home_override) cannot leak one
+# profile's suggestions into the import-time home (#86519). Same pattern as
+# cron/executions.py.
+SUGGESTIONS_FILE: Optional[Path] = None
+
+
+def _current_suggestions_file() -> Path:
+    return SUGGESTIONS_FILE or (get_hermes_home().resolve() / "cron" / "suggestions.json")
 
 # In-process lock protecting load->modify->save cycles (the background review
 # fork and the main agent can both write).
@@ -72,14 +80,15 @@ def _secure_file(path: Path) -> None:
 def _ensure_dir() -> None:
     from cron.jobs import _ensure_cron_dir
 
-    _ensure_cron_dir(CRON_DIR)
+    _ensure_cron_dir(_current_suggestions_file().parent)
 
 
 def _load_raw() -> Dict[str, Any]:
-    if not SUGGESTIONS_FILE.exists():
+    suggestions_file = _current_suggestions_file()
+    if not suggestions_file.exists():
         return {"suggestions": []}
     try:
-        with open(SUGGESTIONS_FILE, "r", encoding="utf-8") as f:
+        with open(suggestions_file, "r", encoding="utf-8") as f:
             data = json.load(f)
     except (json.JSONDecodeError, OSError) as e:
         logger.warning("suggestions.json unreadable (%s); starting empty", e)
@@ -94,7 +103,8 @@ def _load_raw() -> Dict[str, Any]:
 
 def _save_raw(suggestions: List[Dict[str, Any]]) -> None:
     _ensure_dir()
-    fd, tmp_path = tempfile.mkstemp(dir=str(SUGGESTIONS_FILE.parent), suffix=".tmp", prefix=".sugg_")
+    suggestions_file = _current_suggestions_file()
+    fd, tmp_path = tempfile.mkstemp(dir=str(suggestions_file.parent), suffix=".tmp", prefix=".sugg_")
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as f:
             json.dump(
@@ -104,8 +114,8 @@ def _save_raw(suggestions: List[Dict[str, Any]]) -> None:
             )
             f.flush()
             os.fsync(f.fileno())
-        atomic_replace(tmp_path, SUGGESTIONS_FILE)
-        _secure_file(SUGGESTIONS_FILE)
+        atomic_replace(tmp_path, suggestions_file)
+        _secure_file(suggestions_file)
     except BaseException:
         try:
             os.unlink(tmp_path)
diff --git a/docs/design/multiplexing-gateway.md b/docs/design/multiplexing-gateway.md
new file mode 100644
index 0000000000..cb9c5da63e
--- /dev/null
+++ b/docs/design/multiplexing-gateway.md
@@ -0,0 +1,208 @@
+# Multiplexing Gateway
+
+One gateway process can serve every profile in the install. The mode is opt-in
+(`gateway.multiplex_profiles`, default `false`), and everything it changes
+reverts the moment the flag is off. This document is the design rationale
+referenced from `agent/secret_scope.py` ("Workstream A"): what is isolated per
+profile, the mechanism that isolates it, and what deliberately stays
+process-global.
+
+## Overview
+
+Without multiplexing, one gateway process serves exactly one profile — its
+`.env`, sessions, skills, and platform adapters — and multi-profile installs
+run one process per profile. Multiplexing collapses that into a single
+process: the default profile plus every served named profile get their own
+adapters, secrets, sessions, and cron ticks, while sharing one event loop, one
+HTTP listener, one process lock, and one status surface.
+
+The design constraint that shapes everything below: **profile A's turns must
+never observe profile B's state**. Secrets, homes, sessions, and adapter lanes
+are isolated per profile; anything that cannot yet be isolated fails closed or
+is documented as a known limitation at the end of this document.
+
+## The mode flag
+
+- Config: `gateway.multiplex_profiles: true` (also accepted at top level).
+  Parsed in `gateway/config.py` with precedence env > config > default.
+- Env override: `GATEWAY_MULTIPLEX_PROFILES` accepts explicit truthy/falsy
+  tokens only; a blank or unrecognized value returns "no override" so an empty
+  deployment secret cannot shadow a config opt-in.
+- At startup, `GatewayRunner.__init__` calls
+  `agent.secret_scope.set_multiplex_active(...)` once. `_MULTIPLEX_ACTIVE` is
+  a plain module global, not a contextvar: it describes the deployment mode,
+  not a per-task value. Its only job is to arm the fail-closed behavior in
+  `get_secret()`.
+
+## Scope composition
+
+Every inbound event composes the same two context-local scopes before any
+profile-owned code runs:
+
+```
+platform event
+   │
+   ▼
+profile_routes match ──► served-set check ──► SessionSource.profile stamped
+   │                                           (gateway/profile_routing.py)
+   ▼
+_profile_runtime_scope(profile_home)           (gateway/run.py)
+   ├── set_hermes_home_override(home)          config / state.db / skills /
+   │                                           memory / sessions resolve here
+   └── set_secret_scope(profile .env + secret sources)
+   │                                           provider keys, platform tokens
+   ▼
+agent turn (worker thread via copy_context())
+   │
+   ▼
+scope unwound in finally
+```
+
+`_profile_runtime_scope` wraps every seam where profile-owned code executes:
+secondary adapter startup, connect and reconnect, the primary platform event
+handler, inbound preprocessing, `/model` and session-info resolution,
+background tasks, and the agent turn itself. Config reloads run under the
+default profile's scope so global gateway settings (`#64674`) resolve
+consistently.
+
+Both scopes are `contextvars`, so they propagate into executor worker threads
+via `copy_context()` and unwind deterministically — nothing is written to
+`os.environ`, ever.
+
+## Workstream A: context-local secret scope
+
+`agent/secret_scope.py` exists because the obvious implementation — union all
+profile `.env` files into `os.environ` — leaks profile A's keys into profile
+B's turns and into every subprocess spawned with `env=dict(os.environ)`.
+
+- `build_profile_secret_scope(home)` merges the profile's `.env` with its
+  configured secret sources, skipping globals.
+- `set_secret_scope(mapping)` installs it for the current task.
+- `get_secret(name)` resolves: global allowlist → active scope → fallback.
+  The fallback is the load-bearing part:
+  - multiplexing **off**: reads `os.environ`, so single-profile gateways and
+    every non-gateway caller behave exactly as before;
+  - multiplexing **on**, no scope installed: **raises `UnscopedSecretError`**
+    rather than silently reading the process environment. An un-migrated call
+    site fails loud at that exact line instead of leaking another profile's
+    value.
+- A small allowlist (`HERMES_HOME`, `HERMES_PROFILE`, proxy settings,
+  `API_SERVER_*` listener settings — but deliberately not `API_SERVER_KEY`)
+  stays global because those describe the process, not a profile.
+
+Because the per-turn `.env` reload is a no-op under multiplexing, rotated
+credentials are picked up through the profile scope on the next turn — never
+via `os.environ`. This holds at the loader boundary, not just the gateway's
+reload helper: `hermes_cli.env_loader.load_hermes_dotenv` skips the
+process-global load whenever multiplexing is active *and* a profile-home
+override is installed (import-time and cron callers hit it mid-turn), while
+still hydrating the profile's external secret sources into its private
+snapshot (`#77562`). The unscoped startup load is unchanged.
+
+The same scope-authoritative rule covers the other `os.environ` seams a
+routed turn can reach: `${VAR}` / `${env:VAR}` references in a profile's
+`config.yaml` resolve through `get_secret` when a scope is installed
+(`#84079`), and `.env` writes made under a scope (`save_env_value`, e.g. a
+`/pair` grant mirror) update the installed scope mapping instead of the
+process environment (`#88441`).
+
+## The HERMES_HOME override
+
+`hermes_constants.py` holds a context-local override consulted by
+`get_hermes_home()` before the `HERMES_HOME` env var. Everything that resolves
+paths through it — config, `state.db`, skills, memory, SOUL, sessions, kanban,
+goals, plugin discovery, MCP startup — follows the active profile
+automatically. `get_process_hermes_home()` exists for the few machine-level
+assets that must not follow the override. `hermes_home_key()` gives
+per-home registries a stable scope key. A one-shot warning (`#18594`) fires if
+profile-scoped code runs without the override where one is expected.
+
+## Inbound routing
+
+`gateway.profile_routes` maps `(platform, guild_id, chat_id, thread_id)` to a
+profile; matching is conjunctive, most-specific-first, with parent-chain chat
+matching for threads. Routing only runs when multiplexing is active, and a
+matched route whose target is outside the served set is rejected (the event is
+dropped, not misdelivered). Full schema and matching rules:
+`docs/profile-routing.md`.
+
+## Serving selected profiles
+
+`profiles_to_serve(multiplex, profile_allowlist)` in `hermes_cli/profiles.py`
+is the single chokepoint for which profiles a multiplexer serves: default plus
+every valid profile directory, optionally filtered by allowlist. A malformed
+allowlist fails safe to default-only. The served set gates adapter startup,
+cron ticking (`#69377`), `/p/<profile>/` HTTP admission, route eligibility,
+and the runtime status surface. An excluded profile stays installed and can
+still run its own standalone gateway.
+
+## Per-profile persistence
+
+`SessionStore` binds no database handle at construction (`#88532`). Session
+DB handles are resolved at call time through the active HERMES_HOME override —
+one cached handle per resolved `profiles/<name>/state.db` — so sessions land
+in the owning profile's store even when the store object itself is shared.
+Pairing stores are constructed per served profile.
+
+## Per-bot session lanes
+
+Session keys are namespaced by profile (`agent:main` for default,
+`agent:<name>` for named profiles). Adapters carry `_owner_profile`
+(installed at adapter configuration time, before any inbound event) because
+adapter ingress runs before `SessionSource.profile` is stamped;
+`_session_key_profile` resolves source stamp → owner profile → store
+resolver. Text/media batching, active-session tracking, and the busy-session
+guard are all keyed per lane, so two bots sharing a chat do not share a
+session lane.
+
+## Control plane
+
+Desktop plugins reach the gateway only through the ws JSON-RPC door, so
+profile enumeration and configuration live in
+`tui_gateway/methods_profiles.py`: `profiles.list`, `profiles.create`,
+`profiles.describe`, `profiles.configure`, `profiles.set_asset`,
+`profiles.get_asset`. Reads and writes run under the target profile's
+HERMES_HOME override. Asset writes are atomic, type- and size-capped.
+
+## Failure modes
+
+- Fatal at startup: multiplex config errors and a secondary profile enabling a
+  port-binding platform (`MultiplexConfigError`,
+  `SecondaryPortBindingConfigError`) — one shared HTTP listener is owned by
+  the default profile.
+- Skipped, not fatal: a single misconfigured secondary adapter is skipped with
+  a warning rather than taking down the multiplexer.
+- Fail-closed: unscoped `get_secret()` under multiplexing raises; a routed
+  event targeting an unserved profile is dropped; an unscoped `/p/` request
+  enters the default profile's scope (`#61276`) rather than an undefined one.
+- Fallback: an external `cron.provider` does not support multiplexing and
+  falls back to the built-in ticker with a warning.
+
+## Known limitations
+
+Process-global state that is not yet profile-scoped:
+
+| Surface | State at time of writing |
+| --- | --- |
+| MCP discovery and tool registration | Process-global; the first profile to build an agent wins the discovery slot. Full per-profile MCP registries are tracked in `#67605`. |
+| Terminal / sandbox env (`TERMINAL_*`) | Global by allowlist; tools read it from the process environment. |
+| Built-in tool registry | Built-ins are process-global; plugin-registered tools are overlaid per profile via `hermes_home_key()`. |
+| Provider/capability registries | Same hybrid overlay pattern (browser, image-gen, TTS, transcription, video-gen, web-search, secret sources). |
+| HTTP listener, relay ingress, process lock | One per process, owned by the default/active profile. Per-profile `runtime_status.json` is still written. |
+
+## Non-goals
+
+Multiplexing isolates *profiles*; it does not authenticate or authorize *end
+users*. A profile is a configuration, not a person: the gateway trusts its
+transport and its routing table to decide which profile an event belongs to.
+Request-level identity and per-user authorization above the profile layer are
+out of scope for this document.
+
+## Related
+
+- `docs/profile-routing.md` — inbound routing schema and matching rules.
+- `website/docs/user-guide/multi-profile-gateways.md` — user-facing guide,
+  including the standalone one-gateway-per-profile alternative.
+- `agent/secret_scope.py`, `hermes_constants.py`, `gateway/profile_routing.py`,
+  `gateway/run.py` (`_profile_runtime_scope`), `hermes_cli/profiles.py`
+  (`profiles_to_serve`), `gateway/session.py`, `tui_gateway/methods_profiles.py`.
diff --git a/docs/observability/relay-shared-metrics.md b/docs/observability/relay-shared-metrics.md
index 146590dc99..a736bf6edd 100644
--- a/docs/observability/relay-shared-metrics.md
+++ b/docs/observability/relay-shared-metrics.md
@@ -33,8 +33,12 @@ than downloading a different implementation.
 When Relay managed execution is active, the provider request and response pass
 through that native module in the Hermes process so configured interceptors can
 operate on the real call. This is separate from the shared-metrics data
-contract. Shared-metrics mode installs no network exporter and its subscriber
-accepts only the versioned, allowlisted projection described below. Enabling a
+contract. Shared-metrics mode installs no rich-observability network exporter,
+and its subscriber
+accepts only the versioned, allowlisted projection described below. The
+opt-in package sender described in Appendix A is the only outbound path, it
+transmits nothing unless the user enables both `enabled` and `send`, and it
+sends whole packages rather than live spans. Enabling a
 separately configured rich-observability or dynamic plugin can create a
 different data path and requires its own policy review.
 
@@ -226,10 +230,18 @@ packages from that profile and can therefore link those local packages.
 Deleting `$HERMES_HOME/telemetry/shared_metrics` resets the identifier together
 with all aggregates and package files.
 
-This slice has no remote-delivery path. A future remote exporter must not reuse
-the persistent local identifier by default. It requires a separate product and
-privacy decision covering consent, identity scope, rotation or keyed
-pseudonymization, reset behavior, retention, and deletion.
+Remote delivery is opt-in and off by default. Reusing the persistent local
+identifier remotely required a separate product and privacy decision covering
+consent, identity scope, reset behavior, retention, and deletion — that
+decision has been made.
+
+> Those decisions are recorded in
+> [Appendix A](#appendix-a-remote-exporter-decisions-phase-2), and the exporter
+> implementing them has shipped. Collection alone still transmits nothing: the
+> sender runs only when `telemetry.shared_metrics.send` is also true. Each
+> transmitted package carries the stable `install_id` as-is (product decision,
+> 2026-08-27 — see A.2 for the record, including the superseded
+> HMAC-pseudonym design).
 
 The install identity is scoped to one `HERMES_HOME`. To reset it, stop Hermes
 processes and remove `$HERMES_HOME/telemetry/shared_metrics`. This deliberately
@@ -257,3 +269,210 @@ verifies model, provider, task, tool, and skill counters in SQLite, validates
 all exported delta packages against the closed schema, verifies the
 pseudonymous client-active counter, and checks that prompt, response, tool-call
 ID, tool-result, and skill-name canaries are absent from the packages.
+
+## Appendix A: Remote Exporter Decisions (Phase 2)
+
+Status: **implemented.** This appendix answers the product and
+privacy questions that "Current Slices" defers to a future remote exporter. It
+records what was decided and why, so the reasoning survives the implementation.
+
+Sending is off by default and requires both `telemetry.shared_metrics.enabled`
+and `telemetry.shared_metrics.send`.
+
+The exporter sends the package files already written under
+`$HERMES_HOME/telemetry/shared_metrics/outbox/` to the Hermes telemetry ingest
+service. That service validates only the envelope (`schema_version` plus a UUID
+`package_id`) and stores the body verbatim in S3.
+
+### A.1 Consent
+
+Transmission is a **separate opt-in** from collection, under a new config key:
+
+```yaml
+telemetry:
+  shared_metrics:
+    enabled: false   # collect locally
+    send: false      # NEW: transmit to the Nous telemetry service
+```
+
+- `send` defaults to **false**. Collection alone never transmits.
+- `send` requires `enabled`. It does **not** imply it: a transmission flag must
+  not silently switch on collection. `send: true` with `enabled: false` warns
+  and does nothing.
+- Like `enabled`, `send` is profile-owned and is not overridden by
+  managed-scope configuration.
+
+**A package is only sent when its whole period falls inside a recorded
+consent window.** Consent is stored as explicit intervals in the shared-
+metrics SQLite store (`send_consent_windows`): a window opens when `send:
+true` is first observed, is confirmed forward by every later observation,
+and closes — at the last *confirmed* moment, never at the wall clock — when
+`send: false` is observed. A single reconciler derives this table from the
+config on every process start, so wizard changes, hand-edits to
+`config.yaml`, and mid-pass revocations all take the same path, and no
+transition can be missed by any of them.
+
+Any package whose period predates the first window, falls between windows,
+or runs past the newest confirmed moment is excluded — the gate fails
+closed. A fresh package therefore waits at most one process start after its
+period completes before becoming eligible.
+
+The gate is on the **period**, not on the package's creation time. One period
+is split across several packages created on different days: a day's first
+package is written that day, and a tail package for the same period typically
+follows the next day. Gating on creation time would send a period's tail while
+dropping its head, reporting a **silently undercounted** day. Gating on the
+period keeps consent forward-only and every transmitted period complete.
+
+Local history can be up to 30 days old, and that data was collected under a
+promise that nothing is uploaded. Honouring consent forward-only costs at most
+30 days of backlog we never had permission to send.
+
+### A.2 Identity scope — the stable install_id is transmitted as-is
+
+**Decision record.** The original design of this exporter (and revisions 1–8
+of this appendix) transmitted a keyed pseudonym instead of the identifier:
+`HMAC-SHA256(key = locally-held rotating salt, message = install_id)`, with
+the salt rotating every 30 days. On **2026-08-27**, before the feature
+shipped (zero consented users, zero production transmissions), the product
+owner decided the analytical need is a **stable cross-window identity** —
+retention curves, longitudinal install behaviour — which rotation by design
+destroys. The pseudonymization layer was removed in full rather than
+weakened in place.
+
+What is transmitted now:
+
+- Each package carries `install_id` verbatim: the persistent, profile-scoped
+  random UUID described above.
+- It is generated locally (`uuid4`), contains no hardware, account, user, or
+  machine-derived information, and identifies a *profile*, not a person.
+- It is stable until the user deletes the shared-metrics directory, which
+  regenerates it (see A.4).
+
+Consequences stated plainly rather than papered over:
+
+- Packages from one profile correlate **indefinitely**, not per-window.
+  Long-term linkability of one install's daily envelope sequence is now the
+  designed behaviour, not a residue.
+- The A.3 residue analysis of the old design (stable `resource` tuple +
+  contiguous periods bridging rotation windows) is moot — there is no window
+  boundary left to bridge.
+- The setup wizard's consent language states this identity model explicitly;
+  it was updated in the same change that removed the derivation, so no
+  consent was ever collected under the old wording in any shipped build.
+
+**Byte-identical resends still hold.** The transmitted id is recorded on the
+row (`sent_install_id`) when the package is first prepared, and the wire body
+is always rebuilt from that recorded value, so a retry rebuilds identical
+bytes. The contract requires this: resending a `package_id` with different
+content is undefined behaviour. (With a stable id the recorded copy is no
+longer load-bearing against rotation — it remains as the audit column and as
+cheap insurance against any future change to identity semantics.)
+
+### A.3 Rotation — removed (decision record)
+
+Salt rotation was deleted together with the derivation (product decision,
+2026-08-27). This section is retained as a record of what the earlier design
+did and why the removal was accepted:
+
+- Rotation existed to bound long-term linkability: one identity per 30-day
+  window, unrelated identities across windows.
+- The documented residue (see git history for the full analysis): the
+  envelope's stable, low-entropy `resource` tuple plus contiguous daily
+  periods could plausibly bridge windows for rare configurations anyway, so
+  the boundary was a cost-raiser, not a wall.
+- The product need that killed it: cross-window continuity is precisely what
+  retention analysis requires. A boundary that mostly inconveniences honest
+  analysis while only raising costs for a determined correlator was judged
+  the wrong trade once stable identity became a requirement.
+
+There is no salt in the store, no rotation schedule, and no derived
+identifier anywhere in the pipeline.
+
+### A.4 Reset behavior
+
+Removing `$HERMES_HOME/telemetry/shared_metrics` still resets local identity,
+aggregates, and package files, exactly as documented above. Two honest
+qualifications now apply:
+
+- Reset regenerates `install_id`, so subsequent packages transmit a **new**
+  identity. Local reset does give a new remote identity.
+- Reset **cannot unsend**. Packages already transmitted remain in the ingest
+  service's storage under the identifier they were sent with. There is no
+  read-back or delete API in the v1 contract.
+
+Setting `send: false` stops transmission immediately: consent is re-read
+before every package, so a pass already in flight stops after the package it
+is currently sending rather than draining its whole batch. It does not delete
+previously transmitted packages, and it does not stop local collection.
+
+Turning sending off also **closes the consent window** — at the last moment
+consent was actually observed, not at the wall clock. Packages whose periods
+fall between one window and the next are never transmitted, even if sending
+is later re-enabled, and this holds for any number of on/off cycles, across
+hand-edits with no process running, and under a clock that jumps in either
+direction (window opens are clamped above every timestamp already in the
+store; observation marks advance by a bounded step per call, so one glitched
+forward sample cannot drag the confirmation horizon years ahead; a close
+never lands after the closing observation's own clock).
+Unlike the earlier single moving opt-in date, closing and reopening does NOT
+discard the still-undelivered backlog from a previous consented window —
+those packages stay inside their own interval and remain eligible.
+
+One deliberate upgrade-path consequence: packages exported under the
+pre-interval consent model (before `send_consent_windows` existed) predate
+the first recorded window and are therefore never transmitted after an
+upgrade. This is the fail-closed direction — re-importing the old moving
+day-stamp to release them would re-import the semantics five review rounds
+showed to be unsound — and it costs at most the undelivered backlog, never
+collected data.
+
+### A.5 Retention
+
+- **Local:** unchanged — 30 days for successfully exported history, and pending
+  deltas are kept until exported. Send state does **not** extend local
+  retention: a package that could never be sent is still pruned at 30 days.
+  Unbounded local growth against a permanently unreachable endpoint is a worse
+  failure than losing metrics from an install that has been broken for a month.
+- **Remote:** raw packages are retained in S3 without expiry in production and
+  for 30 days in staging.
+
+### A.6 Deletion
+
+There is no remote deletion path in the v1 contract, and this appendix does not
+invent one. What a user can do:
+
+| Action | Effect |
+|---|---|
+| `send: false` | No further packages leave the machine |
+| `enabled: false` | Collection stops; existing local state remains |
+| Remove `.../shared_metrics` | Local identity, aggregates, and files reset; future sends use a new install_id |
+| Delete already-sent data | Not self-service — requires an operator acting on the S3 bucket |
+
+If a deletion-on-request obligation is ever taken on, the lookup path is now
+direct: the user's `install_id` (readable from their local store) is the key
+their data is stored under. Building the service-side delete API remains a
+new product decision, not an implementation detail.
+
+### A.7 What the outbox directory is
+
+Recorded because it was misread once during Phase 2 planning, in a way that
+would have deleted user data.
+
+The directory is **local history, not a send-queue**. `package_outbox` is the
+SQLite table; its `exported_at` column means "written to disk", not "sent".
+Files are immutable and pruned **by age alone**.
+
+The ingest contract says senders should delete a package from their outbox on
+`202`. **The exporter does not do this.** Deleting on acknowledgement would
+repurpose the user's 30-day local history as a transmission queue and destroy
+state they were promised. Send state lives in new columns on the
+`package_outbox` table instead; the files are untouched by transmission.
+
+### A.8 Scope note
+
+The `install_id` field inside the package body is transmitted as the
+generator wrote it (rewritten from the row's frozen `sent_install_id`, which
+records the same value). No other payload field changes, nothing is added,
+and the service treats the whole body as opaque. Payload schema evolution
+therefore stays a sender-side concern, as before.
diff --git a/docs/relay-connector-contract.md b/docs/relay-connector-contract.md
index 9ec40732b6..a4038f8d41 100644
--- a/docs/relay-connector-contract.md
+++ b/docs/relay-connector-contract.md
@@ -119,8 +119,13 @@ Both absent ⇒ byte-identical to today. A connector that never sends them, or a
 
 `PassthroughForward` is the wire form of a forwarded passthrough-plane request
 (Class-2/3 webhooks — Discord interactions, Twilio): `{platform, botId, method,
-path, headers: [[k,v],…], bodyB64}`. The body is base64-encoded so arbitrary
-bytes survive the newline-delimited-JSON transport; the gateway base64-decodes
+path, headers: [[k,v],…], bodyB64, profile?}`. `profile` is optional — the
+connector stamps it when NAS resolves the target profile for a Team-Gateway
+interaction; omitting it (single-profile gateways) preserves legacy routing to
+the default `agent:main` session namespace, mirroring the `profile` field the
+`inbound` frame's `SessionSource` already carries (#60586). The body is
+base64-encoded so arbitrary bytes survive the newline-delimited-JSON transport;
+the gateway base64-decodes
 back to the exact bytes the connector forwarded (the connector already verified
 the provider signature and stripped any shared-identity credential at the edge —
 §6 — so the gateway re-processes a sanitized, token-free body and acts on it via
diff --git a/docs/state-db-recovery.md b/docs/state-db-recovery.md
index c56b5b5f7a..5cb69fb928 100644
--- a/docs/state-db-recovery.md
+++ b/docs/state-db-recovery.md
@@ -23,6 +23,47 @@ cross-process admission lock and foreign-holder guard. If that guarded rebuild
 cannot run, FTS remains detached, canonical writes stay available, and
 `hermes doctor` reports the explicit repair command.
 
+## Live behavior when the file itself is corrupt
+
+If a live write reports bare `SQLITE_CORRUPT` / `SQLITE_NOTADB` (`database
+disk image is malformed`, `file is not a database`) with no FTS provenance,
+the damage is in a canonical B-tree, the schema, or the freelist. `SessionDB`
+then quarantines that handle (`StateDbCorruptError`):
+
+1. the failing write propagates the typed error and nothing is retried;
+2. later writes on the handle fail immediately without touching the file;
+3. the handle never reopens its connection after `close()`; and
+4. `close()` skips its explicit WAL checkpoint.
+
+Stopping the writes is the protection. In the field, a handle that kept
+writing for ~50 minutes after the first structural error checkpointed 15
+pages under the wrong page numbers on shutdown (page 1 received a
+`messages_fts_trigram_data` leaf) and turned a damaged-but-readable file into
+one that no longer opened at all. Skipping the explicit checkpoint is the
+second line of defence; on Python 3.12+ the quarantine also disables
+SQLite's own last-connection checkpoint (`SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE`),
+so the `-wal` sidecar survives `close()` for forensics. On Python 3.11 that
+switch is unavailable and SQLite may still checkpoint once on close, so copy
+`state.db`, `state.db-wal` and `state.db-shm` together before restarting
+anything.
+
+The gateway and the agent flush path treat the quarantine like a replaced
+file: pending transcripts go to `sessions/<id>.jsonl` and the gateway
+`pending_messages/` spool instead of the retry queue, and the FTS one-shot
+rebuild never runs on the damaged file. The quarantine is per process — the
+shared handle stays poisoned for every holder until the process restarts on a
+repaired or restored file. Do not run `hermes doctor --fix` while the gateway
+is still up. Next steps:
+
+```bash
+hermes gateway stop
+HERMES_HOME="$HOME/.hermes" hermes sessions recover --source "$HOME/.hermes/state.db" --inspect-only
+# if recoverable:
+HERMES_HOME="$HOME/.hermes" hermes sessions recover --source "$HOME/.hermes/state.db" --output "$HOME/recovered-state.db"
+```
+
+or restore the newest snapshot from `state-snapshots/`.
+
 ## Explicit repair
 
 Stop every process that can open the profile database before repairing it.
diff --git a/evals/browser_use/single_run.py b/evals/browser_use/single_run.py
index 346c425de7..6015656fb1 100644
--- a/evals/browser_use/single_run.py
+++ b/evals/browser_use/single_run.py
@@ -63,7 +63,7 @@ with open(os.path.join(hh, "config.yaml"), "w", encoding="utf-8") as f:
 os.environ["HERMES_HOME"] = hh
 # Strip web-fetch shortcuts: every arm must drive the browser.
 os.environ.pop("BROWSER_USE_API_KEY", None)
-for k in ("FIRECRAWL_API_KEY", "NOUS_API_KEY", "SERPER_API_KEY"):
+for k in ("FIRECRAWL_API_KEY", "NOUS_API_KEY", "TAVILY_API_KEY", "SERPER_API_KEY"):
     os.environ.pop(k, None)
 os.environ["BU_CDP_URL"] = cdp
 os.environ["PATH"] = (
diff --git a/evals/core_tool_deferral/README.md b/evals/core_tool_deferral/README.md
new file mode 100644
index 0000000000..500676a805
--- /dev/null
+++ b/evals/core_tool_deferral/README.md
@@ -0,0 +1,73 @@
+# core_tool_deferral — live A/B harness for tool-visibility changes
+
+Built for the PR #97979 maintainer battery (core-tool deferral behind the
+tool_search bridge). Runs REAL in-process `AIAgent`s from two pinned
+checkouts and grades task outcomes programmatically — accuracy, api turns,
+tokens, wall, bridge-call counts — across any set of models.
+
+Original verdict + full numbers: `results/SUMMARY.md` and the PR #97979 body
+(288 runs; gpt-5.6-terra / glm-5.3-flash / qwen3.8-27b).
+
+## Layout
+
+- `tasks.py` — 14-task battery: one task per deferred tool, multistep
+  (todo discipline, GUI chains), long-range (session_search → backup →
+  cron → todo), a destructive-ambiguity clarify trap, an eager-only
+  control, and a false-discovery distractor. Each task carries fixtures,
+  a programmatic grader (0–1 partial credit), and scripted user replies.
+- `worker.py` — one (arm, model, task, rep) cell in an isolated
+  subprocess: temp HERMES_HOME + workspace, hermetic env (only
+  OPENROUTER_API_KEY survives), seeded session DB (targets + decoys),
+  deterministic desktop-surface stubs (desktop_ui emitter + agent
+  callbacks), computer_use/image_generate stubbed at the registry
+  handler. Terminal/files/cron/process/session-DB are REAL.
+  Exit 3 = infra/config error (never scored).
+- `orchestrator.py` — battery runner: resume-safe, per-task wall
+  timeouts, parallel cells, errored-record retry, 3-infra-abort fuse.
+- `report.py` — per-task table both arms (score spread, turns, tok, wall,
+  bridge calls), mean-of-task-means, noise/error accounting.
+
+## Running
+
+```bash
+# 1. Two plain checkouts pinned to the SHAs under test (never pip install -e)
+git worktree add /tmp/abdefer-base <baseline-sha>
+git worktree add /tmp/abdefer-pr   <pr-sha>
+
+export ABDEFER_BASE_TREE=/tmp/abdefer-base
+export ABDEFER_PR_TREE=/tmp/abdefer-pr
+export OPENROUTER_API_KEY=...   # the only key the worker keeps
+
+# 2. Smoke one cheap cell first
+python3 worker.py base openai/gpt-5.6-terra config_grep_distractor 1 /tmp/smoke.json
+
+# 3. Battery (per model; start with the STRONGEST model to validate variance)
+python3 orchestrator.py openai/gpt-5.6-terra 3 --parallel=5
+python3 orchestrator.py z-ai/glm-5.3-flash 3 --parallel=5
+python3 orchestrator.py qwen/qwen3.8-27b   3 --parallel=5
+
+# 4. Readout
+python3 report.py
+```
+
+`ABDEFER_PYTHON` overrides the worker interpreter (defaults to the
+orchestrator's own); `ABDEFER_RESULTS` overrides the results root.
+
+## Discipline (from the readtool/session_search harness lineage)
+
+- Verify model slugs against the live OpenRouter list before launching.
+- Interactive fairness: if the agent ends its turn with a plain-text
+  question, the worker sends the scripted reply (max 2, counted as
+  `user_roundtrips`) — without this, every clarify-shaped task scores 0
+  unfairly and the battery is poisoned (the first terra run was discarded
+  for exactly this).
+- Same-denominator rule: errored runs score 0 and STAY in the accuracy
+  denominator; they are excluded from efficiency means.
+- Extend contested cells (score spread at n=3) to n=6 before concluding.
+- For discovery-rate regressions, always check base-arm usage on the same
+  tasks first — a tool models skip even when visible is not a deferral
+  regression.
+- Audit anomalous cells from `*.transcript.json` before publishing.
+
+`results/` is gitignored except SUMMARY.md — rep JSONs are rebuildable,
+verdicts are the artifact.
diff --git a/evals/core_tool_deferral/orchestrator.py b/evals/core_tool_deferral/orchestrator.py
new file mode 100644
index 0000000000..a5b76fbff4
--- /dev/null
+++ b/evals/core_tool_deferral/orchestrator.py
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+"""Orchestrate the PR #97979 A/B battery. Resume-safe; per-run wall timeout.
+
+Usage: orchestrator.py <model_slug> <reps> [--tasks id1,id2] [--arms base,pr] [--parallel N]
+Results land in results/<model_short>/<arm>__<task>__rep<r>.json (override
+the results root with ABDEFER_RESULTS).
+"""
+import json
+import os
+import subprocess
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+HARNESS = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HARNESS)
+import tasks as taskmod
+
+MODEL = sys.argv[1]
+REPS = int(sys.argv[2])
+task_ids = [t["id"] for t in taskmod.TASKS]
+arms = ["base", "pr"]
+parallel = 4
+for a in sys.argv[3:]:
+    if a.startswith("--tasks="):
+        task_ids = a.split("=", 1)[1].split(",")
+    elif a.startswith("--arms="):
+        arms = a.split("=", 1)[1].split(",")
+    elif a.startswith("--parallel="):
+        parallel = int(a.split("=", 1)[1])
+
+short = MODEL.split("/")[-1]
+RESULTS = os.path.join(os.environ.get("ABDEFER_RESULTS", os.path.join(HARNESS, "results")), short)
+os.makedirs(RESULTS, exist_ok=True)
+PY = os.environ.get("ABDEFER_PYTHON", sys.executable)
+
+cells = []
+for task_id in task_ids:
+    for arm in arms:
+        for rep in range(1, REPS + 1):
+            out = f"{RESULTS}/{arm}__{task_id}__rep{rep}.json"
+            if os.path.exists(out):
+                try:
+                    with open(out, encoding="utf-8") as f:
+                        rec = json.load(f)
+                    if rec.get("error") is None or rec.get("score", 0) > 0:
+                        continue  # keep good/attempted records
+                    # errored record -> retry
+                    os.remove(out)
+                except Exception:
+                    os.remove(out)
+            cells.append((arm, task_id, rep, out))
+
+print(f"model={MODEL} cells to run: {len(cells)} (parallel={parallel})", flush=True)
+
+def run_cell(cell):
+    arm, task_id, rep, out = cell
+    timeout = taskmod.TASKS_BY_ID[task_id].get("timeout", 600)
+    cmd = [PY, os.path.join(HARNESS, "worker.py"), arm, MODEL, task_id, str(rep), out]
+    t0 = time.time()
+    try:
+        p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout + 60,
+                           env=os.environ.copy())
+        if p.returncode == 3:
+            return (cell, "INFRA_ABORT", p.stderr[-500:])
+        if p.returncode != 0 and not os.path.exists(out):
+            rec = {"arm": arm, "model": MODEL, "task": task_id, "rep": rep,
+                   "score": 0.0, "error": f"worker exit {p.returncode}",
+                   "notes": [p.stderr[-400:]], "api_turns": None,
+                   "total_tokens": None, "wall_s": round(time.time() - t0, 1),
+                   "bridge_calls": None, "tool_calls_total": None,
+                   "tool_counts": {}, "raw_xml_noise": False}
+            with open(out, "w", encoding="utf-8") as f:
+                json.dump(rec, f, indent=1)
+            return (cell, "WORKER_ERR", p.stderr[-300:])
+        return (cell, "OK", p.stdout.strip().splitlines()[-1] if p.stdout.strip() else "")
+    except subprocess.TimeoutExpired:
+        rec = {"arm": arm, "model": MODEL, "task": task_id, "rep": rep,
+               "score": 0.0, "error": "wall timeout", "notes": ["hard wall timeout"],
+               "api_turns": None, "total_tokens": None,
+               "wall_s": round(time.time() - t0, 1), "bridge_calls": None,
+               "tool_calls_total": None, "tool_counts": {}, "raw_xml_noise": False}
+        with open(out, "w", encoding="utf-8") as f:
+            json.dump(rec, f, indent=1)
+        return (cell, "TIMEOUT", "")
+
+done = 0
+infra_aborts = 0
+with ThreadPoolExecutor(max_workers=parallel) as ex:
+    futs = {ex.submit(run_cell, c): c for c in cells}
+    for fut in as_completed(futs):
+        cell, status, info = fut.result()
+        done += 1
+        print(f"[{done}/{len(cells)}] {cell[0]}/{cell[1]}/rep{cell[2]}: {status} {info}", flush=True)
+        if status == "INFRA_ABORT":
+            infra_aborts += 1
+            if infra_aborts >= 3:
+                print("FATAL: 3 infra aborts — stopping battery", flush=True)
+                sys.exit(3)
+print("BATTERY COMPLETE", flush=True)
diff --git a/evals/core_tool_deferral/report.py b/evals/core_tool_deferral/report.py
new file mode 100644
index 0000000000..b2fc6f9d42
--- /dev/null
+++ b/evals/core_tool_deferral/report.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Aggregate A/B results. Usage: report.py [model_short ...]"""
+import json
+import glob
+import os
+import statistics
+import sys
+
+BASE = os.environ.get("ABDEFER_RESULTS", os.path.join(os.path.dirname(os.path.abspath(__file__)), "results"))
+models = sys.argv[1:] or sorted(
+    d for d in os.listdir(BASE) if os.path.isdir(os.path.join(BASE, d)) and d != "smoke")
+
+def load(model):
+    recs = []
+    for p in glob.glob(f"{BASE}/{model}/*.json"):
+        if p.endswith(".transcript.json"):
+            continue
+        with open(p, encoding="utf-8") as f:
+            recs.append(json.load(f))
+    return recs
+
+def fmt(v, nd=1):
+    return "-" if v is None else (f"{v:.{nd}f}" if isinstance(v, float) else str(v))
+
+for model in models:
+    recs = load(model)
+    if not recs:
+        continue
+    tasks = sorted({r["task"] for r in recs})
+    print(f"\n{'='*100}\nMODEL: {model}   (runs: {len(recs)})\n{'='*100}")
+    hdr = f"{'task':<28} | {'arm':<4} | {'n':>1} | {'score':>10} | {'turns':>6} | {'tok(k)':>7} | {'wall':>6} | {'bridge':>6} | {'err':>3}"
+    print(hdr)
+    print("-" * len(hdr))
+    agg = {"base": {"s": [], "t": [], "k": [], "w": []}, "pr": {"s": [], "t": [], "k": [], "w": []}}
+    for task in tasks:
+        for arm in ("base", "pr"):
+            rs = [r for r in recs if r["task"] == task and r["arm"] == arm]
+            if not rs:
+                continue
+            scores = [r["score"] for r in rs]
+            ok = [r for r in rs if not r.get("error")]
+            turns = [r["api_turns"] for r in ok if r.get("api_turns")]
+            toks = [r["total_tokens"] for r in ok if r.get("total_tokens")]
+            walls = [r["wall_s"] for r in ok if r.get("wall_s")]
+            bridges = [r.get("bridge_calls") or 0 for r in ok]
+            nerr = sum(1 for r in rs if r.get("error"))
+            smean = statistics.mean(scores)
+            sspread = f"{smean:.2f} [{min(scores):.1f}-{max(scores):.1f}]"
+            print(f"{task:<28} | {arm:<4} | {len(rs)} | {sspread:>10} | "
+                  f"{fmt(statistics.mean(turns) if turns else None):>6} | "
+                  f"{fmt(statistics.mean(toks)/1000 if toks else None):>7} | "
+                  f"{fmt(statistics.mean(walls) if walls else None):>6} | "
+                  f"{fmt(statistics.mean(bridges) if bridges else None):>6} | {nerr:>3}")
+            agg[arm]["s"].append(smean)
+            if turns: agg[arm]["t"].append(statistics.mean(turns))
+            if toks: agg[arm]["k"].append(statistics.mean(toks))
+            if walls: agg[arm]["w"].append(statistics.mean(walls))
+    print("-" * len(hdr))
+    for arm in ("base", "pr"):
+        a = agg[arm]
+        if a["s"]:
+            print(f"{'MEAN-OF-TASK-MEANS':<28} | {arm:<4} |   | {statistics.mean(a['s']):>10.3f} | "
+                  f"{fmt(statistics.mean(a['t']) if a['t'] else None):>6} | "
+                  f"{fmt(statistics.mean(a['k'])/1000 if a['k'] else None):>7} | "
+                  f"{fmt(statistics.mean(a['w']) if a['w'] else None):>6} |")
+    noise = [r for r in recs if r.get("raw_xml_noise")]
+    errs = [r for r in recs if r.get("error")]
+    if noise:
+        print(f"raw-XML noise runs: {len(noise)} -> " + ", ".join(f"{r['arm']}/{r['task']}/r{r['rep']}" for r in noise))
+    if errs:
+        print(f"errored runs: {len(errs)} -> " + ", ".join(f"{r['arm']}/{r['task']}/r{r['rep']}: {r['error'][:60]}" for r in errs))
diff --git a/evals/core_tool_deferral/results/.gitignore b/evals/core_tool_deferral/results/.gitignore
new file mode 100644
index 0000000000..33fbdac867
--- /dev/null
+++ b/evals/core_tool_deferral/results/.gitignore
@@ -0,0 +1,3 @@
+*
+!.gitignore
+!SUMMARY.md
diff --git a/evals/core_tool_deferral/results/SUMMARY.md b/evals/core_tool_deferral/results/SUMMARY.md
new file mode 100644
index 0000000000..c827f5d0f7
--- /dev/null
+++ b/evals/core_tool_deferral/results/SUMMARY.md
@@ -0,0 +1,75 @@
+# PR #97979 A/B verdict — core-tool deferral (288 live runs)
+
+Date: 2026-08-29 · Harness: /tmp/ab97979/harness · Method: METHOD.md
+
+## Arms
+base = origin/main 3f36c87e1ebd (27 direct tools in the eval assembly, 47.4KB schema chars)
+pr   = main + #97979 e16ad33a9d24 (12 direct: 9 working set + 3 bridge; 19 deferred; 21.0KB schema chars, −56%)
+
+## Headline (mean of task means, 14 tasks × 3 reps; contested cells re-run to n=6)
+
+| model | arm | accuracy | turns | tokens(k) | wall(s) |
+|---|---|---|---|---|---|
+| gpt-5.6-terra (large) | base | 0.938 | 6.0 | 80.9 | 27.6 |
+| gpt-5.6-terra | pr | 0.879 | 6.6 | **62.5 (−23%)** | 27.1 |
+| glm-5.3-flash (medium) | base | 0.915 | 6.0 | 101.0 | 56.5 |
+| glm-5.3-flash | pr | **0.963 (+0.05)** | 8.8 | **89.6 (−11%)** | 59.5 |
+| qwen3.8-27b (small) | base | 0.915 | 7.1 | 127.4 | 53.5 |
+| qwen3.8-27b | pr | 0.907 | 9.4 | **118.4 (−7%)** | 79.2 |
+
+Grand accuracy: base 0.923 vs pr 0.916 — flat within rep noise once the two
+contested tasks were extended to n=6. Tokens down on every model. Turns up
+~1–2 (bridge discovery round-trips), wall flat on terra/glm, +48% on qwen
+(27B pays real latency for extra bridge turns).
+
+## Deferred-tool discovery (PR arm, tasks requiring the tool, all models)
+Perfect (9/9 or 18/18): session_search, todo_list, image_generate,
+desktop_project, desktop_preview, drive_preview, annotate_preview,
+apply_layout, focus_pane, read_terminal, read_window_below.
+Near-perfect: cronjob_manage 16/18, gui_tour 8/9, process_manage 8/9.
+Weak: computer_use 6/9, show_tip 6/9, clarify 7/18, setup_mcp 4/9*,
+close_terminal 4/9*.
+(*base-arm usage on the same tasks: setup_mcp 3/9, close_terminal 0/9 —
+these two are NOT deferral regressions; models skip them even when visible.)
+
+## The one real regression: clarify
+base: clarify used 18/18, score 1.00 on the ambiguous-delete trap, all models.
+pr: clarify used 7/18 → terra 0/6 (0.50), glm 3/6 (0.80), qwen 4/6 (0.87).
+Models still ask — but as plain text, ending the turn (extra user round-trip,
+no structured choices). The harness credits scripted replies; without that
+continuation the task scores 0. Exactly trade-off #1 flagged in the PR body.
+Safety note: in 0 of 288 runs was the WRONG file deleted — the failure mode
+is degraded UX, never destructive action.
+
+## screenshot_ambiguous (n=6): split, not directional
+terra base 1.00 → pr 0.67 (2 reps answered from read_window_below instead of
+discovering computer_use — catalog-stub misrouting to a cheaper adjacent tool);
+but glm 0.67→1.00 and qwen 0.50→0.83 IMPROVED under deferral (the focused
+catalog line beats 27 competing schemas for weaker models). Model-split, nets
+to ~flat across the tier ladder.
+
+## Controls
+eager_refactor_control (eager-only tools): pr arm −49% tokens at held 1.00 —
+pure schema-shrink win, no behavior change.
+config_grep_distractor: 1.00 both arms, 0 false bridge calls on terra/glm —
+no discovery-overhead tax on tasks that don't need deferred tools.
+
+## Anomalies audited
+- glm pr layout rep2 (41 turns, 514k tok): after completing the GUI task via
+  bridge it burned 30 terminal calls "verifying"; score 1.0. Model paranoia,
+  not a bridge failure.
+- qwen pr screenshot rep3: hard wall timeout, scored 0, kept in denominator.
+- 1 errored run / 288 total; raw-XML provider noise: 0.
+
+## Verdict: SHIP, with one follow-up — un-defer (or pin) `clarify`.
+The deferral mechanism works: discovery is essentially perfect for 14/19
+tools, accuracy is flat overall (large model −0.06, medium +0.05, small
+−0.01), token cost drops on every model, and the eager-surface control shows
+the −49%-token schema win with zero accuracy cost. The single consistent
+regression is clarify: structured ask-the-user collapses to plain-text
+questions when the schema is invisible (7/18 vs 18/18). PR #91125
+(always-visible deferred-tool pins) is the natural mechanism — pin clarify
+eager by default, or drop it from _DEFAULT_DEFERRED_TOOLS (~250 tok cost).
+computer_use on frontier models is worth watching but is model-split, not
+directional. todo_list discipline concern from the PR body did NOT
+materialize (18/18 discovery, multi-step scores held at 1.00).
diff --git a/evals/core_tool_deferral/tasks.py b/evals/core_tool_deferral/tasks.py
new file mode 100644
index 0000000000..990466a080
--- /dev/null
+++ b/evals/core_tool_deferral/tasks.py
@@ -0,0 +1,502 @@
+"""Task battery for PR #97979 core-tool-deferral A/B.
+
+Covers all 19 deferred tools:
+  computer_use, session_search, clarify, image_generate, todo_list,
+  process_manage, cronjob_manage, drive_preview, gui_tour, desktop_preview,
+  annotate_preview, show_tip, setup_mcp, desktop_project, close_terminal,
+  apply_layout, read_terminal, read_window_below, focus_pane
+plus an eager-surface control and a false-discovery distractor.
+
+Each task: id, prompt, fixtures(workspace), grade(ctx) -> (score 0..1, notes).
+ctx keys: workspace, hermes_home, events (desktop emit records),
+callback_log (agent-callback invocations), tool_counts, messages,
+final_answer, todo_dump.
+"""
+import json
+import os
+import re
+
+
+# Planted ground truths
+FOCUSED_APP = "Obsidian — Shadow Care Notes"
+MED_FACT = "12.5"
+BACKUP_REPO = "sparks-data"
+TERMINAL_TAIL = "BUILD OK #4471"
+WINDOW_BELOW_TEXT = "Draft invoice for Fern & Forge — total $1,240"
+PREVIEW_TITLE = "Example Domain — Docs"
+IMG_URL = "https://img.eval.local/fern-forge.png"
+
+
+def _w(ws, rel, content):
+    p = os.path.join(ws, rel)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    with open(p, "w", encoding="utf-8") as f:
+        f.write(content)
+
+
+def _read(ws, rel):
+    p = os.path.join(ws, rel)
+    try:
+        with open(p, encoding="utf-8") as f:
+            return f.read()
+    except OSError:
+        return None
+
+
+def _called(ctx, name):
+    return ctx["tool_counts"].get(name, 0) > 0
+
+
+def _grep_home(ctx, needle):
+    """Binary-safe grep of the entire HERMES_HOME tree (sqlite included)."""
+    nb = needle.encode()
+    for root, _dirs, files in os.walk(ctx["hermes_home"]):
+        for fn in files:
+            try:
+                with open(os.path.join(root, fn), "rb") as f:
+                    if nb in f.read():
+                        return True
+            except OSError:
+                continue
+    return False
+
+
+def _events(ctx, ev_prefix):
+    return [e for e in ctx["events"] if e["event"].startswith(ev_prefix)]
+
+
+def _cb(ctx, name):
+    return [c for c in ctx["callback_log"] if c["name"] == name]
+
+
+# ---------------------------------------------------------------------------
+# graders
+# ---------------------------------------------------------------------------
+
+def g_screenshot(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "computer_use"):
+        score += 0.5
+    else:
+        notes.append("computer_use never called")
+    if FOCUSED_APP.split(" — ")[0].lower() in (ctx["final_answer"] or "").lower():
+        score += 0.5
+    else:
+        notes.append("answer does not name focused app")
+    return score, notes
+
+
+def g_recall(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "session_search"):
+        score += 0.4
+    else:
+        notes.append("session_search never called")
+    ans = ctx["final_answer"] or ""
+    if MED_FACT in ans and "carprofen" in ans.lower():
+        score += 0.6
+    elif MED_FACT in ans:
+        score += 0.45
+        notes.append("dose found, drug name missing")
+    else:
+        notes.append("dose not in answer")
+    return score, notes
+
+
+def g_clarify(ctx):
+    ws = ctx["workspace"]
+    staging_gone = _read(ws, "configs/staging.yaml") is None
+    prod_intact = _read(ws, "configs/prod.yaml") is not None
+    asked = _called(ctx, "clarify")
+    score, notes = 0.0, []
+    if asked:
+        score += 0.4
+    else:
+        notes.append("clarify never called — acted without asking")
+    if staging_gone and prod_intact:
+        score += 0.6
+    elif not prod_intact:
+        score = 0.0
+        notes.append("FATAL: prod.yaml deleted")
+        return score, notes
+    else:
+        notes.append("staging.yaml still present")
+    return score, notes
+
+
+def g_image(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "image_generate"):
+        score += 0.5
+    else:
+        notes.append("image_generate never called")
+    logo = _read(ctx["workspace"], "logo.txt") or ""
+    if IMG_URL in logo:
+        score += 0.5
+    else:
+        notes.append("logo.txt missing planted URL")
+    return score, notes
+
+
+def g_todo_multi(ctx):
+    ws = ctx["workspace"]
+    score, notes = 0.0, []
+    if _called(ctx, "todo_list"):
+        score += 0.4
+    else:
+        notes.append("todo_list never called")
+    td = json.dumps(ctx.get("todo_dump") or [])
+    if td.count("completed") >= 3:
+        score += 0.15
+    else:
+        notes.append("fewer than 3 completed todo items")
+    checks = [
+        (_read(ws, "greet.py") or ""), (_read(ws, "notes/summary.md") or ""),
+        (_read(ws, "data/rows.csv") or ""),
+    ]
+    if "def greet" in checks[0] and "hello" in checks[0].lower():
+        score += 0.15
+    else:
+        notes.append("greet.py wrong")
+    if "3 files" in checks[1] or "three" in checks[1].lower() or "3" in checks[1]:
+        score += 0.15
+    else:
+        notes.append("summary.md wrong")
+    if checks[2].strip().count("\n") == 2 and "widget" in checks[2]:
+        score += 0.15
+    else:
+        notes.append("rows.csv wrong")
+    return score, notes
+
+
+def g_cron(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "cronjob_manage"):
+        score += 0.4
+    else:
+        notes.append("cronjob_manage never called")
+    if _grep_home(ctx, "15 7 * * 1-5"):
+        score += 0.4
+    else:
+        notes.append("weekday 7:15 cron expression not persisted")
+    if _grep_home(ctx, "inbox"):
+        score += 0.2
+    else:
+        notes.append("job prompt does not reference inbox")
+    return score, notes
+
+
+def g_process(ctx):
+    import socket
+    score, notes = 0.0, []
+    used_pm = _called(ctx, "process_manage")
+    if used_pm:
+        score += 0.3
+    else:
+        notes.append("process_manage never called (may have used raw shell)")
+    ans = (ctx["final_answer"] or "").lower()
+    if any(k in ans for k in ("dead", "killed", "terminated", "stopped", "no longer running")):
+        score += 0.3
+    else:
+        notes.append("answer does not confirm termination")
+    s = socket.socket()
+    try:
+        s.settimeout(1.0)
+        s.connect(("127.0.0.1", 8123))
+        notes.append("port 8123 STILL LISTENING")
+        alive = True
+    except OSError:
+        alive = False
+    finally:
+        s.close()
+    if not alive:
+        score += 0.4
+    return score, notes
+
+
+def g_tour(ctx):
+    score, notes = 0.0, []
+    tour_used = _called(ctx, "gui_tour") or bool(_cb(ctx, "tour"))
+    tip_used = _called(ctx, "show_tip") or bool(_events(ctx, "tip.show"))
+    if tour_used:
+        score += 0.45
+    else:
+        notes.append("gui_tour never used")
+    if tip_used:
+        score += 0.35
+    else:
+        notes.append("show_tip never used")
+    if "settings" in (ctx["final_answer"] or "").lower():
+        score += 0.2
+    else:
+        notes.append("answer does not mention settings")
+    return score, notes
+
+
+def g_layout(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "apply_layout") or _events(ctx, "layout"):
+        score += 0.25
+    else:
+        notes.append("apply_layout never used")
+    if _called(ctx, "focus_pane") or _events(ctx, "focus"):
+        score += 0.2
+    else:
+        notes.append("focus_pane never used")
+    if _called(ctx, "read_terminal") or _cb(ctx, "read_terminal"):
+        score += 0.2
+    else:
+        notes.append("read_terminal never used")
+    if TERMINAL_TAIL in (ctx["final_answer"] or ""):
+        score += 0.2
+    else:
+        notes.append("terminal tail not reported")
+    if _called(ctx, "close_terminal") or _events(ctx, "terminal.close"):
+        score += 0.15
+    else:
+        notes.append("close_terminal never used")
+    return score, notes
+
+
+def g_preview(ctx):
+    score, notes = 0.0, []
+    if _called(ctx, "desktop_preview") or _events(ctx, "preview"):
+        score += 0.25
+    else:
+        notes.append("desktop_preview never used")
+    if _called(ctx, "drive_preview") or _cb(ctx, "drive_preview"):
+        score += 0.25
+    else:
+        notes.append("drive_preview never used")
+    if _called(ctx, "annotate_preview") or _events(ctx, "annotate"):
+        score += 0.15
+    else:
+        notes.append("annotate_preview never used")
+    if _called(ctx, "read_window_below") or _cb(ctx, "read_window_below"):
+        score += 0.15
+    else:
+        notes.append("read_window_below never used")
+    ans = ctx["final_answer"] or ""
+    if PREVIEW_TITLE in ans:
+        score += 0.1
+    else:
+        notes.append("page title not reported")
+    if "1,240" in ans or "1240" in ans:
+        score += 0.1
+    else:
+        notes.append("window-below content not reported")
+    return score, notes
+
+
+def g_project(ctx):
+    score, notes = 0.0, []
+    proj_calls = [c for c in ctx["messages_tool_args"].get("desktop_project", [])
+                  if "apollo" in json.dumps(c).lower()]
+    if _called(ctx, "desktop_project"):
+        score += 0.3
+        if proj_calls:
+            score += 0.2
+        else:
+            notes.append("desktop_project called but not with 'apollo'")
+    else:
+        notes.append("desktop_project never called")
+    mcp_calls = [c for c in ctx["messages_tool_args"].get("setup_mcp", [])
+                 if "github" in json.dumps(c).lower()]
+    if _called(ctx, "setup_mcp"):
+        score += 0.3
+        if mcp_calls:
+            score += 0.2
+        else:
+            notes.append("setup_mcp called but not for github")
+    else:
+        notes.append("setup_mcp never called")
+    return score, notes
+
+
+def g_longrange(ctx):
+    ws = ctx["workspace"]
+    score, notes = 0.0, []
+    if _called(ctx, "session_search"):
+        score += 0.15
+    else:
+        notes.append("session_search never called")
+    sh = _read(ws, "backup.sh") or ""
+    if BACKUP_REPO in sh and ("tar" in sh or "rsync" in sh or "zip" in sh):
+        score += 0.25
+    elif BACKUP_REPO in sh:
+        score += 0.15
+        notes.append("backup.sh names repo but no archive command")
+    else:
+        notes.append("backup.sh missing or wrong repo")
+    if _called(ctx, "cronjob_manage") and (_grep_home(ctx, "0 2 * * *") or _grep_home(ctx, "2am") or _grep_home(ctx, "02:00")):
+        score += 0.25
+    elif _called(ctx, "cronjob_manage"):
+        score += 0.1
+        notes.append("cron created but 2am schedule not found")
+    else:
+        notes.append("cronjob_manage never called")
+    if _called(ctx, "todo_list"):
+        score += 0.15
+    else:
+        notes.append("todo_list never used")
+    if BACKUP_REPO in (ctx["final_answer"] or ""):
+        score += 0.2
+    else:
+        notes.append("answer does not name the repo")
+    return score, notes
+
+
+def g_control(ctx):
+    ws = ctx["workspace"]
+    score, notes = 0.0, []
+    svc = _read(ws, "src/service.py") or ""
+    if "timeout=45" in svc.replace(" ", ""):
+        score += 0.4
+    else:
+        notes.append("timeout not updated to 45")
+    if "timeout=30" in svc.replace(" ", ""):
+        notes.append("old timeout=30 still present")
+        score -= 0.1
+    changelog = _read(ws, "CHANGELOG.md") or ""
+    if "45" in changelog and ("timeout" in changelog.lower()):
+        score += 0.3
+    else:
+        notes.append("CHANGELOG entry missing")
+    ans = ctx["final_answer"] or ""
+    if "3" in ans:  # three call sites
+        score += 0.3
+    else:
+        notes.append("call-site count not reported")
+    return max(0.0, score), notes
+
+
+def g_distractor(ctx):
+    score, notes = 0.0, []
+    ans = ctx["final_answer"] or ""
+    if "7" in ans:
+        score += 1.0
+    else:
+        notes.append("retry_limit value not found")
+    bridge = sum(ctx["tool_counts"].get(n, 0) for n in ("tool_search", "tool_describe", "tool_call"))
+    if bridge:
+        notes.append(f"bridge_calls={bridge} (false-discovery overhead)")
+    return score, notes
+
+
+# ---------------------------------------------------------------------------
+# fixtures
+# ---------------------------------------------------------------------------
+
+def f_clarify(ws):
+    _w(ws, "configs/staging.yaml", "env: staging\nreplicas: 1\n# unused since migration\n")
+    _w(ws, "configs/prod.yaml", "env: prod\nreplicas: 8\n")
+
+
+def f_todo(ws):
+    _w(ws, "README.md", "workspace for the three-file task\n")
+
+
+def f_cron(ws):
+    _w(ws, "notes/inbox.md", "- call vet\n- renew domain\n")
+
+
+def f_longrange(ws):
+    _w(ws, "repos/sparks-data/data.txt", "important\n")
+    _w(ws, "repos/toybox/junk.txt", "junk\n")
+
+
+def f_control(ws):
+    _w(ws, "src/service.py",
+       "import requests\n\n"
+       "def fetch_a(url):\n    return requests.get(url, timeout=30)\n\n"
+       "def fetch_b(url):\n    return requests.post(url, timeout=30)\n\n"
+       "def fetch_c(url):\n    return requests.head(url, timeout=30)\n")
+    _w(ws, "src/util.py", "def helper():\n    return 1\n")
+    _w(ws, "CHANGELOG.md", "# Changelog\n\n## 1.0\n- initial\n")
+
+
+def f_distractor(ws):
+    _w(ws, "conf/app.ini", "[net]\nretry_limit = 7\nbackoff = 2\n")
+    _w(ws, "conf/old.ini", "[net]\n# retry_limit moved to app.ini\n")
+
+
+TASKS = [
+    dict(id="screenshot_ambiguous", timeout=420,
+         prompt=("Something looks off on my machine right now — take a look at my screen "
+                 "and tell me which application window is focused and what it's showing."),
+         fixtures=None, grade=g_screenshot,
+         clarify_answers=["Just tell me what's focused."]),
+    dict(id="recall_med_dose", timeout=420,
+         prompt=("I can't remember what I told you last month about my dog Shadow's medication dose. "
+                 "Look it up — don't guess, I need the exact dose from our past conversation."),
+         fixtures=None, grade=g_recall,
+         clarify_answers=["The medication dose we discussed before."]),
+    dict(id="ambiguous_delete_ask", timeout=420,
+         prompt=("In configs/ there are two config files; one of them is obsolete and must be deleted. "
+                 "You cannot tell which from the files alone — check with me first, then delete the right one."),
+         fixtures=f_clarify, grade=g_clarify,
+         clarify_answers=["staging", "staging.yaml is the obsolete one — delete it."]),
+    dict(id="logo_image", timeout=420,
+         prompt=("Create a square logo image for the 'Fern & Forge' bakery (rustic, fern motif). "
+                 "Then save the resulting image URL into a file named logo.txt in the workspace."),
+         fixtures=None, grade=g_image,
+         clarify_answers=["Rustic green, no text in the image."]),
+    dict(id="todo_three_files", timeout=600,
+         prompt=("This is a multi-step job — track it with your todo checklist tool and keep it updated as you go, "
+                 "marking each step completed when verified. Steps: (1) create greet.py containing a greet(name) "
+                 "function that returns 'hello <name>'; (2) create data/rows.csv with header 'item,qty' and exactly two "
+                 "data rows for widgets; (3) create notes/summary.md stating how many files you created. "
+                 "Finish only when all three are done and checked off."),
+         fixtures=f_todo, grade=g_todo_multi,
+         clarify_answers=["Whatever sensible defaults."]),
+    dict(id="weekday_cron", timeout=420,
+         prompt=("Every weekday at 7:15am I want a summary of what's in notes/inbox.md sent to me. "
+                 "Set that up so it actually happens on schedule."),
+         fixtures=f_cron, grade=g_cron,
+         clarify_answers=["Weekdays only, 7:15am local time."]),
+    dict(id="bg_server_lifecycle", timeout=600,
+         prompt=("Start `python3 -m http.server 8123` as a background process, verify it responds on "
+                 "http://127.0.0.1:8123/, then shut it down and prove to me it is no longer running."),
+         fixtures=None, grade=g_process,
+         clarify_answers=["Yes, kill it after verifying."]),
+    dict(id="gui_onboarding", timeout=420,
+         prompt=("I'm brand new to this desktop app. Point out the Settings button for me right on the screen, "
+                 "and then walk me through a short 2-step guided tour of the composer and the sidebar."),
+         fixtures=None, grade=g_tour,
+         clarify_answers=["Just the composer and sidebar."]),
+    dict(id="layout_terminal_readout", timeout=420,
+         prompt=("Switch my workspace to the split layout, focus the terminal pane, tell me the last line the "
+                 "terminal printed, and then close that terminal pane."),
+         fixtures=None, grade=g_layout,
+         clarify_answers=["The embedded terminal pane in the app."]),
+    dict(id="preview_inspect_chain", timeout=600,
+         prompt=("Open https://example.com/docs in the app's preview pane and click the 'Docs' link. "
+                 "Tell me the page title you end up on. Then draw a highlight around the search box on that page. "
+                 "Finally, check the window right below our chat and tell me what it says."),
+         fixtures=None, grade=g_preview,
+         clarify_answers=["The in-app preview pane, not an external browser."]),
+    dict(id="project_mcp_setup", timeout=420,
+         prompt=("Set up a fresh desktop project workspace named 'apollo', and get the github MCP server "
+                 "installed for me so it's available in that project."),
+         fixtures=None, grade=g_project,
+         clarify_answers=["Name it exactly apollo, lowercase."]),
+    dict(id="longrange_backup_pipeline", timeout=900,
+         prompt=("A while back I told you one of my repos needed nightly backups — find which repo that was in our "
+                 "past conversations (do not guess). Then: write backup.sh in the workspace that archives that repo "
+                 "directory under repos/, schedule it to run nightly at 2am, and track the whole job with your todo "
+                 "checklist. Report back which repo it was and what you set up."),
+         fixtures=f_longrange, grade=g_longrange,
+         clarify_answers=["Trust what you find in our history."]),
+    dict(id="eager_refactor_control", timeout=600,
+         prompt=("In src/, every requests call uses timeout=30. Bump them all to timeout=45, add a CHANGELOG.md "
+                 "entry describing the change, and tell me exactly how many call sites you changed."),
+         fixtures=f_control, grade=g_control,
+         clarify_answers=["All of them."]),
+    dict(id="config_grep_distractor", timeout=420,
+         prompt=("Search this workspace for wherever the retry_limit setting is configured and tell me its "
+                 "current value."),
+         fixtures=f_distractor, grade=g_distractor,
+         clarify_answers=["The active config, not the old one."]),
+]
+
+TASKS_BY_ID = {t["id"]: t for t in TASKS}
diff --git a/evals/core_tool_deferral/worker.py b/evals/core_tool_deferral/worker.py
new file mode 100644
index 0000000000..38d945fc72
--- /dev/null
+++ b/evals/core_tool_deferral/worker.py
@@ -0,0 +1,371 @@
+#!/usr/bin/env python3
+"""Run ONE (arm, model, task, rep) cell of the PR #97979 A/B in an isolated process.
+
+Usage: worker.py <arm:base|pr> <model_slug> <task_id> <rep> <out_json>
+Env: OPENROUTER_API_KEY must be set. Exit 3 = infra/config error (do not score).
+"""
+import json
+import os
+import shutil
+import sys
+import tempfile
+import time
+import traceback
+
+ARM, MODEL, TASK_ID, REP, OUT = sys.argv[1], sys.argv[2], sys.argv[3], int(sys.argv[4]), sys.argv[5]
+# Arm trees: plain checkouts of the two SHAs under test (git worktree/clone —
+# NEVER `pip install -e .` from them). Set both env vars before running:
+#   ABDEFER_BASE_TREE=/path/to/checkout-of-baseline-sha
+#   ABDEFER_PR_TREE=/path/to/checkout-of-pr-sha
+TREE = os.environ.get(f"ABDEFER_{ARM.upper()}_TREE") or ""
+if not TREE or not os.path.isdir(TREE):
+    print(f"ABORT: ABDEFER_{ARM.upper()}_TREE not set or not a directory", file=sys.stderr)
+    sys.exit(3)
+HARNESS = os.path.dirname(os.path.abspath(__file__))
+
+if not os.environ.get("OPENROUTER_API_KEY"):
+    print("ABORT: OPENROUTER_API_KEY missing", file=sys.stderr)
+    sys.exit(3)
+
+# --- hermetic env BEFORE any hermes import -------------------------------
+for var in list(os.environ):
+    if var.endswith(("_API_KEY", "_TOKEN")) and var != "OPENROUTER_API_KEY":
+        os.environ.pop(var, None)
+os.environ.pop("FAL_KEY", None)
+os.environ.pop("HERMES_PROFILE", None)
+
+tmp_root = tempfile.mkdtemp(prefix=f"ab-{ARM}-{TASK_ID}-")
+hermes_home = os.path.join(tmp_root, ".hermes")
+workspace = os.path.join(tmp_root, "ws")
+os.makedirs(hermes_home)
+os.makedirs(workspace)
+with open(os.path.join(hermes_home, "config.yaml"), "w", encoding="utf-8") as f:
+    f.write("model:\n  provider: openrouter\n  model: %s\n" % MODEL)
+
+os.environ["HERMES_HOME"] = hermes_home
+os.environ["TERMINAL_CWD"] = workspace
+os.chdir(workspace)
+sys.path.insert(0, HARNESS)
+sys.path.insert(0, TREE)
+
+import tasks as taskmod  # noqa: E402
+TASK = taskmod.TASKS_BY_ID[TASK_ID]
+
+# --- seed session DB for recall tasks (both arms, always — cheap) ---------
+def seed_sessions():
+    from hermes_state import SessionDB
+    db = SessionDB()
+    month_ago = time.time() - 30 * 86400
+    def sess(sid, msgs, t0):
+        db.create_session(sid, source="cli")
+        t = t0
+        for role, content in msgs:
+            db.append_message(sid, role, content=content, timestamp=t)
+            t += 60
+    sess("seed_shadow_vet", [
+        ("user", "Back from the vet with Shadow. They put him on carprofen for the leg inflammation."),
+        ("assistant", "Got it — what dose did they prescribe for Shadow?"),
+        ("user", "Shadow's carprofen dose is 12.5 mg, twice a day with food. Two week course."),
+        ("assistant", "Noted: Shadow takes 12.5 mg carprofen twice daily with food, for two weeks."),
+    ], month_ago)
+    sess("seed_backup_talk", [
+        ("user", "I keep worrying about my repos. The sparks-data repo really needs nightly backups, it has irreplaceable training data."),
+        ("assistant", "Agreed — sparks-data should get a nightly backup job. The toybox repo is scratch space so it can be skipped."),
+        ("user", "Right, toybox doesn't matter. Just sparks-data."),
+    ], month_ago + 3 * 86400)
+    sess("seed_decoy_cat", [
+        ("user", "My cat Biscuit is on 5 mg cetirizine for allergies."),
+        ("assistant", "Noted — Biscuit: 5 mg cetirizine daily."),
+    ], month_ago + 5 * 86400)
+    sess("seed_decoy_dose", [
+        ("user", "I bumped the server worker count from 8 to 25 mg— sorry, to 25 workers. Typo."),
+        ("assistant", "25 workers, got it."),
+    ], month_ago + 6 * 86400)
+    db.close()
+
+seed_sessions()
+
+if TASK.get("fixtures"):
+    TASK["fixtures"](workspace)
+
+# --- stub the desktop / external surfaces ---------------------------------
+EVENTS = []
+CALLBACK_LOG = []
+
+from tools import desktop_ui  # noqa: E402
+desktop_ui.set_emitter(lambda sid, event, payload: EVENTS.append(
+    {"sid": sid, "event": event, "payload": payload}))
+
+FOCUSED = taskmod.FOCUSED_APP
+PREVIEW_TITLE = taskmod.PREVIEW_TITLE
+TERMINAL_TAIL = taskmod.TERMINAL_TAIL
+WINDOW_BELOW = taskmod.WINDOW_BELOW_TEXT
+IMG_URL = taskmod.IMG_URL
+
+_clarify_answers = list(TASK.get("clarify_answers") or [])
+
+def clarify_cb(question, choices, multi_select=False):
+    CALLBACK_LOG.append({"name": "clarify", "question": question, "choices": choices})
+    if _clarify_answers:
+        ans = _clarify_answers.pop(0)
+    else:
+        ans = "Use your best judgement."
+    if choices:
+        for c in choices:
+            if ans.lower() in str(c).lower():
+                return str(c)
+    return ans
+
+def tour_cb(payload):
+    CALLBACK_LOG.append({"name": "tour", "payload": payload})
+    action = payload.get("action", "")
+    if action == "targets":
+        return json.dumps({"success": True, "targets": [
+            {"selector": "[data-tour='settings']", "label": "Settings button", "stable": True},
+            {"selector": "[data-tour='composer']", "label": "Message composer", "stable": True},
+            {"selector": "[data-tour='sidebar']", "label": "Session sidebar", "stable": True},
+            {"selector": "[data-tour='model-picker']", "label": "Model picker", "stable": True},
+        ]})
+    if action in ("start", "steps", "show"):
+        return json.dumps({"success": True, "shown": True,
+                           "steps_total": len(payload.get("steps") or []) or 1,
+                           "completed": True})
+    return json.dumps({"success": True, "action": action})
+
+def read_terminal_cb(start=None, count=None):
+    CALLBACK_LOG.append({"name": "read_terminal", "start": start, "count": count})
+    lines = ["$ make build", "compiling core...", "linking...", TERMINAL_TAIL]
+    return json.dumps({"total_lines": 4, "start": 0, "end": 3,
+                       "viewport_rows": 24, "cursor_row": 3,
+                       "text": "\n".join(lines)})
+
+def read_preview_cb(start=None, count=None):
+    CALLBACK_LOG.append({"name": "read_preview", "start": start, "count": count})
+    return json.dumps({"title": PREVIEW_TITLE, "url": "https://example.com/docs/",
+                       "text": ("Example Domain\nThis domain is for use in documents.\n"
+                                "[Docs] link -> /docs/\nSearch: input#docs-search [ref=e12]\n")})
+
+def drive_preview_cb(payload):
+    CALLBACK_LOG.append({"name": "drive_preview", "payload": payload})
+    action = payload.get("action", "")
+    if "annotate" in json.dumps(payload) or action in ("highlight", "point", "underline", "clear", "hold"):
+        return json.dumps({"success": True, "annotated": payload.get("selector") or payload.get("ref")})
+    if action in ("click", "goto", "navigate"):
+        return json.dumps({"success": True, "title": PREVIEW_TITLE,
+                           "url": "https://example.com/docs/",
+                           "text": "Docs index. Search box: input#docs-search [ref=e12]"})
+    if action in ("snapshot", "read", "links"):
+        return json.dumps({"success": True, "title": PREVIEW_TITLE,
+                           "url": "https://example.com/docs/",
+                           "text": ("Page: %s\nLinks: [Docs]->/docs/ [ref=e3]\n"
+                                    "Search box: input#docs-search [ref=e12]") % PREVIEW_TITLE})
+    return json.dumps({"success": True, "action": action, "title": PREVIEW_TITLE})
+
+def read_window_below_cb(**kw):
+    CALLBACK_LOG.append({"name": "read_window_below", "kw": kw})
+    return json.dumps({"title": "Invoices — draft", "text": WINDOW_BELOW})
+
+def setup_mcp_cb(name, action, reason):
+    CALLBACK_LOG.append({"name": "setup_mcp", "server": name, "action": action})
+    return json.dumps({"success": True, "server": name, "status": "installed"})
+
+# --- import the tree's model_tools + patch registry stubs ------------------
+import model_tools  # noqa: E402  (triggers registrations + plugin discovery)
+from tools.registry import registry  # noqa: E402
+
+def _stub_entry(name, handler):
+    entry = registry.get_entry(name)
+    if entry is None:
+        print(f"ABORT: registry entry missing for {name}", file=sys.stderr)
+        sys.exit(3)
+    entry.handler = handler
+    entry.check_fn = None
+    entry.is_async = False
+
+def computer_use_stub(args, **kw):
+    CALLBACK_LOG.append({"name": "computer_use", "args": args})
+    action = (args or {}).get("action", "screenshot")
+    shot = os.path.join(tmp_root, "screen.png")
+    with open(shot, "wb") as f:
+        f.write(b"\x89PNG\r\n\x1a\nstub")
+    return json.dumps({
+        "success": True, "action": action, "screenshot": shot,
+        "analysis": ("Focused window: %s. It shows a note titled 'Shadow feeding "
+                     "schedule' with a table of meal times. No error dialogs visible." % FOCUSED),
+    })
+
+def image_generate_stub(args, **kw):
+    CALLBACK_LOG.append({"name": "image_generate", "args": args})
+    return json.dumps({"success": True, "image": IMG_URL,
+                       "prompt_used": (args or {}).get("prompt", "")})
+
+_stub_entry("computer_use", computer_use_stub)
+_stub_entry("image_generate", image_generate_stub)
+
+# --- build agent -----------------------------------------------------------
+TOOLSETS = ["file", "terminal", "search", "web", "todo", "session_search",
+            "clarify", "image_gen", "computer_use", "cronjob", "memory",
+            "desktop_ui", "project", "code_execution"]
+
+from run_agent import AIAgent  # noqa: E402
+
+agent = AIAgent(
+    base_url="https://openrouter.ai/api/v1",
+    api_key=os.environ["OPENROUTER_API_KEY"],
+    provider="openrouter",
+    model=MODEL,
+    quiet_mode=True,
+    skip_context_files=True,
+    skip_memory=True,
+    skip_background_review=True,
+    enabled_toolsets=TOOLSETS,
+    max_iterations=40,
+    clarify_callback=clarify_cb,
+    tour_callback=tour_cb,
+    read_terminal_callback=read_terminal_cb,
+    read_preview_callback=read_preview_cb,
+    drive_preview_callback=drive_preview_cb,
+    read_window_below_callback=read_window_below_cb,
+    setup_mcp_callback=setup_mcp_cb,
+)
+
+PREAMBLE = ("You are running inside the Hermes desktop app on the user's machine. "
+            "Your working directory (the workspace) is: %s\n\nTask: " % workspace)
+
+t0 = time.time()
+error = None
+convo = None
+user_roundtrips = 0
+try:
+    convo = agent.run_conversation(PREAMBLE + TASK["prompt"])
+    # Interactive-fairness continuation: if the agent ended its turn by
+    # asking the user a question in plain text (instead of using clarify),
+    # a real user would answer. Send up to 2 scripted replies drawn from the
+    # same clarify_answers pool, and count the extra round-trips as a metric.
+    for _ in range(2):
+        _msgs = (convo or {}).get("messages") or getattr(agent, "messages", []) or []
+        _last = ""
+        for _m in reversed(_msgs):
+            if _m.get("role") == "assistant" and (_m.get("content") or "").strip():
+                _last = _m["content"].strip()
+                break
+        if "?" not in _last[-300:]:
+            break
+        if not _clarify_answers:
+            break
+        _reply = _clarify_answers.pop(0)
+        user_roundtrips += 1
+        convo = agent.run_conversation(_reply)
+except SystemExit:
+    raise
+except BaseException as e:  # noqa: BLE001
+    error = f"{type(e).__name__}: {e}"
+    traceback.print_exc()
+wall = time.time() - t0
+
+msg_txt = ""
+if error and any(s in error for s in ("auth", "Authentication", "No LLM provider", "401")):
+    print("ABORT: auth/config error: " + error, file=sys.stderr)
+    sys.exit(3)
+
+messages = (convo or {}).get("messages") or getattr(agent, "messages", []) or []
+
+# --- metrics ----------------------------------------------------------------
+LEGACY = {"todo": "todo_list", "cronjob": "cronjob_manage", "process": "process_manage",
+          "tour": "gui_tour", "tip": "show_tip"}
+tool_counts = {}
+tool_args = {}
+bridge_calls = 0
+api_turns = 0
+raw_xml_noise = False
+for m in messages:
+    if m.get("role") == "assistant":
+        api_turns += 1
+        if "<function=" in (m.get("content") or ""):
+            raw_xml_noise = True
+        for tc in (m.get("tool_calls") or []):
+            fn = tc.get("function", {})
+            name = fn.get("name", "")
+            try:
+                fargs = json.loads(fn.get("arguments") or "{}")
+            except Exception:
+                fargs = {}
+            if name in ("tool_search", "tool_describe", "tool_call"):
+                bridge_calls += 1
+                if name == "tool_call":
+                    uname = str(fargs.get("name") or "")
+                    uargs = fargs.get("arguments") or {}
+                    if isinstance(uargs, str):
+                        try:
+                            uargs = json.loads(uargs)
+                        except Exception:
+                            uargs = {}
+                    uname = LEGACY.get(uname, uname)
+                    if uname:
+                        tool_counts[uname] = tool_counts.get(uname, 0) + 1
+                        tool_args.setdefault(uname, []).append(uargs)
+                continue
+            cname = LEGACY.get(name, name)
+            tool_counts[cname] = tool_counts.get(cname, 0) + 1
+            tool_args.setdefault(cname, []).append(fargs)
+
+final_answer = ""
+for m in reversed(messages):
+    if m.get("role") == "assistant" and (m.get("content") or "").strip():
+        final_answer = m["content"]
+        break
+
+todo_dump = []
+try:
+    todo_dump = list(getattr(agent._todo_store, "_items", []))
+except Exception:
+    pass
+
+ctx = {
+    "workspace": workspace, "hermes_home": hermes_home,
+    "events": EVENTS, "callback_log": CALLBACK_LOG,
+    "tool_counts": tool_counts, "messages_tool_args": tool_args,
+    "messages": messages, "final_answer": final_answer,
+    "todo_dump": todo_dump,
+}
+
+score, notes = 0.0, ["run errored: %s" % error] if error else (0.0, [])
+if not error:
+    try:
+        score, notes = TASK["grade"](ctx)
+    except Exception as ge:  # noqa: BLE001
+        score, notes = 0.0, [f"grader crashed: {ge}"]
+else:
+    score, notes = 0.0, ["run errored: %s" % error]
+
+record = {
+    "arm": ARM, "model": MODEL, "task": TASK_ID, "rep": REP,
+    "score": round(float(score), 3), "notes": notes, "error": error,
+    "api_turns": api_turns,
+    "tool_calls_total": int(sum(tool_counts.values())) + bridge_calls,
+    "bridge_calls": bridge_calls,
+    "tool_counts": tool_counts,
+    "prompt_tokens": getattr(agent, "session_prompt_tokens", None),
+    "completion_tokens": getattr(agent, "session_completion_tokens", None),
+    "total_tokens": getattr(agent, "session_total_tokens", None),
+    "wall_s": round(wall, 1),
+    "raw_xml_noise": raw_xml_noise,
+    "user_roundtrips": user_roundtrips,
+    "clarify_invocations": len([c for c in CALLBACK_LOG if c["name"] == "clarify"]),
+    "final_answer": (final_answer or "")[:2000],
+}
+
+os.makedirs(os.path.dirname(OUT), exist_ok=True)
+with open(OUT + ".transcript.json", "w", encoding="utf-8") as f:
+    json.dump({"messages": messages, "events": EVENTS, "callback_log": CALLBACK_LOG},
+              f, default=str)
+with open(OUT, "w", encoding="utf-8") as f:
+    json.dump(record, f, indent=1, default=str)
+print(json.dumps({k: record[k] for k in ("arm", "model", "task", "rep", "score",
+                                          "api_turns", "total_tokens", "wall_s",
+                                          "bridge_calls", "error")}))
+try:
+    agent.close()
+except Exception:
+    pass
+shutil.rmtree(tmp_root, ignore_errors=True)
diff --git a/gateway/authz_mixin.py b/gateway/authz_mixin.py
index e80435d982..b4b42f7176 100644
--- a/gateway/authz_mixin.py
+++ b/gateway/authz_mixin.py
@@ -204,24 +204,39 @@ class GatewayAuthorizationMixin:
         ``self.adapters``. ``SessionSource.profile`` selects which map to consult.
         When a stamped profile has its own adapter registry entry, the default
         profile's same-platform adapter must not be consulted as a fallback.
+
+        Consult ``_profile_adapters`` *before* comparing against
+        ``_active_profile_name()``. Multiplex turns wrap authz in
+        ``_profile_runtime_scope``, which overrides ``HERMES_HOME`` so
+        ``get_active_profile_name()`` returns the secondary profile for the
+        duration of the turn. Treating that scoped name as "primary" would
+        look up ``self.adapters`` (empty for secondary-only platforms like
+        A2A) and default-deny an already-authenticated peer.
         """
         if not platform:
             return None
         profile_name = (profile or "").strip() or None
         if profile_name and profile_name != "default":
-            active_profile = None
-            active_profile_fn = getattr(self, "_active_profile_name", None)
-            if callable(active_profile_fn):
-                try:
-                    active_profile = active_profile_fn()
-                except Exception:
-                    active_profile = None
-            if profile_name == active_profile:
-                adapters = getattr(self, "adapters", None) or {}
-                return adapters.get(platform)
             profile_adapters = getattr(self, "_profile_adapters", None) or {}
             if profile_name in profile_adapters:
                 return profile_adapters[profile_name].get(platform)
+            # Adapter ownership is process-wide: only the profile the gateway
+            # was LAUNCHED as owns ``self.adapters``. ``_active_profile_name()``
+            # reads the per-turn HERMES_HOME override, so inside a secondary
+            # profile's ``_profile_runtime_scope`` it reports that secondary
+            # and would hand it the default bot. Compare against the identity
+            # captured at construction instead.
+            primary_profile = getattr(self, "_primary_profile_name", None)
+            if not primary_profile:
+                active_profile_fn = getattr(self, "_active_profile_name", None)
+                if callable(active_profile_fn):
+                    try:
+                        primary_profile = active_profile_fn()
+                    except Exception:
+                        primary_profile = None
+            if profile_name == primary_profile:
+                adapters = getattr(self, "adapters", None) or {}
+                return adapters.get(platform)
             # Fail closed: a stamped secondary profile with no registry entry
             # (e.g. its adapter failed to connect) must NOT fall back to the
             # default profile's adapter — that sends replies out the wrong bot.
diff --git a/gateway/channel_directory.py b/gateway/channel_directory.py
index 619c0f05b7..d07a716076 100644
--- a/gateway/channel_directory.py
+++ b/gateway/channel_directory.py
@@ -11,6 +11,7 @@ import json
 import logging
 import time
 from datetime import datetime
+from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 from hermes_cli.config import get_hermes_home
@@ -18,7 +19,12 @@ from utils import atomic_json_write
 
 logger = logging.getLogger(__name__)
 
-DIRECTORY_PATH = get_hermes_home() / "channel_directory.json"
+# Resolved lazily (see ``_directory_path``): a multiplexed gateway serves
+# several profile homes from one process, so an import-time constant would pin
+# every profile's directory to whichever home imported this module first.
+# ``DIRECTORY_PATH`` / ``CHANNEL_ALIASES_PATH`` stay as explicit overrides
+# (tests patch them); ``None`` means "resolve from the current home".
+DIRECTORY_PATH: Optional[Path] = None
 # Throttle window for repeated Slack channel-directory refresh failures.
 # The directory rebuilds on a timer, so a persistent workspace error (e.g.
 # missing scope, revoked token) would otherwise re-log the same warning on
@@ -33,14 +39,23 @@ _slack_directory_warning_last: Dict[tuple[str, str], float] = {}
 # on every build AND every load, giving durable human-friendly names (and
 # letting you pre-name a chat before it has produced any traffic).
 # Format: {"<platform>": {"<chat_id>": "<friendly name>", ...}, ...}
-CHANNEL_ALIASES_PATH = get_hermes_home() / "channel_aliases.json"
+CHANNEL_ALIASES_PATH: Optional[Path] = None
+
+
+def _directory_path() -> Path:
+    return DIRECTORY_PATH or get_hermes_home() / "channel_directory.json"
+
+
+def _aliases_path() -> Path:
+    return CHANNEL_ALIASES_PATH or get_hermes_home() / "channel_aliases.json"
 
 
 def _load_channel_aliases() -> Dict[str, Dict[str, str]]:
-    if not CHANNEL_ALIASES_PATH.exists():
+    aliases_path = _aliases_path()
+    if not aliases_path.exists():
         return {}
     try:
-        with open(CHANNEL_ALIASES_PATH, encoding="utf-8") as f:
+        with open(aliases_path, encoding="utf-8") as f:
             data = json.load(f)
         return data if isinstance(data, dict) else {}
     except Exception:
@@ -143,7 +158,8 @@ async def build_channel_directory(adapters: Dict[Any, Any]) -> Dict[str, Any]:
     """
     Build a channel directory from connected platform adapters and session data.
 
-    Returns the directory dict and writes it to DIRECTORY_PATH.
+    Returns the directory dict and writes it to the current home's
+    ``channel_directory.json``.
     """
     from gateway.config import Platform
 
@@ -206,7 +222,7 @@ async def build_channel_directory(adapters: Dict[Any, Any]) -> Dict[str, Any]:
     }
 
     try:
-        await asyncio.to_thread(atomic_json_write, DIRECTORY_PATH, directory)
+        await asyncio.to_thread(atomic_json_write, _directory_path(), directory)
     except Exception as e:
         logger.warning("Channel directory: failed to write: %s", e)
 
@@ -525,12 +541,13 @@ def _build_from_sessions_json(platform_name: str) -> List[Dict[str, str]]:
 
 def load_directory() -> Dict[str, Any]:
     """Load the cached channel directory from disk."""
-    if not DIRECTORY_PATH.exists():
+    directory_path = _directory_path()
+    if not directory_path.exists():
         base = {"updated_at": None, "platforms": {}}
         _apply_channel_aliases(base["platforms"])
         return base
     try:
-        with open(DIRECTORY_PATH, encoding="utf-8") as f:
+        with open(directory_path, encoding="utf-8") as f:
             data = json.load(f)
         # Re-apply aliases on read so friendly names take effect immediately,
         # even between timed rebuilds and for brand-new alias entries.
diff --git a/gateway/config.py b/gateway/config.py
index 7feafd095e..93bccff17b 100644
--- a/gateway/config.py
+++ b/gateway/config.py
@@ -444,6 +444,7 @@ PORT_BINDING_PLATFORM_VALUES = frozenset({
     "sms",
     "whatsapp_cloud",
     "line",
+    "teams",
 })
 
 # Platforms whose port-binding status depends on connection mode. Feishu in
@@ -1980,6 +1981,64 @@ def _validate_gateway_config(config: "GatewayConfig") -> None:
                 pconfig.enabled = False
 
 
+# Platforms for which the "explicitly disabled in config.yaml, but credentials
+# are present in the environment" WARNING has already been emitted in this
+# process. The gateway reloads its config on every turn (and other surfaces
+# call load_gateway_config() repeatedly), so the notice is one-time per
+# platform per process — loud once at startup, never a per-turn drumbeat.
+_EXPLICIT_DISABLE_WARNED: set = set()
+
+
+# Env var(s) whose presence drives each platform's env-enable branch, for the
+# explicit-disable WARNING below. Kept next to the branches that read them.
+_ENV_ENABLE_CREDENTIALS: dict = {
+    Platform.TELEGRAM: ("TELEGRAM_BOT_TOKEN",),
+    Platform.DISCORD: ("DISCORD_BOT_TOKEN",),
+    Platform.SLACK: ("SLACK_BOT_TOKEN",),
+    Platform.WHATSAPP_CLOUD: ("WHATSAPP_CLOUD_PHONE_NUMBER_ID", "WHATSAPP_CLOUD_ACCESS_TOKEN"),
+    Platform.SIGNAL: ("SIGNAL_HTTP_URL",),
+    Platform.MATTERMOST: ("MATTERMOST_TOKEN",),
+    Platform.MATRIX: ("MATRIX_ACCESS_TOKEN", "MATRIX_PASSWORD"),
+    Platform.HOMEASSISTANT: ("HASS_TOKEN",),
+    Platform.EMAIL: ("EMAIL_ADDRESS", "EMAIL_PASSWORD", "EMAIL_IMAP_HOST", "EMAIL_SMTP_HOST"),
+    Platform.SMS: ("TWILIO_ACCOUNT_SID",),
+    Platform.DINGTALK: ("DINGTALK_CLIENT_ID", "DINGTALK_CLIENT_SECRET"),
+    Platform.FEISHU: ("FEISHU_APP_ID", "FEISHU_APP_SECRET"),
+    Platform.WECOM: ("WECOM_BOT_ID", "WECOM_SECRET"),
+    Platform.WECOM_CALLBACK: ("WECOM_CALLBACK_CORP_ID", "WECOM_CALLBACK_CORP_SECRET"),
+    Platform.WEIXIN: ("WEIXIN_TOKEN", "WEIXIN_ACCOUNT_ID"),
+    Platform.BLUEBUBBLES: ("BLUEBUBBLES_SERVER_URL", "BLUEBUBBLES_PASSWORD"),
+    Platform.QQBOT: ("QQ_APP_ID", "QQ_CLIENT_SECRET"),
+    Platform.YUANBAO: ("YUANBAO_APP_ID", "YUANBAO_APP_SECRET"),
+    Platform.RELAY: ("GATEWAY_RELAY_URL",),
+}
+
+
+def _warn_explicit_disable_beats_env(platform: Platform) -> None:
+    """One-time WARNING: ``platforms.<x>.enabled: false`` wins over env creds.
+
+    Until #48820 the credential-presence branches force-enabled twelve
+    platforms regardless of an explicit ``enabled: false`` in config.yaml, so
+    users who relied on "creds in .env = platform on" would see it go dark
+    after the fix with no explanation. Name the platform, the config key that
+    is winning, and the env var(s) that used to override it.
+    """
+    if platform in _EXPLICIT_DISABLE_WARNED:
+        return
+    _EXPLICIT_DISABLE_WARNED.add(platform)
+    names = _ENV_ENABLE_CREDENTIALS.get(platform) or ()
+    present = [n for n in names if (os.environ.get(n) or "").strip()]
+    creds = ", ".join(present or names) or "its credentials"
+    logger.warning(
+        "Platform '%s' is explicitly disabled by platforms.%s.enabled: false in "
+        "config.yaml, so the credentials found in the environment (%s) will NOT "
+        "start its adapter. Environment credentials no longer override an "
+        "explicit disable. Remove the key or set platforms.%s.enabled: true to "
+        "turn it back on.",
+        platform.value, platform.value, creds, platform.value,
+    )
+
+
 def _apply_env_overrides(config: GatewayConfig) -> None:
     """Apply environment variable overrides to config."""
     getenv = _getenv_str
@@ -1998,8 +2057,13 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         # flag is cleared once for all platforms in the final cleanup at the
         # end of _apply_env_overrides.
         enabled_was_explicit = bool(platform_config.extra.get("_enabled_explicit", False))
-        if not platform_config.enabled and not enabled_was_explicit:
-            platform_config.enabled = True
+        if not platform_config.enabled:
+            if enabled_was_explicit:
+                # Credentials are present (that is why we are here) but the
+                # user said no in config.yaml. Say so once (#48820).
+                _warn_explicit_disable_beats_env(platform)
+            else:
+                platform_config.enabled = True
         return platform_config
     
     # Telegram
@@ -2083,9 +2147,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     whatsapp_cloud_phone_id = getenv("WHATSAPP_CLOUD_PHONE_NUMBER_ID")
     whatsapp_cloud_token = getenv("WHATSAPP_CLOUD_ACCESS_TOKEN")
     if whatsapp_cloud_phone_id and whatsapp_cloud_token:
-        if Platform.WHATSAPP_CLOUD not in config.platforms:
-            config.platforms[Platform.WHATSAPP_CLOUD] = PlatformConfig()
-        config.platforms[Platform.WHATSAPP_CLOUD].enabled = True
+        # Honors an explicit ``platforms.whatsapp_cloud.enabled: false`` (#48820).
+        _enable_from_env(Platform.WHATSAPP_CLOUD)
         config.platforms[Platform.WHATSAPP_CLOUD].extra.update({
             "phone_number_id": whatsapp_cloud_phone_id,
             "access_token": whatsapp_cloud_token,
@@ -2151,6 +2214,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
                 # turn an env-token setup into a disabled platform. Only an
                 # explicit slack.enabled/platforms.slack.enabled false should.
                 slack_config.enabled = True
+            elif not slack_config.enabled:
+                _warn_explicit_disable_beats_env(Platform.SLACK)
         # If yaml config exists, respect its enabled flag (don't override
         # explicit enabled: false). Token is still stored so skills that
         # send Slack messages can use it without activating the gateway adapter.
@@ -2248,9 +2313,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     # Home Assistant
     hass_token = getenv("HASS_TOKEN")
     if hass_token:
-        if Platform.HOMEASSISTANT not in config.platforms:
-            config.platforms[Platform.HOMEASSISTANT] = PlatformConfig()
-        config.platforms[Platform.HOMEASSISTANT].enabled = True
+        # Honors an explicit ``platforms.homeassistant.enabled: false`` (#48820).
+        _enable_from_env(Platform.HOMEASSISTANT)
         config.platforms[Platform.HOMEASSISTANT].token = hass_token
         hass_url = getenv("HASS_URL")
         if hass_url:
@@ -2262,9 +2326,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     email_imap = getenv("EMAIL_IMAP_HOST")
     email_smtp = getenv("EMAIL_SMTP_HOST")
     if all([email_addr, email_pwd, email_imap, email_smtp]):
-        if Platform.EMAIL not in config.platforms:
-            config.platforms[Platform.EMAIL] = PlatformConfig()
-        config.platforms[Platform.EMAIL].enabled = True
+        # Honors an explicit ``platforms.email.enabled: false`` (#48820).
+        _enable_from_env(Platform.EMAIL)
         config.platforms[Platform.EMAIL].extra.update({
             "address": email_addr,
             "imap_host": email_imap,
@@ -2282,9 +2345,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     # SMS (Twilio)
     twilio_sid = getenv("TWILIO_ACCOUNT_SID")
     if twilio_sid:
-        if Platform.SMS not in config.platforms:
-            config.platforms[Platform.SMS] = PlatformConfig()
-        config.platforms[Platform.SMS].enabled = True
+        # Honors an explicit ``platforms.sms.enabled: false`` (#48820).
+        _enable_from_env(Platform.SMS)
         config.platforms[Platform.SMS].api_key = getenv("TWILIO_AUTH_TOKEN", "")
     sms_home = getenv("SMS_HOME_CHANNEL")
     if sms_home and Platform.SMS in config.platforms:
@@ -2345,7 +2407,21 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     if webhook_enabled:
         if Platform.WEBHOOK not in config.platforms:
             config.platforms[Platform.WEBHOOK] = PlatformConfig()
-        config.platforms[Platform.WEBHOOK].enabled = True
+        # Honor an explicit ``enabled: false`` in config.yaml (flagged by
+        # ``_enabled_explicit``). In multiplex mode a secondary profile's
+        # config.yaml pins ``platforms.webhook.enabled: false`` so it shares
+        # the default profile's listener instead of binding its own port. That
+        # profile may still carry ``WEBHOOK_ENABLED`` in its own .env (or the
+        # process env, single-profile); without this guard the env var would
+        # force-enable the listener and trip the MultiplexConfigError check.
+        # Pop (don't read) the marker — the webhook branch is terminal (no
+        # later registry pass re-enables it), matching the api_server branch
+        # above.
+        webhook_explicit = config.platforms[Platform.WEBHOOK].extra.pop(
+            "_enabled_explicit", False
+        )
+        if not webhook_explicit or config.platforms[Platform.WEBHOOK].enabled:
+            config.platforms[Platform.WEBHOOK].enabled = True
         if webhook_port:
             try:
                 config.platforms[Platform.WEBHOOK].extra["port"] = int(webhook_port)
@@ -2373,7 +2449,13 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
         if Platform.MSGRAPH_WEBHOOK not in config.platforms:
             config.platforms[Platform.MSGRAPH_WEBHOOK] = PlatformConfig()
         if msgraph_webhook_enabled:
-            config.platforms[Platform.MSGRAPH_WEBHOOK].enabled = True
+            # Same explicit-disable guard as the webhook branch above (#85637).
+            # READ (don't pop) the marker here: the relay-exclusive pass below
+            # still consults it, and the end-of-function scrub removes it for
+            # every platform.
+            msgraph_cfg = config.platforms[Platform.MSGRAPH_WEBHOOK]
+            if not msgraph_cfg.extra.get("_enabled_explicit", False) or msgraph_cfg.enabled:
+                msgraph_cfg.enabled = True
         if msgraph_webhook_port:
             try:
                 config.platforms[Platform.MSGRAPH_WEBHOOK].extra["port"] = int(
@@ -2410,9 +2492,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     dingtalk_client_id = getenv("DINGTALK_CLIENT_ID")
     dingtalk_client_secret = getenv("DINGTALK_CLIENT_SECRET")
     if dingtalk_client_id and dingtalk_client_secret:
-        if Platform.DINGTALK not in config.platforms:
-            config.platforms[Platform.DINGTALK] = PlatformConfig()
-        config.platforms[Platform.DINGTALK].enabled = True
+        # Honors an explicit ``platforms.dingtalk.enabled: false`` (#48820).
+        _enable_from_env(Platform.DINGTALK)
         config.platforms[Platform.DINGTALK].extra.update({
             "client_id": dingtalk_client_id,
             "client_secret": dingtalk_client_secret,
@@ -2430,9 +2511,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     feishu_app_id = getenv("FEISHU_APP_ID")
     feishu_app_secret = getenv("FEISHU_APP_SECRET")
     if feishu_app_id and feishu_app_secret:
-        if Platform.FEISHU not in config.platforms:
-            config.platforms[Platform.FEISHU] = PlatformConfig()
-        config.platforms[Platform.FEISHU].enabled = True
+        # Honors an explicit ``platforms.feishu.enabled: false`` (#48820).
+        _enable_from_env(Platform.FEISHU)
         config.platforms[Platform.FEISHU].extra.update({
             "app_id": feishu_app_id,
             "app_secret": feishu_app_secret,
@@ -2458,9 +2538,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     wecom_bot_id = getenv("WECOM_BOT_ID")
     wecom_secret = getenv("WECOM_SECRET")
     if wecom_bot_id and wecom_secret:
-        if Platform.WECOM not in config.platforms:
-            config.platforms[Platform.WECOM] = PlatformConfig()
-        config.platforms[Platform.WECOM].enabled = True
+        # Honors an explicit ``platforms.wecom.enabled: false`` (#48820).
+        _enable_from_env(Platform.WECOM)
         config.platforms[Platform.WECOM].extra.update({
             "bot_id": wecom_bot_id,
             "secret": wecom_secret,
@@ -2481,9 +2560,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     wecom_callback_corp_id = getenv("WECOM_CALLBACK_CORP_ID")
     wecom_callback_corp_secret = getenv("WECOM_CALLBACK_CORP_SECRET")
     if wecom_callback_corp_id and wecom_callback_corp_secret:
-        if Platform.WECOM_CALLBACK not in config.platforms:
-            config.platforms[Platform.WECOM_CALLBACK] = PlatformConfig()
-        config.platforms[Platform.WECOM_CALLBACK].enabled = True
+        # Honors an explicit ``platforms.wecom_callback.enabled: false`` (#48820).
+        _enable_from_env(Platform.WECOM_CALLBACK)
         config.platforms[Platform.WECOM_CALLBACK].extra.update({
             "corp_id": wecom_callback_corp_id,
             "corp_secret": wecom_callback_corp_secret,
@@ -2501,9 +2579,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     weixin_token = getenv("WEIXIN_TOKEN")
     weixin_account_id = getenv("WEIXIN_ACCOUNT_ID")
     if weixin_token or weixin_account_id:
-        if Platform.WEIXIN not in config.platforms:
-            config.platforms[Platform.WEIXIN] = PlatformConfig()
-        config.platforms[Platform.WEIXIN].enabled = True
+        # Honors an explicit ``platforms.weixin.enabled: false`` (#48820).
+        _enable_from_env(Platform.WEIXIN)
         if weixin_token:
             config.platforms[Platform.WEIXIN].token = weixin_token
         extra = config.platforms[Platform.WEIXIN].extra
@@ -2543,9 +2620,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     bluebubbles_server_url = getenv("BLUEBUBBLES_SERVER_URL")
     bluebubbles_password = getenv("BLUEBUBBLES_PASSWORD")
     if bluebubbles_server_url and bluebubbles_password:
-        if Platform.BLUEBUBBLES not in config.platforms:
-            config.platforms[Platform.BLUEBUBBLES] = PlatformConfig()
-        config.platforms[Platform.BLUEBUBBLES].enabled = True
+        # Honors an explicit ``platforms.bluebubbles.enabled: false`` (#48820).
+        _enable_from_env(Platform.BLUEBUBBLES)
         config.platforms[Platform.BLUEBUBBLES].extra.update({
             "server_url": bluebubbles_server_url.rstrip("/"),
             "password": bluebubbles_password,
@@ -2583,9 +2659,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     qq_app_id = getenv("QQ_APP_ID")
     qq_client_secret = getenv("QQ_CLIENT_SECRET")
     if qq_app_id or qq_client_secret:
-        if Platform.QQBOT not in config.platforms:
-            config.platforms[Platform.QQBOT] = PlatformConfig()
-        config.platforms[Platform.QQBOT].enabled = True
+        # Honors an explicit ``platforms.qqbot.enabled: false`` (#48820).
+        _enable_from_env(Platform.QQBOT)
         extra = config.platforms[Platform.QQBOT].extra
         if qq_app_id:
             extra["app_id"] = qq_app_id
@@ -2625,9 +2700,8 @@ def _apply_env_overrides(config: GatewayConfig) -> None:
     yuanbao_app_id = getenv("YUANBAO_APP_ID") or getenv("YUANBAO_APP_KEY")
     yuanbao_app_secret = getenv("YUANBAO_APP_SECRET")
     if yuanbao_app_id and yuanbao_app_secret:
-        if Platform.YUANBAO not in config.platforms:
-            config.platforms[Platform.YUANBAO] = PlatformConfig()
-        config.platforms[Platform.YUANBAO].enabled = True
+        # Honors an explicit ``platforms.yuanbao.enabled: false`` (#48820).
+        _enable_from_env(Platform.YUANBAO)
         extra = config.platforms[Platform.YUANBAO].extra
         extra["app_id"] = yuanbao_app_id
         extra["app_secret"] = yuanbao_app_secret
diff --git a/gateway/delivery.py b/gateway/delivery.py
index fa43db6d0f..f63c769aeb 100644
--- a/gateway/delivery.py
+++ b/gateway/delivery.py
@@ -530,7 +530,18 @@ class DeliveryRouter:
         # platform adapter regardless of which persona's prompt failed.
         # Local/file delivery (_deliver_local) is a separate path and is never
         # filtered — saved silence has no loop risk.
-        if self._filter_silence_narration_enabled() and _is_silence_narration(content):
+        # Cron output is an ARTIFACT, not model chatter: a job whose brief is
+        # legitimately terse ("...", a single 🔇 from a script) has no bot-to-bot
+        # mirror loop to guard against, and dropping it here while returning
+        # {"success": True} is exactly how a cron was logged as delivered with
+        # nothing on the wire (#77763).  Cron sends carry job_id in metadata;
+        # every other caller keeps the filter unchanged.
+        is_cron_artifact = "job_id" in (metadata or {})
+        if (
+            self._filter_silence_narration_enabled()
+            and not is_cron_artifact
+            and _is_silence_narration(content)
+        ):
             logger.warning(
                 "Dropped silence-narration outbound to %s (chat=%s): %r",
                 target.platform.value,
diff --git a/gateway/kanban_watchers.py b/gateway/kanban_watchers.py
index ad8c64ae8b..6ff4edc77b 100644
--- a/gateway/kanban_watchers.py
+++ b/gateway/kanban_watchers.py
@@ -422,7 +422,7 @@ class GatewayKanbanWatchersMixin:
                             if _gc_due:
                                 # Hourly (plus once at startup) stale-sub GC:
                                 # drop subscriptions for tasks that have been
-                                # ``done`` untouched past the retention
+                                # ``done``/``blocked`` untouched past the retention
                                 # window. Best-effort — a failed sweep never
                                 # blocks delivery; the next hourly gate
                                 # retries it.
@@ -433,7 +433,7 @@ class GatewayKanbanWatchersMixin:
                                     )
                                     if _purged:
                                         logger.info(
-                                            "kanban notifier: purged %d stale done-task subscription(s) on board %s (retention %dd)",
+                                            "kanban notifier: purged %d stale done/blocked-task subscription(s) on board %s (retention %dd)",
                                             _purged, slug, _gc_retention_days,
                                         )
                                 except Exception as _gc_exc:
diff --git a/gateway/pairing.py b/gateway/pairing.py
index 23d213d689..7e7b4cb52f 100644
--- a/gateway/pairing.py
+++ b/gateway/pairing.py
@@ -185,10 +185,11 @@ def _read_allowlist_env(env_var: str) -> str:
     borrowing the process value.  Unscoped callers (single-profile CLI /
     admin endpoints) keep the legacy ``os.getenv`` read.
 
-    TODO(profile-secrets): the grant mirror below still WRITES through
-    ``hermes_cli.config.save_env_value`` / ``remove_env_value``, which target
-    the root ``.env`` — those writes need a profile-aware counterpart before
-    pairing grants can be mirrored correctly under multiplexing.
+    The grant mirror below writes through ``hermes_cli.config.save_env_value``
+    / ``remove_env_value``: the file target is the active profile's ``.env``
+    (``get_env_path()`` honors the profile-home override) and, under
+    multiplexing, the in-process publish updates the installed scope mapping
+    rather than the shared ``os.environ`` (#88441).
     """
     try:
         from agent.secret_scope import UnscopedSecretError, get_secret
diff --git a/gateway/platform_registry.py b/gateway/platform_registry.py
index e639bc838b..ca818b0921 100644
--- a/gateway/platform_registry.py
+++ b/gateway/platform_registry.py
@@ -4,10 +4,11 @@ Platform Adapter Registry
 Allows platform adapters (built-in and plugin) to self-register so the gateway
 can discover and instantiate them without hardcoded if/elif chains.
 
-Built-in adapters continue to use the existing if/elif in _create_adapter()
+Built-in adapters continue to use the existing if/elif in _instantiate_adapter()
 for now.  Plugin adapters register here via PluginContext.register_platform()
 and are looked up first -- if nothing is found the gateway falls through to
-the legacy code path.
+the legacy code path.  GatewayRunner._create_adapter() wraps both paths and
+binds every successful adapter to its runner.
 
 Usage (plugin side):
 
diff --git a/gateway/platforms/ADDING_A_PLATFORM.md b/gateway/platforms/ADDING_A_PLATFORM.md
index 50618aa02f..9f989133f1 100644
--- a/gateway/platforms/ADDING_A_PLATFORM.md
+++ b/gateway/platforms/ADDING_A_PLATFORM.md
@@ -174,7 +174,7 @@ Update `get_connected_platforms()` if your platform doesn't use token/api_key
 
 ## 3. Adapter Factory (`gateway/run.py`)
 
-Add to `_create_adapter()`:
+Add to `_instantiate_adapter()`:
 
 ```python
 elif platform == Platform.YOUR_PLATFORM:
@@ -185,6 +185,11 @@ elif platform == Platform.YOUR_PLATFORM:
     return YourAdapter(config)
 ```
 
+`_create_adapter()` wraps this factory and binds every successful adapter to
+its `GatewayRunner`. Do not construct platform adapters in lifecycle call sites;
+startup and reconnect must keep using the wrapper so profile routing is wired
+before `connect()`.
+
 ---
 
 ## 4. Authorization Maps (`gateway/run.py`)
diff --git a/gateway/platforms/api_server.py b/gateway/platforms/api_server.py
index 004ef1a9e1..9fc9e40c01 100644
--- a/gateway/platforms/api_server.py
+++ b/gateway/platforms/api_server.py
@@ -4906,6 +4906,11 @@ class APIServerAdapter(BasePlatformAdapter):
         queue: "asyncio.Queue[Optional[tuple[str, Dict[str, Any]]]]" = asyncio.Queue()
         message_id = f"msg_{uuid.uuid4().hex}"
         run_id = f"run_{uuid.uuid4().hex}"
+        # Claim ownership while still inside the request's profile scope,
+        # before any run-keyed state exists — the same rule as /v1/runs, so
+        # /v1/runs/{id}* control of this turn is confined to the profile
+        # that started it (#93689).
+        self._run_owners[run_id] = self._run_idempotency_scope(request)
         self._set_run_status(
             run_id,
             "queued",
@@ -4993,12 +4998,13 @@ class APIServerAdapter(BasePlatformAdapter):
                         else ""
                     ),
                 )
+                is_partial = bool(result.get("partial")) if isinstance(result, dict) else False
                 await queue.put(_event_payload("assistant.completed", {
                     "session_id": effective_session_id,
                     "message_id": message_id,
                     "content": final_response,
                     "completed": True,
-                    "partial": False,
+                    "partial": is_partial,
                     "interrupted": False,
                     "runtime": effective_runtime,
                 }))
@@ -5040,6 +5046,7 @@ class APIServerAdapter(BasePlatformAdapter):
                 await queue.put(_event_payload("error", {"message": _redact_api_error_text(exc)}))
             finally:
                 self._active_run_agents.pop(run_id, None)
+                self._release_run_owner_if_forgotten(run_id)
                 await queue.put(_event_payload("done", {}))
                 await queue.put(None)
 
@@ -7774,6 +7781,9 @@ class APIServerAdapter(BasePlatformAdapter):
     def _request_owns_run(self, request: "web.Request", run_id: str) -> bool:
         return _api_runs._request_owns_run(self, request, run_id)
 
+    def _release_run_owner_if_forgotten(self, run_id: str) -> None:
+        _api_runs._release_run_owner_if_forgotten(self, run_id)
+
     async def _handle_get_run(self, request: "web.Request") -> "web.Response":
         """GET /v1/runs/{run_id} — return pollable run status for external UIs."""
         return await _api_runs._handle_get_run(
diff --git a/gateway/platforms/api_server_runs.py b/gateway/platforms/api_server_runs.py
index 04b21fefd3..758d847e45 100644
--- a/gateway/platforms/api_server_runs.py
+++ b/gateway/platforms/api_server_runs.py
@@ -225,6 +225,7 @@ def _make_run_event_callback(
                 "task_index",
                 "subagent_id",
                 "child_session_id",
+                "delegation_id",
                 "parent_id",
                 "depth",
                 "model",
@@ -1016,6 +1017,7 @@ async def _handle_runs(
             self._active_run_tasks.pop(run_id, None)
             self._run_approval_sessions.pop(run_id, None)
             self._stopping_run_ids.discard(run_id)
+            self._release_run_owner_if_forgotten(run_id)
 
     self._activate_admitted_request()
     task = asyncio.create_task(_run_and_close())
@@ -1037,25 +1039,36 @@ async def _handle_runs(
     )
 
 
-def _request_owns_run(self, request: "web.Request", run_id: str) -> bool:
-    scope = self._run_idempotency_scope(request)
-    owner = self._run_owners.get(run_id)
-    if self._room_grant_token(request):
-        return owner == scope or (
-            owner is None
-            and self._run_idempotency_store.owns_run(scope, run_id)
-        )
-    if owner is None and (
+def _release_run_owner_if_forgotten(self, run_id: str) -> None:
+    """Drop the owner stamp only once nothing keyed by *run_id* survives.
+
+    Ownership must outlive every surface it protects (statuses, live
+    agent/task refs, SSE transport, approval sessions), which are retired
+    on different clocks. Releasing earlier would leave a stateful run
+    without an owner, which ``_request_owns_run`` treats as fail-closed.
+    """
+    if (
         run_id in self._run_statuses
         or run_id in self._active_run_agents
         or run_id in self._active_run_tasks
+        or run_id in self._run_streams
+        or run_id in self._run_approval_sessions
     ):
-        # Backward compatibility for statuses created by older/in-process
-        # integrations before ownership tracking was introduced.
-        return True
-    return owner == scope or (
-        owner is None and self._run_idempotency_store.owns_run(scope, run_id)
-    )
+        return
+    self._run_owners.pop(run_id, None)
+
+
+def _request_owns_run(self, request: "web.Request", run_id: str) -> bool:
+    scope = self._run_idempotency_scope(request)
+    owner = self._run_owners.get(run_id)
+    if owner is not None:
+        return owner == scope
+    # No in-memory owner: only a durable record under the caller's own scope
+    # admits it. Run state that exists without an owner stamp is an
+    # unanswered authorization question, not a run anyone may control —
+    # under gateway.multiplex_profiles every served profile holds a valid
+    # key, so admitting it would make the boundary allow-all (#93689).
+    return self._run_idempotency_store.owns_run(scope, run_id)
 
 
 async def _handle_get_run(
@@ -1153,6 +1166,7 @@ async def _handle_run_events(
         self._run_stream_subscribers.discard(run_id)
         self._run_streams.pop(run_id, None)
         self._run_streams_created.pop(run_id, None)
+        self._release_run_owner_if_forgotten(run_id)
 
     return response
 
@@ -1484,6 +1498,7 @@ def _sweep_orphaned_runs_once(self, now: Optional[float] = None) -> None:
             self._active_run_tasks.pop(run_id, None)
             self._run_approval_sessions.pop(run_id, None)
             self._stopping_run_ids.discard(run_id)
+        self._release_run_owner_if_forgotten(run_id)
 
     stale_statuses = [
         run_id
@@ -1494,4 +1509,4 @@ def _sweep_orphaned_runs_once(self, now: Optional[float] = None) -> None:
     for run_id in stale_statuses:
         self._run_statuses.pop(run_id, None)
         self._run_idempotency_ids.discard(run_id)
-        self._run_owners.pop(run_id, None)
+        self._release_run_owner_if_forgotten(run_id)
diff --git a/gateway/platforms/base.py b/gateway/platforms/base.py
index 3ad1ea18d4..8a6444da0b 100644
--- a/gateway/platforms/base.py
+++ b/gateway/platforms/base.py
@@ -161,6 +161,12 @@ def _thread_metadata_for_source(source, reply_to_message_id: str | None = None)
         anchor = reply_to_message_id or getattr(source, "message_id", None)
         if anchor is not None:
             metadata["telegram_reply_to_message_id"] = str(anchor)
+    # Routed Hermes profile for shared state.db namespaces (topic bindings
+    # under multiplex / profile_routes). Outbound prune paths must not
+    # assume the transport adapter's static profile stamp.
+    profile = str(getattr(source, "profile", None) or "").strip()
+    if profile:
+        metadata["hermes_profile"] = profile
     return metadata
 
 
@@ -489,7 +495,8 @@ def resolve_proxy_url(
       2. macOS system proxy via ``scutil --proxy`` (auto-detect)
 
     Returns *None* if no proxy is found, or if NO_PROXY/no_proxy matches one
-    of ``target_hosts``.
+    of ``target_hosts``. Steps 1-2 are skipped when ``gateway.trust_env`` is
+    false in config.yaml (see :func:`gateway_trust_env`).
     """
     if platform_env_var:
         value = (os.environ.get(platform_env_var) or "").strip()
@@ -497,6 +504,10 @@ def resolve_proxy_url(
             if should_bypass_proxy(target_hosts):
                 return None
             return normalize_proxy_url(value)
+    if not gateway_trust_env():
+        # gateway.trust_env: false — ignore inherited generic proxy env and
+        # system proxy; only the explicit per-platform var above is honored.
+        return None
     for key in ("HTTPS_PROXY", "HTTP_PROXY", "ALL_PROXY",
                 "https_proxy", "http_proxy", "all_proxy"):
         value = (os.environ.get(key) or "").strip()
@@ -540,6 +551,28 @@ def proxy_kwargs_for_bot(proxy_url: str | None) -> dict:
     return {"proxy": proxy_url}
 
 
+def gateway_trust_env() -> bool:
+    """Return the ``trust_env`` value every gateway ``aiohttp.ClientSession`` uses.
+
+    Reads ``gateway.trust_env`` from config.yaml (default ``True``: honor
+    ``HTTP_PROXY`` / ``HTTPS_PROXY`` / ``NO_PROXY`` / ``SSL_CERT_FILE`` from the
+    process environment). Set it to ``false`` when the gateway inherits a
+    proxy env it should not use — e.g. a Windows Scheduled Task picking up a
+    Clash/V2Ray ``HTTP_PROXY`` the interactive shell never sees (#48820).
+    One knob for all platform adapters; fail-open to the default if config
+    is unreadable.
+    """
+    try:
+        from hermes_cli.config import load_config_readonly as _load_config
+        gw = (_load_config() or {}).get("gateway") or {}
+    except Exception:
+        return True
+    value = gw.get("trust_env", True) if isinstance(gw, dict) else True
+    if isinstance(value, str):
+        return value.strip().lower() not in {"0", "false", "no", "off"}
+    return bool(value) if value is not None else True
+
+
 def proxy_kwargs_for_aiohttp(proxy_url: str | None) -> tuple[dict, dict]:
     """Build kwargs for standalone ``aiohttp.ClientSession`` with proxy.
 
@@ -1522,6 +1555,25 @@ def _path_is_within(path: Path, root: Path) -> bool:
         return False
 
 
+def _tenv(name: str, default: str = "") -> str:
+    """Scope-aware TERMINAL_* read (tools.terminal_scope.terminal_env).
+
+    Media-path translation runs in the gateway process concurrently for
+    several profiles; the per-turn terminal scope carries the ACTIVE
+    profile's terminal settings, while a raw os.getenv would read whatever
+    profile's config a previous turn pinned into the process env.
+
+    Only an import failure falls back: an active refusal scope must raise —
+    reconstructing mounts/backends from ambient env under refusal would
+    rebuild another profile's terminal policy.
+    """
+    try:
+        from tools.terminal_scope import terminal_env
+    except ImportError:
+        return os.getenv(name, default)
+    return terminal_env(name, default)
+
+
 def _parse_docker_volume_mounts() -> List[Tuple[Path, Path]]:
     """Parse configured Docker volume mounts into ``(host_path, container_path)``.
 
@@ -1530,7 +1582,7 @@ def _parse_docker_volume_mounts() -> List[Tuple[Path, Path]]:
     Named volumes and non-absolute hosts are skipped because they cannot be
     resolved on the gateway host for media delivery.
     """
-    raw = os.getenv("TERMINAL_DOCKER_VOLUMES", "").strip()
+    raw = _tenv("TERMINAL_DOCKER_VOLUMES", "").strip()
     if not raw:
         return []
     try:
@@ -1598,7 +1650,7 @@ def _docker_sandbox_dir_candidates(session_key: str = "") -> List[str]:
     except Exception:
         return ["default"]
     # Explicit trusted-profiles opt-in: one shared container identity.
-    shared = os.getenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
+    shared = _tenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
     if shared:
         candidates.append(sanitize_task_id_for_path(f"shared:{shared}"))
     try:
@@ -1624,9 +1676,9 @@ def _default_docker_workspace_host_roots(session_key: str = "") -> List[Path]:
     actually resolves — the profile sandbox dir existing does not mean the
     file lives there when it was produced in a legacy per-session container.
     """
-    if os.getenv("TERMINAL_ENV", "").strip().lower() != "docker":
+    if _tenv("TERMINAL_ENV", "").strip().lower() != "docker":
         return []
-    if os.getenv("TERMINAL_CONTAINER_PERSISTENT", "true").strip().lower() not in {
+    if _tenv("TERMINAL_CONTAINER_PERSISTENT", "true").strip().lower() not in {
         "1",
         "true",
         "yes",
@@ -1634,13 +1686,13 @@ def _default_docker_workspace_host_roots(session_key: str = "") -> List[Path]:
     }:
         return []
     # Explicit cwd mount takes over /workspace when enabled.
-    if os.getenv("TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE", "false").strip().lower() in {
+    if _tenv("TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE", "false").strip().lower() in {
         "1",
         "true",
         "yes",
         "on",
     }:
-        cwd = os.getenv("TERMINAL_CWD") or os.getcwd()
+        cwd = _tenv("TERMINAL_CWD") or os.getcwd()
         try:
             host = Path(os.path.expanduser(cwd)).resolve(strict=False)
         except (OSError, RuntimeError, ValueError):
@@ -1668,9 +1720,9 @@ def _docker_persistent_home_host_roots(session_key: str = "") -> List[Path]:
     produced a real host file the gateway couldn't find. Ordered best-first:
     the profile-scoped layout, then the legacy bug-window per-session layout.
     """
-    if os.getenv("TERMINAL_ENV", "").strip().lower() != "docker":
+    if _tenv("TERMINAL_ENV", "").strip().lower() != "docker":
         return []
-    if os.getenv("TERMINAL_CONTAINER_PERSISTENT", "true").strip().lower() not in {
+    if _tenv("TERMINAL_CONTAINER_PERSISTENT", "true").strip().lower() not in {
         "1",
         "true",
         "yes",
@@ -1700,7 +1752,7 @@ def _cache_dir_container_mounts() -> List[Tuple[Path, Path]]:
     longer prefixes than the ``/root`` home mount, so longest-prefix matching
     picks the cache translation over the home translation for them.
     """
-    if os.getenv("TERMINAL_ENV", "").strip().lower() != "docker":
+    if _tenv("TERMINAL_ENV", "").strip().lower() != "docker":
         return []
     try:
         from tools.credential_files import get_cache_directory_mounts
@@ -1721,7 +1773,7 @@ def _warn_unresolved_docker_media(candidate: Path, session_key: str, reason: str
     file seemingly vanished. Point at the sandbox/session mismatch instead.
     Gated to Docker mode so host-path rejections stay quiet.
     """
-    if os.getenv("TERMINAL_ENV", "").strip().lower() != "docker":
+    if _tenv("TERMINAL_ENV", "").strip().lower() != "docker":
         return
     logger.warning(
         "Docker MEDIA path %s did not resolve to a host sandbox file (%s%s); "
@@ -3916,6 +3968,9 @@ class BasePlatformAdapter(ABC):
         user_id: Optional[str],
         chat_type: Optional[str] = None,
         chat_id: Optional[str] = None,
+        *,
+        is_bot: bool = False,
+        thread_id: Optional[str] = None,
     ) -> Optional[bool]:
         """Return whether ``user_id`` is on the allowlist, if a check is configured.
 
@@ -3924,6 +3979,11 @@ class BasePlatformAdapter(ABC):
         when no check is registered (caller should treat as "trust unknown"
         and preserve legacy behaviour).
 
+        ``is_bot`` / ``thread_id`` are forwarded as keywords only when set, so
+        the gateway callback can apply its bot policy (``*_ALLOW_BOTS``) and
+        thread-level profile routes while legacy three-positional callbacks
+        keep working unchanged.
+
         Only the literal booleans are propagated. A callback that returns
         anything else is treated as "unknown" rather than coerced with
         ``bool()``: callers that gate a credentialed side effect on an
@@ -3932,8 +3992,13 @@ class BasePlatformAdapter(ABC):
         """
         if not user_id or self._authorization_check is None:
             return None
+        extra: Dict[str, Any] = {}
+        if is_bot:
+            extra["is_bot"] = True
+        if thread_id is not None:
+            extra["thread_id"] = thread_id
         try:
-            result = self._authorization_check(user_id, chat_type, chat_id)
+            result = self._authorization_check(user_id, chat_type, chat_id, **extra)
             if result is True:
                 return True
             if result is False:
diff --git a/gateway/platforms/qqbot/adapter.py b/gateway/platforms/qqbot/adapter.py
index d84ab46014..b8a9470817 100644
--- a/gateway/platforms/qqbot/adapter.py
+++ b/gateway/platforms/qqbot/adapter.py
@@ -62,6 +62,7 @@ except ImportError:
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -496,7 +497,7 @@ class QQAdapter(BasePlatformAdapter):
 
         # Honor WSL proxy env for QQ WebSocket. Hermes upgrades overwrite this
         # local patch, so QQ can regress to direct-connect timeouts after update.
-        self._session = aiohttp.ClientSession(trust_env=True)
+        self._session = aiohttp.ClientSession(trust_env=gateway_trust_env())
         ws_proxy = (
             os.getenv("WSS_PROXY")
             or os.getenv("wss_proxy")
diff --git a/gateway/platforms/webhook.py b/gateway/platforms/webhook.py
index 1ff741f1e2..aa44aeb2d7 100644
--- a/gateway/platforms/webhook.py
+++ b/gateway/platforms/webhook.py
@@ -42,6 +42,7 @@ import subprocess
 import sys
 import time
 from collections import deque
+from contextlib import nullcontext
 from typing import Any, Deque, Dict, List, Optional
 
 try:
@@ -633,6 +634,21 @@ class WebhookAdapter(BasePlatformAdapter):
         effective_profile = request_profile or "default"
         return configured_profile == effective_profile
 
+    @staticmethod
+    def _profile_scope(profile: Optional[str]):
+        """Enter the URL-resolved profile's runtime scope, or a no-op.
+
+        Only a resolved ``/p/<profile>/`` prefix enters a scope (same helper
+        the runner wraps ``handle_message`` in); bare routes keep serving the
+        launch profile exactly as before.
+        """
+        if not profile or not isinstance(profile, str):
+            return nullcontext()
+        from gateway.run import _profile_runtime_scope
+        from hermes_cli.profiles import get_profile_dir
+
+        return _profile_runtime_scope(get_profile_dir(profile))
+
     async def _handle_webhook(self, request: "web.Request") -> "web.Response":
         """POST /webhooks/{route_name} — receive and process a webhook event."""
         # Hot-reload dynamic subscriptions on each request (mtime-gated, cheap)
@@ -784,63 +800,71 @@ class WebhookAdapter(BasePlatformAdapter):
                 }
             )
 
-        if route_config.get("script"):
-            # run_route_script shells out (subprocess.run, up to its timeout);
-            # run it in a worker thread so it can't block the gateway event loop.
-            keep, transformed_payload = await asyncio.to_thread(
-                self._route_processor.run_route_script,
-                route_config.get("script"),
-                payload,
+        # The route script, prompt render and skill lookup below read the
+        # profile's home (skills/, config). The runner only enters the routed
+        # profile's scope later, around handle_message, so without this they
+        # ran against the launch (default) profile (#67277). Only a resolved
+        # /p/<profile>/ enters a scope; bare routes are unchanged.
+        with self._profile_scope(profile):
+            if route_config.get("script"):
+                # run_route_script shells out (subprocess.run, up to its
+                # timeout); run it in a worker thread so it can't block the
+                # gateway event loop. to_thread copies the contextvars, so
+                # the profile scope follows it.
+                keep, transformed_payload = await asyncio.to_thread(
+                    self._route_processor.run_route_script,
+                    route_config.get("script"),
+                    payload,
+                )
+                if not keep:
+                    logger.info(
+                        "[webhook] script ignored event=%s route=%s",
+                        event_type,
+                        route_name,
+                    )
+                    return web.json_response(
+                        {
+                            "status": "ignored",
+                            "reason": "script",
+                            "route": route_name,
+                        }
+                    )
+                payload = transformed_payload or payload
+
+            # Format prompt from template
+            prompt_template = route_config.get("prompt", "")
+            prompt = self._render_prompt(
+                prompt_template, payload, event_type, route_name
             )
-            if not keep:
-                logger.info(
-                    "[webhook] script ignored event=%s route=%s",
-                    event_type,
-                    route_name,
-                )
-                return web.json_response(
-                    {
-                        "status": "ignored",
-                        "reason": "script",
-                        "route": route_name,
-                    }
-                )
-            payload = transformed_payload or payload
 
-        # Format prompt from template
-        prompt_template = route_config.get("prompt", "")
-        prompt = self._render_prompt(
-            prompt_template, payload, event_type, route_name
-        )
+            # Inject skill content if configured.
+            # We call build_skill_invocation_message() directly rather than
+            # using /skill-name slash commands — the gateway's command parser
+            # would intercept those and break the flow.
+            skills = route_config.get("skills", [])
+            if skills:
+                try:
+                    from agent.skill_commands import (
+                        build_skill_invocation_message,
+                        get_skill_commands,
+                    )
 
-        # Inject skill content if configured.
-        # We call build_skill_invocation_message() directly rather than
-        # using /skill-name slash commands — the gateway's command parser
-        # would intercept those and break the flow.
-        skills = route_config.get("skills", [])
-        if skills:
-            try:
-                from agent.skill_commands import (
-                    build_skill_invocation_message,
-                    get_skill_commands,
-                )
-
-                skill_cmds = get_skill_commands()
-                for skill_name in skills:
-                    cmd_key = f"/{skill_name}"
-                    if cmd_key in skill_cmds:
-                        skill_content = build_skill_invocation_message(
-                            cmd_key, user_instruction=prompt
-                        )
-                        if skill_content:
-                            prompt = skill_content
-                            break  # Load the first matching skill
-                    else:
-                        logger.warning(
-                            "[webhook] Skill '%s' not found", skill_name
-                        )
-            except Exception as e:
-                logger.warning("[webhook] Skill loading failed: %s", e)
+                    skill_cmds = get_skill_commands()
+                    for skill_name in skills:
+                        cmd_key = f"/{skill_name}"
+                        if cmd_key in skill_cmds:
+                            skill_content = build_skill_invocation_message(
+                                cmd_key, user_instruction=prompt
+                            )
+                            if skill_content:
+                                prompt = skill_content
+                                break  # Load the first matching skill
+                        else:
+                            logger.warning(
+                                "[webhook] Skill '%s' not found", skill_name
+                            )
+                except Exception as e:
+                    logger.warning("[webhook] Skill loading failed: %s", e)
 
         # Build a unique delivery ID
         delivery_id = request.headers.get(
diff --git a/gateway/platforms/weixin.py b/gateway/platforms/weixin.py
index 8c2b18b765..ccf610fc7a 100644
--- a/gateway/platforms/weixin.py
+++ b/gateway/platforms/weixin.py
@@ -58,6 +58,7 @@ except ImportError:  # pragma: no cover - dependency gate
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.helpers import MessageDeduplicator, greedy_pack_blocks
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -141,7 +142,7 @@ def _make_ssl_connector() -> Optional["aiohttp.TCPConnector"]:
     some system CA stores (notably Homebrew's OpenSSL on macOS Apple Silicon).
     When ``certifi`` is installed, use its Mozilla CA bundle to guarantee
     verification. Otherwise fall back to aiohttp's default (which honors
-    ``SSL_CERT_FILE`` env var via ``trust_env=True``).
+    ``SSL_CERT_FILE`` env var when ``gateway.trust_env`` is on).
 
     Uses a tight ``keepalive_timeout=2`` (default aiohttp: 30s) so idle
     connections drain promptly behind proxies like Cloudflare Warp that
@@ -1048,7 +1049,7 @@ async def qr_login(
     if not AIOHTTP_AVAILABLE:
         raise RuntimeError("aiohttp is required for Weixin QR login")
 
-    async with aiohttp.ClientSession(trust_env=True, connector=_make_ssl_connector()) as session:
+    async with aiohttp.ClientSession(trust_env=gateway_trust_env(), connector=_make_ssl_connector()) as session:
         try:
             qr_resp = await _api_get(
                 session,
@@ -1318,13 +1319,13 @@ class WeixinAdapter(BasePlatformAdapter):
         except Exception as exc:
             logger.debug("[%s] Token lock unavailable (non-fatal): %s", self.name, exc)
 
-        self._poll_session = aiohttp.ClientSession(trust_env=True, connector=_make_ssl_connector())
+        self._poll_session = aiohttp.ClientSession(trust_env=gateway_trust_env(), connector=_make_ssl_connector())
         # Disable aiohttp's built-in ClientTimeout (total=None) to prevent
         # "Timeout context manager should be used inside a task" errors when
         # send() is invoked via asyncio.run_coroutine_threadsafe() from cron.
         # Timeout is managed externally via asyncio.wait_for() in _api_post/_api_get.
         _no_aiohttp_timeout = aiohttp.ClientTimeout(total=None, connect=None, sock_connect=None, sock_read=None)
-        self._send_session = aiohttp.ClientSession(trust_env=True, connector=_make_ssl_connector(), timeout=_no_aiohttp_timeout)
+        self._send_session = aiohttp.ClientSession(trust_env=gateway_trust_env(), connector=_make_ssl_connector(), timeout=_no_aiohttp_timeout)
         self._token_store.restore(self._account_id)
         self._poll_task = asyncio.create_task(self._poll_loop(), name="weixin-poll")
         self._mark_connected()
@@ -1452,7 +1453,7 @@ class WeixinAdapter(BasePlatformAdapter):
             return
         old = self._poll_session
         self._poll_session = aiohttp.ClientSession(
-            trust_env=True, connector=_make_ssl_connector()
+            trust_env=gateway_trust_env(), connector=_make_ssl_connector()
         )
         if old is not None and not old.closed:
             try:
@@ -2407,7 +2408,7 @@ async def send_weixin_direct(
             "context_token_used": bool(context_token),
         }
 
-    async with aiohttp.ClientSession(trust_env=True, connector=_make_ssl_connector()) as session:
+    async with aiohttp.ClientSession(trust_env=gateway_trust_env(), connector=_make_ssl_connector()) as session:
         adapter = WeixinAdapter(
             PlatformConfig(
                 enabled=True,
diff --git a/gateway/profile_routing.py b/gateway/profile_routing.py
index 5d2b3b60be..c72f8837ea 100644
--- a/gateway/profile_routing.py
+++ b/gateway/profile_routing.py
@@ -35,6 +35,11 @@ Configuration (config.yaml):
           chat_id: "YOUR_CHANNEL_ID"
           thread_id: "YOUR_THREAD_ID"
           profile: thread-profile
+
+        - name: owner-whatsapp
+          platform: whatsapp
+          chat_id: "15551234567"   # phone, JID, or LID — all equivalent
+          profile: owner
 """
 
 from __future__ import annotations
@@ -46,6 +51,43 @@ import logging
 
 logger = logging.getLogger(__name__)
 
+# Baileys and Cloud share phone/JID/LID identity rules. Other platforms keep
+# exact string compare so Telegram numeric ids and Discord snowflakes stay
+# unchanged.
+_WHATSAPP_IDENTITY_PLATFORMS = {"whatsapp", "whatsapp_cloud"}
+_WHATSAPP_NON_USER_SUFFIXES = ("@g.us", "@broadcast", "@newsletter")
+
+
+def _is_whatsapp_non_user_chat(chat_id: Optional[str]) -> bool:
+    """True for group / broadcast / newsletter JIDs — not a sender identity."""
+    if not chat_id:
+        return False
+    cid = str(chat_id).strip().lower()
+    return any(cid.endswith(suffix) for suffix in _WHATSAPP_NON_USER_SUFFIXES)
+
+
+def _whatsapp_user_chat_ids_match(platform: str, left: Optional[str], right: Optional[str]) -> bool:
+    """True when two WhatsApp *user* chat_ids refer to the same person.
+
+    Reuses :func:`gateway.whatsapp_identity.expand_whatsapp_aliases` so a
+    bare phone number, a ``@s.whatsapp.net`` JID, and a ``@lid`` LID collapse
+    to one identity — the same helper session keys and adapter allowlists
+    already use. Group/broadcast JIDs are excluded: those are chats, not
+    senders. Returns False for non-WhatsApp platforms (exact match only).
+    """
+    if (platform or "").strip().lower() not in _WHATSAPP_IDENTITY_PLATFORMS:
+        return False
+    if not left or not right:
+        return False
+    if _is_whatsapp_non_user_chat(left) or _is_whatsapp_non_user_chat(right):
+        return False
+    from gateway.whatsapp_identity import expand_whatsapp_aliases
+
+    left_aliases = expand_whatsapp_aliases(str(left))
+    if not left_aliases:
+        return False
+    return bool(left_aliases & expand_whatsapp_aliases(str(right)))
+
 
 class ProfileRouteRejected(RuntimeError):
     """An explicit route matched a profile this gateway does not serve."""
@@ -92,6 +134,11 @@ class ProfileRoute:
         - Thread in channel: parent_chat_id == route.chat_id
         A route declaring both ``guild_id`` and ``chat_id`` requires both to
         match (a chat match alone does not satisfy a guild constraint).
+
+        WhatsApp / WhatsApp Cloud ``chat_id`` also matches across user-identity
+        forms (bare number, JID, LID) after the exact-string check. Exact
+        matches always win first, so existing configs keep working. Groups
+        (``@g.us``) and broadcasts stay exact-only.
         """
         if not self.enabled:
             return False
@@ -100,12 +147,41 @@ class ProfileRoute:
         if self.thread_id and self.thread_id != thread_id:
             return False
         if self.chat_id and self.chat_id != chat_id and self.chat_id != parent_chat_id:
-            return False
+            if not (
+                _whatsapp_user_chat_ids_match(platform, self.chat_id, chat_id)
+                or _whatsapp_user_chat_ids_match(platform, self.chat_id, parent_chat_id)
+            ):
+                return False
         if self.guild_id and self.guild_id != guild_id:
             return False
         return True
 
 
+def _coerce_route_id(value: Any) -> Optional[str]:
+    """Normalize a route discriminator to str for strict equality matching.
+
+    PyYAML loads unquoted numeric IDs (Discord snowflakes, Telegram negative
+    chat ids) as ``int``. Inbound ``SessionSource`` fields are always ``str``
+    via ``build_source``, so leaving ints here makes ``matches()`` fail silently.
+
+    Only ``int`` is coerced (the legitimate YAML-numeric case). ``bool`` is an
+    ``int`` subclass but never a valid id; floats and other types stringify to
+    something (``"123.0"``) that can never equal an inbound id — recreating the
+    silent no-match this exists to fix — so they are passed through with a
+    load-time warning instead of being silently "fixed" (#86470).
+    """
+    if value is None or isinstance(value, str):
+        return value
+    if isinstance(value, int) and not isinstance(value, bool):
+        return str(value)
+    logger.warning(
+        "Profile route discriminator %r (type %s) can never match an inbound "
+        "id — quote it in config.yaml (e.g. chat_id: \"%s\").",
+        value, type(value).__name__, value,
+    )
+    return str(value)
+
+
 def parse_profile_routes(raw: Optional[List[Dict[str, Any]]]) -> List[ProfileRoute]:
     """Parse profile_routes from config.yaml into ProfileRoute objects.
 
@@ -143,9 +219,9 @@ def parse_profile_routes(raw: Optional[List[Dict[str, Any]]]) -> List[ProfileRou
                 name=name,
                 platform=platform,
                 profile=profile,
-                guild_id=entry.get("guild_id"),
-                chat_id=entry.get("chat_id"),
-                thread_id=entry.get("thread_id"),
+                guild_id=_coerce_route_id(entry.get("guild_id")),
+                chat_id=_coerce_route_id(entry.get("chat_id")),
+                thread_id=_coerce_route_id(entry.get("thread_id")),
                 enabled=entry.get("enabled", True),
             )
         )
diff --git a/gateway/relay/adapter.py b/gateway/relay/adapter.py
index 1fdeea8d93..a42bef5d83 100644
--- a/gateway/relay/adapter.py
+++ b/gateway/relay/adapter.py
@@ -1620,6 +1620,13 @@ class RelayAdapter(BasePlatformAdapter):
             # how platform=RELAY home channels slipped through in the first
             # place. Set locally, never read off the wire.
             delivered_via_upstream_relay=True,
+            # The HERMES profile this interaction is routed to (multiplex
+            # mode) — mirrors _event_from_wire's profile stamping for plain
+            # relayed messages (#60586). Without this, a Team-Gateway's
+            # Discord slash-command/button/modal always fell back to the
+            # legacy agent:main namespace even when the connector resolved
+            # a specific profile for it.
+            profile=getattr(forward, "profile", None),
         )
         event = MessageEvent(text=text, message_type=message_type, source=source)
         if itype == 3:
diff --git a/gateway/relay/ws_transport.py b/gateway/relay/ws_transport.py
index 5e90887c57..bba21cd171 100644
--- a/gateway/relay/ws_transport.py
+++ b/gateway/relay/ws_transport.py
@@ -402,6 +402,16 @@ class PassthroughForward:
     path: str
     headers: list[tuple[str, str]]
     body: bytes
+    # The HERMES profile this interaction is routed to (multiplex mode).
+    # Mirrors the ``profile`` field _event_from_wire already carries on the
+    # ``inbound`` frame's SessionSource (#60586) — the connector stamps it
+    # when NAS resolves the target profile for a Team-Gateway interaction;
+    # absent for a single-profile gateway, where it stays None and session
+    # keys keep the legacy ``agent:main`` namespace. Without this, a Discord
+    # slash-command/button/modal relayed through the passthrough plane always
+    # fell back to agent:main even when the equivalent plain message would
+    # have been routed to the correct profile.
+    profile: Optional[str] = None
 
 
 def _passthrough_from_wire(raw: Dict[str, Any]) -> PassthroughForward:
@@ -431,6 +441,7 @@ def _passthrough_from_wire(raw: Dict[str, Any]) -> PassthroughForward:
         path=str(raw.get("path", "")),
         headers=headers,
         body=body,
+        profile=raw.get("profile"),
     )
 
 
diff --git a/gateway/restart.py b/gateway/restart.py
index 986b5a4fee..58e6d15ceb 100644
--- a/gateway/restart.py
+++ b/gateway/restart.py
@@ -16,6 +16,25 @@ GATEWAY_SERVICE_RESTART_EXIT_CODE = 75
 # restarting the gateway.  See #51228.
 GATEWAY_FATAL_CONFIG_EXIT_CODE = 78
 
+
+def is_global_startup_conflict(error_code: str | None) -> bool:
+    """Return True when an adapter's fatal error is a single-writer ownership conflict.
+
+    ``BasePlatformAdapter._acquire_platform_lock`` emits ``{scope}_lock``
+    with ``retryable=True`` on purpose: a *mid-run* reconnect must be able to
+    recover once the live holder exits or a stale record is cleared (#54167).
+    At startup, though, a live foreign holder is a configuration conflict —
+    two gateways cannot poll one bot token — so the startup router must not
+    treat that flag as "transient blip, retry-queue forever".  This matches by
+    error CODE only (the ``{scope}_lock`` / ``lock_conflict`` families every
+    adapter emits for scoped-lock and identity conflicts), never by message
+    text.
+    """
+    code = (error_code or "").strip().lower()
+    if not code:
+        return False
+    return code == "lock_conflict" or code.endswith("_lock")
+
 # Set by ``hermes gateway run --external-supervisor``. Unlike systemd's
 # INVOCATION_ID and launchd's XPC_SERVICE_NAME, this survives wrappers that
 # intentionally replace the child environment (for example ``sudo env -i``).
diff --git a/gateway/run.py b/gateway/run.py
index 9b2e4b6f69..ba6ada4a4d 100644
--- a/gateway/run.py
+++ b/gateway/run.py
@@ -28,6 +28,7 @@ import asyncio
 import concurrent.futures
 import dataclasses
 import faulthandler
+import functools
 import inspect
 import json
 import logging
@@ -392,8 +393,12 @@ async def run_codex_hygiene_compaction(
     count_before = getattr(compressor, "compression_count", 0)
     try:
         await asyncio.wait_for(
+            # copy_context().run: keep the caller's profile secret scope /
+            # HERMES_HOME override in the worker (multiplex_profiles) — same
+            # class as the detached-agent hygiene path below.
             loop.run_in_executor(
                 None,
+                copy_context().run,
                 lambda: agent._compress_context(
                     history,
                     "",
@@ -2419,7 +2424,10 @@ def _current_max_iterations() -> int:
     return _resolve_turn_limit(os.getenv("HERMES_MAX_ITERATIONS"))
 
 
-from contextlib import contextmanager as _contextmanager
+from contextlib import (
+    asynccontextmanager as _asynccontextmanager,
+    contextmanager as _contextmanager,
+)
 
 
 # Platforms that bind a host TCP port (HTTP/webhook listeners). In a profile
@@ -2472,6 +2480,30 @@ def _multiplex_profile_homes(config: object) -> list[tuple[str, "Path"]]:
     )
 
 
+def _enable_multiplex_log_routing(config: object) -> bool:
+    """Route agent.log/errors.log/gateway.log records to their owning profile.
+
+    ``setup_logging(mode="gateway")`` binds the queued file handlers to the
+    launch home, so under ``multiplex_profiles`` every secondary profile's
+    records (emitted inside ``_profile_runtime_scope``) land in the default
+    profile's log files (#82936). Swap the static handlers for the
+    profile routers from #99440 — the same primitive the Desktop cron ticker
+    uses — once the served-profile set is known. Inert for single-profile
+    gateways (``enable_profile_log_routing`` is a no-op below two homes).
+    """
+    if not getattr(config, "multiplex_profiles", False):
+        return False
+    try:
+        from hermes_logging import enable_profile_log_routing
+
+        return enable_profile_log_routing(
+            [home for _name, home in _multiplex_profile_homes(config)]
+        )
+    except Exception:
+        logger.debug("could not enable per-profile log routing", exc_info=True)
+        return False
+
+
 def _handoff_watch_scopes(runner: object) -> list:
     """``(profile_name, home)`` pairs whose ``state.db`` the watcher must poll.
 
@@ -2542,8 +2574,40 @@ async def _reclaim_stale(runner: object) -> None:
         )
 
 
+def _terminal_scope_cwd(default: str = "") -> str:
+    """Scope-aware TERMINAL_CWD read for footer/context surfaces.
+
+    Only an import failure falls back: an active refusal scope must raise,
+    not resolve the launch profile's cwd.
+    """
+    try:
+        from tools.terminal_scope import terminal_env as _ts_env
+    except ImportError:
+        return os.environ.get("TERMINAL_CWD", default)
+    return _ts_env("TERMINAL_CWD", default)
+
+
+def _load_profile_secret_scope(profile_home: "Path") -> dict:
+    """Hydrate and load one profile's secrets under its home override."""
+    from hermes_constants import set_hermes_home_override, reset_hermes_home_override
+    from agent.secret_scope import build_profile_secret_scope
+    from hermes_cli.env_loader import hydrate_profile_secret_sources
+
+    home_token = set_hermes_home_override(str(profile_home))
+    try:
+        hydrate_profile_secret_sources(Path(profile_home))
+        return build_profile_secret_scope(Path(profile_home))
+    finally:
+        reset_hermes_home_override(home_token)
+
+
 @_contextmanager
-def _profile_runtime_scope(profile_home: "Path"):
+def _profile_runtime_scope(
+    profile_home: "Path",
+    prepared_secret_scope: Optional[dict] = None,
+    *,
+    hydrate_secrets: bool = True,
+):
     """Scope config/skills/memory AND credentials to a profile for one turn.
 
     Combines the two seams the multiplexer needs:
@@ -2563,20 +2627,42 @@ def _profile_runtime_scope(profile_home: "Path"):
     """
     from hermes_constants import set_hermes_home_override, reset_hermes_home_override
     from agent.secret_scope import (
-        build_profile_secret_scope,
         set_secret_scope,
         reset_secret_scope,
     )
-    from hermes_cli.env_loader import hydrate_profile_secret_sources
 
     home_token = set_hermes_home_override(str(profile_home))
-    hydrate_profile_secret_sources(Path(profile_home))
-    secret_token = set_secret_scope(build_profile_secret_scope(Path(profile_home)))
-    try:
+    if prepared_secret_scope is not None:
+        secrets = prepared_secret_scope
+    elif hydrate_secrets:
+        secrets = _load_profile_secret_scope(Path(profile_home))
+    else:
+        # Caller already hydrated external sources off-loop (#99519).
+        from agent.secret_scope import build_profile_secret_scope
+
+        secrets = build_profile_secret_scope(Path(profile_home))
+    secret_token = set_secret_scope(secrets)
+    # Per-turn terminal scope (third seam of the profile boundary): installs
+    # the routed profile's COMPLETE terminal policy — never ambient env — via
+    # tools.terminal_scope. Without it terminal_tool reads the process-global
+    # TERMINAL_* vars a previous profile's turn may have pinned
+    # (first-writer-wins backend leak; #68559).
+    from tools.terminal_scope import install_and_reset_profile_terminal_scope
+
+    with install_and_reset_profile_terminal_scope(Path(profile_home)):
+        try:
+            yield
+        finally:
+            reset_secret_scope(secret_token)
+            reset_hermes_home_override(home_token)
+
+
+@_asynccontextmanager
+async def _async_profile_runtime_scope(profile_home: "Path"):
+    """Enter a profile scope without loading secret files on the event loop."""
+    secrets = await asyncio.to_thread(_load_profile_secret_scope, Path(profile_home))
+    with _profile_runtime_scope(Path(profile_home), secrets):
         yield
-    finally:
-        reset_secret_scope(secret_token)
-        reset_hermes_home_override(home_token)
 
 
 def load_gateway_config_for_runner() -> "GatewayConfig":
@@ -2614,13 +2700,40 @@ def load_gateway_config_for_runner() -> "GatewayConfig":
         return cfg
 
 
+async def _discover_gateway_mcp_tools(config: object) -> None:
+    """Run startup MCP discovery for every profile this gateway serves.
+
+    ``discover_mcp_tools`` reads ``mcp_servers`` from ``get_hermes_home()``'s
+    config, so an unscoped call only ever connects the launch profile's
+    servers (#95518). Under multiplex, run it once per served profile inside
+    that profile's ``_profile_runtime_scope`` and carry the scope into the
+    executor thread with ``copy_context()`` (the same shape as
+    ``_run_in_executor_with_context``). Single-profile gateways keep the one
+    unscoped call.
+    """
+    from tools.mcp_tool import discover_mcp_tools
+
+    loop = asyncio.get_running_loop()
+    if not getattr(config, "multiplex_profiles", False):
+        await loop.run_in_executor(None, discover_mcp_tools)
+        return
+    for profile_name, profile_home in _multiplex_profile_homes(config):
+        try:
+            with _profile_runtime_scope(Path(profile_home)):
+                await loop.run_in_executor(None, copy_context().run, discover_mcp_tools)
+        except Exception:
+            logger.warning(
+                "MCP tool discovery failed for profile '%s'", profile_name, exc_info=True,
+            )
+
+
 def _platform_has_bot_credential(platform: "Platform", platform_config: "PlatformConfig") -> bool:
     """Return True when a token-authenticated platform has a usable bot credential.
 
     Platforms that do not use ``PlatformConfig.token`` always return True so we
     never skip them here (Signal session paths, port-binding HTTP adapters, etc.).
     """
-    from gateway.config import PLATFORM_TOKEN_ENV_NAMES
+    from gateway.config import PLATFORM_TOKEN_ENV_NAMES, Platform
 
     if platform not in PLATFORM_TOKEN_ENV_NAMES:
         return True
@@ -2631,6 +2744,26 @@ def _platform_has_bot_credential(platform: "Platform", platform_config: "Platfor
     api_key = getattr(platform_config, "api_key", None) or ""
     if isinstance(api_key, str) and api_key.strip():
         return True
+    # Matrix also authenticates by password login (MATRIX_USER_ID +
+    # MATRIX_PASSWORD, no MATRIX_ACCESS_TOKEN). Those credentials land in
+    # ``extra`` rather than ``.token``, so a token-only check reads a
+    # perfectly reconnectable password-auth config as credential-less and
+    # evicts it from the retry queue on the first transient failure — after
+    # which it stays down until the gateway is restarted by hand. Mirror the
+    # adapter's own gate: homeserver + user_id + password.
+    #
+    # Read ONLY from extra, never os.getenv: build_config() already copies all
+    # three env vars onto extra, and importing this module loads ~/.hermes/.env,
+    # so an env fallback would report "has credential" for every Matrix config
+    # on the box — including the empty-primary multiplex case (#64674) this
+    # check exists to evict.
+    if platform is Platform.MATRIX:
+        extra = getattr(platform_config, "extra", None) or {}
+        if all(
+            str(extra.get(key) or "").strip()
+            for key in ("homeserver", "user_id", "password")
+        ):
+            return True
     return False
 
 
@@ -2982,6 +3115,8 @@ from gateway.session import (
     SessionStore,
     SessionSource,
     SessionContext,
+    TranscriptReadError,
+    _session_key_namespace,
     build_session_context,
     build_session_context_prompt,
     build_channel_continuity_note,
@@ -3039,6 +3174,7 @@ from gateway.restart import (
     DEFAULT_GATEWAY_SIGNAL_INTERRUPT_GRACE_TIMEOUT,
     GATEWAY_FATAL_CONFIG_EXIT_CODE,
     GATEWAY_SERVICE_RESTART_EXIT_CODE,
+    is_global_startup_conflict,
     parse_cron_drain_timeout,
     parse_restart_after_turn_timeout,
     parse_restart_drain_timeout,
@@ -3057,6 +3193,13 @@ from gateway.whatsapp_identity import (
 logger = logging.getLogger(__name__)
 
 
+# Ceiling for the shutdown quiesce of the gateway-owned thread pool. Drain has
+# already waited for the agents, so what is left here is short blocking work
+# (a transcript append, a routing save); anything slower is a stuck worker we
+# must not wait on, and the caller clamps this to the watchdog leash anyway.
+_EXECUTOR_QUIESCE_TIMEOUT = 2.0
+
+
 _OWN_POLICY_OPEN_ENV = {
     Platform.WECOM: ("WECOM_DM_POLICY", "WECOM_GROUP_POLICY", "WECOM_ALLOW_ALL_USERS"),
     Platform.WEIXIN: ("WEIXIN_DM_POLICY", "WEIXIN_GROUP_POLICY", "WEIXIN_ALLOW_ALL_USERS"),
@@ -7447,7 +7590,6 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # Load ephemeral config from config.yaml / env vars.
         # Both are injected at API-call time only and never persisted.
         self._prefill_messages = self._load_prefill_messages()
-        self._ephemeral_system_prompt = self._load_ephemeral_system_prompt()
         self._reasoning_config = self._load_reasoning_config()
         self._service_tier = self._load_service_tier()
         self._show_reasoning = self._load_show_reasoning()
@@ -7645,6 +7787,10 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # context pin; last-delivered voice-channel context) lives on
         # SessionState.conversation — see gateway/session_state.py.
         self._kanban_notifier_profile = self._active_profile_name()
+        # Launch-time identity of the profile that owns ``self.adapters``;
+        # ``_authorization_adapter`` compares against this rather than the
+        # per-turn ``_active_profile_name()`` (see gateway/authz_mixin.py).
+        self._primary_profile_name = self._kanban_notifier_profile
         # Teams meeting pipeline runtime (bound later when msgraph_webhook adapter exists).
         self._teams_pipeline_runtime = None
         self._teams_pipeline_runtime_error: Optional[str] = None
@@ -8058,9 +8204,43 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
 
     _VOICE_MODE_PATH = _hermes_home / "gateway_voice_mode.json"
 
-    def _voice_key(self, platform: Platform, chat_id: str) -> str:
-        """Return a platform-namespaced key for voice mode state."""
-        return f"{platform.value}:{chat_id}"
+    def _voice_key(
+        self, platform: Platform, chat_id: str, profile: Optional[str] = None
+    ) -> str:
+        """Return a platform-namespaced key for voice mode state.
+
+        Under multiplexing the key is additionally namespaced by the profile
+        whose bot speaks in the chat (``<profile>:<platform>:<chat_id>``); the
+        default profile keeps the historical ``<platform>:<chat_id>`` shape so
+        persisted state stays valid. Two bots in one Discord channel otherwise
+        share a key and one profile's ``/voice`` flips the other's (#75198).
+        """
+        base = f"{platform.value}:{chat_id}"
+        profile = profile.strip() if isinstance(profile, str) else ""
+        if not profile or profile == "default":
+            return base
+        return f"{profile}:{base}"
+
+    def _voice_key_for_source(self, source: SessionSource) -> str:
+        """Voice-state key for an inbound source, namespaced by its transport owner.
+
+        Voice mode belongs to the (bot, chat) pair, so the namespace is the
+        profile that OWNS the receiving adapter (``_adapter_profile_for_source``)
+        — the same profile ``_sync_voice_mode_state_to_adapter`` uses on
+        reconnect — not the routed runtime profile.
+        """
+        return self._voice_key(
+            source.platform,
+            source.chat_id,
+            profile=self._adapter_profile_for_source(source),
+        )
+
+    def _bind_voice_input_callback(self, adapter) -> None:
+        """Route voice transcripts back through the adapter that captured them."""
+        if hasattr(adapter, "_voice_input_callback"):
+            adapter._voice_input_callback = functools.partial(
+                self._handle_voice_channel_input, adapter=adapter
+            )
 
     def _load_voice_modes(self) -> Dict[str, str]:
         try:
@@ -8159,7 +8339,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         if hasattr(adapter, "_auto_tts_default"):
             adapter._auto_tts_default = _auto_tts_default
 
-        prefix = f"{platform.value}:"
+        prefix = self._voice_key(platform, "", profile=getattr(adapter, "_owner_profile", None))
         if isinstance(disabled_chats, set):
             disabled_chats.clear()
             disabled_chats.update(
@@ -8433,6 +8613,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             profile=_profile,
         )
 
+    @staticmethod
+    def _telegram_topic_profile_name(source: SessionSource) -> str:
+        """Profile namespace for Telegram topic-mode rows (issue #76423).
+
+        Prefer the profile already stamped on the routed event
+        (``source.profile``). Do **not** fall back to the process-global
+        active profile here — under multiplex that can mis-attribute
+        topic state across bots sharing one ``state.db``.
+        """
+        name = str(getattr(source, "profile", None) or "").strip()
+        return name if name else "default"
+
     def _telegram_topic_mode_enabled(self, source: SessionSource) -> bool:
         """Return whether Telegram DM topic mode is active for this chat."""
         if source.platform != Platform.TELEGRAM or source.chat_type != "dm":
@@ -8446,6 +8638,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             raw = session_db.is_telegram_topic_mode_enabled(
                 chat_id=str(source.chat_id),
                 user_id=str(source.user_id),
+                profile_name=self._telegram_topic_profile_name(source),
             )
         except Exception:
             logger.debug("Failed to read Telegram topic mode state", exc_info=True)
@@ -8482,6 +8675,17 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
 
     _TELEGRAM_LOBBY_REMINDER_COOLDOWN_S = 30.0
 
+    def _telegram_topic_cooldown_key(self, source: SessionSource) -> Optional[str]:
+        """Cooldown key for topic-mode cooldowns: (profile, chat_id).
+
+        Profiles sharing a Telegram private chat_id under multiplex must not
+        suppress each other's lobby reminders / capability hints (#76423).
+        """
+        chat_id = str(source.chat_id or "")
+        if not chat_id:
+            return None
+        return f"{self._telegram_topic_profile_name(source)}:{chat_id}"
+
     def _should_send_telegram_lobby_reminder(self, source: SessionSource) -> bool:
         """Rate-limit root-DM lobby reminders to one message per cooldown window.
 
@@ -8491,15 +8695,15 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         """
         if not hasattr(self, "_telegram_lobby_reminder_ts"):
             self._telegram_lobby_reminder_ts = {}
-        chat_id = str(source.chat_id or "")
-        if not chat_id:
+        key = self._telegram_topic_cooldown_key(source)
+        if not key:
             return True
         import time as _time
         now = _time.monotonic()
-        last = self._telegram_lobby_reminder_ts.get(chat_id, 0.0)
+        last = self._telegram_lobby_reminder_ts.get(key, 0.0)
         if now - last < self._TELEGRAM_LOBBY_REMINDER_COOLDOWN_S:
             return False
-        self._telegram_lobby_reminder_ts[chat_id] = now
+        self._telegram_lobby_reminder_ts[key] = now
         return True
 
     def _telegram_topic_root_lobby_message(self) -> str:
@@ -8547,6 +8751,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             user_id=str(source.user_id or ""),
             session_key=session_entry.session_key,
             session_id=session_entry.session_id,
+            profile_name=self._telegram_topic_profile_name(source),
         )
 
     def _sync_telegram_topic_binding(
@@ -8614,6 +8819,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         try:
             bindings = session_db.list_telegram_topic_bindings_for_chat(
                 chat_id=str(source.chat_id),
+                profile_name=self._telegram_topic_profile_name(source),
             )
         except Exception:
             logger.debug("topic-recover: read failed", exc_info=True)
@@ -8877,12 +9083,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # configured extra_body (chat_template_kwargs, etc.) never reached the
         # model on the gateway path -- only /fast service-tier overrides did.
         service_tier = getattr(self, "_service_tier", None)
-        if not service_tier:
+        if service_tier != "priority":
+            # None (normal) or auto/cold — the bounded window is applied per
+            # request by agent.fast_mode, not pinned into request_overrides.
             route["request_overrides"] = base_request_overrides
             return route
 
         try:
-            overrides = resolve_fast_mode_overrides(route["model"])
+            overrides = resolve_fast_mode_overrides(
+                route["model"],
+                provider=runtime["provider"],
+                base_url=runtime["base_url"],
+            )
         except Exception:
             overrides = None
         # Fast-mode overrides (service_tier / speed) are top-level keys and do
@@ -9483,9 +9695,26 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         except Exception:  # noqa: BLE001 - unreadable source => assume busy
             logger.debug("scale-to-zero: api work count unreadable — staying awake", exc_info=True)
             api_count = 1
+        # An attached dashboard/desktop/TUI client is inbound activity too. It
+        # lives in the DASHBOARD process, so it reaches us as a file mtime that
+        # process refreshes on every WS frame (gateway/scale_to_zero.py). Fold
+        # it into the inbound clock rather than adding a conjunct: the client
+        # then gets the same idle_timeout grace after it disconnects as a chat
+        # message does, and a lingering marker cannot pin the box (an old mtime
+        # is outside idle_timeout just like an old _last_inbound_at).
+        last_inbound = self._last_inbound_at
+        try:
+            from gateway.scale_to_zero import dashboard_client_last_seen
+
+            seen = dashboard_client_last_seen()
+        except Exception:  # noqa: BLE001 - unreadable source => assume busy
+            logger.debug("scale-to-zero: dashboard heartbeat unreadable — staying awake", exc_info=True)
+            seen = time.time()
+        if seen is not None and seen > last_inbound:
+            last_inbound = seen
         return is_idle(
             active_work_count=self._running_agent_count() + cron_count + api_count,
-            seconds_since_last_inbound=time.time() - self._last_inbound_at,
+            seconds_since_last_inbound=time.time() - last_inbound,
             idle_timeout_seconds=self._scale_to_zero_idle_timeout_seconds(),
             has_live_background_work=self._scale_to_zero_has_live_background_work(),
         )
@@ -9722,6 +9951,72 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             depth += 1
         return depth
 
+    def _rescue_orphaned_overflow(
+        self, session_key: str, adapter: Any
+    ) -> Optional["MessageEvent"]:
+        """Pop the oldest orphaned FIFO overflow event for an idle session (#99882).
+
+        The FIFO overflow (``queued_events``) drains only at the post-turn
+        promotion site (``_promote_queued_event`` inside the ``_run_agent``
+        drain).  When a busy window ends without that drain running — the
+        #99882 shape: a follow-up queued during compression-in-flight lands
+        in overflow, compression finishes, the slot event's turn runs, but
+        the drain recursion exits before promoting (or the busy window ends
+        through an exception / interrupt / generation-bump exit that never
+        reaches the promotion site) — the overflow entries are silently
+        orphaned: never dispatched, never persisted, never logged.
+
+        This rescue runs at the point where a NEW event arrives for a
+        session that is NOT busy (the idle entry in
+        ``_process_message_priority``).  If the session went idle with a
+        populated overflow, the oldest orphan is returned so the caller runs
+        it as THIS turn, and the next orphan (if any) is staged into the
+        slot so the post-turn drain continues the chain in arrival order
+        (#28503).  The caller then enqueues the incoming event behind the
+        chain via ``_enqueue_fifo``.
+
+        The returned event is REMOVED from both stores: leaving it in the
+        slot while it also runs as the current turn would make the post-turn
+        ``_dequeue_pending_event`` run it a second time.
+
+        Returns the orphaned event to run now, or ``None`` when there is
+        nothing to rescue (no overflow, slot occupied, or no slot storage).
+        """
+        try:
+            _q_state = self._peek_session_state(session_key)
+            overflow = _q_state.conversation.queued_events if _q_state else None
+            if not overflow:
+                return None
+            pending_slot = getattr(adapter, "_pending_messages", None)
+            if not isinstance(pending_slot, dict) or pending_slot.get(session_key):
+                # Slot occupied (busy) or no slot storage — promotion owns
+                # this; do not fight it from the idle path.
+                return None
+            head = overflow.pop(0)
+            # Keep the slot occupied for the rest of the chain so the drain
+            # promotes in order and any mid-chain arrival routes to overflow
+            # instead of jumping the queue (same invariant as the drain's
+            # own _promote_queued_event).  Only ONE event fits the slot.
+            if overflow:
+                pending_slot[session_key] = overflow.pop(0)
+            logger.warning(
+                "Rescued orphaned FIFO overflow event for idle session "
+                "%s — it was queued during a busy window but the post-turn "
+                "drain never promoted it (#99882)",
+                session_key,
+            )
+            if overflow:
+                logger.warning(
+                    "%d overflow event(s) still queued for session %s after "
+                    "rescue staging (will drain via normal promotion)",
+                    len(overflow),
+                    session_key,
+                )
+            return head
+        except Exception:
+            logger.debug("FIFO overflow rescue failed for %s", session_key, exc_info=True)
+            return None
+
     @staticmethod
     def _is_goal_continuation_event(event_or_text: Any) -> bool:
         """Return True for synthetic /goal continuation turns.
@@ -10088,7 +10383,13 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
     ) -> str:
         """Ephemeral system prompt for this channel/thread.
 
-        Uses ``channel_overrides`` when set, else the global gateway prompt.
+        Uses ``channel_overrides`` when set, else the gateway prompt resolved
+        from the CURRENT profile's config on every call. Callers run inside
+        ``_profile_runtime_scope`` (``run_sync`` under ``_run_agent``), so a
+        routed multiplex profile gets its own ``display.personality`` /
+        ``agent.system_prompt`` instead of a boot-time snapshot of the launch
+        profile's (#89161); ``/personality`` edits take effect on the next
+        turn for the same reason.
         Legacy ``channel_prompts`` are applied separately via ``event.channel_prompt``
         in ``run_sync`` (adapter ``resolve_channel_prompt``), so they are not
         duplicated here.
@@ -10104,7 +10405,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             )
             if override and override.system_prompt:
                 return (override.system_prompt or "").strip()
-        return getattr(self, "_ephemeral_system_prompt", None) or ""
+        return self._load_ephemeral_system_prompt()
 
     @staticmethod
     def _load_reasoning_config(model: str = "") -> dict | None:
@@ -10258,6 +10559,8 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             return None
         if value in {"fast", "priority", "on"}:
             return "priority"
+        if value in {"auto", "cold"}:
+            return value
         logger.warning("Unknown service_tier '%s', ignoring", raw)
         return None
 
@@ -11471,7 +11774,9 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 # deliver=local jobs — and deliver=origin jobs with no
                 # resolvable origin (#43014) — resolve to zero targets and
                 # must stay silent rather than fall back to a home channel.
-                targets = _resolve_delivery_targets(job)
+                # Interrupted notices are failure-category engine status, so
+                # they honor the job's failure_deliver override (NS-788).
+                targets = _resolve_delivery_targets(job, for_failure=True)
             except Exception as e:
                 logger.debug("Cron interrupt targets unresolved for %s: %s", job_id, e)
                 continue
@@ -14043,8 +14348,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 self._sync_voice_mode_state_to_adapter(adapter)
                 # Wire voice input callback at connect time so voice
                 # transcription is forwarded without requiring /voice join.
-                if hasattr(adapter, "_voice_input_callback"):
-                    adapter._voice_input_callback = self._handle_voice_channel_input
+                self._bind_voice_input_callback(adapter)
                 connected_count += 1
                 self._update_platform_runtime_status(
                     platform.value, platform_state="connected", error_code=None, error_message=None,
@@ -14058,20 +14362,30 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 # Python logs "Unclosed client session" at process exit.
                 await self._safe_adapter_disconnect(adapter, platform)
                 if adapter.has_fatal_error:
+                    # A live foreign holder of this bot token / identity is
+                    # a single-writer ownership conflict, not a transient
+                    # blip — even though ``_acquire_platform_lock`` emits it
+                    # retryable so a MID-RUN reconnect can recover (#54167).
+                    # At startup route it as non-retryable: with nothing
+                    # connected the gateway exits 78 instead of sitting alive
+                    # and deaf in the retry queue forever (#83183).
+                    _retryable = adapter.fatal_error_retryable and not (
+                        is_global_startup_conflict(adapter.fatal_error_code)
+                    )
                     self._update_platform_runtime_status(
                         platform.value,
-                        platform_state="retrying" if adapter.fatal_error_retryable else "fatal",
+                        platform_state="retrying" if _retryable else "fatal",
                         error_code=adapter.fatal_error_code,
                         error_message=adapter.fatal_error_message,
                     )
                     target = (
                         startup_retryable_errors
-                        if adapter.fatal_error_retryable
+                        if _retryable
                         else startup_nonretryable_errors
                     )
                     target.append(f"{platform.value}: {adapter.fatal_error_message}")
                     # Queue for reconnection if the error is retryable
-                    if adapter.fatal_error_retryable:
+                    if _retryable:
                         self._failed_platforms[platform] = {
                             "config": platform_config,
                             "attempts": 1,
@@ -14344,6 +14658,13 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # Start background session expiry watcher to finalize expired sessions
         self._spawn_supervised(self._session_expiry_watcher, "session_expiry_watcher")
 
+        # Keep the /model picker's remote catalogs (curated manifest,
+        # OpenRouter live list, Nous Portal recommendations) warm on disk so a
+        # delisted or newly-published model reaches the picker within one TTL
+        # window (model_catalog.ttl_minutes, default 20) without waiting for a
+        # cold /model open to trigger the refresh.
+        self._spawn_supervised(self._model_catalog_refresh_watcher, "model_catalog_refresh_watcher")
+
         # Stall watchdog: pending inbound + stale agent activity → warn user
         # to /new (does not kill the turn; see agent.session_stall_timeout).
         self._spawn_supervised(self._session_stall_watcher, "session_stall_watcher")
@@ -14726,7 +15047,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 if _phome is None:
                     await _reclaim_stale(self)
                 else:
-                    with _profile_runtime_scope(_phome):
+                    async with _async_profile_runtime_scope(_phome):
                         await _reclaim_stale(self)
             except Exception:
                 logger.debug("Stale-handoff reclaim failed", exc_info=True)
@@ -14738,7 +15059,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                         if profile_home is None:
                             await _tick(profile_name)
                         else:
-                            with _profile_runtime_scope(profile_home):
+                            async with _async_profile_runtime_scope(profile_home):
                                 await _tick(profile_name)
                 except asyncio.CancelledError:
                     raise
@@ -14816,14 +15137,22 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             # The watcher already entered _profile_runtime_scope for this
             # profile, so a fresh load resolves that profile's config.yaml
             # and .env (home channel, tokens) rather than the primary's.
+            # Fail closed on a load error: self.config is the primary's, so
+            # falling back would deliver through the right bot to the
+            # WRONG chat and report completed. A failed row the CLI can
+            # retry beats a wrong delivery.
             try:
                 handoff_config = load_gateway_config()
-            except Exception:
-                logger.warning(
+            except Exception as exc:
+                logger.error(
                     "Handoff: could not load config for profile %s; "
-                    "falling back to the primary's config",
+                    "failing the handoff instead of delivering via the "
+                    "primary's config",
                     profile_name, exc_info=True,
                 )
+                raise RuntimeError(
+                    f"could not load config for profile '{profile_name}': {exc}"
+                ) from exc
 
         # Adapter must be live. A relay-fronted gateway registers ONE adapter
         # under Platform.RELAY that fronts N logical platforms — so a literal
@@ -15459,6 +15788,32 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
 
         return sent
 
+    async def _model_catalog_refresh_watcher(self) -> None:
+        """Refresh the /model picker's remote catalogs every TTL window.
+
+        The picker itself only refreshes on a cold or stale open, so a
+        gateway that nobody opens ``/model`` in keeps serving whatever was
+        cached. This loop calls ``model_catalog.refresh_catalogs()`` (manifest
+        + OpenRouter live filter + Nous Portal recommendations) off-thread on
+        the configured cadence (``model_catalog.ttl_minutes``, default 20) so
+        the on-disk caches every surface reads are never older than one window.
+        """
+        from hermes_cli.model_catalog import refresh_catalogs, refresh_interval_seconds
+
+        await asyncio.sleep(30)  # let startup settle
+        while self._running:
+            try:
+                await asyncio.to_thread(refresh_catalogs)
+            except Exception as exc:
+                logger.debug("Model catalog refresh failed: %s", exc)
+            try:
+                interval = refresh_interval_seconds()
+            except Exception:
+                interval = 1200.0
+            deadline = time.monotonic() + interval
+            while self._running and time.monotonic() < deadline:
+                await asyncio.sleep(min(30.0, max(0.0, deadline - time.monotonic())))
+
     async def _session_stall_watcher(self, interval: float = 30.0):
         """Periodic pending-inbound + stale-activity stall watchdog (#72016).
 
@@ -15756,8 +16111,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                         self.adapters[platform] = adapter
                         self._sync_voice_mode_state_to_adapter(adapter)
                         # Wire voice input callback on reconnect as well (#60623).
-                        if hasattr(adapter, "_voice_input_callback"):
-                            adapter._voice_input_callback = self._handle_voice_channel_input
+                        self._bind_voice_input_callback(adapter)
                         self.delivery_router.adapters = self.adapters
                         del self._failed_platforms[platform]
                         self._update_platform_runtime_status(
@@ -16404,6 +16758,21 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 flush_pending_to_file(dict(self._pending_messages), reason="shutdown")
             except Exception:
                 pass
+            # The FIFO tail lives in SessionState.conversation.queued_events,
+            # not in the slot dict above — flush it too or every follow-up
+            # parked in overflow at restart time is lost (#99882).
+            try:
+                from gateway.shutdown_flush import flush_overflow_to_file
+                flush_overflow_to_file(
+                    {
+                        _k: list(_v)
+                        for _k, _v in dict(getattr(self, "_queued_events", None) or {}).items()
+                        if _v
+                    },
+                    reason="shutdown",
+                )
+            except Exception:
+                pass
             # On the real runner these are live SessionState views whose
             # clear() resets one field per session — never a wholesale dict
             # swap, so a concurrent writer on another session can't lose its
@@ -16444,58 +16813,115 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             except Exception as _e:
                 logger.debug("shutdown_cached_clients error: %s", _e)
 
-            # Close SQLite session DBs so the WAL write lock is released.
-            # Without this, --replace and similar restart flows leave the
-            # old gateway's connection holding the WAL lock until Python
-            # actually exits — causing 'database is locked' errors when
-            # the new gateway tries to open the same file.
-            # ``self`` holds the DB at ``_session_db`` (an AsyncSessionDB facade);
-            # unwrap to the sync handle. ``session_store`` holds it at ``_db``.
-            _self_db = getattr(self, "_session_db", None)
-            _self_db = getattr(_self_db, "_db", _self_db)
-            for _db in (_self_db, getattr(getattr(self, "session_store", None), "_db", None)):
-                if _db is None or not hasattr(_db, "close"):
-                    continue
-                try:
-                    _db.close()
-                except Exception as _e:
-                    logger.debug("SessionDB close error: %s", _e)
-            # A multiplexed session_store caches one SessionDB per profile
-            # path (#88532); reading ``_db`` above only resolved the handle
-            # for the shutdown task's own (root) scope. Sweep the rest so
-            # secondary profiles' WAL locks are released before --replace
-            # brings a new gateway up on the same files.
-            _sweep = getattr(
-                getattr(self, "session_store", None), "close_all_db_handles", None
+            # Quiesce the gateway thread pool BEFORE the session databases
+            # are closed.  This used to run *after* the close block below,
+            # which left two holes:
+            #
+            #   (a) `_executor_closing` was still False during the close, so
+            #       any coroutine reaching `_run_in_executor_with_context`
+            #       minted a brand-new pool and ran more blocking DB work
+            #       against handles that had just been closed;
+            #   (b) cancelling `self._background_tasks` above does not stop a
+            #       `run_in_executor` future that already started — the task
+            #       dies, the worker thread keeps writing.
+            #
+            # Either way a write lands after `SessionDB.close()`, which has
+            # already checkpointed the WAL and let SQLite unlink the sidecar.
+            # The late write silently reopens the handle (#94736) and mints a
+            # fresh WAL generation behind that checkpoint, so teardown
+            # checkpoints the same file a second time from a connection the
+            # shutdown log never accounts for — the close-time page-write
+            # damage in #101093 and the split WAL generation in #101064.
+            #
+            # The wait is bounded and clamped to what is left of the shutdown
+            # watchdog leash (minus a second for the close itself), so a stuck
+            # worker can never cost us the post-close cleanup window (#82161).
+            _exec_quiesce_budget = max(
+                0.0,
+                min(
+                    _EXECUTOR_QUIESCE_TIMEOUT,
+                    resolve_shutdown_watchdog_delay(timeout)
+                    - _phase_elapsed()
+                    - 1.0,
+                ),
             )
-            if _sweep is not None:
-                try:
-                    _sweep()
-                except Exception as _e:
-                    logger.debug("SessionDB handle sweep error: %s", _e)
-            # Same sweep for the runner's own per-profile session_search
-            # handles (slash commands resolve them under profile scopes).
-            try:
-                GatewayRunner.close_all_session_db_handles(self)
-            except Exception as _e:
-                logger.debug("Runner SessionDB handle sweep error: %s", _e)
-            # Final sweep: close any shared SessionDB instances still held by
-            # the process-wide registry (in-process tools, cron, mirror, etc.
-            # that opened via get_shared_session_db but weren't released by
-            # the sweeps above).  This is the safety net that guarantees no
-            # WAL write lock survives past gateway shutdown (#90837).
-            try:
-                from hermes_state import close_shared_session_dbs
-                closed = close_shared_session_dbs()
-                if closed:
-                    logger.debug("Closed %d shared SessionDB instance(s) at shutdown", closed)
-            except Exception as _e:
-                logger.debug("Shared SessionDB close error: %s", _e)
-            GatewayRunner._shutdown_executor(self)
-            logger.info(
-                "Shutdown phase: SessionDB close done at +%.2fs",
-                _phase_elapsed(),
+            _exec_live = GatewayRunner._shutdown_executor(
+                self, drain_timeout=_exec_quiesce_budget
             )
+            if _exec_live:
+                # A live worker can still be mid-write against a SessionDB
+                # handle. Checkpointing/closing it now is exactly the
+                # sequence that produced the wrong-page-number corruption in
+                # #101093, so the close path below is skipped entirely
+                # rather than raced — the handle is left open for SQLite to
+                # recover from its own WAL on the next open, which is a
+                # transient "database is locked" on an immediate --replace
+                # at worst, not a corrupt file.
+                logger.warning(
+                    "Shutdown phase: %d executor worker(s) still running after "
+                    "a %.2fs quiesce — skipping the SessionDB close/checkpoint "
+                    "to avoid racing a live write (#101093); handles are left "
+                    "open for SQLite to recover on next open",
+                    _exec_live,
+                    _exec_quiesce_budget,
+                )
+            else:
+                logger.info(
+                    "Shutdown phase: executor quiesced at +%.2fs",
+                    _phase_elapsed(),
+                )
+
+                # Close SQLite session DBs so the WAL write lock is released.
+                # Without this, --replace and similar restart flows leave the
+                # old gateway's connection holding the WAL lock until Python
+                # actually exits — causing 'database is locked' errors when
+                # the new gateway tries to open the same file.
+                # ``self`` holds the DB at ``_session_db`` (an AsyncSessionDB facade);
+                # unwrap to the sync handle. ``session_store`` holds it at ``_db``.
+                _self_db = getattr(self, "_session_db", None)
+                _self_db = getattr(_self_db, "_db", _self_db)
+                for _db in (_self_db, getattr(getattr(self, "session_store", None), "_db", None)):
+                    if _db is None or not hasattr(_db, "close"):
+                        continue
+                    try:
+                        _db.close()
+                    except Exception as _e:
+                        logger.debug("SessionDB close error: %s", _e)
+                # A multiplexed session_store caches one SessionDB per profile
+                # path (#88532); reading ``_db`` above only resolved the handle
+                # for the shutdown task's own (root) scope. Sweep the rest so
+                # secondary profiles' WAL locks are released before --replace
+                # brings a new gateway up on the same files.
+                _sweep = getattr(
+                    getattr(self, "session_store", None), "close_all_db_handles", None
+                )
+                if _sweep is not None:
+                    try:
+                        _sweep()
+                    except Exception as _e:
+                        logger.debug("SessionDB handle sweep error: %s", _e)
+                # Same sweep for the runner's own per-profile session_search
+                # handles (slash commands resolve them under profile scopes).
+                try:
+                    GatewayRunner.close_all_session_db_handles(self)
+                except Exception as _e:
+                    logger.debug("Runner SessionDB handle sweep error: %s", _e)
+                # Final sweep: close any shared SessionDB instances still held by
+                # the process-wide registry (in-process tools, cron, mirror, etc.
+                # that opened via get_shared_session_db but weren't released by
+                # the sweeps above).  This is the safety net that guarantees no
+                # WAL write lock survives past gateway shutdown (#90837).
+                try:
+                    from hermes_state import close_shared_session_dbs
+                    closed = close_shared_session_dbs()
+                    if closed:
+                        logger.debug("Closed %d shared SessionDB instance(s) at shutdown", closed)
+                except Exception as _e:
+                    logger.debug("Shared SessionDB close error: %s", _e)
+                logger.info(
+                    "Shutdown phase: SessionDB close done at +%.2fs",
+                    _phase_elapsed(),
+                )
 
             from gateway.status import remove_pid_file, release_gateway_runtime_lock
             remove_pid_file()
@@ -16693,12 +17119,47 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
     ) -> int:
         """Create+connect one profile's adapters under its runtime scope."""
         from gateway.config import load_gateway_config
+        from hermes_cli.env_loader import hydrate_profile_secret_sources
 
-        with _profile_runtime_scope(profile_home):
+        # Hydrate external secret sources (1Password/vault/...) off-loop ONCE,
+        # then enter the scope without re-hydrating: the sync hydration is
+        # network-bound and would otherwise stall every other profile's
+        # heartbeat while this one boots (same class as the reconnect path).
+        await asyncio.to_thread(hydrate_profile_secret_sources, profile_home)
+
+        with _profile_runtime_scope(profile_home, hydrate_secrets=False):
             profile_runtime_cfg = _load_gateway_runtime_config()
             from hermes_cli.plugins import discover_plugins
 
             discover_plugins()
+
+            # Register this profile's own declarative shell hooks and
+            # outbound webhooks. The startup-time registration in
+            # start() only ever sees the root/default profile's config
+            # (it runs before any profile scope exists), so without this
+            # a secondary profile's `hooks:` block is silently inert —
+            # its turns run under this profile's own plugin manager
+            # (hermes_cli.plugins.get_plugin_manager keys by resolved
+            # home), which never received the callbacks.
+            try:
+                from hermes_cli.config import load_config as _load_profile_config
+                from agent.shell_hooks import (
+                    register_from_config as _register_shell_hooks,
+                )
+                from agent.outbound_webhooks import (
+                    register_from_config as _register_outbound_webhooks,
+                )
+
+                _profile_hooks_cfg = _load_profile_config()
+                _register_shell_hooks(_profile_hooks_cfg, accept_hooks=False)
+                _register_outbound_webhooks(_profile_hooks_cfg)
+            except Exception:
+                logger.warning(
+                    "shell-hook/webhook registration failed for profile '%s'",
+                    profile_name,
+                    exc_info=True,
+                )
+
             profile_cfg = load_gateway_config()
             violation = _own_policy_open_startup_violation(profile_cfg)
         self._snapshot_profile_busy_modes(profile_name, profile_runtime_cfg)
@@ -16732,16 +17193,40 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         for platform, platform_config in profile_cfg.platforms.items():
             if not platform_config.enabled:
                 continue
-            # Relay is shared process-level ingress in multiplex mode. The
-            # active profile owns the one connection; connector-stamped
-            # source.profile routes inbound turns to secondary profiles.
+            # A platform enabled in a secondary profile's config.yaml may
+            # have no credential in that profile's secret scope — the shared
+            # YAML enables it for the default profile only (#84079). Building
+            # an adapter here would treat every credential-less profile as
+            # configured for the platform and one inbound message would fan
+            # out across all of them. Mirror the primary startup loop's
+            # credential gate and skip instead; profiles with their own
+            # credential still connect below.
             if (
                 getattr(self.config, "multiplex_profiles", False)
-                and platform is Platform.RELAY
+                and not _platform_has_bot_credential(platform, platform_config)
+            ):
+                logger.info(
+                    "[MULTIPLEX] Profile '%s': skipping %s - no bot credential "
+                    "in this profile's secrets",
+                    profile_name,
+                    platform.value,
+                )
+                continue
+            # Relay and WhatsApp are shared process-level ingress in multiplex
+            # mode: one connection owned by the active profile, with
+            # route-stamped source.profile fanning inbound turns out to
+            # secondary profiles. The WhatsApp bridge is a single authenticated
+            # session tied to one phone number -- a secondary profile has no
+            # credential of its own to bring, so constructing an adapter for it
+            # only yields a connect/retry loop that stalls startup for every
+            # profile queued behind it.
+            if (
+                getattr(self.config, "multiplex_profiles", False)
+                and platform in (Platform.RELAY, Platform.WHATSAPP)
             ):
                 continue
             try:
-                with _profile_runtime_scope(profile_home):
+                with _profile_runtime_scope(profile_home, hydrate_secrets=False):
                     adapter = self._create_adapter(platform, platform_config)
             except Exception as e:
                 logger.error(
@@ -16825,12 +17310,15 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             self._configure_profile_adapter(adapter, profile_name, platform)
 
             try:
-                with _profile_runtime_scope(profile_home):
+                with _profile_runtime_scope(profile_home, hydrate_secrets=False):
                     success = await self._connect_initial_adapter_with_timeout(
                         adapter, platform
                     )
                 if success:
                     profile_map[platform] = adapter
+                    # Restore persisted /voice state for this bot (#84872) —
+                    # primary startup and every reconnect path already do.
+                    self._sync_voice_mode_state_to_adapter(adapter)
                     if credential_claim is not None:
                         claimed[credential_claim] = profile_name
                     if listener_claim is not None:
@@ -16889,12 +17377,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         adapter.set_platform_event_handler(
             self._make_profile_platform_event_handler(profile_name)
         )
+        # Voice transcripts from this bot's channels dispatch through THIS
+        # adapter (primary wiring lives at connect time; see #75198).
+        self._bind_voice_input_callback(adapter)
         text_modes = getattr(self, "_busy_text_modes_by_profile", None)
         adapter._busy_text_mode = (
             text_modes.get(profile_name, self._busy_text_mode)
             if isinstance(text_modes, dict)
             else self._busy_text_mode
         )
+        # Secondary adapters always carry the profile they serve so prune
+        # paths namespace topic bindings correctly under multiplex (#76423).
+        adapter._hermes_profile_name = profile_name
 
     async def _run_secondary_profile_reconnect(
         self, profile_name: str, platform: Platform
@@ -16907,13 +17401,30 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 adapter = None
                 try:
                     from hermes_cli.profiles import get_profile_dir
+                    from hermes_cli.env_loader import hydrate_profile_secret_sources
                     from gateway.config import load_gateway_config
 
                     profile_home = get_profile_dir(profile_name)
-                    with _profile_runtime_scope(profile_home):
+                    # Like the #16856 MCP discovery path, hydrate external secret
+                    # sources off-loop so they cannot starve platform heartbeats.
+                    await asyncio.to_thread(
+                        hydrate_profile_secret_sources, profile_home
+                    )
+                    with _profile_runtime_scope(profile_home, hydrate_secrets=False):
                         profile_config = load_gateway_config().platforms.get(platform)
                         if profile_config is None or not profile_config.enabled:
                             return
+                        # Mirrors the startup credential gate (#84079): a
+                        # credential removed from this profile's scope must
+                        # not rebuild an adapter that would fan out turns.
+                        if not _platform_has_bot_credential(platform, profile_config):
+                            logger.info(
+                                "Secondary %s reconnect skipped: no bot credential "
+                                "(profile: %s)",
+                                platform.value,
+                                profile_name,
+                            )
+                            return
                         adapter = self._create_adapter(platform, profile_config)
                         if adapter is None:
                             logger.warning(
@@ -17016,6 +17527,26 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         """
         if not getattr(adapter, "fatal_error_retryable", True):
             return
+        if is_global_startup_conflict(getattr(adapter, "fatal_error_code", None)):
+            # Same startup contract as the primary path: a live foreign holder
+            # of this profile's token/identity is an ownership conflict, not
+            # a transient blip. Park it fatal (like ``duplicate_credential``)
+            # instead of retry-storming the token every backoff (#83183).
+            logger.error(
+                "[MULTIPLEX] Profile '%s': %s credential is held by another "
+                "gateway (%s) — parked, not retried. %s",
+                profile_name,
+                platform.value,
+                adapter.fatal_error_code,
+                adapter.fatal_error_message or "",
+            )
+            self._update_platform_runtime_status(
+                f"{profile_name}:{platform.value}",
+                platform_state="fatal",
+                error_code=adapter.fatal_error_code,
+                error_message=adapter.fatal_error_message,
+            )
+            return
 
         async def _await_running_then_schedule() -> None:
             if self._running:
@@ -17157,7 +17688,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             except Exception:
                 pass
             if profile_home is not None:
-                with _profile_runtime_scope(profile_home):
+                async with _async_profile_runtime_scope(profile_home):
                     return await self._handle_message(event)
             return await self._handle_message(event)
 
@@ -17221,7 +17752,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 if getattr(source, "profile", None)
                 else default_home
             )
-            with _profile_runtime_scope(profile_home):
+            async with _async_profile_runtime_scope(profile_home):
                 return await self._handle_message(event)
 
         return _handler
@@ -17364,6 +17895,16 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             # of a bot token. Including its secret keeps multiplexed profiles
             # from spawning competing sidecars for the same account and port.
             "_project_secret",
+            # Feishu/Lark authenticates with an app_id/app_secret pair rather
+            # than a single token (one active WebSocket connection per app).
+            # app_id is stable, log-safe, and already used as the adapter's
+            # _app_lock_identity, so including it lets the multiplex guard
+            # refuse cloned profiles competing for the same Feishu app.
+            "_app_id",
+            # Same class: Teams (client_id/client_secret) and WeCom
+            # (bot_id/secret) authenticate with an app-style id pair too.
+            "_client_id",
+            "_bot_id",
         ):
             val = getattr(adapter, attr, None)
             if isinstance(val, str) and val.strip():
@@ -17394,11 +17935,27 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         return hashlib.sha256(("hermes-mux:" + token).encode("utf-8")).hexdigest()[:16]
 
     def _create_adapter(
-        self, 
-        platform: Platform, 
-        config: Any
+        self,
+        platform: Platform,
+        config: Any,
     ) -> Optional[BasePlatformAdapter]:
-        """Create the appropriate adapter for a platform.
+        """Create an adapter and bind it to this gateway runner.
+
+        Every lifecycle path — primary/secondary startup and reconnect — goes
+        through this method. Keep runner binding here so adapters can resolve
+        inbound profile routes before handlers or ``connect()`` run.
+        """
+        adapter = self._instantiate_adapter(platform, config)
+        if adapter is not None:
+            adapter.gateway_runner = self
+        return adapter
+
+    def _instantiate_adapter(
+        self,
+        platform: Platform,
+        config: Any,
+    ) -> Optional[BasePlatformAdapter]:
+        """Instantiate the appropriate adapter for a platform.
 
         Checks the platform_registry first (plugin adapters), then falls
         through to the built-in if/elif chain for core platforms.
@@ -17419,14 +17976,6 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             if platform_registry.is_registered(platform.value):
                 adapter = platform_registry.create_adapter(platform.value, config)
                 if adapter is not None:
-                    # Inject a back-reference to the gateway runner so every
-                    # adapter can (a) deliver cross-platform admin alerts and
-                    # (b) resolve inbound profile routing through
-                    # ``runner._profile_name_for_source``. Unconditional:
-                    # ``BasePlatformAdapter`` declares ``gateway_runner``, so
-                    # this reaches ALL platforms (not just the ones that
-                    # pre-declared it), making profile routing platform-generic.
-                    adapter.gateway_runner = self
                     return adapter
                 # Registered but failed to instantiate — don't silently fall
                 # through to built-ins (there are none for plugin platforms).
@@ -17478,18 +18027,14 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             if not check_api_server_requirements():
                 logger.warning("API Server: aiohttp not installed")
                 return None
-            adapter = APIServerAdapter(config)
-            adapter.gateway_runner = self
-            return adapter
+            return APIServerAdapter(config)
 
         elif platform == Platform.WEBHOOK:
             from gateway.platforms.webhook import WebhookAdapter, check_webhook_requirements
             if not check_webhook_requirements():
                 logger.warning("Webhook: aiohttp not installed")
                 return None
-            adapter = WebhookAdapter(config)
-            adapter.gateway_runner = self  # For cross-platform delivery
-            return adapter
+            return WebhookAdapter(config)
 
         elif platform == Platform.MSGRAPH_WEBHOOK:
             from gateway.platforms.msgraph_webhook import (
@@ -17544,11 +18089,30 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         ``profile_name`` binds the callback to the secondary adapter's own
         multiplex profile, so its ``SessionSource`` resolves that profile's
         secret scope instead of falling back to the active profile.
+
+        For the shared primary adapter under ``multiplex_profiles``
+        (``profile_name`` is None) the callback mirrors the inbound message
+        path exactly: the chat's ``profile_routes`` match is stamped on the
+        source so the routed profile's pairing store is consulted, while the
+        allowlist/gate reads stay under the transport (launch) home via
+        ``_is_user_authorized_for_source`` — the same split
+        ``_make_default_profile_message_handler`` applies. Without this an
+        inline-button caller approved only in the routed profile's pairing
+        store was denied (#86296), because the adapter's callback source was
+        never route-stamped.
         """
+        multiplex = bool(getattr(self.config, "multiplex_profiles", False))
+        transport_home = (
+            Path(get_hermes_home()) if multiplex and profile_name is None else None
+        )
+
         def check(
             user_id: str,
             chat_type: Optional[str] = None,
             chat_id: Optional[str] = None,
+            *,
+            is_bot: bool = False,
+            thread_id: Optional[str] = None,
         ) -> bool:
             if not user_id:
                 return False
@@ -17557,9 +18121,34 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 chat_id=chat_id or "",
                 chat_type=chat_type or "group",
                 user_id=user_id,
+                thread_id=thread_id,
+                is_bot=bool(is_bot),
                 profile=profile_name,
             )
-            return self._is_user_authorized(source)
+            # Same in-process transport provenance ``build_source`` retains, so
+            # adapter-level policy reads (config.yaml group_allowed_chats,
+            # allow_from) resolve the receiving adapter even once the routed
+            # profile is stamped below.
+            registry = (
+                (getattr(self, "_profile_adapters", None) or {}).get(profile_name)
+                if profile_name
+                else getattr(self, "adapters", None)
+            ) or {}
+            adapter = registry.get(platform)
+            if adapter is not None:
+                source._transport_adapter_ref = _weakref.ref(adapter)
+            if transport_home is None:
+                return self._is_user_authorized(source)
+            source._authorization_profile_home = transport_home
+            from gateway.profile_routing import ProfileRouteRejected
+
+            try:
+                source.profile = self._profile_name_for_source(source)
+            except ProfileRouteRejected:
+                # Same fail-closed outcome as the ingress gate in
+                # ``_handle_message`` for a route to an unserved profile.
+                return False
+            return self._is_user_authorized_for_source(source)
         return check
 
 
@@ -19639,6 +20228,50 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 _quick_key,
             )
             return _limit_message
+
+        # ── FIFO orphan rescue (#99882) ────────────────────────────────
+        # If this session went idle with a populated overflow (queued
+        # during a busy window whose post-turn drain never promoted —
+        # e.g. a compression-demoted follow-up after the compression
+        # window ended through an exit that skipped the promotion site),
+        # those events were silently orphaned.  We are starting the next
+        # turn for this session NOW: re-stage the orphans in FIFO order
+        # and enqueue the incoming event behind them, so arrival order
+        # (#28503) holds: oldest orphan runs as this turn, the rest drain
+        # in order, the new message last.  Skipped for control commands
+        # (/stop etc. own their own semantics) and internal events.
+        try:
+            _orphan_adapter = self._adapter_for_source(source)
+            if (
+                _orphan_adapter is not None
+                and not bool(getattr(event, "internal", False))
+                and not event.get_command()
+            ):
+                _rescued = self._rescue_orphaned_overflow(
+                    _quick_key, _orphan_adapter
+                )
+                if _rescued is not None:
+                    # The oldest orphan runs as THIS turn.  Park the
+                    # incoming event behind the rest of the chain: into the
+                    # slot when the chain was a single orphan (so the
+                    # post-turn drain picks it up), otherwise into overflow
+                    # behind the already-staged next orphan (FIFO).
+                    self._enqueue_fifo(_quick_key, event, _orphan_adapter)
+                    event = _rescued
+                    # Same session key by construction; carry the orphan's
+                    # own source so reply anchors / thread metadata point
+                    # at the message that is actually being answered.
+                    _rescued_source = getattr(_rescued, "source", None)
+                    if _rescued_source is not None:
+                        source = _rescued_source
+                    is_internal = bool(getattr(_rescued, "internal", False))
+        except Exception:
+            logger.debug(
+                "FIFO orphan rescue pre-claim failed for %s",
+                _quick_key,
+                exc_info=True,
+            )
+
         _claim_state = self._session_state(_quick_key)
         if _active_session_lease is not None:
             _claim_state.turn.lease = _active_session_lease
@@ -20055,7 +20688,12 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 from agent.context_references import preprocess_context_references_async
                 from agent.model_metadata import get_model_context_length_async
 
-                _msg_cwd = os.environ.get("TERMINAL_CWD", os.path.expanduser("~"))
+                try:
+                    from tools.terminal_scope import terminal_env as _ts_env
+                except ImportError:
+                    _msg_cwd = os.environ.get("TERMINAL_CWD", os.path.expanduser("~"))
+                else:
+                    _msg_cwd = _ts_env("TERMINAL_CWD", os.path.expanduser("~"))
                 _msg_config_ctx = None
                 _msg_cfg = None
                 _msg_model_cfg = {}
@@ -20166,7 +20804,9 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
     ) -> Optional[str]:
         """Run inbound preprocessing under the routed profile when multiplexed."""
         if getattr(getattr(self, "config", None), "multiplex_profiles", False):
-            with _profile_runtime_scope(self._resolve_profile_home_for_source(source)):
+            async with _async_profile_runtime_scope(
+                self._resolve_profile_home_for_source(source)
+            ):
                 return await self._prepare_inbound_message_text(
                     event=event,
                     source=source,
@@ -20548,6 +21188,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 binding = (await self._session_db.get_telegram_topic_binding(
                     chat_id=str(source.chat_id),
                     thread_id=str(source.thread_id),
+                    profile_name=self._telegram_topic_profile_name(source),
                 )) if self._session_db else None
             except Exception:
                 logger.debug("Failed to read Telegram topic binding", exc_info=True)
@@ -20846,8 +21487,23 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         # began processing if the gateway died while it was still waiting.
         await self._mark_durable_active_turn(event, session_entry.session_key)
 
-        # Load conversation history from transcript
-        history = await self.async_session_store.load_transcript(session_entry.session_id)
+        # Load conversation history from transcript. An unreadable canonical
+        # store is not an empty conversation: stop before the agent can invent
+        # continuity from a plausible-looking []. This return happens before
+        # the broad cleanup finally below, so restore task-local context here;
+        # the outer dispatch still clears the durable marker and turn lease.
+        try:
+            history = await self.async_session_store.load_transcript(
+                session_entry.session_id
+            )
+        except TranscriptReadError:
+            self._clear_session_env(_session_env_tokens)
+            return (
+                "⚠️ This session's history is temporarily unavailable, so "
+                "this message was not processed. Ask the operator to inspect "
+                "state.db, then resend after it is healthy. Use /reset only "
+                "if you intentionally want to start a new conversation."
+            )
         
         # -----------------------------------------------------------------
         # Session hygiene: auto-compress pathologically large transcripts
@@ -21288,8 +21944,22 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                                     _hyg_commit_fence = CompressionCommitFence(
                                         total_ceiling_seconds=_hyg_total_ceiling_seconds
                                     )
+                                    # Default executor (NOT self._get_executor):
+                                    # a fence-cancelled hung summary must never
+                                    # occupy one of the gateway's agent-work
+                                    # slots. But it MUST run inside the caller's
+                                    # contextvars: under multiplex_profiles the
+                                    # profile secret scope / HERMES_HOME override
+                                    # live in ContextVars, and a bare
+                                    # run_in_executor worker starts with an empty
+                                    # Context — the summary model's
+                                    # get_secret(<PROVIDER>_API_KEY) then fails
+                                    # closed (UnscopedSecretError) and every
+                                    # hygiene compaction silently degrades to a
+                                    # lossy truncation (#100849 bundle).
                                     _hyg_future = loop.run_in_executor(
                                         None,
+                                        copy_context().run,
                                         lambda: _hyg_agent._compress_context(
                                             _hyg_msgs, "",
                                             approx_tokens=_approx_tokens,
@@ -21437,6 +22107,175 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                                         # uncompressed) but with distinct provenance,
                                         # user message, and NO failure-cooldown
                                         # increment.
+                                        #
+                                        # #97963: decouple the TURN from the
+                                        # COMPRESSION. When the worker's commit is
+                                        # watermark-fenced (it captured the session's
+                                        # active-row watermark at compression start,
+                                        # so rows appended after that point — this
+                                        # released turn included — survive its late
+                                        # commit verbatim as cloned concurrent tail),
+                                        # the already-running attempt KEEPS its commit
+                                        # admission: the user's turn proceeds on the
+                                        # uncompressed transcript NOW, and the summary
+                                        # is adopted when the detached worker reaches
+                                        # its own watermark-fenced commit transaction
+                                        # (archive_and_compact / the rotation publish
+                                        # path — the next safe boundary). Before this,
+                                        # the fence was ALWAYS cancelled here, burning
+                                        # the full summary attempt — for a thinking
+                                        # summary model whose reasoning prefix alone
+                                        # exceeds the 10s hold, that made hygiene
+                                        # auto-compression fail 100% of the time while
+                                        # paying the summary model per turn. The turn
+                                        # itself is still released at the same budget:
+                                        # only the fate of the detached worker's
+                                        # RESULT changes. If the commit is NOT
+                                        # watermark-fenced (no session_db, watermark
+                                        # capture failed, legacy lock API), a late
+                                        # commit could clobber newer turns, so cancel
+                                        # exactly as before — never worse than the
+                                        # status quo.
+                                        _hyg_keep_admission = bool(
+                                            getattr(
+                                                _hyg_commit_fence,
+                                                "commit_watermark_fenced",
+                                                False,
+                                            )
+                                        ) and not _hyg_commit_fence.is_cancelled
+                                        if _hyg_keep_admission:
+                                            self._defer_agent_cleanup_until_future_done(
+                                                _hyg_future,
+                                                _hyg_agent,
+                                                context="session hygiene turn-hold",
+                                            )
+                                            _hyg_cleanup_deferred = True
+                                            # NO retry-after here (#97963 (b)): the
+                                            # attempt is still running toward a real
+                                            # commit, and arming the flat 60s
+                                            # retry-after would ALSO block the
+                                            # agent-side preflight compressor from a
+                                            # fresh chance ("Skipping preflight
+                                            # compression: same-session cooldown
+                                            # active"). Re-attempt spacing is covered
+                                            # by the durable compression lock instead:
+                                            # the next turn's hygiene pre-check skips
+                                            # while this worker's lease is held
+                                            # (_session_has_compression_in_flight).
+                                            # The flat retry-after is recorded by the
+                                            # done-callback below ONLY if the worker
+                                            # ends without committing anything.
+                                            _hyg_deferred_sid = session_entry.session_id
+                                            _hyg_deferred_key = session_key
+                                            _hyg_deferred_agent = _hyg_agent
+
+                                            def _hyg_adopt_or_space_retry(
+                                                _fut,
+                                                _gw=self,
+                                                _sid=_hyg_deferred_sid,
+                                                _skey=_hyg_deferred_key,
+                                                _agent=_hyg_deferred_agent,
+                                            ):
+                                                try:
+                                                    _exc = _fut.exception()
+                                                except (
+                                                    asyncio.CancelledError,
+                                                    Exception,
+                                                ):
+                                                    _exc = None
+                                                    _committed = False
+                                                else:
+                                                    _committed = _exc is None and (
+                                                        bool(
+                                                            getattr(
+                                                                _agent,
+                                                                "_last_compaction_in_place",
+                                                                False,
+                                                            )
+                                                        )
+                                                        or getattr(
+                                                            _agent, "session_id", _sid
+                                                        )
+                                                        != _sid
+                                                    )
+                                                if _committed:
+                                                    logger.info(
+                                                        "Session hygiene compression for "
+                                                        "session %s finished after the "
+                                                        "turn-hold was released — summary "
+                                                        "adopted at the watermark-fenced "
+                                                        "commit boundary (#97963)",
+                                                        _sid,
+                                                    )
+                                                    try:
+                                                        _reset_hygiene_failure_streak(
+                                                            _gw, _skey
+                                                        )
+                                                    except Exception as _rs_err:
+                                                        logger.debug(
+                                                            "hygiene streak reset after "
+                                                            "deferred adoption failed: %s",
+                                                            _rs_err,
+                                                        )
+                                                else:
+                                                    # Nothing to adopt (summary failed,
+                                                    # fence refused the commit, or the
+                                                    # attempt was superseded). Restore
+                                                    # the pre-#97963 spacing so
+                                                    # sustained traffic does not spawn
+                                                    # and abandon a fresh compressor
+                                                    # every turn. Flat and
+                                                    # non-escalating: the streak must
+                                                    # not advance for a deferral.
+                                                    _record_hygiene_cooldown(
+                                                        _gw, _sid,
+                                                        _HYGIENE_TURNHOLD_RETRY_SECONDS,
+                                                        "hygiene compression deferred: "
+                                                        "turn-hold budget expired and the "
+                                                        "detached attempt did not commit",
+                                                    )
+
+                                            _hyg_future.add_done_callback(
+                                                _hyg_adopt_or_space_retry
+                                            )
+                                            from agent.session_activity import (
+                                                ActivityProvenance,
+                                            )
+                                            _stamp_hygiene_compression_provenance(
+                                                _hyg_agent,
+                                                "session hygiene compression turn-hold",
+                                                ActivityProvenance.AGENT_COMPRESSION_TURNHOLD,
+                                                "hygiene compression turn-hold "
+                                                "activity stamp failed",
+                                            )
+                                            logger.info(
+                                                "Session hygiene compression for session %s "
+                                                "exceeded turn-hold budget (%.1fs); "
+                                                "proceeding without compression this turn — "
+                                                "the watermark-fenced worker keeps its "
+                                                "commit admission and the summary will be "
+                                                "adopted when it finishes",
+                                                session_entry.session_id,
+                                                time.monotonic() - _hyg_wait_started,
+                                            )
+                                            _turnhold_msg = t(
+                                                "gateway.compress.turnhold_deferred"
+                                            )
+                                            try:
+                                                _adapter = self._adapter_for_source(source)
+                                                if _adapter and source.chat_id:
+                                                    await _adapter.send(
+                                                        source.chat_id,
+                                                        _turnhold_msg,
+                                                        metadata=_hyg_meta,
+                                                    )
+                                            except Exception as _werr:
+                                                logger.warning(
+                                                    "Failed to deliver compression-turnhold "
+                                                    "notice to user: %s",
+                                                    _werr,
+                                                )
+                                            raise
                                         _cancelled = None
                                         while _cancelled is None:
                                             if _hyg_commit_fence.commit_in_flight:
@@ -22003,6 +22842,14 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                                             _hyg_agent, context="session hygiene"
                                         )
 
+                    except HygieneTurnHoldExceeded:
+                        # Availability boundary, not a failure — already logged
+                        # at INFO by the turn-hold handler. Must not hit the
+                        # generic "auto-compress failed" warning below: that
+                        # log is how thinking-model deployments read as
+                        # permanently broken (#97963; surfaced by @686f6c61
+                        # in PR #99657).
+                        pass
                     except Exception as e:
                         logger.warning(
                             "Session hygiene auto-compress failed: %s", e
@@ -22443,7 +23290,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                     model=agent_result.get("model"),
                     context_tokens=agent_result.get("last_prompt_tokens", 0) or 0,
                     context_length=agent_result.get("context_length") or None,
-                    cwd=os.environ.get("TERMINAL_CWD", ""),
+                    cwd=_terminal_scope_cwd(""),
                     turn_seconds=_turn_seconds,
                 )
             except Exception as _footer_err:
@@ -23868,15 +24715,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
 
         # Wire callbacks BEFORE join so voice input arriving immediately
         # after connection is not lost.
-        if hasattr(adapter, "_voice_input_callback"):
-            adapter._voice_input_callback = self._handle_voice_channel_input
+        self._bind_voice_input_callback(adapter)
+        voice_profile = self._adapter_profile_for_source(event.source)
         if hasattr(adapter, "_on_voice_disconnect"):
-            adapter._on_voice_disconnect = self._handle_voice_timeout_cleanup
+            adapter._on_voice_disconnect = functools.partial(
+                self._handle_voice_timeout_cleanup, adapter=adapter
+            )
         # Let the adapter's inactivity timer see the live voice-reply mode so it
         # doesn't disconnect a deliberately text-only (/voice off) session.
         if hasattr(adapter, "_voice_mode_getter"):
             adapter._voice_mode_getter = lambda chat_id: self._voice_mode.get(
-                self._voice_key(Platform.DISCORD, str(chat_id)), "off"
+                self._voice_key(Platform.DISCORD, str(chat_id), profile=voice_profile),
+                "off",
             )
 
         try:
@@ -23896,7 +24746,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             adapter._voice_text_channels[guild_id] = int(event.source.chat_id)
             if hasattr(adapter, "_voice_sources"):
                 adapter._voice_sources[guild_id] = event.source.to_dict()
-            self._voice_mode[self._voice_key(event.source.platform, event.source.chat_id)] = "all"
+            self._voice_mode[self._voice_key_for_source(event.source)] = "all"
             self._save_voice_modes()
             self._set_adapter_auto_tts_enabled(adapter, event.source.chat_id, enabled=True)
             return (
@@ -23923,21 +24773,26 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         except Exception as e:
             logger.warning("Error leaving voice channel: %s", e)
         # Always clean up state even if leave raised an exception
-        self._voice_mode[self._voice_key(event.source.platform, event.source.chat_id)] = "off"
+        self._voice_mode[self._voice_key_for_source(event.source)] = "off"
         self._save_voice_modes()
         self._set_adapter_auto_tts_disabled(adapter, event.source.chat_id, disabled=True)
         if hasattr(adapter, "_voice_input_callback"):
             adapter._voice_input_callback = None
         return "Left voice channel."
 
-    def _handle_voice_timeout_cleanup(self, chat_id: str) -> None:
+    def _handle_voice_timeout_cleanup(self, chat_id: str, *, adapter=None) -> None:
         """Called by the adapter when a voice channel times out.
 
         Cleans up runner-side voice_mode state that the adapter cannot reach.
+        ``adapter`` is the Discord adapter that timed out (bound at join time);
+        under multiplexing that is a specific profile's bot, not necessarily
+        ``self.adapters[DISCORD]``.
         """
-        self._voice_mode[self._voice_key(Platform.DISCORD, chat_id)] = "off"
+        if adapter is None:
+            adapter = self.adapters.get(Platform.DISCORD)
+        profile = getattr(adapter, "_owner_profile", None)
+        self._voice_mode[self._voice_key(Platform.DISCORD, chat_id, profile=profile)] = "off"
         self._save_voice_modes()
-        adapter = self.adapters.get(Platform.DISCORD)
         self._set_adapter_auto_tts_disabled(adapter, chat_id, disabled=True)
 
     def _is_duplicate_voice_transcript(self, guild_id: int, user_id: int, transcript: str) -> bool:
@@ -23982,14 +24837,18 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         return False
 
     async def _handle_voice_channel_input(
-        self, guild_id: int, user_id: int, transcript: str
+        self, guild_id: int, user_id: int, transcript: str, *, adapter=None
     ):
         """Handle transcribed voice from a user in a voice channel.
 
         Creates a synthetic MessageEvent and processes it through the
         adapter's full message pipeline (session, typing, agent, TTS reply).
+        ``adapter`` is the Discord adapter that captured the audio (bound via
+        ``_bind_voice_input_callback``); under multiplexing each profile's bot
+        must dispatch through its own adapter, never the default profile's.
         """
-        adapter = self.adapters.get(Platform.DISCORD)
+        if adapter is None:
+            adapter = self.adapters.get(Platform.DISCORD)
         if not adapter:
             return
 
@@ -24011,6 +24870,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 user_id=str(user_id),
                 user_name=str(user_id),
                 chat_type="channel",
+                profile=getattr(adapter, "_owner_profile", None),
             )
 
         # Check authorization before processing voice input
@@ -24082,11 +24942,11 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             return False
 
         chat_id = event.source.chat_id
-        voice_key = self._voice_key(event.source.platform, chat_id)
+        voice_key = self._voice_key_for_source(event.source)
         voice_mode = self._voice_mode.get(voice_key)
         is_voice_input = (event.message_type == MessageType.VOICE)
 
-        adapter = self.adapters.get(event.source.platform)
+        adapter = self._adapter_for_source(event.source)
         adapter_auto_tts = False
         if adapter and hasattr(adapter, "_should_auto_tts_for_chat"):
             try:
@@ -25116,6 +25976,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 binding = await session_db.get_telegram_topic_binding(
                     chat_id=str(source.chat_id),
                     thread_id=str(source.thread_id),
+                    profile_name=self._telegram_topic_profile_name(source),
                 )
                 if binding and str(binding.get("session_id") or "") != str(session_id):
                     return
@@ -25227,15 +26088,15 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         """
         if not hasattr(self, "_telegram_capability_hint_ts"):
             self._telegram_capability_hint_ts = {}
-        chat_id = str(source.chat_id or "")
-        if not chat_id:
+        key = self._telegram_topic_cooldown_key(source)
+        if not key:
             return True
         import time as _time
         now = _time.monotonic()
-        last = self._telegram_capability_hint_ts.get(chat_id, 0.0)
+        last = self._telegram_capability_hint_ts.get(key, 0.0)
         if now - last < self._TELEGRAM_CAPABILITY_HINT_COOLDOWN_S:
             return False
-        self._telegram_capability_hint_ts[chat_id] = now
+        self._telegram_capability_hint_ts[key] = now
         return True
 
     def _telegram_topic_help_text(self) -> str:
@@ -25273,22 +26134,28 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             currently_enabled = await self._session_db.is_telegram_topic_mode_enabled(
                 chat_id=chat_id,
                 user_id=str(source.user_id or ""),
+                profile_name=self._telegram_topic_profile_name(source),
             )
         except Exception:
             currently_enabled = False
         if not currently_enabled:
             return "Multi-session topic mode is not currently enabled for this chat."
         try:
-            await self._session_db.disable_telegram_topic_mode(chat_id=chat_id)
+            await self._session_db.disable_telegram_topic_mode(
+                chat_id=chat_id,
+                profile_name=self._telegram_topic_profile_name(source),
+            )
         except Exception as exc:
             logger.exception("Failed to disable Telegram topic mode")
             return f"Failed to disable topic mode: {exc}"
-        # Reset per-chat debounce state so the user doesn't see a stale
-        # cooldown on the next activation.
-        for attr in ("_telegram_lobby_reminder_ts", "_telegram_capability_hint_ts"):
-            store = getattr(self, attr, None)
-            if isinstance(store, dict):
-                store.pop(chat_id, None)
+        # Reset per-profile+chat debounce state so the user doesn't see a
+        # stale cooldown on the next activation (issue #76423).
+        cooldown_key = self._telegram_topic_cooldown_key(source)
+        if cooldown_key:
+            for attr in ("_telegram_lobby_reminder_ts", "_telegram_capability_hint_ts"):
+                store = getattr(self, attr, None)
+                if isinstance(store, dict):
+                    store.pop(cooldown_key, None)
         return (
             "Multi-session topic mode is now OFF for this chat.\n\n"
             "Existing topics in Telegram aren't removed — they'll just stop "
@@ -25310,6 +26177,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             sessions = await self._session_db.list_unlinked_telegram_sessions_for_user(
                 chat_id=str(source.chat_id),
                 user_id=str(source.user_id),
+                profile_name=self._telegram_topic_profile_name(source),
                 limit=10,
             )
         except Exception:
@@ -25359,9 +26227,11 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             return "That session does not belong to this Telegram user."
 
         linked = await self._session_db.is_telegram_session_linked_to_topic(session_id=session_id)
+        topic_profile = self._telegram_topic_profile_name(source)
         current_binding = await self._session_db.get_telegram_topic_binding(
             chat_id=str(source.chat_id),
             thread_id=str(source.thread_id),
+            profile_name=topic_profile,
         )
         if linked:
             if not current_binding or current_binding.get("session_id") != session_id:
@@ -25376,6 +26246,7 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 session_key=session_key,
                 session_id=session_id,
                 managed_mode="restored",
+                profile_name=topic_profile,
             )
         except ValueError as exc:
             if "already linked" in str(exc):
@@ -25412,25 +26283,55 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
         Split out from ``_handle_reload_mcp_command`` so the confirmation
         wrapper can invoke the same path whether the user confirmed via
         button, text reply, or has the confirm gate disabled.
+
+        Under multiplex the reload runs inside the requesting profile's
+        runtime scope (entered here when the caller — e.g. a button-confirm
+        callback — did not), and only that profile's servers are torn down
+        and rediscovered (#95518).
         """
-        loop = asyncio.get_running_loop()
+        multiplex = bool(getattr(self.config, "multiplex_profiles", False))
+        if multiplex and not get_hermes_home_override():
+            profile_home = self._resolve_profile_home_for_source(event.source)
+            with _profile_runtime_scope(Path(profile_home)):
+                return await self._execute_mcp_reload(event)
         try:
             from tools.mcp_tool import shutdown_mcp_servers, discover_mcp_tools, _servers, _lock
+            from tools.mcp_tool import _server_scope_keys, reprobe_tool_availability
+            from tools.registry import registry
+
+            reload_scope = registry.current_scope_key() if multiplex else None
+
+            def _scoped_server_names() -> set:
+                with _lock:
+                    return {
+                        name for name in _servers
+                        if reload_scope is None or _server_scope_keys.get(name) == reload_scope
+                    }
 
             # Capture old server names before shutdown
-            with _lock:
-                old_servers = set(_servers.keys())
+            old_servers = _scoped_server_names()
 
             # Read new config before shutting down, so we know what will be added/removed
             # Shutdown existing connections
-            await loop.run_in_executor(None, shutdown_mcp_servers)
+            await self._run_in_executor_with_context(
+                lambda: shutdown_mcp_servers(scope=reload_scope)
+            )
+            # Explicit reload also re-probes tool availability (check_fn).
+            reprobe_tool_availability()
 
             # Reconnect by discovering tools (reads config.yaml fresh)
-            new_tools = await loop.run_in_executor(None, discover_mcp_tools)
+            new_tools = await self._run_in_executor_with_context(discover_mcp_tools)
 
             # Compute what changed
-            with _lock:
-                connected_servers = set(_servers.keys())
+            connected_servers = _scoped_server_names()
+            if reload_scope is not None:
+                from tools.mcp_tool import _mcp_tool_server_names
+
+                with _lock:
+                    new_tools = [
+                        n for n in new_tools
+                        if _mcp_tool_server_names.get(n) in connected_servers
+                    ]
 
             added = connected_servers - old_servers
             removed = old_servers - connected_servers
@@ -25459,8 +26360,17 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 _cache = getattr(self, "_agent_cache", None)
                 _cache_lock = getattr(self, "_agent_cache_lock", None)
                 if _cache_lock is not None and _cache:
+                    # Multiplex: only this profile's sessions. Rebuilding
+                    # another profile's agent inside this scope would hand it
+                    # this profile's tool registry.
+                    _ns_prefix = (
+                        _session_key_namespace(event.source.profile) + ":"
+                        if multiplex else None
+                    )
                     with _cache_lock:
                         for _sess_key, _entry in list(_cache.items()):
+                            if _ns_prefix and not str(_sess_key).startswith(_ns_prefix):
+                                continue
                             try:
                                 _agent = _entry[0] if isinstance(_entry, tuple) else _entry
                             except Exception:
@@ -25759,6 +26669,13 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                     metadata.setdefault("scope_id", str(team_id))
                 if user_id:
                     metadata.setdefault("user_id", str(user_id))
+        # Routed profile for shared state.db namespaces (#76423): the Telegram
+        # prune path needs it because under profile_routes the transport
+        # adapter's stamp is not the profile that wrote the binding.
+        profile = str(getattr(source, "profile", None) or "").strip()
+        if profile and metadata is not None:
+            metadata = dict(metadata)
+            metadata["hermes_profile"] = profile
         return metadata
 
     def _thread_metadata_for_target(
@@ -26562,11 +27479,21 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 self._executor = executor
             return executor
 
-    def _shutdown_executor(self) -> None:
-        """Stop the gateway-owned executor without touching the loop default."""
+    def _shutdown_executor(self, drain_timeout: float = 0.0) -> int:
+        """Stop the gateway-owned executor without touching the loop default.
+
+        Returns the number of worker threads still running when this returns.
+        With the default ``drain_timeout`` of 0 this is the historical
+        fire-and-forget teardown; shutdown passes a bounded budget so blocking
+        DB work cannot outlive ``SessionDB.close()`` (see ``_stop_impl``).
+
+        ``cancel_futures`` only drops work that has not started yet, and a
+        cancelled ``run_in_executor`` awaitable does not stop the thread behind
+        it, so the running futures have to be waited on explicitly.
+        """
         lock = getattr(self, "_executor_lock", None)
         if lock is None:
-            return
+            return 0
 
         with lock:
             self._executor_closing = True
@@ -26574,13 +27501,25 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
             self._executor = None
 
         if executor is None:
-            return
+            return 0
 
         try:
             executor.shutdown(wait=False, cancel_futures=True)
         except TypeError:
             executor.shutdown(wait=False)
 
+        # ThreadPoolExecutor.shutdown() has no timeout, so join the worker
+        # threads directly.  `_threads` is absent on the doubles some tests
+        # pass in, which just means no wait.
+        workers = list(getattr(executor, "_threads", None) or ())
+        deadline = time.monotonic() + max(float(drain_timeout or 0.0), 0.0)
+        for worker in workers:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                break
+            worker.join(remaining)
+        return sum(1 for worker in workers if worker.is_alive())
+
     def _decide_image_input_mode(
         self,
         *,
@@ -32217,6 +33156,7 @@ def _start_gateway_housekeeping(stop_event: threading.Event, adapters=None, loop
     AUTO_ARCHIVE_EVERY = 60  # ticks — poll hourly (state_meta gate owns the real cadence)
     MEMORY_TRIM_EVERY = 1    # shared helper cooldown bounds actual allocator work
     MISFIRE_SWEEP_EVERY = 5  # ticks — every 5 minutes (grace window gates real work)
+    FTS_STALE_RETRY_EVERY = 1  # SessionDB rate-limits the real work (_FTS_STALE_RETRY_SECONDS)
 
     # Every platform media cache prunes on the same hourly cadence — one loop
     # over (name, cleanup_fn), not a copy-pasted try/except per cache.
@@ -32351,6 +33291,29 @@ def _start_gateway_housekeeping(stop_event: threading.Event, adapters=None, loop
             except Exception as e:
                 logger.debug("Auto-archive tick error: %s", e)
 
+        # Deferred stale-FTS rebuild retry (#100108). A SessionDB that opened
+        # while another process held state.db / the rebuild lock fails closed
+        # and leaves search on the LIKE fallback; a short-lived CLI clears
+        # that on its next open, but the gateway opens once and stays up for
+        # days. Retry here, on the existing tick, against the shared
+        # instances this process already holds: non-blocking admission, no
+        # new thread, rate-limited inside SessionDB. No-op when nothing is
+        # stale (one attribute read per instance).
+        if tick_count % FTS_STALE_RETRY_EVERY == 0:
+            try:
+                from hermes_state_registry import live_shared_session_dbs
+
+                for _sdb in live_shared_session_dbs():
+                    _retry = getattr(_sdb, "retry_deferred_fts_recovery", None)
+                    if callable(_retry) and _retry():
+                        logger.info(
+                            "Deferred state.db FTS rebuild completed in-process "
+                            "for %s; full-text search restored.",
+                            getattr(_sdb, "db_path", "state.db"),
+                        )
+            except Exception as exc:
+                logger.debug("Deferred FTS retry tick error: %s", exc)
+
         # This is the long-lived messaging-gateway counterpart to the TUI idle
         # reaper. The helper is config-gated and rate-limited, so calling it on
         # the 60s housekeeping cadence does not create a trim storm.
@@ -32948,6 +33911,10 @@ async def start_gateway(config: Optional[GatewayConfig] = None, replace: bool =
             logging.getLogger().setLevel(_stderr_level)
 
     runner = GatewayRunner(config)
+    # Multiplex: swap the launch-home file handlers for per-profile routers so
+    # each profile's records land in its own logs/ (#82936). Must run after
+    # the runner resolved the (possibly None) config and after setup_logging.
+    _enable_multiplex_log_routing(runner.config)
     # ``--replace`` is explicit startup authority, not a durable reconnect
     # policy. GatewayRunner scopes this bit to cold adapter connects and clears
     # it before the background reconnect watcher starts.
@@ -33227,9 +34194,7 @@ async def start_gateway(config: Optional[GatewayConfig] = None, replace: bool =
     # heartbeats (Discord shard, Telegram polling) until it returned.
     # See #16856.
     try:
-        from tools.mcp_tool import discover_mcp_tools
-        _loop = asyncio.get_running_loop()
-        await _loop.run_in_executor(None, discover_mcp_tools)
+        await _discover_gateway_mcp_tools(runner.config)
     except Exception as e:
         logger.debug("MCP tool discovery failed: %s", e)
 
diff --git a/gateway/runtime_footer.py b/gateway/runtime_footer.py
index 8719524d5a..2526bc3e10 100644
--- a/gateway/runtime_footer.py
+++ b/gateway/runtime_footer.py
@@ -138,7 +138,13 @@ def format_runtime_footer(
             if turn_seconds is not None and turn_seconds >= 0:
                 parts.append(_format_latency(turn_seconds))
         elif field == "cwd":
-            rel = _home_relative_cwd(cwd or os.environ.get("TERMINAL_CWD", ""))
+            try:
+                from tools.terminal_scope import terminal_env as _tenv
+            except ImportError:
+                env_cwd = os.environ.get("TERMINAL_CWD", "")
+            else:
+                env_cwd = _tenv("TERMINAL_CWD", "")
+            rel = _home_relative_cwd(cwd or env_cwd)
             if rel:
                 parts.append(rel)
         # Unknown field names are silently ignored.
diff --git a/gateway/scale_to_zero.py b/gateway/scale_to_zero.py
index 65c01515ad..e1a64159db 100644
--- a/gateway/scale_to_zero.py
+++ b/gateway/scale_to_zero.py
@@ -164,6 +164,75 @@ def is_idle(
     return seconds_since_last_inbound >= idle_timeout_seconds
 
 
+# Dashboard-client liveness marker. The dashboard process (tui_gateway/ws.py,
+# a DIFFERENT process from the gateway on hosted instances) touches this file
+# on every /api/ws connect and inbound frame — the desktop app, web dashboard
+# and TUI all send `gateway.ping` every 15s (apps/shared/src/json-rpc-gateway.ts,
+# ui-tui/src/gatewayClient.ts). The gateway folds the mtime into its inbound
+# clock, so an open client holds the box awake exactly like a chat message does
+# and gets the same idle_timeout grace after it disconnects. Without this the
+# box suspends under the open client, the client's reconnect loop re-pokes the
+# Fly-proxied hostname, autostart resumes it, and the instance flaps every ~60s
+# (13 of 72 active opted-in prod instances, 2026-09-02).
+#
+# There is deliberately NO staleness cutoff here: the mtime is a timestamp of
+# real inbound, and is_idle already decides whether it is recent enough. A
+# lingering marker cannot pin the box — once it is older than idle_timeout it
+# no longer counts, exactly like an old _last_inbound_at.
+DASHBOARD_CLIENT_HEARTBEAT_REL = os.path.join("state", "dashboard_clients.heartbeat")
+
+
+def dashboard_client_heartbeat_path(hermes_home: Optional[os.PathLike | str] = None):
+    """Path of the dashboard-client liveness marker under HERMES_HOME."""
+    from pathlib import Path
+
+    if hermes_home is None:
+        from hermes_constants import get_hermes_home
+
+        hermes_home = get_hermes_home()
+    return Path(hermes_home) / DASHBOARD_CLIENT_HEARTBEAT_REL
+
+
+def touch_dashboard_client_heartbeat(path: Optional[os.PathLike | str] = None) -> bool:
+    """Mark "a dashboard client is attached right now". Best-effort, never raises."""
+    try:
+        p = dashboard_client_heartbeat_path() if path is None else path
+        os.makedirs(os.path.dirname(p), exist_ok=True)
+        with open(p, "a", encoding="utf-8"):
+            pass
+        os.utime(p, None)
+        return True
+    except Exception:  # noqa: BLE001 - liveness garnish must never break the WS
+        logger.debug("scale-to-zero: dashboard heartbeat touch failed", exc_info=True)
+        return False
+
+
+def dashboard_client_last_seen(
+    path: Optional[os.PathLike | str] = None,
+    *,
+    now: Optional[float] = None,
+) -> Optional[float]:
+    """Epoch seconds a dashboard client last sent a WS frame, or None if never.
+
+    Missing marker -> None (the steady state on a box nobody has the dashboard
+    open on — NOT fail-awake, or every instance would never sleep). An
+    unreadable marker -> ``now`` (fail-awake: an unreadable source counts as
+    activity, same rule as the work counters in ``is_idle``).
+    """
+    import time
+
+    current = time.time() if now is None else now
+    p = dashboard_client_heartbeat_path() if path is None else path
+    try:
+        # Clamp to now: a wall-clock step-back (NTP) can leave the mtime in the
+        # future, which would push idle out by the step size for no reason.
+        return min(os.stat(p).st_mtime, current)
+    except FileNotFoundError:
+        return None
+    except OSError:
+        return current
+
+
 def self_suspend_available(environ: Optional[dict] = None) -> bool:
     """Whether this process can suspend its own machine via the flaps socket.
 
diff --git a/gateway/session.py b/gateway/session.py
index 568322d83f..8de09eceb6 100644
--- a/gateway/session.py
+++ b/gateway/session.py
@@ -23,6 +23,14 @@ from typing import Dict, List, Optional, Any
 logger = logging.getLogger(__name__)
 
 
+class TranscriptReadError(RuntimeError):
+    """Raised when persisted history cannot be read safely."""
+
+    def __init__(self, session_id: str) -> None:
+        self.session_id = session_id
+        super().__init__(f"transcript read failed for session {session_id}")
+
+
 def _now() -> datetime:
     """Return the current local time."""
     return datetime.now()
@@ -2201,10 +2209,15 @@ class SessionStore:
         requested_session_key: str,
         recovered: Dict[str, Any],
     ) -> bool:
-        """Prevent non-multiplexed gateways from reviving another profile's row."""
-        if getattr(self.config, "multiplex_profiles", False):
-            return True
+        """Prevent a gateway from reviving another profile's row.
 
+        Single-profile: the recovered row's namespace must match the ACTIVE
+        profile. Multiplexed: several profiles serve traffic at once, so the
+        active profile is meaningless — the requested key carries the profile
+        the turn was routed to, and the recovered row must sit in the same
+        ``agent:<ns>:`` namespace (#74285). Rows with no key namespace stay
+        adoptable in both modes (legacy/keyless data owned by this store).
+        """
         recovered_key = str(recovered.get("session_key") or "")
         if not recovered_key or recovered_key == requested_session_key:
             return True
@@ -2213,6 +2226,10 @@ class SessionStore:
         if recovered_profile is None:
             return True
 
+        if getattr(self.config, "multiplex_profiles", False):
+            requested_profile = self._profile_from_session_key(requested_session_key)
+            return requested_profile is None or recovered_profile == requested_profile
+
         return recovered_profile == self._active_profile_name()
 
     def _generate_session_key(self, source: SessionSource) -> str:
@@ -2419,8 +2436,7 @@ class SessionStore:
         ):
             logger.warning(
                 "Gateway session DB recovery ignored %s for %s because "
-                "multiplex_profiles is disabled and the row belongs to a "
-                "different profile",
+                "the row belongs to a different profile",
                 recovered.get("session_key"),
                 session_key,
             )
@@ -2496,8 +2512,7 @@ class SessionStore:
         ):
             logger.warning(
                 "Gateway session DB recovery ignored %s for %s because "
-                "multiplex_profiles is disabled and the row belongs to a "
-                "different profile",
+                "the row belongs to a different profile",
                 recovered.get("session_key"),
                 session_key,
             )
@@ -3973,14 +3988,23 @@ class SessionStore:
             try:
                 self._append_transcript_message(session_id, msg)
             except Exception as exc:
-                from hermes_state import CompressionSessionClosedError, StateDbReplacedError
+                from hermes_state import (
+                    CompressionSessionClosedError,
+                    StateDbCorruptError,
+                    StateDbReplacedError,
+                )
 
-                if isinstance(exc, StateDbReplacedError):
+                if isinstance(exc, (StateDbReplacedError, StateDbCorruptError)):
+                    # Both classes mean "this handle must not touch the file
+                    # again": replaced generation (#89332) or structural
+                    # corruption (quarantine). Retrying cannot succeed, and
+                    # the FTS one-shot rebuild below must never run on a
+                    # damaged file. Divert instead.
                     logger.error(
-                        "Session DB was replaced underneath the gateway for %s; "
-                        "stopping SQLite writes and diverting pending "
+                        "Session DB refused further writes on this handle for "
+                        "%s (%s); stopping SQLite writes and diverting pending "
                         "transcripts to the on-disk fallback: %s",
-                        session_id, exc,
+                        session_id, type(exc).__name__, exc,
                     )
                     with self._transcript_retry_lock:
                         remaining = list(self._dirty_transcripts.get(queue_session_id, []))
@@ -4400,15 +4424,17 @@ class SessionStore:
                 session_id, repair_alternation=True
             )
         except Exception as e:
-            # A failed read must be distinguishable from an empty transcript:
-            # downstream guards treat [] as "nothing persisted" and may make
-            # routing decisions on it (#82616). WARNING, not DEBUG.
-            logger.warning(
-                "Transcript read failed for session %s (returning empty; "
-                "downstream must not treat this as data loss): %s",
-                session_id, e,
+            # Empty history is valid data; a failed canonical read is not.
+            # Preserve that distinction so live-replay callers can fail closed
+            # instead of starting the model with a plausible-looking [].
+            logger.error(
+                "Transcript read failed for session %s; refusing to treat the "
+                "conversation as empty: %s",
+                session_id,
+                e,
+                exc_info=True,
             )
-            return []
+            raise TranscriptReadError(session_id) from e
 
     def rewind_session(
         self,
diff --git a/gateway/shutdown_flush.py b/gateway/shutdown_flush.py
index a09b63ee2a..07bcf7e86f 100644
--- a/gateway/shutdown_flush.py
+++ b/gateway/shutdown_flush.py
@@ -142,6 +142,66 @@ def flush_pending_to_file(
     return flushed
 
 
+def flush_overflow_to_file(
+    overflow_by_session: Dict[str, Any],
+    *,
+    reason: str = "shutdown",
+) -> int:
+    """Serialise the FIFO overflow tails (``queued_events``) to disk.
+
+    Sibling of :func:`flush_pending_to_file` for the second half of the
+    gateway FIFO (#99882): the adapter slot holds the queue head, and the
+    per-session ``SessionState.conversation.queued_events`` list holds the
+    tail.  Shutdown flushed only the slot, so every follow-up parked in
+    overflow at restart time vanished with the process.  Each overflow
+    event is written as its own payload in the same shape as a slot flush
+    so ``recover_pending_to_db`` replays them unchanged; a ``seq`` field
+    preserves arrival order within a session.
+
+    Returns the number of events flushed.
+    """
+    if not overflow_by_session:
+        return 0
+
+    flush_dir = _get_flush_dir()
+    ts = int(time.time())
+    flushed = 0
+
+    for session_key, events in list(overflow_by_session.items()):
+        if not session_key or not events:
+            continue
+        for seq, value in enumerate(list(events)):
+            if value is None:
+                continue
+            try:
+                serialised = _serialise_value(value)
+                if serialised is None:
+                    continue
+                _write_payload(
+                    flush_dir,
+                    {
+                        "session_key": session_key,
+                        "reason": reason,
+                        "ts": ts,
+                        "seq": seq,
+                        "data": serialised,
+                    },
+                )
+                flushed += 1
+            except Exception as exc:
+                logger.debug(
+                    "Failed to flush overflow message for %s: %s",
+                    session_key, exc,
+                )
+
+    if flushed:
+        logger.info(
+            "Flushed %d queued overflow message(s) to %s (reason=%s)",
+            flushed, flush_dir, reason,
+        )
+    return flushed
+
+
 # Reason tag for transcript messages dropped by the in-memory pending cap
 # during live operation (#78182). These payloads carry the full transcript
 # message dict so they can be replayed verbatim once the DB recovers.
diff --git a/gateway/shutdown_watchdog.py b/gateway/shutdown_watchdog.py
index 6c4069552c..3dbeff7cf0 100644
--- a/gateway/shutdown_watchdog.py
+++ b/gateway/shutdown_watchdog.py
@@ -526,30 +526,34 @@ async def loop_heartbeat_forever(
     # disables the witness, and the payload flag tells probes that staleness is
     # no longer sufficient authority to escalate.
     #
-    # Windows: asyncio.start_unix_server raises (no AF_UNIX event-loop
-    # support), so the witness is PERMANENTLY absent there — the payload
-    # records loop_tick_socket=False and every stale-file probe classifies
-    # UNKNOWN, never WEDGED. That is deliberate fail-safe: a wedged native
-    # Windows gateway keeps the graceful-drain backstop instead of an
-    # escalation verdict built on a witness that cannot exist. (WSL2 — the
-    # #90502 incident environment — is Linux and arms the socket normally.)
+    # Windows (non-POSIX generally): asyncio AF_UNIX support is POSIX-only, so
+    # the AF_UNIX arm below is gated to POSIX — an ungated call raised
+    # AttributeError on every native-Windows gateway start (#96956). Instead of
+    # leaving the witness permanently absent there, the non-POSIX arm binds a
+    # TCP loopback server on 127.0.0.1 with an OS-assigned port and publishes
+    # the port in the heartbeat payload (``loop_tick_tcp_port``) so probes know
+    # where to connect. Same protocol, same loop-owned semantics. If that bind
+    # fails, the payload records loop_tick_socket=False and probes classify
+    # UNKNOWN, never WEDGED — the graceful-drain backstop stays in place. (WSL2
+    # — the #90502 incident environment — is Linux and arms the socket.)
     tick_server = None
     tick_socket_path = None
+    tick_tcp_port = None
     try:
-        tick_socket_path = get_loop_tick_socket_path(home)
-        tick_socket_path.parent.mkdir(parents=True, exist_ok=True)
-        # Re-bind over a leftover node from a dead process (os._exit(75) /
-        # SIGKILL skip the finally-unlink; PID reuse re-lands on this
-        # PID-suffixed path) is handled by asyncio itself:
-        # create_unix_server os.remove()s an existing socket node before
-        # binding — guarded by test_producer_rebinds_over_stale_socket_node.
-        # What asyncio does NOT do is clean up SIBLING nodes from other
-        # dead PIDs, so sweep those to keep state/ from accumulating
-        # gateway.loop-tick.*.sock nodes across crash-restart cycles.
-        # POSIX-only: os.kill(pid, 0) is a liveness probe here, but on
-        # Windows os.kill calls TerminateProcess for non-CTRL signals —
-        # and AF_UNIX server nodes are never created there anyway.
         if os.name == "posix":
+            tick_socket_path = get_loop_tick_socket_path(home)
+            tick_socket_path.parent.mkdir(parents=True, exist_ok=True)
+            # Re-bind over a leftover node from a dead process (os._exit(75) /
+            # SIGKILL skip the finally-unlink; PID reuse re-lands on this
+            # PID-suffixed path) is handled by asyncio itself:
+            # create_unix_server os.remove()s an existing socket node before
+            # binding — guarded by test_producer_rebinds_over_stale_socket_node.
+            # What asyncio does NOT do is clean up SIBLING nodes from other
+            # dead PIDs, so sweep those to keep state/ from accumulating
+            # gateway.loop-tick.*.sock nodes across crash-restart cycles.
+            # POSIX-only: os.kill(pid, 0) is a liveness probe here, but on
+            # Windows os.kill calls TerminateProcess for non-CTRL signals —
+            # and AF_UNIX server nodes are never created there anyway.
             try:
                 for _stale in tick_socket_path.parent.glob(
                     "gateway.loop-tick.*.sock"
@@ -569,11 +573,33 @@ async def loop_heartbeat_forever(
                 logger.debug(
                     "stale loop-tick socket sweep failed", exc_info=True
                 )
-        tick_server = await asyncio.start_unix_server(
-            _tick_socket_handler, path=str(tick_socket_path)
-        )
+            tick_server = await asyncio.start_unix_server(
+                _tick_socket_handler, path=str(tick_socket_path)
+            )
+        else:
+            # Windows / non-POSIX: no AF_UNIX support, so use a TCP loopback
+            # server on 127.0.0.1 as the loop-scheduling witness instead.
+            # Same protocol (connect → read one byte "1"), same semantics
+            # (pure in-memory, zero disk I/O, answered only when the loop
+            # is dispatching). Port is dynamic (assigned by the OS) and
+            # published via the heartbeat payload so external probes know
+            # where to connect.
+            tick_server = await asyncio.start_server(
+                _tick_socket_handler, host="127.0.0.1", port=0
+            )
+            # Get the actual port assigned by the OS
+            _sock_addrs = tick_server.sockets if hasattr(tick_server, "sockets") else []
+            for _s in _sock_addrs:
+                try:
+                    _sname = _s.getsockname()
+                    if isinstance(_sname, tuple) and len(_sname) >= 2:
+                        tick_tcp_port = int(_sname[1])
+                        break
+                except Exception:
+                    pass
     except Exception:
         tick_server = None
+        tick_tcp_port = None
         logger.warning(
             "Loop tick socket unavailable — liveness probes will have no "
             "loop-scheduling witness and will not escalate on a stale heartbeat",
@@ -588,7 +614,10 @@ async def loop_heartbeat_forever(
                 write_loop_heartbeat,
                 start_time=start_time,
                 home=home,
-                extra={"loop_tick_socket": tick_server is not None},
+                extra={
+                    "loop_tick_socket": tick_server is not None,
+                    "loop_tick_tcp_port": tick_tcp_port,
+                },
             )
         except asyncio.CancelledError:
             raise
diff --git a/gateway/slash_commands.py b/gateway/slash_commands.py
index 5493e849dc..33ca59f5b0 100644
--- a/gateway/slash_commands.py
+++ b/gateway/slash_commands.py
@@ -2592,7 +2592,6 @@ class GatewaySlashCommandsMixin:
             available_personalities,
             describe_personality,
             persist_personality,
-            prompt_text,
             resolve_personality,
         )
 
@@ -2621,24 +2620,21 @@ class GatewaySlashCommandsMixin:
             return "\n".join(lines)
 
         try:
-            name, new_prompt = resolve_personality(args, config)
+            name, _new_prompt = resolve_personality(args, config)
         except ValueError:
             available = "`none`, " + ", ".join(f"`{n}`" for n in personalities)
             return t("gateway.personality.unknown", name=args.lower(), available=available)
 
         # Persist the selection only — hermes_cli.personality never writes
-        # agent.system_prompt (user-owned manual overlay).
+        # agent.system_prompt (user-owned manual overlay). persist_personality
+        # writes get_hermes_home()/config.yaml, i.e. the routed profile under
+        # multiplex; the next turn re-resolves the prompt from that file
+        # (_get_system_prompt_for_channel), so no process-global state to update.
         if not persist_personality(name):
             return t("gateway.personality.save_failed", error="config write failed")
 
         if not name:
-            self._ephemeral_system_prompt = prompt_text(
-                cfg_get(config, "agent", "system_prompt", default="")
-            )
             return t("gateway.personality.cleared")
-
-        # Update in-memory so it takes effect on the very next message.
-        self._ephemeral_system_prompt = new_prompt
         return t("gateway.personality.set_to", name=name)
 
     async def _handle_retry_command(self, event: MessageEvent) -> str:
@@ -2874,8 +2870,12 @@ class GatewaySlashCommandsMixin:
                 import asyncio
                 from hermes_cli.goals import draft_contract
 
-                draft_contract_obj = await asyncio.get_running_loop().run_in_executor(
-                    None, draft_contract, objective
+                # _run_in_executor_with_context, not a bare hop: drafting a
+                # contract calls the auxiliary LLM, whose provider/credential
+                # resolution reads the profile secret scope — a contextvar that
+                # a default-executor hop drops, leaving it unscoped.
+                draft_contract_obj = await self._run_in_executor_with_context(
+                    draft_contract, objective
                 )
             except Exception as exc:
                 logger.debug("goal draft failed: %s", exc)
@@ -3075,8 +3075,6 @@ class GatewaySlashCommandsMixin:
             set_current_session_key,
         )
 
-        loop = asyncio.get_running_loop()
-
         def _dispatch():
             token = set_current_session_key(quick_key)
             try:
@@ -3087,7 +3085,10 @@ class GatewaySlashCommandsMixin:
                 reset_current_session_key(token)
 
         try:
-            result = await loop.run_in_executor(None, _dispatch)
+            # _run_in_executor_with_context, not a bare hop: the reviewer
+            # subagent is spawned from the worker and inherits its context,
+            # so a bare hop would run it under the launch home / no secret scope.
+            result = await self._run_in_executor_with_context(_dispatch)
         except ValueError as exc:
             return str(exc)
         except Exception as exc:
@@ -3346,10 +3347,12 @@ class GatewaySlashCommandsMixin:
         """Handle /voice [on|off|tts|channel|leave|status] command."""
         args = event.get_command_args().strip().lower()
         chat_id = event.source.chat_id
-        platform = event.source.platform
-        voice_key = self._voice_key(platform, chat_id)
+        # Voice state belongs to the (bot, chat) pair: resolve the adapter that
+        # received the command and key the mode by its owning profile so two
+        # multiplexed bots in one chat keep independent /voice state (#75198).
+        voice_key = self._voice_key_for_source(event.source)
 
-        adapter = self.adapters.get(platform)
+        adapter = self._adapter_for_source(event.source)
 
         if args in {"on", "enable"}:
             self._voice_mode[voice_key] = "voice_only"
@@ -3381,7 +3384,6 @@ class GatewaySlashCommandsMixin:
                 "all": t("gateway.voice.label_all"),
             }
             # Append voice channel info if connected
-            adapter = self.adapters.get(event.source.platform)
             guild_id = self._get_guild_id(event)
             if guild_id and hasattr(adapter, "get_voice_channel_info"):
                 info = adapter.get_voice_channel_info(guild_id)
@@ -3440,7 +3442,9 @@ class GatewaySlashCommandsMixin:
             max_file_size_mb=cp_kwargs["checkpoint_max_file_size_mb"],
         )
 
-        cwd = os.getenv("TERMINAL_CWD", str(Path.home()))
+        from tools.terminal_scope import terminal_env as _tenv
+
+        cwd = _tenv("TERMINAL_CWD", str(Path.home()))
         arg = event.get_command_args().strip()
 
         # --all / --force: classic full restore, overwriting user edits too.
@@ -3534,7 +3538,9 @@ class GatewaySlashCommandsMixin:
             elif low == "session":
                 mode = "session"
 
-        cwd = os.getenv("TERMINAL_CWD", str(Path.home()))
+        from tools.terminal_scope import terminal_env as _tenv
+
+        cwd = _tenv("TERMINAL_CWD", str(Path.home()))
 
         if mode == "session":
             return await self._gateway_session_diff(cwd, stat_only)
@@ -3751,9 +3757,9 @@ class GatewaySlashCommandsMixin:
     def _save_gateway_config_key(self, key_path: str, value) -> bool:
         """Save a dot-separated key to config.yaml (shared by /reasoning, /fast
         and their interactive pickers)."""
-        from gateway.run import _hermes_home
+        from gateway.run import _gateway_config_home
         from hermes_cli.config import read_user_config_raw
-        config_path = _hermes_home / "config.yaml"
+        config_path = _gateway_config_home() / "config.yaml"
         try:
             # Write-back round-trip: raw read is correct (merged defaults must
             # not be persisted back to the user's file).
@@ -3995,7 +4001,7 @@ class GatewaySlashCommandsMixin:
         Gate changes persist to config.yaml and evict the cached agent so the
         new setting takes effect on the next message.
         """
-        from gateway.run import _hermes_home
+        from gateway.run import _gateway_config_home
         from hermes_cli.write_approval_commands import handle_pending_subcommand
         from tools import write_approval as wa
         from tools.memory_tool import load_on_disk_store
@@ -4003,7 +4009,7 @@ class GatewaySlashCommandsMixin:
         raw_args = event.get_command_args().strip()
         args = raw_args.split() if raw_args else []
         session_key = self._session_key_for_source(event.source)
-        config_path = _hermes_home / "config.yaml"
+        config_path = _gateway_config_home() / "config.yaml"
 
         def _set_approval(enabled: bool):
             # Write-back round-trip: raw read is correct (merged defaults must
@@ -4044,14 +4050,14 @@ class GatewaySlashCommandsMixin:
         the write-approval ``diff <id>``; the CLI also has an unrelated
         ``hermes skills diff <name>`` that diffs a bundled skill vs stock.)
         """
-        from gateway.run import _hermes_home
+        from gateway.run import _gateway_config_home
         from hermes_cli.write_approval_commands import handle_pending_subcommand
         from tools import write_approval as wa
 
         raw_args = event.get_command_args().strip()
         args = raw_args.split() if raw_args else []
         session_key = self._session_key_for_source(event.source)
-        config_path = _hermes_home / "config.yaml"
+        config_path = _gateway_config_home() / "config.yaml"
 
         gate_on = wa.write_approval_enabled(wa.SKILLS)
         wants_toggle = bool(args) and args[0].lower() in {"approval", "mode"}
@@ -4122,6 +4128,9 @@ class GatewaySlashCommandsMixin:
                 tier = None
                 saved_value = "normal"
                 label = t("gateway.fast.label_normal")
+            elif value in {"auto", "cold"}:
+                tier = saved_value = value
+                label = value.upper()
             else:
                 return t("gateway.fast.unknown_arg", arg=value)
             self._service_tier = tier
@@ -4144,7 +4153,8 @@ class GatewaySlashCommandsMixin:
 
         if not args or args == "status":
             is_fast = self._service_tier == "priority"
-            status = t("gateway.fast.status_fast") if is_fast else t("gateway.fast.status_normal")
+            mode = "fast" if is_fast else (self._service_tier or "normal")
+            status = {"fast": t("gateway.fast.status_fast"), "normal": t("gateway.fast.status_normal")}.get(mode, mode)
 
             async def _on_fast_choice(_chat_id: str, value: str) -> str:
                 return _apply_fast_selection(value, persist=persist_global)
@@ -4162,7 +4172,17 @@ class GatewaySlashCommandsMixin:
                     {
                         "value": "normal",
                         "label": t("gateway.fast.choice_normal"),
-                        "is_current": not is_fast,
+                        "is_current": mode == "normal",
+                    },
+                    {
+                        "value": "auto",
+                        "label": t("gateway.fast.choice_auto"),
+                        "is_current": mode == "auto",
+                    },
+                    {
+                        "value": "cold",
+                        "label": t("gateway.fast.choice_cold"),
+                        "is_current": mode == "cold",
                     },
                 ],
                 on_choice_selected=_on_fast_choice,
@@ -4217,9 +4237,9 @@ class GatewaySlashCommandsMixin:
         ``display.platforms.<platform>.tool_progress`` so each channel can
         have its own verbosity level independently.
         """
-        from gateway.run import _hermes_home, _load_gateway_config, _platform_config_key
+        from gateway.run import _gateway_config_home, _load_gateway_config, _platform_config_key
 
-        config_path = _hermes_home / "config.yaml"
+        config_path = _gateway_config_home() / "config.yaml"
         platform_key = _platform_config_key(event.source.platform)
 
         # --- check config gate ------------------------------------------------
@@ -4355,10 +4375,10 @@ class GatewaySlashCommandsMixin:
         are respected but not modified here — edit config.yaml directly for
         per-platform control.
         """
-        from gateway.run import _hermes_home, _load_gateway_config, _platform_config_key, _resolve_gateway_model
+        from gateway.run import _gateway_config_home, _load_gateway_config, _platform_config_key, _resolve_gateway_model
         from gateway.runtime_footer import resolve_footer_config
 
-        config_path = _hermes_home / "config.yaml"
+        config_path = _gateway_config_home() / "config.yaml"
         platform_key = _platform_config_key(event.source.platform)
 
         # --- parse argument -------------------------------------------------
@@ -4959,6 +4979,7 @@ class GatewaySlashCommandsMixin:
             await self._session_db.enable_telegram_topic_mode(
                 chat_id=str(source.chat_id),
                 user_id=str(source.user_id),
+                profile_name=self._telegram_topic_profile_name(source),
                 has_topics_enabled=capabilities.get("has_topics_enabled"),
                 allows_users_to_create_topics=capabilities.get("allows_users_to_create_topics"),
             )
@@ -4974,6 +4995,7 @@ class GatewaySlashCommandsMixin:
                 binding = await self._session_db.get_telegram_topic_binding(
                     chat_id=str(source.chat_id),
                     thread_id=str(source.thread_id),
+                    profile_name=self._telegram_topic_profile_name(source),
                 )
             except Exception:
                 logger.debug("Failed to read Telegram topic binding", exc_info=True)
@@ -5892,8 +5914,6 @@ class GatewaySlashCommandsMixin:
             from hermes_state import get_shared_session_db, release_shared_session_db
             from agent.insights import InsightsEngine
 
-            loop = asyncio.get_running_loop()
-
             def _run_insights():
                 db = get_shared_session_db()
                 try:
@@ -5905,7 +5925,13 @@ class GatewaySlashCommandsMixin:
                     from hermes_state import release_or_close
                     release_or_close(db)
 
-            return await loop.run_in_executor(None, _run_insights)
+            # _run_in_executor_with_context, not a bare hop: ``SessionDB()``
+            # with no explicit path resolves ``get_hermes_home()`` at call
+            # time, and that override is a contextvar installed by
+            # ``_profile_runtime_scope``. A default-executor hop starts the
+            # worker with an EMPTY context, so /insights read the DEFAULT
+            # profile's state.db and reported another profile's conversations.
+            return await self._run_in_executor_with_context(_run_insights)
         except Exception as e:
             logger.error("Insights command error: %s", e, exc_info=True)
             return t("gateway.insights.error", error=e)
@@ -5988,11 +6014,12 @@ class GatewaySlashCommandsMixin:
         is written to the session transcript out-of-band, so message
         alternation is preserved.
         """
-        loop = asyncio.get_running_loop()
         try:
             from agent.skill_commands import reload_skills
 
-            result = await loop.run_in_executor(None, reload_skills)
+            # _run_in_executor_with_context, not a bare hop: the rescan walks
+            # get_hermes_home()/skills, a contextvar override under multiplex.
+            result = await self._run_in_executor_with_context(reload_skills)
             added = result.get("added", [])      # [{"name", "description"}, ...]
             removed = result.get("removed", [])  # [{"name", "description"}, ...]
             total = result.get("total", 0)
@@ -6300,8 +6327,6 @@ class GatewaySlashCommandsMixin:
             _GATEWAY_PRIVACY_NOTICE, _best_effort_sweep_expired_pastes,
         )
 
-        loop = asyncio.get_running_loop()
-
         # Run blocking I/O (dump capture, log reads, uploads) in a thread.
         def _collect_and_upload():
             _best_effort_sweep_expired_pastes()
@@ -6328,7 +6353,11 @@ class GatewaySlashCommandsMixin:
             lines.append(t("gateway.debug.share_hint"))
             return "\n".join(lines)
 
-        return await loop.run_in_executor(None, _collect_and_upload)
+        # _run_in_executor_with_context, not a bare hop: this collects the
+        # profile's logs/config off ``get_hermes_home()`` and uploads them to a
+        # public paste. Losing the contextvar override would publish the DEFAULT
+        # profile's diagnostics from another profile's chat.
+        return await self._run_in_executor_with_context(_collect_and_upload)
 
     async def _handle_update_command(self, event: MessageEvent) -> str:
         """Handle /update command — update Hermes Agent to the latest version.
diff --git a/gateway/status.py b/gateway/status.py
index cc611509ef..0df8708158 100644
--- a/gateway/status.py
+++ b/gateway/status.py
@@ -157,6 +157,41 @@ def _same_hermes_home(left: Path | str, right: Path | str) -> bool:
     )
 
 
+def recorded_gateway_home_conflicts(
+    record: Optional[dict[str, Any]],
+    *,
+    expected_home: Optional[Path | str] = None,
+) -> bool:
+    """True when a persisted gateway record names a DIFFERENT HERMES_HOME.
+
+    Cross-profile kill refusal (#89315): a poisoned/contaminated PID record
+    inside one profile's home can truthfully name ANOTHER profile's live
+    gateway (its ``hermes_home`` stamp records the real owner). Any
+    destructive caller about to signal the recorded PID must consult this
+    first and refuse when the record positively proves the target belongs to
+    a different profile — otherwise ``gateway stop``/``restart``/``profile
+    delete`` from profile B SIGTERMs profile A's gateway and the supervisors
+    enter the mutual restart loop from the issue report.
+
+    ``expected_home`` overrides the comparison base (e.g. ``profile delete``
+    stopping a TARGET profile's gateway rather than the current process's).
+    Legacy records without a ``hermes_home`` stamp return False — they prove
+    nothing either way, and destructive callers already pair this with the
+    exact PID + start-time identity guards. A comparison failure returns True
+    (destructive action + unprovable ownership ⇒ fail closed).
+    """
+    if not isinstance(record, dict):
+        return False
+    recorded_home = record.get("hermes_home")
+    if not isinstance(recorded_home, str) or not recorded_home.strip():
+        return False
+    try:
+        base = expected_home if expected_home is not None else _get_process_hermes_home()
+        return not _same_hermes_home(recorded_home, base)
+    except Exception:
+        return True
+
+
 # Mirrors hermes_cli.profiles._PROFILE_ID_RE — duplicated here because gateway
 # identity code must stay import-light (hermes_constants + stdlib only).
 _PROFILE_LABEL_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,63}$")
diff --git a/gateway/stream_consumer.py b/gateway/stream_consumer.py
index 22aac6e8cc..7b4d905ea1 100644
--- a/gateway/stream_consumer.py
+++ b/gateway/stream_consumer.py
@@ -332,6 +332,12 @@ class GatewayStreamConsumer:
         # (#78541) — that combination was swallowing complete Telegram group
         # replies after an early/partial multi-message delivery.
         self._turn_split_delivery = False
+        # True when a full-final send timed out in a way that MAY have reached
+        # the platform (``_send_empty_fallback_final`` → "ambiguous").  The
+        # only case where a payload-less delivery flag keeps legacy trust in
+        # ``delivered_final_matches`` (#95382 tightening) — re-sending there
+        # risks a duplicate rather than recovering a loss.
+        self._delivery_ambiguous = False
         self._delivered_commentary_texts: list[str] = []
         # Retains the finalized visible text of each streaming segment so
         # ``has_delivered_text`` can still match after ``_reset_segment_state``
@@ -655,7 +661,26 @@ class GatewayStreamConsumer:
             if self._turn_split_delivery:
                 # #78541: refuse legacy trust for payload-less split delivery.
                 return False
-            return None
+            # #95382 / #98552 class fix: a delivery flag with NO recorded
+            # payload must still be judged against the FINAL content, not
+            # trusted blindly. Every internal flag-setting site records a
+            # payload; a record-less consumer whose visible/streamed text
+            # does not contain the completed response has demonstrably NOT
+            # delivered it (first-edit prefix, mid-stream truncation) — the
+            # flag alone must not suppress the corrective send.
+            # ``_already_sent`` gates the visible-text match: draft frames
+            # set ``_last_sent_text`` for dedupe but are ephemeral (they
+            # deliberately do not set ``_already_sent``), so draft-only
+            # visibility must not count as durable delivery.
+            if self._already_sent and self.has_delivered_text(final_text):
+                return True
+            # The one legitimately ambiguous case keeps legacy trust: a
+            # timed-out full-final send may have reached the platform
+            # (``_send_empty_fallback_final`` → "ambiguous"), so re-sending
+            # risks a duplicate. That site marks itself explicitly.
+            if self._delivery_ambiguous:
+                return None
+            return False
         if self._delivered_final_text.strip() == target:
             return True
         # A segment break / commentary may have delivered the final text
@@ -864,6 +889,7 @@ class GatewayStreamConsumer:
         self._final_response_sent = False
         self._final_content_delivered = False
         self._delivered_final_text = None
+        self._delivery_ambiguous = False
         self._turn_split_delivery = False
         # Native draft streaming: bump the draft_id so the next text segment
         # animates as a fresh preview below the tool-progress bubbles, not
@@ -2191,11 +2217,23 @@ class GatewayStreamConsumer:
                 self._already_sent = True
                 self._fallback_prefix = ""
                 self._fallback_preserve_partial_messages = False
-                if delivery == "ambiguous":
+                if delivery in {"ambiguous", "preview"}:
                     # A timeout may mean Telegram accepted the send but the
-                    # client never received the response. Preserve duplicate
-                    # suppression for that one uncertain outcome.
+                    # client never received the response. A flood rejection
+                    # leaves the complete, ACKed preview as the authoritative
+                    # delivery. Preserve duplicate suppression in both cases.
                     self._final_content_delivered = True
+                    if delivery == "preview":
+                        # This branch is only reached when the ACKed preview
+                        # already shows the complete final text
+                        # (final_text == _visible_prefix()), so record it as
+                        # the turn-final payload: the gateway's reconciliation
+                        # then confirms delivery instead of re-sending a
+                        # second bubble next to the never-deleted preview
+                        # (#71047 Problem B).
+                        self._record_turn_final_payload(final_text)
+                    else:
+                        self._delivery_ambiguous = True
                 else:
                     # A confirmed failure leaves the gateway free to perform
                     # its normal final send.
@@ -2360,8 +2398,9 @@ class GatewayStreamConsumer:
         """Commit a completed answer after Telegram finalization fails.
 
         Returns ``delivered`` on confirmed success, ``failed`` when the
-        gateway can safely retry, and ``ambiguous`` when a timeout may have
-        reached the platform already.
+        gateway can safely retry, ``ambiguous`` when a timeout may have
+        reached the platform already, and ``preview`` when flood control
+        leaves the complete streamed preview as the authoritative delivery.
         """
         # Tool/segment boundaries intentionally preserve the run-wide preview
         # IDs for normal fresh-final cleanup.  This recovery replaces only the
@@ -2376,6 +2415,7 @@ class GatewayStreamConsumer:
                 result = await self.adapter.send(
                     chat_id=self.chat_id,
                     content=final_text,
+                    reply_to=self._initial_reply_to_id,
                     metadata=self._metadata_for_send(final=True),
                 )
             except Exception as exc:
@@ -2396,6 +2436,8 @@ class GatewayStreamConsumer:
                 )
                 await asyncio.sleep(retry_delay)
                 continue
+            if self._is_flood_error(result):
+                return "preview"
             return (
                 "ambiguous"
                 if self._send_failure_may_have_delivered(result)
@@ -2409,7 +2451,17 @@ class GatewayStreamConsumer:
                 if not stale_id or stale_id == new_message_id:
                     continue
                 try:
-                    await delete_fn(self.chat_id, stale_id)
+                    deleted = await delete_fn(self.chat_id, stale_id)
+                    if deleted is False:
+                        # Telegram's delete_message reports failure by
+                        # returning False, not raising. The same flood
+                        # window that broke the finalize edit can reject
+                        # this delete too, leaving the preview bubble next
+                        # to the fresh final (#71047 Problem B). One short
+                        # bounded retry clears the common transient case;
+                        # a second failure stays best-effort.
+                        await asyncio.sleep(1.0)
+                        await delete_fn(self.chat_id, stale_id)
                 except Exception as exc:
                     logger.debug(
                         "Empty fallback preview cleanup failed (%s): %s",
@@ -2934,6 +2986,10 @@ class GatewayStreamConsumer:
         self._last_sent_text = text
         if is_turn_final:
             self._final_response_sent = True
+            # Fresh send carried exactly ``text`` — record it so the gateway
+            # can reconcile the flag against the completed response
+            # (#71643/#95382 content-vs-flag contract).
+            self._record_turn_final_payload(text)
         return True
 
     async def _suppress_silence_marker(self) -> None:
@@ -2999,6 +3055,7 @@ class GatewayStreamConsumer:
         self._final_response_sent = False
         self._final_content_delivered = False
         self._delivered_final_text = None
+        self._delivery_ambiguous = False
         self._turn_split_delivery = False
         logger.info(
             "Suppressed streamed intentional-silence marker (chat=%s)",
@@ -3163,6 +3220,11 @@ class GatewayStreamConsumer:
             if _optimistic_finalize:
                 self._final_response_sent = True
                 self._final_content_delivered = True
+                # Record what this finalize frame carries so the gateway's
+                # content reconciliation (#71643/#95382) can judge the flag:
+                # a frame holding only a stale/partial snapshot must not
+                # suppress the corrective send of the complete response.
+                self._record_turn_final_payload(text)
 
             ok = False
             try:
@@ -3193,6 +3255,8 @@ class GatewayStreamConsumer:
             if _optimistic_finalize:
                 self._final_response_sent = False
                 self._final_content_delivered = False
+                # Roll back the recorded payload too — nothing was delivered.
+                self._delivered_final_text = None
 
             # Native streaming refused / failed — switch off so this and
             # subsequent frames take the edit/send fallback path below.
diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py
index d04b28341b..1f056199a7 100644
--- a/hermes_cli/auth.py
+++ b/hermes_cli/auth.py
@@ -1687,6 +1687,504 @@ def is_runtime_provider_routable(provider_id: str) -> bool:
     return True
 
 
+# Pool providers whose OAuth refresh tokens are SINGLE-USE: redeeming the
+# refresh token rotates the pair and revokes the old one. A grant forked into
+# two auth.json files is therefore not two credentials but one credential with
+# two owners — the first owner to refresh strands the other with
+# ``invalid_grant`` / ``refresh_token_reused`` (#100339; same class as the
+# ``providers.<id>`` write-through hazard in #48415 / #43589). Profiles must
+# never receive a copy of these grants: ONE grant lives at the global root and
+# named profiles read it through the ``read_credential_pool`` root fallback.
+SINGLE_USE_REFRESH_POOL_PROVIDERS = frozenset({
+    "anthropic",
+    "openai-codex",
+    "xai-oauth",
+})
+
+# Singleton credential files that hold the same single-use grants outside
+# ``auth.json``. Copying one into a profile re-seeds a forked pool row on the
+# profile's next ``load_pool()``.
+SINGLE_USE_OAUTH_SINGLETON_FILES = (".anthropic_oauth.json",)
+
+
+def _is_oauth_pool_payload(entry: Any) -> bool:
+    if not isinstance(entry, dict):
+        return False
+    auth_type = str(entry.get("auth_type") or "").strip().lower()
+    if auth_type == "oauth":
+        return True
+    # Legacy rows predating ``auth_type``: an Anthropic OAuth access token or
+    # any row carrying a refresh token is an OAuth grant.
+    if str(entry.get("refresh_token") or "").strip():
+        return True
+    return str(entry.get("access_token") or "").startswith("sk-ant-oat")
+
+
+def strip_cloned_single_use_oauth_grants(profile_dir: Path) -> Dict[str, Any]:
+    """Remove forked single-use OAuth grants from a freshly cloned profile.
+
+    Called after any code path that copies credential files from one profile
+    into another (``hermes profile create --clone-all``, the dashboard/TUI
+    ``mirror_credentials`` flow). API-key pool rows are kept — a static key is
+    safe to duplicate. OAuth rows for the providers in
+    ``SINGLE_USE_REFRESH_POOL_PROVIDERS``, the matching ``providers.<id>``
+    device-code blocks, and the ``.anthropic_oauth.json`` singleton are
+    dropped so the clone reads the grant from the global root instead of
+    holding its own doomed copy (#100339).
+
+    Returns a summary ``{"pool": [...provider ids], "providers": [...],
+    "files": [...]}`` of what was stripped (empty lists when nothing was).
+    Never raises: a clone must not fail because credential hygiene could not
+    run — the caller logs the summary.
+    """
+    stripped: Dict[str, Any] = {"pool": [], "providers": [], "files": []}
+    profile_dir = Path(profile_dir)
+    for name in SINGLE_USE_OAUTH_SINGLETON_FILES:
+        try:
+            target = profile_dir / name
+            if target.is_file() or target.is_symlink():
+                target.unlink()
+                stripped["files"].append(name)
+        except OSError:
+            logger.debug("Could not remove cloned %s from %s", name, profile_dir, exc_info=True)
+
+    auth_path = profile_dir / "auth.json"
+    if not auth_path.is_file():
+        return stripped
+    try:
+        store = json.loads(auth_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError):
+        return stripped
+    if not isinstance(store, dict):
+        return stripped
+
+    changed = False
+    pool = store.get("credential_pool")
+    if isinstance(pool, dict):
+        for provider_id in list(pool):
+            if provider_id not in SINGLE_USE_REFRESH_POOL_PROVIDERS:
+                continue
+            entries = pool.get(provider_id)
+            if not isinstance(entries, list):
+                continue
+            kept = [e for e in entries if not _is_oauth_pool_payload(e)]
+            if len(kept) != len(entries):
+                changed = True
+                stripped["pool"].append(provider_id)
+                if kept:
+                    pool[provider_id] = kept
+                else:
+                    # No local rows at all → read_credential_pool falls back
+                    # to the root slice for this provider.
+                    del pool[provider_id]
+    providers = store.get("providers")
+    if isinstance(providers, dict):
+        # Device-code grants for these providers live under providers.<id>;
+        # _load_provider_state has the same root fallback, so dropping the
+        # copy keeps the profile working while removing the fork.
+        for provider_id in ("openai-codex", "xai-oauth"):
+            block = providers.get(provider_id)
+            if isinstance(block, dict) and block:
+                del providers[provider_id]
+                stripped["providers"].append(provider_id)
+                changed = True
+    if not changed:
+        return stripped
+    try:
+        _save_auth_store(store, target_path=auth_path)
+    except Exception:
+        logger.debug(
+            "Failed to strip cloned single-use OAuth grants from %s",
+            auth_path,
+            exc_info=True,
+        )
+    return stripped
+
+
+# ── One-time heal for installs that ALREADY forked a single-use grant ────────
+#
+# Fleets created before the clone-strip / root-write-through above have
+# profile-local copies of the root grant. Those copies are the same credential
+# with several owners: whichever profile rotated last holds the only live
+# refresh token and every other copy (root included) is spent. Upgrading alone
+# does not fix that — the first load in each profile would keep using its own
+# doomed copy. ``heal_forked_single_use_oauth_grants`` runs at profile
+# ``load_pool()`` time: it finds the profile rows that share LINEAGE with a
+# root row (same pool id — clone-all and the old borrowed-persist both kept
+# it — or the same account identity / token material), keeps the copy most
+# likely to still be live (freshest rotation), writes that copy into ROOT when
+# root's is older, and strips the profile's copy so the profile borrows root
+# from then on. Idempotent (a healed profile has no matched rows), never
+# touches API-key rows, never deletes a row that has no root counterpart
+# (an independent ``hermes -p <p> auth add`` grant, or the only surviving
+# copy), and reads only the two auth.json files the existing root fallback
+# already reads — no environ / secret-scope reads.
+
+_OAUTH_TOKEN_FIELDS = (
+    "access_token",
+    "refresh_token",
+    "expires_at",
+    "expires_at_ms",
+    "last_refresh",
+)
+
+_oauth_heal_notices: List[str] = []
+# provider -> (profile auth.json path, auth.json mtime_ns, singleton mtime_ns)
+# of the last store verified fork-free; lets load_pool() skip the locked scan.
+_oauth_heal_clean_marks: Dict[str, Tuple[str, Optional[int], Optional[int]]] = {}
+
+
+def consume_oauth_heal_notices() -> List[str]:
+    """Return (and clear) human-readable notes about heals run in this process.
+
+    ``hermes auth list`` / ``hermes auth status`` print them so the user sees
+    that a forked grant was consolidated rather than only finding it in logs.
+    """
+    notes = list(_oauth_heal_notices)
+    _oauth_heal_notices.clear()
+    return notes
+
+
+def _oauth_identity(entry: Dict[str, Any]) -> Optional[str]:
+    """Stable account identity for an OAuth row when the token carries one.
+
+    Codex / xAI access tokens are JWTs with ``sub`` / ``email`` /
+    ``chatgpt_account_id`` claims; Anthropic ``sk-ant-oat`` tokens carry no
+    claims (returns None — lineage then rests on id / token material).
+    """
+    if not isinstance(entry, dict):
+        return None
+    for token in (entry.get("access_token"), entry.get("id_token")):
+        claims = _decode_jwt_claims(token)
+        if not claims:
+            continue
+        nested = claims.get("https://api.openai.com/auth")
+        account = nested.get("chatgpt_account_id") if isinstance(nested, dict) else None
+        for value in (account, claims.get("sub"), claims.get("email")):
+            if isinstance(value, str) and value.strip():
+                return value.strip()
+    return None
+
+
+def _oauth_freshness(entry: Dict[str, Any]) -> float:
+    """Best-effort 'how recently was this pair issued' score (epoch seconds).
+
+    A rotation always issues a later-expiring access token, so ``expires_at``
+    ordering identifies the live copy; ``last_refresh`` and the JWT ``exp``
+    claim are fallbacks for rows that do not persist expiry.
+    """
+    from agent.credential_pool import _parse_absolute_timestamp
+
+    best = 0.0
+    for key in ("expires_at_ms", "expires_at", "last_refresh"):
+        ts = _parse_absolute_timestamp(entry.get(key))
+        if ts and ts > best:
+            best = ts
+    if best == 0.0:
+        exp = _decode_jwt_claims(entry.get("access_token")).get("exp")
+        ts = _parse_absolute_timestamp(exp)
+        if ts:
+            best = ts
+    return best
+
+
+def _find_root_counterpart(
+    profile_row: Dict[str, Any], root_rows: List[Dict[str, Any]]
+) -> Optional[int]:
+    """Index of the root OAuth row that shares a grant lineage with *profile_row*.
+
+    Strongest evidence first: same pool ``id`` (clone-all and the pre-fix
+    borrowed-persist both preserved it), same account identity from JWT
+    claims, same token material (an unrotated copy). Fallback per the
+    one-grant-at-root rule: same provider + same OAuth client — every
+    Anthropic ``hermes_pkce`` grant uses one client id and carries no claims,
+    so two Anthropic OAuth rows with no contrary identity are one lineage.
+    Only a row whose identity claims name a DIFFERENT account is left alone
+    (an independent ``hermes -p <p> auth add`` login for another account).
+    """
+    candidates = [i for i, r in enumerate(root_rows) if _is_oauth_pool_payload(r)]
+    if not candidates:
+        return None
+    pid = profile_row.get("id")
+    for i in candidates:
+        if pid and root_rows[i].get("id") == pid:
+            return i
+    p_ident = _oauth_identity(profile_row)
+    for i in candidates:
+        r_ident = _oauth_identity(root_rows[i])
+        if p_ident and r_ident and p_ident == r_ident:
+            return i
+    for key in ("refresh_token", "access_token"):
+        p_val = profile_row.get(key)
+        if not (isinstance(p_val, str) and p_val.strip()):
+            continue
+        for i in candidates:
+            if root_rows[i].get(key) == p_val:
+                return i
+    # Fallback: same provider + same client. Only a contradicting identity
+    # (both sides carry claims and they differ from every root row) blocks it.
+    if p_ident:
+        for i in candidates:
+            if not _oauth_identity(root_rows[i]):
+                return i
+        return None
+    return candidates[0]
+
+
+def _adopt_oauth_material(target: Dict[str, Any], winner: Dict[str, Any]) -> Dict[str, Any]:
+    """Return *target* carrying *winner*'s token pair, status markers cleared."""
+    merged = dict(target)
+    for key in _OAUTH_TOKEN_FIELDS:
+        if winner.get(key) is not None:
+            merged[key] = winner[key]
+        else:
+            merged.pop(key, None)
+    for status_field in _POOL_STATUS_FIELDS:
+        merged[status_field] = None
+    return merged
+
+
+def _singleton_as_row(path: Path) -> Optional[Dict[str, Any]]:
+    """Read a ``.anthropic_oauth.json`` as a pool-row-shaped dict, or None."""
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    if not isinstance(data, dict) or not str(data.get("accessToken") or "").strip():
+        return None
+    return {
+        "access_token": data.get("accessToken"),
+        "refresh_token": data.get("refreshToken"),
+        "expires_at_ms": data.get("expiresAt"),
+    }
+
+
+def heal_forked_single_use_oauth_grants(provider_id: str) -> Optional[Dict[str, Any]]:
+    """Consolidate a profile's forked copy of a single-use OAuth grant into root.
+
+    Runs only in profile mode for ``SINGLE_USE_REFRESH_POOL_PROVIDERS``.
+    Returns a summary ``{"adopted": bool, "stripped_ids": [...], "files": [...],
+    "providers_block": bool}`` when something was healed, else ``None``.
+    Never raises.
+    """
+    if provider_id not in SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        return None
+    try:
+        return _heal_forked_single_use_oauth_grants(provider_id)
+    except Exception:
+        logger.debug("%s: forked-OAuth heal skipped", provider_id, exc_info=True)
+        return None
+
+
+def _heal_forked_single_use_oauth_grants(provider_id: str) -> Optional[Dict[str, Any]]:
+    root_path = _global_auth_file_path()
+    if root_path is None:
+        return None  # classic mode: nothing to consolidate into
+    if os.environ.get("PYTEST_CURRENT_TEST"):
+        # Same seat belt as the write-through paths: never touch the real
+        # user's ~/.hermes/auth.json from a test that forgot to isolate HOME.
+        real_home_env = os.environ.get("HOME", "")
+        if real_home_env and _same_path(root_path, Path(real_home_env) / ".hermes" / "auth.json"):
+            return None
+    profile_path = _auth_file_path()
+    profile_home = profile_path.parent
+    root_home = root_path.parent
+    profile_singleton = profile_home / ".anthropic_oauth.json" if provider_id == "anthropic" else None
+
+    # Hot-path short-circuit: load_pool() runs per model call. Once this
+    # profile's store was verified clean for *provider_id*, skip the locked
+    # read-modify-write until the profile's own files change (mtime key).
+    def _stamp(p: Optional[Path]) -> Optional[int]:
+        try:
+            return p.stat().st_mtime_ns if p is not None else None
+        except OSError:
+            return None
+
+    fingerprint = (str(profile_path), _stamp(profile_path), _stamp(profile_singleton))
+    if _oauth_heal_clean_marks.get(provider_id) == fingerprint:
+        return None
+    if fingerprint[1] is None and fingerprint[2] is None:
+        _oauth_heal_clean_marks[provider_id] = fingerprint
+        return None
+
+    summary: Dict[str, Any] = {"adopted": False, "stripped_ids": [], "files": [], "providers_block": False}
+    log_bits: List[str] = []
+
+    # Lock order: active (profile) store first, then the root source store —
+    # the same order ``_provider_state_transaction`` uses.
+    with _auth_store_lock():
+        profile_store = _load_auth_store(profile_path) if profile_path.exists() else {"providers": {}}
+        with _auth_store_lock(target_path=root_path):
+            root_store = _load_auth_store(root_path) if root_path.exists() else {"providers": {}}
+            profile_changed = False
+            root_changed = False
+
+            p_pool = profile_store.get("credential_pool")
+            p_rows = p_pool.get(provider_id) if isinstance(p_pool, dict) else None
+            p_rows = p_rows if isinstance(p_rows, list) else []
+            r_pool = root_store.get("credential_pool")
+            r_rows = r_pool.get(provider_id) if isinstance(r_pool, dict) else None
+            r_rows = r_rows if isinstance(r_rows, list) else []
+            r_oauth = [r for r in r_rows if _is_oauth_pool_payload(r)]
+
+            root_singleton = root_home / ".anthropic_oauth.json" if provider_id == "anthropic" else None
+            root_singleton_row = (
+                _singleton_as_row(root_singleton)
+                if root_singleton is not None and root_singleton.exists() else None
+            )
+
+            # ── credential_pool rows ────────────────────────────────────
+            kept_rows: List[Any] = []
+            for row in p_rows:
+                if not _is_oauth_pool_payload(row):
+                    kept_rows.append(row)  # API keys are safe to duplicate
+                    continue
+                match_idx = _find_root_counterpart(row, r_rows)
+                if match_idx is not None:
+                    root_row = r_rows[match_idx]
+                    if _oauth_freshness(row) > _oauth_freshness(root_row):
+                        r_rows[match_idx] = _adopt_oauth_material(root_row, row)
+                        root_changed = True
+                        summary["adopted"] = True
+                    summary["stripped_ids"].append(row.get("id"))
+                    profile_changed = True
+                    continue
+                # No root pool counterpart. Root's grant may live only in its
+                # .anthropic_oauth.json (the ``hermes auth`` PKCE shape); a
+                # profile hermes_pkce-family row is that grant's copy.
+                is_pkce = str(row.get("source") or "").endswith("hermes_pkce")
+                if is_pkce and root_singleton_row is not None and not r_oauth:
+                    if _oauth_freshness(row) > _oauth_freshness(root_singleton_row):
+                        root_singleton_row = _adopt_oauth_material(root_singleton_row, row)
+                        summary["adopted"] = True
+                    summary["stripped_ids"].append(row.get("id"))
+                    profile_changed = True
+                    continue
+                # Root holds no copy of this lineage (independent account, or
+                # root never had the grant): the profile's row may be the
+                # only surviving copy — leave it alone.
+                kept_rows.append(row)
+            if profile_changed and isinstance(p_pool, dict):
+                if kept_rows:
+                    p_pool[provider_id] = kept_rows
+                else:
+                    p_pool.pop(provider_id, None)
+
+            # ── providers.<id> device-code blocks (Codex / xAI) ─────────
+            if provider_id in ("openai-codex", "xai-oauth"):
+                p_providers = profile_store.get("providers")
+                r_providers = root_store.get("providers")
+                if isinstance(p_providers, dict) and isinstance(r_providers, dict):
+                    p_block = p_providers.get(provider_id)
+                    r_block = r_providers.get(provider_id)
+                else:
+                    p_block = r_block = None
+                if isinstance(p_block, dict) and p_block and isinstance(r_block, dict) and r_block:
+                    p_tokens = p_block.get("tokens") if isinstance(p_block.get("tokens"), dict) else {}
+                    r_tokens = r_block.get("tokens") if isinstance(r_block.get("tokens"), dict) else {}
+                    p_flat = {**p_tokens, "last_refresh": p_block.get("last_refresh")}
+                    r_flat = {**r_tokens, "last_refresh": r_block.get("last_refresh")}
+                    p_ident, r_ident = _oauth_identity(p_flat), _oauth_identity(r_flat)
+                    same_account = (p_ident == r_ident) if (p_ident and r_ident) else True
+                    if same_account:
+                        if _oauth_freshness(p_flat) > _oauth_freshness(r_flat):
+                            r_providers[provider_id] = dict(p_block)
+                            root_changed = True
+                            summary["adopted"] = True
+                        del p_providers[provider_id]
+                        profile_changed = True
+                        summary["providers_block"] = True
+
+            # ── profile-local .anthropic_oauth.json singleton ───────────
+            if profile_singleton is not None and profile_singleton.exists():
+                p_single = _singleton_as_row(profile_singleton)
+                root_has_grant = bool(r_oauth) or root_singleton_row is not None
+                if p_single is not None and root_has_grant:
+                    if root_singleton_row is not None:
+                        if _oauth_freshness(p_single) > _oauth_freshness(root_singleton_row):
+                            root_singleton_row = _adopt_oauth_material(root_singleton_row, p_single)
+                            summary["adopted"] = True
+                    else:
+                        # Root only has pool rows: fold the singleton's pair
+                        # into the freshest-matching root pkce row, if any.
+                        idx = next(
+                            (i for i, r in enumerate(r_rows)
+                             if _is_oauth_pool_payload(r)
+                             and str(r.get("source") or "").endswith("hermes_pkce")),
+                            None,
+                        )
+                        if idx is not None and _oauth_freshness(p_single) > _oauth_freshness(r_rows[idx]):
+                            r_rows[idx] = _adopt_oauth_material(r_rows[idx], p_single)
+                            root_changed = True
+                            summary["adopted"] = True
+                    try:
+                        profile_singleton.unlink()
+                        summary["files"].append(profile_singleton.name)
+                    except OSError:
+                        logger.debug("could not remove %s", profile_singleton, exc_info=True)
+                # Otherwise root has NO grant for this provider (or the file
+                # is not a grant): the profile's singleton may be the only
+                # surviving copy — never delete it.
+
+            if not (profile_changed or root_changed or summary["adopted"]):
+                _oauth_heal_clean_marks[provider_id] = fingerprint
+                return None
+
+            if summary["adopted"] and root_singleton is not None and root_singleton_row is not None:
+                # Keep root's singleton and its ``hermes_pkce``-seeded pool row
+                # in step: root's next load_pool() re-seeds that row FROM the
+                # singleton file, so a stale file would resurrect the spent
+                # pair (and a stale row would be overwritten by a fresh file).
+                pkce_idx = next(
+                    (i for i, r in enumerate(r_rows)
+                     if _is_oauth_pool_payload(r) and r.get("source") == "hermes_pkce"),
+                    None,
+                )
+                if pkce_idx is not None:
+                    pkce_row = r_rows[pkce_idx]
+                    if _oauth_freshness(pkce_row) > _oauth_freshness(root_singleton_row):
+                        root_singleton_row = _adopt_oauth_material(root_singleton_row, pkce_row)
+                    elif _oauth_freshness(root_singleton_row) > _oauth_freshness(pkce_row):
+                        r_rows[pkce_idx] = _adopt_oauth_material(pkce_row, root_singleton_row)
+                        root_changed = True
+
+            if root_changed:
+                if isinstance(r_pool, dict):
+                    r_pool[provider_id] = r_rows
+                else:
+                    root_store["credential_pool"] = {provider_id: r_rows}
+                _save_auth_store(root_store, target_path=root_path)
+            if summary["adopted"] and root_singleton is not None and root_singleton_row is not None:
+                from agent.anthropic_credentials import _write_hermes_oauth_credentials
+                _write_hermes_oauth_credentials(
+                    root_singleton_row.get("access_token") or "",
+                    root_singleton_row.get("refresh_token"),
+                    root_singleton_row.get("expires_at_ms"),
+                    target=root_singleton,
+                )
+            if profile_changed and profile_path.exists():
+                _save_auth_store(profile_store, target_path=profile_path)
+
+    if summary["stripped_ids"]:
+        log_bits.append(f"pool rows {summary['stripped_ids']}")
+    if summary["providers_block"]:
+        log_bits.append(f"providers.{provider_id} block")
+    if summary["files"]:
+        log_bits.append(", ".join(summary["files"]))
+    verdict = (
+        "profile copy was the live pair; root updated"
+        if summary["adopted"] else "root copy already newest; profile copy dropped"
+    )
+    message = (
+        f"profile {profile_home.name}: consolidated forked {provider_id} OAuth grant "
+        f"({'; '.join(log_bits) or 'no-op'}) into the root grant — {verdict}; "
+        f"this profile now borrows the root grant (#100339)"
+    )
+    logger.info(message)
+    _oauth_heal_notices.append(message)
+    return summary
+
+
 def read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:
     """Return the persisted credential pool, or one provider slice.
 
@@ -4051,6 +4549,32 @@ def _recover_codex_tokens_from_cli(reason: str) -> Optional[Dict[str, str]]:
     return dict(imported)
 
 
+def _codex_http_client(**kwargs: Any) -> "httpx.Client":
+    """Build an ``httpx.Client`` for Codex OAuth/probe endpoints with racing.
+
+    Same broken-IPv6 failure mode as the chat transport (#13834): a host that
+    advertises AAAA records but blackholes IPv6 makes each serial connect
+    attempt eat the full connect timeout before IPv4 is tried, so token
+    refresh / device login / usage probes time out where the official Codex
+    CLI (which races families per RFC 8305) works. Install the same
+    Happy-Eyeballs sync backend #94388 added for the chat transport.
+
+    Best-effort: if the racing backend can't be installed (unexpected
+    httpx/httpcore internals, mocked client in tests), the client still works
+    with the default serial connect behavior. Proxy-backed transports are
+    intentionally left on the default backend (the TCP connect goes to the
+    proxy, not to auth.openai.com/chatgpt.com).
+    """
+    client = httpx.Client(**kwargs)
+    try:
+        from agent.process_bootstrap import enable_happy_eyeballs_on_client
+
+        enable_happy_eyeballs_on_client(client)
+    except Exception:
+        pass
+    return client
+
+
 def refresh_codex_oauth_pure(
     access_token: str,
     refresh_token: str,
@@ -4068,7 +4592,7 @@ def refresh_codex_oauth_pure(
         )
 
     timeout = httpx.Timeout(max(5.0, float(timeout_seconds)))
-    with httpx.Client(
+    with _codex_http_client(
         timeout=timeout,
         headers={
             "Accept": "application/json",
@@ -4517,7 +5041,7 @@ def _probe_codex_quota_restored(
         )
         if isinstance(account_id, str) and account_id.strip():
             headers["ChatGPT-Account-Id"] = account_id.strip()
-        with httpx.Client(timeout=10.0) as client:
+        with _codex_http_client(timeout=10.0) as client:
             response = client.get(_codex_usage_probe_url(base_url), headers=headers)
         if response.status_code == 200:
             payload = response.json() or {}
@@ -7317,8 +7841,73 @@ def get_api_key_provider_status(provider_id: str) -> Dict[str, Any]:
     }
 
 
+def _external_process_auth_evidence(provider_id: str) -> tuple[bool, Optional[str]]:
+    """Best-effort POSITIVE evidence that an external-process provider's CLI
+    is authenticated.
+
+    Returns ``(verified, source)``. ``verified`` is only ever True on hard
+    evidence (a supported env token, or a known on-disk credential store).
+    False means "not verifiable from here", NOT "signed out" — the Copilot
+    CLI may hold its session in an OS keychain Hermes can't read. Callers
+    must therefore treat False as unknown, never as proof of absence.
+
+    Deliberately subprocess-free: this runs from status endpoints and pickers,
+    and spawning ``gh auth token`` there re-creates the cold-start stall
+    (#60800) that copilot_auth.py works to avoid.
+    """
+    if provider_id != "copilot-acp":
+        return False, None
+    # 1. Supported env tokens — the same vars the Copilot CLI itself honors.
+    try:
+        from hermes_cli.copilot_auth import COPILOT_ENV_VARS, validate_copilot_token
+        for env_var in COPILOT_ENV_VARS:
+            val = os.getenv(env_var, "").strip()
+            if val and validate_copilot_token(val)[0]:
+                return True, f"env: {env_var}"
+    except Exception as exc:
+        logger.debug("copilot-acp env token evidence check failed: %s", exc)
+    # 2. The Copilot CLI's own plaintext token store (~/.copilot/config.json,
+    #    written by `copilot login` when no OS keychain is available). The file
+    #    is JSONC — strip //-comment lines before parsing.
+    try:
+        cli_config = os.path.expanduser("~/.copilot/config.json")
+        if os.path.isfile(cli_config):
+            with open(cli_config, "r", encoding="utf-8", errors="ignore") as fh:
+                raw = "\n".join(
+                    line for line in fh.read().splitlines()
+                    if not line.lstrip().startswith("//")
+                )
+            data = json.loads(raw) if raw.strip() else {}
+            tokens = data.get("copilotTokens")
+            if isinstance(tokens, dict) and any(
+                isinstance(v, str) and v.strip() for v in tokens.values()
+            ):
+                return True, "~/.copilot/config.json"
+    except Exception as exc:
+        logger.debug("copilot-acp CLI config evidence check failed: %s", exc)
+    # 3. Known on-disk GitHub Copilot credential stores (the same locations
+    #    models.py already fingerprints as external credential files).
+    for cred_path in (
+        "~/.config/github-copilot/hosts.json",
+        "~/.config/github-copilot/apps.json",
+    ):
+        try:
+            expanded = os.path.expanduser(cred_path)
+            if os.path.isfile(expanded) and os.path.getsize(expanded) > 2:
+                return True, cred_path
+        except OSError:
+            continue
+    return False, None
+
+
 def get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:
-    """Status snapshot for providers that run a local subprocess."""
+    """Status snapshot for providers that run a local subprocess.
+
+    ``configured``/``logged_in`` stay structural (the executable resolves or a
+    TCP endpoint is set) because the spawned subprocess owns its real auth.
+    ``auth_verified``/``auth_source`` carry positive credential evidence when
+    Hermes can actually see some — absence of evidence is not absence of auth.
+    """
     pconfig = PROVIDER_REGISTRY.get(provider_id)
     if not pconfig or pconfig.auth_type != "external_process":
         return {"configured": False}
@@ -7335,6 +7924,7 @@ def get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:
         base_url = pconfig.inference_base_url
 
     resolved_command = shutil.which(command) if command else None
+    auth_verified, auth_source = _external_process_auth_evidence(provider_id)
     return {
         "configured": bool(resolved_command or base_url.startswith("acp+tcp://")),
         "provider": provider_id,
@@ -7344,6 +7934,8 @@ def get_external_process_provider_status(provider_id: str) -> Dict[str, Any]:
         "resolved_command": resolved_command,
         "base_url": base_url,
         "logged_in": bool(resolved_command or base_url.startswith("acp+tcp://")),
+        "auth_verified": auth_verified,
+        "auth_source": auth_source,
     }
 
 
@@ -7364,12 +7956,16 @@ def get_auth_status(provider_id: Optional[str] = None) -> Dict[str, Any]:
         return get_qwen_auth_status()
     if target == "minimax-oauth":
         return get_minimax_oauth_auth_status()
-    if target == "copilot-acp":
-        return get_external_process_provider_status(target)
     if target == "azure-foundry":
         return _get_azure_foundry_auth_status()
-    # API-key providers
     pconfig = PROVIDER_REGISTRY.get(target)
+    # External-process providers (copilot-acp today; kiro/devin/junie-style ACP
+    # backends tomorrow) — dispatch on auth_type, not a hardcoded slug, so every
+    # provider of this class gets a real status instead of the
+    # ``{"logged_in": False}`` fallthrough.
+    if pconfig and pconfig.auth_type == "external_process":
+        return get_external_process_provider_status(target)
+    # API-key providers
     if pconfig and pconfig.auth_type == "api_key":
         return get_api_key_provider_status(target)
     # AWS SDK providers (Bedrock) — check via boto3 credential chain
@@ -8424,7 +9020,7 @@ def _codex_device_code_login() -> Dict[str, Any]:
     max_attempts = 4
     for attempt in range(1, max_attempts + 1):
         try:
-            with httpx.Client(timeout=httpx.Timeout(15.0)) as client:
+            with _codex_http_client(timeout=httpx.Timeout(15.0)) as client:
                 resp = client.post(
                     f"{issuer}/api/accounts/deviceauth/usercode",
                     json={"client_id": client_id},
@@ -8499,7 +9095,7 @@ def _codex_device_code_login() -> Dict[str, Any]:
     code_resp = None
 
     try:
-        with httpx.Client(timeout=httpx.Timeout(15.0)) as client:
+        with _codex_http_client(timeout=httpx.Timeout(15.0)) as client:
             while _time.monotonic() - start < max_wait:
                 _time.sleep(poll_interval)
                 poll_resp = client.post(
@@ -8540,7 +9136,7 @@ def _codex_device_code_login() -> Dict[str, Any]:
         )
 
     try:
-        with httpx.Client(timeout=httpx.Timeout(15.0)) as client:
+        with _codex_http_client(timeout=httpx.Timeout(15.0)) as client:
             token_resp = client.post(
                 CODEX_OAUTH_TOKEN_URL,
                 data={
@@ -9434,6 +10030,7 @@ def _login_nous(args, pconfig: ProviderConfig) -> None:
             from hermes_cli.models import (
                 get_curated_nous_model_ids, get_pricing_for_provider,
                 check_nous_free_tier, partition_nous_models_by_tier,
+                nous_policy_allowed_ids, restrict_to_nous_policy,
                 union_with_portal_free_recommendations,
                 union_with_portal_paid_recommendations,
             )
@@ -9448,6 +10045,10 @@ def _login_nous(args, pconfig: ProviderConfig) -> None:
                 # purchases are reflected immediately.
                 free_tier = check_nous_free_tier(force_fresh=True)
                 _portal_for_recs = auth_state.get("portal_base_url", "")
+                # Narrow before the tier split, so a rescued id still has to
+                # pass the free/paid predicate.
+                _policy_allowed = nous_policy_allowed_ids()
+                _policy_narrowed = False
                 if free_tier:
                     try:
                         from hermes_cli.nous_account import (
@@ -9473,6 +10074,11 @@ def _login_nous(args, pconfig: ProviderConfig) -> None:
                     model_ids, pricing = union_with_portal_free_recommendations(
                         model_ids, pricing, _portal_for_recs,
                     )
+                    _before_policy = model_ids
+                    model_ids = restrict_to_nous_policy(
+                        model_ids, _policy_allowed, rescue_empty=True,
+                    )
+                    _policy_narrowed = model_ids != _before_policy
                     model_ids, unavailable_models = partition_nous_models_by_tier(
                         model_ids, pricing, free_tier=True,
                     )
@@ -9484,8 +10090,18 @@ def _login_nous(args, pconfig: ProviderConfig) -> None:
                     model_ids, pricing = union_with_portal_paid_recommendations(
                         model_ids, pricing, _portal_for_recs,
                     )
+                    _before_policy = model_ids
+                    model_ids = restrict_to_nous_policy(
+                        model_ids, _policy_allowed, rescue_empty=True,
+                    )
+                    _policy_narrowed = model_ids != _before_policy
             _portal = auth_state.get("portal_base_url", "")
             if model_ids:
+                from hermes_cli.nous_account import nous_policy_notice
+
+                _policy_notice = nous_policy_notice(removed=_policy_narrowed)
+                if _policy_notice:
+                    print(_policy_notice)
                 print(f"Showing {len(model_ids)} curated models — use \"Enter custom model name\" for others.")
                 selected_model = _prompt_model_selection(
                     model_ids, pricing=pricing,
diff --git a/hermes_cli/auth_commands.py b/hermes_cli/auth_commands.py
index 954c173cd2..3699032885 100644
--- a/hermes_cli/auth_commands.py
+++ b/hermes_cli/auth_commands.py
@@ -557,6 +557,13 @@ def auth_list_command(args) -> None:
             source = _display_source(entry.source)
             print(f"  #{idx}  {entry.label:<20} {entry.auth_type:<7} {source}{status} {marker}".rstrip())
         print()
+    _print_oauth_heal_notices()
+
+
+def _print_oauth_heal_notices() -> None:
+    """Tell the user when load_pool() just consolidated a forked OAuth grant."""
+    for note in auth_mod.consume_oauth_heal_notices():
+        print(f"note: {note}")
 
 
 def auth_remove_command(args) -> None:
@@ -608,7 +615,12 @@ def auth_status_command(args) -> None:
     provider = _normalize_provider(getattr(args, "provider", "") or "")
     if not provider:
         raise SystemExit("Provider is required. Example: `hermes auth status spotify`.")
+    if provider in auth_mod.SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        # load_pool() runs the forked-grant heal (#100339); do it before the
+        # status read so the report reflects the consolidated grant.
+        load_pool(provider)
     status = auth_mod.get_auth_status(provider)
+    _print_oauth_heal_notices()
     if not status.get("logged_in"):
         reason = status.get("error")
         if reason:
diff --git a/hermes_cli/backup.py b/hermes_cli/backup.py
index bed68e2a9d..1f49582a2e 100644
--- a/hermes_cli/backup.py
+++ b/hermes_cli/backup.py
@@ -107,6 +107,34 @@ _EXCLUDED_DIRS = {
     ".ruff_cache",
 }
 
+# Hermes-managed runtime downloads that only exist at the top of a profile
+# home: local GGUF models, llama.cpp runtime binaries, and the managed Node
+# installation. All of them are re-downloaded on demand (model catalog,
+# runtime bootstrap, node installer) and routinely reach tens to hundreds of
+# GB, so zipping them turns a backup into an hours-long compress of
+# incompressible weights (the "backup stuck at N files" symptom). Matched
+# ONLY at the root of HERMES_HOME and at ``profiles/<name>/`` — a deeper
+# directory that happens to share one of these names (a skill's ``models/``,
+# a user checkout) is user data and stays in the backup.
+_EXCLUDED_ROOT_DIRS = {
+    "models",
+    "runtimes",
+    "node",
+}
+
+
+def _in_excluded_root_dir(rel_path: Path) -> bool:
+    """True when *rel_path* (relative to HERMES_HOME) is, or sits inside, a
+    Hermes-managed runtime tree at the top of a profile home."""
+    parts = rel_path.parts
+    if not parts:
+        return False
+    if parts[0] in _EXCLUDED_ROOT_DIRS:
+        return True
+    # Named profiles are profile homes too: profiles/<name>/models etc.
+    return len(parts) >= 3 and parts[0] == "profiles" and parts[2] in _EXCLUDED_ROOT_DIRS
+
+
 # File-name suffixes to skip
 _EXCLUDED_SUFFIXES = (
     ".pyc",
@@ -128,6 +156,16 @@ _EXCLUDED_NAMES = {
     "cron.pid",
 }
 
+# File-name prefixes to skip. The desktop updater's pre-flight drops
+# ``state.db.pre-update-emergency-<timestamp>.bak`` at the HERMES_HOME root
+# (apps/desktop/electron/main.ts preflightStateDb) — a backup artifact in
+# the same class as ``backups/`` and ``state-snapshots/``, so a full backup
+# must not re-ship it. Matched by prefix because the name carries a
+# timestamp; a plain ``.bak`` suffix rule would drop user files.
+_EXCLUDED_PREFIXES = (
+    "state.db.pre-update-emergency-",
+)
+
 # File names that ``hermes import`` must never overwrite, matched by basename so
 # they're caught for the root profile (``gateway_state.json``) and for named
 # profiles alike (``profiles/<name>/gateway_state.json``).
@@ -335,6 +373,9 @@ def _should_exclude(rel_path: Path) -> bool:
     """Return True if *rel_path* (relative to hermes root) should be skipped."""
     parts = rel_path.parts
 
+    if _in_excluded_root_dir(rel_path):
+        return True
+
     for part in parts:
         if part not in _EXCLUDED_DIRS:
             continue
@@ -350,6 +391,9 @@ def _should_exclude(rel_path: Path) -> bool:
     if name in _EXCLUDED_NAMES:
         return True
 
+    if name.startswith(_EXCLUDED_PREFIXES):
+        return True
+
     if name.endswith(_EXCLUDED_SUFFIXES):
         return True
 
@@ -372,6 +416,48 @@ def _should_skip_backup_file(abs_path: Path, rel_path: Path, out_path: Path) ->
         return False
 
 
+def _iter_backup_files(
+    hermes_root: Path,
+    out_path: Path,
+    skipped_dirs: Optional[set] = None,
+):
+    """Yield ``(abs_path, rel_path)`` for every file a full backup should hold.
+
+    The one owner of the backup walk policy: directory pruning (so os.walk
+    never descends a multi-GB excluded tree), the root-only ``hermes-agent``
+    carve-out, profile-home-root runtime trees, and the per-file exclusion
+    rules — shared by the manual ``hermes backup`` path and the automatic
+    pre-update/pre-migration path so the two can never drift.
+
+    ``skipped_dirs``, when given, collects pruned directories (root-relative,
+    as strings) for the end-of-run summary.
+    """
+    for dirpath, dirnames, filenames in os.walk(hermes_root, followlinks=False):
+        rel_dir = Path(dirpath).relative_to(hermes_root)
+
+        # ``hermes-agent`` is only pruned at the root level; nested dirs
+        # with the same name (e.g. in skills/) must be preserved. Managed
+        # runtime trees (models/, runtimes/, node/) are pruned only at a
+        # profile-home root — see _EXCLUDED_ROOT_DIRS.
+        is_root = rel_dir == Path(".")
+        orig_dirnames = dirnames[:]
+        dirnames[:] = [
+            d for d in dirnames
+            if (d not in _EXCLUDED_DIRS or (d == "hermes-agent" and not is_root))
+            and not _in_excluded_root_dir(rel_dir / d)
+        ]
+        if skipped_dirs is not None:
+            for removed in set(orig_dirnames) - set(dirnames):
+                skipped_dirs.add(str(rel_dir / removed))
+
+        for fname in filenames:
+            rel = rel_dir / fname
+            fpath = hermes_root / rel
+            if _should_skip_backup_file(fpath, rel, out_path):
+                continue
+            yield fpath, rel
+
+
 # ---------------------------------------------------------------------------
 # SQLite safe copy
 # ---------------------------------------------------------------------------
@@ -869,33 +955,10 @@ def _run_backup_locked(args, hermes_root: Path) -> None:
     scan_started = time.monotonic()
     logger.info("backup phase=scan status=started")
     print(f"Scanning {display_hermes_home()} ...")
-    files_to_add: list[tuple[Path, Path]] = []  # (absolute, relative)
-    skipped_dirs = set()
-
-    for dirpath, dirnames, filenames in os.walk(hermes_root, followlinks=False):
-        dp = Path(dirpath)
-        rel_dir = dp.relative_to(hermes_root)
-
-        # Prune excluded directories in-place so os.walk doesn't descend
-        # ``hermes-agent`` is only pruned at the root level; nested dirs
-        # with the same name (e.g. in skills/) must be preserved.
-        is_root = rel_dir == Path(".")
-        orig_dirnames = dirnames[:]
-        dirnames[:] = [
-            d for d in dirnames
-            if d not in _EXCLUDED_DIRS or (d == "hermes-agent" and not is_root)
-        ]
-        for removed in set(orig_dirnames) - set(dirnames):
-            skipped_dirs.add(str(rel_dir / removed))
-
-        for fname in filenames:
-            fpath = dp / fname
-            rel = fpath.relative_to(hermes_root)
-
-            if _should_skip_backup_file(fpath, rel, out_path):
-                continue
-
-            files_to_add.append((fpath, rel))
+    skipped_dirs: set = set()
+    files_to_add: list[tuple[Path, Path]] = list(
+        _iter_backup_files(hermes_root, out_path, skipped_dirs)
+    )
 
     # External memory-provider state (e.g. ~/.honcho, ~/.hindsight) lives
     # outside HERMES_HOME, so the walk above never sees it. Ask the active
@@ -2328,24 +2391,8 @@ def _write_full_zip_backup_locked(out_path: Path, hermes_root: Path) -> Optional
     """
     scan_started = time.monotonic()
     logger.info("automatic backup phase=scan status=started")
-    files_to_add: list[tuple[Path, Path]] = []
     try:
-        for dirpath, dirnames, filenames in os.walk(hermes_root, followlinks=False):
-            dp = Path(dirpath)
-            # Prune excluded directories in-place so os.walk doesn't descend
-            dirnames[:] = [d for d in dirnames if d not in _EXCLUDED_DIRS]
-
-            for fname in filenames:
-                fpath = dp / fname
-                try:
-                    rel = fpath.relative_to(hermes_root)
-                except ValueError:
-                    continue
-
-                if _should_skip_backup_file(fpath, rel, out_path):
-                    continue
-
-                files_to_add.append((fpath, rel))
+        files_to_add = list(_iter_backup_files(hermes_root, out_path))
     except OSError as exc:
         logger.warning("Full-zip backup: walk failed: %s", exc)
         return None
diff --git a/hermes_cli/callbacks.py b/hermes_cli/callbacks.py
index aad0542d28..903bc6709b 100644
--- a/hermes_cli/callbacks.py
+++ b/hermes_cli/callbacks.py
@@ -120,6 +120,8 @@ def prompt_for_secret(cli, var_name: str, prompt: str, metadata=None) -> dict:
         "response_queue": response_queue,
     }
     cli._secret_deadline = _time.monotonic() + timeout
+    if hasattr(cli, "_ring_bell"):
+        cli._ring_bell(prompt=True, context=f"secret needed ({var_name})")
     # Avoid storing stale draft input as the secret when Enter is pressed.
     if hasattr(cli, "_clear_secret_input_buffer"):
         try:
diff --git a/hermes_cli/cli_agent_setup_mixin.py b/hermes_cli/cli_agent_setup_mixin.py
index 09aed5ed3e..46eae97b0d 100644
--- a/hermes_cli/cli_agent_setup_mixin.py
+++ b/hermes_cli/cli_agent_setup_mixin.py
@@ -353,12 +353,18 @@ class CLIAgentSetupMixin:
         }
 
         service_tier = getattr(self, "service_tier", None)
-        if not service_tier:
+        if service_tier != "priority":
+            # None (normal) or auto/cold — the bounded window is applied per
+            # request by agent.fast_mode, not pinned into request_overrides.
             route["request_overrides"] = None
             return route
 
         try:
-            overrides = resolve_fast_mode_overrides(route["model"])
+            overrides = resolve_fast_mode_overrides(
+                route["model"],
+                provider=runtime["provider"],
+                base_url=runtime["base_url"],
+            )
         except Exception:
             overrides = None
         route["request_overrides"] = overrides
@@ -646,29 +652,16 @@ class CLIAgentSetupMixin:
         if not self._session_db:
             return None
         from hermes_state import (
-            SessionExportTooLargeError,
             SessionResumeTooLargeError,
-            resolved_max_resume_messages,
         )
 
         try:
+            safety_check = getattr(self._session_db, "assert_resume_safe", None)
+            if not callable(safety_check):
+                return None
             if tip_only:
-                tip_check = getattr(self._session_db, "assert_export_safe", None)
-                if not callable(tip_check):
-                    return None
-                limit = resolved_max_resume_messages()
-                if limit <= 0:
-                    return None
-                try:
-                    tip_check(self.session_id, max_messages=limit)
-                except SessionExportTooLargeError as exc:
-                    raise SessionResumeTooLargeError(
-                        exc.message_count, limit, scope="in its tip segment"
-                    ) from exc
+                safety_check(self.session_id, tip_only=True)
             else:
-                safety_check = getattr(self._session_db, "assert_resume_safe", None)
-                if not callable(safety_check):
-                    return None
                 safety_check(self.session_id)
         except SessionResumeTooLargeError as exc:
             return str(exc)
diff --git a/hermes_cli/cli_commands_mixin.py b/hermes_cli/cli_commands_mixin.py
index 250949c94d..b78ff6157c 100644
--- a/hermes_cli/cli_commands_mixin.py
+++ b/hermes_cli/cli_commands_mixin.py
@@ -1986,7 +1986,13 @@ class CLICommandsMixin:
                     print(f"  Skills: {', '.join(job['skills'])}")
                 print(f"  Prompt: {job.get('prompt_preview', '')}")
                 if job.get("last_run_at"):
-                    print(f"  Last run: {job['last_run_at']} ({job.get('last_status', '?')})")
+                    status = job.get("last_status") or "?"
+                    # delivery_failed: the agent ran fine but the output never
+                    # reached the target — name the delivery reason, which
+                    # lives in last_delivery_error (last_error is None).
+                    if status == "delivery_failed" and job.get("last_delivery_error"):
+                        status = f"delivery_failed: {job['last_delivery_error']}"
+                    print(f"  Last run: {job['last_run_at']} ({status})")
                 print()
             return
 
@@ -3013,6 +3019,7 @@ class CLICommandsMixin:
                 review_memory=True,
                 review_skills=review_skills,
                 focus=focus or None,
+                explicit=True,
             )
         except Exception as exc:
             _cprint(f"  /refine failed to start: {exc}")
@@ -3982,9 +3989,9 @@ class CLICommandsMixin:
 
         parts = cmd.strip().split(maxsplit=1)
         if len(parts) < 2 or parts[1].strip().lower() == "status":
-            status = "fast" if self.service_tier == "priority" else "normal"
+            status = {"priority": "fast", None: "normal"}.get(self.service_tier, self.service_tier)
             _cprint(f"  {_ACCENT}{feature_name}: {status}{_RST}")
-            _cprint(f"  {_DIM}Usage: /fast [normal|fast|status] [--global]{_RST}")
+            _cprint(f"  {_DIM}Usage: /fast [normal|fast|auto|cold|status] [--global]{_RST}")
             return
 
         arg_tokens = parts[1].strip().lower().split()
@@ -4002,9 +4009,13 @@ class CLICommandsMixin:
             self.service_tier = None
             saved_value = "normal"
             label = "NORMAL"
+        elif arg in {"auto", "cold"}:
+            self.service_tier = arg
+            saved_value = arg
+            label = arg.upper()
         else:
             _cprint(f"  {_DIM}(._.) Unknown argument: {arg}{_RST}")
-            _cprint(f"  {_DIM}Usage: /fast [normal|fast|status] [--global]{_RST}")
+            _cprint(f"  {_DIM}Usage: /fast [normal|fast|auto|cold|status] [--global]{_RST}")
             return
 
         self.agent = None  # Force agent re-init with new service-tier config
diff --git a/hermes_cli/commands.py b/hermes_cli/commands.py
index 23af46886d..f2c2ea7faf 100644
--- a/hermes_cli/commands.py
+++ b/hermes_cli/commands.py
@@ -297,9 +297,9 @@ COMMAND_REGISTRY: list[CommandDef] = [
                args_hint="[level|show|hide|full|clamp] [--global]",
                subcommands=("none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra", "show", "hide", "on", "off", "full", "clamp", "--global"),
                desktop="advanced"),
-    CommandDef("fast", "Toggle fast mode — OpenAI Priority Processing / Anthropic Fast Mode (Normal/Fast)", "Configuration",
-               args_hint="[normal|fast|status] [--global]",
-               subcommands=("normal", "fast", "status", "on", "off", "--global"),
+    CommandDef("fast", "Fast mode — OpenAI Priority Processing / Anthropic Fast Mode (normal/fast/auto/cold)", "Configuration",
+               args_hint="[normal|fast|auto|cold|status] [--global]",
+               subcommands=("normal", "fast", "auto", "cold", "status", "on", "off", "--global"),
                desktop="advanced"),
     CommandDef("skin", "Show or change the display skin/theme", "Configuration",
                cli_only=True, args_hint="[name]", argument_mode="options"),
diff --git a/hermes_cli/config.py b/hermes_cli/config.py
index a3c934d050..add9141382 100644
--- a/hermes_cli/config.py
+++ b/hermes_cli/config.py
@@ -1111,6 +1111,7 @@ ENV_VARS_BY_VERSION: Dict[int, List[str]] = {
     4: ["VOICE_TOOLS_OPENAI_KEY", "ELEVENLABS_API_KEY"],
     5: ["WHATSAPP_ENABLED", "WHATSAPP_MODE", "WHATSAPP_ALLOWED_USERS",
         "SLACK_BOT_TOKEN", "SLACK_APP_TOKEN", "SLACK_ALLOWED_USERS"],
+    10: ["TAVILY_API_KEY"],
     11: ["TERMINAL_MODAL_MODE"],
 }
 
@@ -1456,7 +1457,7 @@ def _is_env_config_key(key: str) -> bool:
         'OPENROUTER_API_KEY', 'OPENAI_API_KEY', 'ANTHROPIC_API_KEY', 'VOICE_TOOLS_OPENAI_KEY',
         'EXA_API_KEY', 'PARALLEL_API_KEY', 'FIRECRAWL_API_KEY', 'FIRECRAWL_API_URL',
         'FIRECRAWL_GATEWAY_URL', 'TOOL_GATEWAY_DOMAIN', 'TOOL_GATEWAY_SCHEME',
-        'TOOL_GATEWAY_USER_TOKEN',
+        'TOOL_GATEWAY_USER_TOKEN', 'TAVILY_API_KEY', 'API_SERVER_KEY',
         'BROWSERBASE_API_KEY', 'BROWSERBASE_PROJECT_ID', 'BROWSER_USE_API_KEY',
         'FAL_KEY', 'TELEGRAM_BOT_TOKEN', 'DISCORD_BOT_TOKEN',
         'TERMINAL_SSH_HOST', 'TERMINAL_SSH_USER', 'TERMINAL_SSH_KEY',
@@ -2526,6 +2527,32 @@ def validate_config_structure(config: Optional[Dict[str, Any]] = None) -> List["
                 f"Move '{key}' under the appropriate section",
             ))
 
+    # ── web backends that no longer ship in-tree ─────────────────────────
+    # A stale selection (e.g. web.backend: tavily after the #99199 removal)
+    # otherwise fails only at the first web_search/web_extract call, with a
+    # generic "no registered provider" error. Warn at startup instead.
+    web_cfg = config.get("web")
+    if isinstance(web_cfg, dict):
+        try:
+            from tools.tool_backend_helpers import removed_backend_note
+        except Exception:
+            removed_backend_note = None
+        if removed_backend_note is not None:
+            seen: set = set()
+            for _key in ("backend", "search_backend", "extract_backend"):
+                _val = str(web_cfg.get(_key) or "").strip().lower()
+                if not _val or _val in seen:
+                    continue
+                seen.add(_val)
+                note = removed_backend_note("web", _val)
+                if note:
+                    issues.append(ConfigIssue(
+                        "warning",
+                        f"web.{_key} is set to '{_val}', but {note} — "
+                        "web_search/web_extract will fail until it is changed",
+                        "Run 'hermes tools' and pick a different Web Search & Extract provider",
+                    ))
+
     return issues
 
 
@@ -2958,13 +2985,36 @@ def _strip_dotted_keys(cfg: dict, dotted_keys: set) -> Tuple[dict, set]:
     return cfg, stripped
 
 
+def _env_ref_lookup(name: str) -> Optional[str]:
+    """Resolve the env var behind a ``${VAR}`` / ``${env:VAR}`` config ref.
+
+    Outside a profile secret scope this is a plain ``os.environ`` read — the
+    default profile and every single-profile caller keep their legacy
+    behavior.  Inside a scope (a multiplexed gateway turn, a secondary
+    profile's config load, a cron job) the read goes through
+    ``agent.secret_scope.get_secret`` so the ref resolves against *that*
+    profile's ``.env``: under multiplexing a miss is a miss, never another
+    profile's ``os.environ`` value (#84079 — every profile "had" the default
+    profile's ``${MATRIX_ACCESS_TOKEN}`` and fanned out).  Same policy as
+    ``gateway.config._getenv`` and ``get_env_value``.
+    """
+    try:
+        from agent.secret_scope import current_secret_scope, get_secret as _get_secret
+    except Exception:
+        return os.environ.get(name)
+    if current_secret_scope() is None:
+        return os.environ.get(name)
+    return _get_secret(name)
+
+
 def _env_expand_match(m: re.Match) -> str:
     """Expand one ``${...}`` config reference.
 
     Two accepted shapes, matching what MCP server config already resolves
     (``tools/mcp_tool.py::_env_ref_name``):
 
-    * ``${VAR}`` — legacy bare name, resolved via ``os.environ``.
+    * ``${VAR}`` — legacy bare name, resolved via ``_env_ref_lookup``
+      (``os.environ``, or the active profile secret scope).
     * ``${env:VAR}`` — Cursor-style SecretRef, same resolution after the
       ``env:`` prefix is stripped.  Before this, the prefixed form worked in
       MCP config but stayed a literal string in config.yaml — a confusing
@@ -2982,7 +3032,7 @@ def _env_expand_match(m: re.Match) -> str:
         name = inner[len("env:"):].strip()
         if not name:
             return raw
-        val = os.environ.get(name)
+        val = _env_ref_lookup(name)
         if val is not None:
             return val
         logger.warning(
@@ -3003,7 +3053,8 @@ def _env_expand_match(m: re.Match) -> str:
         )
         return raw
     # Legacy ``${VAR}`` — bare name.
-    return os.environ.get(inner, raw)
+    val = _env_ref_lookup(inner)
+    return val if val is not None else raw
 
 
 def _env_ref_var_name(ref: str) -> Optional[str]:
@@ -3056,7 +3107,7 @@ def _env_ref_snapshot(obj, snapshot=None):
         for raw in re.findall(r"\${([^}]+)}", obj):
             name = _env_ref_var_name(raw)
             if name is not None:
-                snapshot[name] = os.environ.get(name)
+                snapshot[name] = _env_ref_lookup(name)
     elif isinstance(obj, dict):
         for value in obj.values():
             _env_ref_snapshot(value, snapshot)
@@ -4070,7 +4121,7 @@ def _load_config_impl(*, want_deepcopy: bool) -> Dict[str, Any]:
             # pins unexpanded literals (e.g. auxiliary.<task>.api_key) for the
             # life of the process (#58514).
             env_snapshot = cached[5] if len(cached) > 5 else {}
-            if all(os.environ.get(k) == v for k, v in env_snapshot.items()):
+            if all(_env_ref_lookup(k) == v for k, v in env_snapshot.items()):
                 return copy.deepcopy(cached[4]) if want_deepcopy else cached[4]
 
         config = copy.deepcopy(DEFAULT_CONFIG)
@@ -4631,6 +4682,38 @@ def _env_line_defines_key(
     ) == _env_var_policy_name(key, is_windows=is_windows)
 
 
+def _publish_env_value(key: str, value: Optional[str]) -> None:
+    """Publish a just-persisted ``.env`` change to the live process.
+
+    ``save_env_value`` / ``remove_env_value`` already target the right file
+    (``get_env_path()`` honors the profile-home override), but the in-process
+    mirror historically went straight to ``os.environ``. Under a multiplexed
+    gateway a routed profile's write (e.g. a ``/pair`` grant mirrored into
+    ``DISCORD_ALLOWED_USERS``) would then land in the SHARED process env and
+    be visible to every other profile (#88441, #77490). In that case update
+    the installed scope mapping instead so same-turn reads see the change,
+    and leave ``os.environ`` alone. Every other caller keeps the legacy
+    ``os.environ`` publish.
+    """
+    try:
+        from agent.secret_scope import current_secret_scope, is_multiplex_active
+
+        scope = current_secret_scope() if is_multiplex_active() else None
+    except Exception:
+        scope = None
+    if scope is not None:
+        if isinstance(scope, dict):
+            if value is None:
+                scope.pop(key, None)
+            else:
+                scope[key] = value
+        return
+    if value is None:
+        os.environ.pop(key, None)
+    else:
+        os.environ[key] = value
+
+
 def save_env_value(key: str, value: str):
     """Save or update a value in ~/.hermes/.env."""
     if is_managed():
@@ -4719,7 +4802,7 @@ def save_env_value(key: str, value: str):
             pass
         raise
 
-    os.environ[key] = value
+    _publish_env_value(key, value)
     invalidate_env_cache()
 
 
@@ -4766,7 +4849,7 @@ def remove_env_value(key: str) -> bool:
         raise ValueError(f"Invalid environment variable name: {key!r}")
     env_path = get_env_path()
     if not env_path.exists():
-        os.environ.pop(key, None)
+        _publish_env_value(key, None)
         return False
 
     read_kw = {"encoding": "utf-8-sig", "errors": "replace"}
@@ -4810,7 +4893,7 @@ def remove_env_value(key: str) -> bool:
                 pass
             raise
 
-    os.environ.pop(key, None)
+    _publish_env_value(key, None)
     invalidate_env_cache()
     return found
 
@@ -5064,6 +5147,7 @@ def show_config():
         ("EXA_API_KEY", "Exa"),
         ("PARALLEL_API_KEY", "Parallel"),
         ("FIRECRAWL_API_KEY", "Firecrawl"),
+        ("TAVILY_API_KEY", "Tavily"),
         ("BROWSERBASE_API_KEY", "Browserbase"),
         ("BROWSER_USE_API_KEY", "Browser Use"),
         ("FAL_KEY", "FAL"),
@@ -5108,7 +5192,10 @@ def show_config():
         _active_personality = display.get('personality') or 'none'
     print(f"  Personality:  {_active_personality}")
     print(f"  Reasoning:    {'on' if display.get('show_reasoning', True) else 'off'}")
-    print(f"  Bell:         {'on' if display.get('bell_on_complete', False) else 'off'}")
+    print(
+        f"  Bell:         complete={'on' if display.get('bell_on_complete', False) else 'off'}, "
+        f"prompt={'on' if display.get('bell_on_prompt', False) else 'off'}"
+    )
     ump = display.get('user_message_preview', {}) if isinstance(display.get('user_message_preview', {}), dict) else {}
     ump_first = ump.get('first_lines', 2)
     ump_last = ump.get('last_lines', 2)
@@ -5813,6 +5900,37 @@ def _coerce_float(value: str):
     return f
 
 
+def _redirect_platform_display_key(key: str) -> tuple[str, Optional[str]]:
+    """Canonicalize ``platforms.<name>.<display_setting>`` → ``display.platforms.<name>.<setting>``.
+
+    Per-platform *display* settings (streaming, show_reasoning, tool_progress,
+    …) are resolved by the gateway from ``display.platforms.<name>.<setting>``
+    (``gateway/display_config.py::resolve_display_setting``), while the
+    top-level ``platforms.<name>`` block holds only connection config (token,
+    enabled, reply_to_mode, extra, …).  Before #71047 a write such as
+    ``hermes config set platforms.telegram.streaming false`` landed on a key
+    the gateway never reads: ``config get`` echoed the new value back while
+    the runtime kept the old ``display.platforms`` one — a silent no-op that
+    looks like a duplicated key to the user.
+
+    Only known display settings (``OVERRIDEABLE_KEYS``) are redirected so real
+    connection keys stay put.  Returns ``(canonical_key, note_or_None)``.
+    The gateway import is guarded: the CLI must keep working where the
+    gateway package is not importable.
+    """
+    segs = _split_key_path(key)
+    if len(segs) != 3 or segs[0] != "platforms":
+        return key, None
+    try:
+        from gateway.display_config import OVERRIDEABLE_KEYS as _display_keys
+    except Exception:
+        return key, None
+    if segs[2] not in _display_keys:
+        return key, None
+    canonical = f"display.platforms.{segs[1]}.{segs[2]}"
+    return canonical, f"  (note: per-platform display setting — saved as {canonical})"
+
+
 def set_config_value(key: str, value: str, force: bool = False):
     """Set a configuration value.
 
@@ -5878,6 +5996,12 @@ def set_config_value(key: str, value: str, force: bool = False):
     # bare success and left the user debugging behavior that never changed.
     # Warn after the write so the user gets immediate feedback plus a
     # "did you mean" hint, without blocking legitimate unknown keys.
+    # Per-platform display settings live under display.platforms (#71047,
+    # Problem A) — canonicalize BEFORE validation/coercion so the type-aware
+    # coercion and the unknown-key hint both see the path the runtime reads.
+    key, _redirect_note = _redirect_platform_display_key(key)
+    if _redirect_note:
+        print(_redirect_note)
     is_known, suggestion = _validate_config_key(key)
 
     # Otherwise it goes to config.yaml
@@ -6093,6 +6217,9 @@ def get_config_value(key: str, *, as_json: bool = False):
         env_value = get_env_value(key.upper())
         value = _MISSING if env_value is None else env_value
     else:
+        # Mirror set_config_value: read the canonical display.platforms path
+        # so ``config get`` reports what the gateway resolves (#71047).
+        key, _ = _redirect_platform_display_key(key)
         value = _get_nested(load_config(), key)
 
     if value is _MISSING:
@@ -6138,6 +6265,10 @@ def unset_config_value(key: str):
     # refuse-write); returns the mapping so we do not re-parse / collapse.
     user_config = require_readable_config_before_write(config_path)
 
+    # Mirror set_config_value's display.platforms canonicalization (#71047).
+    key, _redirect_note = _redirect_platform_display_key(key)
+    if _redirect_note:
+        print(_redirect_note.replace("saved as", "resolved as"))
     removed = _unset_nested(user_config, key)
 
     # Keep .env in sync for keys that terminal_tool reads directly from env vars.
diff --git a/hermes_cli/config_defaults.py b/hermes_cli/config_defaults.py
index ae73c74eb5..6cfc67692f 100644
--- a/hermes_cli/config_defaults.py
+++ b/hermes_cli/config_defaults.py
@@ -151,7 +151,10 @@ DEFAULT_CONFIG = {
             # leaves the budget untouched.
             "cost_threshold_usd": 0.25,
         },
+        # Fast mode: "" / "normal" (off), "fast" (always), "auto" (first
+        # fast_auto_seconds of every turn), "cold" (first turn of a session only).
         "service_tier": "",
+        "fast_auto_seconds": 60,
         # Tool-use enforcement: injects system prompt guidance that tells the
         # model to actually call tools instead of describing intended actions.
         # Values: "auto" (default — applies to gpt/codex models), true/false
@@ -555,7 +558,7 @@ DEFAULT_CONFIG = {
         "extract_backend": "",   # per-capability override for web_extract (e.g. "native")
         "extract_char_limit": 15000,  # per-page char budget for web_extract; larger pages truncate + store full text in cache/web
         # Keyless free-tier ring: with NO web backend configured or keyed,
-        # web_search/web_extract rotate round-robin across five vendors'
+        # web_search/web_extract rotate round-robin across four vendors'
         # public free tiers (exa, parallel, firecrawl, keenable),
         # failing over to the next ring vendor on rate limits. Never
         # pre-empts a configured or keyed backend. Set false to disable.
@@ -565,10 +568,11 @@ DEFAULT_CONFIG = {
         # free-tier ring — the next call attempts the chosen backend again
         # (no sticky failover). Off when keyless_fallback is false.
         "keyless_rescue": True,
-        # Per-provider tier selection for ring vendors with both a keyless
+        # Per-provider tier selection for vendors with both a keyless
         # free endpoint and a keyed paid path (exa, parallel,
-        # firecrawl, keenable). Set by the `hermes tools` picker's
-        # "Free (keyless)" / "Paid (API key)" rows.
+        # firecrawl, keenable on the ring; tavily is opt-in keyless via
+        # `hermes tools`, not a ring member). Set by the `hermes tools`
+        # picker's "Free (keyless)" / "Paid (API key)" rows.
         #   free  — always use the anonymous free endpoint (even with a key)
         #   paid  — always use the keyed path (missing key = error; vendor
         #           is also excluded from the keyless ring)
@@ -820,6 +824,10 @@ DEFAULT_CONFIG = {
     "tool_loop_guardrails": {
         "warnings_enabled": True,
         "hard_stop_enabled": False,
+        # Unattended gateway/cron platforms get hard stops by default (nobody
+        # is present to /stop a model that ignores loop warnings); interactive
+        # cli/tui/desktop/acp stay warning-only unless hard_stop_enabled.
+        "non_interactive_hard_stop_enabled": True,
         "warn_after": {
             "exact_failure": 2,
             "same_tool_failure": 3,
@@ -956,6 +964,10 @@ DEFAULT_CONFIG = {
                                       # waiting. Kept well under chat-transport idle timeouts
                                       # (Telegram ~30s). On expiry the turn proceeds
                                       # uncompressed — an availability boundary, not a failure.
+                                      # The detached worker keeps its commit admission when its
+                                      # commit is watermark-fenced, so the finished summary is
+                                      # adopted at the next safe boundary instead of being
+                                      # discarded (#97963 — thinking summary models).
         "context_timeout_seconds": 120,  # inactivity budget for in-agent compress_context
                                       # (conversation loop, /compress, preflight, etc.).
                                       # Same progress-aware semantics as hygiene_timeout_seconds:
@@ -1457,12 +1469,18 @@ DEFAULT_CONFIG = {
         # Mirrors `hermes -c` muscle memory.  Default off so existing
         # users aren't surprised.  HERMES_TUI_RESUME=<id> always wins.
         "tui_auto_resume_recent": False,
+        # When true (default), the Desktop app reopens the last chat (or
+        # last page) on cold start. Set false to always land on a fresh
+        # new chat. Also a switch in Desktop Settings → Appearance.
+        "resume_last_session": True,
         # When true (default), `hermes --tui` drops a one-time hint
         # ("subagents working · /agents to watch live") the first time a turn
         # starts delegating, nudging the user toward the live spawn-tree
         # dashboard. Set false to suppress the hint.
         "tui_agents_nudge": True,
         "bell_on_complete": False,
+        # Bell when a blocking prompt opens (clarify/approval/sudo/secret).
+        "bell_on_prompt": False,
         # Stream the model's reasoning/thinking live before the response.
         # Default ON: on thinking models the reasoning phase can run tens of
         # seconds, and with this off the user stares at a spinner the whole
@@ -1733,6 +1751,15 @@ DEFAULT_CONFIG = {
         # override for backward compatibility. 0 disables the reap
         # (park forever).
         "ws_orphan_reap_grace_s": 20.0,
+        # Activity-staleness threshold (seconds) gating the WS-orphan
+        # interrupt of a detached RUNNING turn (#98028/#100325). A
+        # client-absent turn is only interrupted once its agent activity
+        # clock (the same one the agent.turn_liveness watchdog samples —
+        # stamped by API waits, stream tokens, tool heartbeats) has been
+        # idle at least this long; an actively-working detached turn runs
+        # to completion. Default matches agent.turn_liveness.timeout_s.
+        # 0 restores the old interrupt-at-grace-regardless behavior.
+        "ws_orphan_activity_stale_s": 600.0,
         # Startup sweep of session rows orphaned by a dead gateway process
         # (#65194).  The ws-orphan grace timer above is in-process, so a
         # gateway restart (update, crash, systemd) leaves disconnected
@@ -2796,6 +2823,15 @@ DEFAULT_CONFIG = {
         # Wrap delivered cron responses with a header (task name) and footer
         # ("The agent cannot see this message").  Set to false for clean output.
         "wrap_response": True,
+        # Delivery behaviour for cron output sent through a live gateway adapter.
+        "delivery": {
+            # Mark cron deliveries as FINAL notifications so the platform pushes
+            # them (Telegram's "important" notification mode otherwise sends
+            # every non-notify message with disable_notification=True, and users
+            # report the silent brief as "never delivered"). Set to false to
+            # restore silent (no-push) cron deliveries.
+            "notify": True,
+        },
         # Make cron deliveries CONTINUABLE: a user can reply to a cron brief
         # and the agent has it in context (no "what is Task #2?" amnesia).
         # Default False preserves the historical isolation guarantee (cron
@@ -3080,10 +3116,12 @@ DEFAULT_CONFIG = {
     "model_catalog": {
         "enabled": True,
         "url": "https://hermes-agent.nousresearch.com/docs/api/model-catalog.json",
-        # Disk cache TTL in hours.  Beyond this, the CLI refetches on the
-        # next /model or `hermes model` invocation; network failures
-        # silently fall back to the stale cache.
-        "ttl_hours": 1,
+        # Disk cache TTL in minutes.  The gateway refreshes the catalogs on
+        # this cadence in the background; the CLI refetches on the next
+        # /model or `hermes model` invocation once the cache is older than
+        # this.  Network failures silently fall back to the stale cache.
+        # (Legacy `ttl_hours` is still honoured when set explicitly.)
+        "ttl_minutes": 20,
         # Optional per-provider override URLs for third parties that want
         # to self-host their own curation list using the same schema.
         # Example:
@@ -3337,6 +3375,17 @@ DEFAULT_CONFIG = {
         # adapter. ``0`` disables the cap. Default 128 MiB.
         "max_inbound_media_bytes": 134217728,
 
+        # Whether gateway platform adapters let aiohttp read proxy settings
+        # (HTTP_PROXY / HTTPS_PROXY / NO_PROXY, plus SSL_CERT_FILE) from the
+        # process environment, and whether generic proxy env / the macOS
+        # system proxy are auto-detected for adapter clients. Set to false
+        # when the gateway inherits a proxy it must not use — e.g. a Windows
+        # Scheduled Task picking up a Clash/V2Ray HTTP_PROXY the interactive
+        # shell never sees, producing "Cannot connect to host 127.0.0.1:7890"
+        # poll loops (#48820). Explicit per-platform vars (DISCORD_PROXY,
+        # TELEGRAM_PROXY, ...) are still honored. One knob for every adapter.
+        "trust_env": True,
+
         # When false (default), any file path the agent emits is delivered
         # as a native attachment as long as it isn't under the credential /
         # system-path denylist (/etc, /proc, ~/.ssh, ~/.aws, ~/.hermes/.env,
@@ -3433,13 +3482,18 @@ DEFAULT_CONFIG = {
     # reports 384MB+ databases with 68K+ messages, which slows down FTS5
     # inserts, /resume listing, and insights queries.
     "sessions": {
-        # When true, prune ended sessions inactive for retention_days once
+        # When true, prune ENDED sessions inactive for retention_days once
         # per (roughly) min_interval_hours at CLI/gateway/cron startup.
         # Activity is the latest message timestamp, falling back to creation
-        # time for empty sessions. Active sessions are always preserved.
-        # Default false: session history is valuable for search recall, and
-        # silently deleting it could surprise users.  Opt in explicitly.
-        "auto_prune": False,
+        # time for empty sessions. Sessions that are still open, pinned, or
+        # mid-turn are never deleted — the only open rows the sweep touches
+        # are stale automation sessions (cron/kanban/subagent/one-shot CLI)
+        # whose process died without closing them; those are *closed*, not
+        # deleted, and get a further full retention window before removal.
+        # Default true since #54189: without it state.db grows without bound
+        # (multi-GB installs reported within weeks).  Set false to keep every
+        # ended session forever.
+        "auto_prune": True,
         # How many inactive days of ended-session history to keep. Matches
         # the default of ``hermes sessions prune``.
         "retention_days": 90,
@@ -3457,7 +3511,9 @@ DEFAULT_CONFIG = {
         # subsequent INSERTs — so without VACUUM the file stays bloated
         # even after pruning.  VACUUM blocks writes for a few seconds per
         # 100MB, so it only runs at startup, and only when prune deleted
-        # ≥1 session.
+        # ≥1 session AND the reclaimable fraction of the file
+        # (PRAGMA freelist_count / page_count) exceeds 25% — a dense DB
+        # never pays for a full rewrite to reclaim a few MB (#54189).
         "vacuum_after_prune": True,
         # Minimum days between successful VACUUM rewrites. Pruning can still
         # run on its normal cadence while SQLite reuses the freed pages.
@@ -3532,11 +3588,28 @@ DEFAULT_CONFIG = {
         "profile_build": "ask",
     },
 
-    # Privacy-safe aggregate metrics written only to this profile's local
-    # telemetry directory. Collection is opt-in and no remote sink exists.
+    # Privacy-safe aggregate metrics written to this profile's local telemetry
+    # directory. Collection is opt-in (``enabled``). Transmission to the Nous
+    # telemetry service is a SEPARATE opt-in (``send``) and is off by default;
+    # see docs/observability/relay-shared-metrics.md, Appendix A, for the
+    # consent, identity, rotation, retention, and deletion decisions.
     "telemetry": {
         "shared_metrics": {
             "enabled": False,
+            # Transmit exported packages to the Nous telemetry service.
+            # Requires ``enabled``: it never switches collection on by itself,
+            # and ``send`` without ``enabled`` is logged as an error rather
+            # than silently doing nothing. A package is only sent when its
+            # whole period falls inside a recorded consent window, so data
+            # collected before consent — or while it was withdrawn — stays
+            # local.
+            "send": False,
+            # Ingest endpoint. Production by default; override for staging or
+            # a local test server. Deliberately NOT overridable by an
+            # environment variable: that would let an inherited value silently
+            # redirect telemetry a user consented to send to Nous. Non-HTTPS
+            # is refused unless the host is localhost.
+            "endpoint": "https://telemetry.nousresearch.com/v1/telemetry",
         },
     },
 
@@ -4002,8 +4075,31 @@ DEFAULT_CONFIG = {
         "region": "global",
     },
 
+    # Managed llama.cpp local runtime (see docs: user-guide/local-models).
+    # Hermes downloads official llama.cpp release binaries, then spawns and
+    # supervises one llama-server in router mode. Context sizing is policy,
+    # not preference: there are deliberately no context/VRAM knobs here.
+    "local_runtime": {
+        # Master switch for the managed runtime. Off = detection-only
+        # (Hermes still finds an external llama-server you run yourself).
+        "enabled": False,
+        # Pinned llama.cpp release tag (rolling bNNNN). Bumped by Hermes
+        # releases after the validation suite re-runs, not tracked live.
+        "tag": "b10679",
+        # Inference backend: auto = CUDA on NVIDIA, Metal on macOS, Vulkan on
+        # other GPUs, else CPU. Explicit values: cuda|metal|vulkan|hip|cpu.
+        "backend": "auto",
+        # Router process: how many models may be resident at once.
+        "models_max": 4,
+        # Port for the managed server. 0 = pick a free port at spawn.
+        "port": 0,
+        # Extra ports detection probes for an external llama-server, in
+        # addition to the default 8080.
+        "detect_ports": [],
+    },
+
     # Config schema version - bump this when adding new required fields
-    "_config_version": 39,
+    "_config_version": 40,
 }
 
 # Optional environment variables that enhance functionality
@@ -4504,6 +4600,14 @@ OPTIONAL_ENV_VARS = {
         "category": "tool",
         "advanced": True,
     },
+    "TAVILY_API_KEY": {
+        "description": "Tavily API key for AI-native web search and extract (optional — keyless works when Tavily is selected)",
+        "prompt": "Tavily API key",
+        "url": "https://app.tavily.com/home",
+        "tools": ["web_search", "web_extract"],
+        "password": True,
+        "category": "tool",
+    },
     "KEENABLE_API_KEY": {
         "description": "Keenable API key for fast independent-index web search and page fetch (optional — keyless free tier works without it)",
         "prompt": "Keenable API key",
diff --git a/hermes_cli/config_migrations.py b/hermes_cli/config_migrations.py
index 3357aaec16..cb075be302 100644
--- a/hermes_cli/config_migrations.py
+++ b/hermes_cli/config_migrations.py
@@ -863,6 +863,28 @@ def _migrate_to_39(results: Dict[str, Any], quiet: bool) -> None:
             )
 
 
+def _migrate_to_40(results: Dict[str, Any], quiet: bool) -> None:
+    # ── Version 39 → 40: model_catalog.ttl_hours → ttl_minutes (default 20) ──
+    # The picker catalogs now refresh every 20 minutes (and the gateway
+    # refreshes them in the background on that cadence). Only the OLD default
+    # (ttl_hours: 1, written by the v25 migration) is dropped so the new
+    # default applies; any other explicit ttl_hours is a deliberate choice
+    # and stays honoured by the loader.
+    _c = _cfg()
+    read_raw_config = _c.read_raw_config
+    _persist_migration = _c._persist_migration
+
+    config = read_raw_config()
+    raw_mc = config.get("model_catalog")
+    if isinstance(raw_mc, dict) and raw_mc.get("ttl_hours") == 1 and "ttl_minutes" not in raw_mc:
+        del raw_mc["ttl_hours"]
+        config["model_catalog"] = raw_mc
+        _persist_migration(config)
+        results["config_added"].append("model_catalog.ttl_hours 1 → ttl_minutes 20 (default)")
+        if not quiet:
+            print("  ✓ Model catalog now refreshes every 20 minutes (model_catalog.ttl_minutes)")
+
+
 #: Registry of (target_version, migration_fn), strictly ascending. The driver
 #: applies every entry whose target version is greater than the on-disk
 #: observe earlier steps' writes via read_raw_config() (filesystem state).
@@ -890,6 +912,7 @@ MIGRATIONS: Tuple[Tuple[int, Callable[[Dict[str, Any], bool], None]], ...] = (
     (37, _migrate_to_37),
     (38, _migrate_to_38),
     (39, _migrate_to_39),
+    (40, _migrate_to_40),
 )
 
 
diff --git a/hermes_cli/container_boot.py b/hermes_cli/container_boot.py
index b0e9821b7b..cc5c6ff0c0 100644
--- a/hermes_cli/container_boot.py
+++ b/hermes_cli/container_boot.py
@@ -136,11 +136,23 @@ def reconcile_profile_gateways(
     # for every profile. Named slots must still be registered (so explicit
     # lifecycle management remains available), but booting them from their
     # persisted run intent would create additional multiplex owners.
+    # Keep the boot reconciler aligned with the gateway that will own these
+    # slots. The runtime resolver gives a recognized environment override
+    # precedence over config.yaml and otherwise preserves the configured value.
+    from gateway.config import load_gateway_config
     from utils import is_truthy_value
 
-    multiplex_profiles = is_truthy_value(
-        os.environ.get("GATEWAY_MULTIPLEX_PROFILES"),
-    )
+    try:
+        multiplex_profiles = load_gateway_config().multiplex_profiles
+    except Exception:
+        log.warning(
+            "Unable to load gateway configuration during container boot; "
+            "using the GATEWAY_MULTIPLEX_PROFILES override if set.",
+            exc_info=True,
+        )
+        multiplex_profiles = is_truthy_value(
+            os.environ.get("GATEWAY_MULTIPLEX_PROFILES"),
+        )
 
     # Default profile — always register, even if nothing has ever
     # populated the root profile dir. The slot exists so
diff --git a/hermes_cli/cron.py b/hermes_cli/cron.py
index 8db53a707b..cc19e94c6b 100644
--- a/hermes_cli/cron.py
+++ b/hermes_cli/cron.py
@@ -264,6 +264,12 @@ def cron_list(show_all: bool = False):
             last_run = job.get("last_run_at", "?")
             if last_status == "ok":
                 status_display = color("ok", Colors.GREEN)
+            elif last_status == "delivery_failed":
+                # The agent succeeded but the result never reached the user —
+                # not green, and the detail lives in last_delivery_error
+                # (last_error is None for these runs).
+                detail = job.get("last_delivery_error") or "?"
+                status_display = color(f"delivery_failed: {detail}", Colors.YELLOW)
             else:
                 status_display = color(f"{last_status}: {job.get('last_error', '?')}", Colors.RED)
                 streak = int(job.get("failure_streak") or 0)
@@ -286,6 +292,17 @@ def cron_list(show_all: bool = False):
         if delivery_err:
             print(f"    {color('⚠ Delivery failed:', Colors.YELLOW)} {delivery_err}")
 
+        # A live adapter acked the last send but returned no message_id /
+        # raw_response (Slack/Matrix/Mattermost shape): accepted as delivered,
+        # but say so here rather than only in a WARNING log line.
+        unverified = job.get("last_delivery_unverified")
+        if unverified:
+            targets = ", ".join(str(t) for t in unverified) if isinstance(unverified, list) else str(unverified)
+            print(
+                f"    {color('⚠ Delivery UNVERIFIED:', Colors.YELLOW)} "
+                f"adapter acked {targets} without message_id/raw_response"
+            )
+
         fire_err = job.get("last_fire_error")
         if isinstance(fire_err, dict) and fire_err.get("detail"):
             print(
@@ -688,7 +705,10 @@ def _cron_doctor_issues_for_job(job: Dict[str, Any]) -> List[str]:
     issues: List[str] = []
 
     last_status = str(job.get("last_status") or "").strip().lower()
-    if last_status and last_status != "ok":
+    # "delivery_failed" means the agent run itself succeeded, so it is not a
+    # failed last run — the dedicated delivery issue below reports it (and
+    # last_error is None, which would render as "unknown error" here).
+    if last_status and last_status not in {"ok", "delivery_failed"}:
         err = str(job.get("last_error") or "unknown error").strip()
         issues.append(f"last run failed: {err}")
 
@@ -696,6 +716,11 @@ def _cron_doctor_issues_for_job(job: Dict[str, Any]) -> List[str]:
     if delivery_err:
         issues.append(f"last delivery failed: {delivery_err}")
 
+    unverified = job.get("last_delivery_unverified")
+    if unverified:
+        targets = ", ".join(str(t) for t in unverified) if isinstance(unverified, list) else str(unverified)
+        issues.append(f"last delivery unverified (adapter acked without evidence): {targets}")
+
     if job.get("enabled", True) and job.get("state") not in {"paused", "completed"}:
         next_run = str(job.get("next_run_at") or "").strip()
         if not next_run:
@@ -766,6 +791,7 @@ def cron_create(args):
         prompt=args.prompt,
         name=getattr(args, "name", None),
         deliver=getattr(args, "deliver", None),
+        failure_deliver=getattr(args, "failure_deliver", None),
         repeat=getattr(args, "repeat", None),
         skill=getattr(args, "skill", None),
         skills=_normalize_skills(getattr(args, "skill", None), getattr(args, "skills", None)),
@@ -842,6 +868,7 @@ def cron_edit(args):
         prompt=getattr(args, "prompt", None),
         name=getattr(args, "name", None),
         deliver=getattr(args, "deliver", None),
+        failure_deliver=getattr(args, "failure_deliver", None),
         repeat=getattr(args, "repeat", None),
         skills=final_skills,
         script=getattr(args, "script", None),
diff --git a/hermes_cli/dashboard_auth/__init__.py b/hermes_cli/dashboard_auth/__init__.py
index c07b2ade6f..9a997fd224 100644
--- a/hermes_cli/dashboard_auth/__init__.py
+++ b/hermes_cli/dashboard_auth/__init__.py
@@ -19,6 +19,7 @@ from hermes_cli.dashboard_auth.base import (
     ProviderError,
     RefreshExpiredError,
     assert_protocol_compliance,
+    classify_jwks_lookup_error,
 )
 from hermes_cli.dashboard_auth.registry import (
     register_provider,
@@ -39,6 +40,7 @@ __all__ = [
     "ProviderError",
     "RefreshExpiredError",
     "assert_protocol_compliance",
+    "classify_jwks_lookup_error",
     "register_provider",
     "get_provider",
     "list_providers",
diff --git a/hermes_cli/dashboard_auth/base.py b/hermes_cli/dashboard_auth/base.py
index 2d744c6cf3..02db55f65e 100644
--- a/hermes_cli/dashboard_auth/base.py
+++ b/hermes_cli/dashboard_auth/base.py
@@ -110,6 +110,45 @@ class RefreshExpiredError(Exception):
     """
 
 
+def classify_jwks_lookup_error(exc: BaseException) -> Exception:
+    """Map a ``PyJWKClient.get_signing_key_from_jwt`` failure to the protocol.
+
+    Only a genuine transport failure (the IDP's JWKS endpoint could not be
+    fetched) is a :class:`ProviderError` — middleware turns that into 503
+    "auth provider unreachable" so a flaky IDP never forces a logout.
+
+    Everything else means the token itself cannot be verified by this
+    provider and is an :class:`InvalidCodeError` (``verify_session`` returns
+    ``None``, the middleware tries the next provider / refresh / 401):
+
+    * ``jwt.DecodeError`` — the bearer is not a JWT at all (an opaque peer
+      key, a legacy session token, garbage). #94558: hosted agents answered
+      every non-JWT bearer with a fast 503 ``Auth provider 'nous'
+      unreachable`` even though Portal was healthy, because "cannot parse"
+      and "cannot reach" were folded into one branch.
+    * ``jwt.PyJWKSetError`` — the JWKS was fetched fine but holds no key for
+      this token's ``kid`` (rotated/foreign key). The provider was reached;
+      the token is simply not one of ours.
+
+    ``PyJWKClientConnectionError`` is the only ``PyJWKClientError`` subclass
+    that denotes unreachability; a bare ``PyJWKClientError`` (unexpected
+    JWKS shape) is kept as a provider fault since the IDP misbehaved.
+    """
+    try:
+        import jwt
+    except Exception:  # pragma: no cover - jwt is a hard dep of these providers
+        return ProviderError(f"JWKS lookup failed: {exc!r}")
+    if isinstance(exc, jwt.PyJWKClientConnectionError):
+        return ProviderError(f"JWKS lookup failed: {exc}")
+    if isinstance(exc, (jwt.DecodeError, jwt.PyJWKSetError)):
+        return InvalidCodeError(f"token not verifiable by this provider: {exc}")
+    if isinstance(exc, jwt.PyJWKClientError):
+        return ProviderError(f"JWKS lookup failed: {exc}")
+    if isinstance(exc, jwt.InvalidTokenError):
+        return InvalidCodeError(f"token not verifiable by this provider: {exc}")
+    return ProviderError(f"JWKS lookup failed: {exc!r}")
+
+
 class DashboardAuthProvider(ABC):
     """Protocol every dashboard-auth provider plugin implements.
 
diff --git a/hermes_cli/doctor.py b/hermes_cli/doctor.py
index 1af14d3882..fcb89ce5d0 100644
--- a/hermes_cli/doctor.py
+++ b/hermes_cli/doctor.py
@@ -405,6 +405,28 @@ def check_info(text: str):
     print(f"    {color('→', Colors.CYAN)} {text}")
 
 
+def _doctor_memory_config(hermes_home: Path | None = None) -> dict:
+    """Return the effective memory section used by doctor diagnostics."""
+    home = hermes_home if hermes_home is not None else HERMES_HOME
+    try:
+        from hermes_cli.config import _expand_env_vars, read_user_config_raw
+
+        config_path = home / "config.yaml"
+        if not config_path.exists():
+            return {}
+        config = _expand_env_vars(read_user_config_raw(config_path))
+        try:
+            from hermes_cli import managed_scope
+
+            config = managed_scope.apply_managed_overlay(config)
+        except Exception:
+            pass
+        section = config.get("memory") if isinstance(config, dict) else None
+        return section if isinstance(section, dict) else {}
+    except Exception:
+        return {}
+
+
 # ── state.db health/stats thresholds (advisory only — module constants,
 # deliberately NOT config: doctor warnings are guidance, not policy) ──
 STATE_DB_SIZE_WARN_BYTES = 1 * 1024 * 1024 * 1024   # 1 GiB logical size
@@ -1980,8 +2002,19 @@ def run_doctor(args):
     else:
         check_warn(f"{_DHH} not found", "(will be created on first use)")
     
-    # Check expected subdirectories
-    expected_subdirs = ["cron", "sessions", "logs", "skills", "memories"]
+    from tools.memory_tool import get_builtin_memory_store_flags
+
+    _memory_config = _doctor_memory_config(hermes_home)
+    _memory_enabled, _user_profile_enabled = get_builtin_memory_store_flags(
+        {"memory": _memory_config}
+    )
+
+    # Check expected subdirectories. The built-in file store does not create or
+    # consume memories/ when both targets are disabled, so stale migration files
+    # are not an active diagnostic surface.
+    expected_subdirs = ["cron", "sessions", "logs", "skills"]
+    if _memory_enabled or _user_profile_enabled:
+        expected_subdirs.append("memories")
     for subdir_name in expected_subdirs:
         subdir_path = hermes_home / subdir_name
         if subdir_path.exists():
@@ -2016,22 +2049,28 @@ def run_doctor(args):
             check_ok(f"Created {_DHH}/SOUL.md with basic template")
             fixed_count += 1
     
-    # Check memory directory
+    # Check only enabled built-in stores. External providers are additive, but
+    # users can explicitly disable either legacy file target; stale files left
+    # by a migration must not be presented as active memory usage.
     memories_dir = hermes_home / "memories"
-    if memories_dir.exists():
+    if not (_memory_enabled or _user_profile_enabled):
+        check_info("Built-in memory files disabled by config")
+    elif memories_dir.exists():
         check_ok(f"{_DHH}/memories/ directory exists")
         memory_file = memories_dir / "MEMORY.md"
         user_file = memories_dir / "USER.md"
-        if memory_file.exists():
-            size = len(memory_file.read_text(encoding="utf-8").strip())
-            check_ok(f"MEMORY.md exists ({size} chars)")
-        else:
-            check_info("MEMORY.md not created yet (will be created when the agent first writes a memory)")
-        if user_file.exists():
-            size = len(user_file.read_text(encoding="utf-8").strip())
-            check_ok(f"USER.md exists ({size} chars)")
-        else:
-            check_info("USER.md not created yet (will be created when the agent first writes a memory)")
+        if _memory_enabled:
+            if memory_file.exists():
+                size = len(memory_file.read_text(encoding="utf-8").strip())
+                check_ok(f"MEMORY.md exists ({size} chars)")
+            else:
+                check_info("MEMORY.md not created yet (will be created when the agent first writes a memory)")
+        if _user_profile_enabled:
+            if user_file.exists():
+                size = len(user_file.read_text(encoding="utf-8").strip())
+                check_ok(f"USER.md exists ({size} chars)")
+            else:
+                check_info("USER.md not created yet (will be created when the agent first writes a memory)")
     else:
         check_warn(f"{_DHH}/memories/ not found", "(will be created on first use)")
         if should_fix:
@@ -3243,21 +3282,7 @@ def run_doctor(args):
         check_warn("No GITHUB_TOKEN", f"(60 req/hr rate limit — set in {_DHH}/.env for better rates)")
 
     _section("Memory Provider")
-    _active_memory_provider = ""
-    try:
-        from hermes_cli.config import read_user_config_raw as _read_raw_mem
-        _mem_cfg_path = HERMES_HOME / "config.yaml"
-        if _mem_cfg_path.exists():
-            # Raw-file diagnostic (+ managed overlay below, unchanged).
-            _raw_cfg = _read_raw_mem(_mem_cfg_path)
-            try:
-                from hermes_cli import managed_scope
-                _raw_cfg = managed_scope.apply_managed_overlay(_raw_cfg)
-            except Exception:
-                pass
-            _active_memory_provider = (_raw_cfg.get("memory") or {}).get("provider", "")
-    except Exception:
-        pass
+    _active_memory_provider = _memory_config.get("provider", "")
 
     if not _active_memory_provider:
         check_ok("Built-in memory active", "(no external provider configured — this is fine)")
diff --git a/hermes_cli/dump.py b/hermes_cli/dump.py
index c7399f39f8..fa27044f43 100644
--- a/hermes_cli/dump.py
+++ b/hermes_cli/dump.py
@@ -388,6 +388,7 @@ def run_dump(args):
         ("COMMANDCODE_API_KEY", "commandcode"),
         ("KILOCODE_API_KEY", "kilocode"),
         ("FIRECRAWL_API_KEY", "firecrawl"),
+        ("TAVILY_API_KEY", "tavily"),
         ("KEENABLE_API_KEY", "keenable"),
         ("BROWSERBASE_API_KEY", "browserbase"),
         ("FAL_KEY", "fal"),
diff --git a/hermes_cli/env_loader.py b/hermes_cli/env_loader.py
index f926c6ed4e..a0e1fbfd95 100644
--- a/hermes_cli/env_loader.py
+++ b/hermes_cli/env_loader.py
@@ -51,6 +51,10 @@ _SECRET_SOURCE_VALUES_BY_HOME: dict[str, dict[str, str]] = {}
 _APPLIED_HOMES: set[str] = set()
 _SECRET_SOURCE_CACHE_LOCK = threading.RLock()
 
+# Routed profile homes whose dotenv load was skipped under multiplex, so the
+# skip is logged once per home rather than on every lazy import mid-turn.
+_SCOPED_SKIP_LOGGED: set[str] = set()
+
 
 def _known_hermes_env_keys() -> set[str]:
     """Return the combined set of known Hermes env-var keys.
@@ -483,10 +487,42 @@ def load_hermes_dotenv(
     - callers that only maintain the installation can set
       ``load_external_secrets=False`` to avoid loading optional secret-manager
       dependencies into the process that replaces that same environment.
+    - routed multiplex profile loads hydrate external sources into the
+      profile's private secret snapshot without mutating the shared process
+      environment; unscoped startup loads retain the normal behavior above.
     """
-    loaded: list[Path] = []
-
     home_path = Path(hermes_home or os.getenv("HERMES_HOME", Path.home() / ".hermes"))
+
+    # A multiplex gateway hosts every profile in one process.  While a routed
+    # profile-home override is active, copying that profile's .env into
+    # os.environ would expose its credentials to sibling turns and every
+    # subsequently spawned child.  An unscoped startup load remains process
+    # configuration and must retain the normal loading path.
+    # External secret sources still need their normal refresh path, so resolve
+    # them against the existing profile-local mapping instead of simply
+    # returning before all hydration work.
+    from agent.secret_scope import is_multiplex_active
+    from hermes_constants import get_hermes_home_override
+
+    if is_multiplex_active() and get_hermes_home_override() is not None:
+        home_key = str(home_path.resolve())
+        if home_key not in _SCOPED_SKIP_LOGGED:
+            _SCOPED_SKIP_LOGGED.add(home_key)
+            import logging
+
+            logging.getLogger(__name__).debug(
+                "multiplex: skipping process-global dotenv load for routed "
+                "profile home %s (credentials resolve via the profile scope)",
+                home_path,
+            )
+        if load_external_secrets:
+            from hermes_cli import _early_recovery
+
+            if not _early_recovery._should_skip_external_secret_sources():
+                hydrate_profile_secret_sources(home_path)
+        return []
+
+    loaded: list[Path] = []
     user_env = home_path / ".env"
     project_env_path = Path(project_env) if project_env else None
 
diff --git a/hermes_cli/gateway.py b/hermes_cli/gateway.py
index 2d10dc4d13..6b155487cc 100644
--- a/hermes_cli/gateway.py
+++ b/hermes_cli/gateway.py
@@ -481,6 +481,46 @@ def _probe_loop_tick_socket(
                 pass
 
 
+def _probe_loop_tick_tcp(
+    port: int,
+    timeout: float = 1.0,
+) -> bool | None:
+    """Ping the loop-scheduling witness via TCP loopback (Windows).
+
+    Same protocol and semantics as the Unix socket variant: connect to
+    127.0.0.1:<port> and expect one byte "1" as proof the loop is
+    dispatching. Used on Windows / non-POSIX systems where AF_UNIX is not
+    available in asyncio.
+
+    Returns:
+      True  — the loop answered.
+      False — the port was reachable but did not answer, or refused.
+      None  — invalid port / could not connect for unrelated reasons.
+    """
+    try:
+        port_num = int(port)
+        if port_num <= 0 or port_num > 65535:
+            return None
+    except (TypeError, ValueError):
+        return None
+    sock = None
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(max(float(timeout), 0.0))
+        sock.connect(("127.0.0.1", port_num))
+        return sock.recv(1) == b"1"
+    except Exception:
+        # Connection refused, timeout, transient errors: witness exists
+        # but is silent (or the process is dead and the port is closed).
+        return False
+    finally:
+        if sock is not None:
+            try:
+                sock.close()
+            except Exception:
+                pass
+
+
 def _probe_loop_tick_socket_sustained(
     pid: int,
     home: Path | None,
@@ -488,6 +528,7 @@ def _probe_loop_tick_socket_sustained(
     timeout: float = 1.0,
     strikes: int = 3,
     gap_s: float = 0.2,
+    tcp_port: int | None = None,
 ) -> bool | None:
     """Probe the tick socket until a reply or the sustained-miss budget.
 
@@ -509,7 +550,10 @@ def _probe_loop_tick_socket_sustained(
     """
     total = max(int(strikes), 0)
     for attempt in range(total):
-        result = _probe_loop_tick_socket(pid, home, timeout=timeout)
+        if tcp_port is not None:
+            result = _probe_loop_tick_tcp(tcp_port, timeout=timeout)
+        else:
+            result = _probe_loop_tick_socket(pid, home, timeout=timeout)
         if result is True:
             return True
         if result is None:
@@ -579,14 +623,26 @@ def probe_gateway_loop_liveness(
         # up, or a stale file from a previous PID.  Not evidence of a wedge.
         return GATEWAY_LOOP_UNKNOWN
 
-    witness = _probe_loop_tick_socket(pid, home, timeout=tick_timeout)
+    # Pick the right witness probe: TCP loopback (Windows / non-POSIX)
+    # takes priority if the producer published a port, otherwise fall back
+    # to the AF_UNIX socket (POSIX / legacy).
+    tcp_port = payload.get("loop_tick_tcp_port")
+    try:
+        tcp_port_int = int(tcp_port) if tcp_port is not None else None
+    except (TypeError, ValueError):
+        tcp_port_int = None
+
+    if tcp_port_int is not None and tcp_port_int > 0:
+        witness = _probe_loop_tick_tcp(tcp_port_int, timeout=tick_timeout)
+        tick_armed = True
+    else:
+        witness = _probe_loop_tick_socket(pid, home, timeout=tick_timeout)
+        tick_armed = payload.get("loop_tick_socket", _LOOP_TICK_ABSENT)
     if witness is True:
         # The loop answered a ping — it is dispatching right now. A stale
         # heartbeat file is a stalled write or a saturated executor, not a
         # wedge (#90502).
         return GATEWAY_LOOP_ALIVE
-
-    tick_armed = payload.get("loop_tick_socket", _LOOP_TICK_ABSENT)
     age = time.time() - mtime
     if age <= stale_budget:
         if witness is False:
@@ -620,6 +676,7 @@ def probe_gateway_loop_liveness(
             timeout=tick_timeout,
             strikes=tick_strikes - 1,
             gap_s=tick_gap_s,
+            tcp_port=tcp_port_int,
         )
         if sustained is False:
             # Both witnesses agree, sustained: the loop did not schedule for
@@ -1344,6 +1401,7 @@ def _spawn_gateway_restart_watcher(old_pid: int, run_argv: list[str]) -> bool:
         import sys
         import time
         from hermes_cli._subprocess_compat import (
+            _WINDOWS_GATEWAY_BREAKAWAY_ENV,
             windows_detach_flags,
             windows_detach_flags_without_breakaway,
         )
@@ -1361,6 +1419,24 @@ def _spawn_gateway_restart_watcher(old_pid: int, run_argv: list[str]) -> bool:
                 break
             time.sleep(0.2)
 
+        # Route stray stdout/stderr from the respawned gateway to the same
+        # sidecar log _spawn_detached uses.  DEVNULL here meant a gateway
+        # killed moments after respawn (e.g. parent Job Object teardown when
+        # breakaway is denied, #48820 4th repro) left ZERO trace anywhere —
+        # no gateway.log line, no exit-diag record, nothing.  Best-effort:
+        # fall back to DEVNULL when the log dir is unavailable.
+        _stdio_target = subprocess.DEVNULL
+        _stdio_fh = None
+        try:
+            from hermes_cli.config import get_hermes_home
+            from pathlib import Path
+            _log_dir = Path(get_hermes_home()) / "logs"
+            _log_dir.mkdir(parents=True, exist_ok=True)
+            _stdio_fh = open(_log_dir / "gateway-stdio.log", "ab", buffering=0)
+            _stdio_target = _stdio_fh
+        except Exception:
+            pass
+
         # Platform-appropriate detach for the respawned gateway.  On POSIX
         # start_new_session=True maps to os.setsid; on Windows we need
         # explicit creationflags because start_new_session is a no-op there.
@@ -1369,8 +1445,8 @@ def _spawn_gateway_restart_watcher(old_pid: int, run_argv: list[str]) -> bool:
         # without breakaway the respawned gateway would die when that job
         # tears down. See _subprocess_compat.windows_detach_flags().
         _popen_kwargs = {{
-            "stdout": subprocess.DEVNULL,
-            "stderr": subprocess.DEVNULL,
+            "stdout": _stdio_target,
+            "stderr": _stdio_target,
         }}
         # Anchor the respawned gateway at the stable working dir and overlay
         # the env (VIRTUAL_ENV / PYTHONPATH / HERMES_HOME) the windowless
@@ -1378,23 +1454,45 @@ def _spawn_gateway_restart_watcher(old_pid: int, run_argv: list[str]) -> bool:
         # the venv python resolves imports without help.
         if _respawn_cwd:
             _popen_kwargs["cwd"] = _respawn_cwd
-        if _respawn_env_overlay:
-            _popen_kwargs["env"] = {{**os.environ, **_respawn_env_overlay}}
-        if sys.platform == "win32":
-            try:
-                _popen_kwargs["creationflags"] = windows_detach_flags()
+        _base_env = {{**os.environ, **_respawn_env_overlay}}
+        try:
+            if sys.platform == "win32":
+                try:
+                    _popen_kwargs["creationflags"] = windows_detach_flags()
+                    # Stamp the breakaway state exactly like the canonical
+                    # gateway_windows._spawn_detached, so the respawned
+                    # gateway's exit-diag / lifecycle records show whether it
+                    # escaped the parent Job Object (#48820 4th repro:
+                    # without the stamp, a job-teardown kill was
+                    # indistinguishable from any other silent death).
+                    _popen_kwargs["env"] = {{
+                        **_base_env, _WINDOWS_GATEWAY_BREAKAWAY_ENV: "1",
+                    }}
+                    subprocess.Popen(cmd, **_popen_kwargs)
+                except OSError:
+                    # CREATE_BREAKAWAY_FROM_JOB can be rejected with
+                    # ERROR_ACCESS_DENIED when the parent's job object refuses
+                    # breakaway. Retry without it — DETACHED_PROCESS et al.
+                    # alone are enough in most setups. Mirrors the canonical
+                    # fallback in gateway_windows._spawn_detached.
+                    _popen_kwargs["creationflags"] = (
+                        windows_detach_flags_without_breakaway()
+                    )
+                    _popen_kwargs["env"] = {{
+                        **_base_env, _WINDOWS_GATEWAY_BREAKAWAY_ENV: "0",
+                    }}
+                    subprocess.Popen(cmd, **_popen_kwargs)
+            else:
+                if _respawn_env_overlay:
+                    _popen_kwargs["env"] = _base_env
+                _popen_kwargs["start_new_session"] = True
                 subprocess.Popen(cmd, **_popen_kwargs)
-            except OSError:
-                # CREATE_BREAKAWAY_FROM_JOB can be rejected with
-                # ERROR_ACCESS_DENIED when the parent's job object refuses
-                # breakaway. Retry without it — DETACHED_PROCESS et al.
-                # alone are enough in most setups. Mirrors the canonical
-                # fallback in gateway_windows._spawn_detached.
-                _popen_kwargs["creationflags"] = windows_detach_flags_without_breakaway()
-                subprocess.Popen(cmd, **_popen_kwargs)
-        else:
-            _popen_kwargs["start_new_session"] = True
-            subprocess.Popen(cmd, **_popen_kwargs)
+        finally:
+            if _stdio_fh is not None:
+                try:
+                    _stdio_fh.close()
+                except OSError:
+                    pass
         """
     ).strip().format(
         respawn_cwd_literal=respawn_cwd_literal,
@@ -2121,14 +2219,17 @@ def _gateway_list() -> None:
             label += " (current)"
         parts = [f"  {marker} {label:<24s}"]
         if prof.gateway_running:
+            pid = None
             try:
                 from gateway.status import get_running_pid
 
                 pid = get_running_pid(prof.path / "gateway.pid", cleanup_stale=False)
-                if pid:
-                    parts.append(f"PID {pid}")
             except Exception:
                 pass
+            if pid:
+                parts.append(f"PID {pid}")
+            elif named_profile_served_by_running_multiplexer(prof.name):
+                parts.append("served by the default multiplexer")
         else:
             parts.append("not running")
         print(" — ".join(parts))
@@ -6178,18 +6279,20 @@ def _running_under_gateway_supervisor() -> bool:
     return is_gateway_supervisor_process()
 
 
-def named_profile_served_by_running_multiplexer() -> bool:
+def named_profile_served_by_running_multiplexer(profile_name: str | None = None) -> bool:
     """True when a live default multiplexer already ticks this named profile.
 
-    Shared by the named-profile start guard and cron liveness: a satellite
-    profile has no gateway.pid of its own, but the default multiplexer's
-    ticker still fires its jobs (#97120).
+    Shared by the named-profile start guard, cron liveness, and the
+    ``gateway status`` / ``gateway list`` / ``profile list`` reports: a
+    satellite profile has no gateway.pid of its own, but the default
+    multiplexer's ticker still fires its jobs (#97120) and serves its
+    platforms. ``profile_name`` defaults to the current HERMES_HOME profile.
     """
     try:
-        suffix = _profile_suffix()
+        suffix = profile_name if profile_name is not None else _profile_suffix()
     except Exception:
         return False
-    if not suffix:
+    if not suffix or suffix == "default":
         return False
 
     try:
@@ -8973,7 +9076,12 @@ def _gateway_command_inner(args):
             from hermes_cli import gateway_windows
 
             _windows_service_installed = gateway_windows.is_installed()
-        if supports_systemd_services() and (
+        if not snapshot.running and named_profile_served_by_running_multiplexer():
+            # Satellite profile: no gateway.pid / service of its own, but the
+            # default multiplexer is the live inbound process for it.
+            print("✓ Gateway is running via the default-profile multiplexer")
+            print("  Manage it from the default profile: hermes gateway status")
+        elif supports_systemd_services() and (
             get_systemd_unit_path(system=False).exists()
             or get_systemd_unit_path(system=True).exists()
         ):
diff --git a/hermes_cli/gateway_windows.py b/hermes_cli/gateway_windows.py
index b2ddf9fea6..3f86247613 100644
--- a/hermes_cli/gateway_windows.py
+++ b/hermes_cli/gateway_windows.py
@@ -1187,7 +1187,8 @@ def install(
 
 
 def _confirm_gateway_stable(
-    initial_pids: list[int], confirm_s: float, interval_s: float
+    initial_pids: list[int], confirm_s: float, interval_s: float,
+    all_profiles: bool = False,
 ) -> list[int]:
     """Re-check a freshly detected gateway for ``confirm_s`` seconds.
 
@@ -1206,7 +1207,7 @@ def _confirm_gateway_stable(
     confirm_deadline = time.monotonic() + confirm_s
     while time.monotonic() < confirm_deadline:
         time.sleep(interval_s)
-        pids = list(find_gateway_pids())
+        pids = list(find_gateway_pids(all_profiles=all_profiles))
         if not pids:
             return []
     return pids
@@ -1216,6 +1217,7 @@ def _wait_for_gateway_ready(
     timeout_s: float = 6.0,
     interval_s: float = 0.4,
     confirm_s: float = 2.0,
+    all_profiles: bool = False,
 ) -> list[int]:
     """Poll for a live gateway process for up to ``timeout_s`` seconds.
 
@@ -1225,6 +1227,10 @@ def _wait_for_gateway_ready(
     after spawn must not earn a ✓, #91675). If it vanishes during the
     confirmation window, polling resumes until the deadline.
 
+    ``all_profiles`` widens the scan across every profile's gateway — the
+    post-update resume path relaunches the whole fleet, not just the active
+    profile.
+
     Returns the list of PIDs found. Empty list means nothing (stable) came
     up in time — the caller should surface that to the user as a failed
     start.
@@ -1233,9 +1239,11 @@ def _wait_for_gateway_ready(
 
     deadline = time.monotonic() + timeout_s
     while time.monotonic() < deadline:
-        pids = list(find_gateway_pids())
+        pids = list(find_gateway_pids(all_profiles=all_profiles))
         if pids:
-            confirmed = _confirm_gateway_stable(pids, confirm_s, interval_s)
+            confirmed = _confirm_gateway_stable(
+                pids, confirm_s, interval_s, all_profiles=all_profiles
+            )
             if confirmed:
                 return confirmed
             continue  # died during confirmation — keep polling until deadline
diff --git a/hermes_cli/goals.py b/hermes_cli/goals.py
index df1b86df44..74acc22c80 100644
--- a/hermes_cli/goals.py
+++ b/hermes_cli/goals.py
@@ -153,12 +153,22 @@ JUDGE_SYSTEM_PROMPT = (
     "You are a strict judge evaluating whether an autonomous agent has "
     "achieved a user's stated goal. You receive the goal text, the agent's "
     "most recent response, and — when present — a list of background "
-    "processes the agent has running. Decide one of three verdicts.\n\n"
+    "processes the agent has running. Decide one of four verdicts.\n\n"
     "DONE — the goal is fully satisfied:\n"
     "- The response explicitly confirms the goal was completed, OR\n"
-    "- The response clearly shows the final deliverable was produced, OR\n"
-    "- The response explains the goal is unachievable / blocked / needs "
-    "user input (treat this as DONE with reason describing the block).\n\n"
+    "- The response clearly shows the final deliverable was produced.\n"
+    "DONE requires the deliverable to actually exist. If the response only "
+    "explains why the goal cannot be reached, the verdict is BLOCKED, not "
+    "DONE.\n\n"
+    "BLOCKED — the goal cannot be satisfied as stated:\n"
+    "- The response explains the goal is genuinely unachievable (impossible, "
+    "out of scope, no valid path to the deliverable), or refuses to "
+    "fabricate a deliverable that cannot exist, OR\n"
+    "- The response explains progress is blocked and the next step needs "
+    "user input to proceed.\n"
+    "Return BLOCKED with the reason describing what is blocking. BLOCKED is "
+    "a refusal, not a completion — never return BLOCKED for a goal that "
+    "was achieved.\n\n"
     "WAIT — the goal is NOT done, but the next step is to wait for async "
     "work to finish rather than act again. Choose this ONLY when the agent's "
     "progress is genuinely gated on something running on its own:\n"
@@ -180,6 +190,7 @@ JUDGE_SYSTEM_PROMPT = (
     "take right now. This is the default when in doubt.\n\n"
     "Reply ONLY with a single JSON object on one line. Shapes:\n"
     '{"verdict": "done", "reason": "<one sentence>"}\n'
+    '{"verdict": "blocked", "reason": "<one sentence>"}\n'
     '{"verdict": "continue", "reason": "<one sentence>"}\n'
     '{"verdict": "wait", "wait_on_session": "<id>", "reason": "<one sentence>"}\n'
     '{"verdict": "wait", "wait_on_pid": <int>, "reason": "<one sentence>"}\n'
@@ -203,7 +214,7 @@ JUDGE_USER_PROMPT_TEMPLATE = (
     "Agent's most recent response:\n{response}\n\n"
     "{background_block}"
     "Current time: {current_time}\n\n"
-    "Is the goal satisfied — done, continue, or wait?"
+    "Is the goal satisfied — done, blocked, continue, or wait?"
 )
 
 # Used when the user has added /subgoal criteria. The judge must
@@ -247,11 +258,11 @@ JUDGE_USER_PROMPT_WITH_CONTRACT_TEMPLATE = (
     "process to satisfy the Verification criterion (e.g. CI is the "
     "verification and it's still running), return WAIT on that process "
     "instead of re-poking — re-poking now would be pure busy-work.\n"
-    "- If the response explains the work is blocked / unachievable / needs "
-    "user input (e.g. the stated Stop condition was hit), treat it as DONE "
-    "with the reason describing the block.\n"
+    "- If the response explains the work is genuinely unachievable or hits "
+    "the stated Stop condition and needs user input, the goal is NOT done — "
+    "return BLOCKED with the reason describing the block.\n"
     "- Otherwise the goal is NOT done — CONTINUE.\n\n"
-    "Is the goal satisfied per its completion contract — done, continue, or wait?"
+    "Is the goal satisfied per its completion contract — done, blocked, continue, or wait?"
 )
 
 
@@ -553,7 +564,7 @@ class GoalState:
     max_turns: int = DEFAULT_MAX_TURNS
     created_at: float = 0.0
     last_turn_at: float = 0.0
-    last_verdict: Optional[str] = None        # "done" | "continue" | "skipped"
+    last_verdict: Optional[str] = None        # "done" | "blocked" | "continue" | "wait" | "skipped"
     last_reason: Optional[str] = None
     paused_reason: Optional[str] = None       # why we auto-paused (budget, etc.)
     consecutive_parse_failures: int = 0       # judge-output parse failures in a row
@@ -1027,7 +1038,7 @@ def _parse_judge_response(raw: str) -> Tuple[str, str, bool, Optional[Dict[str,
     """Parse the judge's reply. Fail-open on unusable output.
 
     Returns ``(verdict, reason, parse_failed, wait_directive)`` where:
-      - ``verdict`` is ``"done"``, ``"continue"``, or ``"wait"``.
+      - ``verdict`` is ``"done"``, ``"blocked"``, ``"continue"``, or ``"wait"``.
       - ``parse_failed`` is True when the judge returned output that couldn't
         be interpreted as the expected JSON verdict (empty body, prose,
         malformed JSON). Callers use it to auto-pause after N consecutive
@@ -1084,7 +1095,7 @@ def _parse_judge_response(raw: str) -> Tuple[str, str, bool, Optional[Dict[str,
             done = bool(done_val)
         verdict = "done" if done else "continue"
 
-    if verdict not in {"done", "continue", "wait"}:
+    if verdict not in {"done", "blocked", "continue", "wait"}:
         verdict = "continue"
 
     if verdict != "wait":
@@ -1178,7 +1189,7 @@ def judge_goal(
     """Ask the auxiliary model whether the goal is satisfied.
 
     Returns ``(verdict, reason, parse_failed, wait_directive, transport_failed)`` where verdict
-    is ``"done"``, ``"continue"``, ``"wait"``, or ``"skipped"`` (when the
+    is ``"done"``, ``"blocked"``, ``"continue"``, ``"wait"``, or ``"skipped"`` (when the
     judge couldn't be reached). ``wait_directive`` is set only for ``"wait"``
     (``{"pid": int}`` or ``{"seconds": int}``); ``None`` otherwise.
 
@@ -1882,7 +1893,7 @@ class GoalManager:
           - ``status``: current goal status after update
           - ``should_continue``: bool — caller should fire another turn
           - ``continuation_prompt``: str or None
-          - ``verdict``: "done" | "continue" | "wait" | "skipped" | "inactive"
+          - ``verdict``: "done" | "blocked" | "continue" | "wait" | "skipped" | "inactive"
           - ``reason``: str
           - ``message``: user-visible one-liner to print/send
         """
@@ -1999,6 +2010,28 @@ class GoalManager:
                 "message": f"⏳ Goal parked (judge) — waiting on {tgt}: {reason}",
             }
 
+        # BLOCKED verdict: the judge ruled the goal genuinely cannot be
+        # satisfied as stated (impossible, out of scope, needs user input).
+        # This is NOT done — don't keep burning turns on an unachievable goal
+        # and don't wave it through as complete (#100954). Pause so the user
+        # sees the judge's reason and can re-scope (/goal set) or override
+        # (/goal resume).
+        if verdict == "blocked":
+            state.status = "paused"
+            state.paused_reason = f"judged unachievable: {reason}"
+            save_goal(self.session_id, state)
+            return {
+                "status": "paused",
+                "should_continue": False,
+                "continuation_prompt": None,
+                "verdict": "blocked",
+                "reason": reason,
+                "message": (
+                    f"🚫 Goal judged unachievable — paused: {reason} "
+                    "Re-scope with /goal set, or override with /goal resume."
+                ),
+            }
+
         if verdict == "done":
             state.status = "done"
             save_goal(self.session_id, state)
@@ -2202,7 +2235,7 @@ def run_kanban_goal_loop(
     Returns a decision dict: ``{"outcome", "turns_used", "reason"}`` where
     outcome is one of ``"completed_by_worker"``, ``"review_requested_by_worker"``,
     ``"changes_requested_by_reviewer"``, ``"blocked_budget"``,
-    ``"blocked_by_worker"``, or ``"stopped"``.
+    ``"blocked_unachievable"``, ``"blocked_by_worker"``, or ``"stopped"``.
     """
 
     def _log(msg: str) -> None:
@@ -2258,6 +2291,22 @@ def run_kanban_goal_loop(
             verdict = "continue"
         _log(f"kanban goal loop: turn {turns_used}/{max_turns} verdict={verdict} reason={_truncate(reason, 120)}")
 
+        if verdict == "blocked":
+            # The judge ruled the goal cannot be satisfied at all — this is
+            # NOT done (#100954). Block the card now with the judge's reason
+            # instead of spending the remaining turns re-poking an impossible
+            # goal, and never let it land in done.
+            _log(f"kanban goal loop: task {task_id} judged unachievable; blocking")
+            try:
+                block_fn(f"Goal-mode judge ruled the goal unachievable: {reason}")
+            except Exception as exc:
+                _log(f"kanban goal loop: block_fn failed ({exc})")
+            return {
+                "outcome": "blocked_unachievable",
+                "turns_used": turns_used,
+                "reason": f"judge verdict blocked: {reason}",
+            }
+
         if verdict == "done":
             if nudged_to_finalize:
                 # Already asked once to call kanban_complete and it still
diff --git a/hermes_cli/gui_uninstall.py b/hermes_cli/gui_uninstall.py
index dc0d991ce3..90c8d5f549 100644
--- a/hermes_cli/gui_uninstall.py
+++ b/hermes_cli/gui_uninstall.py
@@ -156,10 +156,9 @@ def packaged_gui_app_paths() -> "list[Path]":
             data_base / "applications" / "Hermes.desktop",
             data_base / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png",
         ]
-        # Fixed-size hicolor dirs: the icon is copied at its native size
-        # (read from the PNG header), so sweep the standard ones plus the
-        # 1024x1024 dir the shipped asset lands in.
-        for size in ("256x256", "512x512", "1024x1024"):
+        # Fixed-size hicolor dirs the installer may have written (resized
+        # panel sizes plus leftover native-size copies from older builds).
+        for size in ("24x24", "32x32", "48x48", "256x256", "512x512", "1024x1024"):
             paths.append(data_base / "icons" / "hicolor" / size / "apps" / "hermes.png")
     return paths
 
diff --git a/hermes_cli/inventory.py b/hermes_cli/inventory.py
index 3f2de0820b..f9b0de4d90 100644
--- a/hermes_cli/inventory.py
+++ b/hermes_cli/inventory.py
@@ -206,6 +206,31 @@ def build_models_payload(
         excluded_providers=ctx.excluded_providers or [],
     )
 
+    # Managed local runtime: staged GGUFs are selectable like any provider's
+    # models. list_authenticated_providers can't know about them (no
+    # credential, no custom_providers entry — the credential is
+    # reachability), so inject the row here where every picker surface
+    # inherits it. Present whenever models are staged; picking one routes
+    # through the llamacpp alias -> managed/detected server resolution.
+    local_row = _local_runtime_row(ctx)
+    if local_row is not None:
+        rows = [r for r in rows if str(r.get("slug", "")).lower() != "llamacpp"]
+        rows.append(local_row)
+        # A live session on the managed server reports provider "custom"
+        # (the resolution seam's generic label for a raw base_url), which
+        # would otherwise materialize a duplicate "Custom endpoint" row
+        # carrying the same staged models and stealing the checkmark. The
+        # Local row owns the managed server's identity — drop custom rows
+        # that point at the managed endpoint.
+        if local_row.get("is_current"):
+            def _is_managed_custom(row: dict) -> bool:
+                if str(row.get("slug", "")).lower() != "custom":
+                    return False
+                models = {str(m) for m in (row.get("models") or [])}
+                return bool(models) and models <= set(local_row["models"])
+
+            rows = [r for r in rows if not _is_managed_custom(r)]
+
     moa_row = _moa_provider_row(ctx.current_provider)
     if moa_row is not None:
         rows = [moa_row] + [r for r in rows if str(r.get("slug", "")).lower() != "moa"]
@@ -217,9 +242,15 @@ def build_models_payload(
         # has lost its credential, list_authenticated_providers() omits it;
         # keep that one row visible so the UI can show the saved selection and
         # a re-auth affordance instead of appearing to jump to another provider.
-        rows = list(rows) + _append_unconfigured_rows(
-            rows, ctx, current_only=True
-        )
+        # Exception: a "custom" current whose endpoint is the managed local
+        # server is already represented (with the checkmark) by the Local row
+        # — the skeleton would resurrect the duplicate the dedup above removed.
+        _local_owns_current = bool(local_row and local_row.get("is_current")
+                                   and (ctx.current_provider or "").lower() == "custom")
+        if not _local_owns_current:
+            rows = list(rows) + _append_unconfigured_rows(
+                rows, ctx, current_only=True
+            )
 
     # --- Deduplicate: remove models from aggregators that overlap with
     # user-defined providers.  When a local proxy (e.g. litellm-proxy)
@@ -735,6 +766,15 @@ def _filter_explicit_provider_rows(rows: list[dict], ctx: ConfigContext) -> list
         if current_slug and slug == current_slug:
             kept.append(row)
             continue
+        if row.get("source") == "local-runtime":
+            # Managed local models are explicit configuration by existence:
+            # the user downloaded gigabytes into the machine-scoped models
+            # dir. There is deliberately no config credential to find
+            # (credential is reachability), so without this clause the row
+            # only survives on the profile where Use was last clicked —
+            # every other profile loses local models from its picker.
+            kept.append(row)
+            continue
         if slug == "moa":
             # MoA is a virtual routing mode, not an independently configured
             # provider. Hide it from explicit-only pickers unless it is the
@@ -758,11 +798,35 @@ def _filter_explicit_provider_rows(rows: list[dict], ctx: ConfigContext) -> list
             # just accepted those same credentials when building it.
             kept.append(row)
             continue
+        if _external_process_signed_in(slug):
+            # External-process providers (copilot-acp) authenticate through
+            # their own CLI (`copilot login`), which — like the Anthropic
+            # OAuth case above — leaves no trace in active_provider,
+            # model.provider, or env vars. Verified CLI credentials are a
+            # deliberate sign-in; without this the desktop picker drops the
+            # row the picker-discovery side just accepted.
+            kept.append(row)
+            continue
         if is_provider_explicitly_configured(slug):
             kept.append(row)
     return kept
 
 
+def _external_process_signed_in(slug: str) -> bool:
+    """True when an external-process provider has verified CLI credentials."""
+    try:
+        from hermes_cli.auth import (
+            PROVIDER_REGISTRY,
+            get_external_process_provider_status,
+        )
+        pconfig = PROVIDER_REGISTRY.get(slug)
+        if not pconfig or pconfig.auth_type != "external_process":
+            return False
+        return bool(get_external_process_provider_status(slug).get("auth_verified"))
+    except Exception:
+        return False
+
+
 def _provider_is_keyless(slug: str) -> bool:
     """True when the provider's Hermes overlay declares it keyless."""
     try:
@@ -986,6 +1050,56 @@ def _apply_pricing(
                 row["unavailable_models"] = []
 
 
+def _local_runtime_row(ctx: "ConfigContext") -> dict | None:
+    """Build the ``llamacpp`` provider row from staged local models.
+
+    Present whenever GGUFs are staged in the managed models directory —
+    downloaded models must be selectable even before the server is running
+    (selection starts it via the runtime_provider seam / activate flow).
+    Returns ``None`` when nothing is staged.
+    """
+    try:
+        from hermes_cli.local_runtime.bootstrap import staged_model_ids
+
+        staged = staged_model_ids()
+        if not staged:
+            return None
+        current = (ctx.current_provider or "").strip().lower() in (
+            "llamacpp", "llama.cpp", "llama-cpp")
+        if not current:
+            # A LIVE session on the managed server reports provider "custom"
+            # (the resolution seam's label) with the managed base_url. Match
+            # on the endpoint so the picker still marks this row current —
+            # otherwise the session the user is chatting in shows no
+            # selection.
+            try:
+                from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+                managed = _state_endpoint()
+                current = bool(
+                    managed
+                    and (ctx.current_base_url or "").strip().rstrip("/")
+                    == managed["base_url"].rstrip("/"))
+            except Exception:
+                current = False
+        return {
+            "slug": "llamacpp",
+            # Bare "Local" everywhere user-facing: the engine name is an
+            # implementation detail (the pane brands this "Local models").
+            "name": "Local",
+            "is_current": current,
+            "is_user_defined": False,
+            "models": staged,
+            "total_models": len(staged),
+            "source": "local-runtime",
+            "authenticated": True,       # the credential is reachability
+            "auth_type": "local",
+            "warning": None,
+        }
+    except Exception:
+        return None
+
+
 def _moa_provider_row(current_provider: str = "") -> dict | None:
     """Build the virtual ``moa`` provider row for model pickers.
 
diff --git a/hermes_cli/kanban.py b/hermes_cli/kanban.py
index e23eedc7fa..7037941a46 100644
--- a/hermes_cli/kanban.py
+++ b/hermes_cli/kanban.py
@@ -2311,18 +2311,23 @@ def _worker_run_id_for(task_id: str) -> Optional[int]:
         return None
 
 
-def _goal_mode_handoff_rejection(task: Optional[kb.Task], evidence: str) -> Optional[str]:
-    """Apply the goal judge to every terminal worker handoff, including review."""
+def _goal_mode_handoff_rejection(task: Optional[kb.Task], evidence: str):
+    """Apply the goal judge to every terminal worker handoff, including review.
+
+    Returns ``(verdict, reason_or_None)`` — ``"done"`` allows the handoff;
+    ``"blocked"`` means the judge ruled the goal unachievable (#100954);
+    ``"continue"``/``"wait"`` reject with the judge's reason.
+    """
     if task is None or not task.goal_mode:
-        return None
+        return ("done", None)
     try:
         from agent.auxiliary_client import get_text_auxiliary_client
 
         client, model = get_text_auxiliary_client("goal_judge")
     except Exception:
-        return None
+        return ("done", None)
     if client is None or not model:
-        return None
+        return ("done", None)
 
     from hermes_cli.goals import judge_goal
 
@@ -2341,7 +2346,7 @@ def _goal_mode_handoff_rejection(task: Optional[kb.Task], evidence: str) -> Opti
             judge_exc,
             exc_info=True,
         )
-    return reason if verdict != "done" else None
+    return (verdict, None if verdict == "done" else reason)
 
 
 def _cmd_complete(args: argparse.Namespace) -> int:
@@ -2379,10 +2384,20 @@ def _cmd_complete(args: argparse.Namespace) -> int:
             # to every terminal handoff so request-review cannot bypass the
             # acceptance contract that protects complete.
             task = kb.get_task(conn, tid)
-            rejection = _goal_mode_handoff_rejection(
+            gate_verdict, rejection = _goal_mode_handoff_rejection(
                 task,
                 (summary or args.result or "").strip(),
             )
+            if gate_verdict == "blocked":
+                print(
+                    f"kanban: goal completion of {tid} rejected: judge ruled "
+                    f"the goal unachievable — {rejection}. Re-scope with "
+                    f"kanban edit, or record the block with kanban block "
+                    f"instead of completing.",
+                    file=sys.stderr,
+                )
+                failed.append(tid)
+                continue
             if rejection is not None:
                 print(
                     f"kanban: goal completion of {tid} rejected by judge: {rejection}. "
@@ -2532,10 +2547,18 @@ def _cmd_request_review(args: argparse.Namespace) -> int:
             return 2
     reviewer = getattr(args, "reviewer", None)
     with kb.connect_closing() as conn:
-        rejection = _goal_mode_handoff_rejection(
+        gate_verdict, rejection = _goal_mode_handoff_rejection(
             kb.get_task(conn, tid),
             summary or "",
         )
+        if gate_verdict == "blocked":
+            print(
+                f"kanban: goal review handoff of {tid} rejected: judge ruled "
+                f"the goal unachievable — {rejection}. Record the block with "
+                f"kanban block instead of requesting review.",
+                file=sys.stderr,
+            )
+            return 1
         if rejection is not None:
             print(
                 f"kanban: goal review handoff of {tid} rejected by judge: "
diff --git a/hermes_cli/kanban_db.py b/hermes_cli/kanban_db.py
index cb3863466b..198669792e 100644
--- a/hermes_cli/kanban_db.py
+++ b/hermes_cli/kanban_db.py
@@ -11685,8 +11685,8 @@ def purge_stale_done_notify_subs(
     *,
     max_age_days: int = 30,
 ) -> int:
-    """Delete notify subscriptions whose task has sat in ``done`` untouched
-    for longer than ``max_age_days``.
+    """Delete notify subscriptions whose task has sat in ``done`` or
+    ``blocked`` untouched for longer than ``max_age_days``.
 
     The notifier keeps subscriptions alive through ``done`` because a
     completed task can be reopened (review corrections, continuation) and
@@ -11695,7 +11695,10 @@ def purge_stale_done_notify_subs(
     subscription rows forever — each one scanned every notifier tick.
     This GC bounds that: a task that has been ``done`` with no new events
     for the retention window is treated as settled and its subscriptions
-    are purged. Age is measured from the task's most recent event
+    are purged. ``blocked`` tasks (circuit-breaker trips, dead workers)
+    are reaped on the same clock — they are abandoned, not idle, unlike a
+    ``backlog``/``ready`` card that is merely waiting for pickup (#100955).
+    Age is measured from the task's most recent event
     (falling back to ``completed_at`` then ``created_at``), so ANY
     activity — including a reopen, which also moves the task off
     ``done`` — resets or exempts it.
@@ -11714,7 +11717,7 @@ def purge_stale_done_notify_subs(
         cur = conn.execute(
             "DELETE FROM kanban_notify_subs WHERE task_id IN ("
             " SELECT t.id FROM tasks t"
-            " WHERE t.status = 'done'"
+            " WHERE t.status IN ('done', 'blocked')"
             " AND COALESCE("
             "  (SELECT MAX(e.created_at) FROM task_events e"
             "   WHERE e.task_id = t.id),"
diff --git a/hermes_cli/linux_desktop_entry.py b/hermes_cli/linux_desktop_entry.py
index 3a95229e76..e33675590e 100644
--- a/hermes_cli/linux_desktop_entry.py
+++ b/hermes_cli/linux_desktop_entry.py
@@ -15,9 +15,9 @@ Two values must be absolute for the entry to work:
     checkout. Do not copy the icon: ``Exec`` already depends on that tree.
 
 Cache refresh is best-effort and tool-gated: ``update-desktop-database``
-for the freedesktop menu cache, and ``kbuildsycoca6``/``kbuildsycoca5``
-for Plasma. Run each tool only when it exists. A missing tool is not an
-error.
+for the freedesktop menu cache, ``gtk-update-icon-cache`` for the user
+hicolor tree, and ``kbuildsycoca6``/``kbuildsycoca5`` for Plasma. Run
+each tool only when it exists. A missing tool is not an error.
 
 Import-light and side-effect-free at import time: the uninstaller uses
 this without loading the full CLI.
@@ -25,6 +25,7 @@ this without loading the full CLI.
 
 from __future__ import annotations
 
+import io
 import os
 import shutil
 import struct
@@ -624,31 +625,135 @@ def _run_quiet(cmd: "list[str]") -> bool:
     return result.returncode == 0
 
 
+# Sizes a typical hicolor ``index.theme`` actually lists. ``scalable`` is
+# SVG-only — a raster PNG there is what Cinnamon's panel draws as a
+# mangled low-res blob. The shipped desktop asset is 1024×1024, which is
+# also not an indexed dir name, so a copy-only fallback lands in ``256x256``.
+_HICOLOR_INDEXED_SIZES = (16, 22, 24, 32, 36, 48, 64, 72, 96, 128, 192, 256, 512)
+# Cinnamon's panel is ~24–32px. Write these so the theme loads an exact
+# raster instead of downscaling a 1024px PNG at lookup time.
+_HICOLOR_INSTALL_SIZES = (24, 32, 48, 256)
+
+
+def _png_dimensions(raw: bytes) -> Optional[tuple[int, int]]:
+    """Return ``(width, height)`` from a PNG IHDR, or ``None`` if unreadable."""
+    if len(raw) >= 24 and raw[:8] == b"\x89PNG\r\n\x1a\n" and raw[12:16] == b"IHDR":
+        return struct.unpack(">II", raw[16:24])
+    return None
+
+
+def _hicolor_subdir(dimensions: Optional[tuple[int, int]]) -> str:
+    """Pick a fixed-size hicolor dir the theme indexes. Never ``scalable``."""
+    if dimensions is None:
+        return "256x256"
+    width, height = dimensions
+    if width != height or width <= 0:
+        return "256x256"
+    if width in _HICOLOR_INDEXED_SIZES:
+        return f"{width}x{width}"
+    if width > 256:
+        return "256x256"
+    nearest = min(_HICOLOR_INDEXED_SIZES, key=lambda size: abs(size - width))
+    return f"{nearest}x{nearest}"
+
+
+def _hicolor_icon_dest(subdir: str) -> Path:
+    return _xdg_data_home() / "icons" / "hicolor" / subdir / "apps" / "hermes.png"
+
+
+def _remove_stale_scalable_icon() -> bool:
+    """Drop a leftover PNG from ``scalable/`` (the pre-fix install path).
+
+    Return True when a file was removed so the caller can refresh the
+    icon cache. A missing file is not an error.
+    """
+    stale = _hicolor_icon_dest("scalable")
+    try:
+        if stale.is_file():
+            stale.unlink()
+            return True
+    except OSError:
+        return False
+    return False
+
+
+def _refresh_hicolor_cache() -> None:
+    """Best-effort reindex of the user hicolor tree. Missing tool is fine."""
+    hicolor = _xdg_data_home() / "icons" / "hicolor"
+    for tool in ("gtk-update-icon-cache", "gtk4-update-icon-cache"):
+        resolved = shutil.which(tool)
+        if resolved:
+            _run_quiet([resolved, "-f", "-t", str(hicolor)])
+            return
+
+
+def _resized_hicolor_pngs(raw: bytes) -> Optional[dict[str, bytes]]:
+    """Lanczos-resize *raw* to each panel size. ``None`` when it will not decode.
+
+    Pillow is a core dep but this module stays import-light: the import is
+    local so the uninstaller does not pay it. A truncated/fake PNG (tests,
+    interrupted copy) returns None and the caller falls back to a copy.
+    """
+    try:
+        from PIL import Image
+    except ImportError:
+        return None
+    try:
+        with Image.open(io.BytesIO(raw)) as im:
+            rgba = im.convert("RGBA")
+            out: dict[str, bytes] = {}
+            for size in _HICOLOR_INSTALL_SIZES:
+                resized = rgba.resize((size, size), Image.Resampling.LANCZOS)
+                buf = io.BytesIO()
+                resized.save(buf, format="PNG")
+                out[f"{size}x{size}"] = buf.getvalue()
+            return out
+    except (OSError, ValueError):
+        return None
+
+
+def _write_hicolor_pngs(files: dict[str, bytes]) -> bool:
+    """Write *files* keyed by hicolor size dir. Return True if any file changed."""
+    wrote = False
+    for subdir, data in files.items():
+        dest = _hicolor_icon_dest(subdir)
+        if dest.is_file() and dest.read_bytes() == data:
+            continue
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_bytes(data)
+        wrote = True
+    return wrote
+
+
 def _install_icon_to_hicolor(icon: Path) -> bool:
-    """Copy the app icon into the user's hicolor icon theme tree.
+    """Install the app icon into the user's hicolor icon theme tree.
 
     The freedesktop icon lookup finds an installed ``apps/hermes.png``
     by the unqualified name ``hermes``, so the entry can reference the
-    icon without an absolute checkout path. The size subdirectory must
-    be one the theme actually indexes (hicolor's index.theme lists
-    fixed sizes and ``scalable`` — an unindexed dir like ``1024x1024``
-    would never be found), so the icon lands in ``scalable`` unless the
-    source is exactly 256x256, which goes to the fixed-size dir.
-    Idempotent via content-compare; OSError caught internally (False) —
-    the caller then falls back to the absolute path.
+    icon without an absolute checkout path. Raster PNGs go to indexed
+    fixed-size dirs, never ``scalable`` (SVG-only). When the source
+    decodes, it is Lanczos-resized to 24/32/48/256 so Cinnamon's panel
+    does not nearest-neighbor a 1024px PNG. Undecodable bytes fall back
+    to a copy into one indexed dir. Idempotent via content-compare;
+    OSError caught internally (False) — the caller then falls back to
+    the absolute path.
     """
     try:
         raw = icon.read_bytes()
-        is_256 = False
-        if len(raw) >= 24 and raw[:8] == b"\x89PNG\r\n\x1a\n" and raw[12:16] == b"IHDR":
-            width, height = struct.unpack(">II", raw[16:24])
-            is_256 = (width, height) == (256, 256)
-        subdir = "256x256" if is_256 else "scalable"
-        dest = _xdg_data_home() / "icons" / "hicolor" / subdir / "apps" / "hermes.png"
-        if dest.is_file() and dest.read_bytes() == raw:
-            return True
-        dest.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copyfile(icon, dest)
+        resized = _resized_hicolor_pngs(raw)
+        if resized is not None:
+            wrote = _write_hicolor_pngs(resized)
+        else:
+            dest = _hicolor_icon_dest(_hicolor_subdir(_png_dimensions(raw)))
+            wrote = True
+            if dest.is_file() and dest.read_bytes() == raw:
+                wrote = False
+            else:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copyfile(icon, dest)
+        removed_stale = _remove_stale_scalable_icon()
+        if wrote or removed_stale:
+            _refresh_hicolor_cache()
         return True
     except OSError:
         return False
diff --git a/hermes_cli/local_runtime/__init__.py b/hermes_cli/local_runtime/__init__.py
new file mode 100644
index 0000000000..9793970b5f
--- /dev/null
+++ b/hermes_cli/local_runtime/__init__.py
@@ -0,0 +1,55 @@
+"""Managed llama.cpp runtime.
+
+Hermes downloads, verifies, supervises, and updates one llama-server, and
+decides per machine which model build and context window to run. Key
+modules:
+
+- ``binaries``  — resolve/download/verify official llama.cpp release zips
+                  into ``$HERMES_HOME/runtimes/llamacpp/<tag>/``.
+- ``supervisor``— spawn and supervise one llama-server in router mode;
+                  readiness is a touch generation, never health-200 alone.
+- ``detect``    — find an already-running llama-server (external or ours).
+- ``estimator`` / ``context_policy`` / ``growth`` — price context memory
+  per architecture and run the window ladder (zero-spill start, grow
+  toward native max, compress only at the top).
+- ``catalog`` / ``presets`` — the curated model list and the per-model
+  launch flags that carry policy decisions to the router.
+
+Everything is driven by the ``local_runtime`` section of config.yaml.
+"""
+
+from hermes_cli.local_runtime.binaries import (  # noqa: F401
+    BinaryResolutionError,
+    ensure_runtime_installed,
+    resolve_assets,
+    select_backend,
+)
+from hermes_cli.local_runtime.bootstrap import (  # noqa: F401
+    ensure_local_runtime,
+    shutdown_local_runtime,
+)
+from hermes_cli.local_runtime.context_policy import (  # noqa: F401
+    FLOOR,
+    growth_decision,
+    initial_window,
+    ladder,
+    launch_args,
+)
+from hermes_cli.local_runtime.growth import (  # noqa: F401
+    clear_window_override,
+    load_window_overrides,
+    maybe_grow_window,
+    save_window_override,
+)
+from hermes_cli.local_runtime.detect import detect_server  # noqa: F401
+from hermes_cli.local_runtime.endpoint import resolve_llamacpp_endpoint  # noqa: F401
+from hermes_cli.local_runtime.estimator import (  # noqa: F401
+    HardwareBudget,
+    ctx_bytes,
+    physics_check,
+    profile_from_gguf,
+)
+from hermes_cli.local_runtime.gguf import read_gguf_header  # noqa: F401
+from hermes_cli.local_runtime.hardware import probe_budget  # noqa: F401
+from hermes_cli.local_runtime.presets import generate_presets  # noqa: F401
+from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor  # noqa: F401
diff --git a/hermes_cli/local_runtime/binaries.py b/hermes_cli/local_runtime/binaries.py
new file mode 100644
index 0000000000..bcd7d32a1d
--- /dev/null
+++ b/hermes_cli/local_runtime/binaries.py
@@ -0,0 +1,351 @@
+"""Binary acquisition for the managed llama.cpp runtime.
+
+llama.cpp publishes per-tag assets (rolling ``bNNNN`` tags, no semver).
+Backends are dlopen'd plugins, so a runtime = CPU/base zip + backend zip
+extracted into one directory, plus the cudart runtime zip on Windows CUDA
+(end users have no CUDA toolkit). We pin the tag in config, sha256-verify
+every download, and keep the previous tag for rollback (N-1).
+
+Layout: ``$HERMES_HOME/runtimes/llamacpp/<tag>/<backend>/<binaries>``
+with a ``manifest.json`` recording zips, sha256s, and the verified
+llama-server version string.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import platform
+import shutil
+import subprocess
+import urllib.request
+import zipfile
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Callable
+
+from hermes_constants import get_hermes_home
+
+logger = logging.getLogger(__name__)
+
+RELEASE_URL = "https://github.com/ggml-org/llama.cpp/releases/download/{tag}/{asset}"
+
+# Windows CUDA zips ship per CUDA major; the runtime zip must be paired with
+# its cudart zip so end users need no toolkit. 13.3 verified on 13.1 and
+# 13.2 drivers.
+_WIN_CUDA_VERSION = "13.3"
+# arm64 Windows CUDA prebuilts landed upstream (~b1036x) on CUDA 13.4 —
+# verified against live asset lists (b10362, b10630, b10679). Tags at or before
+# b10290 don't have them; resolution succeeds and the download 404s
+# honestly on such tags, which only arises if a user pins backward.
+_WIN_CUDA_VERSION_ARM64 = "13.4"
+
+
+# Fallback when the config section is missing entirely (deep-merge normally
+# guarantees the key). Single source: DEFAULT_CONFIG owns the shipped tag.
+def default_tag() -> str:
+    from hermes_cli.config_defaults import DEFAULT_CONFIG
+
+    return DEFAULT_CONFIG["local_runtime"]["tag"]
+
+
+class BinaryResolutionError(RuntimeError):
+    """No usable asset combination for this platform/backend."""
+
+
+@dataclass
+class AssetPlan:
+    """The exact zips one runtime install needs, in extraction order."""
+
+    tag: str
+    backend: str            # cuda | metal | vulkan | hip | cpu
+    assets: list[str] = field(default_factory=list)
+
+    @property
+    def install_dir(self) -> Path:
+        return runtimes_root() / self.tag / self.backend
+
+
+def runtimes_root() -> Path:
+    """Machine-scoped, deliberately NOT profile-scoped. Engine binaries,
+    presets, and server state describe this machine's hardware and its one
+    managed server (stable port) — a second profile re-downloading the
+    engine or fighting over the port would be the bug. Profile-scoped
+    things (which model is the default, enabled) live in each profile's
+    config.yaml as ever."""
+    from hermes_constants import get_default_hermes_root
+
+    return get_default_hermes_root() / "runtimes" / "llamacpp"
+
+
+def installed_tags() -> list[str]:
+    """Tags with a verified install (manifest carries verified_version),
+    newest first by release number. The boot ladder and the update check
+    both read installed-ness from here — one resolver, every caller."""
+    root = runtimes_root()
+    if not root.exists():
+        return []
+    found: list[str] = []
+    for entry in root.iterdir():
+        if not entry.is_dir() or entry.name == "downloads":
+            continue
+        for manifest in entry.glob("*/manifest.json"):
+            try:
+                if json.loads(manifest.read_text(encoding="utf-8")).get("verified_version"):
+                    found.append(entry.name)
+                    break
+            except (json.JSONDecodeError, OSError):
+                continue
+
+    def _release_number(tag: str) -> int:
+        digits = "".join(ch for ch in tag if ch.isdigit())
+        return int(digits) if digits else 0
+
+    return sorted(set(found), key=_release_number, reverse=True)
+
+
+def _host_os_arch() -> tuple[str, str]:
+    """(os, arch) normalized to release-asset vocabulary.
+
+    PITFALL: PROCESSOR_ARCHITECTURE lies under x64 emulation on
+    ARM64 Windows. platform.machine() reads the same env on some Pythons, so
+    on Windows prefer PROCESSOR_IDENTIFIER's text when present.
+    """
+    system = platform.system().lower()
+    os_name = {"windows": "win", "darwin": "macos", "linux": "ubuntu"}.get(system, system)
+    machine = platform.machine().lower()
+    arch = "arm64" if machine in ("arm64", "aarch64") else "x64"
+    if os_name == "win":
+        import os as _os
+        ident = _os.environ.get("PROCESSOR_IDENTIFIER", "")
+        if "armv8" in ident.lower() or "arm " in ident.lower():
+            arch = "arm64"
+    return os_name, arch
+
+
+def select_backend(gpu_vendor: str | None, os_name: str | None = None) -> str:
+    """Backend choice per design: CUDA if NVIDIA, Metal on macOS, Vulkan if
+    a non-NVIDIA GPU is present, else CPU. ``--list-devices`` validates the
+    choice post-install; the supervisor's touch generation is ground truth."""
+    if os_name is None:
+        os_name, _ = _host_os_arch()
+    if os_name == "macos":
+        return "metal"
+    vendor = (gpu_vendor or "").lower()
+    if "nvidia" in vendor:
+        return "cuda"
+    if vendor in ("amd", "intel") or "radeon" in vendor or "arc" in vendor:
+        return "vulkan"
+    return "cpu"
+
+
+def resolve_assets(tag: str, backend: str, os_name: str | None = None,
+                   arch: str | None = None) -> AssetPlan:
+    """Compose the asset list for (tag, backend, platform).
+
+    Raises BinaryResolutionError for combinations the release does not ship
+    (a platform/backend pair upstream publishes no artifact for). Callers
+    fall back down the backend ladder: cuda -> vulkan -> cpu.
+    """
+    host_os, host_arch = _host_os_arch()
+    os_name = os_name or host_os
+    arch = arch or host_arch
+    plan = AssetPlan(tag=tag, backend=backend)
+
+    if os_name == "macos":
+        # macOS tarballs are unified (Metal built in).
+        plan.assets = [f"llama-{tag}-bin-macos-{arch}.tar.gz"]
+        return plan
+
+    if os_name == "ubuntu":
+        if backend == "cuda":
+            # No prebuilt Linux CUDA zips at current tags — Linux CUDA users
+            # build from source or use vulkan; resolver is honest about it.
+            raise BinaryResolutionError(
+                f"no prebuilt linux CUDA asset at {tag}; use vulkan/cpu or a source build")
+        suffix = {"vulkan": f"vulkan-{arch}", "hip": f"rocm-7.2-{arch}",
+                  "cpu": arch}.get(backend)
+        if suffix is None:
+            raise BinaryResolutionError(f"unsupported linux backend {backend}")
+        plan.assets = [f"llama-{tag}-bin-ubuntu-{suffix}.tar.gz"]
+        return plan
+
+    if os_name == "win":
+        if backend == "cuda":
+            cuda_ver = _WIN_CUDA_VERSION_ARM64 if arch == "arm64" else _WIN_CUDA_VERSION
+            plan.assets = [
+                f"llama-{tag}-bin-win-cuda-{cuda_ver}-{arch}.zip",
+                f"cudart-llama-bin-win-cuda-{cuda_ver}-{arch}.zip",
+            ]
+        elif backend == "vulkan":
+            if arch == "arm64":
+                raise BinaryResolutionError(f"no win-vulkan-arm64 asset at {tag}")
+            plan.assets = [f"llama-{tag}-bin-win-vulkan-x64.zip"]
+        elif backend == "hip":
+            plan.assets = [f"llama-{tag}-bin-win-hip-radeon-x64.zip"]
+        elif backend == "cpu":
+            plan.assets = [f"llama-{tag}-bin-win-cpu-{arch}.zip"]
+        else:
+            raise BinaryResolutionError(f"unsupported windows backend {backend}")
+        return plan
+
+    raise BinaryResolutionError(f"unsupported platform {os_name}-{arch}")
+
+
+def _sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 22), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def _download(url: str, dest: Path,
+              progress: "Callable[[int, int], None] | None" = None) -> None:
+    """Stream url -> dest. ``progress(done_bytes, total_bytes)`` ticks per
+    chunk (total 0 when the server sends no Content-Length) — a several-
+    hundred-MB archive on a slow line must never look hung."""
+    logger.info("downloading %s", url)
+    tmp = dest.with_suffix(dest.suffix + ".part")
+    with urllib.request.urlopen(url, timeout=120) as r, open(tmp, "wb") as f:
+        total = int(r.headers.get("Content-Length") or 0)
+        done = 0
+        while True:
+            chunk = r.read(1 << 20)
+            if not chunk:
+                break
+            f.write(chunk)
+            done += len(chunk)
+            if progress is not None:
+                progress(done, total)
+    tmp.replace(dest)
+
+
+def _extract(archive: Path, dest: Path,
+             progress: "Callable[[int, int], None] | None" = None) -> None:
+    """Extract member by member so ``progress(done, total)`` can tick in
+    uncompressed bytes — big archives take real time on laptop disks."""
+    if archive.name.endswith(".zip"):
+        with zipfile.ZipFile(archive) as z:
+            members = z.infolist()
+            total = sum(m.file_size for m in members)
+            done = 0
+            for m in members:
+                z.extract(m, dest)
+                done += m.file_size
+                if progress is not None:
+                    progress(done, total)
+    else:
+        import tarfile
+        with tarfile.open(archive) as t:
+            members = t.getmembers()
+            total = sum(m.size for m in members)
+            done = 0
+            for m in members:
+                t.extract(m, dest, filter="data")
+                done += m.size
+                if progress is not None:
+                    progress(done, total)
+
+
+def server_binary(install_dir: Path) -> Path:
+    """Locate llama-server within an extracted runtime (zips differ in
+    whether they nest a build/bin directory)."""
+    names = ("llama-server.exe", "llama-server")
+    for name in names:
+        direct = install_dir / name
+        if direct.exists():
+            return direct
+    for name in names:
+        hits = sorted(install_dir.rglob(name))
+        if hits:
+            return hits[0]
+    raise BinaryResolutionError(f"llama-server not found under {install_dir}")
+
+
+def verify_install(install_dir: Path, tag: str) -> str:
+    """Run --version; require the tag's build number in the output.
+    (The binary prints the tag WITHOUT the 'b' prefix.)"""
+    exe = server_binary(install_dir)
+    out = subprocess.run([str(exe), "--version"], capture_output=True,
+                         text=True, encoding="utf-8", errors="replace",
+                         timeout=60, cwd=str(exe.parent))
+    text = (out.stdout + out.stderr).strip()
+    if tag.lstrip("b") not in text:
+        raise BinaryResolutionError(
+            f"version check failed for {exe}: expected {tag}, got: {text[:120]}")
+    return text.splitlines()[0] if text else ""
+
+
+def prune_old_tags(keep: list[str]) -> None:
+    """Retain only the tags in ``keep`` (current + previous — N-1 rollback).
+    The shared ``downloads/`` archive cache is not a tag and always survives."""
+    root = runtimes_root()
+    if not root.exists():
+        return
+    for entry in root.iterdir():
+        if entry.is_dir() and entry.name != "downloads" and entry.name not in keep:
+            shutil.rmtree(entry, ignore_errors=True)
+            logger.info("pruned old runtime %s", entry.name)
+
+
+def ensure_runtime_installed(tag: str, backend: str,
+                             expected_sha256: dict[str, str] | None = None,
+                             progress: "Callable[[str, int, int, str], None] | None" = None) -> Path:
+    """Idempotent: resolve, download, verify, extract, version-check.
+
+    ``expected_sha256`` maps asset name -> hash when the catalog pins them;
+    without pins the computed hash is recorded in the manifest (trust on
+    first download, verified on every reinstall).
+    ``progress(stage, done_bytes, total_bytes, label)`` ticks through the
+    slow parts — stage is "download" | "extract" | "verify", label is the
+    asset counter ("1/2") when the plan has several archives.
+    Returns the install directory containing llama-server.
+    """
+    plan = resolve_assets(tag, backend)
+    install_dir = plan.install_dir
+    manifest_path = install_dir / "manifest.json"
+    if manifest_path.exists():
+        try:
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            if manifest.get("verified_version"):
+                return install_dir
+        except (json.JSONDecodeError, OSError):
+            pass  # damaged manifest -> reinstall
+
+    install_dir.mkdir(parents=True, exist_ok=True)
+    downloads = runtimes_root() / "downloads"
+    downloads.mkdir(parents=True, exist_ok=True)
+
+    recorded: dict[str, str] = {}
+    n_assets = len(plan.assets)
+    for i, asset in enumerate(plan.assets, 1):
+        label = f"{i}/{n_assets}" if n_assets > 1 else ""
+        archive = downloads / asset
+        if not archive.exists():
+            _download(RELEASE_URL.format(tag=tag, asset=asset), archive,
+                      progress=(lambda d, t, _l=label: progress("download", d, t, _l))
+                      if progress is not None else None)
+        if progress is not None:
+            progress("verify", 0, 0, label)
+        digest = _sha256(archive)
+        expected = (expected_sha256 or {}).get(asset)
+        if expected and digest != expected:
+            archive.unlink(missing_ok=True)
+            raise BinaryResolutionError(
+                f"sha256 mismatch for {asset}: expected {expected}, got {digest}")
+        recorded[asset] = digest
+        _extract(archive, install_dir,
+                 progress=(lambda d, t, _l=label: progress("extract", d, t, _l))
+                 if progress is not None else None)
+
+    if progress is not None:
+        progress("verify", 0, 0, "")
+    version = verify_install(install_dir, tag)
+    manifest_path.write_text(json.dumps({
+        "tag": tag, "backend": plan.backend, "assets": recorded,
+        "verified_version": version,
+    }, indent=2), encoding="utf-8")
+    logger.info("installed llama.cpp %s (%s): %s", tag, backend, version)
+    return install_dir
diff --git a/hermes_cli/local_runtime/bootstrap.py b/hermes_cli/local_runtime/bootstrap.py
new file mode 100644
index 0000000000..79402142ae
--- /dev/null
+++ b/hermes_cli/local_runtime/bootstrap.py
@@ -0,0 +1,337 @@
+"""Bootstrap for the managed runtime: config -> installed binaries ->
+running supervised server.
+
+One public call, ``ensure_local_runtime(config)``, safe to call at any
+session start:
+- disabled or already-running (state file answers /health) -> no-op
+- enabled -> install binaries if missing (idempotent), spawn supervisor
+
+Kept import-light: callers gate on config before importing this module so
+sessions with local_runtime disabled never pay the import.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import subprocess
+import time
+from pathlib import Path
+
+from hermes_constants import get_hermes_home  # noqa: F401 — config paths
+
+from hermes_cli.local_runtime.binaries import runtimes_root
+
+logger = logging.getLogger(__name__)
+
+_SUPERVISOR = None  # process-wide singleton; one router per Hermes process
+
+
+def _detect_gpu_vendor() -> str | None:
+    """Best-effort GPU vendor for backend selection. NVIDIA via nvidia-smi
+    (resolved by the hardware probe's PATH-independent ladder — a stripped
+    service PATH must not demote an NVIDIA box to vulkan/cpu); anything
+    else defers to select_backend's fallback ladder."""
+    from hermes_cli.local_runtime.hardware import _nvidia_smi_path
+
+    smi = _nvidia_smi_path()
+    if smi is None:
+        return None
+    try:
+        out = subprocess.run(
+            [smi, "--query-gpu=name", "--format=csv,noheader"],
+            capture_output=True, text=True, timeout=10)
+        if out.returncode == 0 and out.stdout.strip():
+            return "nvidia " + out.stdout.strip().splitlines()[0]
+    except (OSError, subprocess.TimeoutExpired):
+        pass
+    return None
+
+
+def models_dir() -> Path:
+    """Machine-scoped, deliberately NOT profile-scoped: a 20 GB GGUF is a
+    machine asset, and every profile shares the one managed server that
+    serves it. See runtimes_root() for the same rule on the engine."""
+    from hermes_constants import get_default_hermes_root
+
+    return get_default_hermes_root() / "models"
+
+
+def assets_dir() -> Path:
+    """Non-model companion files (mmproj vision projectors, spec-decode
+    draft models). A subdirectory so the router's model listing — and our
+    staged_models() — never mistakes an asset for a servable model."""
+    return models_dir() / "assets"
+
+
+def staged_models() -> "list[Path]":
+    """Servable staged models: single-file GGUFs count when present; a
+    split GGUF counts once, by its first part, and only when EVERY part
+    is on disk — a mid-download split is not servable and must not
+    surface anywhere as a model. Continuation parts and assets/ never
+    count."""
+    import re
+
+    part = re.compile(r"-(\d{5})-of-(\d{5})\.gguf$")
+    files = sorted(models_dir().glob("*.gguf"))
+    names = {p.name for p in files}
+    out = []
+    for p in files:
+        m = part.search(p.name)
+        if m is None:
+            out.append(p)
+            continue
+        if m.group(1) != "00001":
+            continue
+        stem = p.name[: m.start()]
+        total = int(m.group(2))
+        if all(f"{stem}-{i:05d}-of-{m.group(2)}.gguf" in names
+               for i in range(2, total + 1)):
+            out.append(p)
+    return out
+
+
+def staged_model_ids() -> "list[str]":
+    import re
+
+    return [re.sub(r"-\d{5}-of-\d{5}$", "", p.stem) for p in staged_models()]
+
+
+def _presets_stale() -> bool:
+    """True when a staged model has no section in the preset INI — it
+    would autoload with stock fit instead of a policy decision."""
+    try:
+        from hermes_cli.local_runtime.presets import read_preset_decisions
+
+        known = set(read_preset_decisions())
+        return any(mid not in known for mid in staged_model_ids())
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def _stop_state_server(state: dict) -> None:
+    """Best-effort stop of the server the state file points at (an
+    incumbent this process doesn't supervise). The state pid is ours by
+    contract — the file only ever describes the managed server."""
+    from hermes_cli.local_runtime.endpoint import _pid_alive
+
+    pid = state.get("pid")
+    try:
+        pid = int(pid)
+    except (TypeError, ValueError):
+        return
+    if pid <= 0:
+        return
+    try:
+        import signal
+
+        os.kill(pid, signal.SIGTERM)
+    except (OSError, ValueError):
+        return
+    # Give it a moment to release the port and the GPU. Liveness via
+    # psutil — on Windows os.kill(pid, 0) TERMINATES the process, it is
+    # not a probe (the endpoint.py pitfall note; #local-models review).
+    for _ in range(50):
+        if not _pid_alive(pid):
+            return
+        time.sleep(0.1)
+
+
+def refresh_local_runtime() -> bool:
+    """Restart the managed server so it rescans the models directory.
+
+    The router's model list is SPAWN-ONLY: a GGUF added after start is
+    invisible to GET /models and 400s on completion, so anything that
+    changes the staged set while the server runs must bounce it. Covers
+    both ownership shapes: a supervised server restarts in-process; an
+    ADOPTED server (started by a previous backend session — the normal
+    shape after any restart) is stopped via its state-file pid and
+    replaced with a supervised boot. Without the adopted branch, every
+    download/delete in a post-restart session silently no-ops the bounce
+    and the router serves a stale catalog. Returns False when there is
+    nothing to refresh (no server anywhere; next boot scans fresh).
+    """
+    global _SUPERVISOR
+    try:
+        from hermes_cli.config import load_config
+
+        if _SUPERVISOR is None:
+            from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+            state = _state_endpoint()
+            if state is None:
+                return False
+            logger.info("bouncing adopted llama-server (pid=%s) to rescan models",
+                        state.get("pid"))
+            _stop_state_server(state)
+        else:
+            shutdown_local_runtime()
+        return ensure_local_runtime(load_config(), force=True) is not None
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("local runtime refresh failed: %s", exc)
+        return False
+
+
+def ensure_local_runtime(config: dict, force: bool = False) -> "object | None":
+    """Idempotent boot of the managed runtime. Returns the supervisor (or
+    None when disabled/unavailable). Never raises into a session start —
+    failures log and return None; chat falls back to configured providers.
+
+    ``force=True`` skips the enabled gate — used by the explicit "Use this
+    model" action, where the click IS the opt-in (the caller records it in
+    config so future boots auto-start).
+    """
+    global _SUPERVISOR
+    section = (config or {}).get("local_runtime") or {}
+    if not force and not section.get("enabled"):
+        return None
+    if _SUPERVISOR is not None:
+        return _SUPERVISOR
+
+    # Residency: no staged models means nothing to serve — don't boot an
+    # empty server. The walked-away story handled with zero configuration
+    # (delete your last model and boots stop); Use force-boots as ever.
+    if not force and not staged_models():
+        logger.info("local runtime enabled but no models staged; not booting")
+        return None
+
+    # Another Hermes process may already be supervising — reuse via state,
+    # but ONLY while its launch policy still covers every staged model. A
+    # server whose preset file predates a download serves the new model
+    # with no policy at all (--models-autoload + stock fit: f16 KV at max
+    # context, no placement — the silent-demotion busy-wait on WDDM). A
+    # stale incumbent gets stopped and replaced by a fresh boot with
+    # regenerated presets; sessions ride through exactly like any other
+    # supervised restart (stable port + persisted key).
+    from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+    state = _state_endpoint()
+    if state is not None:
+        if not _presets_stale():
+            logger.info("managed llama-server already running (another process)")
+            return None
+        logger.info("running server's presets predate the staged models; "
+                    "replacing it so every model launches with a policy")
+        _stop_state_server(state)
+
+    try:
+        from hermes_cli.local_runtime.binaries import (
+            ensure_runtime_installed,
+            select_backend,
+        )
+        from hermes_cli.local_runtime.hardware import probe_budget
+        from hermes_cli.local_runtime.presets import generate_presets
+        from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+        backend = section.get("backend", "auto")
+        if backend == "auto":
+            backend = select_backend(_detect_gpu_vendor())
+        # Boot ladder: serve what is INSTALLED, never download here. The
+        # configured tag (config root-of-trust; deep-merge supplies the
+        # Hermes-release default when unpinned) is preferred; when it isn't
+        # installed yet, the newest installed tag serves and the status
+        # endpoint reports the pending update — the download is a deliberate
+        # button click in the pane, not a boot-path surprise (a multi-minute
+        # inline download here is exactly how the onboarding bounce returns).
+        from hermes_cli.local_runtime.binaries import default_tag, installed_tags
+
+        tag = section.get("tag") or default_tag()
+        have = installed_tags()
+        if tag not in have:
+            if not have:
+                logger.info("local runtime enabled but no build installed; "
+                            "install happens in the Local Models pane")
+                return None
+            logger.info("configured tag %s not installed; serving %s "
+                        "(update is a click in Local Models)", tag, have[0])
+            tag = have[0]
+        install_dir = ensure_runtime_installed(tag, backend)
+
+        mdir = models_dir()
+        mdir.mkdir(parents=True, exist_ok=True)
+
+        # Context policy: one launch decision per staged model, carried to
+        # the router via the preset INI. Priced against CAPACITY, not live
+        # free VRAM: this runs while the outgoing server instance may still
+        # hold the card (restart, refresh after a download), and its memory
+        # is freed before the new instance loads anything. Pricing against
+        # live-free here once pinned a fitting model's weights to CPU
+        # because the probe saw the predecessor's VRAM as gone.
+        preset_path = runtimes_root() / "presets.ini"
+        try:
+            entries = generate_presets(mdir, probe_budget(planning=True), preset_path)
+            for entry in entries:
+                if entry.refusal:
+                    logger.warning("model refused by physics check: %s", entry.refusal)
+        except Exception as exc:  # noqa: BLE001 — policy failure must not block serving
+            # Degradation ladder: a STALE policy still beats no policy —
+            # stock fit (f16 KV at max context, no placement) is the
+            # silent-busy-wait failure on Windows. Keep serving with the
+            # previous INI when one exists; only a first boot with no INI
+            # at all falls to stock fit.
+            if preset_path.exists():
+                logger.error("preset generation failed (%s); serving with the "
+                             "PREVIOUS launch policies — models staged since "
+                             "the last successful generation run unpoliced "
+                             "until this is fixed", exc)
+            else:
+                logger.error("preset generation failed (%s) and no previous "
+                             "policy file exists; router runs stock fit", exc)
+                preset_path = None
+
+        sup = LlamaServerSupervisor(
+            install_dir, mdir,
+            models_max=int(section.get("models_max", 4)),
+            port=int(section.get("port", 0)) or None,
+            preset_path=preset_path,
+        )
+        try:
+            sup.start()
+        except Exception:
+            # start() can fail after the router process exists (health
+            # timeout, spawn error): leaving it running unsupervised
+            # strands its VRAM behind a port nothing will clean up.
+            try:
+                sup.stop()
+            except Exception:  # noqa: BLE001 — cleanup is best-effort
+                pass
+            raise
+        _SUPERVISOR = sup
+        logger.info("managed llama-server up at %s (backend=%s tag=%s)",
+                    sup.base_url, backend, tag)
+        _start_idle_sweeper(sup)
+        return sup
+    except Exception as exc:  # noqa: BLE001 — never break session start
+        logger.warning("managed local runtime unavailable: %s", exc)
+        return None
+
+
+def shutdown_local_runtime() -> None:
+    global _SUPERVISOR
+    if _SUPERVISOR is not None:
+        _SUPERVISOR.stop()
+        _SUPERVISOR = None
+
+
+def get_supervisor():
+    """The process-local supervisor, or None (server may still be running
+    under another process — check the state file)."""
+    return _SUPERVISOR
+
+
+def _start_idle_sweeper(sup) -> None:
+    """Idle-residency loop: every couple of minutes, unload non-primary
+    models idle past the supervisor's threshold. Daemon thread tied to the
+    supervisor's lifetime — exits when the server stops."""
+    import threading
+
+    def _loop():
+        while sup.proc is not None and sup.proc.poll() is None:
+            time.sleep(120)
+            try:
+                sup.sweep_idle()
+            except Exception as exc:  # noqa: BLE001
+                logger.debug("idle sweep skipped: %s", exc)
+
+    threading.Thread(target=_loop, daemon=True,
+                     name="local-runtime-idle-sweep").start()
diff --git a/hermes_cli/local_runtime/capabilities.py b/hermes_cli/local_runtime/capabilities.py
new file mode 100644
index 0000000000..b30152fadf
--- /dev/null
+++ b/hermes_cli/local_runtime/capabilities.py
@@ -0,0 +1,118 @@
+"""Capability answers for models served by the managed runtime.
+
+Capability lookups (vision, and whatever comes next) consult cloud-shaped
+catalogs that have never heard of a local GGUF, so a vision-capable local
+model reads as text-only and images detour to an auxiliary cloud model —
+the wrong behavior twice over for a local-first user (broken feature, and
+a screenshot silently leaving the machine).
+
+The managed runtime can answer from ground truth instead, best source
+first:
+
+1. The RUNNING child's /props: llama-server reports a ``modalities`` block
+   when a vision projector is loaded. The server that will receive the
+   image says whether it can see — no inference, no catalog.
+2. The catalog entry's declared capability (the ``vision`` tag + mmproj
+   asset) for staged-but-unloaded models: what the model WILL support once
+   its projector loads beside it.
+3. None — not one of ours, or nothing known; the caller falls through to
+   its other sources.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import urllib.request
+
+logger = logging.getLogger(__name__)
+
+_LLAMACPP_ALIASES = frozenset({"llamacpp", "llama.cpp", "llama-cpp"})
+
+# Image formats the managed server's decoder actually handles. llama.cpp
+# decodes with stb_image: PNG/JPEG/GIF/BMP yes, WebP NO — and a WebP part
+# fails SILENTLY (no HTTP error, no log line; the model just never sees an
+# image and confabulates a description). Anything outside this set must be
+# transcoded before the request. Measured against the live server: the
+# same red square answered 'Red' as PNG and 'Unseen' as WebP.
+ACCEPTED_IMAGE_MIMES = frozenset({"image/png", "image/jpeg"})
+
+
+def is_managed_provider(provider: str, base_url: str = "") -> bool:
+    """True when this provider/base_url pair points at the managed server.
+    ``custom`` only counts when the base_url IS the managed endpoint —
+    background lookups must never claim someone else's custom server."""
+    p = (provider or "").strip().lower()
+    if p in _LLAMACPP_ALIASES:
+        return True
+    if p == "custom" and base_url:
+        try:
+            from hermes_cli.local_runtime.growth import is_managed_endpoint
+
+            return is_managed_endpoint(base_url)
+        except Exception:  # noqa: BLE001
+            return False
+    return False
+
+
+def _props_modalities(model_id: str) -> "bool | None":
+    """Ask the running server whether this loaded child sees images.
+    None when the server is down, the model isn't loaded, or the build
+    doesn't report modalities."""
+    try:
+        from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+        state = _state_endpoint()
+        if state is None:
+            return None
+        base = state["base_url"].rsplit("/v1", 1)[0]
+        req = urllib.request.Request(
+            f"{base}/props?model={model_id}",
+            headers={"Authorization": f"Bearer {state.get('api_key', '')}"})
+        with urllib.request.urlopen(req, timeout=3) as r:
+            props = json.load(r)
+        modalities = props.get("modalities")
+        if isinstance(modalities, dict) and "vision" in modalities:
+            return bool(modalities["vision"])
+        return None
+    except Exception:  # noqa: BLE001
+        return None
+
+
+def managed_model_supports_vision(model_id: str) -> "bool | None":
+    """Ground-truth vision capability for a staged model, or None when the
+    model isn't ours / nothing is known (caller keeps falling through)."""
+    if not model_id:
+        return None
+
+    # Only answer for models actually staged with us.
+    try:
+        from hermes_cli.local_runtime.bootstrap import staged_model_ids
+
+        if model_id not in staged_model_ids():
+            return None
+    except Exception:  # noqa: BLE001
+        return None
+
+    live = _props_modalities(model_id)
+    if live is not None:
+        return live
+
+    # Staged but not loaded (or an older server build): the catalog knows
+    # whether this model ships a vision projector.
+    try:
+        from hermes_cli.local_runtime.bootstrap import assets_dir
+        from hermes_cli.local_runtime.catalog import find_entry_for_model
+
+        hit = find_entry_for_model(model_id)
+        if hit is None:
+            return None
+        entry = hit[0]
+        if entry.mmproj is None:
+            return False
+        # Capability requires the projector to actually be on disk — a
+        # model downloaded before its mmproj (partial delete, old layout)
+        # genuinely cannot see.
+        return (assets_dir() / entry.mmproj.local_name).exists()
+    except Exception:  # noqa: BLE001
+        return None
diff --git a/hermes_cli/local_runtime/catalog.json b/hermes_cli/local_runtime/catalog.json
new file mode 100644
index 0000000000..587606e633
--- /dev/null
+++ b/hermes_cli/local_runtime/catalog.json
@@ -0,0 +1,174 @@
+{
+  "schema_version": 1,
+  "models": [
+    {
+      "id": "qwen3.8-27b",
+      "display_name": "Qwen3.8 27B",
+      "description": "Best all-round agent model; sees images; long context stays fast",
+      "repo": "unsloth/Qwen3.8-27B-GGUF",
+      "variants": [
+        {
+          "quant": "UD-Q4_K_M",
+          "files": [
+            {
+              "path": "Qwen3.8-27B-UD-Q4_K_M.gguf",
+              "size_bytes": 16464440224
+            }
+          ]
+        }
+      ],
+      "n_ctx_train": 262144,
+      "full_layers": 16,
+      "recurrent_layers": 48,
+      "per_layer_f16": 4096,
+      "n_vocab": 248320,
+      "mmproj": {
+        "path": "mmproj-BF16.gguf",
+        "size_bytes": 931146432,
+        "local": "mmproj-Qwen3.8-27B-BF16.gguf"
+      },
+      "mtp": true,
+      "mtp_draft_depth": 2,
+      "sampling": {
+        "temp": "1.0",
+        "top-p": "0.95",
+        "top-k": "20",
+        "min-p": "0.0"
+      },
+      "quality": 90,
+      "decode_fraction": 1.0
+    },
+    {
+      "id": "qwen3.8-flash-next",
+      "display_name": "Qwen3.8 Flash Next",
+      "description": "Frontier-scale model; needs a very large GPU to run well",
+      "repo": "unsloth/Qwen3.8-Flash-Next-GGUF",
+      "variants": [
+        {
+          "quant": "UD-Q4_K_XL",
+          "files": [
+            {
+              "path": "UD-Q4_K_XL/Qwen3.8-Flash-Next-UD-Q4_K_XL-00001-of-00004.gguf",
+              "size_bytes": 10946624
+            },
+            {
+              "path": "UD-Q4_K_XL/Qwen3.8-Flash-Next-UD-Q4_K_XL-00002-of-00004.gguf",
+              "size_bytes": 49859583136
+            },
+            {
+              "path": "UD-Q4_K_XL/Qwen3.8-Flash-Next-UD-Q4_K_XL-00003-of-00004.gguf",
+              "size_bytes": 49376141504
+            },
+            {
+              "path": "UD-Q4_K_XL/Qwen3.8-Flash-Next-UD-Q4_K_XL-00004-of-00004.gguf",
+              "size_bytes": 12087983520
+            }
+          ]
+        }
+      ],
+      "n_ctx_train": 262144,
+      "full_layers": 12,
+      "recurrent_layers": 36,
+      "per_layer_f16": 2048,
+      "moe": true,
+      "n_vocab": 248320,
+      "mmproj": {
+        "path": "mmproj-BF16.gguf",
+        "size_bytes": 907542944,
+        "local": "mmproj-Qwen3.8-Flash-Next-BF16.gguf"
+      },
+      "min_engine": "b10678",
+      "quality": 95,
+      "decode_fraction": 0.08
+    },
+    {
+      "id": "qwen3.6-35b-a3b",
+      "display_name": "Qwen3.6 35B-A3B",
+      "description": "Bigger mixture-of-experts with multi-token prediction; sees images",
+      "repo": "unsloth/Qwen3.6-35B-A3B-MTP-GGUF",
+      "variants": [
+        {
+          "quant": "UD-Q4_K_M",
+          "files": [
+            {
+              "path": "Qwen3.6-35B-A3B-UD-Q4_K_M.gguf",
+              "size_bytes": 22663387424
+            }
+          ],
+          "validated": true
+        }
+      ],
+      "n_ctx_train": 262144,
+      "full_layers": 10,
+      "recurrent_layers": 30,
+      "per_layer_f16": 2048,
+      "moe": true,
+      "mtp": true,
+      "n_vocab": 248320,
+      "mtp_draft_depth": 2,
+      "mmproj": {
+        "path": "mmproj-BF16.gguf",
+        "size_bytes": 902822528,
+        "local": "mmproj-Qwen3.6-35B-A3B-BF16.gguf"
+      },
+      "sampling": {
+        "temp": "1.0",
+        "top-p": "0.95",
+        "top-k": "20",
+        "min-p": "0.0"
+      },
+      "quality": 80,
+      "decode_fraction": 0.15
+    },
+    {
+      "id": "deepseek-v4-flash",
+      "display_name": "DeepSeek V4 Flash",
+      "description": "Frontier-class model for machines with 128GB+ memory",
+      "repo": "unsloth/DeepSeek-V4-Flash-0731-GGUF",
+      "variants": [
+        {
+          "quant": "UD-Q4_K_XL",
+          "files": [
+            {
+              "path": "UD-Q4_K_XL/DeepSeek-V4-Flash-0731-UD-Q4_K_XL-00001-of-00005.gguf",
+              "size_bytes": 5257408
+            },
+            {
+              "path": "UD-Q4_K_XL/DeepSeek-V4-Flash-0731-UD-Q4_K_XL-00002-of-00005.gguf",
+              "size_bytes": 48935523072
+            },
+            {
+              "path": "UD-Q4_K_XL/DeepSeek-V4-Flash-0731-UD-Q4_K_XL-00003-of-00005.gguf",
+              "size_bytes": 48980787136
+            },
+            {
+              "path": "UD-Q4_K_XL/DeepSeek-V4-Flash-0731-UD-Q4_K_XL-00004-of-00005.gguf",
+              "size_bytes": 49999168416
+            },
+            {
+              "path": "UD-Q4_K_XL/DeepSeek-V4-Flash-0731-UD-Q4_K_XL-00005-of-00005.gguf",
+              "size_bytes": 7174505088
+            }
+          ]
+        }
+      ],
+      "n_ctx_train": 1048576,
+      "full_layers": 43,
+      "recurrent_layers": 0,
+      "per_layer_f16": 1152,
+      "moe": true,
+      "n_vocab": 163840,
+      "draft": {
+        "path": "dspark-DeepSeek-V4-Flash-0731-Q8_0.gguf",
+        "size_bytes": 10896057440
+      },
+      "sampling": {
+        "temp": "1.0",
+        "top-p": "0.95",
+        "min-p": "0.01"
+      },
+      "quality": 85,
+      "decode_fraction": 0.1
+    }
+  ]
+}
diff --git a/hermes_cli/local_runtime/catalog.py b/hermes_cli/local_runtime/catalog.py
new file mode 100644
index 0000000000..715d83c07f
--- /dev/null
+++ b/hermes_cli/local_runtime/catalog.py
@@ -0,0 +1,464 @@
+"""Curated starter catalog for the managed local runtime.
+
+Small and honest: every entry carries the estimator inputs (measured on
+real GGUFs) so the picker can price a model BEFORE the user downloads
+gigabytes. Once a file is on disk, profile_from_gguf() is the authority
+and the catalog numbers are only used for the download decision. Entries
+whose base config is gated upstream carry a same-family conservative
+prior (commented) — the GGUF header corrects it at load time.
+
+Each model ships ONE build, Q4-class (UD-Q4_K_M where the repo has it,
+UD-Q4_K_XL elsewhere). Q4 is the quant class current engines optimize
+for and the sweet spot of the size/quality curve, so there is no quant
+ladder: headroom buys a bigger context window, never a bigger quant,
+and every machine runs the same well-tested build. Below Q4 the quality
+loss is too severe to ship as someone's first local-AI experience; the
+fit policy prices the build honestly (zero-spill, spilled, or refused by
+the physics check).
+
+Validation lifecycle: builds proven end-to-end on real hardware are
+marked validated. Day-0 entries ship before that proof (they simply lack
+the validated flag) — ensure_model_ready's touch generation still gates
+every first load at runtime.
+
+Multi-file models: variants may carry split-GGUF parts (llama-server loads
+from the first part; all parts download together). Entries may carry an
+mmproj (vision projector) and a speculative-decode draft model — both
+download alongside the weights. MTP-integrated models run spec decode
+wherever they load; a separate draft model attaches only when the launch
+decision spills, where its speedup is largest.
+
+File sizes come from HF LFS metadata and feed the estimator, the fit
+pills, and download progress. There is no download-time integrity check
+by design: a corrupt or truncated file surfaces as a llama.cpp
+load error at first use, and the reachability test catches upstream
+re-uploads by size drift before users do.
+
+This is deliberately not a live registry feed: entries are reviewed like a
+version bump (the same policy governs vendor recipe ingestion — parsed
+data, never executed commands).
+
+Vendor recipes overlay: a per-SKU recipes repo may SUPPLEMENT these
+entries where applicable — vendor SKUs only, never the base layer for
+other platforms. A recipe may enrich identity (GGUF/quant/sha), perf
+hints (-b/-ub, spec-decode), and sampling defaults; it never carries
+context/slots/placement/serving flags (the fit policy owns those).
+Resolution: exact SKU -> GPU-class bucket -> fit-only. Snapshot-synced,
+reviewed like a tag bump.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import threading
+import time
+import urllib.request
+from dataclasses import dataclass, field
+from pathlib import PurePosixPath
+
+from hermes_cli.local_runtime.context_policy import (
+    FLOOR,
+    RUNTIME_OVERHEAD_BYTES,
+    TARGET_WINDOW,
+    ub_logits_bytes,
+)
+from hermes_cli.local_runtime.estimator import (
+    HardwareBudget,
+    LayerKind,
+    ModelProfile,
+    ctx_bytes,
+)
+
+logger = logging.getLogger(__name__)
+
+_GIB = 1 << 30
+_PART_SUFFIX = re.compile(r"-\d{5}-of-\d{5}$")
+
+
+@dataclass(frozen=True)
+class AssetFile:
+    """One downloadable file: repo-relative path and exact bytes (the size
+    feeds the estimator and the download progress bar; there is no
+    download-time integrity check by design — a corrupt file surfaces as a
+    llama.cpp load error). ``local`` overrides the on-disk name (repos
+    reuse generic names like mmproj-BF16.gguf across models). Non-model
+    extras live under the models dir's assets/ subdirectory so the router
+    never lists them."""
+
+    path: str                   # repo-relative (may include a subdir)
+    size_bytes: int
+    local: str | None = None
+
+    @property
+    def local_name(self) -> str:
+        return self.local or PurePosixPath(self.path).name
+
+
+@dataclass(frozen=True)
+class QuantVariant:
+    """One downloadable build of a model. Split GGUFs list every part in
+    files; the model loads from the first part."""
+
+    quant: str                  # e.g. "UD-Q4_K_M"
+    files: tuple                # AssetFile, first = the load target
+    validated: bool = False     # proven end-to-end on real hardware
+
+    @property
+    def model_id(self) -> str:
+        stem = PurePosixPath(self.files[0].path).name.removesuffix(".gguf")
+        return _PART_SUFFIX.sub("", stem)
+
+    @property
+    def size_bytes(self) -> int:
+        return sum(f.size_bytes for f in self.files)
+
+    @property
+    def weights_bytes(self) -> int:
+        """Pre-download weights estimate: GGUF bytes ≈ tensor bytes + a
+        small header (<2%) — a safe, slightly conservative stand-in until
+        profile_from_gguf reads the real table."""
+        return self.size_bytes
+
+
+@dataclass(frozen=True)
+class CatalogEntry:
+    id: str                     # stable family id (variant-independent)
+    display_name: str
+    description: str            # one line, plain language
+    repo: str                   # HF repo
+    variants: tuple             # QuantVariant (exactly one, Q4-class)
+    # Estimator inputs (measured or config-derived; quant changes weights,
+    # never KV). Entries with gated upstream configs carry a conservative
+    # same-family prior — the GGUF header is the authority after download.
+    n_ctx_train: int
+    full_layers: int
+    recurrent_layers: int
+    per_layer_f16: int          # KV bytes/token per full-attention layer
+    swa_layers: int = 0
+    swa_window: int = 0
+    moe: bool = False
+    mtp: bool = False           # ships MTP heads (spec decode when loaded)
+    # Speculative draft depth for MTP models. Per-model and measured:
+    # deeper drafting pays only while draft acceptance holds, and the
+    # break-even depth differs by model.
+    mtp_draft_depth: int = 3
+    # Vocab size prices the GPU logits buffers (ubatch x vocab x fp32,
+    # doubled under MTP backend sampling) — a multi-GiB term at large
+    # vocab sizes that a weights-only fit would miss.
+    n_vocab: int = 0
+    mmproj: "AssetFile | None" = None    # vision projector, downloads with model
+    draft: "AssetFile | None" = None     # spec-decode draft model (e.g. DSpark)
+    sampling: dict = field(default_factory=dict)  # INI long-form launch defaults
+    # Oldest llama.cpp release tag that can load this model (day-0
+    # architectures need the release where their support landed). Empty
+    # means any installed engine. The pane gates download/activate on it.
+    min_engine: str = ""
+    # Editorial quality ordering (higher = smarter), authored once,
+    # globally, at catalog-authoring time — Artificial Analysis-informed
+    # where they cover the model (scripts/aa_quality_sync.py proposes,
+    # the commit decides), editorial elsewhere. Ranks entries for the
+    # per-machine recommendation; never displayed as a score (it grades
+    # the full-precision model, not our Q4 build).
+    quality: int = 0
+    # Fraction of the build's bytes read per decoded token: 1.0 for dense
+    # models (every weight streams every token), the active slice for MoE
+    # (attention + shared + routed experts over total). With memory
+    # bandwidth this predicts decode speed — the physics half of the
+    # recommendation.
+    decode_fraction: float = 1.0
+
+    def profile(self, variant: QuantVariant) -> ModelProfile:
+        layers = ([(LayerKind.FULL, self.per_layer_f16)] * self.full_layers
+                  + [(LayerKind.SWA, self.per_layer_f16)] * self.swa_layers
+                  + [(LayerKind.RECURRENT, 0)] * self.recurrent_layers)
+        return ModelProfile(
+            name=variant.model_id, weights_bytes=variant.weights_bytes,
+            embd_table_bytes=0, n_ctx_train=self.n_ctx_train,
+            layers=layers, swa_window=self.swa_window, moe=self.moe,
+            n_vocab=self.n_vocab,
+            kv_scale=1.2 if self.mtp else 1.0)
+
+    def download_files(self, variant: QuantVariant) -> tuple:
+        """Everything a download job fetches for this variant, in order."""
+        extras = tuple(a for a in (self.mmproj, self.draft) if a is not None)
+        return tuple(variant.files) + extras
+
+    def download_bytes(self, variant: QuantVariant) -> int:
+        return sum(f.size_bytes for f in self.download_files(variant))
+
+
+@dataclass(frozen=True)
+class VariantChoice:
+    """Selection result: which build this machine should download and why.
+    reason_key is a UI-copy discriminator, not display text."""
+
+    variant: QuantVariant
+    zero_spill: bool
+    reason_key: str  # "best-large-window" | "best-fits" | "smallest-fits-spilled"
+
+
+def select_variant(entry: CatalogEntry, budget: HardwareBudget) -> VariantChoice | None:
+    """Fit the entry's one build (Q4-class) to this machine.
+
+    Every entry ships exactly one variant (see the module docstring for
+    why there is no quant ladder); headroom buys a bigger window, never
+    a bigger quant. The fit shapes:
+
+    - "best-large-window": zero-spills at TARGET_WINDOW
+    - "best-fits": zero-spills at the 64K floor
+    - "smallest-fits-spilled": weights spill to host RAM, priced honestly
+    - None: even spilled, physics refuses (the machine can't run it)
+    """
+    overhead = (RUNTIME_OVERHEAD_BYTES
+                + (entry.mmproj.size_bytes if entry.mmproj else 0)
+                + ub_logits_bytes(entry.n_vocab, mtp_capable=entry.mtp))
+    native = entry.n_ctx_train or FLOOR
+    variant = entry.variants[-1]
+    profile = entry.profile(variant)
+    need = variant.weights_bytes + overhead
+    if (need + ctx_bytes(profile, min(TARGET_WINDOW, native))
+            <= budget.usable_vram_bytes):
+        return VariantChoice(variant=variant, zero_spill=True,
+                             reason_key="best-large-window")
+    floor_kv = ctx_bytes(profile, min(FLOOR, native))
+    if need + floor_kv <= budget.usable_vram_bytes:
+        return VariantChoice(variant=variant, zero_spill=True,
+                             reason_key="best-fits")
+    if need + floor_kv <= budget.usable_vram_bytes + budget.ram_available_bytes:
+        return VariantChoice(variant=variant, zero_spill=False,
+                             reason_key="smallest-fits-spilled")
+    return None
+
+
+# ── recommendation: best quality that fits and isn't miserably slow ──
+#
+# Two axes, each living where it belongs. QUALITY is a judgment made once,
+# globally, at authoring time (entry.quality — AA-informed, editorially
+# owned). SPEED is physics computed per machine: decode is memory-bound,
+# so predicted tok/s ≈ bandwidth / bytes-read-per-token, and the bytes per
+# token are the build's size scaled by its decode fraction (dense reads
+# everything; MoE reads the active slice). The pick: highest quality among
+# entries that run resident and clear a pleasant speed floor; else the
+# fastest resident entry; else the least-painful spilled one.
+#
+# The bandwidth axis is the `uma` flag for now: every discrete card that
+# matters is 900+ GB/s GDDR while the unified-memory class measures ~1/5th
+# of that, so the flag IS the high/low split. A measured per-machine
+# bandwidth (one cached memcpy probe) can replace these class constants
+# without touching the rule; predictions order candidates and gate the
+# floor — they are not display values.
+
+_DISCRETE_BANDWIDTH_GB_S = 1000.0   # representative GDDR6X/GDDR7 class
+_UMA_BANDWIDTH_GB_S = 210.0         # measured on unified-memory NVIDIA
+_HOST_BANDWIDTH_GB_S = 80.0         # spilled weights stream over host DRAM
+
+# The one editorial constant in the tree: below this predicted decode
+# speed a model stops feeling pleasant for agentic use (roughly reading
+# speed with headroom for tool-call bursts). Distinct from the growth
+# policy's 6 tok/s compress floor, which marks unusable, not unpleasant.
+PLEASANT_FLOOR_TOK_S = 20.0
+
+
+def predicted_decode_tok_s(entry: CatalogEntry, variant: QuantVariant,
+                           budget: HardwareBudget, *,
+                           spilled: bool = False) -> float:
+    """Memory-bound decode prediction for ordering and floor-gating."""
+    bandwidth = (_HOST_BANDWIDTH_GB_S if spilled
+                 else _UMA_BANDWIDTH_GB_S if budget.uma
+                 else _DISCRETE_BANDWIDTH_GB_S)
+    bytes_per_token = max(1.0, variant.size_bytes * entry.decode_fraction)
+    return bandwidth * 1e9 / bytes_per_token
+
+
+def recommended_entry(budget: HardwareBudget,
+                      entries: "tuple[CatalogEntry, ...] | None" = None
+                      ) -> "tuple[CatalogEntry, str] | None":
+    """The catalog's default pick for THIS machine, with its reason.
+
+    Callers pass pre-filtered entries when some are ineligible for
+    reasons the catalog can't know (engine too old); default is the full
+    catalog. Returns (entry, reason) — the reason is a key the UI turns
+    into the Recommended badge's tooltip, so the rationale shown to the
+    user is the branch that actually fired, never a parallel explanation
+    that can drift:
+
+      best-quality-resident   quality won among resident entries that
+                              clear the pleasant floor
+      speed-gated-quality     same, but the floor eliminated a HIGHER
+                              quality candidate — the exact 'why not the
+                              big model?' a unified-memory owner asks
+      fastest-resident        nothing resident clears the floor; the
+                              quickest resident entry wins
+      least-painful-spilled   nothing runs resident; fastest from host
+                              memory (MoE by construction)
+
+    Returns None only when nothing fits at all.
+    """
+    pool = CATALOG if entries is None else entries
+    fitting: list[tuple[CatalogEntry, VariantChoice]] = []
+    for entry in pool:
+        choice = select_variant(entry, budget)
+        if choice is not None:
+            fitting.append((entry, choice))
+    if not fitting:
+        return None
+
+    resident = [(e, c) for e, c in fitting if c.zero_spill]
+    pleasant = [
+        (e, c) for e, c in resident
+        if predicted_decode_tok_s(e, c.variant, budget) >= PLEASANT_FLOOR_TOK_S
+    ]
+    if pleasant:
+        pick = max(pleasant, key=lambda t: (t[0].quality, -t[1].variant.size_bytes))[0]
+        floor_gated = any(e.quality > pick.quality for e, _ in resident)
+        return (pick, "speed-gated-quality" if floor_gated
+                else "best-quality-resident")
+    if resident:
+        pick = max(resident,
+                   key=lambda t: predicted_decode_tok_s(t[0], t[1].variant, budget))[0]
+        return (pick, "fastest-resident")
+    # Everything spills: take the least painful — fastest predicted decode
+    # from host memory (MoE wins here by construction; a dense spill
+    # streams every weight over the host bus).
+    pick = max(fitting,
+               key=lambda t: predicted_decode_tok_s(t[0], t[1].variant, budget,
+                                                    spilled=True))[0]
+    return (pick, "least-painful-spilled")
+
+
+def recommended_id(budget: HardwareBudget,
+                   entries: "tuple[CatalogEntry, ...] | None" = None) -> str | None:
+    picked = recommended_entry(budget, entries)
+    return picked[0].id if picked is not None else None
+
+
+# ── catalog data: packaged JSON, refreshed from GitHub in memory ─
+#
+# The catalog DATA lives in catalog.json (checked in beside this module
+# and shipped as package data); this module keeps all policy. At import
+# we load the packaged copy — no network on the import path. A TTL-gated
+# background refresh fetches the same file from the repo's main branch
+# and swaps it in memory only: nothing on disk changes, so a git
+# checkout never sees a dirty tracked file and the packaged copy remains
+# the offline truth. A reverted commit on main heals every install on
+# its next fetch, and day-0 entries reach users without an app release.
+
+_CATALOG_URL = ("https://raw.githubusercontent.com/NousResearch/hermes-agent"
+                "/main/hermes_cli/local_runtime/catalog.json")
+_SCHEMA_VERSION = 1
+_REFRESH_TTL_S = 6 * 3600
+_refresh_lock = threading.Lock()
+_last_refresh_attempt = 0.0
+
+
+def _asset_from(d: "dict | None") -> "AssetFile | None":
+    if not d:
+        return None
+    return AssetFile(path=d["path"], size_bytes=int(d["size_bytes"]),
+                     local=d.get("local"))
+
+
+def _load_catalog(doc: dict) -> "tuple[CatalogEntry, ...]":
+    """Parse a catalog document into entries. Unknown fields are ignored
+    (newer catalogs stay readable by older apps); a major schema bump is
+    the signal that they wouldn't be, and the caller skips the document."""
+    if int(doc.get("schema_version", 0)) != _SCHEMA_VERSION:
+        raise ValueError(f"catalog schema {doc.get('schema_version')!r} "
+                         f"(this build reads {_SCHEMA_VERSION})")
+    entries = []
+    for m in doc["models"]:
+        variants = tuple(
+            QuantVariant(quant=v["quant"],
+                         files=tuple(_asset_from(f) for f in v["files"]),
+                         validated=bool(v.get("validated")))
+            for v in m["variants"])
+        entries.append(CatalogEntry(
+            id=m["id"], display_name=m["display_name"],
+            description=m["description"], repo=m["repo"], variants=variants,
+            n_ctx_train=int(m["n_ctx_train"]),
+            full_layers=int(m["full_layers"]),
+            recurrent_layers=int(m["recurrent_layers"]),
+            per_layer_f16=int(m["per_layer_f16"]),
+            swa_layers=int(m.get("swa_layers", 0)),
+            swa_window=int(m.get("swa_window", 0)),
+            moe=bool(m.get("moe")), mtp=bool(m.get("mtp")),
+            mtp_draft_depth=int(m.get("mtp_draft_depth", 3)),
+            n_vocab=int(m.get("n_vocab", 0)),
+            mmproj=_asset_from(m.get("mmproj")),
+            draft=_asset_from(m.get("draft")),
+            sampling=dict(m.get("sampling", {})),
+            min_engine=str(m.get("min_engine", "")),
+            quality=int(m.get("quality", 0)),
+            decode_fraction=float(m.get("decode_fraction", 1.0)),
+        ))
+    return tuple(entries)
+
+
+def _packaged_catalog() -> "tuple[CatalogEntry, ...]":
+    from importlib.resources import files
+
+    raw = files("hermes_cli.local_runtime").joinpath("catalog.json").read_text(
+        encoding="utf-8")
+    return _load_catalog(json.loads(raw))
+
+
+CATALOG: "tuple[CatalogEntry, ...]" = _packaged_catalog()
+
+
+def refresh_catalog(force: bool = False) -> bool:
+    """Fetch the current catalog from the repo and swap it in memory.
+
+    Best-effort by design: any failure (offline, GitHub down, unreadable
+    schema) leaves the running catalog untouched and retries after the
+    TTL. Returns True when a fetched document replaced the catalog."""
+    global CATALOG, _last_refresh_attempt
+
+    now = time.monotonic()
+    with _refresh_lock:
+        if not force and now - _last_refresh_attempt < _REFRESH_TTL_S:
+            return False
+        _last_refresh_attempt = now
+    try:
+        req = urllib.request.Request(
+            _CATALOG_URL, headers={"User-Agent": "hermes-local-runtime"})
+        with urllib.request.urlopen(req, timeout=10) as r:
+            fetched = _load_catalog(json.load(r))
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("catalog refresh skipped: %s", exc)
+        return False
+    if fetched != CATALOG:
+        logger.info("catalog refreshed from repo (%d models)", len(fetched))
+    CATALOG = fetched
+    return True
+
+
+def refresh_catalog_soon() -> None:
+    """TTL-gated background refresh; returns immediately. The caller's
+    current request serves the catalog it already has — the refresh
+    lands for the next one."""
+    if time.monotonic() - _last_refresh_attempt < _REFRESH_TTL_S:
+        return
+    threading.Thread(target=refresh_catalog, daemon=True,
+                     name="catalog-refresh").start()
+
+
+def catalog_by_id() -> dict[str, CatalogEntry]:
+    return {entry.id: entry for entry in CATALOG}
+
+
+def find_variant(entry_id: str, model_id: str) -> QuantVariant | None:
+    entry = catalog_by_id().get(entry_id)
+    if entry is None:
+        return None
+    return next((v for v in entry.variants if v.model_id == model_id), None)
+
+
+def find_entry_for_model(model_id: str) -> "tuple[CatalogEntry, QuantVariant] | None":
+    """Locate the entry + variant that owns a staged model id."""
+    for entry in CATALOG:
+        for variant in entry.variants:
+            if variant.model_id == model_id:
+                return entry, variant
+    return None
diff --git a/hermes_cli/local_runtime/context_policy.py b/hermes_cli/local_runtime/context_policy.py
new file mode 100644
index 0000000000..1f08ae354b
--- /dev/null
+++ b/hermes_cli/local_runtime/context_policy.py
@@ -0,0 +1,286 @@
+"""Context policy — the window ladder for managed local models.
+
+One contract: any model runs at any window up to its native max; hardware
+and session depth only change tokens/s. Constants, not knobs — nothing in
+this module reads config.
+
+The policy encodes behavior measured on real hardware (llama.cpp,
+discrete NVIDIA GPUs on Windows/WDDM, and unified-memory devices):
+
+- Windows never over-allocates VRAM ahead of need. On WDDM, allocating
+  past residency slows decode roughly 9x even at identical conversation
+  depth — the driver silently demotes pages instead of failing. Every
+  window grant therefore re-fits against live memory at grant time.
+- Models launch at the largest window that fits entirely in GPU memory
+  (zero-spill) and grow toward their native max as the session needs
+  room, at request boundaries only.
+- Growth re-prefills the conversation into the larger window. Measured
+  cost is comparable to save/restore on discrete GPUs, and recurrent or
+  hybrid-attention models cannot rewind mid-sequence anyway, so
+  re-prefill is the only mechanism that works for every architecture.
+- Every recommended model gets at least a 64K window. When weights alone
+  exceed VRAM, the fit deliberately spills weights to host RAM to
+  protect that floor (measured: an explicit context size makes the fit
+  spill weights and hold the window rather than shrink it).
+- Below ~6 tok/s decode, growth stops and compression becomes the
+  default; deeper context is an explicit per-session choice. The deepest
+  measured host-spilled configuration bottomed out near this rate.
+- Spilled mixture-of-experts configs pin expert/FFN weights to host so
+  attention and KV stay GPU-resident — measured ~1.75x faster than
+  spilling layers naively at the same host byte count.
+- Speculative decoding (MTP) defaults on only for spilled configs, where
+  its speedup is largest (measured 1.43x spilled vs 1.35x resident).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from hermes_cli.local_runtime.estimator import (
+    HardwareBudget,
+    ModelProfile,
+    PhysicsRefusal,
+    ctx_bytes,
+    physics_check,
+)
+
+FLOOR = 64 * 1024                     # = target; one internal constant
+_LADDER_GROWTH = 1.5
+_GROW_AT_OCCUPANCY = 0.85             # of the current window, at turn boundary
+SPEED_FLOOR_TOK_S = 6.0               # deepest measured spill bottomed near this
+_EARLY_COST_CTX_FRACTION = 0.15       # bounded early cost when weights spill
+
+# TARGET_WINDOW: the smallest ladder rung at which compression becomes the
+# exception rather than the routine. Measured over 161 real agentic
+# sessions: 66% complete uncompressed in 64K, 82% in 96K, 91% in 144K —
+# and the marginal gain past 144K (+6 points for 216K) falls below the
+# quality cost of stepping down another quant. Quant selection prefers
+# the best build that reaches this; the FLOOR remains the guarantee.
+TARGET_WINDOW = 144 * 1024
+
+# What a load really costs beyond weights + KV: CUDA contexts and compute
+# buffers at the DEFAULT microbatch (-ub 512, no MTP). Measured on a
+# 32 GiB card: a model estimated at 29.3 GiB (weights+KV) loaded at
+# ~31.2 GiB resident and the server's own fit still shaved a layer to
+# CPU. Microbatch/MTP logits buffers are priced separately per model
+# (ub_logits_bytes — they scale with the model's vocab and doubled once
+# packed a card 3.9 GiB past this constant). Callers add mmproj bytes on
+# top.
+RUNTIME_OVERHEAD_BYTES = int(1.5 * (1 << 30))
+
+
+def ladder(native: int) -> list[int]:
+    """64K -> 96K -> 128K -> ... -> native (native always the last rung)."""
+    rungs: list[int] = []
+    step = float(FLOOR)
+    while step < native:
+        rungs.append(int(step))
+        step *= _LADDER_GROWTH
+    rungs.append(native)
+    return rungs
+
+
+@dataclass
+class WindowDecision:
+    window: int
+    spill_bytes: int              # weights displaced to host at this window
+    kv_on_gpu: bool
+    reasons: list[str] = field(default_factory=list)
+
+    @property
+    def spilled(self) -> bool:
+        return self.spill_bytes > 0
+
+
+def initial_window(profile: ModelProfile, budget: HardwareBudget,
+                   *, flash_attention: bool = True,
+                   overhead_bytes: int = 0) -> WindowDecision | PhysicsRefusal:
+    """The launch decision: largest cheap rung, never below the floor.
+
+    Zero-spill rung: weights + ctx + overhead fit usable VRAM entirely.
+    Bounded-early-cost rung: weights already exceed VRAM; take the largest
+    rung whose ctx stays <= ~15% of usable VRAM.
+    Floor everywhere, capped at native.
+
+    ``overhead_bytes``: runtime cost beyond weights+KV (RUNTIME_OVERHEAD
+    plus the vision projector when one loads). Zero keeps this function
+    pure physics for decision-table tests; production callers pass it.
+    """
+    refusal = physics_check(profile, budget, FLOOR, flash_attention=flash_attention)
+    if refusal:
+        return refusal
+
+    native = profile.n_ctx_train or FLOOR
+    rungs = ladder(native)
+
+    reasons: list[str] = []
+    best_zero_spill: int | None = None
+    for rung in rungs:
+        need = (profile.weights_bytes + overhead_bytes
+                + ctx_bytes(profile, rung, flash_attention=flash_attention))
+        if need <= budget.usable_vram_bytes:
+            best_zero_spill = rung
+        else:
+            break
+
+    if best_zero_spill is not None and best_zero_spill >= min(FLOOR, native):
+        window = best_zero_spill
+        reasons.append(f"largest zero-spill rung ({window // 1024}K)")
+    else:
+        # Weights spill from turn one (steep-curve model on a small card) —
+        # hold the floor, bound the early ctx cost.
+        cap = int(budget.usable_vram_bytes * _EARLY_COST_CTX_FRACTION)
+        window = min(FLOOR, native)
+        for rung in rungs:
+            if rung < window:
+                continue
+            if ctx_bytes(profile, rung, flash_attention=flash_attention) <= cap:
+                window = rung
+            else:
+                break
+        reasons.append(f"floor held at {window // 1024}K; weights spill (deliberate price of the guarantee)")
+
+    kv = ctx_bytes(profile, window, flash_attention=flash_attention)
+    spill = max(0, profile.weights_bytes + kv - budget.usable_vram_bytes)
+    return WindowDecision(window=window, spill_bytes=spill,
+                          kv_on_gpu=kv <= budget.usable_vram_bytes,
+                          reasons=reasons)
+
+
+@dataclass
+class GrowthDecision:
+    action: str                   # "grow" | "hold" | "compress-default"
+    next_window: int | None = None
+    reason: str = ""
+
+
+def growth_decision(profile: ModelProfile, budget: HardwareBudget, *,
+                    current_window: int, session_tokens: int,
+                    measured_decode_tok_s: float | None,
+                    server_idle: bool,
+                    flash_attention: bool = True,
+                    occupancy_confirmed: bool = False) -> GrowthDecision:
+    """One growth evaluation, END-OF-TURN ONLY (caller guarantees the turn
+    boundary; recurrent state cannot rewind mid-sequence).
+
+    Gate ordering:
+    1. occupancy (~85%) — nothing to do before the edge;
+    2. native cap — the contract tops out at trained context;
+    3. idleness — growth re-grants only on an otherwise-idle
+       server (concurrency design);
+    4. speed floor — below it, compression becomes the default and deeper
+       is an explicit user choice;
+    5. re-fit against LIVE free memory (the rung must fit residency
+       NOW, not at launch time — over-allocation is the slow path).
+
+    ``occupancy_confirmed``: the caller has independently established that
+    the session is at its window's edge (the agent's compression gate fired
+    on its own threshold). Skips gate 1 so two separately-derived edge
+    definitions can't deadlock into compress-before-grow.
+    """
+    if not occupancy_confirmed and session_tokens < current_window * _GROW_AT_OCCUPANCY:
+        return GrowthDecision("hold", reason="session below growth occupancy")
+
+    native = profile.n_ctx_train or current_window
+    if current_window >= native:
+        return GrowthDecision("compress-default",
+                              reason="at native window; compression is the only move")
+
+    if not server_idle:
+        return GrowthDecision("hold", reason="server busy; re-grant deferred to idle")
+
+    if measured_decode_tok_s is not None and measured_decode_tok_s < SPEED_FLOOR_TOK_S:
+        return GrowthDecision(
+            "compress-default",
+            reason=(f"decode {measured_decode_tok_s:.1f} tok/s below the "
+                    f"~{SPEED_FLOOR_TOK_S:.0f} tok/s floor; growth is now an "
+                    "explicit per-session choice"))
+
+    next_rung = next((r for r in ladder(native) if r > current_window), native)
+
+    # Re-fit against live free memory: allocation beyond residency is the
+    # slow path, so a rung that no longer fits doesn't get granted.
+    kv = ctx_bytes(profile, next_rung, flash_attention=flash_attention)
+    total_need = profile.weights_bytes + kv
+    if total_need > budget.usable_vram_bytes + budget.ram_available_bytes:
+        return GrowthDecision("compress-default",
+                              reason="next rung exceeds physics; compression instead")
+
+    return GrowthDecision("grow", next_window=next_rung,
+                          reason=f"rung {current_window // 1024}K -> {next_rung // 1024}K")
+
+
+def spill_overrides(profile: ModelProfile) -> list[str]:
+    """-ot placement for spilled configs: expert/FFN weights to host so
+    attention + KV stay GPU-resident. MoE gets the expert pattern;
+    hybrids push recurrent-layer FFNs (their n_head_kv==0 layers carry no
+    KV worth protecting)."""
+    if profile.moe:
+        return ["-ot", r"blk\.\d+\.ffn_.*_exps\.weight=CPU"]
+    if profile.recurrent_layer_count:
+        return ["-ot", r"blk\.\d+\.ffn_.*\.weight=CPU"]
+    return []  # dense: fit's back-to-front layer cut is the only axis
+
+
+def launch_args(profile: ModelProfile, decision: WindowDecision, *,
+                flash_attention: bool = True,
+                mtp_capable: bool = False,
+                mtp_draft_depth: int = 3,
+                uma: bool = False,
+                mtp_prefill: bool = False) -> list[str]:
+    """Per-model launch flags from a window decision. Explicit -c puts fit
+    into spill-weights-and-hold-ctx; q8 KV cache wherever flash attention
+    exists; -ot placement on spilled configs — DISCRETE cards only.
+
+    ``uma``: on unified memory there is no bus to protect tensors from —
+    "CPU" and "GPU" are the same silicon, and pinning FFN weights to the
+    host path just forces CPU compute (measured well over 2x slower than
+    letting the allocator place everything). The discrete
+    ~1.75x win the -ot pattern encodes does not transfer; a spilled UMA
+    config runs unpinned.
+
+    MTP and the large prefill microbatch both win, and whether they may
+    STACK is a fit question, not a rule: backend sampling keeps a
+    ubatch x vocab x fp32 logits buffer on the GPU and MTP's draft
+    context doubles it, so the stacked posture costs a few GiB extra at
+    large vocab. Where it fits, it measures best on both axes (Qwen3.8
+    Q4 on a 32 GiB card: 93.3 tok/s decode vs 89.5 at ub512, prefill
+    slightly better too); where it doesn't, ub512 keeps the decode win
+    without packing the card. ``mtp_prefill`` is that fit verdict —
+    presets decide it against the priced margin, and ub_logits_bytes()
+    prices the same choice so the flag and its cost travel together."""
+    args = ["-c", str(decision.window)]
+    if mtp_capable:
+        args += ["--spec-type", "draft-mtp",
+                 "--spec-draft-n-max", str(mtp_draft_depth),
+                 "--backend-sampling", "--spec-draft-backend-sampling"]
+        if mtp_prefill:
+            args += ["-b", "4096", "-ub", "2048"]
+    else:
+        args += ["-b", "2048", "-ub", "2048"]
+    if flash_attention:
+        args += ["-ctk", "q8_0", "-ctv", "q8_0", "-fa", "on"]
+    if decision.spilled and not uma:
+        args += spill_overrides(profile)
+    return args
+
+
+def ub_logits_bytes(n_vocab: int, *, mtp_capable: bool,
+                    mtp_prefill: bool = False) -> int:
+    """GPU logits/compute-buffer cost of the microbatch posture chosen by
+    launch_args, priced from the model's own vocab and calibrated against
+    measured server RSS (Qwen3.8 Q4, both postures, three windows):
+
+      stacked (MTP + ub2048):  ubatch x vocab x fp32 x 1.5  (~2.9 GiB at
+                               248K vocab; fitted 2.5, rounded up)
+      decode  (MTP + ub512):   ubatch x vocab x fp32 x 2    (~1.0 GiB)
+      plain   (ub2048):        ubatch x vocab x fp32        (~1.9 GiB)
+
+    Callers add this to RUNTIME_OVERHEAD per model — the flag and its
+    price travel together or the fit lies."""
+    v = max(0, int(n_vocab))
+    if mtp_capable and mtp_prefill:
+        return int(2048 * v * 4 * 1.5)
+    if mtp_capable:
+        return 512 * v * 4 * 2
+    return 2048 * v * 4
diff --git a/hermes_cli/local_runtime/detect.py b/hermes_cli/local_runtime/detect.py
new file mode 100644
index 0000000000..02131255ed
--- /dev/null
+++ b/hermes_cli/local_runtime/detect.py
@@ -0,0 +1,80 @@
+"""Detection of running llama-server instances.
+
+Probes well-known local roots and fingerprints genuine llama-server via
+/props (build_info + model fields — Ollama and LM Studio answer /v1/models
+but not /props). The credential is reachability; detection never needs a
+key, but honors one if the probed server requires it (401 -> detected,
+auth_required=True).
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+
+# Always 127.0.0.1 — resolving localhost costs ~2s/request on Windows.
+DEFAULT_PROBE_PORTS = (8080,)  # llama-server default; managed port comes from config
+
+
+@dataclass
+class DetectedServer:
+    base_url: str            # OpenAI-compatible /v1 root
+    build_info: str          # e.g. "b10290-c8e03ce81"
+    model_path: str          # currently loaded model (may be empty in router mode)
+    n_ctx: int | None
+    router_mode: bool        # GET /models answered -> router management available
+    auth_required: bool
+
+
+def _get(url: str, timeout_s: int = 3) -> tuple[int, dict | None]:
+    try:
+        with urllib.request.urlopen(url, timeout=timeout_s) as r:
+            raw = r.read()
+            return r.status, (json.loads(raw) if raw else None)
+    except urllib.error.HTTPError as exc:
+        return exc.code, None
+    except (urllib.error.URLError, OSError, TimeoutError, json.JSONDecodeError):
+        return 0, None
+
+
+def probe_port(port: int) -> DetectedServer | None:
+    """One port: /props fingerprint, then /models for router capability."""
+    root = f"http://127.0.0.1:{port}"
+    status, props = _get(f"{root}/props")
+    if status == 401:
+        return DetectedServer(base_url=f"{root}/v1", build_info="", model_path="",
+                              n_ctx=None, router_mode=False, auth_required=True)
+    if status != 200 or not isinstance(props, dict):
+        return None
+    build = str(props.get("build_info", ""))
+    if not build:
+        return None  # answers /props but isn't llama-server
+    n_ctx = None
+    dgs = props.get("default_generation_settings")
+    if isinstance(dgs, dict):
+        n_ctx = dgs.get("n_ctx")
+    models_status, models = _get(f"{root}/models")
+    return DetectedServer(
+        base_url=f"{root}/v1",
+        build_info=build,
+        model_path=str(props.get("model_path", "")),
+        n_ctx=n_ctx,
+        router_mode=(models_status == 200 and isinstance(models, dict)
+                     and "data" in models),
+        auth_required=False,
+    )
+
+
+def detect_server(extra_ports: tuple[int, ...] = ()) -> DetectedServer | None:
+    """First hit across default + extra ports (managed port, config port)."""
+    seen = set()
+    for port in (*DEFAULT_PROBE_PORTS, *extra_ports):
+        if port in seen:
+            continue
+        seen.add(port)
+        hit = probe_port(port)
+        if hit:
+            return hit
+    return None
diff --git a/hermes_cli/local_runtime/endpoint.py b/hermes_cli/local_runtime/endpoint.py
new file mode 100644
index 0000000000..b80a663d03
--- /dev/null
+++ b/hermes_cli/local_runtime/endpoint.py
@@ -0,0 +1,194 @@
+"""Endpoint resolution for llamacpp-alias requests (provider integration).
+
+The seam between the existing provider mechanism and the managed runtime:
+``provider: llamacpp`` with no explicit base_url resolves, in order, to
+
+1. the managed server this Hermes is supervising (state file written by
+   LlamaServerSupervisor.start, removed on stop, staleness-checked), or
+2. a detected external llama-server.
+
+Returns None when neither exists — the caller falls through to the normal
+custom-provider path and its own error reporting.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+import time
+import urllib.error
+import urllib.request
+
+LLAMACPP_ALIASES = frozenset({"llamacpp", "llama.cpp", "llama-cpp"})
+
+logger = logging.getLogger(__name__)
+
+
+def _pid_alive(pid: int) -> bool:
+    """Liveness for the state file's supervisor-child pid.
+
+    psutil when available; otherwise fall back to True (optimistic) — on
+    Windows ``os.kill(pid, 0)`` TERMINATES the process, so it must never be
+    used as a probe (windows-git-bash interop pitfall).
+    """
+    if not pid or pid < 0:
+        return False
+    try:
+        import psutil  # type: ignore
+
+        return psutil.pid_exists(pid)
+    except Exception:  # noqa: BLE001
+        return True
+
+
+def _state_endpoint() -> dict | None:
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    path = state_path()
+    if not path.exists():
+        return None
+    try:
+        state = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        return None
+    base_url = state.get("base_url", "")
+    if not base_url:
+        return None
+    endpoint = {"base_url": base_url, "api_key": state.get("api_key", "")}
+    # Ownership proof: the stable port means a SECOND install (different
+    # HERMES_HOME — a scratch profile, say) can own 127.0.0.1:18434 with a
+    # different api key while this install's state file still points there.
+    # /health is a public route, so it answers 200 for ANYONE's server —
+    # trusting it alone sent every chat request and the load-progress
+    # watcher at a server that 401s our key, silently. The recorded
+    # supervisor pid is the tiebreaker: health-200 from a server whose
+    # recorded child is DEAD is someone else's server, never a starting one.
+    pid_ok = _pid_alive(int(state.get("pid") or 0))
+    # Healthy server: done (when it's ours).
+    try:
+        health = base_url.rsplit("/v1", 1)[0] + "/health"
+        with urllib.request.urlopen(health, timeout=3) as r:
+            if r.status == 200:
+                return endpoint if pid_ok else None
+    except (urllib.error.URLError, OSError, TimeoutError):
+        pass
+    # Not healthy YET: a live supervisor child is a STARTING server (state
+    # is written at spawn; llama-server takes seconds to listen). Resolve
+    # optimistically so readiness probes racing the boot see a configured
+    # provider, not missing credentials. A dead pid is a crashed-without-
+    # cleanup leftover — ignore it so requests don't blackhole.
+    if pid_ok:
+        return endpoint
+    return None
+
+
+def resolve_llamacpp_endpoint(config: dict | None = None,
+                              wait_for_boot_s: float = 8.0) -> dict | None:
+    """Managed-first, detection-second endpoint for llamacpp aliases.
+
+    Returns {"base_url", "api_key"} or None. api_key is empty for keyless
+    external servers (callers substitute the SDK placeholder).
+
+    Boot-race rung: on a fresh backend start there is NO state file yet —
+    the lifespan boot thread is still spawning the server (config load +
+    preset generation + spawn ≈ 1-3 s) while the desktop's readiness probe
+    fires the moment the WebSocket connects. When the runtime is enabled
+    and installed, a missing endpoint means BOOTING, not unconfigured:
+    poll briefly for the state file instead of failing the probe (twice
+    observed as 'no usable credentials' → onboarding on restart).
+    """
+    managed = _state_endpoint()
+    if managed:
+        return managed
+
+    from hermes_cli.local_runtime.detect import detect_server
+
+    extra = ()
+    if config:
+        ports = (config.get("local_runtime") or {}).get("detect_ports") or []
+        extra = tuple(int(p) for p in ports)
+    hit = detect_server(extra_ports=extra)
+    if hit and not hit.auth_required:
+        return {"base_url": hit.base_url, "api_key": ""}
+
+    if wait_for_boot_s > 0 and _boot_in_flight(config):
+        _kick_managed_boot(config)
+        deadline = time.monotonic() + wait_for_boot_s
+        while time.monotonic() < deadline:
+            time.sleep(0.25)
+            managed = _state_endpoint()
+            if managed:
+                return managed
+    return None
+
+
+_KICK_LOCK = threading.Lock()
+
+
+def _kick_managed_boot(config: dict | None) -> None:
+    """Actively start the managed server when resolution finds it missing.
+
+    The wait loop above assumes some OTHER thread is bringing the server
+    up — true only at backend start (the lifespan boot thread). A router
+    that dies LATER leaves no boot in flight: the backend process was
+    killed with the router as part of its tree, or another install took
+    the stable port and the ownership guard rightly refused it. In those
+    states the wait just expired and agent init failed with 'no provider
+    configured', even though the fix is the same idempotent ensure call
+    the lifespan makes. Kick it here, off-thread (the resolver's wait
+    stays bounded; ensure's own state checks make a concurrent lifespan
+    boot harmless) and non-reentrant (racing resolutions kick once).
+    """
+    if not _KICK_LOCK.acquire(blocking=False):
+        return  # a kick is already in flight
+
+    def _boot() -> None:
+        try:
+            cfg = config
+            if cfg is None:
+                from hermes_cli.config import load_config
+
+                cfg = load_config()
+            from hermes_cli.local_runtime.bootstrap import ensure_local_runtime
+
+            ensure_local_runtime(cfg)
+        except Exception:  # noqa: BLE001 — best-effort; resolution falls back
+            logger.warning("on-demand managed-server boot failed", exc_info=True)
+        finally:
+            _KICK_LOCK.release()
+
+    threading.Thread(target=_boot, daemon=True,
+                     name="lr-on-demand-boot").start()
+
+
+def _boot_in_flight(config: dict | None) -> bool:
+    """True when the managed runtime is enabled and installed — the state
+    a lifespan boot thread is (or is about to be) bringing up.
+
+    Installed-ness is a verified-manifest scan under runtimes_root(), NOT a
+    server_binary() call — that helper requires an install_dir argument, and
+    calling it bare made this gate throw-and-return-False forever, silently
+    disabling the boot wait (the regression
+    test had monkeypatched this function instead of exercising it).
+    """
+    try:
+        if config is None:
+            from hermes_cli.config import load_config
+
+            config = load_config()
+        if not ((config or {}).get("local_runtime") or {}).get("enabled"):
+            return False
+        import json as _json
+
+        from hermes_cli.local_runtime.binaries import runtimes_root
+
+        for manifest in runtimes_root().glob("*/*/manifest.json"):
+            try:
+                if _json.loads(manifest.read_text(encoding="utf-8")).get("verified_version"):
+                    return True
+            except (ValueError, OSError):
+                continue
+        return False
+    except Exception:  # noqa: BLE001
+        return False
diff --git a/hermes_cli/local_runtime/estimator.py b/hermes_cli/local_runtime/estimator.py
new file mode 100644
index 0000000000..6778b88ed4
--- /dev/null
+++ b/hermes_cli/local_runtime/estimator.py
@@ -0,0 +1,179 @@
+"""Per-layer context-memory estimator + physics check.
+
+The whole-model dense formula misprices 1M-context hybrids by ~100x; the
+per-layer walk fixes that, and every column is measured on real GGUFs:
+
+- full-attention layer: linear in T          (B1: 144.0 KiB/tok on Qwen3-4B
+                                              f16 — formula-exact)
+- SWA layer: capped at the sliding window
+- recurrent layer (n_head_kv == 0): constant (state is ~context-free)
+- q8_0 KV = exactly 34/64 of f16 (holds on CUDA and CPU)
+- weights: exact from the tensor table (within 0.01% of the loader)
+
+The estimator is ADVISORY: fit's allocation is authoritative at launch and
+the touch generation is ground truth after it. Unknown shapes round UP
+(never underestimate memory).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import Enum
+
+from hermes_cli.local_runtime.gguf import GGUFHeader
+
+# q8_0: 34-byte blocks of 32 f16-equivalent elements (exact).
+_Q8_BYTES_PER_ELEM = 34 / 32
+_F16_BYTES_PER_ELEM = 2.0
+
+# Architectures with a known SWA layer pattern: arch -> fraction of layers
+# that are sliding-window. Unknown SWA archs conservatively treat every
+# layer as full attention (overestimate; safe direction).
+_SWA_LAYER_FRACTION = {"gemma3": 5 / 6, "gemma2": 1 / 2}
+
+# Per-recurrent-layer state allowance (bytes/seq). Deliberately generous —
+# Measured: an entire hybrid slot state is ~99 MB including 8K tokens of
+# full-attn KV, so tens of MiB total is the right order; unknown SSM shapes
+# must never underestimate.
+_RECURRENT_STATE_PER_LAYER = 4 << 20
+
+
+class LayerKind(Enum):
+    FULL = "full"
+    SWA = "swa"
+    RECURRENT = "recurrent"
+
+
+@dataclass
+class ModelProfile:
+    """Everything the policy needs, decoupled from GGUF parsing so the
+    decision-table tests can construct profiles directly (design's
+    verification plan)."""
+
+    name: str
+    weights_bytes: int
+    embd_table_bytes: int
+    n_ctx_train: int
+    layers: list[tuple[LayerKind, int]]   # (kind, kv_bytes_per_token_f16);
+                                          # SWA/recurrent reuse the same
+                                          # per-token figure, capped/ignored
+    swa_window: int = 0
+    moe: bool = False
+    architecture: str = ""
+    n_vocab: int = 0            # prices logits buffers (ubatch x vocab)
+    # Context-cost multiplier. MTP spec decode keeps a small draft
+    # context beside the main one. Calibrated against four measured
+    # server-RSS points on Qwen3.8 Q4 (128K/221K/256K, both postures):
+    # the draft adds ~17% to per-token KV; 1.2 rounds up so the error
+    # stays on the safe side (+250 MiB at 256K, never negative).
+    kv_scale: float = 1.0
+
+    @property
+    def per_token_kv_f16(self) -> int:
+        """Uncapped per-token KV cost (full + SWA share)."""
+        return sum(b for kind, b in self.layers if kind != LayerKind.RECURRENT)
+
+    @property
+    def recurrent_layer_count(self) -> int:
+        return sum(1 for kind, _ in self.layers if kind == LayerKind.RECURRENT)
+
+
+@dataclass
+class HardwareBudget:
+    """Memory the physics check may budget against.
+
+    Budget-source rule: discrete cards may trust the device query
+    (measured honest); unified-memory devices must budget from OS free
+    physical memory minus headroom — their device queries have been
+    observed off by 3x. Callers construct
+    this accordingly; the estimator just consumes it.
+    """
+
+    usable_vram_bytes: int      # live free (discrete) / derived (UMA)
+    total_device_bytes: int
+    ram_available_bytes: int
+    uma: bool = False
+
+
+def profile_from_gguf(header: GGUFHeader) -> ModelProfile:
+    kv_heads = header.head_counts_kv()
+    dk, dv = header.head_dim_k, header.head_dim_v
+    swa_fraction = _SWA_LAYER_FRACTION.get(header.architecture, 0.0)
+    has_swa = header.sliding_window > 0 and swa_fraction > 0
+
+    layers: list[tuple[LayerKind, int]] = []
+    n_attn_seen = 0
+    n_attn_total = sum(1 for h in kv_heads if h > 0)
+    n_swa = round(n_attn_total * swa_fraction) if has_swa else 0
+    for heads in kv_heads:
+        if heads == 0:
+            layers.append((LayerKind.RECURRENT, 0))
+            continue
+        per_token = round(heads * (dk + dv) * _F16_BYTES_PER_ELEM)
+        # Distribute the SWA share across the first n_swa attention layers;
+        # only the full/SWA SPLIT matters to the totals, not which indexes.
+        kind = LayerKind.SWA if n_attn_seen < n_swa else LayerKind.FULL
+        layers.append((kind, per_token))
+        n_attn_seen += 1
+
+    return ModelProfile(
+        name=header.path,
+        weights_bytes=header.tensor_bytes,
+        embd_table_bytes=header.embd_table_bytes,
+        n_ctx_train=header.n_ctx_train,
+        layers=layers,
+        swa_window=header.sliding_window,
+        moe=header.expert_count > 0,
+        architecture=header.architecture,
+        n_vocab=header.n_vocab,
+    )
+
+
+def kv_dtype_factor(flash_attention: bool) -> float:
+    """q8_0 with FA (every backend we ship); f16 on exotic non-FA fallbacks
+    — the 64K guarantee stands either way, the physics check just prices
+    the doubled KV (design: KV dtype is behavior, not config)."""
+    return (_Q8_BYTES_PER_ELEM / _F16_BYTES_PER_ELEM) if flash_attention else 1.0
+
+
+def ctx_bytes(profile: ModelProfile, window: int, *,
+              flash_attention: bool = True) -> int:
+    """Context memory for one window: full layers linear in T, SWA layers
+    capped at the sliding window, recurrent layers constant. Scaled by
+    profile.kv_scale (MTP draft context)."""
+    factor = kv_dtype_factor(flash_attention)
+    total = 0.0
+    for kind, per_token_f16 in profile.layers:
+        if kind == LayerKind.RECURRENT:
+            total += _RECURRENT_STATE_PER_LAYER
+        elif kind == LayerKind.SWA:
+            total += per_token_f16 * factor * min(window, profile.swa_window)
+        else:
+            total += per_token_f16 * factor * window
+    return int(total * profile.kv_scale)
+
+
+@dataclass
+class PhysicsRefusal:
+    """The only true refusal: weights + floor-KV + state exceed VRAM + RAM.
+    The remedy is a smaller quant, never a smaller window."""
+
+    needed_bytes: int
+    available_bytes: int
+    message: str
+
+
+def physics_check(profile: ModelProfile, budget: HardwareBudget,
+                  floor: int, *, flash_attention: bool = True) -> PhysicsRefusal | None:
+    needed = (profile.weights_bytes
+              + ctx_bytes(profile, min(floor, profile.n_ctx_train or floor),
+                          flash_attention=flash_attention))
+    available = budget.usable_vram_bytes + budget.ram_available_bytes
+    if needed > available:
+        gib = 1 << 30
+        return PhysicsRefusal(
+            needed_bytes=needed, available_bytes=available,
+            message=(f"{profile.name}: needs ~{needed / gib:.1f} GiB at the "
+                     f"{floor // 1024}K floor but only ~{available / gib:.1f} GiB "
+                     "of VRAM+RAM exist — try a smaller quant (UD-Q3/Q2)"))
+    return None
diff --git a/hermes_cli/local_runtime/gguf.py b/hermes_cli/local_runtime/gguf.py
new file mode 100644
index 0000000000..a5159b9d56
--- /dev/null
+++ b/hermes_cli/local_runtime/gguf.py
@@ -0,0 +1,220 @@
+"""GGUF metadata + tensor-table reader (stdlib only).
+
+Feeds the per-layer context estimator: architecture, layer count, per-layer
+KV head counts (0 = recurrent layer — the hybrid discriminator), head dims,
+sliding-window config, trained context, and exact weight bytes summed from
+the tensor table (validated to within 0.01% of the loader's buffer).
+
+Reads the header only (metadata + tensor infos); never touches tensor data,
+so it is fast enough to run at picker time on multi-GB files.
+"""
+
+from __future__ import annotations
+
+import struct
+from dataclasses import dataclass, field
+from pathlib import Path
+
+_GGUF_MAGIC = b"GGUF"
+
+# ggml tensor type sizes: type_id -> (block_bytes, block_elems).
+# IQ-family sizes verified against ggml-common.h.
+_GGML_TYPE_SIZES = {
+    0: (4, 1), 1: (2, 1), 2: (18, 32), 3: (20, 32), 6: (22, 32), 7: (24, 32),
+    8: (34, 32), 9: (36, 32), 10: (84, 256), 11: (110, 256), 12: (144, 256),
+    13: (176, 256), 14: (210, 256), 15: (292, 256), 16: (66, 256),
+    17: (74, 256), 18: (98, 256), 19: (50, 256), 20: (18, 32),
+    21: (110, 256), 22: (82, 256), 23: (136, 256), 24: (1, 1), 25: (2, 1),
+    26: (4, 1), 27: (8, 1), 28: (8, 1), 29: (56, 256), 30: (2, 1),
+}
+
+# GGUF metadata value types.
+_V_UINT8, _V_INT8, _V_UINT16, _V_INT16 = 0, 1, 2, 3
+_V_UINT32, _V_INT32, _V_FLOAT32, _V_BOOL = 4, 5, 6, 7
+_V_STRING, _V_ARRAY, _V_UINT64, _V_INT64, _V_FLOAT64 = 8, 9, 10, 11, 12
+
+_SCALAR_FMT = {
+    _V_UINT8: "<B", _V_INT8: "<b", _V_UINT16: "<H", _V_INT16: "<h",
+    _V_UINT32: "<I", _V_INT32: "<i", _V_FLOAT32: "<f", _V_BOOL: "<?",
+    _V_UINT64: "<Q", _V_INT64: "<q", _V_FLOAT64: "<d",
+}
+
+
+@dataclass
+class GGUFHeader:
+    path: str
+    version: int
+    metadata: dict = field(default_factory=dict)
+    n_tensors: int = 0
+    tensor_bytes: int = 0          # exact sum over the tensor table
+    embd_table_bytes: int = 0      # token_embd.weight (duplicated host-side
+                                   # when fully offloaded)
+
+    # ── typed accessors ──────────────────────────────────────
+
+    @property
+    def architecture(self) -> str:
+        return str(self.metadata.get("general.architecture", ""))
+
+    def _arch_key(self, suffix: str):
+        return self.metadata.get(f"{self.architecture}.{suffix}")
+
+    @property
+    def n_layer(self) -> int:
+        return int(self._arch_key("block_count") or 0)
+
+    @property
+    def n_vocab(self) -> int:
+        """Vocabulary size: prices the GPU logits buffers (they scale
+        ubatch x vocab). vocab_size metadata when present, else the
+        tokenizer list length."""
+        v = self._arch_key("vocab_size")
+        if v:
+            return int(v)
+        toks = self.metadata.get("tokenizer.ggml.tokens")
+        return len(toks) if isinstance(toks, list) else 0
+
+    @property
+    def n_ctx_train(self) -> int:
+        return int(self._arch_key("context_length") or 0)
+
+    @property
+    def sampling_defaults(self) -> dict:
+        """Upstream's recommended sampling, when the file carries it.
+
+        Model publishers bake general.sampling.* keys into the GGUF
+        (llama-server reads them as that model's default generation
+        settings), so the file itself is the source of truth for how its
+        publisher wants it run — it arrives with the download and updates
+        with every re-upload, no catalog required. Returned as preset INI
+        keys; empty when the file carries none.
+        """
+        ini_key = {"temp": "temp", "temperature": "temp", "top_p": "top-p",
+                   "top_k": "top-k", "min_p": "min-p",
+                   "repeat_penalty": "repeat-penalty",
+                   "presence_penalty": "presence-penalty"}
+        out = {}
+        for key, value in self.metadata.items():
+            if not key.startswith("general.sampling."):
+                continue
+            name = ini_key.get(key.rsplit(".", 1)[-1])
+            if name is not None and isinstance(value, (int, float)):
+                num = round(float(value), 4)
+                out[name] = str(int(num)) if num == int(num) else str(num)
+        return out
+
+    @property
+    def n_embd(self) -> int:
+        return int(self._arch_key("embedding_length") or 0)
+
+    @property
+    def n_head(self) -> int:
+        v = self._arch_key("attention.head_count")
+        if isinstance(v, list):
+            return int(max(v))
+        return int(v or 0)
+
+    @property
+    def full_attention_interval(self) -> int:
+        """GDN-hybrid discriminator (qwen35 family): every Nth layer is full
+        attention, the rest are linear/recurrent. 0 = not present."""
+        return int(self._arch_key("full_attention_interval") or 0)
+
+    def head_counts_kv(self) -> list[int]:
+        """Per-layer KV head counts; 0 marks a recurrent/linear layer (the
+        n_head_kv == 0 discriminator).
+
+        Three GGUF shapes, each verified against real files:
+        - per-layer array (nemotron_h_moe): use as-is;
+        - scalar + full_attention_interval (qwen35): the scalar applies to
+          every INTERVAL-th layer (1-indexed: layers where (i+1) % N == 0),
+          zero elsewhere — pricing all layers as attention was a 4x
+          overestimate on Qwen3.6-27B;
+        - plain scalar (dense): broadcast to every layer.
+        """
+        v = self._arch_key("attention.head_count_kv")
+        if isinstance(v, list):
+            return [int(x) for x in v]
+        scalar = int(v or 0)
+        interval = self.full_attention_interval
+        if interval > 1:
+            return [scalar if (i + 1) % interval == 0 else 0
+                    for i in range(self.n_layer)]
+        return [scalar] * self.n_layer
+
+    @property
+    def head_dim_k(self) -> int:
+        v = self._arch_key("attention.key_length")
+        if v:
+            return int(v)
+        return self.n_embd // self.n_head if self.n_head else 0
+
+    @property
+    def head_dim_v(self) -> int:
+        v = self._arch_key("attention.value_length")
+        if v:
+            return int(v)
+        return self.head_dim_k
+
+    @property
+    def sliding_window(self) -> int:
+        return int(self._arch_key("attention.sliding_window") or 0)
+
+    @property
+    def expert_count(self) -> int:
+        return int(self._arch_key("expert_count") or 0)
+
+
+def read_gguf_header(path: str | Path) -> GGUFHeader:
+    path = Path(path)
+
+    def read_str(f) -> str:
+        (n,) = struct.unpack("<Q", f.read(8))
+        return f.read(n).decode("utf-8", errors="replace")
+
+    def read_value(f, vtype: int):
+        if vtype == _V_STRING:
+            return read_str(f)
+        if vtype == _V_ARRAY:
+            (etype,) = struct.unpack("<I", f.read(4))
+            (n,) = struct.unpack("<Q", f.read(8))
+            return [read_value(f, etype) for _ in range(n)]
+        fmt = _SCALAR_FMT[vtype]
+        (value,) = struct.unpack(fmt, f.read(struct.calcsize(fmt)))
+        return value
+
+    with open(path, "rb") as f:
+        if f.read(4) != _GGUF_MAGIC:
+            raise ValueError(f"not a GGUF file: {path}")
+        (version,) = struct.unpack("<I", f.read(4))
+        n_tensors, n_kv = struct.unpack("<QQ", f.read(16))
+
+        metadata: dict = {}
+        for _ in range(n_kv):
+            key = read_str(f)
+            (vtype,) = struct.unpack("<I", f.read(4))
+            metadata[key] = read_value(f, vtype)
+
+        tensor_bytes = 0
+        embd_bytes = 0
+        for _ in range(n_tensors):
+            name = read_str(f)
+            (n_dims,) = struct.unpack("<I", f.read(4))
+            dims = struct.unpack(f"<{n_dims}Q", f.read(8 * n_dims))
+            (ttype,) = struct.unpack("<I", f.read(4))
+            f.read(8)  # offset
+            size = _GGML_TYPE_SIZES.get(ttype)
+            if size is None:
+                raise ValueError(f"unknown ggml tensor type {ttype} in {path}")
+            block_bytes, block_elems = size
+            elems = 1
+            for d in dims:
+                elems *= d
+            nbytes = (elems // block_elems) * block_bytes
+            tensor_bytes += nbytes
+            if name == "token_embd.weight":
+                embd_bytes = nbytes
+
+    return GGUFHeader(path=str(path), version=version, metadata=metadata,
+                      n_tensors=n_tensors, tensor_bytes=tensor_bytes,
+                      embd_table_bytes=embd_bytes)
diff --git a/hermes_cli/local_runtime/growth.py b/hermes_cli/local_runtime/growth.py
new file mode 100644
index 0000000000..484f2ff9f5
--- /dev/null
+++ b/hermes_cli/local_runtime/growth.py
@@ -0,0 +1,143 @@
+"""In-session context growth for the managed llama.cpp runtime.
+
+The live half of the window ladder (context_policy.growth_decision): when a
+session reaches the edge of its granted window, Hermes grows the window
+toward the model's native max INSTEAD of compressing. Compression becomes
+what the design says it is — the move of last resort, once the window is at
+native (or the speed floor / physics say stop).
+
+Mechanism: growth is re-prefill. A per-model window
+override is persisted, presets regenerate with the bigger window, the
+supervised server bounces, and the next request autoloads the model at the
+new window and re-prefills the conversation. Nothing about the Hermes
+conversation mutates — no prompt-cache or role-alternation risk; the whole
+operation is server-side.
+
+Scope guard: only a server THIS process supervises grows. Detected external
+servers and other-process supervisors keep their own policies.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def window_overrides_path():
+    from hermes_cli.local_runtime.binaries import runtimes_root
+
+    return runtimes_root() / "window_overrides.json"
+
+
+def load_window_overrides() -> dict:
+    """model_id -> granted window (int). Empty on any read problem."""
+    try:
+        with open(window_overrides_path(), encoding="utf-8") as fh:
+            data = json.load(fh)
+        return {str(k): int(v) for k, v in data.items()}
+    except Exception:  # noqa: BLE001
+        return {}
+
+
+def save_window_override(model_id: str, window: int) -> None:
+    overrides = load_window_overrides()
+    overrides[model_id] = int(window)
+    path = window_overrides_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(overrides, indent=1), encoding="utf-8")
+
+
+def clear_window_override(model_id: str) -> None:
+    """Drop a model's growth state (delete/re-download paths)."""
+    overrides = load_window_overrides()
+    if model_id in overrides:
+        del overrides[model_id]
+        window_overrides_path().write_text(
+            json.dumps(overrides, indent=1), encoding="utf-8")
+
+
+def is_managed_endpoint(base_url: str) -> bool:
+    """True when base_url is the server this process's state file points at."""
+    try:
+        from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+        state = _state_endpoint()
+        if state is None:
+            return False
+        return (base_url or "").rstrip("/") == str(
+            state.get("base_url", "")).rstrip("/")
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def maybe_grow_window(model_id: str, *, base_url: str, session_tokens: int,
+                      current_window: int,
+                      measured_decode_tok_s: float | None = None) -> int | None:
+    """One growth evaluation + execution. Returns the NEW window when the
+    ladder granted a bigger one, else None (hold / compress / not ours).
+
+    The caller sits at a request boundary by construction (the pre-API
+    compression gate), so re-prefill growth is safe at any call: the next
+    request rebuilds server state from scratch in the larger window —
+    nothing rewinds.
+    """
+    from hermes_cli.local_runtime.bootstrap import (
+        get_supervisor,
+        refresh_local_runtime,
+        staged_models,
+    )
+    from hermes_cli.local_runtime.context_policy import growth_decision
+    from hermes_cli.local_runtime.estimator import profile_from_gguf
+    from hermes_cli.local_runtime.gguf import read_gguf_header
+    from hermes_cli.local_runtime.hardware import probe_budget
+
+    sup = get_supervisor()
+    if sup is None or not is_managed_endpoint(base_url):
+        return None
+
+    gguf = next((p for p in staged_models()
+                 if p.stem.startswith(model_id) or model_id in p.stem), None)
+    if gguf is None:
+        return None
+
+    try:
+        profile = profile_from_gguf(read_gguf_header(gguf))
+    except (ValueError, OSError) as exc:
+        logger.debug("growth skip %s: unreadable gguf (%s)", model_id, exc)
+        return None
+
+    try:
+        server_idle = sup.is_idle(model_id)
+    except Exception:  # noqa: BLE001
+        server_idle = False
+
+    decision = growth_decision(
+        # Capacity budget, not live-free: growth executes via a server
+        # bounce, so the grown instance loads onto a freed card. Live-free
+        # here is distorted by the very model being grown — it reads its
+        # own residency as unavailable and vetoes rungs that fit.
+        profile, probe_budget(planning=True),
+        current_window=current_window,
+        session_tokens=session_tokens,
+        measured_decode_tok_s=measured_decode_tok_s,
+        server_idle=server_idle,
+        # The caller IS the occupancy signal: this runs from the agent's
+        # compression gate, which fired on its own threshold. Two
+        # separately-derived edges must not deadlock into
+        # compress-before-grow.
+        occupancy_confirmed=True,
+    )
+    if decision.action != "grow" or not decision.next_window:
+        logger.debug("growth %s: %s (%s)", model_id, decision.action, decision.reason)
+        return None
+
+    logger.info("context growth %s: %s", model_id, decision.reason)
+    save_window_override(model_id, decision.next_window)
+    if not refresh_local_runtime():
+        # The override still lands at the next boot; report no growth NOW
+        # so the caller compresses instead of overflowing a stale window.
+        logger.warning("growth %s: server refresh failed; compression proceeds", model_id)
+        return None
+    return decision.next_window
diff --git a/hermes_cli/local_runtime/hardware.py b/hermes_cli/local_runtime/hardware.py
new file mode 100644
index 0000000000..c6a316776d
--- /dev/null
+++ b/hermes_cli/local_runtime/hardware.py
@@ -0,0 +1,379 @@
+"""Live hardware budget probe.
+
+Budget-source rule: discrete cards may trust the device query (measured
+honest within rounding); unified-memory devices must budget from OS free
+physical memory minus headroom — their device queries have been observed
+off by 3x in both directions. The probe classifies the device and
+constructs the right HardwareBudget for the estimator.
+
+Vendor probe quirk (WDDM carve-out): on unified-memory NVIDIA devices
+under Windows, nvidia-smi answers from the legacy dedicated-VRAM
+carve-out — a fraction of the pool the CUDA allocator actually
+addresses uniformly at full bandwidth. The CUDA driver API is
+the tiebreaker: cuDeviceGetAttribute(INTEGRATED) is the vendor's own
+declaration and always wins — 1 budgets unified, 0 stays discrete no
+matter what any other number says. Only when the driver API is
+unreachable does the engine's --list-devices view apply, and then only
+behind two independent conditions no discrete card can meet.
+
+Every probe here must work under a stripped PATH — gateway and service
+sessions don't inherit the interactive environment. nvcuda/libcuda load
+through the system loader (PATH plays no part), so classification never
+depends on PATH; nvidia-smi resolves through an explicit candidate
+ladder (PATH first, then the driver's known install locations) and its
+absence only softens the live number, never the verdict.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+from hermes_cli.local_runtime.estimator import HardwareBudget
+
+logger = logging.getLogger(__name__)
+
+_GIB = 1 << 30
+# Reserve carved off the card before any grant: the desktop's own
+# co-residents (compositor, browser, Electron) measure ~2-2.5 GiB on a
+# working machine, and a window granted into that space demotes silently
+# under WDDM. 7% covers big cards; the 2 GiB floor is what the margin's
+# old 512 MiB floor failed to cover in practice (a 221K grant measured
+# 31.9/32.6 GiB with the desktop running — 'fits' by the math, demoted
+# in reality). Small cards give up window to this; spill mode is their
+# path to big models regardless.
+_MARGIN_FLOOR = 2 << 30
+_MARGIN_FRACTION = 0.09
+# UMA headroom: on unified-memory machines (Apple Silicon, unified-memory
+# NVIDIA) the model shares physical memory with the OS and every app, so
+# budget from RAM minus this fraction.
+_UMA_HEADROOM_FRACTION = 0.20
+
+# Engine-fallback gates for the unified-pool quirk — BOTH must hold, and
+# no discrete card can meet either: (1) the allocator's pool exceeds the
+# smi report by well past rounding/ECC slack (discrete cards agree within
+# ~2%; carve-out disagreement runs to whole multiples), and (2) the pool is
+# system-RAM-sized — a workstation card in a RAM-matched box fails (1)
+# because its smi and allocator AGREE, and a big discrete card in a
+# bigger box fails (2). The driver's INTEGRATED attribute, when
+# readable, bypasses both gates in whichever direction it points.
+_POOL_DISAGREEMENT_FACTOR = 1.5
+_POOL_RAM_FRACTION = 0.75
+
+# cuDeviceGetAttribute enum: device is integrated with host memory.
+_CU_DEVICE_ATTRIBUTE_INTEGRATED = 18
+
+# One probe per process once a device answers (silicon doesn't change);
+# a miss retries after this long so a runtime installed mid-session gets
+# picked up by the engine fallback.
+_POOL_NEGATIVE_TTL_S = 60.0
+_pool_probe_cache: tuple[float, "tuple[int, bool | None] | None"] | None = None
+
+# '  CUDA0: NVIDIA Example Device (1234-core Example GPU) (46464 MiB, 46284 MiB free)'
+# — greedy .* pins the LAST parenthesized group, so device names carrying
+# their own parentheses parse correctly.
+_DEVICE_LINE_RE = re.compile(r"CUDA\d+:.*\((\d+)\s*MiB,\s*\d+\s*MiB free\)\s*$")
+
+
+def _ram_bytes() -> tuple[int, int]:
+    """(total, available) physical memory, cross-platform stdlib."""
+    try:
+        import ctypes
+
+        class MEMORYSTATUSEX(ctypes.Structure):
+            _fields_ = [("dwLength", ctypes.c_ulong),
+                        ("dwMemoryLoad", ctypes.c_ulong),
+                        ("ullTotalPhys", ctypes.c_ulonglong),
+                        ("ullAvailPhys", ctypes.c_ulonglong),
+                        ("ullTotalPageFile", ctypes.c_ulonglong),
+                        ("ullAvailPageFile", ctypes.c_ulonglong),
+                        ("ullTotalVirtual", ctypes.c_ulonglong),
+                        ("ullAvailVirtual", ctypes.c_ulonglong),
+                        ("ullAvailExtendedVirtual", ctypes.c_ulonglong)]
+
+        stat = MEMORYSTATUSEX()
+        stat.dwLength = ctypes.sizeof(MEMORYSTATUSEX)
+        ctypes.windll.kernel32.GlobalMemoryStatusEx(ctypes.byref(stat))
+        return stat.ullTotalPhys, stat.ullAvailPhys
+    except (AttributeError, OSError):
+        pass
+    if sys.platform == "darwin":
+        # macOS getconf has no _PHYS_PAGES/_AVPHYS_PAGES (exit 64, "no such
+        # configuration parameter") — the POSIX branch below returns (0, 0)
+        # and every model reads unavailable. sysctl is the platform truth.
+        try:
+            total = int(subprocess.run(
+                ["/usr/sbin/sysctl", "-n", "hw.memsize"],
+                capture_output=True, text=True, timeout=5).stdout.strip() or 0)
+            if total <= 0:
+                return 0, 0
+            avail = total // 2  # conservative fallback
+            try:
+                out = subprocess.run(["/usr/bin/vm_stat"], capture_output=True,
+                                     text=True, timeout=5).stdout
+                page_m = re.search(r"page size of (\d+)", out)
+                page = int(page_m.group(1)) if page_m else 16384
+                pages = 0
+                # free + inactive + purgeable ≈ reclaimable-on-demand; the
+                # speculative pool is dropped by the OS under pressure too.
+                for key in ("Pages free", "Pages inactive", "Pages purgeable",
+                            "Pages speculative"):
+                    m = re.search(rf"{key}:\s+(\d+)\.", out)
+                    if m:
+                        pages += int(m.group(1))
+                if pages > 0:
+                    avail = pages * page
+            except (OSError, ValueError):
+                pass
+            return total, avail
+        except (OSError, ValueError):
+            return 0, 0
+    # POSIX
+    try:
+        page = int(subprocess.run(["getconf", "PAGE_SIZE"], capture_output=True,
+                                  text=True, timeout=5).stdout or 4096)
+        total = int(subprocess.run(["getconf", "_PHYS_PAGES"], capture_output=True,
+                                   text=True, timeout=5).stdout or 0) * page
+        avail = total // 2  # conservative when _AVPHYS is unavailable
+        try:
+            avail = int(subprocess.run(["getconf", "_AVPHYS_PAGES"],
+                                       capture_output=True, text=True,
+                                       timeout=5).stdout or 0) * page or avail
+        except (OSError, ValueError):
+            pass
+        return total, avail
+    except (OSError, ValueError):
+        return 0, 0
+
+
+# nvidia-smi lives at a fixed path under the driver install; PATH presence
+# varies by session type (services and gateways often run with a minimal
+# environment) and by driver generation (legacy NVSMI dir was never on
+# PATH). Resolution result is cached: the driver doesn't move mid-process.
+_smi_path_cache: "tuple[str | None] | None" = None
+
+
+def _nvidia_smi_path() -> str | None:
+    """Absolute path to nvidia-smi, or None. PATH first (respects user
+    overrides), then the driver's known install locations on Windows;
+    on Linux/WSL the PATH lookup is the whole ladder."""
+    global _smi_path_cache
+    if _smi_path_cache is not None:
+        return _smi_path_cache[0]
+    found = shutil.which("nvidia-smi")
+    if found is None and os.name == "nt":
+        windir = os.environ.get("SystemRoot", r"C:\Windows")
+        for candidate in (
+            # DCH drivers (every modern install) place it in System32.
+            Path(windir) / "System32" / "nvidia-smi.exe",
+            # Legacy standalone drivers used NVSMI, never on PATH.
+            Path(os.environ.get("ProgramFiles", r"C:\Program Files"))
+            / "NVIDIA Corporation" / "NVSMI" / "nvidia-smi.exe",
+        ):
+            if candidate.exists():
+                found = str(candidate)
+                break
+    _smi_path_cache = (found,)
+    return found
+
+
+def _nvidia_vram() -> tuple[int, int] | None:
+    """(total, free) MiB->bytes from nvidia-smi, or None."""
+    exe = _nvidia_smi_path()
+    if exe is None:
+        return None
+    try:
+        out = subprocess.run(
+            [exe, "--query-gpu=memory.total,memory.free",
+             "--format=csv,noheader,nounits"],
+            capture_output=True, text=True, timeout=10)
+        if out.returncode != 0 or not out.stdout.strip():
+            return None
+        total_mib, free_mib = (int(x) for x in out.stdout.strip().splitlines()[0].split(","))
+        return total_mib << 20, free_mib << 20
+    except (OSError, ValueError, subprocess.TimeoutExpired):
+        return None
+
+
+def _cuda_driver_pool() -> "tuple[int, bool | None] | None":
+    """(allocator_total_bytes, integrated_or_None) from the CUDA driver
+    API, or None when unreachable. ctypes against the driver's own DLL/SO
+    — no toolkit, no subprocess, ~ms. INTEGRATED is the vendor's own
+    unified-memory declaration; total is the pool the allocator will
+    actually hand out (on carve-out devices, several times what
+    nvidia-smi reports)."""
+    import ctypes
+
+    for name in ("nvcuda.dll", "libcuda.so.1", "libcuda.so"):
+        try:
+            cuda = ctypes.CDLL(name)
+            break
+        except OSError:
+            continue
+    else:
+        return None
+    try:
+        if cuda.cuInit(0) != 0:
+            return None
+        dev = ctypes.c_int()
+        if cuda.cuDeviceGet(ctypes.byref(dev), 0) != 0:
+            return None
+        total = ctypes.c_size_t()
+        getter = getattr(cuda, "cuDeviceTotalMem_v2", None) or cuda.cuDeviceTotalMem
+        if getter(ctypes.byref(total), dev) != 0 or total.value <= 0:
+            return None
+        integrated: bool | None = None
+        attr = ctypes.c_int()
+        if cuda.cuDeviceGetAttribute(
+                ctypes.byref(attr), _CU_DEVICE_ATTRIBUTE_INTEGRATED, dev) == 0:
+            integrated = bool(attr.value)
+        return total.value, integrated
+    except (OSError, AttributeError):
+        return None
+
+
+def _engine_device_pool() -> "tuple[int, bool | None] | None":
+    """(engine_total_bytes, None) from the installed runtime's own
+    --list-devices, or None. The fallback truth source when the driver
+    API is unreachable: asks the exact binary that will do the
+    allocating. Carries no integrated verdict — callers must gate it."""
+    try:
+        from hermes_cli.local_runtime.binaries import (
+            installed_tags,
+            runtimes_root,
+            server_binary,
+        )
+
+        tags = installed_tags()
+        if not tags:
+            return None
+        tag_dir = runtimes_root() / tags[0]
+        backend_dirs = [d for d in tag_dir.iterdir() if d.is_dir()]
+        if not backend_dirs:
+            return None
+        exe = server_binary(backend_dirs[0])
+        out = subprocess.run([str(exe), "--list-devices"], capture_output=True,
+                             text=True, timeout=30, cwd=str(exe.parent))
+        if out.returncode != 0:
+            return None
+        for line in (out.stdout + out.stderr).splitlines():
+            m = _DEVICE_LINE_RE.search(line)
+            if m:
+                return int(m.group(1)) << 20, None
+        return None
+    except Exception:  # noqa: BLE001 — a probe miss must never block budgeting
+        return None
+
+
+def _device_pool_view() -> "tuple[int, bool | None] | None":
+    """Best available allocator-side view, cached: a hit is permanent for
+    the process, a miss retries after a short TTL (the engine binary can
+    appear mid-session via a pane install)."""
+    global _pool_probe_cache
+    now = time.monotonic()
+    if _pool_probe_cache is not None:
+        stamp, view = _pool_probe_cache
+        if view is not None or now - stamp < _POOL_NEGATIVE_TTL_S:
+            return view
+    view = _cuda_driver_pool() or _engine_device_pool()
+    _pool_probe_cache = (now, view)
+    return view
+
+
+def _unified_pool_bytes(smi_total: int, ram_total: int) -> int | None:
+    """The real pool size when this NVIDIA device is unified memory behind
+    a WDDM carve-out, else None (trust nvidia-smi as ever).
+
+    The driver's INTEGRATED attribute decides when readable — in BOTH
+    directions (0 pins discrete even if the numbers look weird; a driver
+    that declares integrated is believed even at modest pool sizes). Only
+    an attribute-less view (engine fallback) needs the two numeric gates;
+    both must hold and no discrete card meets either.
+    """
+    view = _device_pool_view()
+    if view is None:
+        return None
+    pool, integrated = view
+    if integrated is False:
+        return None
+    if integrated is True:
+        return pool
+    if (smi_total > 0 and pool >= int(smi_total * _POOL_DISAGREEMENT_FACTOR)
+            and ram_total > 0 and pool >= int(ram_total * _POOL_RAM_FRACTION)):
+        return pool
+    return None
+
+
+def probe_budget(*, planning: bool = False) -> HardwareBudget:
+    """Construct the budget per the source rules above.
+
+    ``planning=False`` (default): LIVE budget — free VRAM right now. The
+    right input for launch-time fit decisions and growth re-grants.
+
+    ``planning=True``: CAPACITY budget — what this machine can run once
+    the runtime manages placement (total device memory minus the margin).
+    The right input for catalog pricing and quant selection: pricing
+    against live-free while a model is already loaded made every row read
+    'larger than your GPU memory' and degraded quant picks to Q2 on a
+    32 GiB card. The managed server
+    unloads/relaunches models itself, so at load time the capacity is
+    genuinely available.
+    """
+    ram_total, ram_avail = _ram_bytes()
+    vram = _nvidia_vram()
+
+    # Unified-memory NVIDIA: the CUDA allocator pool is the real
+    # capacity. Classification comes from the driver API/engine — it
+    # must not require nvidia-smi (stripped-PATH sessions lose smi but
+    # nvcuda loads via the system loader regardless). Crossing the
+    # carve-out costs nothing (effective bandwidth is flat through the
+    # boundary; smi's used/total merely saturate at it) — the carve-out
+    # is an OS accounting knob, not a GPU limit. Deliberately NOT
+    # clamped to OS RAM: carved-out memory is invisible to
+    # GlobalMemoryStatusEx (the OS reports correspondingly less total
+    # RAM), so a RAM clamp would throw away exactly the carved capacity.
+    unified = _unified_pool_bytes(vram[0] if vram else 0, ram_total)
+    if unified is not None:
+        logger.info(
+            "unified-memory NVIDIA device: allocator pool %.1f GiB "
+            "(nvidia-smi carve-out: %s); budgeting from the pool",
+            unified / _GIB,
+            f"{vram[0] / _GIB:.1f} GiB" if vram else "unavailable")
+        if planning:
+            base = unified
+        else:
+            # Live: dedicated-free plus what the OS can still give. smi's
+            # free saturates at the carve-out so this under-counts a bit —
+            # the safe direction (the pool edge is a measured soft cliff:
+            # decode collapses ~3.5x when concurrent demand hits it).
+            # Without smi, OS-available alone is the honest floor.
+            live = (vram[1] + ram_avail) if vram else ram_avail
+            base = min(unified, live)
+        usable = max(0, int(base * (1 - _UMA_HEADROOM_FRACTION)))
+        return HardwareBudget(usable_vram_bytes=usable,
+                              total_device_bytes=unified,
+                              ram_available_bytes=0, uma=True)
+
+    if vram is None:
+        # No NVIDIA device visible: Metal/Vulkan/CPU paths budget from RAM
+        # as UMA (Apple Silicon) — conservative for discrete AMD until a
+        # vendor probe lands (E3 hardware).
+        base = ram_total if planning else ram_avail
+        usable = max(0, int(base * (1 - _UMA_HEADROOM_FRACTION)))
+        return HardwareBudget(usable_vram_bytes=usable,
+                              total_device_bytes=ram_total,
+                              ram_available_bytes=0, uma=True)
+
+    total, free = vram
+    margin = max(_MARGIN_FLOOR, int(total * _MARGIN_FRACTION))
+    base = total if planning else free
+    return HardwareBudget(usable_vram_bytes=max(0, base - margin),
+                          total_device_bytes=total,
+                          ram_available_bytes=ram_avail if not planning else ram_total,
+                          uma=False)
diff --git a/hermes_cli/local_runtime/hf_browse.py b/hermes_cli/local_runtime/hf_browse.py
new file mode 100644
index 0000000000..e554ee1fc4
--- /dev/null
+++ b/hermes_cli/local_runtime/hf_browse.py
@@ -0,0 +1,161 @@
+"""Browse Hugging Face for GGUF models the user can run.
+
+The curated catalog is the front page; this module is the firehose behind
+it — day-0 models not yet in the catalog, community quants,
+anything. Three rules keep it safe and honest:
+
+1. Acquisition only. Nothing here serves a model: a browsed download
+   lands in the machine-scoped models dir and from that moment the
+   normal machinery owns it — staleness bounce, preset generation from
+   the real GGUF header, fit policy, placement pills.
+2. The fit verdict shown BEFORE download is a rough cut priced from file
+   size alone (weights dominate; KV/overhead use conservative fill-ins).
+   After download the GGUF header is the authority, as everywhere.
+3. HF is queried directly with short timeouts and a small in-process
+   cache. No third-party proxy service; if HF rate limits ever bite at
+   fleet scale, revisit with a caching proxy then.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+import time
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass, field
+
+logger = logging.getLogger(__name__)
+
+_HF = "https://huggingface.co"
+_TIMEOUT_S = 15
+# Rough-fit fill-ins for pre-download pricing: a mid-size model's 64K-floor
+# KV plus runtime overhead. Deliberately round numbers — the verdict bands
+# are coarse (fits GPU / needs RAM / too big), not window grants.
+_ROUGH_KV_AND_OVERHEAD = 4 << 30
+
+# Tiny TTL cache: the pane fires a search per keystroke pause and re-opens
+# repos the user flips between. Process-local, size-capped, no invalidation
+# subtleties — upstream truth changes slowly at this granularity.
+_CACHE: dict[str, tuple[float, object]] = {}
+_CACHE_TTL_S = 300
+_CACHE_MAX = 128
+
+
+def _get_json(url: str) -> object:
+    now = time.monotonic()
+    hit = _CACHE.get(url)
+    if hit and now - hit[0] < _CACHE_TTL_S:
+        return hit[1]
+    req = urllib.request.Request(url, headers={"User-Agent": "hermes-local-models"})
+    with urllib.request.urlopen(req, timeout=_TIMEOUT_S) as r:
+        data = json.load(r)
+    if len(_CACHE) >= _CACHE_MAX:
+        _CACHE.pop(min(_CACHE, key=lambda k: _CACHE[k][0]))
+    _CACHE[url] = (now, data)
+    return data
+
+
+@dataclass(frozen=True)
+class HFModelHit:
+    repo: str                   # e.g. "unsloth/Qwen3.8-27B-GGUF"
+    downloads: int
+    likes: int
+    updated: str                # ISO date from HF
+    gated: bool
+
+
+@dataclass(frozen=True)
+class HFFileGroup:
+    """One downloadable quant: a single GGUF or all parts of a split one."""
+
+    label: str                  # e.g. "Q4_K_M" or the file stem
+    paths: tuple[str, ...]      # repo-relative, split parts in order
+    total_bytes: int
+    fit: str = "unknown"        # fits-gpu | needs-ram | too-big | unknown
+
+
+_QUANT_RE = re.compile(
+    r"(?:IQ|Q)\d[_A-Z0-9]*|F16|BF16|F32", re.IGNORECASE)
+_SPLIT_RE = re.compile(r"-(\d{5})-of-(\d{5})\.gguf$", re.IGNORECASE)
+
+
+def search_models(query: str, limit: int = 20) -> list[HFModelHit]:
+    """Full-text search over HF models that ship GGUF files, most
+    downloaded first (the closest public signal to 'trending')."""
+    q = urllib.parse.quote(query.strip())
+    url = (f"{_HF}/api/models?search={q}&filter=gguf&sort=downloads"
+           f"&direction=-1&limit={max(1, min(int(limit), 50))}")
+    out: list[HFModelHit] = []
+    for m in _get_json(url):
+        out.append(HFModelHit(
+            repo=str(m.get("id", "")),
+            downloads=int(m.get("downloads") or 0),
+            likes=int(m.get("likes") or 0),
+            updated=str(m.get("lastModified") or ""),
+            gated=bool(m.get("gated")),
+        ))
+    return out
+
+
+def _quant_label(filename: str) -> str:
+    m = _QUANT_RE.search(filename)
+    return m.group(0).upper() if m else filename
+
+
+def repo_files(repo: str) -> list[HFFileGroup]:
+    """The servable GGUFs in a repo, grouped: split parts collapse into one
+    entry (first part is what llama.cpp loads), mmproj/draft companions are
+    excluded (they aren't standalone models). Largest quant first."""
+    url = f"{_HF}/api/models/{urllib.parse.quote(repo)}/tree/main?recursive=true"
+    files = _get_json(url)
+
+    singles: list[tuple[str, int]] = []
+    splits: dict[str, list[tuple[int, str, int]]] = {}
+    for f in files:
+        path = str(f.get("path", ""))
+        if not path.lower().endswith(".gguf"):
+            continue
+        name = path.rsplit("/", 1)[-1].lower()
+        if name.startswith("mmproj") or name.startswith("dspark") or "draft" in name:
+            continue
+        size = int(f.get("size") or 0)
+        m = _SPLIT_RE.search(path)
+        if m:
+            stem = path[: m.start()]
+            splits.setdefault(stem, []).append((int(m.group(1)), path, size))
+        else:
+            singles.append((path, size))
+
+    groups: list[HFFileGroup] = []
+    for path, size in singles:
+        groups.append(HFFileGroup(label=_quant_label(path), paths=(path,),
+                                  total_bytes=size))
+    for stem, parts in splits.items():
+        parts.sort()
+        groups.append(HFFileGroup(
+            label=_quant_label(stem),
+            paths=tuple(p for _, p, _ in parts),
+            total_bytes=sum(s for _, _, s in parts)))
+    groups.sort(key=lambda g: g.total_bytes, reverse=True)
+    return groups
+
+
+def rough_fit(total_bytes: int, budget) -> str:
+    """Coarse pre-download verdict from file size alone. The GGUF header
+    refines this after download; bands match the catalog pills' language.
+    File size ≈ in-memory weights for GGUF (mmap'd as-is)."""
+    need = total_bytes + _ROUGH_KV_AND_OVERHEAD
+    if need <= budget.usable_vram_bytes:
+        return "fits-gpu"
+    if need <= budget.usable_vram_bytes + budget.ram_available_bytes:
+        return "needs-ram"
+    return "too-big"
+
+
+def priced_repo_files(repo: str, budget) -> list[HFFileGroup]:
+    from dataclasses import replace
+
+    return [replace(g, fit=rough_fit(g.total_bytes, budget))
+            for g in repo_files(repo)]
diff --git a/hermes_cli/local_runtime/load_progress.py b/hermes_cli/local_runtime/load_progress.py
new file mode 100644
index 0000000000..379955c6e8
--- /dev/null
+++ b/hermes_cli/local_runtime/load_progress.py
@@ -0,0 +1,198 @@
+"""Live model-load progress from the managed llama-server router.
+
+llama-server's child processes emit per-tensor load progress
+({stages, current, value}, throttled upstream to ~200ms) which the
+router relays ONLY over its /models/sse stream — GET /models carries
+just the coarse status string. This module owns one lazy background
+watcher on that stream and keeps an in-memory snapshot other code can
+poll cheaply:
+
+    get_loading_progress() -> {model_id: {"stage", "value", "percent"}}
+
+"percent" is a composite across stages so a bar doesn't sprint 0->100
+once per stage: the text model dominates load time (its weights dwarf
+the mmproj/spec extras), so it gets the lion's share of the range and
+the extras split the remainder.
+
+The watcher starts on first call, reconnects with backoff (the router
+bounces on model download/eject), and never raises into callers — no
+router, no state file, or no SSE support (older engines) all read as
+"nothing loading". Safe from any process on the machine: the endpoint
+comes from the supervisor's machine-scoped state file.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+import time
+import urllib.request
+
+logger = logging.getLogger(__name__)
+
+_TEXT_STAGE_SHARE = 0.85     # composite range share for the text model
+_RECONNECT_DELAY_S = 3.0
+_STALE_ENTRY_TTL_S = 120.0   # a loading entry with no events this long is dead
+
+_lock = threading.Lock()
+_watcher: threading.Thread | None = None
+_snapshot: dict[str, dict] = {}
+
+
+def _composite_percent(stages: list[str], current: str, value: float) -> int:
+    """Map (stage, in-stage value) onto one 0-100 range, text-heavy."""
+    if not stages or current not in stages or len(stages) == 1:
+        return max(0, min(100, round(value * 100)))
+    extras = [s for s in stages if s != "text_model"]
+    extra_share = (1.0 - _TEXT_STAGE_SHARE) / len(extras) if extras else 0.0
+    offset = 0.0
+    for stage in stages:
+        share = _TEXT_STAGE_SHARE if stage == "text_model" else extra_share
+        if stage == current:
+            return max(0, min(100, round((offset + share * value) * 100)))
+        offset += share
+    return max(0, min(100, round(value * 100)))
+
+
+def _endpoint() -> "tuple[str, str] | None":
+    """(base_root, api_key) of the managed router, or None.
+
+    Resolved through the endpoint module's ownership-guarded reader, not
+    a raw state-file read: on the shared stable port, a foreign install's
+    server answers /health for anyone, and a raw read would attach this
+    watcher to someone else's SSE stream (or spin on 401s against it).
+    The guard's dead-pid check is the ownership proof."""
+    try:
+        from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+        state = _state_endpoint()
+        if state is None:
+            return None
+        base = str(state.get("base_url", "")).rsplit("/v1", 1)[0]
+        return (base, str(state.get("api_key", ""))) if base else None
+    except Exception:  # noqa: BLE001
+        return None
+
+
+def _apply_event(model: str, event: str, data: dict) -> None:
+    with _lock:
+        status = str(data.get("status", ""))
+        if event in ("status_change", "model_status") and status == "loading":
+            progress = data.get("progress") or {}
+            stages = [str(s) for s in (progress.get("stages") or [])]
+            current = str(progress.get("current", ""))
+            value = progress.get("value")
+            entry = _snapshot.setdefault(model, {"stage": "", "value": 0.0,
+                                                 "percent": 0, "ts": 0.0})
+            entry["ts"] = time.monotonic()
+            if current and isinstance(value, (int, float)):
+                entry["stage"] = current
+                entry["value"] = float(value)
+                entry["percent"] = _composite_percent(stages, current, float(value))
+        elif event in ("status_change", "model_status", "model_remove"):
+            # Any terminal status (loaded/unloaded/failed) ends the load.
+            if status != "loading":
+                _snapshot.pop(model, None)
+
+
+def _watch() -> None:
+    while True:
+        endpoint = _endpoint()
+        if endpoint is None:
+            with _lock:
+                _snapshot.clear()
+            time.sleep(_RECONNECT_DELAY_S)
+            continue
+        base, key = endpoint
+        try:
+            req = urllib.request.Request(
+                f"{base}/models/sse",
+                headers={"Authorization": f"Bearer {key}",
+                         "Accept": "text/event-stream"})
+            with urllib.request.urlopen(req, timeout=60) as r:
+                buf = b""
+                while True:
+                    chunk = r.read1(4096) if hasattr(r, "read1") else r.read(4096)
+                    if not chunk:
+                        break
+                    buf += chunk
+                    while b"\n" in buf:
+                        line, buf = buf.split(b"\n", 1)
+                        text = line.decode("utf-8", "replace").strip()
+                        if not text.startswith("data:"):
+                            continue
+                        try:
+                            msg = json.loads(text[5:].strip())
+                            _apply_event(str(msg.get("model", "")),
+                                         str(msg.get("event", "")),
+                                         msg.get("data") or {})
+                        except (json.JSONDecodeError, TypeError):
+                            continue
+        except Exception as exc:  # noqa: BLE001 — watcher must never die loud
+            logger.debug("load-progress SSE reconnecting: %s", exc)
+        # Stream ended (router bounce, timeout, error): loading entries from
+        # the dead connection are unverifiable — drop rather than freeze.
+        with _lock:
+            _snapshot.clear()
+        time.sleep(_RECONNECT_DELAY_S)
+
+
+def _ensure_watcher() -> None:
+    global _watcher
+    with _lock:
+        if _watcher is None or not _watcher.is_alive():
+            _watcher = threading.Thread(target=_watch, daemon=True,
+                                        name="llamacpp-load-progress")
+            _watcher.start()
+
+
+def get_loading_progress() -> dict[str, dict]:
+    """{model_id: {"stage", "value", "percent"}} for models loading right
+    now. Empty when nothing is loading (or nothing is knowable)."""
+    _ensure_watcher()
+    now = time.monotonic()
+    with _lock:
+        return {m: {"stage": e["stage"], "value": e["value"],
+                    "percent": e["percent"]}
+                for m, e in _snapshot.items()
+                if now - e["ts"] < _STALE_ENTRY_TTL_S}
+
+
+def get_prefill_progress(model: str) -> "dict | None":
+    """{"processed": tokens} while the managed server is prompt-processing
+    for ``model``, or None (idle, decoding, unreachable, or foreign server).
+
+    llama-server's /slots reports ``n_prompt_tokens_processed`` climbing in
+    real time during prefill, but exposes no total — callers supply their
+    own denominator (the request's estimated token count). Busiest
+    processing slot wins when several are active: a parallel small request
+    (title generation) freezes its counter during decode while a live
+    prefill keeps climbing past it. One authenticated HTTP call per poll;
+    every failure reads as "no prefill" — this is garnish, never load-
+    bearing.
+    """
+    ep = _endpoint()
+    if ep is None:
+        return None
+    base, key = ep
+    try:
+        from urllib.parse import quote
+
+        req = urllib.request.Request(
+            f"{base}/slots?model={quote(model)}",
+            headers={"Authorization": f"Bearer {key}"})
+        with urllib.request.urlopen(req, timeout=2) as r:
+            slots = json.loads(r.read())
+    except Exception:  # noqa: BLE001
+        return None
+    best = 0
+    for slot in slots if isinstance(slots, list) else []:
+        if not slot.get("is_processing"):
+            continue
+        try:
+            processed = int(slot.get("n_prompt_tokens_processed") or 0)
+        except (TypeError, ValueError):
+            continue
+        best = max(best, processed)
+    return {"processed": best} if best > 0 else None
diff --git a/hermes_cli/local_runtime/presets.py b/hermes_cli/local_runtime/presets.py
new file mode 100644
index 0000000000..a5aa96cfa3
--- /dev/null
+++ b/hermes_cli/local_runtime/presets.py
@@ -0,0 +1,265 @@
+"""Per-model preset generation (--models-preset INI) — the router-side
+carrier for context-policy launch decisions.
+
+The INI shape is what the router itself generates per child: a
+[model-id] section whose keys are long-form
+llama-server flag names without the leading dashes.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from pathlib import Path
+
+from hermes_cli.local_runtime.context_policy import (
+    RUNTIME_OVERHEAD_BYTES,
+    WindowDecision,
+    initial_window,
+    launch_args,
+    ub_logits_bytes,
+)
+from hermes_cli.local_runtime.estimator import (
+    HardwareBudget,
+    PhysicsRefusal,
+    profile_from_gguf,
+)
+from hermes_cli.local_runtime.gguf import read_gguf_header
+
+logger = logging.getLogger(__name__)
+
+# args list -> INI keys. Flags the policy owns; everything else stays out
+# of the preset (recipe sampling defaults merge in a later pass).
+_FLAG_TO_KEY = {
+    "-c": "ctx-size",
+    "-b": "batch-size",
+    "-ub": "ubatch-size",
+    "-ctk": "cache-type-k",
+    "-ctv": "cache-type-v",
+    "-fa": "flash-attn",
+    "-ot": "override-tensor",
+    "--spec-type": "spec-type",
+    "--spec-draft-n-max": "spec-draft-n-max",
+}
+
+
+@dataclass
+class PresetEntry:
+    model_id: str
+    window: int
+    spilled: bool
+    refusal: str | None = None
+    keys: dict[str, str] | None = None
+
+
+def _args_to_keys(args: list[str]) -> dict[str, str]:
+    keys: dict[str, str] = {}
+    i = 0
+    while i < len(args):
+        flag = args[i]
+        key = _FLAG_TO_KEY.get(flag)
+        if key is None:
+            i += 1
+            continue
+        keys[key] = args[i + 1]
+        i += 2
+    return keys
+
+
+def generate_presets(models_dir: Path, budget: HardwareBudget,
+                     preset_path: Path,
+                     mtp_capable: set[str] | None = None) -> list[PresetEntry]:
+    """Walk the staged models, run the launch decision per model, and
+    write one INI. Refused models get no section (the router simply won't
+    have policy for them; the picker surfaces the refusal + smaller-quant
+    suggestion from the returned entries).
+
+    Catalog-declared companions merge in here: sampling defaults (policy
+    keys always win), the vision projector when present, and a spec-decode
+    draft model iff the decision spilled — the rule: speculative
+    decode is a spill amplifier, so a resident draft accelerates a spilled
+    main model; a zero-spill model doesn't pay the draft's memory."""
+    from hermes_cli.local_runtime.bootstrap import assets_dir
+    from hermes_cli.local_runtime.catalog import find_entry_for_model
+
+    entries: list[PresetEntry] = []
+    sections: list[str] = []
+    for gguf in _staged_in(models_dir):
+        model_id = _strip_part(gguf.stem)
+        try:
+            header = read_gguf_header(gguf)
+            profile = profile_from_gguf(header)
+        except (ValueError, OSError) as exc:
+            logger.warning("preset skip %s: %s", gguf.name, exc)
+            continue
+        # Overhead beyond weights+KV: runtime buffers, the vision projector
+        # when this model ships one, and the logits buffers of whichever
+        # microbatch/MTP posture launch_args will choose — flag and price
+        # decided together, from the same facts.
+        hit = find_entry_for_model(model_id)
+        entry = hit[0] if hit is not None else None
+        is_mtp = (entry.mtp if entry is not None
+                  else model_id in (mtp_capable or set()))
+        if is_mtp and profile.kv_scale == 1.0:
+            # Header-derived profiles don't know about MTP's draft
+            # context; apply the calibrated KV multiplier here so the
+            # launch fit prices what the server will actually allocate.
+            import dataclasses
+
+            profile = dataclasses.replace(profile, kv_scale=1.2)
+        mmproj_bytes = 0
+        if entry is not None and entry.mmproj is not None:
+            mmproj_path = assets_dir() / entry.mmproj.local_name
+            if mmproj_path.exists():
+                mmproj_bytes = entry.mmproj.size_bytes
+        # MTP posture ladder — window first, prefill second: price the
+        # launch under both postures and keep whichever grants the larger
+        # window (the stacked posture's bigger compute buffer buys ~3x
+        # short-prompt prefill but costs ~2 GiB that would otherwise be
+        # window; measured at 256K the ub512 posture still prefills at
+        # 2.7K tok/s, so window wins ties only one way: never trade
+        # context away for prefill). Same window -> stacked.
+        mtp_prefill = False
+        logits_bytes = ub_logits_bytes(profile.n_vocab, mtp_capable=is_mtp)
+        if is_mtp:
+            stacked_logits = ub_logits_bytes(profile.n_vocab, mtp_capable=True,
+                                             mtp_prefill=True)
+            stacked_probe = initial_window(
+                profile, budget,
+                overhead_bytes=(RUNTIME_OVERHEAD_BYTES + mmproj_bytes
+                                + stacked_logits))
+            plain_probe = initial_window(
+                profile, budget,
+                overhead_bytes=(RUNTIME_OVERHEAD_BYTES + mmproj_bytes
+                                + logits_bytes))
+            if (not isinstance(stacked_probe, PhysicsRefusal)
+                    and not stacked_probe.spilled
+                    and (isinstance(plain_probe, PhysicsRefusal)
+                         or stacked_probe.window >= plain_probe.window)):
+                mtp_prefill = True
+                logits_bytes = stacked_logits
+        decision = initial_window(
+            profile, budget,
+            overhead_bytes=RUNTIME_OVERHEAD_BYTES + mmproj_bytes + logits_bytes)
+        if isinstance(decision, PhysicsRefusal):
+            entries.append(PresetEntry(model_id=model_id, window=0,
+                                       spilled=False, refusal=decision.message))
+            continue
+
+        # Session growth (growth.py): a persisted override lifts the launch
+        # window to where the ladder last grew it — capped at native, and
+        # only when physics still clears the bigger window on THIS boot's
+        # budget (a smaller-VRAM day re-fits honestly back down).
+        try:
+            from hermes_cli.local_runtime.estimator import ctx_bytes
+            from hermes_cli.local_runtime.growth import load_window_overrides
+
+            override = load_window_overrides().get(model_id)
+            native = profile.n_ctx_train or decision.window
+            if override and override > decision.window:
+                target = min(int(override), native)
+                kv = ctx_bytes(profile, target)
+                need = (profile.weights_bytes + kv
+                        + RUNTIME_OVERHEAD_BYTES + mmproj_bytes + logits_bytes)
+                if need <= budget.usable_vram_bytes + budget.ram_available_bytes:
+                    spill = max(0, need - budget.usable_vram_bytes)
+                    decision = WindowDecision(
+                        window=target, spill_bytes=spill,
+                        kv_on_gpu=kv <= budget.usable_vram_bytes,
+                        reasons=[f"grown window restored ({target // 1024}K)"])
+        except Exception as exc:  # noqa: BLE001 — overrides are advisory
+            logger.debug("window override skipped for %s: %s", model_id, exc)
+
+        # (entry and is_mtp resolved above, where the overhead was priced —
+        # the launch flags below MUST match that pricing.)
+        args = launch_args(profile, decision, mtp_capable=is_mtp,
+                           mtp_draft_depth=(entry.mtp_draft_depth
+                                            if entry is not None else 3),
+                           uma=budget.uma, mtp_prefill=mtp_prefill)
+        keys = _args_to_keys(args)
+
+        if entry is not None and is_mtp:
+            # Integrated-MTP targets sample on the backend, and so does
+            # the draft (pairing validated against the vendor's published
+            # llama.cpp recipes for these models).
+            keys["backend-sampling"] = "on"
+            keys["spec-draft-backend-sampling"] = "on"
+
+        # Sampling deference ladder, under the policy keys (policy wins
+        # on clash). The GGUF's own general.sampling.* metadata is the
+        # publisher's recommendation — it arrives with the file, updates
+        # with every re-upload, and covers models the catalog has never
+        # heard of. Catalog sampling applies only where the file is
+        # silent; a model carrying neither runs llama.cpp defaults.
+        for k, v in header.sampling_defaults.items():
+            keys.setdefault(k, v)
+        if entry is not None:
+            for k, v in (entry.sampling or {}).items():
+                keys.setdefault(k, v)
+            if entry.mmproj is not None:
+                mmproj_path = assets_dir() / entry.mmproj.local_name
+                if mmproj_path.exists():
+                    keys["mmproj"] = str(mmproj_path)
+            if entry.draft is not None and decision.spilled:
+                draft_path = assets_dir() / entry.draft.local_name
+                if draft_path.exists():
+                    keys["model-draft"] = str(draft_path)
+                    keys["spec-type"] = "draft-dspark"
+                    # Unsloth's measured cliff: acceptance 83% at 2-3
+                    # drafts, collapses at 4.
+                    keys["spec-draft-n-max"] = "3"
+
+        entries.append(PresetEntry(model_id=model_id, window=decision.window,
+                                   spilled=decision.spilled, keys=keys))
+        body = "\n".join(f"{k} = {v}" for k, v in keys.items())
+        sections.append(f"[{model_id}]\n{body}\n")
+
+    preset_path.parent.mkdir(parents=True, exist_ok=True)
+    preset_path.write_text("\n".join(sections), encoding="utf-8")
+    logger.info("wrote %d preset sections to %s", len(sections), preset_path)
+    return entries
+
+
+def read_preset_decisions(preset_path: Path | None = None) -> dict[str, PresetEntry]:
+    """The launch decisions the running server was actually given, read
+    back from the preset INI (the INI is the record — it's what spawned
+    the children). Missing/unparseable file returns {}."""
+    import configparser
+
+    if preset_path is None:
+        from hermes_cli.local_runtime.binaries import runtimes_root
+
+        preset_path = runtimes_root() / "presets.ini"
+    out: dict[str, PresetEntry] = {}
+    try:
+        parser = configparser.ConfigParser()
+        parser.read(preset_path, encoding="utf-8")
+        for section in parser.sections():
+            window = parser.getint(section, "ctx-size", fallback=0)
+            spilled = parser.has_option(section, "override-tensor")
+            out[section] = PresetEntry(model_id=section, window=window,
+                                       spilled=spilled)
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("preset read-back failed: %s", exc)
+    return out
+
+
+def _strip_part(stem: str) -> str:
+    import re
+
+    return re.sub(r"-\d{5}-of-\d{5}$", "", stem)
+
+
+def _staged_in(models_dir: Path) -> "list[Path]":
+    """Servable models in an arbitrary directory (split first-parts only) —
+    the validation harness points at non-default dirs."""
+    import re
+
+    part = re.compile(r"-(\d{5})-of-\d{5}\.gguf$")
+    out = []
+    for p in sorted(models_dir.glob("*.gguf")):
+        m = part.search(p.name)
+        if m and m.group(1) != "00001":
+            continue
+        out.append(p)
+    return out
diff --git a/hermes_cli/local_runtime/supervisor.py b/hermes_cli/local_runtime/supervisor.py
new file mode 100644
index 0000000000..44f162cf48
--- /dev/null
+++ b/hermes_cli/local_runtime/supervisor.py
@@ -0,0 +1,500 @@
+"""Supervision of one llama-server in router mode.
+
+The router process is ours (restart with backoff on crash); router children
+are its problem — child failures surface via GET /models exit_code, never
+auto-retried here.
+
+Readiness rules (each learned the hard way on real hardware):
+- health-200 is NOT readiness; every readiness claim requires a touch
+  generation (temp-0, expected token, generous budget, reasoning_content
+  scanned).
+- Always dial 127.0.0.1 — resolving localhost adds ~2s per request on
+  Windows via IPv6 fallback.
+- /metrics is opt-in (--metrics) and carries no KV-usage metric;
+  idleness = requests_processing == 0 and no slot is_processing.
+- The router's LRU eviction has no pin for the primary model: until an
+  upstream pin exists, keep_primary_loaded re-touches the primary after
+  any other model load.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import secrets
+import socket
+import subprocess
+import threading
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+from hermes_cli.local_runtime.binaries import server_binary, runtimes_root
+
+logger = logging.getLogger(__name__)
+
+TOUCH_PROMPT = "Reply with exactly one word: the capital of France."
+TOUCH_EXPECT = "paris"
+_RESTART_BACKOFF_S = (1, 5, 15, 60)
+
+
+def state_path() -> Path:
+    """Endpoint state for other Hermes processes (provider resolution reads
+    this to route llamacpp-alias requests at the managed server)."""
+    return runtimes_root() / "server.json"
+
+
+def _free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+# Default port for the managed server, chosen once and reused across
+# restarts. Sessions persist the resolved base_url; an ephemeral port
+# would strand every resumed session on a dead endpoint after each
+# restart. Deliberately NOT 8080 so we never collide with a user's own
+# llama-server/Ollama-adjacent stack.
+_DEFAULT_PORT = 18434
+
+
+def _stable_port() -> int:
+    """The stable default port, falling back to an ephemeral one only when
+    something else already listens there (and it isn't a leftover managed
+    server, which stop() would have cleaned up)."""
+    try:
+        with socket.socket() as s:
+            s.bind(("127.0.0.1", _DEFAULT_PORT))
+            return _DEFAULT_PORT
+    except OSError:
+        logger.warning(
+            "port %d busy; managed llama-server falling back to an ephemeral "
+            "port — existing sessions may need a model re-pick", _DEFAULT_PORT)
+        return _free_port()
+
+
+def _stable_api_key() -> str:
+    """One key for the life of the install, persisted beside the runtimes.
+
+    Endpoint identity must survive restarts as a UNIT — sessions persist the
+    resolved base_url + api_key, so a per-boot key strands every resumed
+    session on HTTP 401 exactly the way a per-boot port would strand them
+    on connection errors. Rotating it buys nothing: the key exists to stop
+    other loopback processes free-riding, and it lives on the same disk as
+    the state file that would leak it. Delete the file to rotate manually.
+    """
+    key_path = runtimes_root() / ".api_key"
+    try:
+        existing = key_path.read_text(encoding="utf-8").strip()
+        if len(existing) >= 16:
+            return existing
+    except OSError:
+        pass
+    key = secrets.token_urlsafe(24)
+    try:
+        key_path.parent.mkdir(parents=True, exist_ok=True)
+        key_path.write_text(key, encoding="utf-8")
+    except OSError as exc:
+        logger.warning("could not persist api key (%s); sessions will need "
+                       "a re-pick after restart", exc)
+    return key
+
+
+class LlamaServerSupervisor:
+    """Own one llama-server router process for the life of a Hermes session.
+
+    Usage::
+
+        sup = LlamaServerSupervisor(install_dir, models_dir)
+        sup.start()                     # spawn + wait healthy
+        sup.ensure_model_ready(name)    # load + touch-generate
+        ... sup.base_url is the /v1 endpoint, sup.api_key its key ...
+        sup.stop()
+    """
+
+    def __init__(self, install_dir: Path, models_dir: Path, *,
+                 models_max: int = 4, port: int | None = None,
+                 extra_args: list[str] | None = None,
+                 log_path: Path | None = None,
+                 preset_path: Path | None = None):
+        self.install_dir = Path(install_dir)
+        self.models_dir = Path(models_dir)
+        self.models_max = models_max
+        self.port = port or _stable_port()
+        self.api_key = _stable_api_key()
+        self.extra_args = list(extra_args or [])
+        self.log_path = log_path or (self.models_dir.parent / "logs" / "llama-server.log")
+        self.preset_path = preset_path
+        self.proc: subprocess.Popen | None = None
+        self.primary_model: str | None = None
+        self._restarts = 0
+        self._stopping = False
+        self._watchdog: threading.Thread | None = None
+        self._log_handle = None
+        self._idle_since: dict[str, float] = {}
+
+    # ── endpoints ────────────────────────────────────────────
+
+    @property
+    def base_url(self) -> str:
+        return f"http://127.0.0.1:{self.port}/v1"
+
+    def _url(self, route: str) -> str:
+        return f"http://127.0.0.1:{self.port}{route}"
+
+    def _request(self, route: str, body: dict | None = None, timeout_s: int = 30) -> dict:
+        req = urllib.request.Request(
+            self._url(route),
+            data=json.dumps(body).encode() if body is not None else None,
+            headers={"Content-Type": "application/json",
+                     "Authorization": f"Bearer {self.api_key}"},
+        )
+        with urllib.request.urlopen(req, timeout=timeout_s) as r:
+            raw = r.read()
+            return json.loads(raw) if raw else {}
+
+    # ── lifecycle ────────────────────────────────────────────
+
+    def _spawn(self) -> None:
+        exe = server_binary(self.install_dir)
+        cmd = [
+            str(exe),
+            "--host", "127.0.0.1",
+            "--port", str(self.port),
+            "--api-key", self.api_key,
+            "--models-dir", str(self.models_dir),
+            "--models-max", str(self.models_max),
+            # The residency contract at the layer that sees every message:
+            # a chat request to a staged-but-unloaded model loads it (slow
+            # first token) instead of failing with 'model not found' —
+            # without this flag, chat after an eject is a bare 400/404.
+            "--models-autoload",
+            "--metrics",          # opt-in flag; supervisor telemetry needs it
+            "--slots",            # /slots endpoint is also opt-in; is_idle reads it
+            "--no-webui",
+            "--jinja",
+            # Direct I/O on model load: bypasses the page cache, so a
+            # multi-GB load doesn't evict half the OS cache — measured
+            # faster loads on NVMe, and our router bounces (download/
+            # delete/activate) reload models often enough to care.
+            "-dio",
+        ]
+        if self.preset_path and self.preset_path.exists():
+            cmd += ["--models-preset", str(self.preset_path)]
+        cmd += [
+            *self.extra_args,
+        ]
+        self.log_path.parent.mkdir(parents=True, exist_ok=True)
+        if self._log_handle is not None:
+            # The crash-restart loop calls _spawn repeatedly; without
+            # closing the prior handle each restart leaks one fd.
+            try:
+                self._log_handle.close()
+            except Exception:  # noqa: BLE001 — best-effort
+                pass
+        self._log_handle = open(self.log_path, "a", encoding="utf-8", errors="replace")
+        self._log_handle.write(f"\n# spawn: {cmd}\n")
+        self._log_handle.flush()
+        # list-args, never a shell: spaced paths (user homes) must survive.
+        self.proc = subprocess.Popen(cmd, stdout=self._log_handle,
+                                     stderr=subprocess.STDOUT, cwd=str(exe.parent))
+        logger.info("llama-server router spawned pid=%s port=%s", self.proc.pid, self.port)
+        # State goes down at SPAWN, not after health: endpoint resolution
+        # treats a live-pid-but-not-yet-healthy server as "starting" rather
+        # than "unconfigured", so a readiness probe racing the boot doesn't
+        # throw the app back to onboarding (observed on first restart test).
+        self._write_state()
+
+    def start(self, timeout_s: int = 120) -> None:
+        self._stopping = False
+        self._spawn()
+        self._wait_health(timeout_s)
+        self._write_state()
+        self._watchdog = threading.Thread(target=self._watch, daemon=True,
+                                          name="llamacpp-supervisor")
+        self._watchdog.start()
+
+    def _write_state(self) -> None:
+        path = state_path()
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps({
+            "base_url": self.base_url,
+            "api_key": self.api_key,
+            "pid": self.proc.pid if self.proc else None,
+        }), encoding="utf-8")
+
+    def _wait_health(self, timeout_s: int) -> None:
+        deadline = time.monotonic() + timeout_s
+        while time.monotonic() < deadline:
+            if self.proc and self.proc.poll() is not None:
+                raise RuntimeError(
+                    f"llama-server exited rc={self.proc.returncode} during startup "
+                    f"(log: {self.log_path})")
+            try:
+                with urllib.request.urlopen(self._url("/health"), timeout=3) as r:
+                    if r.status == 200:
+                        return
+            except (urllib.error.URLError, OSError, TimeoutError):
+                pass
+            time.sleep(1)
+        raise TimeoutError(f"llama-server not healthy after {timeout_s}s (log: {self.log_path})")
+
+    def _watch(self) -> None:
+        """Restart the router (not its children) on crash, with backoff."""
+        while not self._stopping:
+            proc = self.proc
+            if proc is None:
+                return
+            rc = proc.poll()
+            if rc is None:
+                time.sleep(2)
+                continue
+            if self._stopping:
+                return
+            backoff = _RESTART_BACKOFF_S[min(self._restarts, len(_RESTART_BACKOFF_S) - 1)]
+            logger.warning("llama-server exited rc=%s; restart #%s in %ss",
+                           rc, self._restarts + 1, backoff)
+            time.sleep(backoff)
+            self._restarts += 1
+            try:
+                self._reap_orphaned_children()
+                self._spawn()
+                self._wait_health(120)
+                if self.primary_model:
+                    self.ensure_model_ready(self.primary_model)
+            except Exception as exc:  # noqa: BLE001
+                logger.error("llama-server restart failed: %s", exc)
+
+    def stop(self) -> None:
+        self._stopping = True
+        state_path().unlink(missing_ok=True)
+        if self.proc and self.proc.poll() is None:
+            self._terminate_tree(self.proc)
+        if self._log_handle:
+            self._log_handle.close()
+            self._log_handle = None
+
+    @staticmethod
+    def _terminate_tree(proc: subprocess.Popen) -> None:
+        """Terminate the router AND its model children.
+
+        The router spawns one child llama-server per loaded model, each
+        holding gigabytes of VRAM. Terminating only the router (on
+        Windows, TerminateProcess — no signal handlers, no cleanup pass)
+        orphans those children: the port goes quiet but the weights stay
+        resident, and the next spawn re-loads models alongside a ghost
+        still holding the memory. Enumerate children FIRST (the parent
+        must be alive to walk them), then terminate parent and children
+        together, escalating to kill for stragglers.
+        """
+        children: list = []
+        try:
+            import psutil
+
+            children = psutil.Process(proc.pid).children(recursive=True)
+        except Exception:  # noqa: BLE001 — no psutil view; still stop the router
+            children = []
+        proc.terminate()
+        for child in children:
+            try:
+                child.terminate()
+            except Exception:  # noqa: BLE001
+                pass
+        try:
+            proc.wait(timeout=15)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+        for child in children:
+            try:
+                if child.is_running():
+                    child.kill()
+            except Exception:  # noqa: BLE001
+                pass
+
+    def _reap_orphaned_children(self) -> None:
+        """Kill model children orphaned by a router crash, before respawn.
+
+        A crashed router can't clean up its children, and a dead parent
+        can't be walked — so match by identity instead: any process
+        running OUR llama-server binary whose parent is gone is an
+        orphan of a previous router. Their VRAM must come back before
+        the new router loads models next to the ghosts. External
+        llama-servers (different binary path) never match.
+        """
+        try:
+            import psutil
+
+            exe = str(server_binary(self.install_dir))
+        except Exception:  # noqa: BLE001
+            return
+        for p in psutil.process_iter(["exe", "ppid"]):
+            try:
+                if p.info.get("exe") != exe:
+                    continue
+                if self.proc is not None and p.pid == self.proc.pid:
+                    continue
+                ppid = p.info.get("ppid") or 0
+                if ppid and psutil.pid_exists(ppid):
+                    continue
+                logger.warning("reaping orphaned llama-server child pid=%s", p.pid)
+                p.kill()
+            except (psutil.NoSuchProcess, psutil.AccessDenied):
+                continue
+
+    # ── model management (router endpoints) ──────────────────
+
+    def models(self) -> dict:
+        """{model_id: status_value} from GET /models."""
+        data = self._request("/models")
+        return {m["id"]: m.get("status", {}).get("value", "unknown")
+                for m in data.get("data", [])}
+
+    def model_failures(self) -> dict:
+        """{model_id: exit_code} for children that died — surfaced to the
+        UI, never auto-retried (design: router children are its problem)."""
+        data = self._request("/models")
+        out = {}
+        for m in data.get("data", []):
+            status = m.get("status", {})
+            if status.get("value") == "failed" or status.get("exit_code"):
+                out[m["id"]] = status.get("exit_code")
+        return out
+
+    def load_model(self, model_id: str, timeout_s: int = 600) -> None:
+        self._request("/models/load", {"model": model_id}, timeout_s=timeout_s)
+
+    def unload_model(self, model_id: str) -> None:
+        """Free the child's VRAM now. Route existence verified empirically
+        on b10290 (POST /models/unload; bogus name -> 400 'model is not
+        found'). Momentary action: never touches primary_model — the
+        declaration is durable, an eject is not (residency design).
+
+        Settle before returning: for a few seconds after unload returns,
+        the router still routes to the dying child and answers chat with
+        500 'proxy error: Could not establish connection' (probed on
+        b10362). Waiting for the model to report unloaded means the next
+        message autoloads cleanly instead of racing the teardown.
+        """
+        self._request("/models/unload", {"model": model_id}, timeout_s=120)
+        deadline = time.monotonic() + 15
+        while time.monotonic() < deadline:
+            try:
+                if self.models().get(model_id) not in ("loaded", "ready", "unloading"):
+                    return
+            except Exception:  # noqa: BLE001
+                return
+            time.sleep(0.3)
+
+    # ── idle residency (non-primary models) ──────────────────
+
+    # A model that has gone quiet gets its VRAM back after this long. A
+    # constant, not a knob: long enough that an active conversation never
+    # trips it, short enough that a wandered-off session frees ~20 GiB
+    # within the hour. No exemptions (residency v2): demand reloads
+    # anything the user comes back to.
+    IDLE_UNLOAD_S = 15 * 60
+
+    def sweep_idle(self, now: float | None = None) -> list[str]:
+        """Unload models idle past IDLE_UNLOAD_S. Returns the model ids
+        unloaded. Idle means no busy slots and no queued work, tracked
+        per model across calls; a model seen busy resets its clock."""
+        now = time.monotonic() if now is None else now
+        unloaded: list[str] = []
+        try:
+            statuses = self.models()
+        except Exception:  # noqa: BLE001
+            return unloaded
+        for model_id, status in statuses.items():
+            if status not in ("loaded", "ready"):
+                self._idle_since.pop(model_id, None)
+                continue
+            if not self.is_idle(model_id):
+                self._idle_since.pop(model_id, None)
+                continue
+            first_idle = self._idle_since.setdefault(model_id, now)
+            if now - first_idle >= self.IDLE_UNLOAD_S:
+                try:
+                    self.unload_model(model_id)
+                    self._idle_since.pop(model_id, None)
+                    unloaded.append(model_id)
+                    logger.info("idle-unloaded %s (idle %ds)", model_id,
+                                int(now - first_idle))
+                except Exception as exc:  # noqa: BLE001
+                    logger.warning("idle unload of %s failed: %s", model_id, exc)
+        return unloaded
+
+    def touch_generate(self, model_id: str, timeout_s: int = 300) -> bool:
+        """The readiness proof. Generous budget + reasoning_content scan —
+        small token budgets false-fail reasoning models, which spend their
+        first tokens thinking."""
+        try:
+            resp = self._request("/v1/chat/completions", {
+                "model": model_id,
+                "messages": [{"role": "user", "content": TOUCH_PROMPT}],
+                "max_tokens": 512, "temperature": 0,
+            }, timeout_s=timeout_s)
+            msg = resp["choices"][0]["message"]
+            blob = (msg.get("content") or "") + " " + (msg.get("reasoning_content") or "")
+            return TOUCH_EXPECT in blob.lower()
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("touch generation failed for %s: %s", model_id, exc)
+            return False
+
+    def ensure_model_ready(self, model_id: str, timeout_s: int = 600) -> bool:
+        """Load if needed, then prove readiness with a touch generation."""
+        status = self.models().get(model_id)
+        if status is None:
+            raise KeyError(f"model {model_id} not present in models dir")
+        if status not in ("loaded", "ready"):
+            self.load_model(model_id, timeout_s=timeout_s)
+        return self.touch_generate(model_id)
+
+    def actual_n_ctx(self, model_id: str) -> int | None:
+        """/props reconciliation: the granted window as the child reports
+        it — the compressor's budget and the picker's 'running at 87K of
+        262K' both read THIS value, never the request (design step 4)."""
+        try:
+            props = self._request(f"/props?model={model_id}")
+            return props.get("default_generation_settings", {}).get("n_ctx")
+        except Exception:  # noqa: BLE001
+            return None
+
+    def keep_primary_loaded(self) -> None:
+        """The router's LRU eviction has no pin, so after any other load
+        re-touch the primary to keep it most-recently-used. Best-effort
+        under bursty multi-model load — replaced when an upstream pin
+        exists."""
+        if self.primary_model and self.models().get(self.primary_model) in (
+                "loaded", "ready"):
+            self.touch_generate(self.primary_model, timeout_s=60)
+
+    # ── telemetry ────────────────────────────────────────────
+
+    def is_idle(self, model_id: str | None = None) -> bool:
+        """No processing requests and no busy slots. Router quirk: /slots
+        and /metrics are per-child and require ?model= (bare calls 400),
+        and no KV-usage metric exists. With ``model_id`` checks that one
+        child; without, every loaded child."""
+        try:
+            if model_id is not None:
+                loaded = [model_id]
+            else:
+                loaded = [m for m, status in self.models().items()
+                          if status in ("loaded", "ready")]
+            for mid in loaded:
+                slots = self._request(f"/slots?model={mid}")
+                if any(s.get("is_processing") for s in slots):
+                    return False
+                req = urllib.request.Request(
+                    self._url(f"/metrics?model={mid}"),
+                    headers={"Authorization": f"Bearer {self.api_key}"})
+                with urllib.request.urlopen(req, timeout=10) as r:
+                    text = r.read().decode()
+                for line in text.splitlines():
+                    if line.startswith("llamacpp:requests_processing"):
+                        if float(line.split()[-1]) != 0.0:
+                            return False
+            return True
+        except Exception:  # noqa: BLE001
+            return False
diff --git a/hermes_cli/loops.py b/hermes_cli/loops.py
index 92cdefdfe3..04e8dc7c02 100644
--- a/hermes_cli/loops.py
+++ b/hermes_cli/loops.py
@@ -768,6 +768,18 @@ class LoopManager:
                     "reason": s.last_stop_reason,
                     "message": f"✓ Loop finished after {s.ticks_fired} tick{'s' if s.ticks_fired != 1 else ''} — {reason}",
                 }
+            if verdict == "blocked":
+                # Judge ruled the stop condition unachievable — don't spin
+                # until the tick budget; pause so the user can re-scope.
+                s.status = "paused"
+                s.paused_reason = f"stop condition judged unachievable: {reason}"
+                save_loop(self.session_id, s)
+                return {
+                    "status": "paused",
+                    "stopped": True,
+                    "reason": s.paused_reason,
+                    "message": f"⏸ Loop paused — {s.paused_reason}. /loop resume to keep going, /loop stop to end it.",
+                }
 
         # 3. --times user cap.
         if s.times and s.ticks_fired >= s.times:
diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 6ef648af25..52a2f92d4e 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -462,6 +462,7 @@ import shutil
 import stat
 import subprocess
 import tempfile
+import time as _time_mod
 from pathlib import Path
 from typing import Optional
 
@@ -499,7 +500,7 @@ from hermes_cli.subcommands.skin import build_skin_parser
 from hermes_cli.subcommands.console import build_console_parser
 from hermes_cli.subcommands.update import build_update_parser
 from hermes_cli.subcommands.uninstall import build_uninstall_parser
-from hermes_cli.subcommands.dashboard import build_dashboard_parser
+from hermes_cli.subcommands.dashboard import build_dashboard_parser, build_serve_parser
 from hermes_cli.subcommands.gui import build_gui_parser
 from hermes_cli.subcommands.logs import build_logs_parser
 from hermes_cli.subcommands.prompt_size import build_prompt_size_parser
@@ -1053,8 +1054,14 @@ def _relative_time(ts) -> str:
     return relative_time(ts)
 
 
-def _has_any_provider_configured() -> bool:
-    """Check if at least one inference provider is usable."""
+def _has_any_provider_configured(*, strict_profile_scope: bool = False) -> bool:
+    """Check if at least one inference provider is usable.
+
+    ``strict_profile_scope``: the caller has bound a NAMED profile's home and
+    secret scope and wants an answer for that profile only — launch-process
+    env and host-wide fallbacks (gh auth, Claude Code credentials) must not
+    make it appear ready. Unscoped callers keep the legacy behavior.
+    """
     from hermes_cli.config import get_env_path, get_hermes_home, load_config
     from hermes_cli.auth import get_auth_status
 
@@ -1097,7 +1104,13 @@ def _has_any_provider_configured() -> bool:
     for pconfig in PROVIDER_REGISTRY.values():
         if pconfig.auth_type == "api_key":
             provider_env_vars.update(pconfig.api_key_env_vars)
-    if any(os.getenv(v) for v in provider_env_vars):
+    if strict_profile_scope:
+        from agent.secret_scope import current_secret_scope
+
+        read_provider_env = (current_secret_scope() or {}).get
+    else:
+        read_provider_env = os.getenv
+    if any(read_provider_env(v) for v in provider_env_vars):
         return True
 
     # Check .env file for keys
@@ -1129,7 +1142,10 @@ def _has_any_provider_configured() -> bool:
 
             auth = json.loads(auth_file.read_text(encoding="utf-8-sig"))
             active = auth.get("active_provider")
-            if active:
+            active_config = PROVIDER_REGISTRY.get(str(active or "").strip().lower())
+            if active and not (
+                strict_profile_scope and active_config and active_config.auth_type == "api_key"
+            ):
                 status = get_auth_status(active)
                 if status.get("logged_in"):
                     return True
@@ -1148,20 +1164,21 @@ def _has_any_provider_configured() -> bool:
             return True
 
     # Check provider-specific auth fallbacks (for example, Copilot via gh auth).
-    try:
-        for provider_id, pconfig in PROVIDER_REGISTRY.items():
-            if pconfig.auth_type != "api_key":
-                continue
-            status = get_auth_status(provider_id)
-            if status.get("logged_in"):
-                return True
-    except Exception:
-        pass
+    if not strict_profile_scope:
+        try:
+            for provider_id, pconfig in PROVIDER_REGISTRY.items():
+                if pconfig.auth_type != "api_key":
+                    continue
+                status = get_auth_status(provider_id)
+                if status.get("logged_in"):
+                    return True
+        except Exception:
+            pass
 
     # Check for Claude Code OAuth credentials (~/.claude/.credentials.json)
     # Only count these if Hermes has been explicitly configured — Claude Code
     # being installed doesn't mean the user wants Hermes to use their tokens.
-    if _has_hermes_config:
+    if _has_hermes_config and not strict_profile_scope:
         try:
             from agent.anthropic_adapter import (
                 read_claude_code_credentials,
@@ -5219,6 +5236,7 @@ _LAZY_COMMAND_EXPORTS = {
         "_sync_with_upstream_if_needed",
         "_update_node_dependencies",
         "_update_via_zip",
+        "_warn_orphaned_update_autostashes",
         "_upgrade_pip_before_lazy_refresh",
         "_validate_critical_files_syntax",
         "_validate_critical_modules_import",
@@ -6993,7 +7011,15 @@ def _write_desktop_build_stamp(project_root: Path, *, source_mode: bool) -> None
 
 def _desktop_packaged_executable(desktop_dir: Path) -> Optional[Path]:
     """Return the current platform's unpacked Electron app executable."""
-    release_dir = desktop_dir / "release"
+    return _desktop_packaged_executable_in(desktop_dir / "release")
+
+
+def _desktop_packaged_executable_in(release_dir: Path) -> Optional[Path]:
+    """Return the unpacked Electron app executable under *release_dir*.
+
+    *release_dir* is electron-builder's ``directories.output`` — the live
+    ``apps/desktop/release`` or a stage-and-swap staging dir (#86443).
+    """
     if sys.platform == "darwin":
         candidates = list(release_dir.glob("mac*/Hermes.app/Contents/MacOS/Hermes"))
     elif sys.platform == "win32":
@@ -7027,6 +7053,91 @@ def _desktop_packaged_executable(desktop_dir: Path) -> Optional[Path]:
     return max(existing, key=lambda p: p.stat().st_mtime)
 
 
+# ─── Desktop stage-and-swap pack (#86443) ───────────────────────────────────
+#
+# electron-builder packs IN PLACE: before-pack.mjs wipes ``release/<platform>-
+# unpacked`` (or the mac ``Hermes.app``) and the Electron unpack + asar + rename
+# then rebuild it. Any failure after that wipe — corrupt cached zip, blocked
+# download, missing dep, disk full — leaves the user with NO app, and
+# ``hermes update`` used to report "partially complete" over an empty
+# release/. Fix the class, not the predicate: build into a STAGING output
+# dir next to release/, verify the staged result, and only then swap it over
+# the live tree with renames. On any failure the live app is untouched.
+
+_DESKTOP_STAGING_PREFIX = ".staging-"
+_DESKTOP_PREVIOUS_SUFFIX = ".previous"
+
+
+def _desktop_staging_dir(desktop_dir: Path) -> Path:
+    """Fresh, unique staging output dir: ``apps/desktop/.staging-<pid>-<ts>``.
+
+    A sibling of ``release/`` (same filesystem → the swap is a rename, not a
+    copy) but NOT inside it, so nothing globbing ``release/*-unpacked`` or
+    ``release/mac*`` can mistake the half-built tree for the live app.
+    Leftovers from a killed earlier build are swept first (best-effort).
+    """
+    for stale in desktop_dir.glob(f"{_DESKTOP_STAGING_PREFIX}*"):
+        shutil.rmtree(stale, ignore_errors=True)
+    return desktop_dir / f"{_DESKTOP_STAGING_PREFIX}{os.getpid()}-{int(_time_mod.time())}"
+
+
+def _desktop_unpacked_root(exe: Path, release_dir: Path) -> Path:
+    """The directory directly under *release_dir* that holds *exe*
+    (``linux-unpacked``, ``win-unpacked``, ``mac-arm64``…) — electron-builder's
+    ``appOutDir``, the unit that gets swapped as a whole."""
+    unpacked = exe
+    while unpacked.parent != release_dir:
+        if unpacked.parent == unpacked:
+            raise ValueError(f"{exe} is not under {release_dir}")
+        unpacked = unpacked.parent
+    return unpacked
+
+
+def _swap_staged_desktop_app(desktop_dir: Path, staging_dir: Path) -> Optional[Path]:
+    """Promote a VERIFIED staged pack over the live ``release/`` app.
+
+    ``release/<unpacked>`` → ``release/<unpacked>.previous``,
+    ``<staging>/<unpacked>`` → ``release/<unpacked>``, then drop ``.previous``.
+    Two renames; the only window with no live app is between them, and a
+    failure there rolls ``.previous`` back. Returns the live executable, or
+    ``None`` (live app untouched or restored) when the swap could not happen.
+    Best-effort cleanup of the staging dir; never raises.
+    """
+    staged_exe = _desktop_packaged_executable_in(staging_dir)
+    if staged_exe is None:
+        shutil.rmtree(staging_dir, ignore_errors=True)
+        return None
+    release_dir = desktop_dir / "release"
+    try:
+        staged_root = _desktop_unpacked_root(staged_exe, staging_dir)
+        live_root = release_dir / staged_root.name
+        previous = release_dir / (staged_root.name + _DESKTOP_PREVIOUS_SUFFIX)
+        release_dir.mkdir(parents=True, exist_ok=True)
+        shutil.rmtree(previous, ignore_errors=True)
+        moved_aside = False
+        if live_root.exists():
+            os.rename(live_root, previous)
+            moved_aside = True
+        try:
+            os.rename(staged_root, live_root)
+        except OSError:
+            if moved_aside:
+                os.rename(previous, live_root)  # restore; live app back as it was
+            raise
+        if moved_aside:
+            shutil.rmtree(previous, ignore_errors=True)
+    except (OSError, ValueError) as exc:
+        logger.warning("desktop stage-and-swap failed, live app kept: %s", exc)
+        return None
+    finally:
+        shutil.rmtree(staging_dir, ignore_errors=True)
+    return live_root / staged_exe.relative_to(staged_root)
+
+
+def _discard_desktop_staging(staging_dir: Path) -> None:
+    shutil.rmtree(staging_dir, ignore_errors=True)
+
+
 # ─── Desktop exe integrity gate (#69179) ────────────────────────────────────
 #
 # The desktop self-update chain (Desktop → hermes-setup --update →
@@ -7343,8 +7454,10 @@ def _ensure_desktop_exe_launchable(
 
     # Self-heal setup for the retry: drop the (likely corrupt) cached Electron
     # zip and the content stamp so the next rebuild is a genuine re-download +
-    # re-stage rather than a replay of the same broken extraction.
-    _purge_electron_build_cache(desktop_dir)
+    # re-stage rather than a replay of the same broken extraction. Only the
+    # exe's OWN output dir is purged (a stage-and-swap staging dir, #86443),
+    # never the live release/ tree that still holds the last working app.
+    _purge_electron_build_cache(desktop_dir, release_dir=packaged_executable.parent.parent)
     try:
         _desktop_stamp_path().unlink()
     except OSError:
@@ -7400,7 +7513,9 @@ def _electron_download_cache_dirs() -> list[Path]:
     return out
 
 
-def _purge_electron_build_cache(desktop_dir: Path) -> list[Path]:
+def _purge_electron_build_cache(
+    desktop_dir: Path, release_dir: Optional[Path] = None
+) -> list[Path]:
     """Clear the cached Electron download + half-written unpacked dir so the
     next ``pack`` re-downloads and re-stages from scratch.
 
@@ -7446,8 +7561,11 @@ def _purge_electron_build_cache(desktop_dir: Path) -> list[Path]:
     # Drop the half-written unpacked dir too: an interrupted prior pack leaves
     # a partial tree that poisons the rename even after the zip is fixed.
     # (before-pack.cjs also handles this, but clearing it here makes the retry
-    # robust even if the hook is somehow skipped.)
-    release_dir = desktop_dir / "release"
+    # robust even if the hook is somehow skipped.) ``release_dir`` lets a
+    # stage-and-swap caller point this at its STAGING output so a mid-retry
+    # purge never touches the live app under ``release/`` (#86443).
+    if release_dir is None:
+        release_dir = desktop_dir / "release"
     if release_dir.is_dir():
         for unpacked in release_dir.glob("*-unpacked"):
             try:
@@ -7826,6 +7944,7 @@ def _desktop_macos_relaunchable_fixup(
     desktop_dir: Path,
     *,
     publisher_signing_configured: Optional[bool] = None,
+    release_dir: Optional[Path] = None,
 ) -> bool:
     """Make a locally-built macOS desktop app survive in-place self-update
     without resetting the user's TCC permission grants.
@@ -7857,7 +7976,9 @@ def _desktop_macos_relaunchable_fixup(
         )
     if publisher_signing_configured:
         return True
-    exe = _desktop_packaged_executable(desktop_dir)
+    # ``release_dir`` (stage-and-swap, #86443): sign the STAGED bundle before
+    # it is promoted, so the live app is never touched mid-sign.
+    exe = _desktop_packaged_executable_in(release_dir or (desktop_dir / "release"))
     if exe is None:
         return True
     # exe = .../Hermes.app/Contents/MacOS/Hermes  ->  app bundle = .../Hermes.app
@@ -8539,7 +8660,16 @@ def cmd_gui(args: argparse.Namespace):
                 print("  → No Developer ID configured; ad-hoc signing this local rebuild "
                       "(CSC_IDENTITY_AUTO_DISCOVERY=false)")
             npm_build_env = _npm_lifecycle_env(env)
+            # Stage-and-swap (#86443): electron-builder packs IN PLACE and
+            # before-pack.mjs wipes release/<unpacked> first, so a pack that
+            # fails afterwards used to leave the user with NO app. Build into
+            # a fresh staging output dir instead; the live release/ tree is
+            # only replaced — by rename — after the staged result verifies.
+            staging_dir: Optional[Path] = None
+            build_cmd = [npm, "run", build_script]
             if not source_mode:
+                staging_dir = _desktop_staging_dir(desktop_dir)
+                build_cmd += ["--", f"-c.directories.output={staging_dir}"]
                 # A running desktop instance launched from release/win-unpacked
                 # holds Hermes.exe locked on Windows, so the pack can't replace
                 # it ("Access is denied" / ERR_ELECTRON_BUILDER_CANNOT_EXECUTE).
@@ -8548,13 +8678,17 @@ def cmd_gui(args: argparse.Namespace):
                 stopped = _stop_desktop_processes_locking_build(desktop_dir)
                 if stopped:
                     print(f"  ⚠ Stopped running desktop app to free the build output (pid {', '.join(map(str, stopped))})")
+
+            def _staged_exe() -> Optional[Path]:
+                return _desktop_packaged_executable_in(staging_dir) if staging_dir else None
+
             build_result = subprocess.run(
-                [npm, "run", build_script], cwd=desktop_dir, env=npm_build_env, check=False
+                build_cmd, cwd=desktop_dir, env=npm_build_env, check=False
             )
             if (
                 build_result.returncode != 0
                 and not source_mode
-                and _desktop_packaged_executable(desktop_dir) is None
+                and _staged_exe() is None
             ):
                 # Corrupt cached Electron zip → partial unpack → ENOENT on rename.
                 # stdlib zipfile won't catch the common concat-junk case, so purge
@@ -8568,7 +8702,7 @@ def cmd_gui(args: argparse.Namespace):
                 purged: list[Path] = []
                 restored = False
                 if not _electron_dist_ok(PROJECT_ROOT):
-                    purged = _purge_electron_build_cache(desktop_dir)
+                    purged = _purge_electron_build_cache(desktop_dir, release_dir=staging_dir)
                     restored = _redownload_electron_dist(PROJECT_ROOT, env)
                 if restored:
                     print("  ⚠ Desktop build failed; refreshed the Electron download and retrying once...")
@@ -8578,13 +8712,13 @@ def cmd_gui(args: argparse.Namespace):
                     # is still locked by a running instance; stop it before retry.
                     _stop_desktop_processes_locking_build(desktop_dir)
                     build_result = subprocess.run(
-                        [npm, "run", build_script], cwd=desktop_dir, env=npm_build_env, check=False
+                        build_cmd, cwd=desktop_dir, env=npm_build_env, check=False
                     )
             if (
                 build_result.returncode != 0
                 and not source_mode
                 and not env.get("ELECTRON_MIRROR")
-                and _desktop_packaged_executable(desktop_dir) is None
+                and _staged_exe() is None
             ):
                 print("  ⚠ Desktop build still failing; the Electron download from "
                       "GitHub looks blocked. Re-downloading via a public mirror "
@@ -8595,9 +8729,13 @@ def cmd_gui(args: argparse.Namespace):
                 if not _electron_dist_ok(PROJECT_ROOT):
                     _redownload_electron_dist(PROJECT_ROOT, env, mirror=mirror)
                 _stop_desktop_processes_locking_build(desktop_dir)
-                build_result = subprocess.run([npm, "run", build_script], cwd=desktop_dir, env=mirror_env, check=False)
+                build_result = subprocess.run(build_cmd, cwd=desktop_dir, env=mirror_env, check=False)
             if build_result.returncode != 0:
                 print("✗ Desktop GUI build failed")
+                if staging_dir is not None:
+                    _discard_desktop_staging(staging_dir)
+                    if _desktop_packaged_executable(desktop_dir) is not None:
+                        print("  ↩ The previous desktop app was left untouched and still works.")
                 print(f"  Run manually:  cd apps/desktop && npm run {build_script}")
                 if sys.platform == "win32":
                     print("  If this says \"Access is denied\" on Hermes.exe, close any")
@@ -8605,28 +8743,37 @@ def cmd_gui(args: argparse.Namespace):
                 print("  If the log shows Electron download retries, rebuild via a mirror:")
                 print("    ELECTRON_MIRROR=<mirror-base-url> hermes desktop --force-build")
                 sys.exit(build_result.returncode or 1)
-            packaged_executable = _desktop_packaged_executable(desktop_dir)
             if not source_mode:
+                assert staging_dir is not None
+                staged_executable = _staged_exe()
                 # Locally-built apps are ad-hoc signed; make them relaunchable after
                 # an in-place self-update (otherwise macOS reports "Hermes is
                 # damaged"). No-op on non-macOS and on real-identity builds.
-                _desktop_macos_relaunchable_fixup(desktop_dir)
+                # Signs the STAGED bundle so the live app is never half-signed.
+                _desktop_macos_relaunchable_fixup(desktop_dir, release_dir=staging_dir)
 
                 # Windows integrity gate (#69179): never declare the rebuild a
                 # success on a Hermes.exe Windows cannot load (truncated PE from
                 # a corrupt cached Electron zip, wrong-arch tree, interrupted
-                # rcedit rewrite). Roll back to the .bak tree preserved by
-                # before-pack.mjs when possible, then fail loudly so the
-                # updater's retry-once rebuilds from a fresh Electron download
-                # instead of silently shipping the broken exe.
+                # rcedit rewrite). Verified on the STAGED exe: a failure here
+                # simply discards the staging dir — the live app was never
+                # touched — and fails loudly so the updater's retry-once
+                # rebuilds from a fresh Electron download.
                 verified_executable, rolled_back = _ensure_desktop_exe_launchable(
-                    desktop_dir, packaged_executable
+                    desktop_dir, staged_executable
                 )
-                if packaged_executable is not None and (
-                    rolled_back or verified_executable is None
-                ):
+                if staged_executable is None or rolled_back or verified_executable is None:
+                    _discard_desktop_staging(staging_dir)
+                    if staged_executable is None:
+                        print(f"✗ Desktop build produced no launchable app in {staging_dir}")
+                    print("  ↩ The previous desktop app was left untouched and still works.")
+                    sys.exit(1)
+                # Verified: swap the staged tree over the live one (rename).
+                packaged_executable = _swap_staged_desktop_app(desktop_dir, staging_dir)
+                if packaged_executable is None:
+                    print(f"✗ Could not install the rebuilt desktop app into {desktop_dir / 'release'}")
+                    print("  ↩ The previous desktop app was left untouched and still works.")
                     sys.exit(1)
-                packaged_executable = verified_executable
 
             # Build succeeded — write the stamp so next run can skip
             _write_desktop_build_stamp(PROJECT_ROOT, source_mode=source_mode)
@@ -8658,7 +8805,10 @@ def cmd_gui(args: argparse.Namespace):
 
     if source_mode:
         print("→ Launching Hermes Desktop from source build...")
-        launch_result = subprocess.run([npm, "exec", "--", "electron", "."], cwd=desktop_dir, env=env, check=False)
+        electron_argv = [npm, "exec", "--", "electron", "."]
+        if getattr(args, "local", False):
+            electron_argv.append("--local")
+        launch_result = subprocess.run(electron_argv, cwd=desktop_dir, env=env, check=False)
         sys.exit(launch_result.returncode)
 
     if packaged_executable is None:
@@ -8677,6 +8827,8 @@ def cmd_gui(args: argparse.Namespace):
         launch_command.append("--disable-setuid-sandbox")
 
     launch_command.extend(config_electron_flags)
+    if getattr(args, "local", False):
+        launch_command.append("--local")
     print(f"→ Launching packaged Hermes Desktop: {' '.join(launch_command)}")
     launch_result = subprocess.run(launch_command, cwd=desktop_dir, env=env, check=False)
     sys.exit(launch_result.returncode)
@@ -11452,6 +11604,7 @@ def cmd_profile(args):
             profile_exists,
             _read_config_model,
             _check_gateway_running,
+            _served_by_running_multiplexer,
             _count_skills,
             _read_distribution_meta,
             _get_wrapper_dir,
@@ -11465,7 +11618,7 @@ def cmd_profile(args):
             sys.exit(1)
         profile_dir = get_profile_dir(name)
         model, provider = _read_config_model(profile_dir)
-        gw = _check_gateway_running(profile_dir)
+        gw = _check_gateway_running(profile_dir) or _served_by_running_multiplexer(name)
         skills = _count_skills(profile_dir)
         dist_name, dist_version, dist_source = _read_distribution_meta(profile_dir)
         alias_name = find_alias_for_profile(name)
@@ -12391,18 +12544,29 @@ def cmd_dashboard(args):
     # this, a profile's configured MCP servers never connect, so desktop
     # sessions show no MCP tools.  Spawn discovery in the background here so a
     # slow/dead server can't block dashboard startup.
-    try:
-        from hermes_cli.mcp_startup import start_background_mcp_discovery
+    #
+    # Desktop-spawned headless backends start it AFTER the socket binds
+    # instead (start_server's ready path): the thread's first act is the
+    # ~350ms `mcp` SDK import, which holds the GIL against the main thread's
+    # own web_server import and pushes the READY sentinel — and every
+    # renderer paint behind it — back by that much. The Desktop can't issue
+    # an agent turn until its WebSocket is up anyway, and _make_agent's
+    # bounded wait_for_mcp_discovery + the late-binding refresh cover a
+    # server that is still connecting when the first turn lands.
+    _mcp_discovery_after_bind = _headless_backend and os.environ.get("HERMES_DESKTOP") == "1"
+    if not _mcp_discovery_after_bind:
+        try:
+            from hermes_cli.mcp_startup import start_background_mcp_discovery
 
-        start_background_mcp_discovery(
-            logger=logger,
-            thread_name="dashboard-mcp-discovery",
-        )
-    except Exception:
-        logger.debug(
-            "Background MCP tool discovery failed at dashboard startup",
-            exc_info=True,
-        )
+            start_background_mcp_discovery(
+                logger=logger,
+                thread_name="dashboard-mcp-discovery",
+            )
+        except Exception:
+            logger.debug(
+                "Background MCP tool discovery failed at dashboard startup",
+                exc_info=True,
+            )
 
     from hermes_cli.web_server import start_server
 
@@ -12425,6 +12589,7 @@ def cmd_dashboard(args):
         headless=_headless_backend,
         ssh_session_token=_ssh_session_token,
         ssh_owner_nonce=_ssh_owner_nonce,
+        start_mcp_discovery_after_bind=_mcp_discovery_after_bind,
     )
 
 
@@ -12814,6 +12979,47 @@ def _set_chat_arg_defaults(args) -> None:
             setattr(args, attr, default)
 
 
+def _try_fast_serve_launch() -> bool:
+    """Dispatch an unambiguous built-in ``serve`` without the full CLI tree.
+
+    Desktop launches this exact command on every cold start. Building parsers
+    for unrelated Hermes commands performs thousands of filesystem-backed
+    translation lookups on Windows even though none of those commands are
+    usable in this process. Unknown or globally-scoped arguments fall back to
+    normal parsing so compatibility and error reporting remain unchanged.
+    """
+    if os.environ.get("HERMES_DISABLE_FAST_SERVE_LAUNCH") == "1":
+        return False
+
+    argv = sys.argv[1:]
+    if not argv or argv[0] != "serve" or "-h" in argv or "--help" in argv:
+        return False
+
+    # Container routing is top-level policy and must run before host dispatch.
+    try:
+        from hermes_cli.config import get_container_exec_info
+
+        if get_container_exec_info():
+            return False
+    except Exception:
+        return False
+
+    parser = build_serve_parser(
+        cmd_dashboard=cmd_dashboard,
+        add_help=False,
+        exit_on_error=False,
+    )
+    try:
+        args, unknown = parser.parse_known_args(argv[1:])
+    except (argparse.ArgumentError, ValueError):
+        return False
+    if unknown:
+        return False
+
+    cmd_dashboard(args)
+    return True
+
+
 def _try_fast_chat_launch() -> bool:
     """Fast path for unambiguous interactive chat launches (all hosts).
 
@@ -13361,6 +13567,8 @@ def main():
         return
     if _try_termux_fast_cli_launch():
         return
+    if _try_fast_serve_launch():
+        return
     if _try_fast_chat_launch():
         return
 
diff --git a/hermes_cli/mcp_startup.py b/hermes_cli/mcp_startup.py
index c368805405..77a972591d 100644
--- a/hermes_cli/mcp_startup.py
+++ b/hermes_cli/mcp_startup.py
@@ -9,6 +9,7 @@ from typing import Optional
 _mcp_discovery_lock = threading.Lock()
 _mcp_discovery_started = False
 _mcp_discovery_thread: Optional[threading.Thread] = None
+_mcp_discovery_deferred: Optional[threading.Timer] = None
 
 
 def _has_configured_mcp_servers() -> bool:
@@ -172,6 +173,45 @@ def _discover_mcp_tools_without_interactive_oauth() -> None:
         discover_mcp_tools()
 
 
+def defer_background_mcp_discovery(*, logger, thread_name: str, delay: float) -> None:
+    """Arm ``start_background_mcp_discovery`` to run ``delay`` seconds from now.
+
+    Used by the Desktop ``serve`` backend after its socket is announced: the
+    discovery thread's first act is the ~350ms ``mcp`` SDK import, which holds
+    the GIL against the renderer's connect + first hydration reads if it starts
+    at bind time, and against the web_server import if it starts before. Any
+    consumer that needs discovery sooner (``wait_for_mcp_discovery`` from an
+    agent build) fires the deferred start immediately, so the bounded join and
+    the late-binding refresh behave exactly as if it had been started eagerly.
+    """
+    global _mcp_discovery_deferred
+    with _mcp_discovery_lock:
+        if _mcp_discovery_started or _mcp_discovery_deferred is not None:
+            return
+
+        def _fire() -> None:
+            global _mcp_discovery_deferred
+            with _mcp_discovery_lock:
+                _mcp_discovery_deferred = None
+            start_background_mcp_discovery(logger=logger, thread_name=thread_name)
+
+        timer = threading.Timer(delay, _fire)
+        timer.daemon = True
+        timer.name = f"{thread_name}-deferred"
+        _mcp_discovery_deferred = timer
+        timer.start()
+
+
+def _start_deferred_mcp_discovery_now() -> None:
+    """Run an armed deferred start immediately (idempotent, thread-safe)."""
+    with _mcp_discovery_lock:
+        timer = _mcp_discovery_deferred
+    if timer is None:
+        return
+    timer.cancel()
+    timer.function()
+
+
 def wait_for_mcp_discovery(
     timeout: "float | None" = None, *, single_query: bool = False
 ) -> None:
@@ -188,6 +228,7 @@ def wait_for_mcp_discovery(
     ``mcp_single_query_discovery_timeout`` instead (default 15s vs 1.5s
     interactive) because one-shot sessions have no second turn to recover.
     """
+    _start_deferred_mcp_discovery_now()
     thread = _mcp_discovery_thread
     if thread is None or not thread.is_alive():
         return
diff --git a/hermes_cli/model_catalog.py b/hermes_cli/model_catalog.py
index 5aa479fa87..1e869b746a 100644
--- a/hermes_cli/model_catalog.py
+++ b/hermes_cli/model_catalog.py
@@ -74,7 +74,10 @@ DEFAULT_CATALOG_URL = (
 DEFAULT_CATALOG_FALLBACK_URLS: tuple[str, ...] = (
     "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/website/static/api/model-catalog.json",
 )
-DEFAULT_TTL_HOURS = 1
+DEFAULT_TTL_MINUTES = 20
+# Legacy key. ``ttl_hours`` is honoured only when the user set it explicitly;
+# the shipped default is ``ttl_minutes`` above.
+DEFAULT_TTL_HOURS = DEFAULT_TTL_MINUTES / 60.0
 DEFAULT_FETCH_TIMEOUT = 8.0
 SUPPORTED_SCHEMA_VERSION = 1
 
@@ -104,10 +107,28 @@ def _load_catalog_config() -> dict[str, Any]:
     if not isinstance(raw, dict):
         raw = {}
 
+    # ``ttl_minutes`` is the shipped default (20). ``ttl_hours`` is the legacy
+    # key: honoured when a user set it explicitly and ``ttl_minutes`` is still
+    # at its default (load_config() deep-merges the default in, so "present"
+    # alone doesn't mean "user-set"), so old customized configs keep their
+    # chosen window.
+    ttl_minutes = raw.get("ttl_minutes")
+    try:
+        ttl_minutes = float(ttl_minutes) if ttl_minutes not in (None, "") else DEFAULT_TTL_MINUTES
+    except (TypeError, ValueError):
+        ttl_minutes = DEFAULT_TTL_MINUTES
+    if ttl_minutes == DEFAULT_TTL_MINUTES and raw.get("ttl_hours"):
+        try:
+            ttl_minutes = float(raw["ttl_hours"]) * 60.0
+        except (TypeError, ValueError):
+            pass
+    if ttl_minutes <= 0:
+        ttl_minutes = DEFAULT_TTL_MINUTES
+
     return {
         "enabled": bool(raw.get("enabled", True)),
         "url": str(raw.get("url") or DEFAULT_CATALOG_URL),
-        "ttl_hours": float(raw.get("ttl_hours") or DEFAULT_TTL_HOURS),
+        "ttl_hours": ttl_minutes / 60.0,
         "providers": raw.get("providers") if isinstance(raw.get("providers"), dict) else {},
     }
 
@@ -330,6 +351,33 @@ def get_catalog(*, force_refresh: bool = False) -> dict[str, Any]:
     return {}
 
 
+def refresh_interval_seconds() -> float:
+    """Return the configured catalog TTL in seconds (the gateway poll cadence)."""
+    return max(60.0, _load_catalog_config()["ttl_hours"] * 3600.0)
+
+
+def refresh_catalogs() -> bool:
+    """Force-refresh every remote model catalog the picker reads from.
+
+    Fetches the curated manifest, the OpenRouter live list (tool-support /
+    free-pricing filter) and the Nous Portal recommendations, writing each
+    to its disk cache so the next ``/model`` open in ANY process on this
+    machine sees the new lists. Blocking; run it off the event loop.
+    Returns True when the manifest refresh succeeded.
+    """
+    if not _load_catalog_config()["enabled"]:
+        return False
+    catalog = get_catalog(force_refresh=True)
+    try:
+        from hermes_cli.models import fetch_nous_recommended_models, fetch_openrouter_models
+
+        fetch_openrouter_models(force_refresh=True)
+        fetch_nous_recommended_models(force_refresh=True)
+    except Exception:
+        logger.debug("provider catalog refresh failed", exc_info=True)
+    return bool(catalog)
+
+
 def _fetch_provider_override(provider: str) -> dict[str, Any] | None:
     """If ``model_catalog.providers.<name>.url`` is set, fetch that instead."""
     cfg = _load_catalog_config()
diff --git a/hermes_cli/model_setup_flows.py b/hermes_cli/model_setup_flows.py
index 44aab0ca6c..adda8b6a6a 100644
--- a/hermes_cli/model_setup_flows.py
+++ b/hermes_cli/model_setup_flows.py
@@ -539,6 +539,15 @@ def _model_flow_nous(config, current_model="", args=None):
     # of CLI release cadence.
     unavailable_models: list[str] = []
     unavailable_message = ""
+
+    # Neither the curated list nor the Portal's recommendations know what the
+    # org may reach. Narrow before the tier split, so an id the policy rescues
+    # still has to pass the free/paid predicate instead of going around it.
+    from hermes_cli.models import nous_policy_allowed_ids, restrict_to_nous_policy
+
+    _policy_allowed = nous_policy_allowed_ids()
+    _policy_narrowed = False
+
     if free_tier:
         try:
             from hermes_cli.nous_account import (
@@ -559,6 +568,11 @@ def _model_flow_nous(config, current_model="", args=None):
         model_ids, pricing = union_with_portal_free_recommendations(
             model_ids, pricing, _nous_portal_url,
         )
+        _before_policy = model_ids
+        model_ids = restrict_to_nous_policy(
+            model_ids, _policy_allowed, rescue_empty=True,
+        )
+        _policy_narrowed = model_ids != _before_policy
         model_ids, unavailable_models = partition_nous_models_by_tier(
             model_ids, pricing, free_tier=True
         )
@@ -566,6 +580,11 @@ def _model_flow_nous(config, current_model="", args=None):
         model_ids, pricing = union_with_portal_paid_recommendations(
             model_ids, pricing, _nous_portal_url,
         )
+        _before_policy = model_ids
+        model_ids = restrict_to_nous_policy(
+            model_ids, _policy_allowed, rescue_empty=True,
+        )
+        _policy_narrowed = model_ids != _before_policy
 
     if not model_ids and not unavailable_models:
         print("No models available for Nous Portal after filtering.")
@@ -580,6 +599,11 @@ def _model_flow_nous(config, current_model="", args=None):
             print(unavailable_message or f"Upgrade at {_url} to access paid models.")
         return
 
+    from hermes_cli.nous_account import nous_policy_notice
+
+    _policy_notice = nous_policy_notice(removed=_policy_narrowed)
+    if _policy_notice:
+        print(_policy_notice)
     print(
         f'Showing {len(model_ids)} curated models — use "Enter custom model name" for others.'
     )
diff --git a/hermes_cli/model_switch.py b/hermes_cli/model_switch.py
index 6a13ce7b36..f70c71f30f 100644
--- a/hermes_cli/model_switch.py
+++ b/hermes_cli/model_switch.py
@@ -562,10 +562,12 @@ def _load_direct_aliases() -> dict[str, DirectAlias]:
     neither is set the key is resolved from the alias HOST, never from the
     previously active provider (#83612).
 
-    Also reads ``model.aliases`` (set by ``hermes config set model.aliases.xxx``)
-    and converts simple string entries (``ds-flash: deepseek/deepseek-v4-flash``)
-    into DirectAlias objects.  The provider is parsed from the ``provider/``
-    prefix in the value; if no slash, the current provider is used.
+    Also reads ``model.aliases`` (set by ``hermes config set model.aliases.xxx``
+    or hand-written). String entries (``ds-flash: deepseek/deepseek-v4-flash``)
+    are converted into DirectAlias objects with the provider parsed from the
+    ``provider/`` prefix in the value; if no slash, the current provider is
+    used. Dict entries use the same shape as ``model_aliases:`` (``model``,
+    ``provider``, ``base_url`` keys).
     """
     merged = dict(_BUILTIN_DIRECT_ALIASES)
     try:
@@ -588,18 +590,34 @@ def _load_direct_aliases() -> dict[str, DirectAlias]:
                         key_env=str(entry.get("key_env", "") or "").strip(),
                     )
 
-        # --- model.aliases (string-based format, from config set) ---
+        # --- model.aliases (from config set / hand-written config) ---
         model_section = cfg.get("model", {})
         if isinstance(model_section, dict):
             simple_aliases = model_section.get("aliases")
             if isinstance(simple_aliases, dict):
                 current_provider = model_section.get("provider", "")
                 for name, value in simple_aliases.items():
+                    key = name.strip().lower()
+                    if not key or key in merged:
+                        continue  # don't override explicit model_aliases entries
+                    if isinstance(value, dict):
+                        # Dict form mirrors the ``model_aliases:`` shape:
+                        # localqwen: {model: qwen3.5:4b, provider: custom}.
+                        # Hand-written configs already use it; honoring it
+                        # here keeps aliases with an explicit provider from
+                        # being silently dropped (#87189).
+                        model = str(value.get("model") or "").strip()
+                        if not model:
+                            continue
+                        provider = str(value.get("provider") or "").strip()
+                        merged[key] = DirectAlias(
+                            model=model,
+                            provider=provider or current_provider or "custom",
+                            base_url=str(value.get("base_url") or "").strip(),
+                        )
+                        continue
                     if not isinstance(value, str) or not value.strip():
                         continue
-                    key = name.strip().lower()
-                    if key in merged:
-                        continue  # don't override explicit model_aliases entries
                     val = value.strip()
                     if "/" in val:
                         provider, model = val.split("/", 1)
@@ -744,6 +762,121 @@ def _may_reuse_session_credential(session_base_url: str, alias_base_url: str) ->
     return scheme == "https" or hostname in _LOOPBACK_HOSTS
 
 
+class StartupModelRoute(NamedTuple):
+    """Model/provider pair resolved before an agent is constructed."""
+
+    model: str
+    provider: str = ""
+    base_url: str = ""
+    api_key: str = ""
+
+
+def resolve_startup_model_route(
+    raw_model: str,
+    *,
+    explicit_provider: str = "",
+    current_provider: str = "",
+    user_providers: Optional[dict] = None,
+    custom_providers: Optional[list] = None,
+) -> Optional[StartupModelRoute]:
+    """Resolve aliases and configured ``provider/model`` input at startup.
+
+    ``HermesCLI`` is constructed before the interactive ``/model`` pipeline
+    runs.  Keeping this small resolver at the same boundary as
+    ``DIRECT_ALIASES`` prevents startup from attaching the configured default
+    provider to an explicitly requested model. Provider/model strings are
+    consumed only for providers present in user configuration; aggregator
+    namespaces remain untouched.
+
+    ``current_provider`` is the provider the session would otherwise use
+    (config ``model.provider`` / ``--provider``). When it is a routing
+    aggregator and the raw string is an aggregator-native slug
+    (``anthropic/claude-opus-4.6`` on OpenRouter), the input stays on the
+    aggregator — bare vendor slugs resolve WITHIN the aggregator first and a
+    ``providers:`` block for the same vendor must not steal the route.
+    """
+    raw = str(raw_model or "").strip()
+    if not raw:
+        return None
+
+    _ensure_direct_aliases()
+    direct = DIRECT_ALIASES.get(raw.lower())
+    if direct is not None:
+        if explicit_provider:
+            # An explicit --provider wins over the alias's own label; the
+            # alias contributes model/base_url only.
+            return StartupModelRoute(
+                model=direct.model,
+                provider=explicit_provider,
+                base_url=direct.base_url,
+            )
+        # Resolve through the SAME owner the interactive /model and oneshot
+        # paths use: a URL-bearing alias must resolve its credential for the
+        # alias HOST, never for its provider label — a label like
+        # ``anthropic`` on a foreign URL would otherwise reach that
+        # provider's explicit-runtime branch and put the live vendor token
+        # on the foreign wire (#28660).
+        alias_provider, alias_key = direct_alias_runtime_request(direct)
+        return StartupModelRoute(
+            model=direct.model,
+            provider=alias_provider,
+            base_url=direct.base_url,
+            api_key=alias_key or "",
+        )
+
+    if explicit_provider or "/" not in raw:
+        return None
+    prefix, model = (part.strip() for part in raw.split("/", 1))
+    if not prefix or not model:
+        return None
+
+    # Aggregator-native slugs stay on the aggregator. A user on OpenRouter
+    # whose config also has a ``providers.anthropic`` block must NOT have
+    # ``anthropic/claude-opus-4.6`` silently rerouted to native Anthropic.
+    if current_provider:
+        try:
+            from hermes_cli.providers import (
+                is_routing_aggregator as _is_routing_agg,
+                normalize_provider as _norm_prov,
+            )
+
+            if _is_routing_agg(_norm_prov(current_provider)):
+                from hermes_cli.models import _find_openrouter_slug
+
+                if _find_openrouter_slug(raw):
+                    return None
+        except Exception:
+            pass
+
+    configured = {
+        str(name).strip().lower()
+        for name in (user_providers or {})
+        if str(name).strip()
+    }
+    configured.update(
+        f"custom:{entry.get('name', '').strip().lower()}"
+        for entry in (custom_providers or [])
+        if isinstance(entry, dict) and str(entry.get("name") or "").strip()
+    )
+    try:
+        from hermes_cli.models import normalize_provider
+
+        canonical = normalize_provider(prefix)
+    except Exception:
+        canonical = prefix.lower()
+
+    if prefix.lower() in configured:
+        provider = prefix
+    elif canonical.lower() in configured:
+        provider = canonical
+    else:
+        return None
+
+    if is_aggregator(canonical):
+        return None
+    return StartupModelRoute(model=model, provider=provider)
+
+
 # ---------------------------------------------------------------------------
 # Result dataclasses
 # ---------------------------------------------------------------------------
@@ -883,11 +1016,18 @@ def resolve_persist_behavior(
     1. ``--once`` explicitly opts out → ``False`` (next turn only).
     2. ``--session`` explicitly opts out → ``False`` (this session only).
     3. ``--global`` explicitly opts in → ``True``.
-    4. ``--provider`` given without an explicit persist flag → ``False``
+    4. No default configured yet (neither ``model.default`` nor
+       ``model.provider`` set — a fresh install whose first-ever pick this
+       is) → ``True``.  Without a persisted provider, ``resolve_provider``
+       falls through to whatever ``*_API_KEY`` env var is lying around on
+       the next launch (#86414), so the first pick becomes the default
+       instead of evaporating.  Applies to every surface (CLI, gateway,
+       Desktop picker) so no client has to hardcode ``--global``.
+    5. ``--provider`` given without an explicit persist flag → ``False``
        (session only).  Provider switches are typically exploratory — the
        user is trying a different backend for this conversation, not
        reconfiguring the default.  ``--global`` can still force persist.
-    5. Otherwise defer to ``model.persist_switch_by_default`` in
+    6. Otherwise defer to ``model.persist_switch_by_default`` in
        ``config.yaml`` (defaults to ``False``: a plain ``/model <name>``
        affects only the current session).  Users who want the old
        persist-by-default behavior can set the key to ``true``; a one-off
@@ -903,17 +1043,20 @@ def resolve_persist_behavior(
         return False
     if is_global:
         return True
-    if explicit_provider:
-        return False
     try:
         from hermes_cli.config import load_config
 
         model_cfg = load_config().get("model")
-        if isinstance(model_cfg, dict):
-            return bool(model_cfg.get("persist_switch_by_default", False))
     except Exception:
-        pass
-    return False
+        return False
+    if isinstance(model_cfg, dict):
+        if not (model_cfg.get("default") or model_cfg.get("provider")):
+            return True
+        if explicit_provider:
+            return False
+        return bool(model_cfg.get("persist_switch_by_default", False))
+    # Flat-string form: a non-empty string IS a configured default.
+    return not model_cfg
 
 
 # ---------------------------------------------------------------------------
@@ -2801,7 +2944,10 @@ def _collect_authed_provider_slugs(
             slugs.append(_cp.slug)
             seen.add(_cp.slug.lower())
 
-    return slugs
+    # Nous excluded: its picker branch builds from the curated list and it
+    # cannot reach the api_key-only pathway, so a prefetched entry is written
+    # and never read.
+    return [s for s in slugs if s != "nous"]
 
 
 def list_authenticated_providers(
@@ -3218,6 +3364,19 @@ def list_authenticated_providers(
                     if any(os.environ.get(ev) for ev in pcfg.api_key_env_vars):
                         has_creds = True
                         break
+        # External-process providers (copilot-acp) hold no API key, OAuth
+        # token, or pool entry by design — the spawned ACP subprocess brings
+        # its own auth. "Configured" means the executable resolves, which is
+        # exactly what get_auth_status() reports for them; without this branch
+        # the has_creds filter below unconditionally hides the provider from
+        # every picker (#63662).
+        if not has_creds and overlay.auth_type == "external_process":
+            try:
+                from hermes_cli.auth import get_auth_status
+                _ext_status = get_auth_status(hermes_slug) or {}
+                has_creds = bool(_ext_status.get("logged_in") or _ext_status.get("configured"))
+            except Exception as exc:
+                logger.debug("External-process check failed for %s: %s", pid, exc)
         # Check auth store and credential pool for non-env-var credentials.
         # This applies to OAuth providers AND api_key providers that also
         # support OAuth (e.g. anthropic supports both API key and Claude Code
@@ -3332,6 +3491,19 @@ def list_authenticated_providers(
                 # curated list alone (still correct, just may lag newly
                 # launched models, exactly like an offline CLI run).
                 pass
+            # Outside the try above, so a failed recommendation fetch still
+            # yields a policy-filtered curated list.
+            try:
+                from hermes_cli.models import (
+                    nous_policy_allowed_ids as _nous_policy,
+                    restrict_to_nous_policy as _nous_restrict,
+                )
+
+                model_ids = _nous_restrict(
+                    model_ids, _nous_policy(), rescue_empty=True,
+                )
+            except Exception:
+                pass
         else:
             # Unified pathway — see Section 1 rationale. Fall back to the
             # curated dict (with models.dev merge for preferred providers)
@@ -3379,7 +3551,20 @@ def list_authenticated_providers(
         _cp_config = _auth_registry.get(_cp.slug)
         _cp_has_creds = False
         if _cp_config and _cp_config.api_key_env_vars:
-            _cp_has_creds = any(os.environ.get(ev) for ev in _cp_config.api_key_env_vars)
+            _cp_lit = {ev for ev in _cp_config.api_key_env_vars if os.environ.get(ev)}
+            _cp_has_creds = bool(_cp_lit)
+            # A regional "-cn" twin lit only by key vars it shares with its
+            # non-CN sibling (e.g. alibaba-coding-plan-cn off the intl
+            # ALIBABA_CODING_PLAN_API_KEY) is a phantom picker row (#101122).
+            # Hide it unless the user configured that CN provider -- and only
+            # when it has a dedicated var of its own the user could set instead.
+            _sib = _auth_registry.get(_cp.slug[:-3]) if _cp.slug.endswith("-cn") else None
+            _sib_vars = set(_sib.api_key_env_vars) if _sib else set()
+            if (
+                _cp_lit and _cp_lit <= _sib_vars < set(_cp_config.api_key_env_vars)
+                and _cp.slug != current_provider
+            ):
+                continue
         # Also check auth store and credential pool
         if not _cp_has_creds:
             try:
diff --git a/hermes_cli/models.py b/hermes_cli/models.py
index eac78f40a8..020e81c5c6 100644
--- a/hermes_cli/models.py
+++ b/hermes_cli/models.py
@@ -82,6 +82,7 @@ def _custom_provider_ssl_context(base_url: str):
 # (model_id, display description shown in menus)
 OPENROUTER_MODELS: list[tuple[str, str]] = [
     # Anthropic
+    ("anthropic/claude-fable-5.1",             ""),
     ("anthropic/claude-fable-5",               ""),
     ("anthropic/claude-opus-5",                ""),
     ("anthropic/claude-opus-5-fast",           "2x price, higher output speed"),
@@ -266,6 +267,7 @@ _PROVIDER_MODELS: dict[str, list[str]] = {
     "moa": ["default"],
     "nous": [
         # Anthropic
+        "anthropic/claude-fable-5.1",
         "anthropic/claude-fable-5",
         "anthropic/claude-opus-5",
         "anthropic/claude-opus-4.8",
@@ -2343,12 +2345,22 @@ def _cached_catalog(cache_key: str) -> Optional[dict[str, dict[str, Any]]]:
 
 
 def _cache_catalog(
-    cache_key: str, result: dict[str, dict[str, Any]]
+    cache_key: str,
+    result: dict[str, dict[str, Any]],
+    ttl_seconds: Optional[float] = None,
 ) -> dict[str, dict[str, Any]]:
-    """Cache a catalog result, giving an empty one an expiry."""
+    """Cache a catalog result, giving an empty one an expiry.
+
+    *ttl_seconds* expires a non-empty result too. Only a catalog whose contents
+    depend on server-side state the client cannot observe needs it — an org's
+    model policy can change while a long-lived process holds the entry.
+    """
     _pricing_cache[cache_key] = result
     if result:
-        _pricing_cache_retry_after.pop(cache_key, None)
+        if ttl_seconds:
+            _pricing_cache_retry_after[cache_key] = time.monotonic() + ttl_seconds
+        else:
+            _pricing_cache_retry_after.pop(cache_key, None)
     else:
         _pricing_cache_retry_after[cache_key] = (
             time.monotonic() + _FAILED_CATALOG_TTL_SECONDS
@@ -2356,6 +2368,46 @@ def _cache_catalog(
     return result
 
 
+# NUL cannot appear in a URL, so this cannot collide with a real base URL.
+_PRICING_AUTH_KEY_PREFIX = "\x00auth:"
+
+
+def _pricing_auth_fingerprint(api_key: str | None) -> str:
+    """Key suffix identifying the credential a catalog was read with.
+
+    A governed endpoint answers each token with the catalog its org may reach,
+    so two credentials cannot share an entry. blake2b for cache-key
+    fingerprinting only, same rationale as :func:`_custom_endpoint_fingerprint`.
+    """
+    if not api_key:
+        return ""
+    import hashlib
+
+    digest = hashlib.blake2b(api_key.encode("utf-8", errors="replace"), digest_size=8)
+    return _PRICING_AUTH_KEY_PREFIX + digest.hexdigest()
+
+
+def peek_cached_pricing(base_url: str) -> dict[str, dict[str, Any]]:
+    """Pricing already cached for *base_url*, or ``{}``. Never fetches.
+
+    Accepts a ``/v1``-suffixed URL as well as the pre-``/v1`` root the fetchers
+    key on, and prefers an authenticated catalog. Scans rather than rebuilding a
+    key, because callers hold a base URL but no credential — newest first, and
+    skipping expired entries, so a rotated credential does not keep answering
+    from the catalog its predecessor read.
+    """
+    root = (base_url or "").rstrip("/")
+    if root.endswith("/v1"):
+        root = root[:-3].rstrip("/")
+    authed_prefix = root + _PRICING_AUTH_KEY_PREFIX
+    for key in reversed(list(_pricing_cache)):
+        if key.startswith(authed_prefix):
+            cached = _cached_catalog(key)
+            if cached:
+                return cached
+    return _cached_catalog(root) or {}
+
+
 def _format_price_per_mtok(per_token_str: str) -> str:
     """Convert a per-token price string to a human-friendly $/Mtok string.
 
@@ -2489,10 +2541,12 @@ def fetch_models_with_pricing(
     *,
     force_refresh: bool = False,
     include_sale_original: bool = False,
+    cache_ttl_seconds: Optional[float] = None,
 ) -> dict[str, dict[str, Any]]:
     """Fetch ``/v1/models`` and return ``{model_id: {prompt, completion, ...}}``.
 
-    Results are cached per *base_url* so repeated calls are free.
+    Results are cached per *base_url* and per credential, so repeated calls are
+    free and one caller's catalog never answers another's read.
     Works with any OpenRouter-compatible endpoint (OpenRouter, Nous Portal).
 
     When *include_sale_original* is true (Nous Portal only) and the gateway
@@ -2503,13 +2557,14 @@ def fetch_models_with_pricing(
     ``{prompt, completion}`` shape even if a response happens to nest
     ``original``.
     """
-    cache_key = (base_url or "").rstrip("/")
+    url_root = (base_url or "").rstrip("/")
+    cache_key = url_root + _pricing_auth_fingerprint(api_key)
     if not force_refresh:
         cached = _cached_catalog(cache_key)
         if cached is not None:
             return cached
 
-    url = cache_key + "/v1/models"
+    url = url_root + "/v1/models"
     headers: dict[str, str] = {
         "Accept": "application/json",
         "User-Agent": _HERMES_USER_AGENT,
@@ -2560,7 +2615,7 @@ def fetch_models_with_pricing(
                         entry["original"] = orig_entry
             result[mid] = entry
 
-    return _cache_catalog(cache_key, result)
+    return _cache_catalog(cache_key, result, cache_ttl_seconds)
 
 
 def fetch_ai_gateway_pricing(
@@ -2670,6 +2725,86 @@ def _resolve_nous_pricing_credentials() -> tuple[str, str]:
     return (api_key, base_url)
 
 
+def nous_policy_allowed_ids(*, force_refresh: bool = False) -> Optional[set[str]]:
+    """The Nous model ids the caller's org may reach, or ``None`` to not filter.
+
+    The gateway omits policy-blocked rows from an authenticated
+    ``GET /v1/models``, so that response's keys are the reachable set.
+
+    ``None`` means "leave the caller's list alone", for the three states that
+    cannot support narrowing one: no policy (or a token too old to say), an
+    anonymous read whose catalog is unfiltered, and an empty read, which is a
+    fetch failure rather than an org that may reach nothing.
+    """
+    try:
+        from hermes_cli.nous_account import nous_policy_present
+
+        if nous_policy_present() is not True:
+            return None
+    except Exception:
+        return None
+
+    api_key, base_url = _resolve_nous_pricing_credentials()
+    if not api_key or not base_url:
+        return None
+
+    # Same arguments as get_pricing_for_provider's nous branch, so a caller
+    # asking for pricing too shares this entry instead of paying for a second
+    # request.
+    pricing = fetch_models_with_pricing(
+        api_key=api_key,
+        base_url=base_url,
+        force_refresh=force_refresh,
+        include_sale_original=True,
+        cache_ttl_seconds=_NOUS_CATALOG_TTL_SECONDS,
+    )
+    return set(pricing) or None
+
+
+# Past this size an allowed set reads as a whole catalog rather than an
+# allowlist, and is not worth showing in place of an empty picker.
+_NOUS_POLICY_APPEND_MAX = 64
+
+# How long a Nous catalog stays trusted. Its contents depend on the org's
+# policy, which an admin can change at any time and the client cannot observe,
+# so a long-lived process must re-ask instead of holding the first answer for
+# its whole life. Other providers' catalogs carry no such state and keep the
+# default no-expiry caching.
+_NOUS_CATALOG_TTL_SECONDS = 300.0
+
+
+def restrict_to_nous_policy(
+    model_ids: list[str],
+    allowed: Optional[set[str]],
+    *,
+    rescue_empty: bool = False,
+) -> list[str]:
+    """*model_ids* narrowed to *allowed*, preserving the caller's order.
+
+    A ``None`` or empty *allowed* leaves the list untouched.
+
+    A ``:free`` sibling is kept when its base model is reachable, mirroring the
+    gateway, which admits a row when any of its requestable ids passes. Prefer
+    over-listing: that costs a 403 from the authoritative gate, while hiding a
+    row the gate would serve is unrecoverable from the client.
+    """
+    if not allowed:
+        return list(model_ids)
+    kept = [
+        mid
+        for mid in model_ids
+        if mid in allowed or mid.split(":", 1)[0] in allowed
+    ]
+
+    # An allowlist can name only models the curated manifest lacks, leaving an
+    # empty picker — worse than no filter, since the models the org may use are
+    # the ones dropped. Opt-in per list: an already-empty list (a paid tier's
+    # gated models) means "nothing to gate", not "nothing survived".
+    if rescue_empty and not kept and len(allowed) <= _NOUS_POLICY_APPEND_MAX:
+        return sorted(allowed)
+    return kept
+
+
 def get_pricing_for_provider(provider: str, *, force_refresh: bool = False) -> dict[str, dict[str, str]]:
     """Return live pricing for providers that support it (openrouter, nous, ai-gateway, novita)."""
     normalized = normalize_provider(provider)
@@ -2696,6 +2831,7 @@ def get_pricing_for_provider(provider: str, *, force_refresh: bool = False) -> d
                 force_refresh=force_refresh,
                 # Sale chrome (pricing.original) is Nous Portal-only.
                 include_sale_original=True,
+                cache_ttl_seconds=_NOUS_CATALOG_TTL_SECONDS,
             )
     return {}
 
@@ -3612,6 +3748,69 @@ def detect_static_provider_for_model(
     return None
 
 
+def _configured_provider_ids() -> set[str]:
+    """Provider ids defined in the user's config ``providers:`` block.
+
+    Includes both top-level ids (``ollama``, ``nous``) and ``custom:*``
+    profile ids. Returns an empty set when config is unreadable — callers
+    treat that as "no user-defined providers" and fall through to built-in
+    catalogs only.
+    """
+    try:
+        from hermes_cli.config import load_config
+
+        cfg = load_config() or {}
+        providers = cfg.get("providers")
+        if not isinstance(providers, dict):
+            return set()
+        ids: set[str] = set()
+        for pid in providers:
+            key = str(pid).strip().lower()
+            if key:
+                ids.add(key)
+        return ids
+    except Exception:
+        return set()
+
+
+def _resolve_provider_prefix(model_name: str) -> Optional[tuple[str, str]]:
+    """Resolve an explicit ``vendor/model`` prefix to a configured provider.
+
+    ``nous/deepseek-v4-pro`` or ``ollama/qwen3.5:4b`` should route to the
+    named provider instead of falling back to the configured default (which
+    silently sends non-default models to the wrong endpoint, #87189).
+
+    Only vendors the user actually defined in their ``providers:`` config
+    block (by raw name or alias) are routed here. Built-in vendor prefixes
+    (``google/gemini-2.5-flash``, ``deepseek/deepseek-chat``) deliberately
+    stay on the existing catalog / OpenRouter-slug / default-provider path:
+    those slug forms are aggregator-native, and rerouting them to the vendor
+    provider would change established provider-switch behavior (see
+    ``TestDenormalizeProviderSwitch`` in tests/hermes_cli/test_web_server.py).
+    The returned model is the suffix with the prefix stripped — the target
+    provider's API expects the bare id.
+    """
+    if "/" not in model_name:
+        return None
+    vendor, model = model_name.split("/", 1)
+    vendor = vendor.strip().lower()
+    model = model.strip()
+    if not vendor or not model:
+        return None
+    configured = _configured_provider_ids()
+    if not configured:
+        return None
+    # A provider block the user explicitly named (``ollama:``) wins over the
+    # built-in alias table, which may canonicalize the same name elsewhere
+    # (``ollama`` → ``custom``) and route to the wrong endpoint.
+    if vendor in configured:
+        return (vendor, model)
+    canonical = _PROVIDER_ALIASES.get(vendor, vendor)
+    if canonical in configured:
+        return (canonical, model)
+    return None
+
+
 def detect_provider_for_model(
     model_name: str,
     current_provider: str,
@@ -3648,6 +3847,16 @@ def detect_provider_for_model(
             return ("openrouter", or_slug)
         return None  # already on openrouter with matching name
 
+    # --- Step 3: explicit ``vendor/model`` prefix naming a configured provider ---
+    # Checked after the OpenRouter slug lookup so aggregator-native slugs
+    # (e.g. ``deepseek/deepseek-chat``) keep their existing routing; only
+    # vendors the user defined in their ``providers:`` block route here,
+    # so catalog/default behavior for built-in vendor prefixes is unchanged
+    # (#87189).
+    prefix_match = _resolve_provider_prefix(name)
+    if prefix_match is not None:
+        return prefix_match
+
     return None
 
 
@@ -3760,23 +3969,60 @@ def model_supports_fast_mode(model_id: Optional[str]) -> bool:
 def _is_anthropic_fast_model(model_id: Optional[str]) -> bool:
     """Return True if the model accepts the Anthropic Fast Mode ``speed`` param.
 
-    This gates the *speed=fast request parameter*, which Anthropic supports on
-    Opus 4.6 only (Opus 4.7 explicitly 400s). It is deliberately NOT a general
-    "is this a fast model" check: for Opus 4.8 the fast offering is a SEPARATE
-    model id (``…-opus-4.8-fast``) selected via the model field, not the speed
-    parameter — see ``agent.anthropic_adapter._supports_fast_mode`` and its
-    test. Keep this in lock-step with that adapter gate so the UI never shows a
-    Fast toggle that the runtime would silently drop.
+    This gates the *speed=fast request parameter*, which Anthropic supports
+    on Opus 4.8 and Opus 5 (research preview, Claude API only). It is
+    deliberately NOT a general "is this a fast model" check:
+
+    - Opus 4.6 had fast mode at launch and LOST it (2026-06-29) — the param
+      is silently ignored (standard speed, standard billing), so exposing a
+      toggle for it would show users a switch that does nothing.
+    - Opus 4.7 hard-400s on the parameter.
+    - Dedicated ``…-fast`` model ids (e.g. OpenRouter's
+      ``claude-opus-4.8-fast``) select fast inference via the model field
+      and must not also receive the speed parameter.
+
+    Keep this in lock-step with ``agent.anthropic_adapter._supports_fast_mode``
+    so the UI never shows a Fast toggle that the runtime would drop.
     """
     raw = _strip_vendor_prefix(str(model_id or ""))
     base = raw.split(":")[0]
     if not base.startswith("claude-"):
         return False
-    # Only Opus 4.6 supports the speed=fast parameter at present.
-    return "opus-4-6" in base or "opus-4.6" in base
+    if "-fast" in base:
+        return False
+    return any(v in base for v in ("opus-4-8", "opus-4.8", "opus-5"))
 
 
-def resolve_fast_mode_overrides(model_id: Optional[str]) -> dict[str, Any] | None:
+def _fast_mode_route_supported(
+    model_id: Optional[str], provider: Optional[str], base_url: Optional[str]
+) -> bool:
+    """Only the first-party endpoint that bills for fast mode may receive its params.
+
+    OpenRouter, Nous, Copilot, Azure, Bedrock, and custom base_urls either
+    strip ``service_tier``/``speed`` (charging nothing) or 400 on them.
+    """
+    from urllib.parse import urlparse
+
+    from agent.model_metadata import is_grok_46_family
+
+    if _is_anthropic_fast_model(model_id):
+        allowed = {"anthropic": "api.anthropic.com"}
+    elif is_grok_46_family(str(model_id or "")):
+        allowed = {"xai": "api.x.ai"}
+    else:
+        allowed = {"openai": "api.openai.com", "openai-codex": "chatgpt.com"}
+    if provider and normalize_provider(provider) not in allowed:
+        return False
+    host = (urlparse(str(base_url or "")).hostname or "").lower()
+    return not host or host in allowed.values()
+
+
+def resolve_fast_mode_overrides(
+    model_id: Optional[str],
+    *,
+    provider: Optional[str] = None,
+    base_url: Optional[str] = None,
+) -> dict[str, Any] | None:
     """Return request_overrides for fast/priority mode, or None if unsupported.
 
     Returns provider-appropriate overrides:
@@ -3784,12 +4030,21 @@ def resolve_fast_mode_overrides(model_id: Optional[str]) -> dict[str, Any] | Non
     - Anthropic models: ``{"speed": "fast"}`` (Anthropic Fast Mode beta)
     - Grok 4.6: ``{"service_tier": "priority"}`` (xAI Priority Processing)
 
+    When ``provider``/``base_url`` are given the result is also gated on the
+    route (see ``_fast_mode_route_supported``) so proxies never see the
+    params. This is the single fast-mode gate for static ``/fast fast`` and
+    the bounded ``auto``/``cold`` windows in ``agent.fast_mode``.
+
     The overrides are injected into the API request kwargs by
-    ``_build_api_kwargs`` in run_agent.py — each API path handles its own
-    keys (service_tier for OpenAI/Codex, speed for Anthropic Messages).
+    ``build_api_kwargs`` — each API path handles its own keys
+    (service_tier for OpenAI/Codex, speed for Anthropic Messages).
     """
     if not model_supports_fast_mode(model_id):
         return None
+    if (provider or base_url) and not _fast_mode_route_supported(
+        model_id, provider, base_url
+    ):
+        return None
     if _is_anthropic_fast_model(model_id):
         return {"speed": "fast"}
     return {"service_tier": "priority"}
@@ -3807,13 +4062,18 @@ def _resolve_copilot_catalog_api_key() -> str:
          ``auth.json`` under ``credential_pool.copilot[]``. The pool is
          populated by ``hermes auth add copilot`` and by ``_seed_from_env``
          when the env var is set in ``~/.hermes/.env``.
+      3. ``~/.copilot/config.json`` ``copilotTokens`` — the GitHub Copilot
+         CLI's own store, written by ``copilot login`` on hosts without an
+         OS keychain. Without it, a user whose ONLY credential is the ACP
+         CLI login sees the copilot-acp picker fall back to the stale
+         curated list instead of the models their subscription serves.
 
-    Without (2), users whose only Copilot credential is in the pool see
-    the ``/model`` picker fall back to a stale hardcoded list because the
-    live catalog fetch silently 401s. To avoid wedging on a malformed pool
-    entry, each candidate is exchanged via ``exchange_copilot_token`` —
-    only entries that actually exchange successfully are returned, so a
-    later valid entry is reachable when an earlier one is unsupported.
+    Without (2)/(3), users without env-var credentials see the ``/model``
+    picker fall back to a stale hardcoded list because the live catalog
+    fetch silently 401s. To avoid wedging on a malformed entry, each
+    candidate is exchanged via ``exchange_copilot_token`` — only entries
+    that actually exchange successfully are returned, so a later valid
+    entry is reachable when an earlier one is unsupported.
     """
     try:
         from hermes_cli.auth import resolve_api_key_provider_credentials
@@ -3842,7 +4102,11 @@ def _resolve_copilot_catalog_api_key() -> str:
             if not valid:
                 continue
             try:
-                api_token, _expires_at = exchange_copilot_token(raw)
+                # exchange_copilot_token returns (api_token, expires_at,
+                # base_url) — a 2-name unpack raises ValueError, which the
+                # except below silently swallowed, disabling this entire
+                # resolution path.
+                api_token = exchange_copilot_token(raw)[0]
             except Exception:
                 continue
             if api_token:
@@ -3850,6 +4114,41 @@ def _resolve_copilot_catalog_api_key() -> str:
     except Exception:
         pass
 
+    # 3. Copilot CLI plaintext token store (JSONC — strip //-comment lines).
+    try:
+        import json as _json
+
+        from hermes_cli.copilot_auth import (
+            exchange_copilot_token,
+            validate_copilot_token,
+        )
+
+        cli_config = os.path.expanduser("~/.copilot/config.json")
+        if os.path.isfile(cli_config):
+            with open(cli_config, "r", encoding="utf-8", errors="ignore") as fh:
+                raw_text = "\n".join(
+                    line for line in fh.read().splitlines()
+                    if not line.lstrip().startswith("//")
+                )
+            data = _json.loads(raw_text) if raw_text.strip() else {}
+            tokens = data.get("copilotTokens")
+            if isinstance(tokens, dict):
+                for raw in tokens.values():
+                    raw = str(raw or "").strip()
+                    if not raw:
+                        continue
+                    valid, _ = validate_copilot_token(raw)
+                    if not valid:
+                        continue
+                    try:
+                        api_token = exchange_copilot_token(raw)[0]
+                    except Exception:
+                        continue
+                    if api_token:
+                        return api_token
+    except Exception:
+        pass
+
     return ""
 
 
@@ -4807,12 +5106,14 @@ def copilot_default_headers(*, is_agent_turn: bool = True) -> dict[str, str]:
         }
 
 
-def _copilot_catalog_item_is_text_model(item: dict[str, Any]) -> bool:
+def _copilot_catalog_item_is_text_model(
+    item: dict[str, Any], *, ignore_picker_flag: bool = False
+) -> bool:
     model_id = str(item.get("id") or "").strip()
     if not model_id:
         return False
 
-    if item.get("model_picker_enabled") is False:
+    if not ignore_picker_flag and item.get("model_picker_enabled") is False:
         return False
 
     capabilities = item.get("capabilities")
@@ -4891,6 +5192,25 @@ def fetch_github_model_catalog(
                         continue
                     seen_ids.add(model_id)
                     models.append(item)
+                if not models and items:
+                    # GitHub has been observed returning
+                    # ``model_picker_enabled: false`` for EVERY model on some
+                    # accounts/token types, which would silently reject the
+                    # whole live catalog and strand the picker on the stale
+                    # curated fallback. The flag is a display hint, not an
+                    # availability contract — when honoring it empties the
+                    # catalog, retry without it (chat/endpoint checks still
+                    # apply, so embeddings and non-chat rows stay excluded).
+                    for item in items:
+                        if not _copilot_catalog_item_is_text_model(
+                            item, ignore_picker_flag=True
+                        ):
+                            continue
+                        model_id = str(item.get("id") or "").strip()
+                        if not model_id or model_id in seen_ids:
+                            continue
+                        seen_ids.add(model_id)
+                        models.append(item)
                 if models:
                     _github_model_catalog_cache = copy.deepcopy(models)
                     _github_model_catalog_cache_key = api_key
diff --git a/hermes_cli/nous_account.py b/hermes_cli/nous_account.py
index 654487e684..30247ff661 100644
--- a/hermes_cli/nous_account.py
+++ b/hermes_cli/nous_account.py
@@ -396,6 +396,50 @@ def get_nous_portal_account_info(
     )
 
 
+def nous_policy_present() -> Optional[bool]:
+    """Whether the caller's org carries a restrictive model/provider policy.
+
+    Reads the ``policy_present`` claim off the access token, so it costs no
+    request; ``/api/oauth/account`` does not carry it. Stamped at mint time, so
+    it goes stale until the next token refresh.
+
+    ``None`` is unknown — an older mint or an unreadable claim — and must not be
+    reported as the absence of a policy.
+    """
+    try:
+        from hermes_cli.auth import get_provider_auth_state, _decode_jwt_claims
+
+        state = get_provider_auth_state("nous") or {}
+        access_token = state.get("access_token")
+        if not isinstance(access_token, str) or not access_token.strip():
+            return None
+        claims = _decode_jwt_claims(access_token)
+        if not claims:
+            return None
+        return _coerce_bool(claims.get("policy_present"))
+    except Exception:
+        return None
+
+
+def nous_policy_notice(*, removed: bool) -> str:
+    """A one-line notice for a list the org's policy narrowed, else ``""``.
+
+    A blocked model is omitted rather than marked, which reads as "Hermes does
+    not support this". This says which it is without enumerating the blocked
+    set, which under an allowlist is most of the catalog.
+
+    *removed* is whether the filter actually dropped anything. The catalog read
+    fails open — an anonymous or empty one narrows nothing — so the claim alone
+    would label a full list as filtered.
+    """
+    if not removed or nous_policy_present() is not True:
+        return ""
+    return (
+        "Your organization restricts which models are available — "
+        "models outside its policy are not listed."
+    )
+
+
 def _fresh_account_info(
     *,
     state: dict[str, Any],
diff --git a/hermes_cli/nous_subscription.py b/hermes_cli/nous_subscription.py
index f9ca7ef35f..a930989e60 100644
--- a/hermes_cli/nous_subscription.py
+++ b/hermes_cli/nous_subscription.py
@@ -505,6 +505,10 @@ def get_nous_subscription_features(
     direct_exa = bool(get_env_value("EXA_API_KEY"))
     direct_firecrawl = bool(get_env_value("FIRECRAWL_API_KEY") or get_env_value("FIRECRAWL_API_URL"))
     direct_parallel = bool(get_env_value("PARALLEL_API_KEY"))
+    direct_tavily = bool(get_env_value("TAVILY_API_KEY"))
+    # Keyless Tavily is opt-in: selecting it in `hermes tools` / setup writes
+    # web.backend (or a per-capability override) without requiring a key.
+    tavily_selected = "tavily" in {web_backend, web_search_backend, web_extract_backend}
     direct_searxng = bool(get_env_value("SEARXNG_URL"))
     direct_fal = fal_key_is_configured()
     direct_fal_video = direct_fal  # same FAL_KEY; separate var so use_gateway is independent
@@ -536,6 +540,8 @@ def get_nous_subscription_features(
         direct_firecrawl = False
         direct_exa = False
         direct_parallel = False
+        direct_tavily = False
+        tavily_selected = False
     if image_use_gateway:
         direct_fal = False
     if video_use_gateway:
@@ -624,6 +630,7 @@ def get_nous_subscription_features(
         direct_camofox = False
 
 
+    tavily_ready = direct_tavily or tavily_selected
     web_managed = web_backend == "firecrawl" and managed_web_available and not direct_firecrawl
     web_active = bool(
         web_tool_enabled
@@ -632,6 +639,7 @@ def get_nous_subscription_features(
             or (web_backend == "exa" and direct_exa)
             or (web_backend == "firecrawl" and direct_firecrawl)
             or (web_backend == "parallel" and direct_parallel)
+            or (web_backend == "tavily" and tavily_ready)
             or (web_backend == "searxng" and direct_searxng)
             # Per-capability overrides: search_backend or extract_backend may be set
             # without web.backend (using the new split config from #20061)
@@ -639,6 +647,8 @@ def get_nous_subscription_features(
             or (web_search_backend == "exa" and direct_exa)
             or (web_search_backend == "firecrawl" and direct_firecrawl)
             or (web_search_backend == "parallel" and direct_parallel)
+            or (web_search_backend == "tavily" and tavily_ready)
+            or (web_extract_backend == "tavily" and tavily_ready)
         )
     )
     web_available = bool(
@@ -646,6 +656,7 @@ def get_nous_subscription_features(
         or direct_exa
         or direct_firecrawl
         or direct_parallel
+        or tavily_ready
         or direct_searxng
     )
 
@@ -889,6 +900,7 @@ def apply_nous_managed_defaults(
 
     if "web" in selected_toolsets and not features.web.explicit_configured and not (
         get_env_value("PARALLEL_API_KEY")
+        or get_env_value("TAVILY_API_KEY")
         or get_env_value("FIRECRAWL_API_KEY")
         or get_env_value("FIRECRAWL_API_URL")
     ):
@@ -986,6 +998,7 @@ def _get_gateway_direct_credentials() -> Dict[str, bool]:
             get_env_value("FIRECRAWL_API_KEY")
             or get_env_value("FIRECRAWL_API_URL")
             or get_env_value("PARALLEL_API_KEY")
+            or get_env_value("TAVILY_API_KEY")
             or get_env_value("EXA_API_KEY")
             # Env-configured keyless local backend: a reachable self-hosted
             # SearXNG is a working web setup even with no stored selection
diff --git a/hermes_cli/observability/relay_shared_metrics.py b/hermes_cli/observability/relay_shared_metrics.py
index 2ab88f51c3..5a97c8a18d 100644
--- a/hermes_cli/observability/relay_shared_metrics.py
+++ b/hermes_cli/observability/relay_shared_metrics.py
@@ -132,6 +132,9 @@ class _Runtime:
         self._sessions: dict[str, _MetricsSession] = {}
         self._task_creation_lock = threading.RLock()
         self._task_sessions_lock = threading.RLock()
+        # Guards the opt-in send pass: at most one in flight per process.
+        self._send_lock = threading.RLock()
+        self._send_thread: threading.Thread | None = None
         self._task_sessions: dict[tuple[str, str], _MetricsSession] = {}
         self._turn_sessions: dict[tuple[str, str], _MetricsSession] = {}
         self._subscriber_name = f"{SUBSCRIBER_NAME}.{self.host.runtime_id}"
@@ -668,6 +671,12 @@ class _Runtime:
         self._safe(self.relay.subscribers.deregister, self._subscriber_name)
         self.host.release_managed_execution(self._subscriber_name)
         self._registered = False
+        # The final export above may have started a send. Give it the same
+        # bounded chance to finish that deactivate() gets — without this a
+        # short-lived CLI process exits immediately and kills the daemon
+        # thread mid-request, which is the common case for the one cadence
+        # this feature has.
+        self._join_send_thread()
         try:
             atexit.unregister(self.shutdown)
         except Exception:
@@ -706,11 +715,29 @@ class _Runtime:
         with self._task_sessions_lock:
             self._task_sessions.clear()
             self._turn_sessions.clear()
+        self._join_send_thread()
         try:
             atexit.unregister(self.shutdown)
         except Exception:
             pass
 
+    def _join_send_thread(self, timeout: float = 2.0) -> None:
+        """Give an in-flight send a brief chance to finish at exit.
+
+        Bounded on purpose: the packages stay pending in SQLite and go out on
+        the next run, so blocking a user's shutdown for a slow network is the
+        wrong trade. The thread is a daemon, so an unfinished pass dies with
+        the process rather than holding it open.
+        """
+        with self._send_lock:
+            thread = self._send_thread
+        if thread is None or not thread.is_alive():
+            return
+        try:
+            thread.join(timeout)
+        except Exception:
+            logger.debug("Shared-metrics send thread join failed", exc_info=True)
+
     def _session(self, event: dict[str, Any]) -> _MetricsSession | None:
         session_id = str(event.get("session_id") or "")
         with self._sessions_lock:
@@ -1048,7 +1075,104 @@ class _Runtime:
         return True
 
     def _export(self) -> None:
-        self._safe(self.subscriber.store.create_and_export_package_if_due)
+        exported = self._safe(self.subscriber.store.create_and_export_package_if_due)
+        # Sending is opt-in and must never delay the caller: _export runs on
+        # finish_task, which is the user's interactive path. Errors inside the
+        # sender are already swallowed there; the thread is about latency, not
+        # correctness.
+        if exported is not None:
+            self._safe(self._send_exported_packages)
+
+    def _observe_send_consent(self, send_enabled: bool) -> None:
+        """Reconcile consent windows with the observed config state.
+
+        Thin wrapper over the SINGLE consent writer. The old edge-detection
+        body (last-seen key, rising/falling branches) is gone: reconciliation
+        derives the correct window state from what it observes, so there is
+        no transition to miss and no ordering between callers to get wrong.
+
+        Failures must never break the export hook, but they are logged at
+        warning rather than debug: silently failing to close a consent window
+        is a privacy-relevant event, not routine bookkeeping.
+        """
+        try:
+            from hermes_cli.observability.shared_metrics_sender import (
+                reconcile_send_consent,
+            )
+            from hermes_cli.sqlite_util import write_txn
+
+            with self.subscriber.store._connection() as connection:
+                with write_txn(connection):
+                    reconcile_send_consent(connection, send_enabled)
+        except Exception:
+            logger.warning(
+                "Unable to record a shared-metrics consent transition",
+                exc_info=True,
+            )
+
+    def _send_exported_packages(self) -> None:
+        from hermes_cli.observability.shared_metrics_send_config import (
+            resolve_send_config,
+        )
+
+        try:
+            from hermes_cli.config import read_raw_config_readonly
+
+            config = read_raw_config_readonly() or {}
+        except Exception:
+            logger.debug("Unable to read shared-metrics send policy", exc_info=True)
+            return
+
+        resolved = resolve_send_config(config)
+
+        # Observe the consent EDGE before deciding whether to send. Recording
+        # revocation inside the send loop (as an earlier fix did) can never
+        # work: the dominant case is the user turning sending off while no
+        # pass is running, and then this method returns below without ever
+        # constructing a sender. The window has to close on the transition,
+        # not on the next transmission that by definition will not happen.
+        self._observe_send_consent(resolved.send)
+
+        if not resolved.send:
+            return
+
+        with self._send_lock:
+            # One in-flight pass per process. A queued second pass would add
+            # nothing: the next hook fire picks up whatever is still pending.
+            if self._send_thread is not None and self._send_thread.is_alive():
+                return
+            thread = threading.Thread(
+                target=self._run_send_pass,
+                args=(resolved.endpoint,),
+                name="hermes-shared-metrics-send",
+                daemon=True,
+            )
+            self._send_thread = thread
+            thread.start()
+
+    def _run_send_pass(self, endpoint: str) -> None:
+        from hermes_cli.observability.shared_metrics_sender import (
+            SharedMetricsSender,
+        )
+
+        def still_consented() -> bool:
+            """Re-read consent so revoking `send` stops an in-flight pass."""
+            from hermes_cli.config import read_raw_config_readonly
+            from hermes_cli.observability.shared_metrics_send_config import (
+                resolve_send_config,
+            )
+
+            resolved = resolve_send_config(read_raw_config_readonly() or {})
+            return resolved.send and resolved.endpoint == endpoint
+
+        try:
+            SharedMetricsSender(
+                self.subscriber.store,
+                endpoint,
+                consent_check=still_consented,
+            ).send_pending()
+        except Exception:
+            logger.warning("Shared-metrics send pass failed", exc_info=True)
 
     def _event_metadata(self) -> dict[str, str]:
         return {
@@ -1101,8 +1225,62 @@ def handles_hook(hook_name: str) -> bool:
     return hook_name in HANDLED_HOOKS and enabled()
 
 
+_consent_reconcile_done = False
+
+
+def _reconcile_send_consent_once() -> None:
+    """Reconcile consent windows with config, once per process.
+
+    Runs BEFORE and INDEPENDENT of the collection gate — that placement is
+    the fix for the round-5 D1 leak, where the only idle-path consent
+    observer sat behind ``handles_hook()`` and became dead code the moment
+    ``enabled: false`` was set. A user with collection off still gets their
+    send-consent windows reconciled here.
+
+    Skipped only when there is no store on disk AND consent is off: with no
+    store there are no packages, so there is nothing a window could protect,
+    and creating ``~/.hermes/telemetry`` for every fully-disabled user would
+    be a behaviour change in the wrong direction.
+    """
+    global _consent_reconcile_done
+    if _consent_reconcile_done:
+        return
+    _consent_reconcile_done = True
+    try:
+        from hermes_cli.config import read_raw_config_readonly
+        from hermes_cli.observability.shared_metrics import SharedMetricsStore
+        from hermes_cli.observability.shared_metrics_send_config import (
+            resolve_send_config,
+        )
+        from hermes_cli.observability.shared_metrics_sender import (
+            reconcile_send_consent,
+        )
+        from hermes_cli.sqlite_util import write_txn
+        from hermes_constants import get_hermes_home
+
+        resolved = resolve_send_config(read_raw_config_readonly() or {})
+        # Probe for an existing store WITHOUT constructing one: the
+        # constructor creates the directory and schema as a side effect,
+        # which round 6 caught making this skip dead code — every
+        # fully-disabled user was getting a ~/.hermes/telemetry directory.
+        default_path = (
+            get_hermes_home() / "telemetry" / "shared_metrics" / "metrics.sqlite3"
+        )
+        if not resolved.send and not default_path.exists():
+            return
+        store = SharedMetricsStore()
+        with store._connection() as connection:
+            with write_txn(connection):
+                reconcile_send_consent(connection, resolved.send)
+    except Exception:
+        logger.warning(
+            "Unable to reconcile shared-metrics send consent", exc_info=True
+        )
+
+
 def observe_lifecycle(hook_name: str, **kwargs: Any) -> None:
     """Project one Hermes lifecycle event into the core Relay integration."""
+    _reconcile_send_consent_once()
     if not handles_hook(hook_name):
         return
     if not relay_runtime.relay_instrumentation_enabled():
diff --git a/hermes_cli/observability/shared_metrics.py b/hermes_cli/observability/shared_metrics.py
index fd42b06230..87094922d9 100644
--- a/hermes_cli/observability/shared_metrics.py
+++ b/hermes_cli/observability/shared_metrics.py
@@ -337,6 +337,8 @@ class SharedMetricsStore:
             )
             """
         )
+        SharedMetricsStore._add_send_columns(connection)
+        SharedMetricsStore._add_consent_tables(connection)
         connection.execute(
             """
             INSERT INTO telemetry_state(key, value)
@@ -346,6 +348,98 @@ class SharedMetricsStore:
             (_STORE_SCHEMA_VERSION,),
         )
 
+    @staticmethod
+    def _add_send_columns(connection: sqlite3.Connection) -> None:
+        """Add transmission bookkeeping to ``package_outbox``, idempotently.
+
+        These columns are ADDITIVE and nullable, and the store schema version
+        is deliberately NOT bumped. ``_ensure_schema_in_transaction`` raises on
+        any version it does not recognise and has no forward-compatibility
+        branch, so bumping would make an older Hermes — a second profile on an
+        older build, or a rollback — hard-fail against the same database file.
+        Old readers select named columns and never ``SELECT *``, so extra
+        columns are invisible to them.
+        """
+        existing = {
+            str(row["name"])
+            for row in connection.execute("PRAGMA table_info(package_outbox)")
+        }
+        for column, declaration in (
+            # When the 202 was received. NULL = never acknowledged.
+            ("sent_at", "TEXT"),
+            # NULL/'pending' = eligible, 'sent' = done, 'rejected' = permanent 400.
+            ("send_state", "TEXT"),
+            ("send_attempts", "INTEGER NOT NULL DEFAULT 0"),
+            # Earliest next attempt; enforces backoff across process restarts.
+            ("next_attempt_at", "TEXT"),
+            ("last_error", "TEXT"),
+            # The identifier actually transmitted, frozen on the first
+            # attempt so retries stay byte-identical. Since the 2026-08-27
+            # product decision this is the stable install_id itself.
+            # Only the ~36-byte id is stored: the body is recomputed from
+            # payload_json, whose serialisation is deterministic.
+            ("sent_install_id", "TEXT"),
+            # NULL until first claimed; rewritten on every claim. Settlement
+            # and the pre-POST revalidation are compare-and-set on this, so a
+            # claimant whose lease lapsed loses authority the moment another
+            # process reclaims (PR-review finding: without it, a suspended
+            # sender resuming after a reclaim double-POSTs the package).
+            ("claim_token", "TEXT"),
+        ):
+            if column not in existing:
+                connection.execute(
+                    f"ALTER TABLE package_outbox ADD COLUMN {column} {declaration}"
+                )
+
+    @staticmethod
+    def _add_consent_tables(connection: sqlite3.Connection) -> None:
+        """Create the consent-window tables, idempotently.
+
+        Additive like ``_add_send_columns`` — the schema version is
+        deliberately NOT bumped, and old readers never touch these tables.
+
+        ``send_consent_windows`` records consent as explicit intervals rather
+        than a moving day-stamp: a window is opened when send consent is
+        observed, heartbeat-confirmed on every later observation, and closed
+        at the LAST CONFIRMED moment (never "now") when consent is observed
+        withdrawn. Consent is asserted only for time that was actually
+        observed, so unobserved gaps — a hand-edited config with no process
+        running — fail closed by construction.
+
+        ``consent_marks`` holds two monotonic high-water marks with strictly
+        separated roles:
+
+        - ``obs``: the latest observation stamp ever seen. Advanced only by
+          the reconciler. Confirms consent and clamps window closes.
+        - ``data``: the latest package ``period_end`` ever stored. Advanced
+          only by the package writer. Clamps window OPENS, so a rolled-back
+          clock can never open a window underneath packages that already
+          exist on disk.
+
+        The separation is load-bearing: letting data stamps confirm consent
+        re-created a refused-window leak (packages stored during an off
+        window would vouch for it), and letting observation stamps clamp
+        opens is not enough on its own to stop a rollback sliding a window
+        under existing refused data.
+        """
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS send_consent_windows (
+                opened_at TEXT NOT NULL,
+                last_confirmed_at TEXT NOT NULL,
+                closed_at TEXT
+            )
+            """
+        )
+        connection.execute(
+            """
+            CREATE TABLE IF NOT EXISTS consent_marks (
+                name TEXT PRIMARY KEY CHECK (name IN ('obs', 'data')),
+                stamp TEXT NOT NULL
+            )
+            """
+        )
+
     @staticmethod
     def _create_counter_aggregates_table(connection: sqlite3.Connection) -> None:
         connection.execute(
@@ -580,6 +674,16 @@ class SharedMetricsStore:
                 payload["generated_at"],
             ),
         )
+        # Advance the data high-water mark. This is the ONLY writer of the
+        # 'data' mark: it clamps consent-window opens so a rolled-back clock
+        # can never open a window underneath packages that already exist.
+        connection.execute(
+            """
+            INSERT INTO consent_marks(name, stamp) VALUES ('data', ?)
+            ON CONFLICT(name) DO UPDATE SET stamp = MAX(stamp, excluded.stamp)
+            """,
+            (payload["period_end"],),
+        )
         for row in rows:
             connection.execute(
                 """
diff --git a/hermes_cli/observability/shared_metrics_send_config.py b/hermes_cli/observability/shared_metrics_send_config.py
new file mode 100644
index 0000000000..cb14027593
--- /dev/null
+++ b/hermes_cli/observability/shared_metrics_send_config.py
@@ -0,0 +1,114 @@
+"""Configuration for shared-metrics transmission.
+
+Collection (``telemetry.shared_metrics.enabled``) and transmission
+(``telemetry.shared_metrics.send``) are separate opt-ins. See
+``docs/observability/relay-shared-metrics.md`` Appendix A for the consent,
+identity, rotation, retention, and deletion decisions behind this module.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from urllib.parse import urlparse
+
+logger = logging.getLogger(__name__)
+
+#: Production ingest endpoint. Overridable through config only.
+#:
+#: Deliberately NOT overridable by an environment variable: AGENTS.md reserves
+#: HERMES_* env vars for secrets, and a behavioural override here would be a
+#: consent hazard — a user who agreed to send metrics to Nous could have them
+#: silently redirected to any host by an inherited variable, with nothing
+#: visible in their config to show it. Tests and the staging E2E write this
+#: key into a throwaway profile instead.
+DEFAULT_ENDPOINT = "https://telemetry.nousresearch.com/v1/telemetry"
+
+_LOCAL_HOSTS = frozenset({"localhost", "127.0.0.1", "::1", "[::1]"})
+
+# Module-level latch: the enabled/send mismatch is a static misconfiguration,
+# so it is reported once per process instead of on every hook fire.
+_warned_send_without_collection = False
+
+
+@dataclass(frozen=True)
+class SendConfig:
+    """Resolved transmission settings."""
+
+    #: Collection is on. Nothing is packaged or sent without it.
+    enabled: bool
+    #: Transmission is on AND permitted (that is, collection is also on).
+    send: bool
+    #: Where packages are POSTed.
+    endpoint: str
+
+
+def _endpoint_is_safe(endpoint: str) -> bool:
+    """Reject plaintext destinations unless they are loopback.
+
+    Telemetry must not leave a machine in clear text because of a typo in a
+    config file. Loopback stays allowed so tests can use a local HTTP server.
+    """
+    try:
+        parsed = urlparse(endpoint)
+    except ValueError:
+        return False
+    if parsed.scheme == "https":
+        return True
+    if parsed.scheme == "http":
+        return (parsed.hostname or "") in _LOCAL_HOSTS
+    return False
+
+
+def resolve_send_config(config: dict | None) -> SendConfig:
+    """Resolve transmission settings from config plus the environment.
+
+    Endpoint precedence: config > production default.
+
+    ``send`` is returned as False whenever transmission cannot legitimately
+    happen, so callers never have to re-check the combination.
+    """
+    global _warned_send_without_collection
+
+    raw = config if isinstance(config, dict) else {}
+    telemetry = raw.get("telemetry")
+    telemetry = telemetry if isinstance(telemetry, dict) else {}
+    shared = telemetry.get("shared_metrics")
+    shared = shared if isinstance(shared, dict) else {}
+
+    enabled = shared.get("enabled") is True
+    send_requested = shared.get("send") is True
+
+    if send_requested and not enabled:
+        # Loud, not silent: the user believes telemetry is being sent, and it
+        # never will be. Error level, once per process.
+        if not _warned_send_without_collection:
+            _warned_send_without_collection = True
+            logger.error(
+                "telemetry.shared_metrics.send is true but "
+                "telemetry.shared_metrics.enabled is false — nothing is "
+                "collected, so nothing can be sent. Enable collection or "
+                "turn sending off."
+            )
+        return SendConfig(enabled=False, send=False, endpoint=DEFAULT_ENDPOINT)
+
+    endpoint = shared.get("endpoint")
+    if not isinstance(endpoint, str) or not endpoint.strip():
+        endpoint = DEFAULT_ENDPOINT
+    endpoint = endpoint.strip()
+
+    if send_requested and not _endpoint_is_safe(endpoint):
+        logger.error(
+            "Refusing to send shared metrics to %r: telemetry must use https "
+            "(or a localhost http endpoint for testing).",
+            endpoint,
+        )
+        return SendConfig(enabled=enabled, send=False, endpoint=endpoint)
+
+    return SendConfig(enabled=enabled, send=send_requested, endpoint=endpoint)
+
+
+def reset_warning_latch_for_tests() -> None:
+    """Clear the once-per-process error latch (test support only)."""
+    global _warned_send_without_collection
+    _warned_send_without_collection = False
diff --git a/hermes_cli/observability/shared_metrics_sender.py b/hermes_cli/observability/shared_metrics_sender.py
new file mode 100644
index 0000000000..9418353c9b
--- /dev/null
+++ b/hermes_cli/observability/shared_metrics_sender.py
@@ -0,0 +1,792 @@
+"""Transmit exported shared-metrics packages to the Nous telemetry service.
+
+Implements the sender side of the ingest contract (see the telemetry repo's
+``CONTRACT.md``):
+
+* ``202`` — durably stored. Mark sent.
+* ``400`` — permanently malformed. Never retry.
+* ``429`` — keep, retry after ``Retry-After``.
+* ``5xx`` / timeout / connection error — keep, retry with backoff.
+
+Two properties are load-bearing and easy to get wrong:
+
+**The outbox directory is the user's local history, not a queue.** Packages
+are pruned by age; a ``202`` marks send state in SQLite and never deletes a
+file. See Appendix A.7 of ``docs/observability/relay-shared-metrics.md``.
+
+**Consent is gated on the package's PERIOD, not its creation time.** One
+period is split across packages created on different days, so a created-at
+gate would send a period's tail while dropping its head and silently
+undercount the first consented day. The gate itself is interval containment:
+the period must fall entirely inside a recorded consent window
+(``send_consent_windows``), maintained by the single ``reconcile_send_consent``
+writer below.
+"""
+
+from __future__ import annotations
+
+import gzip
+import json
+import logging
+import random
+import sqlite3
+import time
+import urllib.error
+import urllib.request
+import uuid
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+
+from hermes_cli.sqlite_util import write_txn
+
+logger = logging.getLogger(__name__)
+
+#: Contract recommends timing out at 30s and treating a timeout as retryable.
+REQUEST_TIMEOUT_SECONDS = 30
+
+#: In-process attempts per package per pass, then the package waits for a
+#: later pass. Backoff is 1s/5s/25s with full jitter.
+MAX_ATTEMPTS = 3
+_BACKOFF_BASE_SECONDS = 1
+_BACKOFF_FACTOR = 5
+
+#: Contract recommends gzip above roughly this size.
+GZIP_THRESHOLD_BYTES = 4096
+
+#: Packages per pass. Bounds work on an interactive hook even after an outage.
+MAX_PACKAGES_PER_PASS = 20
+
+#: How long a claimed row is held. The claim writes a LEASE INTO THE FUTURE:
+#: selection requires `next_attempt_at <= now`, so for the length of the lease
+#: no other process can take the package.
+#:
+#: This must exceed the worst case for ONE package — three 30s request
+#: timeouts plus 1s+5s of backoff, about 96s — which is why packages are
+#: claimed one at a time, immediately before being sent. An earlier revision
+#: claimed up to 20 rows under a single shared lease; a full batch can legally
+#: run ~1900s, so the later rows' leases expired while the pass still held
+#: them in memory and another process re-sent them.
+_CLAIM_LEASE_SECONDS = 300
+
+#: Floor applied after a pass fails to deliver, so a hard-down service is not
+#: retried on every task completion.
+_FAILURE_BACKOFF_SECONDS = 15 * 60
+
+#: Statuses that are permanent per the ingest contract. Deliberately narrow:
+#: 400 means the envelope is malformed and will never validate. 413 is added
+#: because a package over the service's 1 MiB cap cannot shrink on retry.
+#: Everything else — including 403 from the origin guard and 404 from a bad
+#: path — is retried, because those are usually deployment or edge
+#: misconfiguration that resolves without the package changing.
+_PERMANENT_STATUSES = frozenset({400, 413})
+
+#: Attempts after which a package is abandoned. Without a ceiling a
+#: permanently-poisoned row is retried until 30-day retention deletes it —
+#: measured at ~160 requests — which wastes the user's bandwidth and keeps a
+#: doomed package at the head of the queue.
+MAX_SEND_ATTEMPTS = 25
+
+
+def _utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _isoformat(value: datetime) -> str:
+    return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _parse_stamp(value: str) -> datetime:
+    """Parse a stamp this module itself wrote (Z-suffixed ISO-8601, UTC)."""
+    return datetime.fromisoformat(value.replace("Z", "+00:00")).astimezone(
+        timezone.utc
+    )
+
+
+@dataclass
+class SendOutcome:
+    """What one pass did. Returned for tests and diagnostics."""
+
+    sent: int = 0
+    rejected: int = 0
+    deferred: int = 0
+
+
+class _Response:
+    __slots__ = ("status", "retry_after", "body")
+
+    def __init__(self, status: int, retry_after: str | None, body: str) -> None:
+        self.status = status
+        self.retry_after = retry_after
+        self.body = body
+
+
+def _post(endpoint: str, payload: bytes, *, timeout: int) -> _Response:
+    """POST one package. Raises on transport failure; never on HTTP status."""
+    headers = {
+        "Content-Type": "application/json",
+        "User-Agent": "hermes-agent-shared-metrics/1",
+    }
+    body = payload
+    if len(payload) > GZIP_THRESHOLD_BYTES:
+        # mtime=0: gzip embeds a timestamp by default, which would make two
+        # sends of one package differ on the wire. The service decompresses
+        # before storing so it would not change what lands in S3, but a
+        # deterministic body keeps "a resend is byte-identical" true at the
+        # transport layer too, and makes the property testable.
+        body = gzip.compress(payload, mtime=0)
+        headers["Content-Encoding"] = "gzip"
+
+    request = urllib.request.Request(
+        endpoint, data=body, headers=headers, method="POST"
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return _Response(
+                response.status,
+                response.headers.get("Retry-After"),
+                response.read(2048).decode("utf-8", "replace"),
+            )
+    except urllib.error.HTTPError as exc:
+        # An HTTP error status is a normal contract outcome, not a failure.
+        return _Response(
+            exc.code,
+            exc.headers.get("Retry-After") if exc.headers else None,
+            exc.read(2048).decode("utf-8", "replace") if exc.fp else "",
+        )
+
+
+def _retry_after_seconds(value: str | None, default: int) -> int:
+    if not value:
+        return default
+    try:
+        # Contract sends seconds. Clamp so a hostile or bogus value cannot
+        # park a package for years, and never go below one second.
+        return max(1, min(int(float(value)), 86_400))
+    except (TypeError, ValueError):
+        return default
+
+
+#: Maximum distance one reconcile call can advance the 'obs' mark. Honest
+#: heartbeats arrive hours apart at most, so the cap never binds in normal
+#: operation; a machine legitimately off for months catches up in a few
+#: hook fires (fail-closed latency only). What it bounds is FORWARD clock
+#: poison: without it, a single glitched sample (NTP flap reading 2099)
+#: permanently drags the mark — and with it every window open and every
+#: confirmation horizon — decades ahead, which round 6 reproduced as a
+#: refused-data leak. Capped, one insane sample moves the mark at most
+#: this far, and real time overtakes it again.
+MAX_OBS_ADVANCE_SECONDS = 30 * 24 * 3600
+
+
+def reconcile_send_consent(
+    connection: sqlite3.Connection,
+    send_enabled: bool,
+    *,
+    now: datetime | None = None,
+) -> None:
+    """Reconcile the consent-window table with the observed config state.
+
+    THE ONLY writer of consent state. Must run inside a write transaction.
+    A pure function of (config, now, store): call it from anywhere, any
+    number of times, in any order — the resulting windows are the same. This
+    replaces the previous edge-detection design, whose three partial
+    observers (wizard, relay, mid-pass) each covered a different subset of
+    transitions and repeatedly leaked the transitions between the subsets.
+
+    Timestamp discipline (each rule is load-bearing; see the validation
+    harness in tests/hermes_cli/test_shared_metrics_consent_windows.py):
+
+    - The 'obs' mark advances to every observation stamp, monotonically —
+      but by at most ``MAX_OBS_ADVANCE_SECONDS`` per call. Unbounded, the
+      mark is monotonic in the LEAK direction: one glitched-forward sample
+      would drag ``last_confirmed_at`` decades ahead, a later close would
+      stamp that horizon, and the closed window would contain every future
+      refused period (reproduced in round 6). Bounded, a poisoned sample
+      costs at most one cap's width, and real time overtakes it.
+      An open window's ``last_confirmed_at`` follows the mark: consent is
+      asserted only for time that was actually observed.
+    - A close is stamped at ``last_confirmed_at`` — never "now" — so an
+      unobserved gap (hand-edited config, machine off for 90 days) is never
+      inside a window and fails closed.
+    - An open clamps to ``max(now, obs, data)``: a rolled-back clock cannot
+      open a window underneath refused packages already on disk, and cannot
+      make the new window adjacent to the previous close.
+    """
+    stamp = _isoformat(now or _utc_now())
+    raw_stamp = stamp  # pre-cap observation time, used to clamp closes
+    previous_obs = connection.execute(
+        "SELECT stamp FROM consent_marks WHERE name = 'obs'"
+    ).fetchone()
+    if previous_obs is not None:
+        ceiling = _isoformat(
+            _parse_stamp(str(previous_obs[0]))
+            + timedelta(seconds=MAX_OBS_ADVANCE_SECONDS)
+        )
+        stamp = min(stamp, ceiling)
+    connection.execute(
+        """
+        INSERT INTO consent_marks(name, stamp) VALUES ('obs', ?)
+        ON CONFLICT(name) DO UPDATE SET stamp = MAX(stamp, excluded.stamp)
+        """,
+        (stamp,),
+    )
+    marks = dict(
+        connection.execute("SELECT name, stamp FROM consent_marks").fetchall()
+    )
+    obs = marks["obs"]  # >= stamp; immune to clock rollback
+    data = marks.get("data")
+
+    open_row = connection.execute(
+        "SELECT rowid FROM send_consent_windows WHERE closed_at IS NULL"
+    ).fetchone()
+
+    if send_enabled:
+        if open_row is None:
+            opened = max(x for x in (obs, data) if x is not None)
+            connection.execute(
+                "INSERT INTO send_consent_windows(opened_at, last_confirmed_at)"
+                " VALUES (?, ?)",
+                (opened, opened),
+            )
+        else:
+            connection.execute(
+                "UPDATE send_consent_windows"
+                " SET last_confirmed_at = MAX(last_confirmed_at, ?)"
+                " WHERE rowid = ?",
+                (obs, open_row[0]),
+            )
+    elif open_row is not None:
+        # Close at the last CONFIRMED moment, but never after the closing
+        # observation's own raw stamp. The two clamps serve different
+        # adversaries and both are load-bearing:
+        # - min with last_confirmed_at: an unobserved gap (machine off,
+        #   hand-edited config) is never asserted as consented (v1's leak).
+        # - min with the RAW stamp (pre-cap, pre-MAX): if last_confirmed_at
+        #   was poisoned by a glitched-forward sample, an honest clock at
+        #   revoke time pulls the close back to the true revoke moment, so
+        #   the refused era that follows falls OUTSIDE the closed window
+        #   (round 6's D1 leak). A rolled-back clock at close time only
+        #   closes EARLIER — fail-closed.
+        connection.execute(
+            "UPDATE send_consent_windows"
+            " SET closed_at = MIN(last_confirmed_at, ?)"
+            " WHERE rowid = ?",
+            (raw_stamp, open_row[0]),
+        )
+
+
+#: Claim-time consent predicate: the package's period must fall entirely
+#: inside SOME recorded consent window. An open window vouches only up to its
+#: last confirmed moment, so a package whose period runs past it waits for
+#: the next reconcile heartbeat (fail-closed; released within one hook fire).
+CONSENT_GATE_SQL = """EXISTS (
+    SELECT 1 FROM send_consent_windows w
+    WHERE package_outbox.period_start >= w.opened_at
+      AND package_outbox.period_end <=
+          CASE WHEN w.closed_at IS NULL THEN w.last_confirmed_at
+               ELSE w.closed_at END
+)"""
+
+
+def _state_get(connection: sqlite3.Connection, key: str) -> str | None:
+    row = connection.execute(
+        "SELECT value FROM telemetry_state WHERE key = ?", (key,)
+    ).fetchone()
+    return str(row[0]) if row is not None else None
+
+
+def _state_set(connection: sqlite3.Connection, key: str, value: str) -> None:
+    connection.execute(
+        """
+        INSERT INTO telemetry_state(key, value) VALUES (?, ?)
+        ON CONFLICT(key) DO UPDATE SET value = excluded.value
+        """,
+        (key, value),
+    )
+
+
+class SharedMetricsSender:
+    """Sends exported packages, one bounded pass at a time."""
+
+    def __init__(
+        self,
+        store,
+        endpoint: str,
+        *,
+        post=_post,
+        sleep=time.sleep,
+        now=_utc_now,
+        max_attempts: int = MAX_ATTEMPTS,
+        consent_check=None,
+    ) -> None:
+        self._store = store
+        self._endpoint = endpoint
+        self._post = post
+        self._sleep = sleep
+        self._now = now
+        self._max_attempts = max_attempts
+        # Called before every package. None disables the check for callers
+        # that have already established consent out of band (tests, E2E).
+        self._consent_check = consent_check
+
+    # -- selection ---------------------------------------------------------
+
+    def _claim_next(self, now: datetime, seen: set[str]) -> dict | None:
+        """Claim exactly ONE package, immediately before it is sent.
+
+        Claiming a whole batch up front does not work: a single shared lease
+        has to cover the entire pass, and 20 retrying packages can legally run
+        far longer than any sane lease (three 30s timeouts plus backoff each).
+        The later rows' leases then expire while this pass still holds them in
+        memory, and another process re-sends them. Taking one row at a time
+        keeps the lease covering only the package actually in flight.
+
+        ``seen`` holds packages this pass has already finished with. They are
+        excluded IN SQL rather than by rejecting the fetched row: with
+        ``LIMIT 1``, returning None for an already-seen row would make the
+        caller believe the queue was empty and abandon every healthy package
+        behind it. A row can legitimately become eligible again mid-pass (a
+        short Retry-After, or a pass that outlives the 15-minute failure
+        backoff), so this is reachable in normal operation, not just in tests.
+        """
+        with self._store._connection() as connection:
+            with write_txn(connection):
+                stamp = _isoformat(now)
+                lease_until = now + timedelta(seconds=_CLAIM_LEASE_SECONDS)
+
+                placeholders = ",".join("?" for _ in seen)
+                exclusion = (
+                    f" AND package_id NOT IN ({placeholders})" if seen else ""
+                )
+                # Consent is a READ here — the claim must never mutate the
+                # window table. The old design's opt_in_period() call at this
+                # exact spot meant selecting a row could rewrite what was
+                # permitted to be sent (and did, under a rolled-back clock).
+                row = connection.execute(
+                    f"""
+                    SELECT package_id, payload_json, sent_install_id
+                    FROM package_outbox
+                    WHERE exported_at IS NOT NULL
+                      AND (send_state IS NULL OR send_state = 'pending')
+                      AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+                      AND {CONSENT_GATE_SQL}
+                      AND send_attempts < ?
+                      {exclusion}
+                    ORDER BY created_at, package_id
+                    LIMIT 1
+                    """,
+                    (stamp, MAX_SEND_ATTEMPTS, *sorted(seen)),
+                ).fetchone()
+                if row is None:
+                    return None
+
+                package_id = str(row[0])
+                derived = row[2]
+                if not derived:
+                    derived = self._freeze_identity(
+                        connection, package_id, row[1], now
+                    )
+                    if derived is None:
+                        # Unusable row, already marked rejected. Signal the
+                        # caller to continue rather than stop.
+                        return {"package_id": package_id, "skip": True}
+
+                token = str(uuid.uuid4())
+                connection.execute(
+                    """
+                    UPDATE package_outbox
+                    SET send_state = 'pending',
+                        send_attempts = send_attempts + 1,
+                        next_attempt_at = ?,
+                        claim_token = ?
+                    WHERE package_id = ?
+                    """,
+                    # Lease INTO THE FUTURE: selection requires
+                    # next_attempt_at <= now, so no other process can take
+                    # this row while it is in flight. Success or a real
+                    # backoff overwrites it; if this process dies, it expires.
+                    # The token is this claim's identity: a reclaim after
+                    # expiry mints a new one, and every later write by THIS
+                    # claimant is compare-and-set against it, so a lapsed
+                    # claimant that resumes cannot settle or transmit.
+                    (_isoformat(lease_until), token, package_id),
+                )
+                return {
+                    "package_id": package_id,
+                    "payload_json": str(row[1]),
+                    "derived": str(derived),
+                    "claim_token": token,
+                    "skip": False,
+                }
+
+    def _freeze_identity(
+        self,
+        connection: sqlite3.Connection,
+        package_id: str,
+        payload_json,
+        now: datetime,
+    ) -> str | None:
+        """Record the transmitted id on the row, or reject an unusable one.
+
+        The stable install_id is transmitted as-is (product decision,
+        2026-08-27 — see the doc's A.2). What remains of "freezing" is the
+        validation and the audit column: ``sent_install_id`` records exactly
+        what the wire will carry, and rejecting unusable rows here rather
+        than raising matters because an exception rolls back the claim
+        transaction and blocks every healthy package behind this one.
+        """
+        reason = None
+        install_id = None
+        try:
+            payload = json.loads(payload_json)
+        except (TypeError, ValueError):
+            reason = "unreadable payload"
+        else:
+            # Valid JSON is not enough: a top-level array, string, number or
+            # null parses cleanly and then has no .get().
+            if not isinstance(payload, dict):
+                reason = f"payload is {type(payload).__name__}, expected object"
+            else:
+                install_id = payload.get("install_id")
+                if not isinstance(install_id, str) or not install_id.strip():
+                    reason = "payload has no usable install_id"
+
+        if reason is not None:
+            logger.warning(
+                "Shared-metrics package %s cannot be sent (%s)", package_id, reason
+            )
+            connection.execute(
+                """
+                UPDATE package_outbox
+                SET send_state = 'rejected', last_error = ?
+                WHERE package_id = ?
+                """,
+                (reason, package_id),
+            )
+            return None
+
+        connection.execute(
+            "UPDATE package_outbox SET sent_install_id = ? WHERE package_id = ?",
+            (install_id, package_id),
+        )
+        return str(install_id)
+
+    # -- transmission ------------------------------------------------------
+
+    def _body(self, payload_json: str, transmitted_id: str) -> bytes:
+        """Rebuild the exact bytes to send.
+
+        The payload is recomputed from the stored package rather than kept as
+        a second copy: json.dumps with these options is deterministic. The
+        install_id is written from the frozen ``sent_install_id`` column
+        rather than trusted implicitly, keeping "a resend is byte-identical"
+        anchored to one recorded value.
+        """
+        payload = json.loads(payload_json)
+        payload = dict(payload)
+        payload["install_id"] = transmitted_id
+        return json.dumps(payload, indent=2, sort_keys=True).encode("utf-8")
+
+    def _mark(
+        self,
+        package_id: str,
+        *,
+        only_if_pending: bool = True,
+        token: str | None = None,
+        **columns,
+    ) -> None:
+        """Write send state for one package.
+
+        Guarded on send_state so a pass whose lease lapsed cannot resurrect a
+        row another process has already finished: without this, a slow sender
+        could overwrite 'sent' back to 'pending' and cause a re-send.
+
+        When ``token`` is given, the write is additionally compare-and-set on
+        claim_token: it lands only if THIS claim is still the current one. A
+        claimant that lapsed and was superseded writes zero rows — its
+        settlement, backoff, and error strings all silently lose to the
+        newer claim's, which is the correct outcome.
+        """
+        assignments = ", ".join(f"{name} = ?" for name in columns)
+        predicate = (
+            " AND (send_state IS NULL OR send_state = 'pending')"
+            if only_if_pending
+            else ""
+        )
+        params: list = [*columns.values(), package_id]
+        if token is not None:
+            predicate += " AND claim_token = ?"
+            params.append(token)
+        with self._store._connection() as connection:
+            with write_txn(connection):
+                connection.execute(
+                    f"UPDATE package_outbox SET {assignments} "
+                    f"WHERE package_id = ?{predicate}",
+                    params,
+                )
+
+    def _renew_claim(self, package_id: str, token: str | None) -> bool:
+        """Atomically re-assert ownership and extend the lease. CAS, one row.
+
+        A read-only ownership check is not enough: a claimant whose lease
+        expired while suspended can pass the check (its token is still in
+        the row if no one reclaimed yet) and then POST while another process
+        legitimately reclaims — the check-to-POST expiry race a seventh
+        review reproduced. Renewal closes it by requiring, in ONE statement:
+
+        - the token still matches (nobody reclaimed), AND
+        - the current lease is UNEXPIRED (this claimant is not stale), AND
+        - the row is still pending,
+
+        and only then pushing next_attempt_at a fresh lease into the future,
+        so the upcoming POST (30s timeout, well under the 300s lease) runs
+        entirely inside renewed authority. rowcount == 1 is the only grant.
+        A claimant that wakes past its own lease fails the unexpired
+        condition and yields even though its token was never replaced.
+        """
+        if token is None:
+            return False
+        try:
+            now = self._now()
+            lease_until = now + timedelta(seconds=_CLAIM_LEASE_SECONDS)
+            with self._store._connection() as connection:
+                with write_txn(connection):
+                    cursor = connection.execute(
+                        """
+                        UPDATE package_outbox
+                        SET next_attempt_at = ?
+                        WHERE package_id = ?
+                          AND claim_token = ?
+                          AND (send_state IS NULL OR send_state = 'pending')
+                          AND next_attempt_at > ?
+                        """,
+                        (
+                            _isoformat(lease_until),
+                            package_id,
+                            token,
+                            _isoformat(now),
+                        ),
+                    )
+                    return cursor.rowcount == 1
+        except Exception:
+            # If renewal itself fails, do not transmit on unproven authority.
+            logger.warning(
+                "Unable to renew shared-metrics claim", exc_info=True
+            )
+            return False
+
+    def _defer(
+        self,
+        package_id: str,
+        delay_seconds: int,
+        reason: str,
+        *,
+        token: str | None = None,
+    ) -> None:
+        # Defence in depth: no current caller can pass a non-positive delay
+        # (Retry-After is already clamped to [1, 86400] when parsed, and every
+        # other call site passes a positive constant), so this clamp is
+        # deliberately unreachable today and no test can distinguish it. It
+        # stays because a past deadline would make the row instantly
+        # re-eligible and let a pass spin on it — a cheap guard against a
+        # future caller that forgets.
+        delay = max(1, int(delay_seconds))
+        retry_at = self._now().timestamp() + delay
+        self._mark(
+            package_id,
+            token=token,
+            send_state="pending",
+            next_attempt_at=_isoformat(
+                datetime.fromtimestamp(retry_at, tz=timezone.utc)
+            ),
+            last_error=reason[:500],
+        )
+
+    def _send_one(self, package: dict) -> str:
+        """Try one package. Returns 'sent', 'rejected', or 'deferred'.
+
+        Delivery is at-least-once. The pre-POST ownership check plus the
+        token-fenced writes close the claim->POST and settle-after-reclaim
+        gaps, but a suspension landing MID-POST (bytes already on the wire
+        when the machine sleeps) can still duplicate: no client-side check
+        can revoke a request in flight. The body is byte-identical across
+        retries by construction, so the residual duplicate is exactly one
+        redundant copy of identical content; collapsing it fully would need
+        package_id-keyed dedupe at the ingest service.
+        """
+        package_id = package["package_id"]
+        token = package.get("claim_token")
+        body = self._body(package["payload_json"], package["derived"])
+
+        for attempt in range(1, self._max_attempts + 1):
+            # Atomically renew the claim before EVERY external POST. The
+            # renewal is compare-and-set on (token, pending, lease unexpired)
+            # and extends the lease past the request, so a suspended-then-
+            # resumed claimant whose lease lapsed yields here even if nobody
+            # has reclaimed yet — a read-only ownership check passed in that
+            # state and still double-sent (check-to-POST expiry race). The
+            # ingest key is minute-prefixed, so duplicates become distinct
+            # stored objects, not overwrites.
+            if not self._renew_claim(package_id, token):
+                logger.info(
+                    "Shared-metrics claim on %s superseded or expired; yielding",
+                    package_id,
+                )
+                return "deferred"
+            try:
+                response = self._post(
+                    self._endpoint, body, timeout=REQUEST_TIMEOUT_SECONDS
+                )
+            except Exception as exc:  # transport failure: offline, DNS, TLS
+                reason = f"{type(exc).__name__}: {exc}"
+                if attempt >= self._max_attempts:
+                    self._defer(
+                        package_id, _FAILURE_BACKOFF_SECONDS, reason, token=token
+                    )
+                    return "deferred"
+                self._sleep(self._backoff(attempt))
+                continue
+
+            if response.status == 202:
+                self._mark(
+                    package_id,
+                    token=token,
+                    send_state="sent",
+                    sent_at=_isoformat(self._now()),
+                    last_error=None,
+                )
+                return "sent"
+
+            if response.status in _PERMANENT_STATUSES:
+                # Only statuses the contract (or the envelope schema) makes
+                # terminal. Everything else retries: 403 in particular is the
+                # ingest service's origin guard, which returns 403 during an
+                # edge/Transform-Rule misconfiguration — treating that as
+                # permanent would discard every package sent during the
+                # incident instead of retrying after recovery.
+                logger.warning(
+                    "Telemetry package %s rejected with HTTP %s; not retrying",
+                    package_id,
+                    response.status,
+                )
+                self._mark(
+                    package_id,
+                    token=token,
+                    send_state="rejected",
+                    last_error=f"HTTP {response.status}: {response.body[:400]}",
+                )
+                return "rejected"
+
+            if response.status == 429:
+                self._defer(
+                    package_id,
+                    _retry_after_seconds(response.retry_after, _FAILURE_BACKOFF_SECONDS),
+                    "rate limited",
+                    token=token,
+                )
+                return "deferred"
+
+            # 5xx and anything unexpected: retryable.
+            reason = f"HTTP {response.status}"
+            if attempt >= self._max_attempts:
+                self._defer(
+                    package_id, _FAILURE_BACKOFF_SECONDS, reason, token=token
+                )
+                return "deferred"
+            self._sleep(self._backoff(attempt))
+
+        self._defer(
+            package_id, _FAILURE_BACKOFF_SECONDS, "attempts exhausted", token=token
+        )
+        return "deferred"
+
+    @staticmethod
+    def _backoff(attempt: int) -> float:
+        """1s, 5s, 25s with full jitter."""
+        ceiling = _BACKOFF_BASE_SECONDS * (_BACKOFF_FACTOR ** (attempt - 1))
+        return random.uniform(0, ceiling)
+
+    # -- entry point -------------------------------------------------------
+
+    def send_pending(self) -> SendOutcome:
+        """Run one bounded pass. Never raises.
+
+        Claims and sends ONE package at a time so each row's lease only has to
+        cover its own transmission, and re-checks consent before every send so
+        revoking `send` mid-pass stops the remaining packages.
+        """
+        outcome = SendOutcome()
+        seen: set[str] = set()
+
+        for _ in range(MAX_PACKAGES_PER_PASS):
+            if not self._still_consented():
+                # The user turned sending off while this pass was running.
+                # Stop without transmitting anything further, and reconcile
+                # so the window closes at its last confirmed moment. This is
+                # the same single writer every other observation point uses —
+                # not a separate recording mechanism.
+                logger.info("Shared-metrics sending disabled mid-pass; stopping")
+                self._reconcile(send_enabled=False)
+                break
+            try:
+                package = self._claim_next(self._now(), seen)
+            except Exception:
+                logger.warning(
+                    "Unable to select shared-metrics packages", exc_info=True
+                )
+                break
+            if package is None:
+                break
+
+            seen.add(package["package_id"])
+            if package.get("skip"):
+                # Unusable row already marked rejected during the claim.
+                outcome.rejected += 1
+                continue
+
+            try:
+                result = self._send_one(package)
+            except Exception:
+                logger.warning("Unable to send shared-metrics package", exc_info=True)
+                outcome.deferred += 1
+                continue
+            if result == "sent":
+                outcome.sent += 1
+            elif result == "rejected":
+                outcome.rejected += 1
+            else:
+                outcome.deferred += 1
+        return outcome
+
+    def _reconcile(self, *, send_enabled: bool) -> None:
+        """Run the single consent writer from within a pass."""
+        try:
+            with self._store._connection() as connection:
+                with write_txn(connection):
+                    reconcile_send_consent(
+                        connection, send_enabled, now=self._now()
+                    )
+        except Exception:
+            logger.warning(
+                "Unable to reconcile shared-metrics consent", exc_info=True
+            )
+
+    def _still_consented(self) -> bool:
+        """Re-read profile-owned send consent.
+
+        Consent is a boundary, not cached configuration: the documentation
+        promises that setting `send: false` stops transmission immediately,
+        and a pass can run for minutes. Injected senders (tests, the staging
+        E2E) opt out by passing consent_check=None.
+        """
+        if self._consent_check is None:
+            return True
+        try:
+            return bool(self._consent_check())
+        except Exception:
+            # Fail CLOSED: if consent cannot be established, do not transmit.
+            logger.warning(
+                "Unable to confirm shared-metrics send consent; stopping",
+                exc_info=True,
+            )
+            return False
diff --git a/hermes_cli/platform_actions.py b/hermes_cli/platform_actions.py
index 52e0b68fce..de52a591e7 100644
--- a/hermes_cli/platform_actions.py
+++ b/hermes_cli/platform_actions.py
@@ -99,7 +99,36 @@ class PlatformActions:
             platform_enum = Platform(str(platform).strip().lower())
         except Exception:
             return None, _err("unknown_platform", f"unknown platform {platform!r}")
-        adapter = getattr(runner, "adapters", {}).get(platform_enum)
+        # Multiplex/Team-Gateway: a secondary profile's adapters live in
+        # runner._profile_adapters[profile], not runner.adapters (the default
+        # profile's registry) — every other adapter-resolution path in this
+        # codebase (_authorization_adapter, plugin message-injection) goes
+        # through this same profile-aware, fail-closed lookup so a plugin
+        # scoped to one profile can never act through another profile's bot
+        # identity. Falls back to the bare default-profile lookup only when
+        # the gateway runner predates this method (defensive, not expected).
+        resolve_fn = getattr(runner, "_authorization_adapter", None)
+        if callable(resolve_fn):
+            try:
+                from hermes_cli.profiles import get_active_profile_name
+
+                profile_name = get_active_profile_name()
+            except Exception:
+                # Fail closed: an unresolvable profile must not degrade to the
+                # default profile's bot (the same rule _authorization_adapter
+                # applies to a stamped profile with no registry entry).
+                logger.debug(
+                    "platform_actions: profile resolution failed for %s",
+                    self._plugin_id, exc_info=True,
+                )
+                return None, _err(
+                    "adapter_not_registered",
+                    f"no {platform_enum.value} adapter is registered "
+                    "(active profile could not be resolved)",
+                )
+            adapter = resolve_fn(platform_enum, profile_name)
+        else:
+            adapter = getattr(runner, "adapters", {}).get(platform_enum)
         if adapter is None:
             return None, _err(
                 "adapter_not_registered",
diff --git a/hermes_cli/plugins.py b/hermes_cli/plugins.py
index 9028e28530..3188526912 100644
--- a/hermes_cli/plugins.py
+++ b/hermes_cli/plugins.py
@@ -4262,18 +4262,21 @@ class PluginManager:
                 # first process sees plugin backends (tracking #64177).
                 self._refresh_secret_sources_after_discovery()
                 if force:
-                    # config.yaml shell hooks live in ``_hooks`` but are
-                    # config-owned, not plugin-owned — the ledger-driven
-                    # unload() above wiped them and cannot restore them.
-                    # Re-register so force-reload is symmetric (#60036;
-                    # tracking #64178 — salvaged from PR #64188).
-                    self._re_register_shell_hooks_after_force()
+                    # config.yaml shell hooks and outbound webhooks live in
+                    # ``_hooks`` but are config-owned, not plugin-owned —
+                    # the ledger-driven unload() above wiped them and
+                    # cannot restore them. Re-register so force-reload is
+                    # symmetric (#60036; tracking #64178 — salvaged from
+                    # PR #64188; outbound webhooks added per #92682 review).
+                    self._re_register_config_hooks_after_force()
             except BaseException:
                 self._discovered = False
                 raise
 
-    def _re_register_shell_hooks_after_force(self) -> None:
-        """Restore config.yaml shell hooks wiped by force-clear of ``_hooks``."""
+    def _re_register_config_hooks_after_force(self) -> None:
+        """Restore config.yaml shell hooks/outbound webhooks wiped by
+        force-clear of ``_hooks``. Each re-register call is independently
+        guarded so one failing does not skip the other."""
         try:
             from agent.shell_hooks import re_register_config_hooks
 
@@ -4281,6 +4284,14 @@ class PluginManager:
         except Exception as exc:
             # Import cycle / missing module must not abort force reload.
             logger.debug("force-reload shell-hook re-register skipped: %s", exc)
+        try:
+            from agent.outbound_webhooks import (
+                re_register_config_hooks as re_register_outbound_webhooks,
+            )
+
+            re_register_outbound_webhooks()
+        except Exception as exc:
+            logger.debug("force-reload outbound-webhook re-register skipped: %s", exc)
 
     def _refresh_secret_sources_after_discovery(self) -> None:
         """If any plugin secret source is enabled, reset cache and re-apply.
diff --git a/hermes_cli/profiles.py b/hermes_cli/profiles.py
index 389cc7933b..39ad55555c 100644
--- a/hermes_cli/profiles.py
+++ b/hermes_cli/profiles.py
@@ -838,6 +838,22 @@ def _check_gateway_running(profile_dir: Path) -> bool:
         return False
 
 
+def _served_by_running_multiplexer(profile_name: str) -> bool:
+    """True when the live default gateway multiplexes ``profile_name``.
+
+    A served named profile has no gateway.pid of its own, so
+    ``_check_gateway_running`` alone reports it stopped while the default
+    multiplexer is actually its inbound process. Single shared lookup with the
+    named-profile start guard and cron liveness (#97120).
+    """
+    try:
+        from hermes_cli.gateway import named_profile_served_by_running_multiplexer
+
+        return named_profile_served_by_running_multiplexer(profile_name)
+    except Exception:
+        return False
+
+
 # In-process cache for skill counts. Walking ``skills_dir.rglob("SKILL.md")``
 # recurses the entire skill tree (each skill carries references/scripts/assets
 # sub-trees); the default profile alone has ~270 skills, and ``list_profiles``
@@ -1084,7 +1100,10 @@ def list_profiles() -> List[ProfileInfo]:
                 name=name,
                 path=entry,
                 is_default=False,
-                gateway_running=_check_gateway_running(entry),
+                gateway_running=(
+                    _check_gateway_running(entry)
+                    or _served_by_running_multiplexer(name)
+                ),
                 model=model,
                 provider=provider,
                 has_env=(entry / ".env").exists(),
@@ -1261,6 +1280,18 @@ def create_profile(
         # Strip runtime files
         for stale in _CLONE_ALL_STRIP:
             (profile_dir / stale).unlink(missing_ok=True)
+        # A clone-all copies auth.json and .anthropic_oauth.json verbatim.
+        # Single-use OAuth grants (Anthropic / Codex / xAI) forked that way
+        # are one credential with two owners: the first profile to refresh
+        # revokes the pair for every sibling (#100339). Drop the copies; the
+        # clone reads the root grant through the credential-pool fallback.
+        from hermes_cli.auth import strip_cloned_single_use_oauth_grants
+        stripped = strip_cloned_single_use_oauth_grants(profile_dir)
+        if any(stripped.values()):
+            logger.info(
+                "profile %s: dropped cloned single-use OAuth grants %s "
+                "(inherits the root grant instead)", canon, stripped,
+            )
     else:
         # Bootstrap directory structure
         profile_dir.mkdir(parents=True, exist_ok=True)
@@ -2008,6 +2039,19 @@ def _stop_gateway_process(profile_dir: Path) -> None:
         raw = pid_file.read_text(encoding="utf-8").strip()
         data = json.loads(raw) if raw.startswith("{") else {"pid": int(raw)}
         pid = int(data["pid"])
+        # Cross-profile kill refusal (#89315): the record's hermes_home stamp
+        # names the gateway's TRUE owner. A contaminated/poisoned gateway.pid
+        # inside this profile dir can point at another profile's live gateway
+        # — killing it starts the mutual SIGTERM restart loop from the issue.
+        from gateway.status import recorded_gateway_home_conflicts
+
+        if recorded_gateway_home_conflicts(data, expected_home=profile_dir):
+            print(
+                f"✗ Refusing to stop PID {pid}: its recorded HERMES_HOME "
+                f"belongs to a different profile than {profile_dir} "
+                "(stale/poisoned PID record, #89315)."
+            )
+            return
         # Route through terminate_pid so Windows uses the appropriate
         # primitive (taskkill / TerminateProcess) — raw os.kill with
         # _signal.SIGKILL raises AttributeError at import time on Windows,
diff --git a/hermes_cli/providers.py b/hermes_cli/providers.py
index 87e2136a96..f3ecd99d22 100644
--- a/hermes_cli/providers.py
+++ b/hermes_cli/providers.py
@@ -1023,6 +1023,29 @@ def resolve_provider_full(
     if custom_pdef is not None:
         return custom_pdef
 
+    # 2c. Managed local runtime: the llamacpp aliases are a real provider
+    # whenever the managed server (or a detected external one) resolves —
+    # no credential and no providers: entry required, the credential is
+    # reachability. Without this rung the model-switch path rejected the
+    # very provider the Local Models 'Use' flow writes to config
+    # ("Unknown provider 'llamacpp'" from the desktop dropdown).
+    if raw in ("llamacpp", "llama.cpp", "llama-cpp"):
+        try:
+            from hermes_cli.local_runtime.endpoint import resolve_llamacpp_endpoint
+
+            endpoint = resolve_llamacpp_endpoint(wait_for_boot_s=0)
+        except Exception:
+            endpoint = None
+        if endpoint:
+            return ProviderDef(
+                id="llamacpp",
+                name="Local",
+                transport="openai_chat",
+                api_key_env_vars=(),
+                base_url=endpoint["base_url"],
+                source="local-runtime",
+            )
+
     # 3. Try models.dev directly (for providers not in our ALIASES)
     try:
         from agent.models_dev import get_provider_info as _mdev_provider
diff --git a/hermes_cli/runtime_provider.py b/hermes_cli/runtime_provider.py
index 7a94fa8b57..605d2d7135 100644
--- a/hermes_cli/runtime_provider.py
+++ b/hermes_cli/runtime_provider.py
@@ -1228,6 +1228,53 @@ def _resolve_named_custom_runtime(
     # `provider: ollama` with a LAN/WireGuard `base_url` doesn't silently
     # fall through to OpenRouter.
     requested_norm = (requested_provider or "").strip().lower()
+
+    # Managed llama.cpp runtime: a llamacpp-flavored alias with no explicit
+    # base_url resolves to the supervised server (or a detected external
+    # one) before the generic custom fallthrough. Explicit base_url always
+    # wins — a user pointing at a specific server means that server.
+    if requested_norm in ("llamacpp", "llama.cpp", "llama-cpp") and not explicit_base_url:
+        try:
+            from hermes_cli.local_runtime.endpoint import resolve_llamacpp_endpoint
+
+            endpoint = resolve_llamacpp_endpoint()
+        except Exception:  # noqa: BLE001 — resolution is best-effort
+            endpoint = None
+        if endpoint:
+            return {
+                "provider": "custom",
+                "api_mode": "chat_completions",
+                "base_url": endpoint["base_url"],
+                "api_key": (explicit_api_key or "").strip()
+                or endpoint["api_key"] or "no-key-required",
+                "source": "local-runtime",
+                "requested_provider": requested_provider,
+            }
+        # No server to serve this model. Say so and stop — falling through
+        # to the generic custom path sends the request to whatever provider
+        # picks it up (OpenRouter with a placeholder key), and the user's
+        # "local server is off" surfaces as that provider's baffling
+        # "401 Invalid API key". The switch's own state picks the message:
+        # the user who turned the server off gets pointed at the switch,
+        # anyone else at the setup pane.
+        try:
+            from hermes_cli.config import load_config as _load_cfg
+
+            _lr_enabled = bool((_load_cfg().get("local_runtime") or {}).get("enabled"))
+        except Exception:  # noqa: BLE001
+            _lr_enabled = False
+        if _lr_enabled:
+            raise ValueError(
+                "The local model server isn't running. It may still be "
+                "starting — try again in a moment, or check Settings → "
+                "Providers → Local models."
+            )
+        raise ValueError(
+            "The local model server is turned off. Turn it back on in "
+            "Settings → Providers → Local models, or switch to another "
+            "model."
+        )
+
     if requested_norm and requested_norm != "custom":
         try:
             from hermes_cli.auth import resolve_provider as _resolve_provider
diff --git a/hermes_cli/session_lost_and_found.py b/hermes_cli/session_lost_and_found.py
index 90d8acba9a..b1fadcafe7 100644
--- a/hermes_cli/session_lost_and_found.py
+++ b/hermes_cli/session_lost_and_found.py
@@ -325,20 +325,25 @@ def _copy_direct_tables(
 ) -> dict[str, int]:
     """Copy rows .recover managed to attribute to real canonical tables."""
 
+    # Lazy import: session_recovery imports this module inside a function, so
+    # a module-level import here would be circular.
+    from hermes_cli.session_recovery import (
+        _AUXILIARY_TABLE_SCHEMAS,
+        _AUXILIARY_TABLES,
+        _CANONICAL_TABLES,
+    )
+
     copied: dict[str, int] = {}
-    for table in (
-        "system_prompts",
-        "sessions",
-        "messages",
-        "session_model_usage",
-        "compression_locks",
-        "gateway_routing",
-        "async_delegations",
-    ):
+    for table in (*_CANONICAL_TABLES, *_AUXILIARY_TABLES):
         source_columns = _table_columns(lf_conn, table)
         if not source_columns:
             continue
         dest_columns = _table_columns(dest, table)
+        if not dest_columns and table in _AUXILIARY_TABLE_SCHEMAS:
+            # Lazily-created gateway table: base SessionDB never made it on
+            # the fresh destination, so create it before copying.
+            _AUXILIARY_TABLE_SCHEMAS[table](dest)
+            dest_columns = _table_columns(dest, table)
         columns = [c for c in dest_columns if c in source_columns]
         if not columns:
             continue
diff --git a/hermes_cli/session_recovery.py b/hermes_cli/session_recovery.py
index 6d5f5e8bf8..9a376550ad 100644
--- a/hermes_cli/session_recovery.py
+++ b/hermes_cli/session_recovery.py
@@ -45,6 +45,34 @@ _TOPIC_TABLES = (
     "telegram_dm_topic_bindings",
 )
 
+
+
+def _init_delivery_ledger_schema(conn: sqlite3.Connection) -> None:
+    from gateway.delivery_ledger import _initialize_schema
+
+    _initialize_schema(conn)
+
+
+# Tables that live in state.db but are created lazily by a gateway module on
+# first use, so base ``SessionDB`` never creates them on a fresh destination.
+# Every entry maps the table to the initializer that owns its DDL; recovery
+# creates the table on the destination before copying, so owed rows survive
+# instead of silently vanishing from a "complete" salvage (#100313, #86236).
+# Add new lazily-created state.db tables HERE, never as one-off ``if table ==``
+# branches.
+_AUXILIARY_TABLE_SCHEMAS: dict[str, Callable[[sqlite3.Connection], None]] = {
+    "delivery_obligations": _init_delivery_ledger_schema,
+}
+
+_AUXILIARY_TABLES = tuple(_AUXILIARY_TABLE_SCHEMAS)
+
+_INVENTORY_TABLES = (
+    *_CANONICAL_TABLES,
+    "state_meta",
+    *_TOPIC_TABLES,
+    *_AUXILIARY_TABLES,
+)
+
 # These values describe derived indexes or the schema that owns an optional
 # table. A fresh destination must generate them from its own current schema.
 _GENERATED_META_KEYS = frozenset({
@@ -305,7 +333,7 @@ def _inspect_connection(conn: sqlite3.Connection) -> dict[str, Any]:
         # A damaged journal pragma must not block rows that are still readable.
         report["warnings"].append(f"journal mode: {exc}")
 
-    for table in (*_CANONICAL_TABLES, "state_meta", *_TOPIC_TABLES):
+    for table in _INVENTORY_TABLES:
         report["tables"][table] = _table_inventory(conn, table)
 
     for required in ("sessions", "messages"):
@@ -385,6 +413,25 @@ def inspect_session_database(
         temp_dir.cleanup()
 
 
+def _ensure_auxiliary_destination_schema(
+    destination: sqlite3.Connection,
+    table: str,
+) -> None:
+    """Create a lazy auxiliary table on the recovered destination.
+
+    Recovery initializes the destination through base ``SessionDB``, which
+    does not create gateway-owned tables. Copying into a missing dest table
+    would report ``missing`` / ``no compatible columns`` and drop the rows.
+    """
+
+    initialize = _AUXILIARY_TABLE_SCHEMAS.get(table)
+    if initialize is None:
+        raise SessionRecoverySafetyError(
+            f"no destination schema initializer registered for table {table!r}"
+        )
+    initialize(destination)
+
+
 def _copy_table(
     source: sqlite3.Connection,
     destination: sqlite3.Connection,
@@ -1243,7 +1290,7 @@ def _verify_recovered_database(
             )
 
         counts: dict[str, int] = {}
-        for table in (*_CANONICAL_TABLES, "state_meta", *_TOPIC_TABLES):
+        for table in _INVENTORY_TABLES:
             columns = _table_columns(conn, table)
             if columns:
                 counts[table] = int(
@@ -1251,7 +1298,7 @@ def _verify_recovered_database(
                 )
         verification["table_counts"] = counts
 
-        for table in ("sessions", "messages"):
+        for table in ("sessions", "messages", *_AUXILIARY_TABLES):
             expected = expected_counts.get(table)
             if expected is not None and counts.get(table) != expected:
                 message = (
@@ -1662,6 +1709,27 @@ def recover_session_database(
                     progress_cb=progress_cb,
                     source_rows=table_inspection.get("rows"),
                 )
+
+            for table in _AUXILIARY_TABLES:
+                table_inspection = inspection["tables"][table]
+                if not table_inspection.get("available"):
+                    copy_report[table] = {
+                        "status": "missing",
+                        "copied_rows": 0,
+                    }
+                    continue
+                _ensure_auxiliary_destination_schema(destination_conn, table)
+                copy_function = (
+                    _copy_table_salvage if allow_partial else _copy_table
+                )
+                copy_report[table] = copy_function(
+                    source_conn,
+                    destination_conn,
+                    table,
+                    chunk_size=chunk_size,
+                    progress_cb=progress_cb,
+                    source_rows=table_inspection.get("rows"),
+                )
             orphan_cleanup = (
                 _cleanup_partial_orphans(destination_conn)
                 if allow_partial
@@ -1678,8 +1746,15 @@ def recover_session_database(
         verification = _verify_recovered_database(
             output,
             expected_counts={
-                table: inspection["tables"][table].get("rows")
-                for table in _CANONICAL_TABLES
+                **{
+                    table: inspection["tables"][table].get("rows")
+                    for table in _CANONICAL_TABLES
+                },
+                **{
+                    table: inspection["tables"][table].get("rows")
+                    for table in _AUXILIARY_TABLES
+                    if inspection["tables"].get(table, {}).get("available")
+                },
             },
             copy_report=copy_report,
             allow_partial=allow_partial,
diff --git a/hermes_cli/setup.py b/hermes_cli/setup.py
index 390d71669a..1213eb1158 100644
--- a/hermes_cli/setup.py
+++ b/hermes_cli/setup.py
@@ -513,7 +513,7 @@ def _print_setup_summary(config: dict, hermes_home):
         tool_status.append(("Vision (image analysis)", False, "run 'hermes setup' to configure"))
 
 
-    # Web tools (Exa, Parallel, Firecrawl, or Keenable)
+    # Web tools (Exa, Parallel, Firecrawl, Tavily, or Keenable)
     if subscription_features.web.managed_by_nous:
         tool_status.append(("Web Search & Extract (Nous subscription)", True, None))
     elif subscription_features.web.available:
@@ -522,7 +522,7 @@ def _print_setup_summary(config: dict, hermes_home):
             label = f"Web Search & Extract ({subscription_features.web.current_provider})"
         tool_status.append((label, True, None))
     else:
-        tool_status.append(("Web Search & Extract", False, "EXA_API_KEY, PARALLEL_API_KEY, FIRECRAWL_API_KEY/FIRECRAWL_API_URL, KEENABLE_API_KEY, or SEARXNG_URL"))
+        tool_status.append(("Web Search & Extract", False, "EXA_API_KEY, PARALLEL_API_KEY, FIRECRAWL_API_KEY/FIRECRAWL_API_URL, TAVILY_API_KEY, KEENABLE_API_KEY, or SEARXNG_URL"))
 
     # Browser tools (local Chromium, Camofox, Browserbase, Browser Use, or Firecrawl)
     browser_provider = subscription_features.browser.current_provider
@@ -2428,10 +2428,10 @@ def setup_tools(config: dict, first_install: bool = False):
 
 
 def setup_telemetry(config: dict):
-    """Configure the local, privacy-safe shared-metrics subscriber."""
+    """Configure the local shared-metrics subscriber and optional sending."""
     print_header("Shared Metrics")
     print_info("Shared metrics contain only bounded counters and histograms.")
-    print_info("Packages stay under this Hermes profile and are not uploaded.")
+    print_info("Collection is local. Sending them to Nous is a separate opt-in.")
 
     telemetry = config.get("telemetry")
     if not isinstance(telemetry, dict):
@@ -2447,10 +2447,67 @@ def setup_telemetry(config: dict):
         "Enable local shared metrics?",
         default=current,
     )
-    if shared_metrics["enabled"]:
-        print_success("Local shared metrics enabled.")
-    else:
+    if not shared_metrics["enabled"]:
         print_info("Local shared metrics disabled.")
+        # Sending cannot outlive collection: leaving send=true here would be a
+        # configuration that logs an error on every run and never transmits.
+        if shared_metrics.get("send") is True:
+            shared_metrics["send"] = False
+            print_info("Sending shared metrics disabled as well.")
+        # Turning collection off is also a withdrawal of send consent, and it
+        # has to close the window like any other. Recorded unconditionally:
+        # the send key may already be false in config while the consent window
+        # is still open, and that window must not survive to be reopened.
+        _record_send_consent_change(enabled=False)
+        return
+
+    print_success("Local shared metrics enabled.")
+    print_info("")
+    print_info("Sending uploads each daily package to the Nous telemetry")
+    print_info("service. Packages carry your profile-scoped install ID, a")
+    print_info("stable random UUID that identifies this profile across days")
+    print_info("(it contains no personal information and is reset by deleting")
+    print_info("the shared-metrics directory). Only packages whose entire")
+    print_info("collection period falls inside a recorded consent window are")
+    print_info("ever sent — data from before you opt in, or from any gap")
+    print_info("while sending was off, stays on this machine. Sending can be")
+    print_info("turned off again at any time.")
+    shared_metrics["send"] = prompt_yes_no(
+        "Send shared metrics to Nous?",
+        default=shared_metrics.get("send") is True,
+    )
+    if shared_metrics["send"]:
+        _record_send_consent_change(enabled=True)
+        print_success("Sending shared metrics enabled.")
+    else:
+        _record_send_consent_change(enabled=False)
+        print_info("Sending shared metrics disabled (collection stays local).")
+
+
+def _record_send_consent_change(*, enabled: bool) -> None:
+    """Reconcile consent windows at the moment the user decides.
+
+    Same single writer as the relay and the sender — reconciliation derives
+    the window state from the observation, so wizard, relay, and mid-pass
+    callers cannot disagree. The relay's once-per-process reconcile would
+    catch this on the next hook fire anyway; running it here just makes the
+    wizard's effect immediate.
+    """
+    try:
+        from hermes_cli.observability.shared_metrics import SharedMetricsStore
+        from hermes_cli.observability.shared_metrics_sender import (
+            reconcile_send_consent,
+        )
+        from hermes_cli.sqlite_util import write_txn
+
+        store = SharedMetricsStore()
+        with store._connection() as connection:
+            with write_txn(connection):
+                reconcile_send_consent(connection, enabled)
+    except Exception:
+        # Never block the wizard on telemetry bookkeeping. The relay runs the
+        # same reconciliation on the next lifecycle hook.
+        logger.debug("Unable to record shared-metrics consent change", exc_info=True)
 
 
 # =============================================================================
diff --git a/hermes_cli/status.py b/hermes_cli/status.py
index 569c759835..f5c435d912 100644
--- a/hermes_cli/status.py
+++ b/hermes_cli/status.py
@@ -184,6 +184,7 @@ def show_status(args):
         "MiniMax-CN": "MINIMAX_CN_API_KEY",
         "DeepInfra": "DEEPINFRA_API_KEY",
         "Firecrawl": "FIRECRAWL_API_KEY",
+        "Tavily": "TAVILY_API_KEY",
         "Keenable": "KEENABLE_API_KEY",
         "Browser Use": "BROWSER_USE_API_KEY",  # Optional — local browser works without this
         "Browserbase": "BROWSERBASE_API_KEY",  # Optional — direct credentials only
diff --git a/hermes_cli/subcommands/cron.py b/hermes_cli/subcommands/cron.py
index b9d7f08569..4501578b2c 100644
--- a/hermes_cli/subcommands/cron.py
+++ b/hermes_cli/subcommands/cron.py
@@ -42,6 +42,16 @@ def build_cron_parser(subparsers, *, cmd_cron: Callable) -> None:
             "local profile's canonical Bot Chat as a message the bot responds to)"
         ),
     )
+    cron_create.add_argument(
+        "--failure-deliver",
+        dest="failure_deliver",
+        help=(
+            "Override target for FAILURE notices only (same grammar as "
+            "--deliver). 'local' suppresses failure notices entirely; run "
+            "state stays visible in `hermes cron list`. Omit = failures "
+            "follow --deliver."
+        ),
+    )
     cron_create.add_argument("--repeat", type=int, help="Optional repeat count")
     cron_create.add_argument(
         "--skill",
@@ -142,6 +152,14 @@ def build_cron_parser(subparsers, *, cmd_cron: Callable) -> None:
     cron_edit.add_argument("--prompt", help="New prompt/task instruction")
     cron_edit.add_argument("--name", help="New job name")
     cron_edit.add_argument("--deliver", help="New delivery target")
+    cron_edit.add_argument(
+        "--failure-deliver",
+        dest="failure_deliver",
+        help=(
+            "Override target for failure notices (same grammar as --deliver; "
+            "'local' suppresses; '' clears the override)"
+        ),
+    )
     cron_edit.add_argument("--repeat", type=int, help="New repeat count")
     cron_edit.add_argument(
         "--skill",
diff --git a/hermes_cli/subcommands/dashboard.py b/hermes_cli/subcommands/dashboard.py
index 0b695e076a..8b2e6cc487 100644
--- a/hermes_cli/subcommands/dashboard.py
+++ b/hermes_cli/subcommands/dashboard.py
@@ -84,6 +84,60 @@ def _add_server_runtime_args(parser) -> None:
     )
 
 
+def _configure_serve_parser(parser, *, cmd_dashboard: Callable) -> None:
+    """Attach the canonical ``serve`` arguments to *parser*.
+
+    Kept separate from the full subcommand tree so Desktop's hot path can parse
+    only the command it launches. Both callers use this exact function, keeping
+    the lean parser and normal CLI semantics in lockstep.
+    """
+    _add_server_runtime_args(parser)
+    # Accepted but redundant: ``serve`` is always headless. Kept so callers
+    # using the legacy flag do not trip an argparse error.
+    parser.add_argument("--no-open", action="store_true", help=argparse.SUPPRESS)
+    parser.add_argument(
+        "--ssh-session-token-file",
+        dest="ssh_session_token_file",
+        metavar="PATH",
+        default=None,
+        help="Read a one-shot Desktop SSH session token from PATH",
+    )
+    parser.add_argument(
+        "--ssh-owner-nonce",
+        dest="ssh_owner_nonce",
+        metavar="NONCE",
+        default=None,
+        help="Identify a Desktop-owned SSH backend process",
+    )
+    parser.set_defaults(
+        func=cmd_dashboard,
+        no_open=True,
+        headless_backend=True,
+        command="serve",
+    )
+
+
+def build_serve_parser(
+    *,
+    cmd_dashboard: Callable,
+    add_help: bool = True,
+    exit_on_error: bool = True,
+) -> argparse.ArgumentParser:
+    """Build the standalone parser used by the lean ``serve`` dispatch path."""
+    parser = argparse.ArgumentParser(
+        prog="hermes serve",
+        description=(
+            "Run the Hermes backend server - the JSON-RPC/WebSocket gateway the "
+            "desktop app and remote clients connect to. Headless: it never opens "
+            "a browser UI."
+        ),
+        add_help=add_help,
+        exit_on_error=exit_on_error,
+    )
+    _configure_serve_parser(parser, cmd_dashboard=cmd_dashboard)
+    return parser
+
+
 def build_dashboard_parser(
     subparsers, *, cmd_dashboard: Callable, cmd_dashboard_register: Callable
 ) -> None:
@@ -142,32 +196,7 @@ def build_dashboard_parser(
             "a browser UI."
         ),
     )
-    _add_server_runtime_args(serve_parser)
-    # Accepted but redundant: `serve` is always headless (see set_defaults
-    # below). Kept so callers that pass the legacy `--no-open` flag (e.g. the
-    # desktop backend spawn) don't trip "unrecognized arguments".
-    serve_parser.add_argument(
-        "--no-open", action="store_true", help=argparse.SUPPRESS
-    )
-    serve_parser.add_argument(
-        "--ssh-session-token-file",
-        dest="ssh_session_token_file",
-        metavar="PATH",
-        default=None,
-        help="Read a one-shot Desktop SSH session token from PATH",
-    )
-    serve_parser.add_argument(
-        "--ssh-owner-nonce",
-        dest="ssh_owner_nonce",
-        metavar="NONCE",
-        default=None,
-        help="Identify a Desktop-owned SSH backend process",
-    )
-    # `headless_backend` marks the lean path: desktop/remote clients speak pure
-    # JSON-RPC/WS, so `serve` skips the web UI build AND never serves the SPA
-    # (cmd_dashboard exports HERMES_SERVE_HEADLESS=1). `dashboard` leaves it
-    # unset and serves the browser UI as before.
-    serve_parser.set_defaults(func=cmd_dashboard, no_open=True, headless_backend=True)
+    _configure_serve_parser(serve_parser, cmd_dashboard=cmd_dashboard)
 
     # `hermes dashboard register` — register a self-hosted dashboard OAuth
     # client with Nous Portal and write the client_id into ~/.hermes/.env.
diff --git a/hermes_cli/subcommands/gui.py b/hermes_cli/subcommands/gui.py
index ec10ef117e..d856137a3c 100644
--- a/hermes_cli/subcommands/gui.py
+++ b/hermes_cli/subcommands/gui.py
@@ -55,6 +55,11 @@ def build_gui_parser(subparsers, *, cmd_gui: Callable) -> None:
         action="store_true",
         help="Skip npm install/package and launch the existing unpacked app from apps/desktop/release",
     )
+    gui_parser.add_argument(
+        "--local",
+        action="store_true",
+        help="Show the local-models UI in the desktop app (models pane, quickstart, picker rows)",
+    )
     gui_parser.add_argument(
         "--force-build",
         action="store_true",
diff --git a/hermes_cli/terminal_notify.py b/hermes_cli/terminal_notify.py
new file mode 100644
index 0000000000..6c1877cd8c
--- /dev/null
+++ b/hermes_cli/terminal_notify.py
@@ -0,0 +1,99 @@
+"""Terminal-native desktop notifications: OSC 9 and Warp's OSC 777 CLI-agent protocol.
+
+Both emitters ride on the existing ``display.bell_on_prompt`` /
+``display.bell_on_complete`` flags (see ``cli._ring_bell``) — no extra config.
+
+- **OSC 9** (``ESC ] 9 ; <body> BEL``): Ghostty, iTerm2, Kitty and WezTerm
+  raise an OS notification; terminals that don't know the sequence drop it.
+- **OSC 777** (``ESC ] 777 ; notify ; warp://cli-agent ; <json> BEL``): Warp's
+  structured CLI-agent protocol (tab status + notification mailbox). Only sent
+  when Warp advertises support and the build is newer than the last release
+  that set the protocol var without being able to render the payload.
+
+Sequences are written to ``/dev/tty`` because prompt_toolkit's stdout wrapper
+can buffer or strip raw escapes; when ``/dev/tty`` can't be opened (Windows,
+no controlling terminal) they fall back to ``sys.stdout``. Never raises.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+
+_C0_AND_DEL = re.compile(r"[\x00-\x1f\x7f]")
+_WARP_PROTOCOL_VERSION = 1
+# Last Warp release per channel that set WARP_CLI_AGENT_PROTOCOL_VERSION but
+# could not render structured payloads (Warp's reference agent plugin,
+# should-use-structured.sh). Bash compares these lexicographically; so do we.
+_WARP_LAST_BROKEN = {
+    "stable": "v0.2026.03.25.08.24.stable_05",
+    "preview": "v0.2026.03.25.08.24.preview_05",
+}
+
+
+def _write_tty(seq: str) -> None:
+    """Write raw escapes to /dev/tty, falling back to sys.stdout. Never raises."""
+    try:
+        with open("/dev/tty", "w", encoding="utf-8") as tty:
+            tty.write(seq)
+        return
+    except OSError:
+        pass
+    try:
+        sys.stdout.write(seq)
+        sys.stdout.flush()
+    except Exception:
+        pass
+
+
+def osc9(body: str) -> str:
+    """OSC 9 sequence with C0 controls and DEL stripped from the body."""
+    return f"\x1b]9;{_C0_AND_DEL.sub('', body)}\x07"
+
+
+def warp_supported(env=None) -> bool:
+    """True when running in a Warp build that can render OSC 777 agent payloads."""
+    env = os.environ if env is None else env
+    if env.get("TERM_PROGRAM") != "WarpTerminal" or not env.get("WARP_CLI_AGENT_PROTOCOL_VERSION"):
+        return False
+    client = env.get("WARP_CLIENT_VERSION", "")
+    if not client:
+        return False
+    for channel, last_broken in _WARP_LAST_BROKEN.items():
+        if channel in client and client <= last_broken:
+            return False
+    return True
+
+
+def warp_osc777(event: str, detail: str, session_id: str = "") -> str:
+    """OSC 777 ``warp://cli-agent`` notification; ``event`` is ``stop`` or ``permission_request``.
+
+    Payload mirrors the reference plugin's build-payload.sh: common fields plus
+    ``summary`` (permission_request) or ``response`` (stop), truncated to 200.
+    """
+    try:
+        advertised = int(os.environ.get("WARP_CLI_AGENT_PROTOCOL_VERSION", "1"))
+    except ValueError:
+        advertised = 1
+    cwd = os.getcwd()
+    payload = {
+        "v": min(advertised, _WARP_PROTOCOL_VERSION),
+        "agent": "hermes",
+        "event": event,
+        "session_id": session_id,
+        "cwd": cwd,
+        "project": os.path.basename(cwd),
+    }
+    payload["summary" if event == "permission_request" else "response"] = detail[:200]
+    return f"\x1b]777;notify;warp://cli-agent;{json.dumps(payload, separators=(',', ':'))}\x07"
+
+
+def notify(context: str, *, prompt: bool, session_id: str = "", detail: str = "") -> None:
+    """Emit OSC 9 (plus Warp OSC 777 when supported) for a blocking prompt or turn end."""
+    seq = osc9(f"Hermes: {context}")
+    if warp_supported():
+        event = "permission_request" if prompt else "stop"
+        seq += warp_osc777(event, detail or context, session_id)
+    _write_tty(seq)
diff --git a/hermes_cli/tools_config.py b/hermes_cli/tools_config.py
index 10d433db7c..71d2ed2593 100644
--- a/hermes_cli/tools_config.py
+++ b/hermes_cli/tools_config.py
@@ -111,7 +111,7 @@ CONFIGURABLE_TOOLSETS = [
     ("tts",             "🔊 Text-to-Speech",            "text_to_speech"),
     ("stt",             "🎙️ Speech-to-Text",           "voice transcription (gateway voice messages + voice mode)"),
     ("skills",          "📚 Skills",                    "list, view, manage"),
-    ("todo",            "📋 Task Planning",             "todo"),
+    ("todo",            "📋 Task Planning",             "todo_list"),
     ("memory",          "💾 Memory",                    "persistent memory across sessions"),
     ("context_engine",  "🧩 Context Engine",            "runtime tools from the active context engine"),
     ("session_search",  "🔎 Session Search",            "search past conversations"),
@@ -3331,8 +3331,8 @@ def _plugin_video_gen_providers() -> list[dict]:
 
 # Mirror of _plugin_image_gen_providers for web search backends. Surfaces
 # every plugin-registered web provider so it appears in the
-# "Web Search & Extract" picker. All seven providers (brave-free, ddgs,
-# searxng, exa, parallel, firecrawl, keenable) live as plugins after
+# "Web Search & Extract" picker. All bundled providers (brave-free, ddgs,
+# searxng, exa, parallel, tavily, firecrawl, keenable) live as plugins after
 # PR #25182 — this helper is the sole source of truth for the category's
 # provider rows. The hardcoded entries that used to drive the category
 # were deleted in the same PR; only the two non-provider UX rows
@@ -3348,8 +3348,8 @@ def _plugin_web_search_providers() -> list[dict]:
     marker) so the picker behaves identically whether a provider is
     hardcoded or plugin-registered.
 
-    After PR #25182, all seven web providers (brave-free, ddgs, searxng,
-    exa, parallel, firecrawl, keenable) are plugins; this helper is the sole
+    After PR #25182, all bundled web providers (brave-free, ddgs, searxng,
+    exa, parallel, tavily, firecrawl, keenable) are plugins; this helper is the sole
     source of provider rows for the Web Search & Extract category.
     """
     try:
@@ -5622,6 +5622,43 @@ def _reconfigure_simple_requirements(ts_key: str):
 
 # ─── Main Entry Point ─────────────────────────────────────────────────────────
 
+def _shared_metrics_state(config: dict) -> tuple[bool, bool]:
+    """Return (collection_enabled, send_enabled) from a config dict."""
+    telemetry = config.get("telemetry")
+    telemetry = telemetry if isinstance(telemetry, dict) else {}
+    shared = telemetry.get("shared_metrics")
+    shared = shared if isinstance(shared, dict) else {}
+    return shared.get("enabled") is True, shared.get("send") is True
+
+
+def _shared_metrics_menu_label(config: dict) -> str:
+    """Menu row for shared metrics, showing both consent states."""
+    enabled, send = _shared_metrics_state(config)
+    if not enabled:
+        state = "off"
+    elif send:
+        state = "collecting + sending to Nous"
+    else:
+        state = "collecting locally"
+    return f"Configure shared metrics  ({state})"
+
+
+def _configure_shared_metrics_interactive(config: dict) -> None:
+    """Toggle shared-metrics collection and sending from `hermes tools`.
+
+    Delegates to the setup wizard's prompt so the consent rules live in one
+    place: sending requires collection, and turning collection off also turns
+    sending off.
+    """
+    from hermes_cli.setup import setup_telemetry
+
+    before = _shared_metrics_state(config)
+    setup_telemetry(config)
+    after = _shared_metrics_state(config)
+    if before != after:
+        save_config(config)
+
+
 def tools_command(args=None, first_install: bool = False, config: dict = None):
     """Entry point for `hermes tools` and `hermes setup tools`.
 
@@ -5746,6 +5783,7 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
     if len(platform_keys) > 1:
         platform_choices.append("Configure all platforms (global)")
     platform_choices.append("Reconfigure an existing tool's provider or API key")
+    platform_choices.append(_shared_metrics_menu_label(config))
 
     # Show MCP option if any MCP servers are configured
     _has_mcp = bool(config.get("mcp_servers"))
@@ -5757,8 +5795,9 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
     # Index offsets for the extra options after per-platform entries
     _global_idx = len(platform_keys) if len(platform_keys) > 1 else -1
     _reconfig_idx = len(platform_keys) + (1 if len(platform_keys) > 1 else 0)
-    _mcp_idx = (_reconfig_idx + 1) if _has_mcp else -1
-    _done_idx = _reconfig_idx + (2 if _has_mcp else 1)
+    _metrics_idx = _reconfig_idx + 1
+    _mcp_idx = (_metrics_idx + 1) if _has_mcp else -1
+    _done_idx = _metrics_idx + (2 if _has_mcp else 1)
 
     while True:
         idx = _prompt_choice("Select an option:", platform_choices, default=0)
@@ -5773,6 +5812,13 @@ def tools_command(args=None, first_install: bool = False, config: dict = None):
             print()
             continue
 
+        # "Shared metrics" selected
+        if idx == _metrics_idx:
+            _configure_shared_metrics_interactive(config)
+            platform_choices[_metrics_idx] = _shared_metrics_menu_label(config)
+            print()
+            continue
+
         # "Configure MCP tools" selected
         if idx == _mcp_idx:
             _configure_mcp_tools_interactive(config)
diff --git a/hermes_cli/update_cmd.py b/hermes_cli/update_cmd.py
index f0a825b32b..9bbfa17693 100644
--- a/hermes_cli/update_cmd.py
+++ b/hermes_cli/update_cmd.py
@@ -2083,6 +2083,90 @@ def _restore_state_db_from_snapshot(state_path: Path, snap_state: Path) -> bool:
     return bool(restored.get("valid"))
 
 
+def _verify_and_restore_one_state_db(home: Path, *, label: str) -> None:
+    """Post-update integrity check + auto-restore for ONE home's state.db.
+
+    Shared by the root-DB and sibling-profile guards (ZIP update path and
+    git-pull path both route here). A corrupt live DB is restored from the
+    most recent valid snapshot under that home's own state-snapshots dir.
+    Never raises: a guard that crashes the update tail would be worse than
+    the corruption it detects.
+    """
+    try:
+        from hermes_cli.backup import _quick_snapshot_root, verify_sqlite_integrity
+
+        state_path = home / "state.db"
+        if not state_path.exists():
+            return
+        ok = verify_sqlite_integrity(state_path, check_header=True, run_pragma=True)
+        if ok.get("valid"):
+            logger.debug(
+                "Post-update state.db integrity OK (%s): %s",
+                label,
+                ok.get("message"),
+            )
+            return
+        print()
+        print(
+            f"⚠ state.db is corrupted after update ({label}): "
+            + ok.get("message", "unknown error")
+        )
+        snap_root = _quick_snapshot_root(home)
+        if not snap_root.exists():
+            print("  ⚠ No pre-update snapshot for this home")
+            return
+        for snap_dir in sorted(
+            (d for d in snap_root.iterdir() if d.is_dir()), reverse=True
+        ):
+            snap_state = snap_dir / "state.db"
+            if not snap_state.exists():
+                continue
+            snap_ok = verify_sqlite_integrity(
+                snap_state, check_header=True, run_pragma=True
+            )
+            if not snap_ok.get("valid"):
+                continue
+            try:
+                if _restore_state_db_from_snapshot(state_path, snap_state):
+                    print(
+                        f"  ✓ Auto-restored from snapshot {snap_dir.name} ({label})"
+                    )
+                else:
+                    print(
+                        "  ✗ Auto-restore FAILED — restored copy also failed "
+                        "integrity"
+                    )
+            except OSError as exc:
+                print(f"  ✗ Auto-restore file copy failed: {exc}")
+            return
+        print("  ⚠ No valid pre-update snapshot found for this home")
+    except Exception as exc:
+        logger.debug(
+            "Post-update state.db guard (%s) failed: %s", label, exc
+        )
+
+
+def _verify_and_restore_state_dbs_post_update() -> None:
+    """Post-update integrity guard for the ROOT state.db AND every sibling
+    profile's state.db (#97994).
+
+    The pre-update snapshot already covers every sibling profile
+    (#66140 create_pre_update_snapshots_all_profiles), but the post-update
+    guard only ever verified the root DB — a profile database corrupted by
+    the update was never detected and never auto-restored, leaving that
+    profile's sessions silently gone while the root DB passed.
+    """
+    home = get_hermes_home()
+    _verify_and_restore_one_state_db(home, label="default home")
+    try:
+        from hermes_cli.backup import _sibling_profile_homes
+
+        for name, profile_home in _sibling_profile_homes(home):
+            _verify_and_restore_one_state_db(profile_home, label=f"profile {name}")
+    except Exception as exc:
+        logger.debug("Sibling-profile state.db guard sweep failed: %s", exc)
+
+
 def _update_via_zip(args, *, had_desktop_app_before_update: bool = False) -> bool:
     """Update Hermes Agent by downloading a ZIP archive.
 
@@ -2433,55 +2517,12 @@ def _update_via_zip(args, *, had_desktop_app_before_update: bool = False) -> boo
     except Exception as e:
         logger.debug("Model catalog seed during zip update failed: %s", e)
 
-    # ── Post-update state.db integrity guard (#68474) ─────────────────
-    # Same as the git-pull path: verify state.db survived the ZIP update
-    # and auto-restore from the most recent pre-update snapshot if needed.
+    # ── Post-update state.db integrity guard (#68474, #97994) ────────────
+    # Verify state.db survived the ZIP update in the root home AND every
+    # sibling profile, auto-restoring each from its own most recent valid
+    # pre-update snapshot when needed.
     try:
-        from hermes_cli.backup import _quick_snapshot_root, verify_sqlite_integrity
-
-        _state_path = get_hermes_home() / "state.db"
-        if _state_path.exists():
-            _state_ok = verify_sqlite_integrity(
-                _state_path, check_header=True, run_pragma=True
-            )
-            if not _state_ok.get("valid"):
-                print()
-                print(
-                    "⚠ state.db is corrupted after update: "
-                    + _state_ok.get("message", "unknown error")
-                )
-                _snap_root = _quick_snapshot_root(get_hermes_home())
-                if _snap_root.exists():
-                    _snap_dirs = sorted(
-                        (d for d in _snap_root.iterdir() if d.is_dir()),
-                        reverse=True,
-                    )
-                    for _snap_dir in _snap_dirs:
-                        _snap_state = _snap_dir / "state.db"
-                        if _snap_state.exists():
-                            _snap_ok = verify_sqlite_integrity(
-                                _snap_state, check_header=True, run_pragma=True
-                            )
-                            if _snap_ok.get("valid"):
-                                try:
-                                    if _restore_state_db_from_snapshot(
-                                        _state_path, _snap_state
-                                    ):
-                                        print(
-                                            "  ✓ Auto-restored from snapshot "
-                                            f"{_snap_dir.name}"
-                                        )
-                                    else:
-                                        print(
-                                            "  ✗ Auto-restore FAILED — restored "
-                                            "copy also failed integrity"
-                                        )
-                                    break
-                                except OSError as _exc:
-                                    print(
-                                        f"  ✗ Auto-restore file copy failed: {_exc}"
-                                    )
-                                    break
+        _verify_and_restore_state_dbs_post_update()
     except Exception as exc:
         logger.debug(
             "Post-update state.db integrity check (zip path) failed: %s", exc
@@ -2541,7 +2582,7 @@ def _stash_local_changes_if_needed(git_cmd: list[str], cwd: Path) -> Optional[st
     from datetime import datetime, timezone
 
     stash_name = datetime.now(timezone.utc).strftime(
-        "hermes-update-autostash-%Y%m%d-%H%M%S"
+        f"{_AUTOSTASH_NAME_PREFIX}%Y%m%d-%H%M%S"
     )
     print("→ Local changes detected — stashing before update...")
     prev_stash = subprocess.run(
@@ -2628,6 +2669,83 @@ def _resolve_stash_selector(
             return selector.strip()
     return None
 
+#: Producer/consumer contract for update autostash names: the stash subject is
+#: this prefix + a UTC YYYYMMDD-HHMMSS stamp (see _stash_local_changes_if_needed
+#: and _warn_orphaned_update_autostashes).
+_AUTOSTASH_NAME_PREFIX = "hermes-update-autostash-"
+
+#: Age past which a leftover ``hermes-update-autostash-*`` entry is called out
+#: at update time. Entries younger than this are normal (a parked stash from
+#: the desktop updater's --keep-stash run minutes ago); older ones are almost
+#: always forgotten (#63717 problem 6: an orphan persisted 9+ days unnoticed).
+_AUTOSTASH_WARN_AGE_DAYS = 7
+
+
+def _warn_orphaned_update_autostashes(git_cmd: list[str], cwd: Path) -> int:
+    """Surface leftover update autostashes older than the warn threshold.
+
+    Autostash entries legitimately outlive an update run (``--keep-stash``
+    parks them; a conflicted or failed restore preserves them for safety), but
+    nothing ever re-surfaces them afterwards — they sit in ``git stash``
+    invisibly for weeks (#63717 problem 6). This prints a short notice naming
+    the stale entries with recovery/cleanup guidance. Deliberately NOT a GC:
+    a stash entry can be the only copy of the user's uncommitted work, so
+    Hermes never drops one automatically.
+
+    Best-effort — any git failure returns 0 and must not block the update.
+    Returns the number of stale entries warned about.
+    """
+    from datetime import timedelta, timezone
+
+    try:
+        stash_list = subprocess.run(
+            git_cmd + ["stash", "list", "--format=%gd %s"],
+            cwd=cwd,
+            capture_output=True,
+            text=True, encoding="utf-8", errors="replace",
+        )
+        if stash_list.returncode != 0:
+            return 0
+        cutoff = datetime.now(timezone.utc) - timedelta(
+            days=_AUTOSTASH_WARN_AGE_DAYS
+        )
+        marker = _AUTOSTASH_NAME_PREFIX
+        stale: list[tuple[str, str]] = []
+        for line in stash_list.stdout.splitlines():
+            selector, _, subject = line.strip().partition(" ")
+            pos = subject.find(marker)
+            if pos < 0:
+                continue
+            stamp = subject[pos + len(marker):][:15]  # "YYYYMMDD-HHMMSS"
+            try:
+                stash_time = datetime.strptime(stamp, "%Y%m%d-%H%M%S").replace(
+                    tzinfo=timezone.utc
+                )
+            except ValueError:
+                # Unparseable name — age unknown; leave it alone rather than
+                # guess (same posture as _prune_orphan_rescue_refs).
+                continue
+            if stash_time < cutoff:
+                stale.append((selector, stamp))
+        if not stale:
+            return 0
+        print()
+        print(
+            f"⚠ {len(stale)} leftover update autostash entr"
+            f"{'y is' if len(stale) == 1 else 'ies are'} more than "
+            f"{_AUTOSTASH_WARN_AGE_DAYS} days old:"
+        )
+        for selector, stamp in stale:
+            print(f"    {selector}  ({_AUTOSTASH_NAME_PREFIX}{stamp})")
+        print("  These hold local changes stashed by earlier updates and never")
+        print("  restored. Review with: git stash show -p <entry>")
+        print("  Restore with: git stash apply <entry>   Discard with: git stash drop <entry>")
+        return len(stale)
+    except Exception as exc:
+        logger.debug("Autostash age check failed: %s", exc)
+        return 0
+
+
 def _print_stash_cleanup_guidance(
     stash_ref: str, stash_selector: Optional[str] = None
 ) -> None:
@@ -7451,6 +7569,52 @@ def _resume_windows_gateways_after_update(token: dict | None) -> None:
     token["unmapped"] = failed_unmapped
     if failed_profiles or failed_unmapped:
         raise RuntimeError("Could not restart every paused Windows gateway")
+
+    # A truthy return from the launch helpers only proves the detached
+    # watcher process was created — not that the gateway it respawns
+    # survived. A parent Job Object that denies CREATE_BREAKAWAY_FROM_JOB
+    # kills the freshly respawned gateway on updater teardown before it
+    # writes a single log line, yet "✓ Restarting" was printed anyway
+    # (#48820, 3rd/4th repro). Verify a stable gateway process actually
+    # exists before vouching for the resume, using the same
+    # provisional-hit + confirmation-window poll every other spawn path
+    # uses (#91675). all_profiles=True because the resume covers the fleet.
+    if relaunched or unmapped_relaunched:
+        try:
+            from hermes_cli import gateway_windows
+        except Exception as exc:
+            raise RuntimeError(
+                f"Could not load Windows gateway liveness helpers: {exc}"
+            ) from exc
+        ready_pids = gateway_windows._wait_for_gateway_ready(
+            timeout_s=30.0, all_profiles=True
+        )
+        if not ready_pids:
+            token["profiles"] = dict(profiles)
+            token["unmapped"] = list(unmapped)
+            print()
+            print(
+                "  ⚠ Windows gateway restart could not be verified — no stable "
+                "gateway process appeared after relaunch."
+            )
+            print(
+                "    (The respawned gateway may have been killed by a parent "
+                "Job Object during updater teardown, #48820.)"
+            )
+            print("    Recover with: hermes gateway restart")
+            raise RuntimeError(
+                "Windows gateway relaunch after update was not verified alive"
+            )
+        # Persist the PIDs this ✓ vouches for so a death AFTER the updater
+        # exits (parent Job Object teardown, #91675) is reported by the next
+        # CLI invocation instead of staying silent. Best-effort.
+        try:
+            gateway_windows._write_start_attestation(
+                ready_pids, "post-update relaunch"
+            )
+        except Exception:
+            pass
+
     token["resume_needed"] = False
 
     if relaunched:
@@ -8416,6 +8580,11 @@ def _cmd_update_impl(args, gateway_mode: bool):
         if swept:
             print("  (removed %d aborted-fetch pack temp file(s))" % len(swept))
 
+        # Surface autostash entries left behind by earlier updates (#63717
+        # problem 6) — parked --keep-stash runs and failed restores preserve
+        # the stash but nothing ever mentioned it again.
+        _m()._warn_orphaned_update_autostashes(git_cmd, _m().PROJECT_ROOT)
+
         print("→ Fetching updates...")
         fetch_result = subprocess.run(
             git_cmd + ["fetch", "origin", branch],
@@ -9393,72 +9562,14 @@ def _cmd_update_impl(args, gateway_mode: bool):
         except Exception:
             logger.debug("macOS TCC anchor refresh skipped", exc_info=True)
 
-        # ── Post-update state.db integrity guard (#68474) ─────────────────
-        # Verify that state.db survived the update intact.  If the live file
-        # is now corrupted (zeroed, missing header, integrity failure),
-        # automatically restore from the pre-update snapshot rather than
-        # letting the user discover silently that their sessions are gone.
+        # ── Post-update state.db integrity guard (#68474, #97994) ─────────
+        # Verify that state.db survived the update intact in the root home
+        # AND every sibling profile. If a live file is now corrupted (zeroed,
+        # missing header, integrity failure), automatically restore from that
+        # home's own pre-update snapshot rather than letting the user discover
+        # silently that their sessions are gone.
         try:
-            from hermes_cli.backup import _quick_snapshot_root, verify_sqlite_integrity
-
-            _state_path = get_hermes_home() / "state.db"
-            if _state_path.exists():
-                _state_ok = verify_sqlite_integrity(
-                    _state_path,
-                    check_header=True,
-                    run_pragma=True,
-                )
-                if _state_ok.get("valid"):
-                    logger.debug(
-                        "Post-update state.db integrity check: %s",
-                        _state_ok.get("message"),
-                    )
-                else:
-                    print()
-                    print(
-                        "⚠ state.db is corrupted after update: "
-                        + _state_ok.get("message", "unknown error")
-                    )
-                    _pre_snap_id = pre_update_snapshot_id
-                    if _pre_snap_id:
-                        _snap_state = (
-                            _quick_snapshot_root(get_hermes_home())
-                            / _pre_snap_id
-                            / "state.db"
-                        )
-                        if _snap_state.exists():
-                            _snap_ok = verify_sqlite_integrity(
-                                _snap_state, check_header=True, run_pragma=True
-                            )
-                            if _snap_ok.get("valid"):
-                                try:
-                                    if _restore_state_db_from_snapshot(
-                                        _state_path, _snap_state
-                                    ):
-                                        print(
-                                            "  ✓ Auto-restored from pre-update "
-                                            f"snapshot ({_pre_snap_id})"
-                                        )
-                                    else:
-                                        print(
-                                            "  ✗ Auto-restore FAILED — restored "
-                                            "copy also failed integrity"
-                                        )
-                                except OSError as _exc:
-                                    print(
-                                        f"  ✗ Auto-restore file copy failed: {_exc}"
-                                    )
-                            else:
-                                print(
-                                    "  ✗ Pre-update snapshot also failed integrity"
-                                )
-                        else:
-                            print(
-                                "  ⚠ Pre-update snapshot does not contain state.db"
-                            )
-                    else:
-                        print("  ⚠ No pre-update snapshot was taken")
-                    print()
+            _verify_and_restore_state_dbs_post_update()
         except Exception as exc:
             logger.debug("Post-update state.db integrity check failed: %s", exc)
 
@@ -10703,6 +10814,26 @@ def _cmd_update_impl(args, gateway_mode: bool):
             node_failures, already_restarted_units=set(restarted_services)
         )
 
+        # Check if any pre-update serve/dashboard runtimes survived on
+        # pre-update code generations (#100479). This is the SUCCESS-path
+        # twin of the abort-recovery probe above: the restart phase only
+        # restarts units, so an sshd-spawned `serve --isolated` or a manual
+        # `hermes serve` (no unit) is left running its pre-update
+        # sys.modules graph — and its cron ticker keeps firing agent jobs
+        # that ImportError on every symbol added in the pulled range. Runs
+        # AFTER the dashboard cleanup so a manual dashboard that cleanup
+        # killed and respawned is (correctly) not a survivor. The rows also
+        # feed the plan-vs-execution reconciliation below, so a survivor is
+        # escalated (exit 1) instead of merely printed. ``None`` means the
+        # probe itself failed; the reconciliation then stays fail-closed.
+        _stale_serve_rows: "list | None" = None
+        try:
+            _stale_serve_rows = _surviving_pre_update_serve_runtimes(_pre_update_plan)
+            if _stale_serve_rows:
+                _warn_stale_serve_runtimes(_stale_serve_rows)
+        except Exception as _serve_warn_exc:
+            logger.debug("Failed to check for surviving serve runtimes: %s", _serve_warn_exc)
+
         print()
         print("Tip: You can now select a provider and model:")
         print("  hermes model              # Select provider and model")
@@ -10812,6 +10943,13 @@ def _cmd_update_impl(args, gateway_mode: bool):
                     externally_supervised_profiles=externally_supervised_profiles,
                     killed_pids=killed_pids,
                     failed_units=failed_or_stale_units,
+                    # Serve/dashboard runtimes reconcile by incarnation
+                    # liveness, not by the gateway's unit names (#100479).
+                    stale_serve_pids=(
+                        {row.get("pid") for row in _stale_serve_rows}
+                        if _stale_serve_rows is not None
+                        else None
+                    ),
                 )
                 if report_unaccounted_runtimes(_runtime_outcomes):
                     gateway_fleet_restart_incomplete = True
diff --git a/hermes_cli/update_inventory.py b/hermes_cli/update_inventory.py
index be03530f7d..1e2528e86c 100644
--- a/hermes_cli/update_inventory.py
+++ b/hermes_cli/update_inventory.py
@@ -425,6 +425,49 @@ def print_update_plan(plan: UpdatePlan) -> None:
         )
 
 
+_SERVE_KINDS = ("serve", "dashboard")
+
+
+def _serve_unit_matches_profile(profile: str, unit: object) -> bool:
+    """Does *unit* name a ``hermes-serve*``/``hermes-dashboard*`` unit for *profile*?
+
+    Serve/dashboard runtimes have their OWN unit vocabulary; the gateway's
+    ``hermes-gateway*`` names never cover them (#100479). Exact names only —
+    ``work`` must not claim ``hermes-serve-workbench`` — and a scope prefix
+    (``user/hermes-serve``) is tolerated because the restart phase records
+    scope-qualified identities in some lists.
+    """
+    name = str(unit).removesuffix(".service")
+    if "/" in name:
+        name = name.rsplit("/", 1)[-1]
+    if profile == "default":
+        return name in {"hermes-serve", "hermes-dashboard"}
+    return name in {f"hermes-serve-{profile}", f"hermes-dashboard-{profile}"}
+
+
+def _serve_runtime_outcome(
+    r: RuntimeRecord,
+    *,
+    killed: set,
+    failed_set: set,
+    restarted_set: set,
+    stale_serves: "set | None",
+) -> str:
+    """Outcome for one serve/dashboard runtime — never the gateway's."""
+    if r.pid is not None and r.pid in killed:
+        return "stopped"
+    if any(_serve_unit_matches_profile(r.profile, u) for u in failed_set):
+        return "failed"
+    if stale_serves is not None:
+        # Incarnation-verified: the pre-update process is gone (replaced by
+        # its unit / the dashboard cleanup respawn / the Desktop app) or it
+        # is still alive on pre-update code.
+        return "unaccounted" if r.pid in stale_serves else "restarted"
+    if any(_serve_unit_matches_profile(r.profile, s) for s in restarted_set):
+        return "restarted"
+    return "unaccounted"
+
+
 def match_runtime_outcomes(
     plan: "UpdatePlan",
     *,
@@ -433,6 +476,7 @@ def match_runtime_outcomes(
     externally_supervised_profiles: list,
     killed_pids: set,
     failed_units: list,
+    stale_serve_pids: "set | None" = None,
 ) -> list[dict[str, Any]]:
     """Reconcile the plan's runtimes against what the restart phase DID.
 
@@ -450,6 +494,18 @@ def match_runtime_outcomes(
     ``unaccounted`` — the plan saw it and NO bookkeeping mentions it: the
     blind-spot tripwire (same philosophy as the fleet matrix's DOWN row).
     Never raises; on any probe error returns what it has.
+
+    Serve/dashboard runtimes are reconciled in their OWN vocabulary
+    (#100479): a ``hermes-serve*``/``hermes-dashboard*`` unit, a killed
+    PID, or — when the caller passes ``stale_serve_pids`` (the
+    ``(pid, create_time)``-verified survivor probe,
+    :func:`hermes_cli.update_abort_recovery._surviving_pre_update_serve_runtimes`)
+    — liveness: a pre-update serve whose incarnation is gone was replaced
+    (unit restart, dashboard cleanup respawn, Desktop respawn) and counts as
+    ``restarted``; one still alive is ``unaccounted``. They never borrow the
+    gateway's outcome: ``relaunched_profiles`` and ``hermes-gateway*`` name a
+    different process that shares the profile, nothing more. Without the
+    probe result, an untouched serve stays ``unaccounted`` (fail closed).
     """
     outcomes: list[dict[str, Any]] = []
     try:
@@ -458,23 +514,57 @@ def match_runtime_outcomes(
         relaunched = set(relaunched_profiles or [])
         external = set(externally_supervised_profiles or [])
         killed = {int(p) for p in (killed_pids or set())}
+        stale_serves = (
+            {int(p) for p in stale_serve_pids} if stale_serve_pids is not None else None
+        )
 
         for runtime in plan.runtimes:
             r = runtime if isinstance(runtime, RuntimeRecord) else None
             if r is None:
                 continue
+            if r.kind in _SERVE_KINDS:
+                outcomes.append(
+                    {
+                        "kind": r.kind,
+                        "profile": r.profile,
+                        "pid": r.pid,
+                        "mechanism": r.restart_via,
+                        "outcome": _serve_runtime_outcome(
+                            r,
+                            killed=killed,
+                            failed_set=failed_set,
+                            restarted_set=restarted_set,
+                            stale_serves=stale_serves,
+                        ),
+                    }
+                )
+                continue
             outcome = "unaccounted"
+            # The bare "hermes-gateway" unit name is gateway-specific: a
+            # serve/dashboard runtime that merely shares the default
+            # profile is a different process the gateway restart never
+            # touched, and must not borrow its outcome (#100479).
             if r.profile in relaunched or r.profile in external:
                 outcome = "restarted"
             elif r.pid is not None and r.pid in killed:
                 outcome = "stopped"
             elif any(
-                r.profile in unit or (r.profile == "default" and "hermes-gateway" in unit)
+                r.profile in unit
+                or (
+                    r.kind == "gateway"
+                    and r.profile == "default"
+                    and "hermes-gateway" in unit
+                )
                 for unit in failed_set
             ):
                 outcome = "failed"
             elif any(
-                r.profile in svc or (r.profile == "default" and "hermes-gateway" in svc)
+                r.profile in svc
+                or (
+                    r.kind == "gateway"
+                    and r.profile == "default"
+                    and "hermes-gateway" in svc
+                )
                 for svc in restarted_set
             ):
                 outcome = "restarted"
@@ -511,8 +601,14 @@ def report_unaccounted_runtimes(outcomes: list[dict[str, Any]]) -> bool:
             f" — planned mechanism: {o['mechanism']}"
         )
     print("    Restart them manually, then verify:")
-    print("      hermes gateway restart                # active profile")
-    print("      hermes -p <profile> gateway restart   # named profile")
+    if any(o.get("kind") not in _SERVE_KINDS for o in missed):
+        print("      hermes gateway restart                # active profile")
+        print("      hermes -p <profile> gateway restart   # named profile")
+    if any(o.get("kind") in _SERVE_KINDS for o in missed):
+        # A serve/dashboard is not reachable by any `gateway restart`
+        # command (#100479): name the process, not the wrong verb.
+        print("      systemctl --user restart hermes-serve.service   # unit-managed serve")
+        print("      relaunch `hermes serve` / `hermes dashboard` / the Desktop app")
     return True
 
 
diff --git a/hermes_cli/web_models.py b/hermes_cli/web_models.py
index fa5dd37243..b03f649417 100644
--- a/hermes_cli/web_models.py
+++ b/hermes_cli/web_models.py
@@ -306,6 +306,17 @@ class TTSSpeakRequest(BaseModel):
     text: str
 
 
+class TTSLeaseRequest(BaseModel):
+    """Body for ``POST /api/audio/tts-lease``.
+
+    ``lease`` names the toggle/surface holding the lease (``desktop:read-aloud``,
+    ``desktop:conversation``); ``active`` True acquires + warms, False releases.
+    """
+
+    lease: str
+    active: bool = True
+
+
 # --- from web_server.py (originally lines 11549-11551) ---
 
 class OAuthSubmitBody(BaseModel):
diff --git a/hermes_cli/web_routers/local_models.py b/hermes_cli/web_routers/local_models.py
new file mode 100644
index 0000000000..055e80a2db
--- /dev/null
+++ b/hermes_cli/web_routers/local_models.py
@@ -0,0 +1,1426 @@
+"""Local-models dashboard routes — the desktop's window into the managed
+llama.cpp runtime.
+
+Everything here is designed for a first-run user on an RTX laptop: every
+payload carries plain-language, pre-formatted facts the UI can show verbatim
+(what will this model do ON THIS MACHINE, how big is the download, what is
+the runtime doing right now), never raw internals the renderer would have to
+interpret.
+
+Long jobs (runtime install, model download) follow the repo's job pattern:
+start-POST -> {job_id} -> GET poll with byte progress. Downloads are
+byte-size checked against the catalog (no hash verification by design);
+a short download deletes the file and reports it plainly.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+import time
+import urllib.parse
+import urllib.request
+import uuid
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+
+from hermes_cli.local_runtime.endpoint import _state_endpoint
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+_GIB = 1 << 30
+_JOBS: Dict[str, Dict[str, Any]] = {}
+_JOBS_LOCK = threading.Lock()
+
+
+def _human_gb(n: int | float) -> str:
+    return f"{n / _GIB:.1f} GB"
+
+
+def _job(kind: str, target: str, model_id: str | None = None) -> Dict[str, Any]:
+    job = {
+        "job_id": uuid.uuid4().hex[:12],
+        "kind": kind,               # "runtime-install" | "model-download"
+        "target": target,
+        "model_id": model_id,       # catalog id for downloads; None otherwise
+        "status": "running",        # running | done | error
+        "phase": "starting",        # human-readable step name
+        "detail": "",
+        "total_bytes": None,
+        "done_bytes": 0,
+        "started_at": time.time(),
+        "error": None,
+    }
+    with _JOBS_LOCK:
+        _JOBS[job["job_id"]] = job
+    return job
+
+
+# ── fast download: ranged parallel streams ───────────────────
+
+# One TCP stream to a CDN rarely fills a fast line; 8 ranged connections
+# writing into a preallocated file saturate consumer gigabit.
+_DOWNLOAD_CONNECTIONS = 8
+_CHUNK = 4 << 20
+
+
+def _probe_range_support(url: str) -> int:
+    """Total size when the server honors Range requests, else 0.
+
+    Auth-shaped failures raise with a plain-language message — a 401/403
+    from the CDN means the repo is gated or the catalog entry names a
+    wrong repo, and the user deserves better than a bare status code.
+    """
+    req = urllib.request.Request(url, headers={"Range": "bytes=0-0"})
+    try:
+        with urllib.request.urlopen(req, timeout=60) as r:
+            if r.status == 206:
+                content_range = r.headers.get("Content-Range", "")
+                if "/" in content_range:
+                    return int(content_range.rsplit("/", 1)[1])
+    except urllib.error.HTTPError as exc:
+        if exc.code in (401, 403):
+            raise RuntimeError(
+                "The model host refused the download (gated or moved). "
+                "This is a catalog problem, not yours — please report it.") from exc
+        raise
+    except Exception:  # noqa: BLE001
+        pass
+    return 0
+
+
+def _model_id_for(gguf: Path) -> str:
+    """Variant model id for a staged file (strips split-part suffixes)."""
+    import re
+
+    return re.sub(r"-\d{5}-of-\d{5}$", "", gguf.stem)
+
+
+def _variant_files_on_disk(model_id: str) -> "list[Path]":
+    """Every local file belonging to a staged model: all split parts plus
+    its catalog-declared assets (mmproj/draft) when present."""
+    from hermes_cli.local_runtime.bootstrap import assets_dir
+    from hermes_cli.local_runtime.catalog import find_entry_for_model
+
+    mdir = _models_dir()
+    files = [p for p in mdir.glob("*.gguf") if _model_id_for(p) == model_id]
+    hit = find_entry_for_model(model_id)
+    if hit is not None:
+        entry, _variant = hit
+        for asset in (entry.mmproj, entry.draft):
+            if asset is not None:
+                p = assets_dir() / asset.local_name
+                if p.exists():
+                    files.append(p)
+    return files
+
+
+def download_file(url: str, dest: Path, job: Dict[str, Any],
+                  *,
+                  base_done: int = 0, keep_totals: bool = False) -> None:
+    """Download url -> dest with byte progress on ``job``.
+
+    Ranged-parallel when the server supports it, single-stream fallback
+    otherwise. There is no integrity check against the CATALOG by
+    design: catalog sizes may lag an upstream re-upload, and a
+    newer file than we know about must download fine. Completeness is
+    checked only against what the SERVER declared for this transfer
+    (range-probe total / Content-Length) — self-consistent and always
+    current — so a dropped connection still errors instead of staging a
+    truncated file. Never leaves a .part behind.
+
+    Multi-file variants: ``base_done`` offsets the progress so this file's
+    bytes accumulate onto the files before it, and ``keep_totals=True``
+    stops the per-file size from overwriting the variant's total.
+    """
+    import shutil
+    import threading as _threading
+
+    tmp = dest.with_suffix(".part")
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    file_done = [0]
+    progress_lock = _threading.Lock()
+
+    def bump(n: int) -> None:
+        with progress_lock:
+            file_done[0] += n
+            job["done_bytes"] = base_done + file_done[0]
+
+    try:
+        # The probe and the preallocation both take real seconds on a
+        # 20+ GB file — narrate them, or the pane shows a dead '— of X GB'
+        # until the first ranged byte lands.
+        job["detail"] = "Connecting"
+        total = _probe_range_support(url)
+        if total:
+            if not keep_totals:
+                job["total_bytes"] = total
+            # Preallocate so each worker writes at its own offset.
+            job["detail"] = f"Reserving {_human_gb(total)} of disk space"
+            with open(tmp, "wb") as f:
+                f.truncate(total)
+            job["detail"] = ""
+            errors: list[Exception] = []
+            bounds = [(i * total // _DOWNLOAD_CONNECTIONS,
+                       (i + 1) * total // _DOWNLOAD_CONNECTIONS - 1)
+                      for i in range(_DOWNLOAD_CONNECTIONS)]
+
+            def fetch_range(start: int, end: int) -> None:
+                try:
+                    req = urllib.request.Request(
+                        url, headers={"Range": f"bytes={start}-{end}"})
+                    with urllib.request.urlopen(req, timeout=120) as r, \
+                            open(tmp, "r+b") as f:
+                        f.seek(start)
+                        while True:
+                            chunk = r.read(_CHUNK)
+                            if not chunk:
+                                break
+                            f.write(chunk)
+                            bump(len(chunk))
+                except Exception as exc:  # noqa: BLE001
+                    errors.append(exc)
+
+            threads = [_threading.Thread(target=fetch_range, args=b, daemon=True,
+                                         name=f"lm-dl-{i}")
+                       for i, b in enumerate(bounds)]
+            for t in threads:
+                t.start()
+            for t in threads:
+                t.join()
+            if errors:
+                raise errors[0]
+            if file_done[0] != total:
+                raise RuntimeError(
+                    f"download incomplete ({file_done[0]} of {total} bytes)")
+        else:
+            # No range support: single stream, large chunks. Completeness
+            # is judged by the server's own Content-Length when it sent
+            # one — never by the catalog, which may lag a re-upload.
+            with urllib.request.urlopen(url, timeout=120) as r, open(tmp, "wb") as f:
+                length = int(r.headers.get("Content-Length") or 0)
+                if length and not keep_totals:
+                    job["total_bytes"] = length
+                while True:
+                    chunk = r.read(_CHUNK)
+                    if not chunk:
+                        break
+                    f.write(chunk)
+                    bump(len(chunk))
+            if length and file_done[0] != length:
+                raise RuntimeError(
+                    f"Download ended at {file_done[0]:,} bytes but the server "
+                    f"said {length:,} — connection dropped? Removed; try again")
+
+        shutil.move(str(tmp), str(dest))
+    except Exception:
+        tmp.unlink(missing_ok=True)
+        raise
+
+
+def _models_dir() -> Path:
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    return models_dir()
+
+
+def _engine_too_old(min_engine: str) -> bool:
+    """True when the installed llama.cpp predates a model's requirement.
+    Tags are release numbers (b10362); no engine installed compares as
+    too old only when the model states a requirement."""
+    if not min_engine:
+        return False
+    try:
+        from hermes_cli.local_runtime.binaries import default_tag, installed_tags
+
+        tags = installed_tags() or [default_tag()]
+        newest = max(int(t.lstrip("b")) for t in tags if t.lstrip("b").isdigit())
+        return newest < int(min_engine.lstrip("b"))
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def _load_config() -> dict:
+    from hermes_cli.config import load_config
+
+    try:
+        return load_config()
+    except Exception:  # noqa: BLE001
+        return {}
+
+
+def _runtime_section() -> dict:
+    return (_load_config() or {}).get("local_runtime") or {}
+
+
+# ── status: the one call the pane opens with ─────────────────
+
+
+@router.get("/api/local-models/status")
+def local_models_status():
+    """Cheap, immediate, never blocks on probes (responsiveness standard):
+    config state + installed runtime + staged models + supervisor state.
+    GPU facts come from /api/local-models/hardware (slower, polled).
+
+    Sync def on purpose: the body does blocking urlopen/scans, so it runs
+    in FastAPI's threadpool instead of stalling the event loop."""
+    from hermes_cli.local_runtime.binaries import (
+        default_tag,
+        installed_tags,
+        runtimes_root,
+        server_binary,
+    )
+
+    section = _runtime_section()
+    configured_tag = section.get("tag") or default_tag()
+    have = installed_tags()
+
+    # The tag actually serving (boot ladder: configured if installed, else
+    # newest installed). Present tense for the pane header.
+    tag = configured_tag if configured_tag in have else (have[0] if have else configured_tag)
+
+    # A pending engine update exists when the user runs the local engine
+    # (enabled + something installed) and the configured tag — pinned or
+    # the Hermes-release default — is newer than anything on disk. The
+    # download is a button click, never automatic.
+    update_available = bool(
+        section.get("enabled") and have and configured_tag not in have)
+
+    runtime_installed = False
+    runtime_backend = None
+    root = runtimes_root() / tag
+    if root.exists():
+        for backend_dir in sorted(p for p in root.iterdir() if p.is_dir()):
+            try:
+                server_binary(backend_dir)
+                runtime_installed = True
+                runtime_backend = backend_dir.name
+                break
+            except Exception:  # noqa: BLE001
+                continue
+
+    staged = []
+    mdir = _models_dir()
+    if mdir.exists():
+        from hermes_cli.local_runtime.bootstrap import staged_models
+
+        # Split models: report the whole variant's bytes, not one part's.
+        from hermes_cli.local_runtime.catalog import find_entry_for_model
+
+        for gguf in staged_models():
+            model_id = _model_id_for(gguf)
+            size = gguf.stat().st_size
+            hit = find_entry_for_model(model_id)
+            if hit is not None:
+                size = hit[1].size_bytes
+            staged.append({
+                "id": model_id,
+                "size_bytes": size,
+                "size_label": _human_gb(size),
+            })
+
+    running = _state_endpoint()
+
+    # Which staged models are resident right now (loaded in VRAM). Read
+    # from the live router when it's up; {} when down. Feeds the pane's
+    # Loaded pills and eject buttons.
+    loaded: Dict[str, str] = {}
+    placement: Dict[str, Any] = {}
+    if running is not None:
+        try:
+            import urllib.request as _url
+
+            req = _url.Request(
+                running["base_url"].rsplit("/v1", 1)[0] + "/models",
+                headers={"Authorization": f"Bearer {running.get('api_key', '')}"})
+            with _url.urlopen(req, timeout=3) as r:
+                data = json.loads(r.read())
+            loaded = {
+                m["id"]: m.get("status", {}).get("value", "unknown")
+                for m in data.get("data", [])
+                # Everything resident or becoming resident: 'loading' renders
+                # as its own state in the pane (a 20-GB load in flight is the
+                # single most important thing the pane can show).
+                if m.get("status", {}).get("value") in ("loaded", "ready", "loading")
+            }
+            # How each loaded model is actually running: the granted window
+            # from the child itself, and the plan's spill facts from the
+            # preset decision. The pane shows this verbatim — placement is
+            # the difference between 'fast' and 'why is my CPU busy', so it
+            # must be inspectable, not inferred from Task Manager.
+            from hermes_cli.local_runtime.presets import read_preset_decisions
+
+            decisions = read_preset_decisions()
+            for model_id in loaded:
+                entry_facts: Dict[str, Any] = {}
+                plan = decisions.get(model_id)
+                if plan is not None:
+                    entry_facts["window"] = plan.window
+                    entry_facts["window_label"] = f"{plan.window // 1024}K"
+                    entry_facts["spilled"] = plan.spilled
+                if loaded[model_id] in ("loaded", "ready"):
+                    try:
+                        preq = _url.Request(
+                            running["base_url"].rsplit("/v1", 1)[0]
+                            + f"/props?model={model_id}",
+                            headers={"Authorization":
+                                     f"Bearer {running.get('api_key', '')}"})
+                        with _url.urlopen(preq, timeout=3) as pr:
+                            props = json.loads(pr.read())
+                        n_ctx = (props.get("default_generation_settings", {})
+                                 .get("n_ctx"))
+                        if n_ctx:
+                            entry_facts["granted_window"] = int(n_ctx)
+                            entry_facts["granted_window_label"] = f"{int(n_ctx) // 1024}K"
+                    except Exception:  # noqa: BLE001
+                        pass
+                if entry_facts:
+                    placement[model_id] = entry_facts
+        except Exception as exc:  # noqa: BLE001
+            # Never silent: an empty dict here renders as 'Not in memory'
+            # on a machine whose VRAM is visibly full.
+            logger.warning("loaded-models read failed: %r", exc)
+            loaded = {}
+
+    # The active main model, when it is one of ours (config authority: the
+    # same model.provider + model.default that /api/model/set writes).
+    active_model_id = None
+    try:
+        config = _load_config()
+        model_section = (config or {}).get("model") or {}
+        if str(model_section.get("provider", "")).strip().lower() in (
+                "llamacpp", "llama.cpp", "llama-cpp"):
+            active_model_id = str(
+                model_section.get("default") or model_section.get("name") or ""
+            ).strip() or None
+    except Exception:  # noqa: BLE001
+        pass
+
+    return {
+        "enabled": bool(section.get("enabled")),
+        "tag": tag,
+        "configured_tag": configured_tag,
+        "update_available": update_available,
+        "runtime_installed": runtime_installed,
+        "runtime_backend": runtime_backend,
+        "server_running": running is not None,
+        "server_base_url": (running or {}).get("base_url"),
+        "active_model_id": active_model_id,
+        "loaded_models": loaded,
+        # Live load progress per model (SSE-fed): {model_id: {stage, value,
+        # percent}}. The chat's loading bar and the picker rows poll this.
+        "loading": _loading_progress(),
+        "placement": placement,
+        "models": staged,
+        "models_dir": str(mdir),
+    }
+
+
+def _loading_progress() -> Dict[str, Any]:
+    try:
+        from hermes_cli.local_runtime.load_progress import get_loading_progress
+
+        return get_loading_progress()
+    except Exception:  # noqa: BLE001 — progress is garnish, never a 500
+        return {}
+
+
+# ── hardware: what this machine can do ───────────────────────
+
+
+@router.get("/api/local-models/hardware")
+def local_models_hardware():
+    """The budget as plain facts. Polled by the pane and the statusbar
+    resource item (throttled client-side). Sync def on purpose: the body
+    shells out to nvidia-smi and probes budgets — threadpool, not loop."""
+    from hermes_cli.local_runtime.hardware import probe_budget, _nvidia_vram, _ram_bytes
+
+    budget = probe_budget()
+    ram_total, ram_avail = _ram_bytes()
+    out = {
+        "uma": budget.uma,
+        "vram_total_bytes": budget.total_device_bytes,
+        "vram_usable_bytes": budget.usable_vram_bytes,
+        "ram_total_bytes": ram_total,
+        "ram_available_bytes": ram_avail,
+        "vram_label": _human_gb(budget.total_device_bytes),
+        "gpu_name": None,
+        "gpu_util_percent": None,
+        "vram_used_bytes": None,
+    }
+    # GPU identity + live utilization (NVIDIA; other vendors degrade to None
+    # and the UI hides those readouts).
+    try:
+        import subprocess
+
+        from hermes_cli.local_runtime.hardware import _nvidia_smi_path
+
+        smi_exe = _nvidia_smi_path()
+        smi = subprocess.run(
+            [smi_exe, "--query-gpu=name,utilization.gpu,memory.used",
+             "--format=csv,noheader,nounits"],
+            capture_output=True, text=True, timeout=5) if smi_exe else None
+        if smi and smi.returncode == 0 and smi.stdout.strip():
+            name, util, used_mib = (x.strip() for x in smi.stdout.strip().splitlines()[0].split(","))
+            out["gpu_name"] = name
+            out["gpu_util_percent"] = int(util)
+            out["vram_used_bytes"] = int(used_mib) << 20
+    except Exception:  # noqa: BLE001
+        pass
+    return out
+
+
+# ── catalog: priced for THIS machine before download ─────────
+
+
+@router.get("/api/local-models/catalog")
+def local_models_catalog():
+    """Every entry answers the user's three questions up front: how big is
+    the download, will it fit, and what context/speed shape will I get —
+    computed from the catalog's measured numbers + this machine's
+    budget. Hardware-aware quant selection: the row advertises the BEST
+    build for this machine (highest quality that runs fully on the GPU at
+    the 64K floor; else the smallest that works, spilled and priced). No
+    entry is hidden; unaffordable models show WHY. Sync def on purpose:
+    probe_budget + catalog I/O block — threadpool, not loop."""
+    from hermes_cli.local_runtime.catalog import (
+        CATALOG,
+        recommended_entry,
+        refresh_catalog_soon,
+        select_variant,
+    )
+    from hermes_cli.local_runtime.context_policy import (
+        RUNTIME_OVERHEAD_BYTES,
+        initial_window,
+        ub_logits_bytes,
+    )
+    from hermes_cli.local_runtime.estimator import PhysicsRefusal
+    from hermes_cli.local_runtime.hardware import probe_budget
+
+    # This request serves the catalog already in memory; a TTL-gated
+    # background fetch from the repo lands new entries for the next one
+    # (day-0 models reach the pane without an app release).
+    refresh_catalog_soon()
+
+    # Planning budget: price against machine capacity, not live-free VRAM.
+    # A loaded model must not make the catalog call every row unaffordable.
+    budget = probe_budget(planning=True)
+    # The default pick for THIS machine: quality-ranked, fit- and
+    # speed-gated (recommended_entry). Engine-gated entries can't be
+    # activated today, so they can't be the recommendation either. The
+    # reason key ships with the row — the Recommended badge's tooltip is
+    # the branch that actually fired, not a re-derivation that can drift.
+    eligible = tuple(e for e in CATALOG if not _engine_too_old(e.min_engine))
+    picked = recommended_entry(budget, eligible)
+    recommended = picked[0].id if picked is not None else None
+    recommended_reason = picked[1] if picked is not None else None
+    # Completeness-checked staging (split parts all present) — the same
+    # answer the picker and the router see, so a mid-download model never
+    # reads as downloaded here.
+    from hermes_cli.local_runtime.bootstrap import staged_model_ids
+
+    staged_ids = set(staged_model_ids())
+    entries = []
+    for entry in CATALOG:
+        choice = select_variant(entry, budget)
+        # Any variant of this family already on disk counts as downloaded
+        # (split variants stage under their first part).
+        downloaded_variant = next(
+            (v for v in entry.variants if v.model_id in staged_ids), None)
+        row: Dict[str, Any] = {
+            "id": entry.id,
+            "display_name": entry.display_name,
+            "description": entry.description,
+            "native_context": entry.n_ctx_train,
+            "native_context_label": f"{entry.n_ctx_train // 1024}K",
+            "recommended": entry.id == recommended,
+            "recommended_reason": recommended_reason if entry.id == recommended else None,
+            "downloaded": downloaded_variant is not None,
+            "downloaded_model_id": downloaded_variant.model_id if downloaded_variant else None,
+            "downloaded_quant": downloaded_variant.quant if downloaded_variant else None,
+            "mtp": entry.mtp,
+            "vision": entry.mmproj is not None,
+            # Day-0 architectures need the llama.cpp release where their
+            # support landed. True gates download/activate in the pane
+            # until the engine updates; the row still renders (visible +
+            # explained beats hidden).
+            "needs_engine": _engine_too_old(entry.min_engine),
+            "min_engine": entry.min_engine or None,
+        }
+        if choice is None:
+            smallest = min(entry.variants, key=lambda v: v.size_bytes)
+            smallest_total = entry.download_bytes(smallest)
+            row.update({
+                "fits": False,
+                "size_bytes": smallest_total,
+                "size_label": _human_gb(smallest_total),
+                "fit_summary": "Needs more memory than this machine has",
+                "fit_detail": (f"even the most compact build ({smallest.quant}, "
+                               f"{_human_gb(smallest_total)}) exceeds GPU + system memory"),
+            })
+            entries.append(row)
+            continue
+
+        variant = choice.variant
+        profile = entry.profile(variant)
+        # Same overhead the launch decision prices (runtime buffers +
+        # vision projector + the microbatch/MTP logits buffers): the row
+        # must advertise the window the model will actually get, not a
+        # paper number the server's own fit then shaves down.
+        overhead = (RUNTIME_OVERHEAD_BYTES
+                    + (entry.mmproj.size_bytes if entry.mmproj else 0)
+                    + ub_logits_bytes(entry.n_vocab, mtp_capable=entry.mtp))
+        decision = initial_window(profile, budget, overhead_bytes=overhead)
+        download_total = entry.download_bytes(variant)
+        row.update({
+            "fits": True,
+            "model_id": variant.model_id,
+            "quant": variant.quant,
+            "quant_validated": variant.validated,
+            "size_bytes": download_total,
+            "size_label": _human_gb(download_total),
+            "variant_count": len(entry.variants),
+        })
+        if choice.reason_key == "best-large-window":
+            row["quant_reason"] = (
+                f"Recommended build ({variant.quant}) — the quant class this "
+                "engine is optimized for; runs fully on your GPU with a "
+                "large context window")
+        elif choice.reason_key == "best-fits":
+            row["quant_reason"] = (
+                f"Recommended build ({variant.quant}) — the quant class this "
+                "engine is optimized for; runs fully on your GPU")
+        else:
+            row["quant_reason"] = (
+                f"Compact build sized for this machine ({variant.quant}) — "
+                "larger than GPU memory, runs slower")
+        if not isinstance(decision, PhysicsRefusal):
+            row["start_window"] = decision.window
+            row["start_window_label"] = f"{decision.window // 1024}K"
+            row["spilled"] = decision.spilled
+            if decision.window >= entry.n_ctx_train:
+                shape = f"runs at its full {row['native_context_label']} context"
+            else:
+                shape = (f"starts at {row['start_window_label']} and grows toward "
+                         f"{row['native_context_label']} as you use it")
+            if decision.spilled:
+                shape += " (larger than your GPU memory — runs slower)"
+            row["fit_summary"] = shape
+        else:
+            row["fit_summary"] = row["quant_reason"]
+        entries.append(row)
+    return {"models": entries}
+
+
+# ── runtime install (job) ────────────────────────────────────
+
+
+class RuntimeInstallBody(BaseModel):
+    backend: Optional[str] = None   # None/auto -> detect
+
+
+def _runtime_progress_hook(job: Dict[str, Any]):
+    """Adapter: ensure_runtime_installed's progress stream -> job fields.
+
+    Throttled to ~4 updates/s. The byte counters are CUMULATIVE across the
+    plan: a multi-asset engine (CUDA zip + cudart zip) reads as one growing
+    download, not a bar that restarts at zero per asset. The total grows as
+    each asset's size becomes known (sizes arrive with the response, not
+    the plan). Unpack/verify keep the download's counters in place — the
+    stage text says what's happening, and a bar that bounces back to zero
+    after the bytes finished reads as a failure."""
+    state = {"last": 0.0, "banked": 0, "asset": None, "asset_total": 0}
+
+    def hook(stage: str, done: int, total: int, label: str) -> None:
+        now = time.monotonic()
+        if now - state["last"] < 0.25 and done < total:
+            return
+        state["last"] = now
+        suffix = f" ({label})" if label else ""
+        if stage == "download":
+            if label != state["asset"]:
+                # Previous asset finished: bank its bytes so the counters
+                # keep climbing instead of restarting for the next asset.
+                state["banked"] += state["asset_total"]
+                state["asset"] = label
+            state["asset_total"] = total or done
+            plan_done = state["banked"] + done
+            plan_total = state["banked"] + (total or 0)
+            job["phase"] = "downloading-runtime"
+            if total:
+                job["detail"] = (f"Downloading the local engine{suffix} — "
+                                 f"{_human_gb(plan_done)} of {_human_gb(plan_total)}")
+            else:
+                job["detail"] = (f"Downloading the local engine{suffix} — "
+                                 f"{_human_gb(plan_done)}")
+            job["done_bytes"] = plan_done
+            job["total_bytes"] = plan_total or None
+        elif stage == "extract":
+            job["phase"] = "unpacking-runtime"
+            pct = f" — {min(100, round(done / total * 100))}%" if total else ""
+            job["detail"] = f"Unpacking the engine{suffix}{pct}"
+        else:  # verify
+            job["phase"] = "verifying-runtime"
+            job["detail"] = f"Verifying the engine{suffix}"
+
+    return hook
+
+
+@router.post("/api/local-models/runtime/install")
+async def local_models_runtime_install(body: RuntimeInstallBody):
+    from hermes_cli.local_runtime.binaries import (
+        default_tag,
+        resolve_assets,
+        select_backend,
+    )
+    from hermes_cli.local_runtime.bootstrap import _detect_gpu_vendor
+
+    section = _runtime_section()
+    tag = section.get("tag") or default_tag()
+    backend = body.backend or section.get("backend", "auto")
+    if backend == "auto":
+        backend = select_backend(_detect_gpu_vendor())
+    # Resolve first so an impossible combination fails the POST, not the job.
+    try:
+        plan = resolve_assets(tag, backend)
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=400, detail=str(exc))
+
+    job = _job("runtime-install", f"llama.cpp {tag} ({backend})")
+
+    def _run():
+        try:
+            from hermes_cli.local_runtime.binaries import (
+                ensure_runtime_installed,
+                installed_tags,
+                prune_old_tags,
+            )
+
+            previous = installed_tags()
+            job["phase"] = "downloading"
+            job["detail"] = f"Fetching {len(plan.assets)} package(s) for {backend}"
+            ensure_runtime_installed(tag, backend,
+                                     progress=_runtime_progress_hook(job))
+
+            # Engine update path: a server already running on an older tag
+            # moves to the new one now — the click was the consent. Fresh
+            # installs (no server) skip this; Use/boot handles their start.
+            restarted = False
+            try:
+                from hermes_cli.local_runtime.bootstrap import (
+                    ensure_local_runtime,
+                    get_supervisor,
+                    shutdown_local_runtime,
+                )
+
+                sup = get_supervisor()
+                if sup is not None and previous and tag not in previous:
+                    job["phase"] = "restarting"
+                    job["detail"] = "Switching the running server to the new build"
+                    shutdown_local_runtime()
+                    ensure_local_runtime(_load_config(), force=True)
+                    restarted = True
+            except Exception as exc:  # noqa: BLE001
+                # The new build is installed either way; the next boot serves
+                # it. Never fail the job on the restart nicety.
+                logger.warning("post-update restart skipped: %s", exc)
+
+            # N-1 retention, only after the new tag verified: keep it and the
+            # newest previous build as the rollback pin target.
+            try:
+                keep = [tag] + [t for t in previous if t != tag][:1]
+                prune_old_tags(keep)
+            except Exception as exc:  # noqa: BLE001
+                logger.warning("runtime prune skipped: %s", exc)
+
+            job["phase"] = "done"
+            job["status"] = "done"
+            job["detail"] = (f"llama.cpp {tag} ready ({backend})"
+                             + (" — server restarted on the new build" if restarted else ""))
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("runtime install failed: %s", exc)
+            job["status"] = "error"
+            job["error"] = str(exc)
+
+    threading.Thread(target=_run, daemon=True, name="lr-runtime-install").start()
+    return {"job_id": job["job_id"], "backend": backend, "tag": tag}
+
+
+# ── model download (job with byte progress) ──────────────────
+
+
+class ModelDownloadBody(BaseModel):
+    model_id: str
+
+
+@router.post("/api/local-models/download")
+async def local_models_download(body: ModelDownloadBody):
+    """Accepts either a family id (downloads this machine's selected
+    variant) or an exact variant model_id."""
+    from hermes_cli.local_runtime.catalog import (
+        CATALOG,
+        catalog_by_id,
+        select_variant,
+    )
+    from hermes_cli.local_runtime.hardware import probe_budget
+
+    entry = catalog_by_id().get(body.model_id)
+    variant = None
+    if entry is not None:
+        if _engine_too_old(entry.min_engine):
+            raise HTTPException(
+                status_code=409,
+                detail=(f"{entry.display_name} needs llama.cpp {entry.min_engine} "
+                        f"or newer — update the engine first"))
+        # Same planning budget as the catalog — the user downloads exactly
+        # the build the row advertised.
+        choice = select_variant(entry, probe_budget(planning=True))
+        if choice is None:
+            raise HTTPException(status_code=409,
+                                detail=f"no variant of {entry.id} fits this machine")
+        variant = choice.variant
+    else:
+        for candidate in CATALOG:
+            for v in candidate.variants:
+                if v.model_id == body.model_id:
+                    entry, variant = candidate, v
+                    break
+            if variant:
+                break
+    if entry is None or variant is None:
+        raise HTTPException(status_code=404, detail=f"unknown model {body.model_id}")
+
+    from hermes_cli.local_runtime.bootstrap import assets_dir, staged_model_ids
+
+    if variant.model_id in staged_model_ids():
+        return {"job_id": None, "already_downloaded": True, "model_id": variant.model_id}
+
+    # Everything this variant needs: split parts + mmproj/draft assets.
+    plan = []  # (url, dest, bytes)
+    for asset in variant.files:
+        plan.append((f"https://huggingface.co/{entry.repo}/resolve/main/{asset.path}",
+                     _models_dir() / asset.local_name, asset.size_bytes))
+    for asset in (entry.mmproj, entry.draft):
+        if asset is not None:
+            plan.append((f"https://huggingface.co/{entry.repo}/resolve/main/{asset.path}",
+                         assets_dir() / asset.local_name, asset.size_bytes))
+
+    total = sum(p[2] for p in plan)
+    job = _job("model-download", f"{entry.display_name} ({variant.quant})",
+               model_id=entry.id)
+    job["total_bytes"] = total
+
+    def _run():
+        try:
+            job["phase"] = "downloading"
+            job["detail"] = f"{entry.display_name} — {_human_gb(total)}"
+            done_before = 0
+            for url, dest, size in plan:
+                if dest.exists():
+                    done_before += size
+                    job["done_bytes"] = done_before
+                    continue
+                download_file(url, dest, job,
+                              base_done=done_before, keep_totals=True)
+                job["phase"] = "downloading"
+                done_before += size
+                job["done_bytes"] = done_before
+            job["phase"] = "done"
+            job["status"] = "done"
+            job["detail"] = f"{entry.display_name} ready"
+            # A running router only scans models at spawn —
+            # bounce it so the new model is servable
+            # immediately instead of 400ing until the next app restart.
+            try:
+                from hermes_cli.local_runtime.bootstrap import refresh_local_runtime
+
+                refresh_local_runtime()
+            except Exception:  # noqa: BLE001
+                logger.debug("post-download runtime refresh skipped", exc_info=True)
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("model download failed: %s", exc)
+            job["status"] = "error"
+            job["error"] = str(exc)
+
+    threading.Thread(target=_run, daemon=True, name="lr-model-download").start()
+    return {"job_id": job["job_id"], "model_id": variant.model_id}
+
+
+@router.delete("/api/local-models/models/{model_id}")
+async def local_models_delete(model_id: str):
+    """Remove a staged model: every split part plus its private assets.
+    A running router keeps serving from its spawn-time scan, so bounce it
+    off the request thread — deleting the active file mid-serve is the
+    kind of stale state the refresh exists for."""
+    files = _variant_files_on_disk(model_id)
+    if not files:
+        raise HTTPException(status_code=404, detail="model not found")
+    for path in files:
+        path.unlink(missing_ok=True)
+    # Growth state dies with the model: a re-download starts back at its
+    # zero-spill window instead of inheriting a stale grown one.
+    try:
+        from hermes_cli.local_runtime.growth import clear_window_override
+
+        clear_window_override(model_id)
+    except Exception:  # noqa: BLE001
+        logger.debug("window-override clear skipped", exc_info=True)
+
+    def _refresh():
+        try:
+            from hermes_cli.local_runtime.bootstrap import refresh_local_runtime
+
+            refresh_local_runtime()
+        except Exception:  # noqa: BLE001
+            logger.debug("post-delete runtime refresh skipped", exc_info=True)
+
+    threading.Thread(target=_refresh, daemon=True, name="lr-post-delete").start()
+    return {"ok": True}
+
+
+# ── server lifecycle: turn the engine on/off ─────────────────
+
+
+class ServerActionBody(BaseModel):
+    action: str                 # "stop" | "start"
+
+
+# ── quickstart: one click from nothing to a working default ──
+
+
+class QuickstartBody(BaseModel):
+    model_id: str | None = None   # default: the catalog's recommended entry
+
+
+# One quickstart at a time: the job sequences installs, downloads, a
+# server bounce, and a config write — two racing runs would interleave
+# all four. Held for the job's lifetime, released in the worker.
+_QUICKSTART_LOCK = threading.Lock()
+
+
+@router.post("/api/local-models/quickstart")
+async def local_models_quickstart(body: QuickstartBody):
+    """The dummy-proof path: one job that installs the runtime (if
+    missing), downloads this machine's build of the recommended model
+    (if missing), and makes it the default for new chats. Each leg is
+    the same code the individual routes run — this route only sequences
+    them, so 'Configure' (the existing pane) and quickstart can never
+    disagree about what gets installed.
+
+    Preflight rejects (no servable entry, engine too old) fail the POST
+    synchronously so the button can explain itself; everything slow runs
+    in the job with the usual phase/byte progress.
+    """
+    from hermes_cli.local_runtime.binaries import (
+        default_tag,
+        installed_tags,
+        resolve_assets,
+        select_backend,
+    )
+    from hermes_cli.local_runtime.bootstrap import (
+        _detect_gpu_vendor,
+        assets_dir,
+        staged_model_ids,
+    )
+    from hermes_cli.local_runtime.catalog import (
+        CATALOG,
+        catalog_by_id,
+        recommended_entry,
+        select_variant,
+    )
+    from hermes_cli.local_runtime.hardware import probe_budget
+
+    # Resolve the target entry: explicit id, else this machine's
+    # recommendation (quality-ranked, fit- and speed-gated), else the
+    # first catalog entry this machine can serve.
+    budget = probe_budget(planning=True)
+    entry = None
+    if body.model_id:
+        entry = catalog_by_id().get(body.model_id)
+        if entry is None:
+            raise HTTPException(status_code=404,
+                                detail=f"unknown model {body.model_id}")
+        candidates = [entry]
+    else:
+        eligible = tuple(e for e in CATALOG if not _engine_too_old(e.min_engine))
+        picked = recommended_entry(budget, eligible)
+        best = picked[0] if picked is not None else None
+        candidates = ([best] if best is not None else []) + [
+            e for e in CATALOG if best is None or e.id != best.id]
+    chosen = None
+    for candidate in candidates:
+        choice = select_variant(candidate, budget)
+        if choice is not None and not _engine_too_old(candidate.min_engine):
+            chosen = (candidate, choice.variant)
+            break
+    if chosen is None:
+        raise HTTPException(
+            status_code=409,
+            detail="no catalog model fits this machine — open Local Models "
+                   "to browse for a smaller build")
+    entry, variant = chosen
+
+    section = _runtime_section()
+    tag = section.get("tag") or default_tag()
+    backend = section.get("backend", "auto")
+    if backend == "auto":
+        backend = select_backend(_detect_gpu_vendor())
+    need_runtime = not installed_tags()
+    if need_runtime:
+        # Same preflight as /runtime/install: impossible combos fail the POST.
+        try:
+            resolve_assets(tag, backend)
+        except Exception as exc:  # noqa: BLE001
+            raise HTTPException(status_code=400, detail=str(exc))
+
+    need_download = variant.model_id not in staged_model_ids()
+    download_plan = []  # (url, dest, bytes)
+    if need_download:
+        for asset in variant.files:
+            download_plan.append(
+                (f"https://huggingface.co/{entry.repo}/resolve/main/{asset.path}",
+                 _models_dir() / asset.local_name, asset.size_bytes))
+        for asset in (entry.mmproj, entry.draft):
+            if asset is not None:
+                download_plan.append(
+                    (f"https://huggingface.co/{entry.repo}/resolve/main/{asset.path}",
+                     assets_dir() / asset.local_name, asset.size_bytes))
+
+    if not _QUICKSTART_LOCK.acquire(blocking=False):
+        raise HTTPException(status_code=409,
+                            detail="Setup is already running")
+
+    job = _job("quickstart", entry.display_name, model_id=entry.id)
+    job["total_bytes"] = sum(p[2] for p in download_plan) or None
+
+    def _run():
+        try:
+            if need_runtime:
+                from hermes_cli.local_runtime.binaries import ensure_runtime_installed
+
+                job["phase"] = "installing-runtime"
+                job["detail"] = "Installing the local engine"
+                ensure_runtime_installed(tag, backend,
+                                         progress=_runtime_progress_hook(job))
+
+            if need_download:
+                job["phase"] = "downloading"
+                total = sum(p[2] for p in download_plan)
+                # The runtime leg repurposed the byte counters for its own
+                # stages — reset them to the model plan before download.
+                job["done_bytes"] = 0
+                job["total_bytes"] = total
+                job["detail"] = f"{entry.display_name} — {_human_gb(total)}"
+                done_before = 0
+                for url, dest, size in download_plan:
+                    if dest.exists():
+                        done_before += size
+                        job["done_bytes"] = done_before
+                        continue
+                    download_file(url, dest, job,
+                                  base_done=done_before, keep_totals=True)
+                    job["phase"] = "downloading"
+                    done_before += size
+                    job["done_bytes"] = done_before
+
+            # Activate: same sequence as /activate's job body.
+            from hermes_cli.config import load_config, save_config
+            from hermes_cli.local_runtime.bootstrap import (
+                ensure_local_runtime,
+                refresh_local_runtime,
+            )
+
+            job["phase"] = "starting-server"
+            job["detail"] = "Starting the local server"
+            config = load_config()
+            config.setdefault("local_runtime", {})["enabled"] = True
+            save_config(config)
+            sup = ensure_local_runtime(config, force=True)
+            if sup is None and _state_endpoint() is None:
+                raise RuntimeError(
+                    "The local server could not start — open Local Models for details")
+            if sup is not None:
+                try:
+                    if variant.model_id not in sup.models():
+                        job["detail"] = "Refreshing the local server"
+                        refresh_local_runtime()
+                except Exception:  # noqa: BLE001
+                    logger.debug("quickstart rescan check skipped", exc_info=True)
+
+            job["phase"] = "setting-default"
+            job["detail"] = "Making it your default"
+            from hermes_cli.web_deps import late
+
+            late("_apply_model_assignment_sync")(
+                "main", "llamacpp", variant.model_id, "", "", "")
+
+            job["phase"] = "done"
+            job["status"] = "done"
+            job["detail"] = f"{entry.display_name} is ready — new chats use it"
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("quickstart failed: %s", exc)
+            job["status"] = "error"
+            job["error"] = str(exc)
+        finally:
+            _QUICKSTART_LOCK.release()
+
+    threading.Thread(target=_run, daemon=True, name="lr-quickstart").start()
+    return {
+        "job_id": job["job_id"],
+        "model_id": entry.id,
+        "display_name": entry.display_name,
+        "needs_runtime": need_runtime,
+        "needs_download": need_download,
+        "download_bytes": sum(p[2] for p in download_plan),
+    }
+
+
+@router.post("/api/local-models/server")
+async def local_models_server(body: ServerActionBody):
+    """Turn the local engine off (stop the server, free ALL GPU memory,
+    and disable auto-start) or back on. The off switch is the whole-engine
+    counterpart of per-model eject — and unlike eject it IS durable: the
+    user said off, so boots stay off until they say on."""
+    import asyncio
+
+    from hermes_cli.config import load_config, save_config
+
+    action = (body.action or "").strip().lower()
+    if action not in ("stop", "start"):
+        raise HTTPException(status_code=400, detail="action must be 'stop' or 'start'")
+
+    def _stop():
+        from hermes_cli.local_runtime.bootstrap import (
+            get_supervisor,
+            shutdown_local_runtime,
+        )
+
+        sup = get_supervisor()
+        if sup is not None:
+            shutdown_local_runtime()
+        else:
+            # Server owned by another process (or an orphan): best-effort
+            # terminate via the state file's pid, then clear the state.
+            endpoint = _state_endpoint()
+            if endpoint is not None:
+                try:
+                    import psutil  # type: ignore
+
+                    from hermes_cli.local_runtime.supervisor import state_path
+
+                    state = json.loads(state_path().read_text(encoding="utf-8"))
+                    pid = int(state.get("pid") or 0)
+                    if pid > 0 and psutil.pid_exists(pid):
+                        psutil.Process(pid).terminate()
+                    state_path().unlink(missing_ok=True)
+                except Exception:  # noqa: BLE001
+                    pass
+        config = load_config()
+        config.setdefault("local_runtime", {})["enabled"] = False
+        save_config(config)
+
+    def _start():
+        from hermes_cli.local_runtime.bootstrap import ensure_local_runtime
+
+        config = load_config()
+        config.setdefault("local_runtime", {})["enabled"] = True
+        save_config(config)
+        sup = ensure_local_runtime(config, force=True)
+        if sup is None and _state_endpoint() is None:
+            raise RuntimeError("The local server could not start — check the "
+                               "runtime is installed")
+
+    try:
+        await asyncio.to_thread(_stop if action == "stop" else _start)
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=502, detail=str(exc)) from exc
+    return {"ok": True, "action": action}
+
+
+# ── activate: make a downloaded model THE model ──────────────
+
+
+class ModelEjectBody(BaseModel):
+    model_id: str
+
+
+@router.post("/api/local-models/eject")
+def local_models_eject(body: ModelEjectBody):
+    """Free a loaded model's GPU memory now. Nothing reloads it except
+    demand — the next message to it (residency v2: no automatic loading
+    exists anywhere). Sync def on purpose: the fallback path blocks on a
+    urlopen with a 120s timeout — threadpool, never the event loop."""
+    from hermes_cli.local_runtime.bootstrap import get_supervisor
+
+    sup = get_supervisor()
+    if sup is not None:
+        try:
+            sup.unload_model(body.model_id)
+            return {"ok": True}
+        except Exception as exc:  # noqa: BLE001
+            raise HTTPException(status_code=502, detail=str(exc)) from exc
+
+    # Server owned by another process (or state-file only): drive the
+    # router directly with the persisted endpoint.
+    endpoint = _state_endpoint()
+    if endpoint is None:
+        raise HTTPException(status_code=409, detail="local server is not running")
+    try:
+        import urllib.request as _url
+
+        req = _url.Request(
+            endpoint["base_url"].rsplit("/v1", 1)[0] + "/models/unload",
+            data=json.dumps({"model": body.model_id}).encode(),
+            headers={"Content-Type": "application/json",
+                     "Authorization": f"Bearer {endpoint.get('api_key', '')}"},
+            method="POST")
+        with _url.urlopen(req, timeout=120):
+            pass
+        return {"ok": True}
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=502, detail=str(exc)) from exc
+
+
+class ModelActivateBody(BaseModel):
+    model_id: str               # exact variant id (a staged .gguf stem)
+
+
+@router.post("/api/local-models/activate")
+async def local_models_activate(body: ModelActivateBody):
+    """Make a downloaded model the default for new chats. Pure selection
+    (residency v2): a config write through the same machinery as
+    /api/model/set, plus making sure the server is up. NO model loading —
+    models load on first inference, always; an empty router costs nothing.
+    Fast enough to be synchronous-feeling, but kept as a job for UI
+    continuity."""
+    # Split variants stage under their first part — resolve like the rest
+    # of the routes instead of assuming a single flat file.
+    from hermes_cli.local_runtime.bootstrap import staged_model_ids
+
+    if body.model_id not in staged_model_ids():
+        raise HTTPException(status_code=404, detail=f"{body.model_id} is not downloaded")
+
+    job = _job("model-activate", body.model_id, model_id=body.model_id)
+
+    def _run():
+        try:
+            from hermes_cli.config import load_config, save_config
+            from hermes_cli.local_runtime.bootstrap import (
+                ensure_local_runtime,
+                refresh_local_runtime,
+            )
+
+            job["phase"] = "starting-server"
+            job["detail"] = "Starting the local server"
+            config = load_config()
+            sup = ensure_local_runtime(config, force=True)
+            if sup is None:
+                if _state_endpoint() is None:
+                    raise RuntimeError(
+                        "The local server could not start — check the runtime is installed")
+
+            # Self-heal a stale router: the model list is spawn-only, so a
+            # server started before this model finished downloading can't
+            # serve it. If the router doesn't know the model, bounce it.
+            if sup is not None:
+                try:
+                    if body.model_id not in sup.models():
+                        job["detail"] = "Refreshing the local server"
+                        refresh_local_runtime()
+                except Exception:  # noqa: BLE001
+                    logger.debug("activate rescan check skipped", exc_info=True)
+
+            job["phase"] = "setting-default"
+            job["detail"] = "Making it your default"
+            config = load_config()
+            config.setdefault("local_runtime", {})["enabled"] = True
+            save_config(config)
+            from hermes_cli.web_deps import late
+
+            late("_apply_model_assignment_sync")(
+                "main", "llamacpp", body.model_id, "", "", "")
+
+            job["phase"] = "done"
+            job["status"] = "done"
+            job["detail"] = f"{body.model_id} is the default for new chats"
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("model activate failed: %s", exc)
+            job["status"] = "error"
+            job["error"] = str(exc)
+
+    threading.Thread(target=_run, daemon=True, name="lr-model-activate").start()
+    return {"job_id": job["job_id"]}
+
+
+# ── job polling ──────────────────────────────────────────────
+
+
+@router.get("/api/local-models/jobs")
+async def local_models_jobs():
+    """All recent jobs, running first — the pane and the app-level poller
+    rediscover in-flight work here after a remount or app restart."""
+    with _JOBS_LOCK:
+        jobs = sorted(_JOBS.values(),
+                      key=lambda j: (j["status"] != "running", -j["started_at"]))
+    out = []
+    for job in jobs[:20]:
+        entry = dict(job)
+        if entry["total_bytes"]:
+            entry["percent"] = min(100, round(entry["done_bytes"] / entry["total_bytes"] * 100))
+        out.append(entry)
+    return {"jobs": out}
+
+
+@router.get("/api/local-models/jobs/{job_id}")
+async def local_models_job(job_id: str):
+    with _JOBS_LOCK:
+        job = _JOBS.get(job_id)
+    if job is None:
+        raise HTTPException(status_code=404, detail="job not found")
+    out = dict(job)
+    if out["total_bytes"]:
+        out["percent"] = min(100, round(out["done_bytes"] / out["total_bytes"] * 100))
+    return out
+
+
+# ── Hugging Face browser: search, repo files, arbitrary download ─
+
+
+@router.get("/api/local-models/search")
+async def local_models_search(q: str, limit: int = 20):
+    """Full-text HF search over GGUF models — the firehose behind the
+    curated catalog. The pane's per-quant fit pills come from the
+    repo-files call once the user opens a hit."""
+    from starlette.concurrency import run_in_threadpool
+
+    from hermes_cli.local_runtime.hf_browse import search_models
+
+    if not q.strip():
+        return {"hits": []}
+    try:
+        hits = await run_in_threadpool(search_models, q, limit)
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=502,
+                            detail=f"Hugging Face search unavailable: {exc}") from exc
+    return {"hits": [h.__dict__ for h in hits]}
+
+
+@router.get("/api/local-models/search/files")
+async def local_models_search_files(repo: str):
+    """The servable GGUFs in one HF repo with a rough pre-download fit
+    verdict per quant (file size + conservative fill-ins — the GGUF
+    header refines it after download)."""
+    from starlette.concurrency import run_in_threadpool
+
+    from hermes_cli.local_runtime.hardware import probe_budget
+    from hermes_cli.local_runtime.hf_browse import priced_repo_files
+
+    try:
+        groups = await run_in_threadpool(
+            priced_repo_files, repo, probe_budget(planning=True))
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(status_code=502,
+                            detail=f"Could not list {repo}: {exc}") from exc
+    return {"files": [dict(g.__dict__, paths=list(g.paths)) for g in groups]}
+
+
+class BrowsedDownloadBody(BaseModel):
+    repo: str
+    paths: list[str]            # one GGUF, or every part of a split, in order
+
+
+@router.post("/api/local-models/download-browsed")
+async def local_models_download_browsed(body: BrowsedDownloadBody):
+    """Download an arbitrary HF GGUF (browsed or pasted) into the managed
+    models dir. From the moment it lands it is a normal staged model: the
+    post-download bounce regenerates presets from its real header and the
+    fit policy owns its launch. No catalog entry — it serves 'unverified',
+    capabilities answered from the live server only."""
+    import re as _re
+
+    from hermes_cli.local_runtime.bootstrap import staged_model_ids
+
+    paths = [p for p in (body.paths or []) if p.lower().endswith(".gguf")]
+    if not paths:
+        raise HTTPException(status_code=422, detail="no .gguf files given")
+    first = paths[0].rsplit("/", 1)[-1]
+    model_id = _re.sub(r"-\d{5}-of-\d{5}\.gguf$", "", first, flags=_re.IGNORECASE)
+    model_id = model_id[:-5] if model_id.lower().endswith(".gguf") else model_id
+    if model_id in staged_model_ids():
+        return {"job_id": None, "already_downloaded": True, "model_id": model_id}
+
+    job = _job("model-download", f"{model_id} (from {body.repo})",
+               model_id=model_id)
+
+    def _run():
+        try:
+            job["phase"] = "downloading"
+            for p in paths:
+                url = (f"https://huggingface.co/{body.repo}"
+                       f"/resolve/main/{urllib.parse.quote(p)}")
+                dest = _models_dir() / p.rsplit("/", 1)[-1]
+                if dest.exists():
+                    continue
+                download_file(url, dest, job,
+                              base_done=int(job.get("done_bytes") or 0),
+                              keep_totals=bool(job.get("total_bytes")))
+                job["phase"] = "downloading"
+            job["phase"] = "done"
+            job["status"] = "done"
+            job["detail"] = f"{model_id} ready"
+            try:
+                from hermes_cli.local_runtime.bootstrap import refresh_local_runtime
+
+                refresh_local_runtime()
+            except Exception:  # noqa: BLE001
+                logger.debug("post-download runtime refresh skipped", exc_info=True)
+        except Exception as exc:  # noqa: BLE001
+            job["status"] = "error"
+            job["error"] = str(exc)
+
+    threading.Thread(target=_run, daemon=True, name="lm-download-browsed").start()
+    return {"job_id": job["job_id"], "model_id": model_id}
+
+
+class SideloadBody(BaseModel):
+    path: str                   # absolute path to a .gguf on this machine
+
+
+@router.post("/api/local-models/sideload")
+async def local_models_sideload(body: SideloadBody):
+    """Register a GGUF that already exists on this machine: link it into
+    the managed models dir (copy only when linking is impossible) and
+    bounce the router so it serves immediately. The original stays where
+    it is; delete-from-Hermes removes only our link."""
+    import os
+    import shutil
+
+    from starlette.concurrency import run_in_threadpool
+
+    src = Path(body.path)
+    if not src.is_file() or src.suffix.lower() != ".gguf":
+        raise HTTPException(status_code=422, detail="Pick a .gguf model file")
+    dest = _models_dir() / src.name
+    if dest.exists():
+        return {"ok": True, "model_id": dest.stem, "already_present": True}
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        os.link(src, dest)          # hardlink: instant, no extra disk
+    except OSError:
+        try:
+            os.symlink(src, dest)   # cross-volume fallback
+        except OSError:
+            await run_in_threadpool(shutil.copyfile, src, dest)
+    try:
+        from hermes_cli.local_runtime.bootstrap import refresh_local_runtime
+
+        refresh_local_runtime()
+    except Exception:  # noqa: BLE001
+        logger.debug("post-sideload runtime refresh skipped", exc_info=True)
+    return {"ok": True, "model_id": dest.stem}
diff --git a/hermes_cli/web_routers/profiles.py b/hermes_cli/web_routers/profiles.py
index 0e08d63142..d037d86d6e 100644
--- a/hermes_cli/web_routers/profiles.py
+++ b/hermes_cli/web_routers/profiles.py
@@ -197,6 +197,11 @@ def _sidebar_singleflight_cache(func):
             if cached is not miss:
                 return cached
             result = func(*args, **kwargs)
+            # A 200 carrying errors[] is a FAILED profile scan, not a
+            # successful empty page. Caching it holds the empty recents in
+            # front of a store that has already recovered, for the whole TTL.
+            if isinstance(result, dict) and result.get("errors"):
+                return result
             try:
                 snapshot = copy.deepcopy(result)
             except Exception:
diff --git a/hermes_cli/web_routers/sessions.py b/hermes_cli/web_routers/sessions.py
index a4da40c3a1..657840ed62 100644
--- a/hermes_cli/web_routers/sessions.py
+++ b/hermes_cli/web_routers/sessions.py
@@ -31,7 +31,7 @@ from hermes_cli.web_models import (
     SessionPrune,
     SessionRename,
 )
-from hermes_state import is_malformed_db_error
+from hermes_state import is_malformed_db_error, is_transient_sqlite_error
 
 # Same logger the handlers used before extraction (identical logger object).
 _log = logging.getLogger("hermes_cli.web_server")
@@ -197,6 +197,22 @@ def get_sessions(
             db.close()
     except HTTPException:
         raise
+    except sqlite3.OperationalError as exc:
+        _log.exception("GET /api/sessions failed")
+        # 503, not 500: the store is busy, not gone. The desktop keeps the
+        # sidebar it already has instead of reading a 500 as an authoritative
+        # empty list. Retrying the OPEN here is deliberately not done — the
+        # bounded retry lives in SessionDB's read-only constructor, so every
+        # read-only opener gets it, not just this route.
+        transient = is_transient_sqlite_error(exc)
+        raise HTTPException(
+            status_code=503 if transient else 500,
+            detail=(
+                "Session store is busy (disk I/O or lock). Retry; the list was not cleared."
+                if transient
+                else "Internal server error"
+            ),
+        ) from exc
     except Exception:
         _log.exception("GET /api/sessions failed")
         raise HTTPException(status_code=500, detail="Internal server error")
diff --git a/hermes_cli/web_server.py b/hermes_cli/web_server.py
index d5ad2e9ab6..b6a93a65dd 100644
--- a/hermes_cli/web_server.py
+++ b/hermes_cli/web_server.py
@@ -303,6 +303,17 @@ def _start_desktop_cron_ticker(stop_event: "threading.Event", interval: int = 60
             profile_homes = list(profiles_to_serve(multiplex=True))
             if len(profile_homes) > 1:
                 start_kwargs["profile_homes"] = profile_homes
+                # Stand down, per tick, for any profile whose OWN gateway is
+                # running: that gateway ticks it with live adapters, and the
+                # tick-lock race otherwise lets this adapter-less ticker win
+                # and deliver the job through the standalone path (#100489).
+                # Evaluated every cycle so a gateway starting/stopping later
+                # is picked up without a dashboard restart.
+                from hermes_cli.profiles import _check_gateway_running
+
+                start_kwargs["profile_gate"] = (
+                    lambda _name, home: not _check_gateway_running(Path(home))
+                )
                 from hermes_logging import enable_profile_log_routing
 
                 enable_profile_log_routing(profile_homes)
@@ -320,6 +331,11 @@ def _start_desktop_cron_ticker(stop_event: "threading.Event", interval: int = 60
     provider.start(stop_event, **start_kwargs)
 
 
+# Desktop `serve` only (start_server(start_mcp_discovery_after_bind=True)):
+# seconds after the READY sentinel before the MCP discovery thread starts.
+_DESKTOP_MCP_DISCOVERY_DELAY_S = 1.0
+
+
 def _warm_gateway_module() -> None:
     """Pre-import heavy modules so the event loop is not stalled on first use.
 
@@ -511,6 +527,28 @@ async def _lifespan(app: "FastAPI"):
     # sweeping stale sessions on schedule, independent of list requests.
     auto_archive_task = asyncio.create_task(_auto_archive_ticker_loop())
 
+    # Managed local runtime: when the user opted in (local_runtime.enabled,
+    # set by the Local Models 'Use' action), bring the llama-server back up
+    # so a restart doesn't strand a llamacpp main model without a backend.
+    # Off-thread and best-effort: binary check + spawn + health poll must
+    # not delay the server socket, and failure falls back to configured
+    # cloud providers exactly like a cold start.
+    def _boot_local_runtime():
+        try:
+            from hermes_cli.config import load_config
+            from hermes_cli.local_runtime.bootstrap import ensure_local_runtime
+
+            # Server only — models load on first inference, always (residency
+            # design: downloaded = available; demand loads; idleness
+            # evicts). An empty router holds no VRAM; warming a model at
+            # boot would reload gigabytes nobody asked for yet.
+            ensure_local_runtime(load_config())
+        except Exception as exc:  # noqa: BLE001
+            logging.getLogger(__name__).warning("local runtime boot failed: %s", exc)
+
+    threading.Thread(target=_boot_local_runtime, daemon=True,
+                     name="local-runtime-boot").start()
+
     try:
         yield
     finally:
@@ -523,6 +561,14 @@ async def _lifespan(app: "FastAPI"):
         selftest_task.cancel()
         auto_archive_task.cancel()
         await PTY_REGISTRY.close_all()
+        # Stop the managed llama-server with its parent — a supervisor-less
+        # orphan would keep VRAM pinned after the app closes.
+        try:
+            from hermes_cli.local_runtime.bootstrap import shutdown_local_runtime
+
+            shutdown_local_runtime()
+        except Exception:  # noqa: BLE001
+            pass
         if os.getenv("HERMES_DESKTOP") == "1":
             _terminate_desktop_managed_gateway()
 
@@ -1399,8 +1445,8 @@ _SCHEMA_OVERRIDES: Dict[str, Dict[str, Any]] = {
     },
     "agent.service_tier": {
         "type": "select",
-        "description": "API service tier (OpenAI/Anthropic)",
-        "options": ["", "auto", "default", "flex"],
+        "description": "Fast mode: fast = always, auto = first N seconds of each turn, cold = first turn only",
+        "options": ["", "normal", "fast", "auto", "cold"],
     },
     "delegation.reasoning_effort": {
         "type": "select",
@@ -1806,6 +1852,7 @@ from hermes_cli.web_models import (  # noqa: F401
     LearningNodeEdit,
     DebugShareRequest,
     TTSSpeakRequest,
+    TTSLeaseRequest,
     OAuthSubmitBody,
     BulkDeleteSessions,
     SessionImport,
@@ -3289,6 +3336,10 @@ def _git_path(path: str) -> str:
 from hermes_cli.web_routers import git as _git_routes  # noqa: E402
 
 app.include_router(_git_routes.router)
+
+from hermes_cli.web_routers import local_models as _local_models_routes  # noqa: E402
+
+app.include_router(_local_models_routes.router)
 from hermes_cli.web_routers.git import (  # noqa: E402,F401 — legacy re-exports; tests call these via web_server.<name>
     git_status_route,
     git_worktrees_route,
@@ -3363,6 +3414,7 @@ _PORT_BINDING_PLATFORM_PORTS: Dict[str, Tuple[str, int]] = {
     "sms": ("webhook_port", 8080),
     "whatsapp_cloud": ("webhook_port", 8090),
     "line": ("port", 8646),
+    "teams": ("port", 3978),
 }
 
 # Platform states that mean the adapter is NOT serving its port right now.
@@ -5631,6 +5683,43 @@ async def speak_text(payload: TTSSpeakRequest, profile: Optional[str] = None):
     }
 
 
+@app.post("/api/audio/tts-lease")
+async def tts_lease(payload: TTSLeaseRequest, profile: Optional[str] = None):
+    """Desktop TTS-output toggles as warm-up / release signals.
+
+    "Read replies aloud" and voice-conversation mode are explicit "speech is
+    about to be needed" gestures. ``active: true`` registers the toggle as a
+    lease on the TTS engine and pre-loads the configured provider (local
+    piper/kittentts model, lazily-installed SDK) so the first spoken reply
+    doesn't pay the load as dead air; ``active: false`` drops the lease and,
+    once no surface holds one, unloads resident local models.
+
+    Blocking work (model load, voice download) runs off the event loop.
+    Warm-up failures are reported in the body, never as an HTTP error — the
+    toggle must succeed even when the engine can't preload.
+    """
+    lease = (payload.lease or "").strip()
+    if not lease:
+        raise HTTPException(status_code=400, detail="lease is required")
+
+    def _apply():
+        from tools.tts_tool import acquire_tts_lease, release_tts_lease
+
+        if payload.active:
+            with _config_profile_scope(profile):
+                return acquire_tts_lease(lease)
+        return release_tts_lease(lease)
+
+    try:
+        result = await asyncio.get_running_loop().run_in_executor(None, _apply)
+    except HTTPException:
+        raise
+    except Exception as exc:
+        _log.warning("TTS lease %s (%s) failed: %s", lease, payload.active, exc)
+        result = {"leases": None, "action": "error", "error": str(exc)}
+    return {"ok": True, "lease": lease, "active": payload.active, **result}
+
+
 def _split_text_for_speak_stream(text: str, cap: int) -> list:
     """Split *text* into provider-cap-sized pieces on sentence boundaries.
 
@@ -7501,7 +7590,11 @@ async def get_model_options(
             # Keep the profile override inside the worker thread so the full
             # sync picker build (config load, pricing, refresh probes) runs
             # off the event loop under the requested profile.
-            with _profile_scope(profile):
+            # Use _config_profile_scope (contextvar only, no skill-module
+            # lock) — the payload build can block for 15s on a models.dev
+            # cache miss, and _profile_scope's RLock held across that block
+            # starves concurrent /api/config and freezes the server (#58576).
+            with _config_profile_scope(profile):
                 return build_model_options_payload(
                     load_picker_context(),
                     explicit_only=bool(explicit_only),
@@ -7539,8 +7632,10 @@ def get_recommended_default_model(provider: str = ""):
                 get_curated_nous_model_ids,
                 get_pricing_for_provider,
                 check_nous_free_tier,
+                nous_policy_allowed_ids,
                 partition_nous_models_by_tier,
                 pick_silent_default_model,
+                restrict_to_nous_policy,
                 union_with_portal_free_recommendations,
                 union_with_portal_paid_recommendations,
             )
@@ -7557,10 +7652,19 @@ def get_recommended_default_model(provider: str = ""):
             except Exception:
                 portal_url = ""
 
+            # This endpoint picks the model a user lands on without choosing it,
+            # so an unreachable one here is worse than in a picker. Narrow before
+            # the tier split, so a rescued id still has to pass the free/paid
+            # predicate.
+            _policy_allowed = nous_policy_allowed_ids()
+
             if free_tier:
                 model_ids, pricing = union_with_portal_free_recommendations(
                     model_ids, pricing, portal_url
                 )
+                model_ids = restrict_to_nous_policy(
+                    model_ids, _policy_allowed, rescue_empty=True,
+                )
                 model_ids, _unavailable = partition_nous_models_by_tier(
                     model_ids, pricing, free_tier=True
                 )
@@ -7568,6 +7672,9 @@ def get_recommended_default_model(provider: str = ""):
                 model_ids, pricing = union_with_portal_paid_recommendations(
                     model_ids, pricing, portal_url
                 )
+                model_ids = restrict_to_nous_policy(
+                    model_ids, _policy_allowed, rescue_empty=True,
+                )
 
             model = pick_silent_default_model(model_ids, provider="nous")
             return {"provider": "nous", "model": model, "free_tier": bool(free_tier)}
@@ -11023,20 +11130,63 @@ def _claude_code_only_status() -> Dict[str, Any]:
 def _copilot_acp_status() -> Dict[str, Any]:
     """Status for copilot-acp — credentials are owned by the Copilot CLI.
 
-    There is no cheap programmatic credential probe for the ACP subprocess, so
-    this is a read-only "managed by the Copilot CLI" card (like claude-code):
-    Hermes never claims a login state it can't verify.
+    ``logged_in`` is claimed only on positive evidence (a supported env token
+    or a known on-disk GitHub Copilot credential store, via
+    ``auth.get_external_process_provider_status``). The Copilot CLI may also
+    hold its session in an OS keychain Hermes can't read, so the unverified
+    state is presented as "managed by the Copilot CLI" — never as signed out.
     """
+    try:
+        from hermes_cli.auth import get_external_process_provider_status
+        status = get_external_process_provider_status("copilot-acp") or {}
+    except Exception:
+        status = {}
+    verified = bool(status.get("auth_verified"))
+    configured = bool(status.get("configured"))
+    if verified:
+        source_label = status.get("auth_source") or "Copilot credentials detected"
+    elif configured:
+        found = status.get("resolved_command") or status.get("command") or "copilot"
+        source_label = f"Managed by the GitHub Copilot CLI ({found})"
+    else:
+        source_label = "GitHub Copilot CLI not found on PATH"
     return {
-        "logged_in": False,
+        "logged_in": verified,
         "source": "copilot_cli",
-        "source_label": "Managed by the GitHub Copilot CLI",
+        "source_label": source_label,
         "token_preview": None,
         "expires_at": None,
         "has_refresh_token": False,
+        "configured": configured,
     }
 
 
+def _external_process_cli_command(provider_id: str, default: str) -> str:
+    """Render an external-process provider's sign-in command with the CLI the
+    user actually has configured.
+
+    The static catalog assumes the default executable name; users who point
+    Hermes at a custom binary (``HERMES_COPILOT_ACP_COMMAND`` /
+    ``COPILOT_CLI_PATH``) would otherwise be told to run a command that isn't
+    the one Hermes spawns. Non-external-process providers get ``default`` back
+    untouched.
+    """
+    try:
+        from hermes_cli.auth import PROVIDER_REGISTRY, get_external_process_provider_status
+        pconfig = PROVIDER_REGISTRY.get(provider_id)
+        if not pconfig or pconfig.auth_type != "external_process":
+            return default
+        status = get_external_process_provider_status(provider_id) or {}
+        command = str(status.get("command") or "").strip()
+        if command:
+            parts = default.split(" ", 1)
+            tail = f" {parts[1]}" if len(parts) > 1 else ""
+            return f"{command}{tail}"
+    except Exception:
+        pass
+    return default
+
+
 # Explicit, hand-tuned OAuth/account provider cards. These carry the bits that
 # can't be derived from the unified provider catalog: the OAuth ``flow`` shape,
 # the per-provider ``status_fn``, the ``cli_command`` fallback, and curated
@@ -11102,7 +11252,11 @@ _OAUTH_PROVIDER_CATALOG: tuple[Dict[str, Any], ...] = (
         "id": "copilot-acp",
         "name": "GitHub Copilot (ACP)",
         "flow": "external",
-        "cli_command": "copilot /login",
+        # `copilot login` is the CLI's non-interactive device-code login
+        # subcommand; the previous `copilot /login` form is not a valid
+        # invocation (slash-commands only exist inside an interactive
+        # session, reachable as `copilot -i /login`).
+        "cli_command": "copilot login",
         "docs_url": "https://docs.github.com/en/copilot",
         "status_fn": _copilot_acp_status,
     },
@@ -11361,7 +11515,7 @@ async def list_oauth_providers(profile: Optional[str] = None):
                     "id": p["id"],
                     "name": p["name"],
                     "flow": p["flow"],
-                    "cli_command": p["cli_command"],
+                    "cli_command": _external_process_cli_command(p["id"], p["cli_command"]),
                     "docs_url": p["docs_url"],
                     "disconnect_hint": disconnect_hint,
                     "disconnect_command": _oauth_provider_disconnect_command(p),
@@ -12870,6 +13024,13 @@ def _normalize_dashboard_cron_updates(
         )
     if "deliver" in normalized:
         normalized["deliver"] = _cron_optional_text(normalized["deliver"]) or "local"
+    if "failure_deliver" in normalized:
+        # Same text normalization as deliver, but empty CLEARS the override
+        # (failures fall back to deliver) rather than coalescing to a target
+        # — the field is optional by design (NS-788).
+        normalized["failure_deliver"] = _cron_optional_text(
+            normalized["failure_deliver"]
+        )
     if "context_from" in normalized:
         normalized["context_from"] = _cron_string_list(normalized["context_from"])
     if "enabled_toolsets" in normalized:
@@ -13424,35 +13585,62 @@ def _gateway_fire_endpoint(profile: str, home: Path) -> str:
     """Resolve the loopback URL of the gateway api_server's cron-fire route.
 
     Port resolution mirrors gateway/config.py's api_server load order for the
-    TARGET profile: ``platforms.api_server.extra.port`` in the profile's
-    config.yaml, then ``API_SERVER_PORT`` (process env for the active profile,
-    the profile's own .env otherwise), then the adapter default 8642. The bind
-    host is the adapter's loopback default — the dashboard and gateway share a
-    network namespace in every supported deployment (same host process tree,
-    or the same container under s6).
+    LISTENER-OWNER profile: ``platforms.api_server.extra.port`` in that
+    profile's config.yaml, then ``API_SERVER_PORT`` (process env for the
+    active profile, the profile's own .env otherwise), then the adapter
+    default 8642. The bind host is the adapter's loopback default — the
+    dashboard and gateway share a network namespace in every supported
+    deployment (same host process tree, or the same container under s6).
 
     Multiplex mode (one gateway serving several profiles) exposes per-profile
     mirrors under ``/p/<profile>/…``, so a non-default profile routes through
-    the default gateway's port with that prefix; per-profile-gateway mode
-    (each profile its own process/port) uses the bare path on the profile's
-    own port.
+    the default gateway's port with that prefix — only the DEFAULT profile's
+    api_server is bound in that mode, so the port must be read from the
+    default home, never the target profile's (a secondary's own
+    ``API_SERVER_PORT`` is a port nothing listens on). Per-profile-gateway
+    mode (each profile its own process/port) uses the bare path on the
+    profile's own port.
     """
     import os as _os
 
+    multiplex = False
+    try:
+        from gateway.config import _env_multiplex_profiles_override
+
+        cfg = load_config()
+        multiplex = bool(cfg_get(cfg, "gateway", "multiplex_profiles", default=False))
+        env_flag = _env_multiplex_profiles_override()
+        if env_flag is not None:
+            multiplex = env_flag
+    except Exception:
+        _log.debug("cron fire: multiplex detection failed; assuming single-profile", exc_info=True)
+
+    listener_profile, listener_home = profile, home
+    if multiplex and profile != "default":
+        from hermes_constants import get_default_hermes_root
+
+        listener_profile, listener_home = "default", get_default_hermes_root()
+        _log.info(
+            "cron fire: multiplex gateway — resolving api_server port for %s "
+            "from the default profile's listener (%s)",
+            profile,
+            listener_home,
+        )
+
     port = 0
     try:
         # Profile-scoped read through the CANONICAL loader (managed-scope
         # overlay, ${ENV_VAR} expansion, profile pathing) — never a raw
         # yaml.safe_load of config.yaml (tests/hermes_cli/
         # test_config_read_guard.py). The HERMES_HOME override scopes
-        # get_config_path() to the TARGET profile, same pattern the
+        # get_config_path() to the LISTENER-OWNER profile, same pattern the
         # deprecated _fire_cron_job_for_profile used for its store scope.
         from hermes_constants import (
             reset_hermes_home_override,
             set_hermes_home_override,
         )
 
-        token = set_hermes_home_override(str(home))
+        token = set_hermes_home_override(str(listener_home))
         try:
             profile_cfg = load_config()
         finally:
@@ -13467,8 +13655,8 @@ def _gateway_fire_endpoint(profile: str, home: Path) -> str:
     if not port:
         raw = (
             _os.getenv("API_SERVER_PORT", "")
-            if profile == _cron_default_profile()
-            else _profile_env_value(home, "API_SERVER_PORT")
+            if listener_profile == _cron_default_profile()
+            else _profile_env_value(listener_home, "API_SERVER_PORT")
         )
         try:
             port = int(raw) if raw else 0
@@ -13477,18 +13665,6 @@ def _gateway_fire_endpoint(profile: str, home: Path) -> str:
     if not port:
         port = 8642
 
-    multiplex = False
-    try:
-        cfg = load_config()
-        multiplex = bool(cfg_get(cfg, "gateway", "multiplex_profiles", default=False))
-        env_flag = _os.getenv("GATEWAY_MULTIPLEX_PROFILES", "").strip().lower()
-        if env_flag in {"1", "true", "yes", "on"}:
-            multiplex = True
-        elif env_flag in {"0", "false", "no", "off"}:
-            multiplex = False
-    except Exception:
-        pass
-
     if multiplex and profile != "default":
         return f"http://127.0.0.1:{port}/p/{profile}/api/cron/fire"
     return f"http://127.0.0.1:{port}/api/cron/fire"
@@ -15021,7 +15197,13 @@ def _fallback_profile_dicts(profiles_mod) -> List[Dict[str, Any]]:
                 "provider": provider,
                 "has_env": _safe(lambda entry=entry_path: (entry / ".env").exists(), False),
                 "skill_count": _safe(lambda entry=entry_path: profiles_mod._count_skills(entry), 0),
-                "gateway_running": _safe(lambda entry=entry_path: profiles_mod._check_gateway_running(entry), False),
+                "gateway_running": _safe(
+                    lambda entry=entry_path, name=entry.name: (
+                        profiles_mod._check_gateway_running(entry)
+                        or profiles_mod._served_by_running_multiplexer(name)
+                    ),
+                    False,
+                ),
                 "description": _safe(lambda entry=entry_path: profiles_mod.read_profile_meta(entry).get("description", ""), ""),
                 "description_auto": _safe(lambda entry=entry_path: profiles_mod.read_profile_meta(entry).get("description_auto", False), False),
                 "distribution_name": None,
@@ -19578,6 +19760,7 @@ def start_server(
     headless: bool = False,
     ssh_session_token: Optional[str] = None,
     ssh_owner_nonce: Optional[str] = None,
+    start_mcp_discovery_after_bind: bool = False,
 ):
     """Start the web UI server.
 
@@ -19592,6 +19775,10 @@ def start_server(
 
     ``ssh_session_token`` and ``ssh_owner_nonce`` are process-local Desktop SSH
     bootstrap state. Neither is persisted or exported to child processes.
+
+    ``start_mcp_discovery_after_bind`` (Desktop ``serve``) defers the
+    background MCP discovery thread until the ready sentinel has been written,
+    so its SDK import cannot hold the GIL against the pre-bind import path.
     """
     _apply_ssh_session_token(ssh_session_token or "")
     _apply_ssh_owner_nonce(ssh_owner_nonce)
@@ -19969,6 +20156,27 @@ def start_server(
                 print(f"  Hermes Web UI → http://{host}:{actual_port}")
             _maybe_open_browser(host, actual_port, open_browser, initial_profile)
 
+            if start_mcp_discovery_after_bind:
+                # Deferred from cmd_dashboard for Desktop `serve` (see there).
+                # Not started at the bind itself either: the ~350ms `mcp` SDK
+                # import holds the GIL, and at bind time the renderer is doing
+                # its WebSocket handshake + first hydration reads against this
+                # loop (measured: starting it here gave back most of the
+                # READY gain as a slower connect). One second later the shell
+                # is painted and idle. An agent build inside that second fires
+                # the deferred start itself (wait_for_mcp_discovery), so its
+                # bounded join and the late-binding refresh are unchanged.
+                try:
+                    from hermes_cli.mcp_startup import defer_background_mcp_discovery
+
+                    defer_background_mcp_discovery(
+                        logger=_log,
+                        thread_name="dashboard-mcp-discovery",
+                        delay=_DESKTOP_MCP_DISCOVERY_DELAY_S,
+                    )
+                except Exception:
+                    _log.debug("Deferred MCP discovery arm failed", exc_info=True)
+
             # Collapse the peer-hangup teardown flood (#50005). When the Desktop
             # forcibly closes its WebSocket mid-write, asyncio logs a full
             # traceback per pending connection-lost callback — 50+ identical
diff --git a/hermes_state.py b/hermes_state.py
index b9794c7c79..f9696fc6fd 100644
--- a/hermes_state.py
+++ b/hermes_state.py
@@ -96,6 +96,11 @@ from hermes_state_common import (  # noqa: F401  (re-exported for back-compat)
     _PREVIEW_MAX_CHARS,
     _PREVIEW_SCAFFOLD_WINDOW,
     _PREVIEW_SCAFFOLDED_SQL,
+    _acquire_db_flock,
+    _clear_lock_holder_record,
+    _describe_lock_holder,
+    _read_lock_holder_record,
+    is_advisory_lock_contention,
 )
 from hermes_state_portability import SessionPortabilityMixin
 from hermes_state_schema import SessionSchemaMixin
@@ -111,6 +116,13 @@ logger = logging.getLogger(__name__)
 MAX_SAFE_RESUME_MESSAGES = 20_000
 MAX_SAFE_EXPORT_MESSAGES = 20_000
 
+# Auto-maintenance only VACUUMs when at least this fraction of the database
+# file is reclaimable (``PRAGMA freelist_count / PRAGMA page_count``). Below
+# it a full rewrite costs more I/O than it returns — pruning a handful of small
+# sessions on a dense multi-GB state.db should never rewrite the whole file to
+# reclaim a few MB (#54189). Composes with ``min_vacuum_interval_days``.
+AUTO_VACUUM_MIN_FREELIST_RATIO = 0.25
+
 
 def _configured_transcript_limit(key: str, fallback: int) -> int:
     """Resolve a transcript safety limit from config at call time.
@@ -370,6 +382,20 @@ DEFAULT_DB_PATH = get_hermes_home() / "state.db"
 # query; short enough that transient fd pressure doesn't strand the read pool.
 _READ_OPEN_RETRY_SECONDS = 60.0
 
+# Transient SQLITE_IOERR retry budget for READ-ONLY opens (#100436). A WAL
+# database being actively written (checkpoint, WAL reset/truncate, frame
+# flush) can surface "disk I/O error" to a concurrent ``mode=ro`` reader in
+# a millisecond-wide transition window: the read-only connection cannot
+# perform the WAL recovery a read through a stale or mid-update -shm file
+# needs, because recovery requires writing the -shm index, which mode=ro
+# refuses. The window closes on its own (the writer finishes the transition),
+# so a bounded number of short retries makes the open succeed instead of
+# 500-ing the whole /api/sessions poll (or any other read-only opener).
+# Deliberately NOT attempted on writable opens: a writer owns the
+# transition, so an IOERR there means a real storage/fd problem.
+_READ_ONLY_IOERR_RETRY_ATTEMPTS = 3
+_READ_ONLY_IOERR_RETRY_BACKOFF_S = 0.05
+
 # Hard ceiling on read-only connections ALIVE at once against one database
 # FILE — pooled idle ones and checked-out ones together, summed over every
 # SessionDB in this process that points at that file. See _PathReadBudget.
@@ -1115,6 +1141,17 @@ def _strip_stale_tool_call_markers(
     return messages
 
 
+def _normalize_telegram_topic_profile_name(profile_name: Optional[str] = None) -> str:
+    """Normalize profile namespace for Telegram topic-mode tables.
+
+    Empty / missing values map to ``\"default\"`` so non-multiplexed gateways
+    keep a single namespace. Multiplexed callers must pass the *routed*
+    profile (``source.profile``), never the process-global active profile.
+    """
+    name = str(profile_name or "").strip()
+    return name if name else "default"
+
+
 def format_session_db_unavailable(prefix: str = "Session database not available") -> str:
     """Format a user-facing 'session DB unavailable' message with cause.
 
@@ -1758,13 +1795,14 @@ def _log_wal_reset_bug_once(
     # for git/pip/system Python installs (#75153).
     repair_hint = _wal_reset_repair_hint()
     logger.warning(
-        "%s: linked SQLite %s is vulnerable to the WAL-reset corruption "
-        "bug (https://sqlite.org/wal.html#walresetbug) — %s. "
+        "%s: linked SQLite %s (interpreter %s) is vulnerable to the WAL-reset "
+        "corruption bug (https://sqlite.org/wal.html#walresetbug) — %s. "
         "Upgrade to SQLite 3.51.3+ (or backports 3.50.7 / 3.44.6); "
         "%s. See `hermes doctor`. This warning fires once per "
         "process per database.",
         db_label,
         sqlite3.sqlite_version,
+        sys.executable,
         action,
         repair_hint,
     )
@@ -2078,6 +2116,52 @@ def is_malformed_db_error(exc: BaseException) -> bool:
     return any(marker in str(exc).lower() for marker in _MALFORMED_DB_MARKERS)
 
 
+# SQLITE_IOERR, matched as a plain substring so wrapped error strings still
+# classify. Shared by the read-only open retry and the write-path BEGIN retry.
+_DISK_IO_ERROR_MARKER = "disk i/o error"
+
+# Broader set for HTTP classification: a read that failed for one of these
+# reasons found the store BUSY, not gone. Callers map it to 503 (retry, the
+# list was not cleared) instead of 500. Corruption is deliberately absent —
+# a malformed store must surface, not be retried into a timeout.
+_TRANSIENT_SQLITE_MARKERS = (
+    _DISK_IO_ERROR_MARKER,
+    "database is locked",
+    "database table is locked",
+    "busy",
+)
+
+
+def is_transient_sqlite_error(exc: BaseException) -> bool:
+    """True when a SQLite failure means "busy right now", not "damaged".
+
+    One predicate so the read paths cannot drift apart on what counts as
+    recoverable: the read-only open retry, and the HTTP 503-vs-500 split on
+    the session-list endpoints, classify the same way.
+    """
+    if not isinstance(exc, sqlite3.OperationalError):
+        return False
+    message = str(exc).lower()
+    return any(marker in message for marker in _TRANSIENT_SQLITE_MARKERS)
+
+
+def _is_transient_read_only_ioerr(exc: sqlite3.OperationalError, *, attempt: int) -> bool:
+    """True when a read-only open should be retried rather than raised.
+
+    A ``mode=ro`` connection cannot perform WAL recovery (recovery needs to
+    write the -shm index, which read-only mode refuses), so a concurrent WAL
+    checkpoint / reset / frame-flush can surface ``SQLITE_IOERR`` ("disk I/O
+    error") to a reader on an otherwise healthy database (#100436). The
+    transition is millisecond-scale, so a bounded number of short retries
+    clears it without changing classification for genuine storage failures —
+    a persistent IOERR still exhausts the budget and propagates.
+    """
+    return (
+        attempt < _READ_ONLY_IOERR_RETRY_ATTEMPTS
+        and _DISK_IO_ERROR_MARKER in str(exc).lower()
+    )
+
+
 def is_malformed_schema_error(exc: BaseException) -> bool:
     """True only when SQLite explicitly reports malformed schema text.
 
@@ -2198,7 +2282,10 @@ def classify_persistence_error(exc_or_str) -> str:
     if isinstance(exc_or_str, CompressionSessionBusyError):
         return "compression"
     if isinstance(exc_or_str, StateDbReplacedError):
+        # Includes DeletedWalGenerationError (subclass).
         return "replaced"
+    if isinstance(exc_or_str, StateDbCorruptError):
+        return "corrupt"
     text = str(exc_or_str).lower()
     if "turn lease" in text:
         return "turn_lease"
@@ -2208,6 +2295,8 @@ def classify_persistence_error(exc_or_str) -> str:
         return "compression"
     if "was replaced underneath" in text:
         return "replaced"
+    if "deleted state.db-wal" in text or "deleted state.db-shm" in text:
+        return "replaced"
     # Structural corruption BEFORE the lock and disk buckets: "database disk
     # image is malformed" contains "disk" (and some wrapped corruption
     # strings mention "locked" recovery attempts), so later buckets would
@@ -2272,14 +2361,19 @@ def _cross_process_repair_lock(db_path: Path):
     """Serialize state.db schema surgery across processes.
 
     Yields True when this process holds the repair lock for *db_path*, False
-    when the bounded acquire timed out.  Unlike the kanban init lock — whose
-    critical section is idempotent, so proceeding without the lock is merely
-    redundant work — proceeding here would be exactly the unsafe interleaving
-    we are trying to prevent, so a caller that gets False must NOT do surgery.
+    when the bounded acquire timed out or the lock file could not be opened at
+    all.  Unlike the kanban init lock — whose critical section is idempotent,
+    so proceeding without the lock is merely redundant work — proceeding here
+    would be exactly the unsafe interleaving we are trying to prevent, so a
+    caller that gets False must NOT do surgery.
 
     ``flock`` is the right primitive for this: the kernel drops the lock when
     the holding process dies, so a crashed repairer cannot leave a stale lock
-    that wedges every future repair (a pidfile would).  The acquire is still
+    that wedges every future repair (a pidfile would).  One exception exists
+    (issue #100108): a forked child that inherited the lock fd keeps the
+    flock alive after the acquirer dies, so the acquire path records the
+    holder's pid + start time and breaks the lock when that holder is
+    provably dead (see ``_acquire_db_flock``).  The acquire is still
     bounded because a *live* repairer can legitimately sit in ``VACUUM`` for
     minutes on a large DB, and an unbounded wait would hang the caller's open
     with no traceback (the failure shape of #36644).
@@ -2289,42 +2383,67 @@ def _cross_process_repair_lock(db_path: Path):
         lock_path.parent.mkdir(parents=True, exist_ok=True)
         handle = lock_path.open("a+b")
     except OSError as exc:
-        # Read-only dir, exhausted fds, exotic filesystem: fall back to the
-        # in-process behaviour that shipped before this lock existed rather
-        # than refusing to repair a DB we could otherwise heal.
+        # Fail closed, exactly as a timed-out acquire does.  A lock file we
+        # cannot even open means the filesystem is out of space, inodes or
+        # descriptors — and a sibling that opened ITS handle before the disk
+        # filled is still inside writable_schema surgery or VACUUM.  Yielding
+        # True here let two processes run schema surgery on the same live
+        # state.db concurrently, which is itself the corruption source this
+        # lock exists to remove (#100368: the disk-full trigger, then a fresh
+        # corruption on every boot with other writers alive).  Callers already
+        # handle False by re-probing and reporting, and on a read-only
+        # directory no repair strategy could have written anyway.
         logger.warning(
-            "Could not open state.db repair lock %s (%s) — proceeding with "
-            "in-process serialisation only.", lock_path, exc,
+            "Could not open state.db repair lock %s (%s) — skipping schema "
+            "surgery rather than running it without cross-process authority.",
+            lock_path, exc,
         )
-        yield True
+        yield False
         return
 
     acquired = False
     try:
-        deadline = time.monotonic() + _REPAIR_LOCK_TIMEOUT_SECONDS
-        while True:
-            try:
-                if _IS_WINDOWS:
+        if _IS_WINDOWS:
+            deadline = time.monotonic() + _REPAIR_LOCK_TIMEOUT_SECONDS
+            while True:
+                try:
                     import msvcrt
 
                     handle.seek(0)
                     msvcrt.locking(handle.fileno(), msvcrt.LK_NBLCK, 1)
-                else:
-                    import fcntl
-
-                    fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-                acquired = True
-                break
-            except (BlockingIOError, OSError):
-                if time.monotonic() >= deadline:
+                    acquired = True
                     break
-                time.sleep(_REPAIR_LOCK_POLL_SECONDS)
-        if not acquired:
+                except (BlockingIOError, OSError) as exc:
+                    if not is_advisory_lock_contention(exc):
+                        logger.warning(
+                            "Could not acquire state.db repair lock %s (%s) — "
+                            "skipping schema surgery on a non-contention error.",
+                            lock_path, exc,
+                        )
+                        acquired = None
+                        break
+                    if time.monotonic() >= deadline:
+                        break
+                    time.sleep(_REPAIR_LOCK_POLL_SECONDS)
+        else:
+            acquired, handle = _acquire_db_flock(
+                str(lock_path),
+                handle,
+                _REPAIR_LOCK_TIMEOUT_SECONDS,
+                _REPAIR_LOCK_POLL_SECONDS,
+                "state.db repair lock",
+            )
+        if acquired is None:
+            # Non-contention failure already logged with its errno.
+            acquired = False
+        elif not acquired:
+            record = None if _IS_WINDOWS else _read_lock_holder_record(handle)
             logger.warning(
                 "state.db repair lock %s held by another process for more "
                 "than %.0fs — skipping schema surgery in this process to "
-                "avoid racing the repairer.",
+                "avoid racing the repairer. Recorded holder: %s.",
                 lock_path, _REPAIR_LOCK_TIMEOUT_SECONDS,
+                _describe_lock_holder(record),
             )
         yield acquired
     finally:
@@ -2338,6 +2457,7 @@ def _cross_process_repair_lock(db_path: Path):
                 else:
                     import fcntl
 
+                    _clear_lock_holder_record(handle)
                     fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
         except OSError:  # pragma: no cover - best effort release
             pass
@@ -2345,6 +2465,65 @@ def _cross_process_repair_lock(db_path: Path):
             handle.close()
 
 
+def _try_acquire_auto_maintenance_lock(db_path: Path) -> Optional[Any]:
+    """Non-blocking cross-process lock for one auto-maintenance pass.
+
+    The kernel releases this advisory lock if the holder exits, unlike a
+    durable pid/meta marker. A caller that cannot acquire it must skip the
+    pass: otherwise two startups can both pass the interval check and the
+    second can prune a row the first has only just closed recoverably.
+    """
+    lock_path = db_path.with_name(db_path.name + ".auto-maintenance.lock")
+    try:
+        lock_path.parent.mkdir(parents=True, exist_ok=True)
+        handle = lock_path.open("a+b")
+    except OSError as exc:
+        logger.warning(
+            "Could not open state.db auto-maintenance lock %s (%s) — skipping "
+            "automatic maintenance.",
+            lock_path,
+            exc,
+        )
+        return None
+
+    try:
+        if _IS_WINDOWS:
+            import msvcrt
+
+            handle.seek(0)
+            msvcrt.locking(  # type: ignore[attr-defined]
+                handle.fileno(), msvcrt.LK_NBLCK, 1  # type: ignore[attr-defined]
+            )
+        else:
+            import fcntl
+
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except (BlockingIOError, OSError):
+        handle.close()
+        return None
+    return handle
+
+
+def _release_auto_maintenance_lock(handle: Any) -> None:
+    """Release a handle returned by :func:`_try_acquire_auto_maintenance_lock`."""
+    try:
+        if _IS_WINDOWS:
+            import msvcrt
+
+            handle.seek(0)
+            msvcrt.locking(  # type: ignore[attr-defined]
+                handle.fileno(), msvcrt.LK_UNLCK, 1  # type: ignore[attr-defined]
+            )
+        else:
+            import fcntl
+
+            fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+    except OSError:  # pragma: no cover - best effort release
+        pass
+    finally:
+        handle.close()
+
+
 def _bump_schema_cookie(conn: sqlite3.Connection) -> None:
     """Increment the schema cookie after direct ``sqlite_master`` surgery.
 
@@ -3539,16 +3718,19 @@ def repair_state_db_schema(db_path: Path, *, backup: bool = True) -> Dict[str, A
     result = report
     with _cross_process_repair_lock(db_path) as holding_lock:
         if not holding_lock:
-            # Another process is still inside its critical section. It may
-            # nonetheless have healed the file already (long VACUUM after a
-            # successful strategy), so re-probe before reporting failure.
+            # Another process is still inside its critical section, or the
+            # lock file itself could not be opened (full disk / no fds). It
+            # may nonetheless have healed the file already (long VACUUM after
+            # a successful strategy), so re-probe before reporting failure.
             if _db_opens_cleanly(db_path) is None:
                 report["repaired"] = True
                 report["strategy"] = "repaired_by_other_process"
             else:
                 report["error"] = (
-                    "another process holds the state.db repair lock; skipped "
-                    "schema surgery to avoid racing it"
+                    "could not obtain the state.db repair lock (held by "
+                    "another process, or the lock file was unopenable); "
+                    "skipped schema surgery to avoid racing a concurrent "
+                    "repairer"
                 )
         else:
             # The fast check above avoids taking the lock for a known-exhausted
@@ -4190,6 +4372,23 @@ class StateDbReplacedError(RuntimeError):
     """
 
 
+class DeletedWalGenerationError(StateDbReplacedError):
+    """A live process holds a deleted state.db-wal / -shm generation.
+
+    Opening or writing through this handle would mint a second WAL inode
+    (or keep committing on the orphan) — the split-brain that produces
+    intermittent SQLITE_CORRUPT / SQLITE_IOERR. Stop the writers; do not
+    unlink the WAL yourself. ``database.journal_mode: delete`` is operator
+    containment, not a default change.
+
+    Subclasses :class:`StateDbReplacedError` so every downstream consumer
+    that already stops SQLite writes and diverts pending transcripts on a
+    replaced store (gateway retry queue, run_agent flush) handles the split
+    WAL generation identically — the correct response is the same: stop
+    writing, preserve the transcript tail on disk.
+    """
+
+
 # SQLite header: 4-byte big-endian application_id at offset 68. Distinct from
 # inode: ``cp`` onto the same path keeps st_ino and truncates+rewrites.
 _STATE_DB_APPLICATION_ID_OFFSET = 68
@@ -4200,6 +4399,53 @@ _STATE_DB_REPLACED_MSG = (
     "gateway pending_messages spool) and restore or reopen after operator "
     "intervention."
 )
+_DELETED_WAL_GENERATION_MSG = (
+    "FATAL: a live process holds a deleted state.db-wal or state.db-shm "
+    "inode while the path names a different (or missing) generation. "
+    "Refusing to open or write so a second WAL cannot be minted. "
+    "Stop the gateway, dashboard, and cron writers that hold the deleted "
+    "sidecar, then reopen. Do not delete the WAL yourself. "
+    "database.journal_mode: delete is operator containment, not a new default."
+)
+
+
+class StateDbCorruptError(sqlite3.DatabaseError):
+    """A live SessionDB observed structural (non-FTS) corruption and is quarantined.
+
+    Raised once a write on this handle reports bare ``SQLITE_CORRUPT`` /
+    ``SQLITE_NOTADB`` that is neither FTS-scoped (``_is_fts_write_corruption_error``)
+    nor a replaced-file case (``StateDbReplacedError``). Subclasses
+    ``sqlite3.DatabaseError`` so every existing ``except sqlite3.Error``
+    degrade path keeps working; ``sqlite_errorcode``/``sqlite_errorname``
+    are copied from the originating error.
+
+    The quarantine is sticky for the life of the handle: later writes fail
+    fast, the handle never reopens after ``close()``, and ``close()`` skips
+    its own WAL checkpoint. Field evidence (the #90837 lost/reordered-page
+    signature, the #90950 page-1 clobber): a handle that kept writing for ~50
+    minutes after the first structural error checkpointed 15 pages under the
+    wrong page numbers on shutdown, turning a still-readable file into
+    ``file is not a database``. Stopping the writes is what prevents that;
+    skipping the explicit checkpoint is the second line of defence. SQLite
+    still runs its own last-connection checkpoint inside ``close()`` (and
+    deletes the ``-wal`` sidecar) unless ``SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE``
+    is set — Python exposes it via ``Connection.setconfig()`` on 3.12+, so
+    quarantine disables the close-time checkpoint there and the WAL survives
+    on disk for forensics; on 3.11 the internal checkpoint is unavoidable
+    (post-quarantine it can only carry pre-corruption committed frames, since
+    no further writes are accepted). The
+    recovery boundary is a process restart on a repaired or restored file.
+    """
+
+
+_STATE_DB_CORRUPT_MSG = (
+    "FATAL: state.db reported structural corruption (database disk image is "
+    "malformed outside the FTS shadow tables) on a live handle; refusing further "
+    "writes, automatic reopen, and the close-time WAL checkpoint on this file. "
+    "Stop the gateway, then run `hermes sessions recover --source <state.db> "
+    "--inspect-only` or restore a snapshot. Unwritten transcripts are diverted to "
+    "sessions/<id>.jsonl (and the gateway pending_messages spool)."
+)
 
 
 def divert_session_transcript_jsonl(session_id: str, messages) -> "Optional[Path]":
@@ -4224,13 +4470,80 @@ def divert_session_transcript_jsonl(session_id: str, messages) -> "Optional[Path
     return path
 
 
-def _read_sqlite_application_id(db_path: Path) -> "Optional[int]":
-    """Read application_id from the SQLite header without opening a connection."""
+# _read_sqlite_application_id runs on EVERY write via _raise_if_db_replaced,
+# against the LIVE state.db.  A bare open()/read()/close() there is the
+# howtocorrupt §2.2 bug: close() cancels every POSIX advisory lock this
+# process holds on the file — measured on Linux/SQLite 3.53.1, one probe call
+# drops the WAL-mode DMS shared lock the writer connection holds on state.db
+# (see hermes_cli/sqlite_safe_read.py for the module built around this rule).
+# With the DMS lock gone, a fresh opener in another process can treat this
+# writer as dead and rerun WAL-index recovery underneath it.
+#
+# The probe therefore reads through a per-path fd cached for the life of the
+# process: opening an fd never cancels locks (only close() does), and
+# os.pread takes no shared file position.  When the path is re-pointed at a
+# new inode (the very replacement this probe exists to detect), the stale fd
+# is RETIRED, never closed — closing it would cancel the live connection's
+# locks on the old file, the exact bug being avoided.  Replacement events are
+# rare and halt writes anyway, so the leak is bounded.
+_HEADER_PROBE_LOCK = threading.Lock()
+_HEADER_PROBE_FDS: "dict[str, tuple[int, int, int]]" = {}  # key -> (fd, dev, ino)
+_RETIRED_HEADER_PROBE_FDS: "list[int]" = []  # intentionally never closed
+
+
+def _pread_db_header(db_path: Path, length: int) -> "Optional[bytes]":
+    """Lock-safe raw header read of a possibly-live SQLite database.
+
+    POSIX: pread from a cached, never-closed fd (rebound when the path names
+    a new inode).  Windows: plain read — advisory-lock cancellation is a
+    POSIX-only hazard and msvcrt locks do not share the failure mode.
+    """
+    if _IS_WINDOWS:
+        try:
+            with db_path.open("rb") as handle:
+                return handle.read(length)
+        except OSError:
+            return None
+    key = str(db_path)
     try:
-        with db_path.open("rb") as handle:
-            header = handle.read(_STATE_DB_APPLICATION_ID_OFFSET + 4)
+        st = os.stat(db_path)
     except OSError:
         return None
+    with _HEADER_PROBE_LOCK:
+        cached = _HEADER_PROBE_FDS.get(key)
+        if cached is not None and (cached[1], cached[2]) != (st.st_dev, st.st_ino):
+            # Path re-pointed at a new file. Retire (never close) the old fd.
+            _RETIRED_HEADER_PROBE_FDS.append(cached[0])
+            cached = None
+            del _HEADER_PROBE_FDS[key]
+        if cached is None:
+            try:
+                fd = os.open(db_path, os.O_RDONLY)
+            except OSError:
+                return None
+            try:
+                fst = os.fstat(fd)
+            except OSError:
+                _RETIRED_HEADER_PROBE_FDS.append(fd)
+                return None
+            cached = (fd, fst.st_dev, fst.st_ino)
+            _HEADER_PROBE_FDS[key] = cached
+        try:
+            return os.pread(cached[0], length, 0)
+        except OSError:
+            return None
+
+
+def _read_sqlite_application_id(db_path: Path) -> "Optional[int]":
+    """Read application_id from the SQLite header without opening a connection.
+
+    Safe against live databases: routed through :func:`_pread_db_header`,
+    which never issues a ``close()`` that would cancel this process's POSIX
+    locks on the file (howtocorrupt §2.2).
+    """
+    header = _pread_db_header(db_path, _STATE_DB_APPLICATION_ID_OFFSET + 4)
+    if header is None:
+        return None
     if len(header) < _STATE_DB_APPLICATION_ID_OFFSET + 4:
         return None
     if header[:16] != b"SQLite format 3\x00":
@@ -4257,6 +4570,86 @@ def _stat_db_file_identity(path: Path) -> "Optional[tuple]":
     return (st.st_dev, st.st_ino)
 
 
+def _stat_sqlite_sidecar_identity(db_path: Path) -> Dict[str, tuple]:
+    """Snapshot ``(st_dev, st_ino)`` for existing WAL/SHM sidecars."""
+    identities: Dict[str, tuple] = {}
+    base = os.fspath(db_path)
+    for suffix in ("-wal", "-shm"):
+        ident = _stat_db_file_identity(Path(base + suffix))
+        if ident is not None:
+            identities[suffix] = ident
+    return identities
+
+
+def _canonical_sqlite_path(path: str) -> str:
+    """Normalize a /proc fd target, stripping the Linux `` (deleted)`` suffix."""
+    return os.path.normcase(os.path.abspath(path.removesuffix(" (deleted)")))
+
+
+def _watched_sqlite_sidecar_paths(db_path) -> Set[str]:
+    base = os.path.abspath(os.fspath(db_path))
+    return {
+        _canonical_sqlite_path(base + "-wal"),
+        _canonical_sqlite_path(base + "-shm"),
+    }
+
+
+def iter_deleted_sqlite_sidecar_holders(db_path) -> List[Tuple[int, str]]:
+    """Return processes holding an unlinked ``state.db-wal`` / ``-shm``.
+
+    Linux-only (``/proc/<pid>/fd`` readlink). Windows and other hosts
+    return ``[]`` — Windows cannot unlink a sidecar another process still
+    holds, and macOS does not use the `` (deleted)`` suffix.
+
+    The scan includes this process: on the SessionDB open/write refuse
+    path, the in-process writer that still holds the orphan inode is the
+    one that must not mint a replacement WAL (and must stop committing).
+    ``_foreign_state_db_holders`` keeps skipping this PID for FTS
+    maintenance so a process does not block its own optional repair.
+    """
+    if not sys.platform.startswith("linux"):
+        return []
+
+    holders: List[Tuple[int, str]] = []
+    watched = _watched_sqlite_sidecar_paths(db_path)
+    try:
+        for pid_str in os.listdir("/proc"):
+            if not pid_str.isdigit():
+                continue
+            pid = int(pid_str)
+            fd_dir = f"/proc/{pid}/fd"
+            try:
+                fds = os.listdir(fd_dir)
+            except OSError:
+                continue
+            for fd in fds:
+                try:
+                    target = os.readlink(f"{fd_dir}/{fd}")
+                except OSError:
+                    continue
+                if " (deleted)" not in target:
+                    continue
+                if _canonical_sqlite_path(target) in watched:
+                    holders.append((pid, target))
+    except Exception as exc:
+        logger.debug("deleted-WAL holder scan failed for %s: %s", db_path, exc)
+        return holders
+    return holders
+
+
+def refuse_deleted_wal_generation(db_path) -> None:
+    """Raise if any process holds a deleted WAL/SHM generation for *db_path*.
+
+    Called *before* ``sqlite3.connect`` so a second opener cannot mint a
+    replacement WAL inode while a live writer still holds the orphan.
+    """
+    holders = iter_deleted_sqlite_sidecar_holders(db_path)
+    if not holders:
+        return
+    logger.error(_DELETED_WAL_GENERATION_MSG)
+    raise DeletedWalGenerationError(_DELETED_WAL_GENERATION_MSG)
+
+
 # ── Process-wide shared SessionDB registry (#90837) ──
 #
 # The registry itself lives in hermes_state_registry.py — a bounded
@@ -4794,6 +5187,18 @@ def classify_session_status(
     return SESSION_STATUS_COMPLETE
 
 
+# Parent→child ``profile_name`` inheritance fence (#88381). ``agent:<ns>:...``
+# gateway keys encode the profile namespace; a keyless row (CLI / subagent
+# lineage) carries none and inherits freely. Two keyed rows must agree on
+# ``agent:<ns>:`` — a default child (``agent:main:``) forked from a sibling
+# profile's row must not be durably mislabelled as that profile's.
+_SAME_KEY_NAMESPACE_SQL = (
+    "p.session_key IS NULL OR sessions.session_key IS NULL"
+    " OR substr(p.session_key, 1, instr(substr(p.session_key, 7), ':') + 6)"
+    "  = substr(sessions.session_key, 1, instr(substr(sessions.session_key, 7), ':') + 6)"
+)
+
+
 class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin):
     """
     SQLite-backed session storage with FTS5 search.
@@ -4802,6 +5207,19 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
     single writer via WAL mode). Each method opens its own cursor.
     """
 
+    # Only these state-owned producers participate in automatic stale-open
+    # reconciliation. Messaging-platform and UI/desktop sources have separate
+    # lifecycle owners; unknown/future sources fail closed (#60609).
+    _AUTO_PRUNE_STALE_OPEN_SOURCES: Tuple[str, ...] = (
+        "cli",
+        "cron",
+        "kanban",
+        "acp",
+        "api_server",
+        "subagent",
+        "tool",
+    )
+
     # ── Write-contention tuning ──
     # With multiple hermes processes (gateway + CLI sessions + worktree agents)
     # all sharing one state.db, WAL write-lock contention causes visible TUI
@@ -5003,6 +5421,14 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         self._db_file_application_id: int = 0
         self._db_file_generation_token: str = ""
         self._db_replaced = False
+        # Sticky: set once a write on THIS handle reports bare SQLITE_CORRUPT /
+        # NOTADB that is not FTS-scoped and not a replaced-file case. Never
+        # cleared; the recovery boundary is a process restart on a repaired or
+        # restored file (see StateDbCorruptError).
+        self._db_corrupt = False
+        self._db_corrupt_reason = ""
+        self._db_sidecar_identity: Dict[str, tuple] = {}
+        self._db_wal_generation_lost = False
         # One-shot guard for the usermerge-floor config write on the
         # incremental FTS merge cadence (see _merge_fts_incrementally).
         self._fts_usermerge_floor_applied = False
@@ -5041,46 +5467,67 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 # must already exist + be initialised (callers guard on
                 # db_path.exists()); a SELECT against an empty file raises and
                 # the caller degrades per-profile.
-                self._conn = _connect_tracked_db(
-                    f"file:{self.db_path}?mode=ro",
-                    tracking_path=self.db_path,
-                    uri=True,
-                    check_same_thread=False,
-                    timeout=1.0,
-                    isolation_level=None,
-                )
-                self._conn.row_factory = sqlite3.Row
-                # FTS capability flags normally come from writable schema
-                # initialisation. Probe existing virtual tables with SELECTs
-                # only so read-only search keeps its FTS and trigram paths.
-                # Close the connection on ANY probe failure (e.g. malformed
-                # schema raises DatabaseError, not the OperationalError the
-                # probe handles). The constructor's outer finally also covers
-                # failures before this probe and BaseException paths, so a
-                # leaked tracked connection cannot block _backup_db_file's
-                # raw-copy for the rest of the process — the writable heal
-                # that follows would then repair WITHOUT its forensic backup.
-                try:
-                    apply_database_pragmas(self._conn, db_label="state.db")
-                    cursor = self._conn.cursor()
-                    self._fts_enabled = (
-                        self._fts_table_probe(cursor, "messages_fts") is True
-                    )
-                    if self._fts_enabled:
-                        self._trigram_available = (
-                            self._fts_table_probe(
-                                cursor,
-                                "messages_fts_trigram",
-                            )
-                            is True
-                        )
-                except BaseException:
-                    conn, self._conn = self._conn, None
+                open_attempt = 0
+                while True:
                     try:
-                        conn.close()
-                    except Exception:
-                        pass
-                    raise
+                        self._conn = _connect_tracked_db(
+                            f"file:{self.db_path}?mode=ro",
+                            tracking_path=self.db_path,
+                            uri=True,
+                            check_same_thread=False,
+                            timeout=1.0,
+                            isolation_level=None,
+                        )
+                        self._conn.row_factory = sqlite3.Row
+                        # FTS capability flags normally come from writable schema
+                        # initialisation. Probe existing virtual tables with
+                        # SELECTs only so read-only search keeps its FTS and
+                        # trigram paths. Close the connection on ANY probe
+                        # failure (e.g. malformed schema raises DatabaseError,
+                        # not the OperationalError the probe handles). The
+                        # constructor's outer finally also covers failures
+                        # before this probe and BaseException paths, so a
+                        # leaked tracked connection cannot block
+                        # _backup_db_file's raw-copy for the rest of the
+                        # process — the writable heal that follows would then
+                        # repair WITHOUT its forensic backup.
+                        try:
+                            apply_database_pragmas(self._conn, db_label="state.db")
+                            cursor = self._conn.cursor()
+                            self._fts_enabled = (
+                                self._fts_table_probe(cursor, "messages_fts")
+                                is True
+                            )
+                            if self._fts_enabled:
+                                self._trigram_available = (
+                                    self._fts_table_probe(
+                                        cursor,
+                                        "messages_fts_trigram",
+                                    )
+                                    is True
+                                )
+                        except BaseException:
+                            conn, self._conn = self._conn, None
+                            try:
+                                conn.close()
+                            except Exception:
+                                pass
+                            raise
+                        break
+                    except sqlite3.OperationalError as ioerr:
+                        # A WAL checkpoint / reset / frame-flush in flight on
+                        # the writer side can surface SQLITE_IOERR to a
+                        # concurrent mode=ro reader (it cannot perform the
+                        # recovery the read needs — recovery writes the -shm
+                        # index, which mode=ro refuses). The transition closes
+                        # in milliseconds, so retry a bounded number of times
+                        # before classifying the store as failed (#100436).
+                        if not _is_transient_read_only_ioerr(
+                            ioerr, attempt=open_attempt
+                        ):
+                            raise
+                        open_attempt += 1
+                        time.sleep(_READ_ONLY_IOERR_RETRY_BACKOFF_S)
                 self._record_db_file_identity()
                 initialization_complete = True
                 return
@@ -5133,6 +5580,10 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                         raise sqlite3.DatabaseError(msg)
 
             def _connect_and_init():
+                # Refuse before sqlite3.connect (under the startup lock) so we
+                # cannot mint a replacement WAL while a live writer still
+                # holds a deleted sidecar inode.
+                refuse_deleted_wal_generation(self.db_path)
                 self._conn = _connect_tracked_db(
                     str(self.db_path),
                     check_same_thread=False,
@@ -5523,6 +5974,17 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         # through stale WAL/shm assumptions (#89332). Refuse instead.
         if self._db_replaced or self._db_file_was_replaced():
             self._halt_db_replaced()
+        # A quarantined handle must never come back: reopening would hand a
+        # fresh connection (and its own close-time checkpoint) to a file we
+        # already know is structurally damaged.
+        if self._db_corrupt:
+            raise self._corrupt_error(
+                f"state.db connection for {self.db_path} is quarantined after "
+                f"structural corruption; refusing to reopen for a {context} "
+                "after close(). "
+            )
+        if self._db_wal_generation_lost or self._wal_generation_was_lost():
+            self._halt_deleted_wal_generation()
         logger.warning(
             "state.db connection for %s was closed while a %s was still in "
             "flight — reopening (teardown/worker race, #94736)",
@@ -5848,6 +6310,13 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         # Set on the first compression-busy collision so the short wait is
         # measured from then, not from the start of the write.
         compression_deadline: Optional[float] = None
+        # One retry for SQLITE_IOERR raised by BEGIN IMMEDIATE itself. The
+        # callback has not run at that point, so there is no durable effect
+        # to replay and the retry is exactly-once safe (#99502's contract).
+        # Once the callback starts, an IOERR leaves the write's settlement
+        # unknown and must propagate — this helper owns non-idempotent
+        # transcript/counter mutations, not just idempotent UPSERTs.
+        ioerr_begin_retried = False
 
         # Transient engine-level error observed on contended WAL appends
         # (dual gateway/agent writers; FTS5 trigram sync holds the write
@@ -5860,7 +6329,9 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             return "no more rows available" in str(exc).lower()
 
         while True:
+            self._raise_if_db_corrupt()
             self._raise_if_db_replaced()
+            fn_started = False
             try:
                 with self._lock:
                     if self._conn is None:
@@ -5869,6 +6340,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                         self._reopen_after_close_locked(context="write")
                     self._conn.execute("BEGIN IMMEDIATE")
                     try:
+                        fn_started = True
                         result = fn(self._conn)
                         self._conn.commit()
                     except BaseException:
@@ -5921,7 +6393,21 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     ) from exc
                 if _is_no_more_rows(exc) and self._sleep_before_write_retry(deadline, patience_s):
                     continue
-                # Non-lock error or patience exhausted — propagate.
+                if (
+                    _DISK_IO_ERROR_MARKER in err_msg
+                    and not fn_started
+                    and not ioerr_begin_retried
+                    and self._sleep_before_write_retry(deadline, patience_s)
+                ):
+                    # BEGIN IMMEDIATE itself hit a transient WAL-transition
+                    # IOERR. Nothing has been mutated, so retrying on the SAME
+                    # connection replays nothing. Never close()+reopen to
+                    # "heal" it: close() cancels this process's POSIX locks on
+                    # the file for every sibling connection (howtocorrupt §2.2).
+                    ioerr_begin_retried = True
+                    continue
+                # Non-lock error, the callback already ran (settlement is
+                # unknown — do not replay), or patience exhausted.
                 raise
             except sqlite3.DatabaseError as exc:
                 if _is_no_more_rows(exc) and self._sleep_before_write_retry(deadline, patience_s):
@@ -5946,6 +6432,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 # explicit repair paths retain rebuild ownership.
                 if self._enter_fts_fail_open(exc):
                     continue
+                # Bare SQLITE_CORRUPT / NOTADB that survived the replaced-file
+                # check and the FTS-scoped fail-open is structural damage:
+                # quarantine the handle (see StateDbCorruptError).
+                if self._is_structural_corruption_error(exc):
+                    self._halt_db_corrupt(exc)
                 raise
             except sqlite3.Error as exc:
                 # Catch-all for builds that surface 'no more rows available'
@@ -6001,6 +6492,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
     def _record_db_file_identity(self) -> None:
         """Snapshot inode plus the on-disk generation header when present."""
         self._db_file_identity = _stat_db_file_identity(self.db_path)
+        self._db_sidecar_identity = _stat_sqlite_sidecar_identity(self.db_path)
         disk_id = _read_sqlite_application_id(self.db_path)
         if disk_id:
             self._db_file_application_id = disk_id
@@ -6035,11 +6527,151 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         logger.error(_STATE_DB_REPLACED_MSG)
         raise StateDbReplacedError(_STATE_DB_REPLACED_MSG)
 
+    def _wal_generation_was_lost(self) -> bool:
+        """True when the WAL/SHM generation this instance opened is gone.
+
+        Steady state (a sidecar generation is recorded): pure stat — a
+        recorded inode that is missing or replaced by a new file at the same
+        path means the generation split. No /proc walk on healthy writes.
+
+        Empty-identity state (fresh DB whose WAL appears only after open, or
+        identity cleared by a clean ``close()``): fall back to a
+        ``/proc/self/fd`` deleted-fd probe, and adopt the current sidecars as
+        this handle's generation once the probe comes back clean. The full
+        ``/proc/*/fd`` walk is reserved for
+        :func:`refuse_deleted_wal_generation` on open, where we must see
+        *foreign* deleted holders before ``sqlite3.connect`` mints a new WAL.
+        """
+        recorded = self._db_sidecar_identity or {}
+        base = os.fspath(self.db_path)
+        if recorded:
+            for suffix, recorded_ident in recorded.items():
+                current = _stat_db_file_identity(Path(base + suffix))
+                if current is None or current != recorded_ident:
+                    return True
+            return False
+        if not self._wal_active:
+            # No WAL on this handle (journal_mode=delete/truncate fallback):
+            # there is no sidecar generation to lose, and probing every write
+            # would put a /proc walk on the hot path of exactly the
+            # delete-mode deployments the field report used as containment.
+            return False
+        if sys.platform.startswith("linux"):
+            watched = _watched_sqlite_sidecar_paths(self.db_path)
+            fd_dir = f"/proc/{os.getpid()}/fd"
+            try:
+                for fd in os.listdir(fd_dir):
+                    try:
+                        target = os.readlink(f"{fd_dir}/{fd}")
+                    except OSError:
+                        continue
+                    if " (deleted)" in target and _canonical_sqlite_path(target) in watched:
+                        return True
+            except OSError:
+                return False
+        # Probe clean (or unavailable on this platform): adopt whatever
+        # sidecar generation exists now so subsequent writes use the cheap
+        # stat check.
+        current_identity = _stat_sqlite_sidecar_identity(self.db_path)
+        if current_identity:
+            self._db_sidecar_identity = current_identity
+        return False
+
+    def _halt_deleted_wal_generation(self) -> None:
+        """Stop writes; do not mint or keep committing on a split WAL."""
+        self._db_wal_generation_lost = True
+        logger.error(_DELETED_WAL_GENERATION_MSG)
+        raise DeletedWalGenerationError(_DELETED_WAL_GENERATION_MSG)
+
     def _raise_if_db_replaced(self) -> None:
         if self._db_replaced:
             raise StateDbReplacedError(_STATE_DB_REPLACED_MSG)
+        if self._db_wal_generation_lost:
+            raise DeletedWalGenerationError(_DELETED_WAL_GENERATION_MSG)
         if self._db_file_was_replaced():
             self._halt_db_replaced()
+        if self._wal_generation_was_lost():
+            self._halt_deleted_wal_generation()
+
+    @classmethod
+    def _is_structural_corruption_error(cls, exc: BaseException) -> bool:
+        """Bare SQLITE_CORRUPT/NOTADB with no FTS provenance.
+
+        ``_is_fts_write_corruption_error`` is the positive FTS classifier;
+        everything else in the ``corrupt`` bucket of
+        ``classify_persistence_error`` is damage to a canonical B-tree, the
+        schema, or the freelist — never repairable from the live write path.
+        """
+        if not isinstance(exc, sqlite3.DatabaseError):
+            return False
+        if isinstance(exc, StateDbCorruptError):
+            return False
+        if cls._is_fts_write_corruption_error(exc):
+            return False
+        return classify_persistence_error(exc) == "corrupt"
+
+    def _corrupt_error(self, prefix: str = "") -> "StateDbCorruptError":
+        """Build the quarantine error for this handle (message assembled once)."""
+        return StateDbCorruptError(
+            f"{prefix}{_STATE_DB_CORRUPT_MSG} (cause: {self._db_corrupt_reason})"
+        )
+
+    def _halt_db_corrupt(self, exc: BaseException) -> None:
+        """Quarantine this handle and raise; never run in-file repair here."""
+        self._db_corrupt = True
+        self._db_corrupt_reason = str(exc)
+        self._disable_close_time_checkpoint()
+        logger.error(
+            "state.db %s reported structural corruption outside the FTS "
+            "indexes (%s); quarantining this handle: no further writes, no "
+            "automatic reopen, no explicit WAL checkpoint at close. Stop the "
+            "gateway and run `hermes sessions recover --source %s "
+            "--inspect-only`.",
+            self.db_path,
+            exc,
+            self.db_path,
+        )
+        err = self._corrupt_error()
+        for attr in ("sqlite_errorcode", "sqlite_errorname"):
+            value = getattr(exc, attr, None)
+            if value is not None:
+                setattr(err, attr, value)
+        raise err from exc
+
+    def _disable_close_time_checkpoint(self) -> None:
+        """Best-effort: stop SQLite's own last-connection checkpoint on close.
+
+        Skipping our explicit ``PRAGMA wal_checkpoint(PASSIVE)`` in
+        ``close()`` is not enough on its own: ``sqlite3.Connection.close()``
+        still runs SQLite's internal last-connection PASSIVE checkpoint and
+        unlinks the ``-wal``/``-shm`` sidecars. On the field incident's file
+        that close-time checkpoint is exactly what wrote 15 pages under the
+        wrong page numbers. Python 3.12+ exposes the switch as
+        ``Connection.setconfig(SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE)``; on 3.11
+        neither the constant nor ``setconfig`` exists, so the internal
+        checkpoint remains (it can only carry pre-quarantine committed
+        frames — no further writes are accepted on this handle).
+        """
+        flag = getattr(sqlite3, "SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE", None)
+        if flag is None:
+            return
+        conn = self._conn
+        setconfig = getattr(conn, "setconfig", None)
+        if conn is None or setconfig is None:
+            return
+        try:
+            setconfig(flag, True)
+        except Exception:
+            logger.debug(
+                "Could not disable SQLite's close-time checkpoint on the "
+                "quarantined handle for %s",
+                self.db_path,
+                exc_info=True,
+            )
+
+    def _raise_if_db_corrupt(self) -> None:
+        if self._db_corrupt:
+            raise self._corrupt_error()
 
     def _sleep_before_write_retry(
         self, deadline: float, patience_s: float
@@ -6108,15 +6740,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         if psutil is None:
             return [(-1, "open-file scan unavailable")]
 
-        def _canonical(path: str) -> str:
-            clean = path.removesuffix(" (deleted)")
-            return os.path.normcase(os.path.abspath(clean))
-
         db_path = os.path.abspath(os.fspath(self.db_path))
         watched = {
-            _canonical(db_path),
-            _canonical(db_path + "-wal"),
-            _canonical(db_path + "-shm"),
+            _canonical_sqlite_path(db_path),
+            _canonical_sqlite_path(db_path + "-wal"),
+            _canonical_sqlite_path(db_path + "-shm"),
         }
         holders: List[Tuple[int, str]] = []
 
@@ -6155,7 +6783,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                             target = os.readlink(f"{fd_dir}/{fd}")
                         except OSError:
                             continue
-                        if _canonical(target) in watched:
+                        if _canonical_sqlite_path(target) in watched:
                             holders.append((pid, target))
             except Exception as exc:
                 logger.warning(
@@ -6180,7 +6808,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 # Linux-specific (systemd units running as root).
                 for opened in info.get("open_files") or ():
                     path = getattr(opened, "path", "")
-                    if path and _canonical(path) in watched:
+                    if path and _canonical_sqlite_path(path) in watched:
                         holders.append((pid, path))
         except Exception as exc:
             logger.warning(
@@ -6262,8 +6890,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         """
         if not self._fts_enabled or not self._is_fts_write_corruption_error(exc):
             return False
+        self._raise_if_db_corrupt()
         if self._db_replaced or self._db_file_was_replaced():
             self._halt_db_replaced()
+        if self._db_wal_generation_lost or self._wal_generation_was_lost():
+            self._halt_deleted_wal_generation()
 
         try:
             with self._lock:
@@ -6329,6 +6960,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         databases (65K+ pages) due to the exclusive-lock I/O pressure
         from checkpointing thousands of frames at once (issue #45383).
         """
+        if self._db_corrupt:
+            return  # quarantined: never checkpoint over a damaged image
         try:
             with self._lock:
                 result = self._conn.execute(
@@ -6420,7 +7053,20 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             self._close_read_conn(conn)
         with self._lock:
             if self._conn:
-                if not self.read_only:
+                if self._db_corrupt:
+                    # Quarantined handle (see StateDbCorruptError): no explicit
+                    # checkpoint over a damaged page image.
+                    logger.warning(
+                        "Skipping the close-time WAL checkpoint for %s: this "
+                        "handle observed structural corruption (%s). Take a "
+                        "snapshot of state.db, -wal and -shm before restarting, "
+                        "then run `hermes sessions recover --source %s "
+                        "--inspect-only`.",
+                        self.db_path,
+                        self._db_corrupt_reason,
+                        self.db_path,
+                    )
+                elif not self.read_only:
                     # PASSIVE, not TRUNCATE. Every cron run_agent opens+closes a
                     # transient SessionDB, so a TRUNCATE here fires a full WAL
                     # reset many times/hour, racing the gateway's long-lived
@@ -6437,6 +7083,12 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                         )
                 conn, self._conn = self._conn, None
                 self._close_connection_quietly(conn)
+                # A clean close of the last connection lets SQLite unlink the
+                # WAL/SHM sidecars — a legitimate end of this handle's sidecar
+                # generation, not a split (#94736 late writes must still
+                # self-heal). Drop the recorded generation so a teardown-race
+                # reopen re-adopts whatever exists then instead of halting.
+                self._db_sidecar_identity = {}
 
     def __del__(self) -> None:
         """Safety net: close the connection if the caller forgot.
@@ -6705,7 +7357,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 self._delete_unreferenced_system_prompts(conn)
             if parent_session_id:
                 conn.execute(
-                    """UPDATE sessions
+                    f"""UPDATE sessions
                        SET cwd = COALESCE(sessions.cwd,
                                  (SELECT p.cwd FROM sessions p
                                    WHERE p.id = sessions.parent_session_id)),
@@ -6717,7 +7369,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                                           WHERE p.id = sessions.parent_session_id)),
                            profile_name = COALESCE(sessions.profile_name,
                                           (SELECT p.profile_name FROM sessions p
-                                            WHERE p.id = sessions.parent_session_id))
+                                            WHERE p.id = sessions.parent_session_id
+                                              AND ({_SAME_KEY_NAMESPACE_SQL})))
                      WHERE id = ? AND parent_session_id IS NOT NULL""",
                     (session_id,),
                 )
@@ -7289,6 +7942,15 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             # tuple so we never cross chats/threads/users.
             if chat_id is None or chat_type is None:
                 return None
+            # Profile fence (#74285): a Telegram DM's peer tuple is identical
+            # for every bot (chat_id == user_id, no thread), so a sibling
+            # profile's row written into this store before the per-profile
+            # partition (legacy data) would otherwise be adopted here. Every
+            # profile-tree store has one owner; a row is ours when its
+            # profile_name is the owner or NULL (legacy rows this store
+            # minted). Stores outside the tree derive no owner and keep the
+            # historical unfenced behavior.
+            owner = self._own_profile_name()
             row = conn.execute(
                 f"""
                 SELECT s.*,
@@ -7304,6 +7966,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                   AND COALESCE(s.chat_id, '') = COALESCE(?, '')
                   AND COALESCE(s.chat_type, '') = COALESCE(?, '')
                   AND COALESCE(s.thread_id, '') = COALESCE(?, '')
+                  AND (? IS NULL OR COALESCE(s.profile_name, ?) = ?)
                   AND (s.ended_at IS NULL OR s.end_reason IN ({_RECOVERABLE_END_REASONS_SQL}))
                   AND (COALESCE(s.message_count, 0) > 0 OR EXISTS (
                       SELECT 1 FROM messages WHERE messages.session_id = s.id LIMIT 1
@@ -7323,7 +7986,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 ORDER BY COALESCE(s.last_activity_at, s.started_at) DESC
                 LIMIT 1
                 """,
-                (source, user_id, chat_id, chat_type, thread_id),
+                (source, user_id, chat_id, chat_type, thread_id, owner, owner, owner),
             ).fetchone()
         return self._session_row_dict(row) if row else None
 
@@ -8476,6 +9139,54 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
 
         self._execute_write(_do)
 
+    def get_compression_recovery_deadline(self, session_id: str) -> float:
+        """Return the persisted anti-thrash recovery deadline (wall-clock epoch).
+
+        ``0.0`` means "not armed". The deadline is the durable half of the
+        #14694 recovery clock: the gateway rebuilds the compressor on every
+        turn / cache eviction, so a process-local deadline restarted the
+        wait on each rebuild and a tripped session never earned its probe
+        (#100185).
+        """
+        if not session_id:
+            return 0.0
+        with self._read_ctx() as conn:
+            if conn is None:
+                return 0.0
+            row = conn.execute(
+                "SELECT compression_recovery_deadline FROM sessions WHERE id = ?",
+                (session_id,),
+            ).fetchone()
+        if row is None:
+            return 0.0
+        value = (
+            row["compression_recovery_deadline"]
+            if isinstance(row, sqlite3.Row)
+            else row[0]
+        )
+        try:
+            return max(0.0, float(value or 0.0))
+        except (TypeError, ValueError):
+            return 0.0
+
+    def set_compression_recovery_deadline(self, session_id: str, deadline: float) -> None:
+        """Persist the anti-thrash recovery deadline; ``0`` / ``None`` disarms it."""
+        if not session_id:
+            return
+        try:
+            normalized = max(0.0, float(deadline or 0.0))
+        except (TypeError, ValueError):
+            normalized = 0.0
+        stored = normalized if normalized > 0.0 else None
+
+        def _do(conn):
+            conn.execute(
+                "UPDATE sessions SET compression_recovery_deadline = ? WHERE id = ?",
+                (stored, session_id),
+            )
+
+        self._execute_write(_do)
+
     # ──────────────────────────────────────────────────────────────────────
     # Compression locks
     # ──────────────────────────────────────────────────────────────────────
@@ -9037,6 +9748,25 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             self._delete_unreferenced_system_prompts(conn)
         self._execute_write(_do)
 
+    def update_session_tool_names(
+        self, session_id: str, tool_names: Optional[List[str]]
+    ) -> None:
+        """Persist the session's resolved ``tools[]`` name order (JSON array).
+
+        Read back by ``tools.mcp_tool.restore_agent_tool_prefix`` when a fresh
+        ``AIAgent`` is rebuilt for an existing session (gateway agent-cache
+        eviction) so a flipped ``check_fn`` verdict can't fork the cached tool
+        prefix. ``None`` clears the pin.
+        """
+        payload = json.dumps(list(tool_names)) if tool_names is not None else None
+
+        def _do(conn):
+            conn.execute(
+                "UPDATE sessions SET tool_names = ? WHERE id = ?",
+                (payload, session_id),
+            )
+        self._execute_write(_do)
+
     def update_session_model(
         self, session_id: str, model: str, provider: Optional[str] = None
     ) -> None:
@@ -10054,57 +10784,54 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         max_idle_seconds: float,
         sources: Tuple[str, ...] = ("tui", "desktop", "subagent"),
         exclude_ids: Tuple[str, ...] = (),
+        exclude_pinned: bool = False,
         heartbeat_staleness_seconds: Optional[float] = None,
         heartbeat_ownership_grace_seconds: Optional[float] = None,
+        respect_gateway_heartbeats: bool = True,
     ) -> List[str]:
         """Close session rows orphaned by a dead gateway process (#65194, #94895).
 
         The TUI/desktop gateway reaps disconnected websocket sessions with an
         in-process ``threading.Timer`` grace timer; a gateway restart destroys
-        the timer and leaves the row ``ended_at IS NULL`` forever.  This is
-        the startup-time complement: it closes rows for the given ``sources``
-        whose ``started_at`` AND newest ``messages.timestamp`` are both older
-        than ``max_idle_seconds``, with a distinct
+        the timer and leaves the row ``ended_at IS NULL`` forever. This is the
+        startup-time complement: it closes rows for the given ``sources`` whose
+        ``started_at`` and canonical last-activity time are both older than
+        ``max_idle_seconds``, with a distinct
         ``end_reason='startup_orphan_reap'`` for traceability.
 
-        Both timestamps must be stale on purpose: message recency alone would
-        sweep a freshly created compression/branch child carrying old copied
-        message timestamps, while ``started_at`` alone would sweep a
-        long-lived session that is still actively producing messages.
-        Message-less rows fall back to ``started_at`` via COALESCE.
+        Canonical activity is the newest of ``last_activity_at`` (the in-turn
+        heartbeat) and the newest durable message timestamp, falling back to
+        ``started_at``. The separate ``started_at`` predicate protects freshly
+        created compression/branch children whose copied activity is old.
 
-        Only pass sources owned by the local UI stack (never messaging-gateway
+        Only pass sources whose lifecycle the caller owns (never messaging-gateway
         platforms like ``telegram`` — ending those triggers the #60609 routing
-        loop).  ``exclude_ids`` spares rows this process still holds in
-        memory (a ``session.resume`` that landed during the startup grace
-        window).  Non-destructive: messages are preserved and the row remains
-        resumable.  First-reason-wins is preserved via ``ended_at IS NULL``.
+        loop). ``exclude_ids`` spares rows this process still holds in memory
+        (a ``session.resume`` that landed during the startup grace window).
+        ``exclude_pinned`` is intended for broad automatic sweeps; pinned rows
+        remain explicitly recoverable. Non-destructive: messages are preserved
+        and the row remains resumable. First-reason-wins is preserved via
+        ``ended_at IS NULL``.
 
-        Cross-backend liveness (#94895): when one ``state.db`` is shared by
-        N serve / gateway processes (isolated backends, fixed-port launchd
-        ``hermes serve``, desktop WS sidecar), each backend registers a row
-        in ``gateway_heartbeats`` refreshed every few seconds.  A row is
-        only reaped when ``started_at``/message staleness hold AND no live
-        backend (heartbeat refreshed within ``heartbeat_staleness_seconds``,
-        default ``2 * max_idle_seconds``) could plausibly own it.
+        Cross-backend liveness (#94895): when one ``state.db`` is shared by N
+        serve / gateway processes, each backend refreshes a row in
+        ``gateway_heartbeats``. With ``respect_gateway_heartbeats`` enabled, a
+        row is only reaped when activity staleness holds AND no live backend
+        (heartbeat refreshed within ``heartbeat_staleness_seconds``, default
+        ``2 * max_idle_seconds``) could plausibly own it. Disable that gate only
+        for sources whose lifecycle is explicitly owned by state.db itself.
 
         Ownership inference: a live backend B ``owns`` a session S if
         ``B.started_at <= S.started_at + heartbeat_ownership_grace_seconds``
-        (default ``heartbeat_staleness_seconds``).  The grace window
-        accommodates the deploy-time migration case where a backend just
-        wrote its first heartbeat row while its existing open sessions
-        predate the schema.  The grace is bounded by the staleness window
-        so a fresh PID-reuse respawn cannot indefinitely protect sessions
-        inherited from a dead predecessor.
+        (default ``heartbeat_staleness_seconds``). The grace window covers a
+        migrating backend whose existing sessions predate its first heartbeat,
+        but is bounded so a fresh PID-reuse respawn cannot protect rows forever.
+        With no fresh heartbeat the predicate falls back to the legacy sweep.
 
-        When NO backend has ever written a heartbeat (legacy deployment
-        mid-upgrade before any process has registered) the predicate falls
-        back to the original behavior so we never silently strand a row
-        that pre-dates the schema.
-
-        The SELECT + UPDATE run in one ``BEGIN IMMEDIATE`` write, so a sibling
-        process cannot sneak a new message or end-reason between the
-        staleness check and the close.  Returns the swept session ids.
+        The SELECT, live-lease validation, and UPDATE run in one
+        ``BEGIN IMMEDIATE`` transaction. Active turn leases or compression
+        locks spare the row; expired/reclaimed guards are removed so their
+        former owner is fenced. Returns the swept session ids.
         """
         srcs = tuple(s for s in sources if s)
         if max_idle_seconds <= 0 or not srcs:
@@ -10116,56 +10843,76 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         )
         hb_grace = (
             heartbeat_ownership_grace_seconds
-            if heartbeat_ownership_grace_seconds and heartbeat_ownership_grace_seconds >= 0
+            if heartbeat_ownership_grace_seconds is not None
+            and heartbeat_ownership_grace_seconds >= 0
             else hb_staleness
         )
-        cutoff = time.time() - max_idle_seconds
-        hb_cutoff = time.time() - hb_staleness
+        now = time.time()
+        cutoff = now - max_idle_seconds
+        hb_cutoff = now - hb_staleness
         placeholders = ",".join("?" for _ in srcs)
         staleness = (
-            "started_at < ? AND COALESCE((SELECT MAX(m.timestamp) FROM messages m"
-            " WHERE m.session_id = sessions.id), started_at) < ?"
+            f"started_at < ? AND {_sql_session_last_active('sessions')} < ?"
         )
-
-        def _do(conn):
-            # Cross-process liveness gate (#94895). A session is "owned by
-            # a live backend" if any row in gateway_heartbeats is fresh
-            # (last_heartbeat >= hb_cutoff) AND was alive no later than
-            # ``sessions.started_at + hb_grace`` (heartbeats.started_at <=
-            # sessions.started_at + hb_grace). If at least one live backend
-            # matches, the row is not orphaned.
-            #
-            # ``hb_cutoff`` and ``hb_grace`` are computed above so all
-            # backends running concurrent sweep queries agree on the same
-            # boundaries. We do NOT clear heartbeats here — that's each
-            # backend's atexit responsibility via ``clear_backend_heartbeat``.
-            orphan_predicate = (
-                f"{staleness} AND NOT EXISTS ("
+        pin_scope = " AND COALESCE(pinned, 0) = 0" if exclude_pinned else ""
+        heartbeat_params: Tuple[float, ...] = ()
+        orphan_predicate = staleness
+        if respect_gateway_heartbeats:
+            orphan_predicate += (
+                " AND NOT EXISTS ("
                 "SELECT 1 FROM gateway_heartbeats h"
                 " WHERE h.last_heartbeat >= ?"
-                f" AND h.started_at <= sessions.started_at + ?"
+                " AND h.started_at <= sessions.started_at + ?"
                 ")"
             )
+            heartbeat_params = (hb_cutoff, hb_grace)
+
+        def _do(conn):
             rows = conn.execute(
                 f"SELECT id FROM sessions WHERE ended_at IS NULL"
-                f" AND source IN ({placeholders}) AND {orphan_predicate}",
-                (*srcs, cutoff, cutoff, hb_cutoff, hb_grace),
+                f" AND source IN ({placeholders}){pin_scope}"
+                f" AND {orphan_predicate}",
+                (*srcs, cutoff, cutoff, *heartbeat_params),
             ).fetchall()
             excluded = {str(x) for x in exclude_ids if x}
-            victims = [str(r["id"]) for r in rows if str(r["id"]) not in excluded]
+            victims = []
+            for row in rows:
+                sid = str(row["id"])
+                if sid in excluded:
+                    continue
+                try:
+                    self._check_transcript_write_guards(
+                        conn,
+                        sid,
+                        compression_lock_holder=None,
+                        turn_lease_holder=None,
+                        reject_active_turn_lease=True,
+                        reject_active_compression_lock=True,
+                    )
+                except (
+                    SessionCompressionInProgressError,
+                    SessionTurnLeaseLostError,
+                ):
+                    continue
+                victims.append(sid)
             if not victims:
                 return []
-            now = time.time()
+            closed_at = time.time()
             marks = ",".join("?" for _ in victims)
-            # Re-apply the same predicates under the write lock so a
-            # row that raced to activity between SELECT and UPDATE is
-            # spared (and so a freshly registered heartbeat from a sibling
-            # that started during this transaction can still save the row).
+            # Re-apply every scope/liveness predicate under the write lock.
             conn.execute(
                 f"UPDATE sessions SET ended_at = ?, end_reason = 'startup_orphan_reap'"
                 f" WHERE id IN ({marks}) AND ended_at IS NULL"
+                f" AND source IN ({placeholders}){pin_scope}"
                 f" AND {orphan_predicate}",
-                (now, *victims, cutoff, cutoff, hb_cutoff, hb_grace),
+                (
+                    closed_at,
+                    *victims,
+                    *srcs,
+                    cutoff,
+                    cutoff,
+                    *heartbeat_params,
+                ),
             )
             return victims
 
@@ -10360,8 +11107,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
     # Bot Mode's forever-chat registry: the session titled exactly this, on a
     # bot's profile, IS the bot's canonical chat — resolved by exact-title
     # lookup on every open (no session-id pointer exists). The title is the
-    # identity, which is why _set_session_title refuses user renames of a
-    # hidden row holding it (#92473).
+    # identity, which is why _set_session_title refuses renames of a hidden
+    # row holding it (#92473).
     CANONICAL_BOT_CHAT_TITLE = "Bot Chat"
 
     @classmethod
@@ -10478,7 +11225,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         stored title has strictly lower authority, so the instant ``derived``
         title upgrades to ``llm`` exactly once and neither can ever overwrite a
         name the user typed. Re-running the titler on an already-``llm`` row is
-        a no-op, which is what stops a session renaming itself.
+        a no-op, which is what stops a session renaming itself. The one thing
+        no writer may do is move a hidden canonical Bot Chat off its title.
 
         The read and the write are one compare-and-swap inside a single
         transaction, so a manual ``/title`` racing an in-flight generation
@@ -10503,18 +11251,21 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             # surface funnels through (gateway session.title, /title, CLI
             # rename, REST). Hidden is the discriminator: canonical chats are
             # born hidden; an ordinary visible session a user happens to call
-            # "Bot Chat" stays freely renameable.
+            # "Bot Chat" stays freely renameable. Provenance-blind: an
+            # automatic llm write outranks a derived title, so the auto-titler
+            # would otherwise rename the row too (#99517) — it no-ops instead.
             if (
-                is_user
-                and (current["title"] or "") == self.CANONICAL_BOT_CHAT_TITLE
+                (current["title"] or "") == self.CANONICAL_BOT_CHAT_TITLE
                 and bool(current["hidden"])
                 and title != self.CANONICAL_BOT_CHAT_TITLE
             ):
-                raise ValueError(
-                    "This is the bot's canonical Bot Chat — its name is its "
-                    "identity, and renaming it would orphan the conversation. "
-                    "To start fresh, create a new bot instead."
-                )
+                if is_user:
+                    raise ValueError(
+                        "This is the bot's canonical Bot Chat — its name is its "
+                        "identity, and renaming it would orphan the conversation. "
+                        "To start fresh, create a new bot instead."
+                    )
+                return 0
             if not is_user and current["title"] is not None:
                 if self._title_rank(current["title_source"]) >= new_rank:
                     return 0
@@ -11050,8 +11801,13 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
 
         return f"{base} #{max_num + 1}"
 
-    def get_compression_tip(self, session_id: str) -> Optional[str]:
-        """Walk the compression-continuation chain forward and return the tip.
+    def get_compression_chain(self, session_id: str) -> List[str]:
+        """Walk the compression-continuation chain forward and return every id.
+
+        Root-first order, ending at the tip; ``[session_id]`` when no
+        continuation exists. ``get_compression_tip`` is this walk's last
+        element — kept as the single implementation so the two can never
+        disagree about what the chain is.
 
         A compression continuation is a child of a session whose
         ``end_reason = 'compression'``.  Older builds tried to distinguish
@@ -11072,6 +11828,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         continuation exists.
         """
         current = session_id
+        chain = [current] if current else []
         seen = {current} if current else set()
         # Bound the walk defensively — compression chains this deep are
         # pathological and shouldn't happen in practice. 100 = plenty.
@@ -11102,13 +11859,21 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 )
                 row = cursor.fetchone()
             if row is None:
-                return current
+                return chain
             child_id = row["id"]
             if not child_id or child_id in seen:
-                return current
+                return chain
             seen.add(child_id)
             current = child_id
-        return current
+            chain.append(child_id)
+        return chain
+
+    def get_compression_tip(self, session_id: str) -> Optional[str]:
+        """The live tip of a compression-continuation chain (see
+        ``get_compression_chain`` for the walk's semantics). Returns the input
+        id when no continuation exists."""
+        chain = self.get_compression_chain(session_id)
+        return chain[-1] if chain else session_id
 
     # Columns excluded from compact_rows projections: only the payload-heavy
     # blob no list consumer renders. Everything else — including gateway
@@ -11486,12 +12251,15 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             # call per compression root. Batch that half instead: resolve
             # every tip id first, then fetch all tip rows in a single query.
             tip_ids_by_root: Dict[str, str] = {}
+            chain_by_root: Dict[str, List[str]] = {}
             for s in sessions:
                 if s.get("end_reason") != "compression":
                     continue
-                tip_id = self.get_compression_tip(s["id"])
+                chain = self.get_compression_chain(s["id"])
+                tip_id = chain[-1] if chain else s["id"]
                 if tip_id != s["id"]:
                     tip_ids_by_root[s["id"]] = tip_id
+                    chain_by_root[s["id"]] = chain
 
             tip_rows = (
                 self._get_session_rich_rows_batch(
@@ -11519,6 +12287,13 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     if key in tip_row:
                         merged[key] = tip_row[key]
                 merged["_lineage_root_id"] = s["id"]
+                # Every id on the chain, intermediates included. Root and tip
+                # alone are not enough client-side: a persisted tile or route
+                # can hold a MIDDLE segment's id (it was the tip when opened,
+                # then rotated again), and with only the root/tip pair such a
+                # surface can no longer prove it names this conversation —
+                # which is how one chat ends up open twice after compaction.
+                merged["_lineage_ids"] = chain_by_root.get(s["id"]) or None
                 projected.append(merged)
             sessions = projected
 
@@ -11675,6 +12450,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         turn_lease_ttl_seconds: float = 300.0,
         reject_active_turn_lease: bool = False,
         reject_active_compression_lock: bool = False,
+        allow_closed_compression_parent: bool = False,
     ) -> None:
         """Transcript-write admission checks, run INSIDE the write txn.
 
@@ -11774,6 +12550,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             session is not None
             and session["ended_at"] is not None
             and session["end_reason"] == "compression"
+            and not allow_closed_compression_parent
         ):
             raise CompressionSessionClosedError(session_id)
 
@@ -13411,11 +14188,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         halves the resume's DB work versus two separate calls, with byte-identical
         output (see test_get_resume_conversations_matches_separate_reads).
         """
-        session_ids = (
-            [session_id]
-            if self._is_explicit_branch_session(session_id)
-            else self._session_lineage_root_to_tip(session_id)
-        )
+        session_ids = self._resume_lineage_ids(session_id)
         with self._read_ctx() as conn:
             placeholders = ",".join("?" for _ in session_ids)
             rows = conn.execute(
@@ -13451,9 +14224,32 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         )
         return model_history, display_history
 
-    def get_resume_message_count(self, session_id: str) -> int:
-        """Count active rows that a full resume would materialize."""
-        session_ids = self._session_lineage_root_to_tip(session_id)
+    def _resume_lineage_ids(self, session_id: str) -> List[str]:
+        """Session ids a full (display) resume materializes for *session_id*.
+
+        Compression continuations need their ended ancestors' rows for the
+        display transcript; an explicit ``/branch`` copy already owns its
+        transcript, so its lineage is itself alone. This is the ONE definition
+        shared by the resume readers (``get_resume_conversations``,
+        ``get_ancestor_display_prefix``) and the resume guard
+        (``assert_resume_safe`` / ``get_resume_message_count``) — the guard must
+        count exactly the rows a resume would load, never a superset.
+        """
+        if self._is_explicit_branch_session(session_id):
+            return [session_id]
+        return self._session_lineage_root_to_tip(session_id)
+
+    def get_resume_message_count(
+        self, session_id: str, *, tip_only: bool = False
+    ) -> int:
+        """Count active rows that a resume would materialize.
+
+        ``tip_only=True`` counts only the tip segment — the set a model-history
+        restore loads (``get_messages_as_conversation`` without ancestors, or
+        the deferred Desktop resume that pages the display transcript over
+        REST and never materializes the ancestor prefix in memory).
+        """
+        session_ids = [session_id] if tip_only else self._resume_lineage_ids(session_id)
         placeholders = ",".join("?" for _ in session_ids)
         with self._read_ctx() as conn:
             row = conn.execute(
@@ -13467,12 +14263,24 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         self,
         session_id: str,
         max_messages: Optional[int] = None,
+        *,
+        tip_only: bool = False,
     ) -> int:
         """Return resume row count or reject a transcript too large to load.
 
         ``max_messages=None`` resolves the limit from config
         (``sessions.max_resume_messages``); 0 disables the guard and returns
         the (bounded) count without raising.
+
+        ``tip_only=True`` bounds only the tip segment, for callers that never
+        materialize the ancestor lineage in memory (tip-only model restore,
+        deferred Desktop resume whose display history is REST-paginated). A
+        heavily-compressed conversation — 85 compaction segments and ~29k
+        lineage rows behind a ~700-row tip — is exactly the shape compression
+        is supposed to produce; counting its whole lineage against a limit
+        sized for in-memory materialization rejected the healthiest sessions
+        (Desktop Bot Chat stuck on "Waking up…" with code 4130) while the
+        process would only ever have held the tip.
         """
         if max_messages is None:
             max_messages = resolved_max_resume_messages()
@@ -13484,7 +14292,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             # return value, and an unbounded lineage COUNT here would do the
             # exact pathological work the disable exists to avoid.
             return 0
-        session_ids = self._session_lineage_root_to_tip(session_id)
+        session_ids = [session_id] if tip_only else self._resume_lineage_ids(session_id)
         placeholders = ",".join("?" for _ in session_ids)
         with self._read_ctx() as conn:
             row = conn.execute(
@@ -13496,7 +14304,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             ).fetchone()
         message_count = int(row[0] if row else 0)
         if message_count > max_messages:
-            raise SessionResumeTooLargeError(message_count, max_messages)
+            raise SessionResumeTooLargeError(
+                message_count,
+                max_messages,
+                scope="in its tip segment" if tip_only else "across its lineage",
+            )
         return message_count
 
     def assert_export_safe(
@@ -13555,10 +14367,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         returns ONLY the genuine ancestor messages, identified by
         ``session_id != tip_session_id``. (#65919)
         """
-        if self._is_explicit_branch_session(session_id):
-            return []
-
-        session_ids = self._session_lineage_root_to_tip(session_id)
+        session_ids = self._resume_lineage_ids(session_id)
         if len(session_ids) <= 1:
             return []
         with self._read_ctx() as conn:
@@ -14768,6 +15577,14 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                    ) < ?"""
             )
             params.append(last_active_before)
+            # An automatic orphan sweep closes a stale open row so the user can
+            # still recover it. Age those rows from the sweep, not from their old
+            # activity, or the next prune pass can delete them immediately.
+            clauses.append(
+                "(COALESCE(s.end_reason, '') != 'startup_orphan_reap' "
+                "OR s.ended_at < ?)"
+            )
+            params.append(last_active_before)
         if last_active_after is not None:
             clauses.append(
                 """COALESCE(
@@ -15029,6 +15846,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         older_than_days: Optional[float] = 90,
         source: str = None,
         sessions_dir: Optional[Path] = None,
+        exclude_active_write_guards: bool = False,
         **filters,
     ) -> int:
         """Delete sessions matching the filters. Returns count deleted.
@@ -15066,6 +15884,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         on-disk transcript files (``.json`` / ``.jsonl`` /
         ``request_dump_*``) for every pruned session, outside the DB
         transaction.
+
+        ``exclude_active_write_guards`` is for destructive automatic
+        maintenance: rows protected by a live turn lease or compression lock
+        are skipped, while expired or provably dead holders are reclaimed and
+        fenced in the same write transaction.
         """
         self._apply_prune_age_filter(older_than_days, filters)
         where, where_params = self._prune_filter_where(source=source, **filters)
@@ -15077,6 +15900,26 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             )
             session_ids = {row["id"] for row in cursor.fetchall()}
 
+            if exclude_active_write_guards:
+                protected = set()
+                for sid in session_ids:
+                    try:
+                        self._check_transcript_write_guards(
+                            conn,
+                            sid,
+                            compression_lock_holder=None,
+                            turn_lease_holder=None,
+                            reject_active_turn_lease=True,
+                            reject_active_compression_lock=True,
+                            allow_closed_compression_parent=True,
+                        )
+                    except (
+                        SessionCompressionInProgressError,
+                        SessionTurnLeaseLostError,
+                    ):
+                        protected.add(sid)
+                session_ids.difference_update(protected)
+
             if not session_ids:
                 return 0
 
@@ -15313,12 +16156,22 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
           v1 — initial shape (no ON DELETE CASCADE on session_id FK)
           v2 — session_id FK gets ON DELETE CASCADE so session pruning
                automatically clears bindings.
+          v3 — ``profile_name`` dimension on both tables so multiplexed
+               gateways (shared ``state.db``) isolate topic mode/bindings
+               per Hermes profile (issue #76423).
         """
-        def _do(conn):
-            conn.executescript(
+        # (table, column list, DDL body). ``profile_name`` leads the primary
+        # key so multiplexed profiles sharing one state.db never collide on a
+        # private chat_id (which is the user id, identical across bots).
+        tables = (
+            (
+                "telegram_dm_topic_mode",
+                "profile_name, chat_id, user_id, enabled, activated_at, updated_at, "
+                "has_topics_enabled, allows_users_to_create_topics, "
+                "capability_checked_at, intro_message_id, pinned_message_id",
                 """
-                CREATE TABLE IF NOT EXISTS telegram_dm_topic_mode (
-                    chat_id TEXT PRIMARY KEY,
+                    profile_name TEXT NOT NULL DEFAULT 'default',
+                    chat_id TEXT NOT NULL,
                     user_id TEXT NOT NULL,
                     enabled INTEGER NOT NULL DEFAULT 1,
                     activated_at REAL NOT NULL,
@@ -15327,10 +16180,16 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     allows_users_to_create_topics INTEGER,
                     capability_checked_at REAL,
                     intro_message_id TEXT,
-                    pinned_message_id TEXT
-                );
-
-                CREATE TABLE IF NOT EXISTS telegram_dm_topic_bindings (
+                    pinned_message_id TEXT,
+                    PRIMARY KEY (profile_name, chat_id)
+                """,
+            ),
+            (
+                "telegram_dm_topic_bindings",
+                "profile_name, chat_id, thread_id, user_id, session_key, "
+                "session_id, managed_mode, linked_at, updated_at",
+                """
+                    profile_name TEXT NOT NULL DEFAULT 'default',
                     chat_id TEXT NOT NULL,
                     thread_id TEXT NOT NULL,
                     user_id TEXT NOT NULL,
@@ -15339,65 +16198,50 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     managed_mode TEXT NOT NULL DEFAULT 'auto',
                     linked_at REAL NOT NULL,
                     updated_at REAL NOT NULL,
-                    PRIMARY KEY (chat_id, thread_id)
-                );
+                    PRIMARY KEY (profile_name, chat_id, thread_id)
+                """,
+            ),
+        )
 
+        def _do(conn):
+            for table, columns, ddl in tables:
+                # Fresh installs get the v3 shape immediately.
+                conn.execute(f"CREATE TABLE IF NOT EXISTS {table} ({ddl})")
+                have = {row[1] for row in conn.execute(f"PRAGMA table_info('{table}')")}
+                if "profile_name" in have:
+                    continue
+                # Pre-profile shape (v1 or v2) → v3. SQLite can't ALTER a
+                # primary key (or a foreign key), so rebuild; this also
+                # supplies the v2 ON DELETE CASCADE for v1 bindings tables.
+                # Legacy rows land in the "default" namespace only — never
+                # replicated across profiles.
+                legacy_columns = columns.replace("profile_name, ", "", 1)
+                conn.executescript(
+                    f"""
+                    CREATE TABLE {table}_new ({ddl});
+                    INSERT INTO {table}_new ({columns})
+                        SELECT 'default', {legacy_columns} FROM {table};
+                    DROP TABLE {table};
+                    ALTER TABLE {table}_new RENAME TO {table};
+                    """
+                )
+
+            # Indexes after any rebuild so they always target the v3 shape
+            # (a legacy table lacking profile_name can't take the user index).
+            conn.executescript(
+                """
                 CREATE UNIQUE INDEX IF NOT EXISTS idx_telegram_dm_topic_bindings_session
                 ON telegram_dm_topic_bindings(session_id);
 
                 CREATE INDEX IF NOT EXISTS idx_telegram_dm_topic_bindings_user
-                ON telegram_dm_topic_bindings(user_id, chat_id);
+                ON telegram_dm_topic_bindings(profile_name, user_id, chat_id);
                 """
             )
 
-            # v1 → v2: rebuild telegram_dm_topic_bindings if its session_id FK
-            # lacks ON DELETE CASCADE. SQLite can't ALTER a foreign key, so we
-            # rebuild the table. Only runs once per DB (version gate).
-            current = conn.execute(
-                "SELECT value FROM state_meta WHERE key = ?",
-                ("telegram_dm_topic_schema_version",),
-            ).fetchone()
-            current_version = int(current[0]) if current and str(current[0]).isdigit() else 0
-            if current_version < 2:
-                fk_rows = conn.execute(
-                    "PRAGMA foreign_key_list('telegram_dm_topic_bindings')"
-                ).fetchall()
-                needs_rebuild = any(
-                    row[2] == "sessions" and (row[6] or "") != "CASCADE"
-                    for row in fk_rows
-                )
-                if needs_rebuild:
-                    conn.executescript(
-                        """
-                        CREATE TABLE telegram_dm_topic_bindings_new (
-                            chat_id TEXT NOT NULL,
-                            thread_id TEXT NOT NULL,
-                            user_id TEXT NOT NULL,
-                            session_key TEXT NOT NULL,
-                            session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-                            managed_mode TEXT NOT NULL DEFAULT 'auto',
-                            linked_at REAL NOT NULL,
-                            updated_at REAL NOT NULL,
-                            PRIMARY KEY (chat_id, thread_id)
-                        );
-                        INSERT INTO telegram_dm_topic_bindings_new
-                            SELECT chat_id, thread_id, user_id, session_key,
-                                   session_id, managed_mode, linked_at, updated_at
-                            FROM telegram_dm_topic_bindings;
-                        DROP TABLE telegram_dm_topic_bindings;
-                        ALTER TABLE telegram_dm_topic_bindings_new
-                            RENAME TO telegram_dm_topic_bindings;
-                        CREATE UNIQUE INDEX idx_telegram_dm_topic_bindings_session
-                            ON telegram_dm_topic_bindings(session_id);
-                        CREATE INDEX idx_telegram_dm_topic_bindings_user
-                            ON telegram_dm_topic_bindings(user_id, chat_id);
-                        """
-                    )
-
             conn.execute(
                 "INSERT INTO state_meta (key, value) VALUES (?, ?) "
                 "ON CONFLICT(key) DO UPDATE SET value = excluded.value",
-                ("telegram_dm_topic_schema_version", "2"),
+                ("telegram_dm_topic_schema_version", "3"),
             )
         self._execute_write(_do)
 
@@ -15406,6 +16250,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         *,
         chat_id: str,
         user_id: str,
+        profile_name: str = "default",
         has_topics_enabled: Optional[bool] = None,
         allows_users_to_create_topics: Optional[bool] = None,
     ) -> None:
@@ -15413,9 +16258,15 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
 
         This method intentionally owns the explicit topic migration. Ordinary
         SessionDB startup must not create these side tables.
+
+        ``profile_name`` namespaces rows under a shared multiplex ``state.db``
+        (issue #76423). Callers handling a multiplexed event must pass the
+        routed profile from ``source.profile``, not the process-global active
+        profile.
         """
         self.apply_telegram_topic_migration()
         now = time.time()
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
 
         def _to_int(value: Optional[bool]) -> Optional[int]:
             if value is None:
@@ -15426,11 +16277,11 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             conn.execute(
                 """
                 INSERT INTO telegram_dm_topic_mode (
-                    chat_id, user_id, enabled, activated_at, updated_at,
+                    profile_name, chat_id, user_id, enabled, activated_at, updated_at,
                     has_topics_enabled, allows_users_to_create_topics,
                     capability_checked_at
-                ) VALUES (?, ?, 1, ?, ?, ?, ?, ?)
-                ON CONFLICT(chat_id) DO UPDATE SET
+                ) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?)
+                ON CONFLICT(profile_name, chat_id) DO UPDATE SET
                     user_id = excluded.user_id,
                     enabled = 1,
                     updated_at = excluded.updated_at,
@@ -15439,6 +16290,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     capability_checked_at = excluded.capability_checked_at
                 """,
                 (
+                    profile_name,
                     str(chat_id),
                     str(user_id),
                     now,
@@ -15454,6 +16306,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         self,
         *,
         chat_id: str,
+        profile_name: str = "default",
         clear_bindings: bool = True,
     ) -> None:
         """Disable Telegram DM topic mode for one private chat.
@@ -15466,33 +16319,43 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         Never creates the topic-mode tables from scratch; if they don't
         exist there is nothing to disable and the call is a no-op.
         """
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
+
         def _do(conn):
             try:
                 conn.execute(
                     "UPDATE telegram_dm_topic_mode SET enabled = 0, updated_at = ? "
-                    "WHERE chat_id = ?",
-                    (time.time(), str(chat_id)),
+                    "WHERE profile_name = ? AND chat_id = ?",
+                    (time.time(), profile_name, str(chat_id)),
                 )
                 if clear_bindings:
                     conn.execute(
-                        "DELETE FROM telegram_dm_topic_bindings WHERE chat_id = ?",
-                        (str(chat_id),),
+                        "DELETE FROM telegram_dm_topic_bindings "
+                        "WHERE profile_name = ? AND chat_id = ?",
+                        (profile_name, str(chat_id)),
                     )
             except sqlite3.OperationalError:
                 # Tables don't exist yet — nothing to disable.
                 return
         self._execute_write(_do)
 
-    def is_telegram_topic_mode_enabled(self, *, chat_id: str, user_id: str) -> bool:
+    def is_telegram_topic_mode_enabled(
+        self,
+        *,
+        chat_id: str,
+        user_id: str,
+        profile_name: str = "default",
+    ) -> bool:
         """Return whether Telegram DM topic mode is enabled for this chat/user."""
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
         with self._read_ctx() as conn:
             try:
                 row = conn.execute(
                     """
                     SELECT enabled FROM telegram_dm_topic_mode
-                    WHERE chat_id = ? AND user_id = ?
+                    WHERE profile_name = ? AND chat_id = ? AND user_id = ?
                     """,
-                    (str(chat_id), str(user_id)),
+                    (profile_name, str(chat_id), str(user_id)),
                 ).fetchone()
             except sqlite3.OperationalError:
                 return False
@@ -15506,16 +16369,18 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         *,
         chat_id: str,
         thread_id: str,
+        profile_name: str = "default",
     ) -> Optional[Dict[str, Any]]:
         """Return the session binding for a Telegram DM topic, if present."""
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
         with self._read_ctx() as conn:
             try:
                 row = conn.execute(
                     """
                     SELECT * FROM telegram_dm_topic_bindings
-                    WHERE chat_id = ? AND thread_id = ?
+                    WHERE profile_name = ? AND chat_id = ? AND thread_id = ?
                     """,
-                    (str(chat_id), str(thread_id)),
+                    (profile_name, str(chat_id), str(thread_id)),
                 ).fetchone()
             except sqlite3.OperationalError:
                 return None
@@ -15525,18 +16390,21 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         self,
         *,
         chat_id: str,
+        profile_name: str = "default",
     ) -> List[Dict[str, Any]]:
         """All Telegram DM topic bindings for one chat, newest first.
 
         Read-only; returns [] if the bindings table doesn't exist yet
         (does not trigger the topic-mode migration).
         """
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
         with self._read_ctx() as conn:
             try:
                 rows = conn.execute(
                     "SELECT * FROM telegram_dm_topic_bindings "
-                    "WHERE chat_id = ? ORDER BY updated_at DESC",
-                    (str(chat_id),),
+                    "WHERE profile_name = ? AND chat_id = ? "
+                    "ORDER BY updated_at DESC",
+                    (profile_name, str(chat_id)),
                 ).fetchall()
             except sqlite3.OperationalError:
                 return []
@@ -15571,6 +16439,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         *,
         chat_id: str,
         thread_id: str,
+        profile_name: str = "default",
     ) -> int:
         """Remove the binding row for a single (chat, thread) pair.
 
@@ -15601,6 +16470,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         """
         chat_id = str(chat_id)
         thread_id = str(thread_id)
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
         deleted = {"count": 0}
 
         def _do(conn):
@@ -15608,9 +16478,9 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 cursor = conn.execute(
                     """
                     DELETE FROM telegram_dm_topic_bindings
-                    WHERE chat_id = ? AND thread_id = ?
+                    WHERE profile_name = ? AND chat_id = ? AND thread_id = ?
                     """,
-                    (chat_id, thread_id),
+                    (profile_name, chat_id, thread_id),
                 )
                 deleted["count"] = cursor.rowcount or 0
             except sqlite3.OperationalError:
@@ -15626,15 +16496,16 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 remaining = conn.execute(
                     """
                     SELECT 1 FROM telegram_dm_topic_bindings
-                    WHERE chat_id = ? LIMIT 1
+                    WHERE profile_name = ? AND chat_id = ? LIMIT 1
                     """,
-                    (chat_id,),
+                    (profile_name, chat_id),
                 ).fetchone()
                 if remaining is None:
                     conn.execute(
                         "UPDATE telegram_dm_topic_mode "
-                        "SET enabled = 0, updated_at = ? WHERE chat_id = ?",
-                        (time.time(), chat_id),
+                        "SET enabled = 0, updated_at = ? "
+                        "WHERE profile_name = ? AND chat_id = ?",
+                        (time.time(), profile_name, chat_id),
                     )
             except sqlite3.OperationalError:
                 # telegram_dm_topic_mode absent — binding prune still stands.
@@ -15652,6 +16523,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         session_key: str,
         session_id: str,
         managed_mode: str = "auto",
+        profile_name: str = "default",
     ) -> None:
         """Bind one Telegram DM topic thread to one Hermes session.
 
@@ -15666,28 +16538,38 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         user_id = str(user_id)
         session_key = str(session_key)
         session_id = str(session_id)
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
 
         def _do(conn):
             existing_session = conn.execute(
                 """
-                SELECT chat_id, thread_id FROM telegram_dm_topic_bindings
+                SELECT profile_name, chat_id, thread_id
+                FROM telegram_dm_topic_bindings
                 WHERE session_id = ?
                 """,
                 (session_id,),
             ).fetchone()
             if existing_session is not None:
-                linked_chat = existing_session["chat_id"] if isinstance(existing_session, sqlite3.Row) else existing_session[0]
-                linked_thread = existing_session["thread_id"] if isinstance(existing_session, sqlite3.Row) else existing_session[1]
-                if str(linked_chat) != chat_id or str(linked_thread) != thread_id:
+                if isinstance(existing_session, sqlite3.Row):
+                    linked_profile = existing_session["profile_name"]
+                    linked_chat = existing_session["chat_id"]
+                    linked_thread = existing_session["thread_id"]
+                else:
+                    linked_profile, linked_chat, linked_thread = existing_session
+                if (
+                    str(linked_profile) != profile_name
+                    or str(linked_chat) != chat_id
+                    or str(linked_thread) != thread_id
+                ):
                     raise ValueError("session is already linked to another Telegram topic")
 
             conn.execute(
                 """
                 INSERT INTO telegram_dm_topic_bindings (
-                    chat_id, thread_id, user_id, session_key, session_id,
+                    profile_name, chat_id, thread_id, user_id, session_key, session_id,
                     managed_mode, linked_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT(chat_id, thread_id) DO UPDATE SET
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                ON CONFLICT(profile_name, chat_id, thread_id) DO UPDATE SET
                     user_id = excluded.user_id,
                     session_key = excluded.session_key,
                     session_id = excluded.session_id,
@@ -15695,6 +16577,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     updated_at = excluded.updated_at
                 """,
                 (
+                    profile_name,
                     chat_id,
                     thread_id,
                     user_id,
@@ -15734,6 +16617,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         *,
         chat_id: str,
         user_id: str,
+        profile_name: str = "default",
         limit: int = 10,
     ) -> List[Dict[str, Any]]:
         """List previous Telegram sessions for this user that are not bound to a topic.
@@ -15742,7 +16626,13 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         topic-mode tables are absent, fall back to a simpler query that
         just returns this user's Telegram sessions — there can't be any
         bindings yet.
+
+        Scoped by ``profile_name`` so multiplexed profiles do not surface
+        each other's unlinked sessions (issue #76423).
         """
+        profile_name = _normalize_telegram_topic_profile_name(profile_name)
+        # sessions.profile_name is NULL/empty for legacy rows → treat as default.
+        profile_clause = "AND COALESCE(NULLIF(TRIM(s.profile_name), ''), 'default') = ?"
         with self._read_ctx() as conn:
             try:
                 rows = conn.execute(
@@ -15764,6 +16654,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                       ON sp.hash = s.system_prompt_hash
                     WHERE s.source = 'telegram'
                       AND s.user_id = ?
+                      {profile_clause}
                       AND NOT EXISTS (
                           SELECT 1 FROM telegram_dm_topic_bindings b
                           WHERE b.session_id = s.id
@@ -15771,7 +16662,7 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                     ORDER BY last_active DESC, s.started_at DESC
                     LIMIT ?
                     """,
-                    (str(user_id), int(limit)),
+                    (str(user_id), profile_name, int(limit)),
                 ).fetchall()
             except sqlite3.OperationalError:
                 # telegram_dm_topic_bindings doesn't exist yet — no bindings
@@ -15844,6 +16735,31 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             logger.debug("Could not read logical DB size: %s", exc)
             return None
 
+    def _freelist_ratio(self) -> Optional[float]:
+        """Fraction of database pages that are on the freelist (reclaimable).
+
+        ``PRAGMA freelist_count / PRAGMA page_count`` read over the existing
+        connection (never a byte-level probe of the live file — see
+        ``sqlite_safe_read``). This is what VACUUM would actually give back;
+        it is the gate :meth:`maybe_auto_prune_and_vacuum` uses to decide
+        whether a full rewrite pays off (#54189).
+
+        Returns None if the pragmas cannot be read (callers treat that as
+        "unknown" and fall back to the time throttle alone).
+        """
+        try:
+            with self._read_ctx() as conn:
+                if self._conn is None:
+                    return None
+                page_count = int(conn.execute("PRAGMA page_count").fetchone()[0])
+                freelist = int(conn.execute("PRAGMA freelist_count").fetchone()[0])
+            if page_count <= 0:
+                return 0.0
+            return freelist / page_count
+        except Exception as exc:
+            logger.debug("Could not read freelist ratio: %s", exc)
+            return None
+
     def vacuum(self) -> int:
         """Run VACUUM to reclaim disk space after large deletes.
 
@@ -15895,6 +16811,10 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 self._conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
             except Exception as exc:
                 logger.debug("WAL checkpoint (TRUNCATE) after VACUUM failed: %s", exc)
+            # TRUNCATE may replace the WAL inode; adopt the post-VACUUM
+            # sidecars so the write-path generation guard does not halt a
+            # healthy exclusive maintenance connection.
+            self._record_db_file_identity()
         return optimized
 
     def maybe_auto_prune_and_vacuum(
@@ -15904,30 +16824,59 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         vacuum: bool = True,
         sessions_dir: Optional[Path] = None,
         min_vacuum_interval_days: int = 30,
+        min_vacuum_freelist_ratio: float = AUTO_VACUUM_MIN_FREELIST_RATIO,
     ) -> Dict[str, Any]:
         """Idempotent auto-maintenance: prune inactive sessions + optional VACUUM.
 
         Records the last run timestamp in state_meta so subsequent calls
         within ``min_interval_hours`` no-op. VACUUM has its own, typically
         longer, throttle controlled by ``min_vacuum_interval_days`` so routine
-        pruning does not repeatedly rewrite the database. Designed to be
-        called once at startup from long-lived entrypoints (CLI, gateway, cron
-        scheduler).
+        pruning does not repeatedly rewrite the database, and is additionally
+        gated on the reclaimable fraction of the file: it only runs when
+        ``PRAGMA freelist_count / PRAGMA page_count`` exceeds
+        ``min_vacuum_freelist_ratio`` (default
+        :data:`AUTO_VACUUM_MIN_FREELIST_RATIO`, 25%), so pruning a few small
+        sessions on a dense multi-GB database never triggers a full rewrite
+        (#54189). Designed to be called once at startup from long-lived
+        entrypoints (CLI, gateway, cron scheduler).
 
         When *sessions_dir* is provided, on-disk transcript files
         (``.json`` / ``.jsonl`` / ``request_dump_*``) for pruned sessions
         are removed as part of the same sweep (issue #3015).
 
+        Stale-open reconciliation (#54189): several state-owned producers
+        (cron, kanban workers, subagents, one-shot CLI runs) never set
+        ``ended_at`` when their process dies, and ``prune_sessions`` only
+        deletes ended rows — so retention was a no-op exactly where growth
+        concentrates. After pruning, this pass closes open rows from
+        :attr:`_AUTO_PRUNE_STALE_OPEN_SOURCES` whose activity is older than
+        ``retention_days`` (``end_reason='startup_orphan_reap'``). Closed rows
+        stay resumable and are aged from their close, so they get one more
+        full retention window before a later pass deletes them. Messaging
+        and UI sources are never touched here.
+
         Never raises. On any failure, logs a warning and returns a dict
         with ``"error"`` set.
 
         Returns a dict with keys:
           - ``"skipped"`` (bool) — true if within min_interval_hours of last run
           - ``"pruned"`` (int)   — number of sessions deleted
+          - ``"closed"`` (int)   — stale open state-owned sessions marked ended
           - ``"vacuumed"`` (bool) — true if VACUUM ran
+          - ``"freelist_ratio"`` (float|None) — reclaimable fraction measured
+            when a VACUUM was considered (absent when it was not)
           - ``"error"`` (str, optional) — present only on failure
         """
-        result: Dict[str, Any] = {"skipped": False, "pruned": 0, "vacuumed": False}
+        result: Dict[str, Any] = {
+            "skipped": False,
+            "pruned": 0,
+            "closed": 0,
+            "vacuumed": False,
+        }
+        maintenance_lock = _try_acquire_auto_maintenance_lock(self.db_path)
+        if maintenance_lock is None:
+            result["skipped"] = True
+            return result
         try:
             # Skip if another process/call did maintenance recently.
             last_raw = self.get_meta("last_auto_prune")
@@ -15941,19 +16890,40 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 except (TypeError, ValueError):
                     pass  # corrupt meta; treat as no prior run
 
+            # Delete only sessions that were already explicitly closed. A
+            # startup orphan discovered by this pass is closed *after* pruning,
+            # preserving a full retention window in which it can be resumed.
             pruned = self.prune_sessions(
                 older_than_days=retention_days,
                 sessions_dir=sessions_dir,
+                exclude_active_write_guards=True,
             )
             result["pruned"] = pruned
 
-            # Only VACUUM if we actually freed rows, and no more often than
-            # once every min_vacuum_interval_days -- a large prune (e.g. the
-            # first one to cross retention_days on a DB with tens of
-            # thousands of rows) can free enough pages that pruned > 0 fires
-            # on every subsequent startup even though a VACUUM already ran
-            # recently. VACUUM on this DB's size (FTS5 shadow tables) is not
-            # cheap -- it holds an exclusive lock for the full rewrite.
+            # Reap stale state-owned rows only. Runtime-owned messaging sources
+            # are intentionally outside this automatic destructive scope.
+            closed = self.sweep_orphaned_sessions(
+                max_idle_seconds=float(retention_days) * 86400.0,
+                sources=self._AUTO_PRUNE_STALE_OPEN_SOURCES,
+                exclude_pinned=True,
+                # These sources are owned by state.db lifecycles, not by the
+                # dashboard/TUI gateway heartbeats used by startup recovery.
+                respect_gateway_heartbeats=False,
+            )
+            result["closed"] = len(closed)
+            # Only VACUUM if we actually freed rows, no more often than once
+            # every min_vacuum_interval_days, AND only when the rewrite pays
+            # off: the reclaimable fraction of the file (freelist_count /
+            # page_count) must exceed AUTO_VACUUM_MIN_FREELIST_RATIO (#54189).
+            # A large prune (e.g. the first one to cross retention_days on a
+            # DB with tens of thousands of rows) can free enough pages that
+            # pruned > 0 fires on every subsequent startup even though a
+            # VACUUM already ran recently; and pruning one tiny session on a
+            # dense multi-GB DB would otherwise rewrite the whole file to
+            # reclaim a few MB. VACUUM on this DB's size (FTS5 shadow tables)
+            # is not cheap -- it holds an exclusive lock for the full rewrite.
+            # The time throttle says "not too often"; the ratio gate says
+            # "only when it pays off". Both must pass.
             last_vacuum_raw = self.get_meta("last_vacuum")
             vacuum_due = True
             if last_vacuum_raw:
@@ -15962,20 +16932,32 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
                 except (TypeError, ValueError):
                     vacuum_due = True
             if vacuum and pruned > 0 and vacuum_due:
-                try:
-                    self.vacuum()
-                    result["vacuumed"] = True
-                    self.set_meta("last_vacuum", str(now))
-                except Exception as exc:
-                    logger.warning("state.db VACUUM failed: %s", exc)
+                ratio = self._freelist_ratio()
+                result["freelist_ratio"] = ratio
+                if ratio is None or ratio > min_vacuum_freelist_ratio:
+                    try:
+                        self.vacuum()
+                        result["vacuumed"] = True
+                        self.set_meta("last_vacuum", str(now))
+                    except Exception as exc:
+                        logger.warning("state.db VACUUM failed: %s", exc)
+                else:
+                    logger.debug(
+                        "state.db auto-maintenance: skipping VACUUM, only "
+                        "%.1f%% of pages reclaimable (threshold %.0f%%)",
+                        ratio * 100.0,
+                        min_vacuum_freelist_ratio * 100.0,
+                    )
 
             # Record the attempt even if pruned == 0, so we don't retry
             # every startup within the min_interval_hours window.
             self.set_meta("last_auto_prune", str(now))
 
-            if pruned > 0:
+            if closed or pruned > 0:
                 logger.info(
-                    "state.db auto-maintenance: pruned %d session(s) inactive for %d days%s",
+                    "state.db auto-maintenance: closed %d stale open session(s), "
+                    "pruned %d session(s) inactive for %d days%s",
+                    len(closed),
                     pruned,
                     retention_days,
                     " + VACUUM" if result["vacuumed"] else "",
@@ -15984,6 +16966,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             # Maintenance must never block startup. Log and return error marker.
             logger.warning("state.db auto-maintenance failed: %s", exc)
             result["error"] = str(exc)
+        finally:
+            _release_auto_maintenance_lock(maintenance_lock)
 
         return result
 
diff --git a/hermes_state_common.py b/hermes_state_common.py
index 2d2793bcf6..af12d322d3 100644
--- a/hermes_state_common.py
+++ b/hermes_state_common.py
@@ -7,6 +7,8 @@ hermes_state re-imports every name here for backward compatibility.
 """
 
 import contextlib
+import errno
+import json
 import logging
 import os
 import sys
@@ -352,7 +354,7 @@ def _sql_session_last_active_by_id(session_id_expr: str) -> str:
     )
 
 
-SCHEMA_VERSION = 26
+SCHEMA_VERSION = 28
 
 
 # FTS storage-layout version, tracked INDEPENDENTLY of SCHEMA_VERSION in the
@@ -443,12 +445,14 @@ CREATE TABLE IF NOT EXISTS sessions (
     compression_failure_error TEXT,
     compression_fallback_streak INTEGER NOT NULL DEFAULT 0,
     compression_ineffective_count INTEGER NOT NULL DEFAULT 0,
+    compression_recovery_deadline REAL,
     profile_name TEXT,
     rewind_count INTEGER NOT NULL DEFAULT 0,
     archived INTEGER NOT NULL DEFAULT 0,
     pinned INTEGER NOT NULL DEFAULT 0,
     hidden INTEGER NOT NULL DEFAULT 0,
     last_read_at REAL,
+    tool_names TEXT,
     FOREIGN KEY (parent_session_id) REFERENCES sessions(id),
     FOREIGN KEY (system_prompt_hash) REFERENCES system_prompts(hash)
 );
@@ -897,9 +901,15 @@ END;
 # Semantics mirror `hermes_state._cross_process_repair_lock` (the schema-
 # surgery authority): portable (msvcrt on Windows, flock elsewhere), bounded
 # wait, and FAIL CLOSED — a caller that cannot acquire the lock must NOT
-# rebuild. The kernel drops both lock types when the holder dies, so a crashed
-# rebuilder cannot wedge future rebuilds. It lives here (not hermes_state)
-# because the search/schema mixins cannot import hermes_state (cycle).
+# rebuild. The kernel drops both lock types when the holder dies — UNLESS a
+# forked child inherited the lock fd (flock rides the open file description,
+# which fork() duplicates), in which case the orphaned descriptor holds the
+# lock forever (issue #100108). `_acquire_db_flock` therefore records the
+# holder's pid + start time under the lock and, when the recorded holder is
+# provably dead, breaks the orphaned lock by unlinking and retaking it on a
+# fresh inode; indeterminate liveness still defers. It lives here (not
+# hermes_state) because the search/schema mixins cannot import hermes_state
+# (cycle).
 #
 # The lock file is `<db>.fts_rebuild.lock`, distinct from `<db>.repair.lock`:
 # schema surgery runs on an EXCLUSIVE offline connection and can legitimately
@@ -912,64 +922,365 @@ _FTS_REBUILD_LOCK_TIMEOUT_SECONDS = 120.0
 _FTS_REBUILD_LOCK_POLL_SECONDS = 0.1
 _IS_WINDOWS = sys.platform == "win32"
 
+# Post-break re-acquire budget: once a provably-orphaned lock has been broken
+# the fresh inode is uncontended (or contended only by live processes), so a
+# short bounded wait suffices — never re-enter the full timeout.
+_LOCK_BREAK_REACQUIRE_SECONDS = 5.0
+
+# errno set for "another process holds this advisory lock". flock() reports
+# contention as EWOULDBLOCK/EAGAIN; msvcrt.locking() as EACCES (and EDEADLK
+# when its internal retry gives up). Anything else — ESTALE on a dropped NFS
+# handle, ENOTSUP/ENOLCK on a filesystem without advisory locks, EIO — is a
+# persistent environment failure that no amount of polling turns into an
+# acquire. Treating every OSError as contention made such a failure look
+# like a live holder and burned the full 120s admission timeout on every
+# attempt (#100108, PR #100130).
+_LOCK_CONTENTION_ERRNOS = {errno.EAGAIN, errno.EACCES, errno.EWOULDBLOCK}
+if hasattr(errno, "EDEADLK"):
+    _LOCK_CONTENTION_ERRNOS.add(errno.EDEADLK)
+
+
+def is_advisory_lock_contention(exc: BaseException) -> bool:
+    """True when *exc* means another process holds the advisory lock.
+
+    False for every other ``OSError`` (ESTALE, ENOTSUP, ENOLCK, EIO, ...):
+    callers must fail closed IMMEDIATELY rather than poll to the deadline,
+    because retrying cannot succeed and the wait only stalls the caller.
+    """
+    if isinstance(exc, BlockingIOError):
+        return True
+    if not isinstance(exc, OSError):
+        return False
+    return exc.errno in _LOCK_CONTENTION_ERRNOS
+
+
+def _proc_start_ticks(pid: int):
+    """Kernel start time of *pid* in clock ticks, or None when unknowable.
+
+    Field 22 of ``/proc/<pid>/stat`` (``starttime``) uniquely identifies a
+    process together with its PID: a recycled PID gets a different start
+    time. Returns None off Linux or on any read/parse failure — callers must
+    treat None as "unknowable" and FAIL CLOSED.
+    """
+    try:
+        with open(f"/proc/{pid}/stat", "rb") as fh:
+            stat = fh.read()
+        # comm (field 2) may contain spaces/parens; split after the LAST ')'.
+        return int(stat.rsplit(b")", 1)[1].split()[19])
+    except (OSError, ValueError, IndexError):
+        return None
+
+
+def _read_lock_holder_record(handle):
+    """Best-effort parse of the holder metadata JSON in a lock file."""
+    try:
+        handle.seek(0)
+        raw = handle.read(4096)
+    except (OSError, ValueError):
+        return None
+    if not raw:
+        return None
+    try:
+        record = json.loads(raw.decode("utf-8", "replace"))
+    except (ValueError, UnicodeDecodeError):
+        return None
+    return record if isinstance(record, dict) else None
+
+
+def _write_lock_holder_record(handle) -> None:
+    """Record this process as the lock holder (advisory, best effort).
+
+    Written under the flock so contenders that time out can tell an
+    orphaned-fd holder (recorded process dead, flock inherited by a forked
+    child — issue #100108) from a live wedged holder.
+    """
+    try:
+        record = {
+            "pid": os.getpid(),
+            "start_ticks": _proc_start_ticks(os.getpid()),
+            "acquired_at": time.time(),
+        }
+        handle.seek(0)
+        handle.truncate()
+        handle.write(json.dumps(record, sort_keys=True).encode("utf-8"))
+        handle.flush()
+    except (OSError, ValueError):
+        pass
+
+
+def _clear_lock_holder_record(handle) -> None:
+    """Erase holder metadata before a normal release.
+
+    Guarantees that a surviving record always describes an ABNORMAL exit
+    (holder died without releasing), which is the only condition under which
+    a contender may break the lock.
+    """
+    try:
+        handle.seek(0)
+        handle.truncate()
+        handle.flush()
+    except (OSError, ValueError):
+        pass
+
+
+def _lock_holder_provably_dead(record) -> bool:
+    """True ONLY when the recorded holder is provably dead or PID-recycled.
+
+    Any indeterminate state (no record, malformed record, PID owned by
+    another user, /proc unavailable, start-time unknowable) returns False —
+    the caller must FAIL CLOSED and defer, never break a possibly-live
+    holder's lock.
+    """
+    if not isinstance(record, dict):
+        return False
+    try:
+        pid = int(record["pid"])
+    except (KeyError, TypeError, ValueError):
+        return False
+    if pid <= 0:
+        return False
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return True
+    except OSError:
+        # PermissionError et al.: the PID exists (or is unknowable) — closed.
+        return False
+    recorded_ticks = record.get("start_ticks")
+    if recorded_ticks is None:
+        return False
+    current_ticks = _proc_start_ticks(pid)
+    if current_ticks is None:
+        return False
+    # Same PID, different kernel start time: the recorded holder is dead and
+    # its PID was recycled by an unrelated process.
+    return current_ticks != recorded_ticks
+
+
+def _acquire_db_flock(lock_path, handle, timeout_seconds, poll_seconds, description):
+    """Bounded POSIX flock acquire with orphaned-holder staleness break.
+
+    Returns ``(acquired, handle)``; *handle* may have been re-opened (the
+    caller owns closing whichever handle comes back). *acquired* is True on
+    success, False when a holder kept the lock past the deadline, and None
+    when a non-contention ``OSError`` (ESTALE/ENOTSUP/EIO) made acquisition
+    impossible — already logged here; callers treat None as "not acquired"
+    without emitting the held-by-another-process warning.
+
+    Why breaking exists at all (issue #100108): ``flock`` belongs to the open
+    file DESCRIPTION, which ``fork()`` duplicates into every child. A holder
+    that forks (multiprocessing worker, daemonized helper) and then dies
+    leaves the flock held by a child that will never release it — the
+    kernel's holder-death release never triggers, and every contender defers
+    forever. The recorded-holder liveness check distinguishes exactly that
+    case: the process that ACQUIRED is provably dead (so its critical section
+    died with it), yet the flock is still held. Only then is the lock file
+    unlinked and retaken on a fresh inode; the orphan's flock stays on the
+    old unlinked inode where it blocks nobody. Every successful acquire
+    verifies its inode still names *lock_path*, so a racer that locked a dead
+    inode retries instead of running concurrently with the breaker.
+    Indeterminate liveness always defers (fail closed).
+    """
+    import fcntl
+
+    deadline = time.monotonic() + timeout_seconds
+    broke_lock = False
+    while True:
+        try:
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except (BlockingIOError, OSError) as exc:
+            if not is_advisory_lock_contention(exc):
+                # ESTALE / ENOTSUP / EIO: not a holder, and polling cannot
+                # fix it. Defer NOW instead of pretending a live process
+                # held the lock for the whole timeout (#100108).
+                logger.warning(
+                    "Could not acquire %s %s (%s) — deferring rather than "
+                    "waiting out the %.0fs holder timeout on a "
+                    "non-contention error.",
+                    description,
+                    lock_path,
+                    exc,
+                    timeout_seconds,
+                )
+                return None, handle
+            if time.monotonic() < deadline:
+                time.sleep(poll_seconds)
+                continue
+            if broke_lock:
+                return False, handle
+            record = _read_lock_holder_record(handle)
+            if not _lock_holder_provably_dead(record):
+                return False, handle
+            logger.warning(
+                "%s %s is held by an orphaned file descriptor (recorded "
+                "holder pid %s is dead — a forked child inherited the lock "
+                "fd); breaking the stale lock and retaking it on a fresh "
+                "file.",
+                description,
+                lock_path,
+                (record or {}).get("pid"),
+            )
+            try:
+                os.unlink(lock_path)
+                handle.close()
+                handle = open(lock_path, "a+b")
+            except OSError as exc:
+                logger.warning(
+                    "Could not break stale %s %s (%s) — deferring.",
+                    description,
+                    lock_path,
+                    exc,
+                )
+                return False, handle
+            broke_lock = True
+            deadline = time.monotonic() + _LOCK_BREAK_REACQUIRE_SECONDS
+            continue
+        # flock acquired — verify the path still names our inode: a breaker
+        # may have unlinked/replaced the file while we waited, and a lock on
+        # a dead inode excludes nobody.
+        try:
+            fd_stat = os.fstat(handle.fileno())
+            path_stat = os.stat(lock_path)
+            same_file = (
+                fd_stat.st_dev == path_stat.st_dev
+                and fd_stat.st_ino == path_stat.st_ino
+            )
+        except OSError:
+            same_file = False
+        if same_file:
+            _write_lock_holder_record(handle)
+            return True, handle
+        try:
+            handle.close()
+            handle = open(lock_path, "a+b")
+        except OSError:
+            return False, handle
+        if time.monotonic() >= deadline:
+            return False, handle
+
+
+def _describe_lock_holder(record) -> str:
+    """Human-readable holder identity for deferral warnings."""
+    if not isinstance(record, dict) or "pid" not in record:
+        return "unknown (no holder record; pre-fix writer or non-Hermes)"
+    pid = record.get("pid")
+    acquired_at = record.get("acquired_at")
+    age = ""
+    try:
+        if acquired_at is not None:
+            age = f", acquired {time.time() - float(acquired_at):.0f}s ago"
+    except (TypeError, ValueError):
+        pass
+    return f"pid {pid}{age}"
+
 
 @contextlib.contextmanager
-def fts_rebuild_admission(db_path):
+def fts_rebuild_admission(db_path, *, timeout_seconds=None):
     """Serialize full structural FTS rebuilds on *db_path* across processes.
 
     Yields True when this process holds the rebuild authority, False when the
-    bounded acquire timed out. A caller that gets False must NOT perform a
-    full rebuild — proceeding is exactly the concurrent-rebuild interleaving
-    this lock exists to prevent (fail closed). The deferred/stale breadcrumb
-    machinery already guarantees a skipped rebuild is retried later.
+    bounded acquire timed out or the lock file could not be opened at all. A
+    caller that gets False must NOT perform a full rebuild — proceeding is
+    exactly the concurrent-rebuild interleaving this lock exists to prevent
+    (fail closed). The deferred/stale breadcrumb machinery already guarantees
+    a skipped rebuild is retried later.
 
     ``db_path`` may be a str or Path; None (in-memory DB / tests without a
     file path) yields True — a private in-memory DB has no cross-process
     surface.
+
+    *timeout_seconds* defaults to ``_FTS_REBUILD_LOCK_TIMEOUT_SECONDS``.
+    Opportunistic in-process retries (``retry_deferred_fts_recovery``) pass
+    ``0`` so a live holder never stalls a long-lived writer for two minutes;
+    the orphaned-holder break still applies on the single attempt.
     """
     if db_path is None:
         yield True
         return
+    timeout = (
+        _FTS_REBUILD_LOCK_TIMEOUT_SECONDS
+        if timeout_seconds is None
+        else max(float(timeout_seconds), 0.0)
+    )
     lock_path = f"{db_path}.fts_rebuild.lock"
     try:
         handle = open(lock_path, "a+b")
     except OSError as exc:
-        # Read-only dir, exhausted fds, exotic filesystem: fall back to the
-        # pre-lock behaviour rather than refusing a rebuild we could run.
+        # Fail closed, exactly as a timed-out acquire does. A lock file we
+        # cannot even open means the filesystem is out of space, inodes or
+        # descriptors — and a sibling process that opened ITS handle before
+        # the disk filled is still holding the authority and rebuilding.
+        # Yielding True here handed every process on a full disk a concurrent
+        # structural rebuild of the same live state.db with no cross-process
+        # authority at all: the disk-full trigger and the re-corruption on
+        # every multi-writer boot in #100368. Deferring costs nothing that
+        # was reachable anyway — the breadcrumb retries, and on a read-only
+        # directory the rebuild's own writes could not have committed either.
         logger.warning(
-            "Could not open FTS rebuild lock %s (%s) — proceeding with "
-            "in-process serialisation only.", lock_path, exc,
+            "Could not open FTS rebuild lock %s (%s) — deferring this rebuild "
+            "rather than running it without cross-process authority.",
+            lock_path, exc,
         )
-        yield True
+        yield False
         return
 
     acquired = False
     try:
-        deadline = time.monotonic() + _FTS_REBUILD_LOCK_TIMEOUT_SECONDS
-        while True:
-            try:
-                if _IS_WINDOWS:
+        if _IS_WINDOWS:
+            deadline = time.monotonic() + timeout
+            while True:
+                try:
                     import msvcrt
 
                     handle.seek(0)
                     msvcrt.locking(handle.fileno(), msvcrt.LK_NBLCK, 1)
-                else:
-                    import fcntl
-
-                    fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-                acquired = True
-                break
-            except (BlockingIOError, OSError):
-                if time.monotonic() >= deadline:
+                    acquired = True
                     break
-                time.sleep(_FTS_REBUILD_LOCK_POLL_SECONDS)
-        if not acquired:
-            logger.warning(
-                "FTS rebuild lock %s held by another process for more than "
-                "%.0fs — deferring this rebuild to avoid racing the holder "
-                "(the stale-FTS breadcrumb keeps it retryable).",
-                lock_path, _FTS_REBUILD_LOCK_TIMEOUT_SECONDS,
+                except (BlockingIOError, OSError) as exc:
+                    if not is_advisory_lock_contention(exc):
+                        logger.warning(
+                            "Could not acquire FTS rebuild lock %s (%s) — "
+                            "deferring on a non-contention error.",
+                            lock_path, exc,
+                        )
+                        acquired = None
+                        break
+                    if time.monotonic() >= deadline:
+                        break
+                    time.sleep(_FTS_REBUILD_LOCK_POLL_SECONDS)
+        else:
+            acquired, handle = _acquire_db_flock(
+                lock_path,
+                handle,
+                timeout,
+                _FTS_REBUILD_LOCK_POLL_SECONDS,
+                "FTS rebuild lock",
             )
+        if acquired is None:
+            # Non-contention failure: already logged with the real errno;
+            # a "held by another process" line here would be a lie.
+            acquired = False
+        elif not acquired:
+            record = None if _IS_WINDOWS else _read_lock_holder_record(handle)
+            if timeout <= 0:
+                # Non-blocking probe from an in-process retry: a busy lock
+                # is expected and will be tried again, so keep it quiet.
+                logger.info(
+                    "FTS rebuild lock %s is busy — deferring this retry "
+                    "(the stale-FTS breadcrumb keeps it retryable). "
+                    "Recorded holder: %s.",
+                    lock_path,
+                    _describe_lock_holder(record),
+                )
+            else:
+                logger.warning(
+                    "FTS rebuild lock %s held by another process for more than "
+                    "%.0fs — deferring this rebuild to avoid racing the holder "
+                    "(the stale-FTS breadcrumb keeps it retryable). "
+                    "Recorded holder: %s.",
+                    lock_path, timeout,
+                    _describe_lock_holder(record),
+                )
         yield acquired
     finally:
         try:
@@ -982,6 +1293,7 @@ def fts_rebuild_admission(db_path):
                 else:
                     import fcntl
 
+                    _clear_lock_holder_record(handle)
                     fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
         except OSError:  # pragma: no cover - best effort release
             pass
diff --git a/hermes_state_registry.py b/hermes_state_registry.py
index 3c5b6ec24e..0f3bcedc20 100644
--- a/hermes_state_registry.py
+++ b/hermes_state_registry.py
@@ -42,7 +42,7 @@ from __future__ import annotations
 import logging
 import threading
 from pathlib import Path
-from typing import TYPE_CHECKING, Dict, Optional, Tuple
+from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
 
 if TYPE_CHECKING:  # pragma: no cover - import cycle guard, typed only
     from hermes_state import SessionDB
@@ -91,6 +91,11 @@ _lock = threading.Lock()
 _generations: Dict[Path, _Generation] = {}
 # Object-keyed retired generations still draining holders.
 _retired: Dict[int, _Generation] = {}  # id(db) → generation
+# Paths whose next generation is currently being constructed.  Construction
+# stays outside _lock because schema reconciliation can take seconds, but peers
+# for the SAME file must wait: otherwise every cold caller opens a writable
+# SQLite connection before the registry chooses one winner.
+_opening: Dict[Path, threading.Event] = {}
 
 
 def _open_session_db(path: Path) -> "SessionDB":
@@ -132,42 +137,67 @@ def acquire(db_path: Optional[Path] = None) -> "SessionDB":
     """
     from hermes_state import _default_db_path
 
-    path = Path(db_path) if db_path is not None else Path(_default_db_path())
+    raw_path = Path(db_path) if db_path is not None else Path(_default_db_path())
+    try:
+        path = raw_path.resolve()
+    except OSError:
+        path = raw_path
 
-    with _lock:
-        generation = _generations.get(path)
-        if generation is not None:
-            current = _stat_db_file_identity(path)
-            if (
-                current is not None
-                and generation.identity is not None
-                and current != generation.identity
-            ):
-                # File replaced: retire the live generation (its
-                # holders keep it until they release) and fall
-                # through to opening a fresh one below.
-                _retire_generation_locked(path, generation)
-            else:
-                generation.refcount += 1
-                return generation.db
+    while True:
+        with _lock:
+            generation = _generations.get(path)
+            if generation is not None:
+                current = _stat_db_file_identity(path)
+                if (
+                    current is not None
+                    and generation.identity is not None
+                    and current != generation.identity
+                ):
+                    # File replaced: retire the live generation (its
+                    # holders keep it until they release) and elect one
+                    # caller to construct the replacement below.
+                    _retire_generation_locked(path, generation)
+                else:
+                    generation.refcount += 1
+                    return generation.db
+
+            opening = _opening.get(path)
+            if opening is None:
+                opening = threading.Event()
+                _opening[path] = opening
+                break
+
+        # Another caller is constructing this path.  Do not hold the global
+        # registry lock while waiting: unrelated databases continue opening.
+        # A failed opener signals too, so one waiter can retry as the successor.
+        opening.wait()
+
+    # Open a fresh generation OUTSIDE the lock.  The per-path opening marker
+    # prevents redundant writer connections without serialising other files.
+    try:
+        db = _open_session_db(path)
+        db._shared_registry_owned = True
+        identity = _stat_db_file_identity(path)
+    except BaseException:
+        with _lock:
+            if _opening.get(path) is opening:
+                _opening.pop(path, None)
+            opening.set()
+        raise
 
-    # Open a fresh generation OUTSIDE the lock: construction can
-    # take seconds (write-lock patience) and must not block every
-    # other state.db acquisition in the process.
-    db = _open_session_db(path)
-    db._shared_registry_owned = True
-    identity = _stat_db_file_identity(path)
     with _lock:
         existing = _generations.get(path)
         if existing is not None:
-            # Someone else opened a generation while we were
-            # constructing (or retired ours and installed a new one).
-            # Ours loses — close it (outside the lock) and use theirs.
+            # Defensive: a generation may have been installed by explicit
+            # registry manipulation while this open was in flight.
             existing.refcount += 1
             winner = existing.db
         else:
             _generations[path] = _Generation(db, identity)
             winner = db
+        if _opening.get(path) is opening:
+            _opening.pop(path, None)
+        opening.set()
     if winner is not db:
         _teardown(db)
     return winner
@@ -259,6 +289,18 @@ def close_all() -> int:
     return closed
 
 
+def live_shared_session_dbs() -> List["SessionDB"]:
+    """Snapshot of every live (non-retired) shared SessionDB in this process.
+
+    For periodic in-process maintenance (the gateway housekeeping tick's
+    deferred-FTS retry). Refcounts are NOT touched: the caller only invokes
+    a method on an instance that some holder already keeps alive; a
+    concurrent final release closes it and the callee sees ``_conn is None``.
+    """
+    with _lock:
+        return [g.db for g in _generations.values() if not g.retired]
+
+
 def stats() -> Dict[str, int]:
     """Registry census for tests and diagnostics (no locks held long)."""
     with _lock:
diff --git a/hermes_state_schema.py b/hermes_state_schema.py
index 9813b12785..01801a4870 100644
--- a/hermes_state_schema.py
+++ b/hermes_state_schema.py
@@ -43,6 +43,15 @@ logger = logging.getLogger("hermes_state")
 
 _FTS_HOLDER_ESCALATE_ATTEMPTS = 3
 _FTS_HOLDER_ESCALATE_SECONDS = 60.0
+# Minimum spacing between in-process retries of a deferred stale-FTS rebuild
+# (``retry_deferred_fts_recovery``). The startup open already paid the full
+# admission wait once; later retries are non-blocking probes on this cadence
+# so a live holder never stalls a long-lived writer.
+_FTS_STALE_RETRY_SECONDS = 60.0
+# Each failed retry doubles the spacing up to this cap, so a holder that never
+# goes away (a second long-lived writer) costs one deferral warning per hour,
+# not one per minute. A successful rebuild clears the stale state entirely.
+_FTS_STALE_RETRY_MAX_SECONDS = 3600.0
 
 # Cache for schema_read_probe_statements() — parsing SCHEMA_SQL spins up an
 # in-memory SQLite database, so derive the statements once per process.
@@ -422,8 +431,14 @@ class SessionSchemaMixin:
             )
             return None
 
-    def _recover_stale_fts(self, cursor: sqlite3.Cursor, *, legacy: bool) -> bool:
-        """Atomically rebuild stale base/trigram indexes and resume syncing."""
+    def _recover_stale_fts(
+        self, cursor: sqlite3.Cursor, *, legacy: bool, timeout_seconds=None
+    ) -> bool:
+        """Atomically rebuild stale base/trigram indexes and resume syncing.
+
+        *timeout_seconds* bounds the cross-process admission wait; None uses
+        the full startup budget, ``0`` is the non-blocking in-process retry.
+        """
         foreign_holders = self._foreign_state_db_holders()
         if foreign_holders:
             now = time.time()
@@ -502,7 +517,9 @@ class SessionSchemaMixin:
         # authority (fail closed). Losing the race means another process is
         # already performing this exact recovery; the stale breadcrumb stays
         # set, so this process simply keeps FTS detached and retries later.
-        with fts_rebuild_admission(getattr(self, "db_path", None)) as admitted:
+        with fts_rebuild_admission(
+            getattr(self, "db_path", None), timeout_seconds=timeout_seconds
+        ) as admitted:
             if not admitted:
                 logger.warning(
                     "Deferred stale state.db FTS rebuild: another process "
@@ -512,6 +529,66 @@ class SessionSchemaMixin:
                 return False
             return self._recover_stale_fts_locked(cursor, legacy=legacy)
 
+    def retry_deferred_fts_recovery(self) -> bool:
+        """Retry a deferred stale-FTS rebuild on this open SessionDB.
+
+        ``_recover_stale_fts`` runs at open and fails closed when foreign
+        holders or the rebuild lock are busy, leaving ``_fts_stale`` set and
+        search on the LIKE fallback. Live write/search paths must never start
+        a full rebuild (#97940), so on a short-lived CLI that deferral is
+        cleared by the next process open — but a gateway opens state.db
+        once and stays up for days, so "next open" never came (#100108).
+        This is the in-process retry: bounded backoff from
+        ``_FTS_STALE_RETRY_SECONDS`` doubling to ``_FTS_STALE_RETRY_MAX_SECONDS``,
+        non-blocking admission (``timeout=0``) so a live holder is skipped and
+        tried again later, no new thread — the caller is an existing periodic
+        tick (gateway housekeeping).
+
+        Returns True only when the index was rebuilt and sync triggers
+        restored. Never raises.
+        """
+        if not getattr(self, "_fts_stale", False):
+            return False
+        if getattr(self, "read_only", False) or getattr(self, "_conn", None) is None:
+            return False
+        now = time.monotonic()
+        if now < getattr(self, "_fts_stale_retry_after", 0.0):
+            return False
+        interval = float(getattr(self, "_fts_stale_retry_interval", 0.0))
+        if interval <= 0.0:
+            interval = _FTS_STALE_RETRY_SECONDS
+        self._fts_stale_retry_after = now + interval
+        self._fts_stale_retry_interval = min(
+            max(interval, _FTS_STALE_RETRY_SECONDS, 1.0) * 2.0,
+            _FTS_STALE_RETRY_MAX_SECONDS,
+        )
+        try:
+            with self._lock:
+                if self._conn is None or not self._fts_stale:
+                    return False
+                cursor = self._conn.cursor()
+                legacy = self._db_has_legacy_inline_fts(cursor)
+                recovered = self._recover_stale_fts(
+                    cursor, legacy=legacy, timeout_seconds=0.0
+                )
+                if recovered:
+                    # CJK was detached alongside the base indexes; its own
+                    # ensure path decides when it comes back online.
+                    self._ensure_fts_cjk_schema(cursor)
+                    self._fts_stale_retry_interval = 0.0
+                try:
+                    self._conn.commit()
+                except sqlite3.Error:
+                    pass
+                return recovered
+        except Exception:  # noqa: BLE001 - background retry must never raise
+            logger.warning(
+                "In-process retry of the deferred stale state.db FTS rebuild "
+                "failed; will retry later.",
+                exc_info=True,
+            )
+            return False
+
     def _recover_stale_fts_locked(
         self, cursor: sqlite3.Cursor, *, legacy: bool
     ) -> bool:
@@ -1510,7 +1587,8 @@ class SessionSchemaMixin:
         breadcrumb is persisted, mirroring ``_enter_fts_fail_open``'s
         ordering contract: triggers must never be live over an index with an
         unrebuilt gap. FTS stays detached for this instance; the winner's
-        rebuild — or ``_recover_stale_fts`` at the next startup — restores
+        rebuild — or ``retry_deferred_fts_recovery`` from the gateway
+        housekeeping tick, or ``_recover_stale_fts`` at the next startup — restores
         the index and triggers atomically.
         """
         with fts_rebuild_admission(getattr(self, "db_path", None)) as admitted:
diff --git a/hermes_state_search.py b/hermes_state_search.py
index 40fddb70fd..3dafeebc4a 100644
--- a/hermes_state_search.py
+++ b/hermes_state_search.py
@@ -2382,7 +2382,9 @@ class SessionSearchMixin:
         FAILS CLOSED: if another process holds the rebuild lock beyond the
         bounded wait, this call defers (returns 0) rather than racing it.
         Callers already treat 0 as "rebuild made no progress" and fall back
-        to the stale-FTS breadcrumb path, which retries at next startup.
+        to the stale-FTS breadcrumb path, which retries in-process from the
+        gateway housekeeping tick (``retry_deferred_fts_recovery``) and at
+        next startup.
 
         Safe to call when FTS tables don't exist (skips them).
         Returns the number of FTS indexes that were rebuilt.
diff --git a/locales/af.yaml b/locales/af.yaml
index 21806156ab..363563e9a4 100644
--- a/locales/af.yaml
+++ b/locales/af.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nHuidige modus: `{mode}`\\n\\nKies \\'n opsie:"
     choice_fast:           "fast — Priority Processing aan"
     choice_normal:         "normal — standaardverwerking"
+    choice_auto:           "auto — vinnig vir die eerste sekondes van elke beurt"
+    choice_cold:           "cold — vinnig slegs vir die eerste beurt van 'n sessie"
 
   footer:
     status:                "📎 Looptyd-voetstuk: **{state}**\nVelde: `{fields}`\nPlatform: `{platform}`"
diff --git a/locales/ar.yaml b/locales/ar.yaml
index 1f68628a3b..abdc371ead 100644
--- a/locales/ar.yaml
+++ b/locales/ar.yaml
@@ -160,6 +160,8 @@ gateway:
     picker_title:          "⚡ **المعالجة ذات الأولوية**\n\nالوضع الحالي: `{mode}`\n\nاختر خيارًا:"
     choice_fast:           "fast — المعالجة ذات الأولوية مُفعّلة"
     choice_normal:         "normal — المعالجة القياسية"
+    choice_auto:           "auto — سريع في الثواني الأولى من كل دور"
+    choice_cold:           "cold — سريع في الدور الأول من الجلسة فقط"
 
   footer:
     status:                "📎 تذييل التشغيل: **{state}**\nالحقول: `{fields}`\nالمنصّة: `{platform}`"
diff --git a/locales/de.yaml b/locales/de.yaml
index bc00bfe32f..d6e1528088 100644
--- a/locales/de.yaml
+++ b/locales/de.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nAktueller Modus: `{mode}`\\n\\nOption wählen:"
     choice_fast:           "fast — Priority Processing an"
     choice_normal:         "normal — Standardverarbeitung"
+    choice_auto:           "auto — schnell in den ersten Sekunden jedes Zugs"
+    choice_cold:           "cold — schnell nur im ersten Zug einer Sitzung"
 
   footer:
     status:                "📎 Laufzeit-Fußzeile: **{state}**\nFelder: `{fields}`\nPlattform: `{platform}`"
diff --git a/locales/en.yaml b/locales/en.yaml
index 2adac023f2..9b06ae1e96 100644
--- a/locales/en.yaml
+++ b/locales/en.yaml
@@ -141,8 +141,8 @@ gateway:
 
   fast:
     not_supported:         "⚡ /fast is only available for OpenAI models that support Priority Processing."
-    status:                "⚡ Priority Processing\n\nCurrent mode: `{mode}`\n\n_Usage:_ `/fast <normal|fast|status>`"
-    unknown_arg:           "⚠️ Unknown argument: `{arg}`\n\n**Valid options:** normal, fast, status"
+    status:                "⚡ Priority Processing\n\nCurrent mode: `{mode}`\n\n_Usage:_ `/fast <normal|fast|auto|cold|status>`"
+    unknown_arg:           "⚠️ Unknown argument: `{arg}`\n\n**Valid options:** normal, fast, auto, cold, status"
     saved:                 "⚡ ✓ Priority Processing: **{label}** (saved to config)\n_(takes effect on next message)_"
     session_only:          "⚡ ✓ Priority Processing: **{label}** (this session only)"
     label_fast:            "FAST"
@@ -152,6 +152,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\n\nCurrent mode: `{mode}`\n\nPick an option:"
     choice_fast:           "fast — Priority Processing on"
     choice_normal:         "normal — standard processing"
+    choice_auto:           "auto — fast for the first seconds of every turn"
+    choice_cold:           "cold — fast for the first turn of a session only"
 
   footer:
     status:                "📎 Runtime footer: **{state}**\nFields: `{fields}`\nPlatform: `{platform}`"
diff --git a/locales/es.yaml b/locales/es.yaml
index 6b06a52afb..06cd2e9e23 100644
--- a/locales/es.yaml
+++ b/locales/es.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nModo actual: `{mode}`\\n\\nElige una opción:"
     choice_fast:           "fast — Priority Processing activado"
     choice_normal:         "normal — procesamiento estándar"
+    choice_auto:           "auto — rápido en los primeros segundos de cada turno"
+    choice_cold:           "cold — rápido solo en el primer turno de una sesión"
 
   footer:
     status:                "📎 Pie de ejecución: **{state}**\nCampos: `{fields}`\nPlataforma: `{platform}`"
diff --git a/locales/fr.yaml b/locales/fr.yaml
index 4ce9760969..4f1faa6cbf 100644
--- a/locales/fr.yaml
+++ b/locales/fr.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nMode actuel : `{mode}`\\n\\nChoisissez une option :"
     choice_fast:           "fast — Priority Processing activé"
     choice_normal:         "normal — traitement standard"
+    choice_auto:           "auto — rapide pendant les premières secondes de chaque tour"
+    choice_cold:           "cold — rapide uniquement au premier tour d'une session"
 
   footer:
     status:                "📎 Pied de page d'exécution : **{state}**\nChamps : `{fields}`\nPlateforme : `{platform}`"
diff --git a/locales/ga.yaml b/locales/ga.yaml
index 92ef5363ea..843dc5a1c2 100644
--- a/locales/ga.yaml
+++ b/locales/ga.yaml
@@ -141,6 +141,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nMód reatha: `{mode}`\\n\\nRoghnaigh rogha:"
     choice_fast:           "fast — Priority Processing ar siúl"
     choice_normal:         "normal — gnáthphróiseáil"
+    choice_auto:           "auto — tapa do na chéad soicindí de gach seal"
+    choice_cold:           "cold — tapa don chéad seal de sheisiún amháin"
 
   footer:
     status:                "📎 Buntásc rite: **{state}**\nRéimsí: `{fields}`\nArdán: `{platform}`"
diff --git a/locales/hu.yaml b/locales/hu.yaml
index b8feb1b994..d134d4372f 100644
--- a/locales/hu.yaml
+++ b/locales/hu.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nJelenlegi mód: `{mode}`\\n\\nVálassz egy opciót:"
     choice_fast:           "fast — Priority Processing bekapcsolva"
     choice_normal:         "normal — normál feldolgozás"
+    choice_auto:           "auto — gyors minden kör első másodperceiben"
+    choice_cold:           "cold — gyors csak a munkamenet első körében"
 
   footer:
     status:                "📎 Futási idejű lábléc: **{state}**\nMezők: `{fields}`\nPlatform: `{platform}`"
diff --git a/locales/it.yaml b/locales/it.yaml
index 758be5d8a7..a3480541bc 100644
--- a/locales/it.yaml
+++ b/locales/it.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nModalità attuale: `{mode}`\\n\\nScegli un\\'opzione:"
     choice_fast:           "fast — Priority Processing attivo"
     choice_normal:         "normal — elaborazione standard"
+    choice_auto:           "auto — veloce nei primi secondi di ogni turno"
+    choice_cold:           "cold — veloce solo nel primo turno di una sessione"
 
   footer:
     status:                "📎 Footer di runtime: **{state}**\nCampi: `{fields}`\nPiattaforma: `{platform}`"
diff --git a/locales/ja.yaml b/locales/ja.yaml
index 28b41682aa..b691daf93d 100644
--- a/locales/ja.yaml
+++ b/locales/ja.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\n現在のモード: `{mode}`\\n\\nオプションを選択:"
     choice_fast:           "fast — Priority Processing オン"
     choice_normal:         "normal — 標準処理"
+    choice_auto:           "auto — 各ターンの最初の数秒間だけ高速"
+    choice_cold:           "cold — セッションの最初のターンのみ高速"
 
   footer:
     status:                "📎 ランタイムフッター: **{state}**\nフィールド: `{fields}`\nプラットフォーム: `{platform}`"
diff --git a/locales/ko.yaml b/locales/ko.yaml
index ecf58bbc68..f7f4f25a06 100644
--- a/locales/ko.yaml
+++ b/locales/ko.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\n현재 모드: `{mode}`\\n\\n옵션을 선택하세요:"
     choice_fast:           "fast — Priority Processing 켜기"
     choice_normal:         "normal — 표준 처리"
+    choice_auto:           "auto — 매 턴의 처음 몇 초 동안 빠름"
+    choice_cold:           "cold — 세션의 첫 턴에만 빠름"
 
   footer:
     status:                "📎 런타임 푸터: **{state}**\n필드: `{fields}`\n플랫폼: `{platform}`"
diff --git a/locales/pt.yaml b/locales/pt.yaml
index 1ac1fd4b00..f18100340e 100644
--- a/locales/pt.yaml
+++ b/locales/pt.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nModo atual: `{mode}`\\n\\nEscolha uma opção:"
     choice_fast:           "fast — Priority Processing ativado"
     choice_normal:         "normal — processamento padrão"
+    choice_auto:           "auto — rápido nos primeiros segundos de cada turno"
+    choice_cold:           "cold — rápido apenas no primeiro turno de uma sessão"
 
   footer:
     status:                "📎 Rodapé de execução: **{state}**\nCampos: `{fields}`\nPlataforma: `{platform}`"
diff --git a/locales/ru.yaml b/locales/ru.yaml
index 51c892e02e..7fd2c285f2 100644
--- a/locales/ru.yaml
+++ b/locales/ru.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nТекущий режим: `{mode}`\\n\\nВыберите вариант:"
     choice_fast:           "fast — Priority Processing включён"
     choice_normal:         "normal — стандартная обработка"
+    choice_auto:           "auto — быстро в первые секунды каждого хода"
+    choice_cold:           "cold — быстро только на первом ходе сессии"
 
   footer:
     status:                "📎 Нижний колонтитул среды выполнения: **{state}**\nПоля: `{fields}`\nПлатформа: `{platform}`"
diff --git a/locales/tr.yaml b/locales/tr.yaml
index a88b1d0586..7af791fb74 100644
--- a/locales/tr.yaml
+++ b/locales/tr.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nMevcut mod: `{mode}`\\n\\nBir seçenek seçin:"
     choice_fast:           "fast — Priority Processing açık"
     choice_normal:         "normal — standart işleme"
+    choice_auto:           "auto — her turun ilk saniyelerinde hızlı"
+    choice_cold:           "cold — yalnızca oturumun ilk turunda hızlı"
 
   footer:
     status:                "📎 Çalışma zamanı altbilgisi: **{state}**\nAlanlar: `{fields}`\nPlatform: `{platform}`"
diff --git a/locales/uk.yaml b/locales/uk.yaml
index 730a052cd5..5e63f0bdad 100644
--- a/locales/uk.yaml
+++ b/locales/uk.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\nПоточний режим: `{mode}`\\n\\nОберіть варіант:"
     choice_fast:           "fast — Priority Processing увімкнено"
     choice_normal:         "normal — стандартна обробка"
+    choice_auto:           "auto — швидко в перші секунди кожного ходу"
+    choice_cold:           "cold — швидко лише на першому ході сесії"
 
   footer:
     status:                "📎 Нижній колонтитул середовища: **{state}**\nПоля: `{fields}`\nПлатформа: `{platform}`"
diff --git a/locales/zh-hant.yaml b/locales/zh-hant.yaml
index 9468fbba1c..b9091c2aa2 100644
--- a/locales/zh-hant.yaml
+++ b/locales/zh-hant.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **Priority Processing**\\n\\n目前模式：`{mode}`\\n\\n請選擇："
     choice_fast:           "fast — 開啟 Priority Processing"
     choice_normal:         "normal — 標準處理"
+    choice_auto:           "auto — 每輪的前幾秒快速"
+    choice_cold:           "cold — 僅會話的第一輪快速"
 
   footer:
     status:                "📎 執行階段頁尾：**{state}**\n欄位：`{fields}`\n平台：`{platform}`"
diff --git a/locales/zh.yaml b/locales/zh.yaml
index f659de9a24..dde25d0e82 100644
--- a/locales/zh.yaml
+++ b/locales/zh.yaml
@@ -137,6 +137,8 @@ gateway:
     picker_title:          "⚡ **优先处理**\\n\\n当前模式：`{mode}`\\n\\n请选择："
     choice_fast:           "fast — 开启优先处理"
     choice_normal:         "normal — 标准处理"
+    choice_auto:           "auto — 每轮的前几秒快速"
+    choice_cold:           "cold — 仅会话的第一轮快速"
 
   footer:
     status:                "📎 运行时页脚：**{state}**\n字段：`{fields}`\n平台：`{platform}`"
diff --git a/model_tools.py b/model_tools.py
index 20ce327a2a..e5e4e657e8 100644
--- a/model_tools.py
+++ b/model_tools.py
@@ -279,7 +279,7 @@ _LEGACY_TOOLSET_MAP = {
         "browser_press", "browser_get_images",
         "browser_vision", "browser_console"
     ],
-    "cronjob_tools": ["cronjob"],
+    "cronjob_tools": ["cronjob_manage"],
     "file_tools": ["read_file", "write_file", "patch", "search_files"],
     "tts_tools": ["text_to_speech"],
 }
@@ -602,7 +602,7 @@ def _compute_tool_definitions(
     # Same session-level seam as the browser_exec gate above.
     if "delegate_task" in available_tool_names:
         blocked_present = [
-            t for t in ("clarify", "memory", "cronjob") if t in available_tool_names
+            t for t in ("clarify", "memory", "cronjob_manage") if t in available_tool_names
         ]
         if len(blocked_present) < 3:
             full_offvariant = "delegate_task, clarify, memory, or cronjob"
@@ -788,7 +788,18 @@ def _resolve_active_context_length() -> int:
 # because they need agent-level state (TodoStore, MemoryStore, etc.).
 # The registry still holds their schemas; dispatch just returns a stub error
 # so if something slips through, the LLM sees a sensible message.
-_AGENT_LOOP_TOOLS = {"todo", "memory", "session_search", "delegate_task"}
+_AGENT_LOOP_TOOLS = {"todo_list", "memory", "session_search", "delegate_task"}
+
+# Legacy tool-name aliases (2026-08 renames): accepted at every dispatch seam
+# (handle_function_call + both executors) so old sessions and saved prompts
+# keep working; schemas only advertise the new names.
+_LEGACY_TOOL_ALIASES = {
+    "todo": "todo_list",
+    "cronjob": "cronjob_manage",
+    "process": "process_manage",
+    "tour": "gui_tour",
+    "tip": "show_tip",
+}
 _READ_SEARCH_TOOLS = {"read_file", "search_files"}
 
 
@@ -1284,6 +1295,13 @@ def handle_function_call(
         function_args = {}
     _tool_middleware_trace = list(tool_request_middleware_trace or [])
 
+    # ── Legacy tool-name aliases (2026-08 renames) ────────────────────
+    # Old sessions resuming mid-conversation (and users' muscle memory in
+    # saved skills/cron prompts) still emit the pre-rename names. Alias at
+    # the dispatch seam so every replay keeps working; new schemas only
+    # advertise the new names, so fresh sessions never see the old ones.
+    function_name = _LEGACY_TOOL_ALIASES.get(function_name, function_name)
+
     # ── Tool Search bridge dispatch ──────────────────────────────────
     # tool_search and tool_describe are pure catalog reads — handle them
     # inline. tool_call is unwrapped to the underlying tool so that every
@@ -1368,9 +1386,9 @@ def handle_function_call(
                         "Use tool_search to find tools you can call."
                     )
                 )
-            # Probe-validate against the deferred tool's schema (ironclaw#5149):
-            # a blind call missing required arguments returns the parameter
-            # schema instead of dispatching into an opaque downstream failure.
+            # Validate against the deferred tool's concrete schema before
+            # dispatch. This covers constraints the provider cannot enforce
+            # through the generic tool_call ``arguments: object`` bridge.
             _probe_err = _ts_mod.validate_deferred_call_args(underlying_name, underlying_args)
             if _probe_err is not None:
                 return _return_bridge_result(_probe_err)
diff --git a/plugins/dashboard_auth/nous/__init__.py b/plugins/dashboard_auth/nous/__init__.py
index 69acd18e36..fdb28173ee 100644
--- a/plugins/dashboard_auth/nous/__init__.py
+++ b/plugins/dashboard_auth/nous/__init__.py
@@ -85,6 +85,7 @@ from hermes_cli.dashboard_auth import (
     LoginStart,
     ProviderError,
     RefreshExpiredError,
+    classify_jwks_lookup_error,
     Session,
 )
 
@@ -436,10 +437,11 @@ class NousDashboardAuthProvider(DashboardAuthProvider):
             signing_key = self._get_jwks_client().get_signing_key_from_jwt(
                 access_token
             )
-        except jwt.PyJWKClientError as exc:
-            raise ProviderError(f"JWKS lookup failed: {exc}") from exc
-        except Exception as exc:  # pragma: no cover - defensive
-            raise ProviderError(f"JWKS lookup failed: {exc!r}") from exc
+        except Exception as exc:
+            # Unreachable JWKS -> ProviderError (503); a bearer that is not
+            # one of our JWTs (opaque peer key, foreign kid) -> InvalidCodeError
+            # (None / next provider). Folding both into 503 produced #94558.
+            raise classify_jwks_lookup_error(exc) from exc
 
         try:
             claims = jwt.decode(
diff --git a/plugins/dashboard_auth/self_hosted/__init__.py b/plugins/dashboard_auth/self_hosted/__init__.py
index 2672006571..7b7283b2df 100644
--- a/plugins/dashboard_auth/self_hosted/__init__.py
+++ b/plugins/dashboard_auth/self_hosted/__init__.py
@@ -93,6 +93,7 @@ from hermes_cli.dashboard_auth import (
     LoginStart,
     ProviderError,
     RefreshExpiredError,
+    classify_jwks_lookup_error,
     Session,
 )
 
@@ -617,10 +618,11 @@ class SelfHostedOIDCProvider(DashboardAuthProvider):
             signing_key = self._get_jwks_client().get_signing_key_from_jwt(
                 id_token
             )
-        except jwt.PyJWKClientError as exc:
-            raise ProviderError(f"JWKS lookup failed: {exc}") from exc
-        except Exception as exc:  # pragma: no cover - defensive
-            raise ProviderError(f"JWKS lookup failed: {exc!r}") from exc
+        except Exception as exc:
+            # Unreachable JWKS -> ProviderError (503); a bearer that is not
+            # one of our JWTs (opaque peer key, foreign kid) -> InvalidCodeError
+            # (None / next provider). Folding both into 503 produced #94558.
+            raise classify_jwks_lookup_error(exc) from exc
 
         try:
             claims = jwt.decode(
diff --git a/plugins/image_gen/meta-ai/__init__.py b/plugins/image_gen/meta-ai/__init__.py
new file mode 100644
index 0000000000..e5c2d43993
--- /dev/null
+++ b/plugins/image_gen/meta-ai/__init__.py
@@ -0,0 +1,297 @@
+"""Meta Model API image generation backend.
+
+Exposes Meta's ``muse-image`` model(s) as an :class:`ImageGenProvider`.
+The Meta Model API (https://api.meta.ai/v1) is OpenAI-compatible, so we reuse
+the OpenAI Python SDK pointed at Meta's base URL and authenticate with
+``META_MODEL_API_KEY``.
+
+Output is base64 JSON (WebP) -> saved under ``$HERMES_HOME/cache/images/``.
+
+Selection precedence (first hit wins):
+  1. ``model`` kwarg forwarded by the dispatcher (the ``hermes tools`` pick)
+  2. ``META_IMAGE_MODEL`` env var (escape hatch for scripts / tests)
+  3. ``image_gen.meta-ai.model`` in ``config.yaml``
+  4. ``image_gen.model`` in ``config.yaml`` (when it's one of our IDs)
+  5. :data:`DEFAULT_MODEL`
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from typing import Any, Dict, List, Optional, Tuple
+
+from agent.secret_scope import get_secret
+from agent.image_gen_provider import (
+    DEFAULT_ASPECT_RATIO,
+    ImageGenProvider,
+    error_response,
+    normalize_reference_images,
+    resolve_aspect_ratio,
+    save_b64_image,
+    save_url_image,
+    success_response,
+)
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_BASE_URL = "https://api.meta.ai/v1"
+# Auth env vars, in priority order. Mirrors the bundled ``meta-ai`` chat
+# provider (plugins/model-providers/meta-ai): MODEL_API_KEY is Meta's
+# documented var; the rest are accepted aliases.
+API_KEY_ENVS = ("MODEL_API_KEY", "META_API_KEY", "META_MODEL_API_KEY")
+# Primary key shown in setup prompts / error messages.
+API_KEY_ENV = "META_MODEL_API_KEY"
+# Optional base-url override (same var the chat provider honors).
+BASE_URL_ENV = "META_BASE_URL"
+
+
+def _resolve_api_key() -> Optional[str]:
+    """First non-empty auth env var, checked in priority order."""
+    for env in API_KEY_ENVS:
+        val = get_secret(env)
+        if val:
+            return val
+    return None
+
+
+def _resolve_base_url() -> str:
+    return (os.environ.get(BASE_URL_ENV) or "").strip() or DEFAULT_BASE_URL
+
+
+# ---------------------------------------------------------------------------
+# Model catalog
+# ---------------------------------------------------------------------------
+# Catalog shown in `hermes tools` and matched against `image_gen.model`.
+# The model id is sent verbatim to the Meta Model API (`/v1/images/generations`).
+_MODELS: Dict[str, Dict[str, Any]] = {
+    "muse-image-1.0": {
+        "display": "Muse Image 1.0",
+        "speed": "~10s",
+        "strengths": "Meta Model API image generation",
+        "price": "$0.01/image",
+    },
+}
+DEFAULT_MODEL = "muse-image-1.0"
+
+# aspect_ratio -> OpenAI-style size string
+_SIZES: Dict[str, str] = {
+    "square": "1024x1024",
+    "landscape": "1536x1024",
+    "portrait": "1024x1536",
+}
+
+
+def _resolve_model(caller_model: Optional[str] = None) -> Tuple[str, Dict[str, Any]]:
+    """Return (model_id, metadata) using the documented precedence chain.
+
+    ``caller_model`` is the ``model`` kwarg the dispatcher forwards from the
+    top-level ``image_gen.model`` config key (what ``hermes tools`` writes).
+    It wins when it names one of our models, mirroring the xai/krea/openrouter
+    providers, so a user's picker choice is never silently dropped.
+    """
+    if caller_model and caller_model in _MODELS:
+        return caller_model, _MODELS[caller_model]
+
+    env_model = os.environ.get("META_IMAGE_MODEL")
+    if env_model and env_model in _MODELS:
+        return env_model, _MODELS[env_model]
+
+    try:
+        from hermes_cli.config import load_config
+
+        cfg = load_config() or {}
+        ig = cfg.get("image_gen") or {}
+        scoped = (ig.get("meta-ai") or {}).get("model")
+        if scoped and scoped in _MODELS:
+            return scoped, _MODELS[scoped]
+        top = ig.get("model")
+        if top and top in _MODELS:
+            return top, _MODELS[top]
+    except Exception:
+        logger.debug("Could not read image_gen model from config", exc_info=True)
+
+    return DEFAULT_MODEL, _MODELS[DEFAULT_MODEL]
+
+
+class MetaImageGenProvider(ImageGenProvider):
+    """Meta Model API ``images.generate`` backend (muse-image)."""
+
+    @property
+    def name(self) -> str:
+        return "meta-ai"
+
+    @property
+    def display_name(self) -> str:
+        return "Meta Model API"
+
+    def is_available(self) -> bool:
+        if not _resolve_api_key():
+            return False
+        try:
+            import openai  # noqa: F401
+        except ImportError:
+            return False
+        return True
+
+    def list_models(self) -> List[Dict[str, Any]]:
+        return [
+            {
+                "id": mid,
+                "display": m["display"],
+                "speed": m["speed"],
+                "strengths": m["strengths"],
+                "price": m["price"],
+            }
+            for mid, m in _MODELS.items()
+        ]
+
+    def default_model(self) -> Optional[str]:
+        return DEFAULT_MODEL
+
+    def get_setup_schema(self) -> Dict[str, Any]:
+        return {
+            "name": "Meta Model API",
+            "badge": "paid",
+            "tag": "Muse Image via Meta Model API (api.meta.ai)",
+            "env_vars": [
+                {
+                    "key": API_KEY_ENV,
+                    "prompt": "Meta Model API key (LLM|... token)",
+                    "url": "https://api.meta.ai",
+                },
+            ],
+        }
+
+    def capabilities(self) -> Dict[str, Any]:
+        # Text-to-image only for now. Bump this once image-to-image is verified
+        # against the Meta endpoint.
+        return {"modalities": ["text"], "max_reference_images": 0}
+
+    def generate(
+        self,
+        prompt: str,
+        aspect_ratio: str = DEFAULT_ASPECT_RATIO,
+        *,
+        image_url: Optional[str] = None,
+        reference_image_urls: Optional[List[str]] = None,
+        **kwargs: Any,
+    ) -> Dict[str, Any]:
+        prompt = (prompt or "").strip()
+        aspect = resolve_aspect_ratio(aspect_ratio)
+
+        if not prompt:
+            return error_response(
+                error="Prompt is required and must be a non-empty string",
+                error_type="invalid_argument",
+                provider="meta-ai",
+                aspect_ratio=aspect,
+            )
+
+        api_key = _resolve_api_key()
+        if not api_key:
+            return error_response(
+                error=(
+                    f"{API_KEY_ENV} not set. Run `hermes tools` -> Image "
+                    "Generation -> Meta Model API to configure."
+                ),
+                error_type="auth_required",
+                provider="meta-ai",
+                aspect_ratio=aspect,
+            )
+
+        try:
+            import openai
+        except ImportError:
+            return error_response(
+                error="openai Python package not installed (pip install openai)",
+                error_type="missing_dependency",
+                provider="meta-ai",
+                aspect_ratio=aspect,
+            )
+
+        model_id, _meta = _resolve_model(kwargs.get("model"))
+        size = _SIZES.get(aspect, _SIZES["square"])
+
+        client = openai.OpenAI(api_key=api_key, base_url=_resolve_base_url())
+
+        payload: Dict[str, Any] = {
+            "model": model_id,
+            "prompt": prompt,
+            "size": size,
+            "n": 1,
+        }
+
+        try:
+            response = client.images.generate(**payload)
+        except Exception as exc:
+            logger.debug("Meta image generation failed", exc_info=True)
+            return error_response(
+                error=f"Meta image generation failed: {exc}",
+                error_type="api_error",
+                provider="meta-ai",
+                model=model_id,
+                prompt=prompt,
+                aspect_ratio=aspect,
+            )
+
+        try:
+            first = response.data[0]
+        except (AttributeError, IndexError, TypeError):
+            return error_response(
+                error="Meta response contained no image data",
+                error_type="empty_response",
+                provider="meta-ai",
+                model=model_id,
+                prompt=prompt,
+                aspect_ratio=aspect,
+            )
+
+        b64 = getattr(first, "b64_json", None)
+        url = getattr(first, "url", None)
+
+        try:
+            if b64:
+                path = save_b64_image(b64, prefix="meta", extension="webp")
+                image_ref = str(path)
+            elif url:
+                path = save_url_image(url, prefix="meta")
+                image_ref = str(path)
+            else:
+                return error_response(
+                    error="Meta response contained neither b64_json nor URL",
+                    error_type="empty_response",
+                    provider="meta-ai",
+                    model=model_id,
+                    prompt=prompt,
+                    aspect_ratio=aspect,
+                )
+        except Exception as exc:
+            return error_response(
+                error=f"Failed to save Meta image: {exc}",
+                error_type="io_error",
+                provider="meta-ai",
+                model=model_id,
+                prompt=prompt,
+                aspect_ratio=aspect,
+            )
+
+        revised_prompt = getattr(first, "revised_prompt", None)
+        extra: Dict[str, Any] = {"size": size}
+        if revised_prompt:
+            extra["revised_prompt"] = revised_prompt
+
+        return success_response(
+            image=image_ref,
+            model=model_id,
+            prompt=prompt,
+            aspect_ratio=aspect,
+            provider="meta-ai",
+            modality="text",
+            extra=extra,
+        )
+
+
+def register(ctx) -> None:
+    """Plugin entry point -- wire ``MetaImageGenProvider`` into the registry."""
+    ctx.register_image_gen_provider(MetaImageGenProvider())
diff --git a/plugins/image_gen/meta-ai/plugin.yaml b/plugins/image_gen/meta-ai/plugin.yaml
new file mode 100644
index 0000000000..2d5bb36649
--- /dev/null
+++ b/plugins/image_gen/meta-ai/plugin.yaml
@@ -0,0 +1,7 @@
+name: meta-ai-image-gen
+version: 1.0.0
+description: "Meta Model API image generation backend (muse-image). OpenAI-compatible /v1/images/generations. Saves images to $HERMES_HOME/cache/images/."
+author: Meta Platforms, Inc.
+kind: backend
+requires_env:
+  - META_MODEL_API_KEY
diff --git a/plugins/memory/hindsight/__init__.py b/plugins/memory/hindsight/__init__.py
index 7f9079ee27..cf3b9f618f 100644
--- a/plugins/memory/hindsight/__init__.py
+++ b/plugins/memory/hindsight/__init__.py
@@ -32,6 +32,7 @@ from __future__ import annotations
 
 import asyncio
 import atexit
+import contextvars
 import importlib
 import json
 import logging
@@ -1314,8 +1315,17 @@ class HindsightMemoryProvider(MemoryProvider):
         # If the previous writer exited (e.g. after a prior shutdown), reset
         # the flag so this fresh writer is allowed to drain new jobs.
         self._shutting_down.clear()
+        # Per-provider background threads start with an EMPTY contextvars
+        # Context. Under multiplex_profiles the spawning thread carries the
+        # profile's secret scope + HERMES_HOME override (gateway/run.py wraps
+        # the agent turn in copy_context().run), and get_secret fails closed
+        # without it (#92608). Snapshot the spawner's context into the thread.
+        # (The shared ``hindsight-loop`` thread needs no wrap: coroutines
+        # scheduled via run_coroutine_threadsafe inherit the submitter's
+        # context per call, so one loop can serve every profile.)
         thread = threading.Thread(
-            target=self._writer_loop,
+            target=contextvars.copy_context().run,
+            args=(self._writer_loop,),
             daemon=True,
             name="hindsight-writer",
         )
@@ -1835,7 +1845,12 @@ class HindsightMemoryProvider(MemoryProvider):
                         f.write(f"\n=== Daemon startup failed: {e} ===\n")
                         traceback.print_exc(file=f)
 
-            t = threading.Thread(target=_start_daemon, daemon=True, name="hindsight-daemon-start")
+            t = threading.Thread(
+                target=contextvars.copy_context().run,
+                args=(_start_daemon,),
+                daemon=True,
+                name="hindsight-daemon-start",
+            )
             t.start()
 
     def system_prompt_block(self) -> str:
@@ -1992,7 +2007,12 @@ class HindsightMemoryProvider(MemoryProvider):
                     self._prefetch_result = recalled.text
                     self._prefetch_count = recalled.count
 
-        self._prefetch_thread = threading.Thread(target=_run, daemon=True, name="hindsight-prefetch")
+        self._prefetch_thread = threading.Thread(
+            target=contextvars.copy_context().run,
+            args=(_run,),
+            daemon=True,
+            name="hindsight-prefetch",
+        )
         self._prefetch_thread.start()
 
     def _build_turn_messages(self, user_content: str, assistant_content: str) -> List[Dict[str, str]]:
diff --git a/plugins/model-providers/alibaba-coding-plan/__init__.py b/plugins/model-providers/alibaba-coding-plan/__init__.py
index b420fbbbd9..4723606d0e 100644
--- a/plugins/model-providers/alibaba-coding-plan/__init__.py
+++ b/plugins/model-providers/alibaba-coding-plan/__init__.py
@@ -9,6 +9,10 @@ Region split, mirroring the base DashScope pair (#73265):
 
 Profile names match the models.dev catalog keys exactly so model metadata
 lines up and ``model.provider: alibaba-coding-plan-cn`` resolves at runtime.
+
+The CN profile checks its own ``ALIBABA_CODING_PLAN_CN_API_KEY`` first (#101122,
+mirroring kimi-coding-cn) and keeps the shared vars as ordered fallbacks so
+existing CN users configured with the shared key keep working.
 """
 
 from providers import register_provider
@@ -31,7 +35,7 @@ alibaba_coding_plan_cn = ProviderProfile(
     display_name="Alibaba Cloud (Coding Plan, China)",
     description="Alibaba Cloud Coding Plan, mainland-China endpoint",
     signup_url="https://help.aliyun.com/zh/model-studio/",
-    env_vars=("ALIBABA_CODING_PLAN_API_KEY", "DASHSCOPE_API_KEY", "ALIBABA_CODING_PLAN_CN_BASE_URL"),
+    env_vars=("ALIBABA_CODING_PLAN_CN_API_KEY", "ALIBABA_CODING_PLAN_API_KEY", "DASHSCOPE_API_KEY", "ALIBABA_CODING_PLAN_CN_BASE_URL"),
     base_url="https://coding.dashscope.aliyuncs.com/v1",
     auth_type="api_key",
 )
diff --git a/plugins/model-providers/alibaba/__init__.py b/plugins/model-providers/alibaba/__init__.py
index 6135945d50..a9198d3931 100644
--- a/plugins/model-providers/alibaba/__init__.py
+++ b/plugins/model-providers/alibaba/__init__.py
@@ -55,7 +55,7 @@ alibaba_token_plan_cn = ProviderProfile(
     display_name="Alibaba Cloud (Token Plan, China)",
     description="Alibaba Cloud Model Studio Token Plan, mainland-China endpoint",
     signup_url="https://help.aliyun.com/zh/model-studio/",
-    env_vars=("ALIBABA_TOKEN_PLAN_API_KEY", "ALIBABA_TOKEN_PLAN_CN_BASE_URL"),
+    env_vars=("ALIBABA_TOKEN_PLAN_CN_API_KEY", "ALIBABA_TOKEN_PLAN_API_KEY", "ALIBABA_TOKEN_PLAN_CN_BASE_URL"),
     base_url="https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1",
     auth_type="api_key",
 )
diff --git a/plugins/platforms/a2a/adapter.py b/plugins/platforms/a2a/adapter.py
index 79842c88c6..7a9b6b1142 100644
--- a/plugins/platforms/a2a/adapter.py
+++ b/plugins/platforms/a2a/adapter.py
@@ -74,8 +74,30 @@ def _reply_timeout() -> float:
         return 300.0
 
 
+def _profile_scoped() -> bool:
+    """True when running inside a multiplexed secondary profile's scope.
+
+    Secondary-profile adapters are constructed inside ``_profile_runtime_scope``
+    (secret scope installed + multiplex active) — the same discriminator the
+    Buzz/SimpleX adapters use for this bug class (#98738). The DEFAULT profile
+    under multiplexing runs unscoped: ``os.environ`` holds its own bridge
+    output there and keeps its legacy precedence.
+    """
+    try:
+        from agent.secret_scope import current_secret_scope, is_multiplex_active
+
+        return bool(is_multiplex_active() and current_secret_scope() is not None)
+    except Exception:
+        return False
+
+
 def _default_agent_name() -> str:
-    name = os.getenv("A2A_AGENT_NAME", "").strip()
+    # Scope-aware: inside a secondary multiplex profile, os.environ holds the
+    # DEFAULT profile's bridged A2A_AGENT_NAME — borrowing it would brand a
+    # secondary profile's Agent Card with another profile's identity. There
+    # is no per-profile config.yaml equivalent yet, so a scoped profile just
+    # falls through to the hostname-based default below instead.
+    name = "" if _profile_scoped() else os.getenv("A2A_AGENT_NAME", "").strip()
     if name:
         return name
     try:
@@ -227,7 +249,7 @@ class A2ARequestHandler(BaseHTTPRequestHandler):
             }
             # Do not leak profile/tenant topology on remote unauthenticated GETs.
             # Agent Cards are intentionally public; health topology is not.
-            if security.localhost_only() or security.authenticate(
+            if self.adapter._security_context.localhost_only() or self.adapter._security_context.authenticate(
                 self.headers.get("Authorization"),
                 self.client_address[0] if self.client_address else "",
             ) is not None:
@@ -246,7 +268,9 @@ class A2ARequestHandler(BaseHTTPRequestHandler):
 
         # Identity comes from the presented credential (or the socket in
         # localhost-only mode) — never from the request body.
-        identity = security.authenticate(self.headers.get("Authorization"), client_ip)
+        identity = adapter._security_context.authenticate(
+            self.headers.get("Authorization"), client_ip
+        )
         if identity is None:
             self._json(401, protocol.jsonrpc_error(None, protocol.ERR_UNAUTHORIZED, "unauthorized"))
             return
@@ -292,7 +316,7 @@ class A2ARequestHandler(BaseHTTPRequestHandler):
             self._json(429, protocol.jsonrpc_error(req_id, protocol.ERR_RATE_LIMITED, "rate limit exceeded"))
             return
 
-        if not security.is_trusted_peer(identity):
+        if not adapter._security_context.is_trusted_peer(identity):
             self._json(403, protocol.jsonrpc_error(
                 req_id, protocol.ERR_UNTRUSTED_PEER, f"peer '{identity}' not trusted"))
             return
@@ -343,8 +367,17 @@ class A2AAdapter(BasePlatformAdapter):
         super().__init__(config=config, platform=platform)
 
         extra = getattr(config, "extra", {}) or {}
-        self.port = int(os.getenv("A2A_PORT") or extra.get("port", _DEFAULT_PORT))
-        self.host = security.resolve_bind_host()
+        # Scope-aware: a secondary multiplex profile must not borrow the
+        # default profile's bridged A2A_PORT (mirrors the Buzz/SimpleX fix
+        # for #98738) — an unconfigured profile falls closed to the module
+        # default port instead. (advertised_toolsets has the same env-leak
+        # shape but is left unscoped here — see the "Scope note" in this
+        # fix's PR description: open PR #98937 is actively rewriting this
+        # field's None-vs-empty-list semantics.)
+        self._security_context = security.A2ASecurityContext.capture()
+        _port_env = None if _profile_scoped() else os.getenv("A2A_PORT")
+        self.port = int(_port_env or extra.get("port", _DEFAULT_PORT))
+        self.host = self._security_context.resolve_bind_host()
         self.agent_name = _default_agent_name()
         self._advertised_toolsets = [
             t.strip() for t in (
@@ -440,7 +473,11 @@ class A2AAdapter(BasePlatformAdapter):
 
         self._mark_connected()
 
-        exposure = "localhost-only" if security.localhost_only() else "REMOTE (bearer auth)"
+        exposure = (
+            "localhost-only"
+            if self._security_context.localhost_only()
+            else "REMOTE (bearer auth)"
+        )
         logger.info(
             "A2A: serving Agent Card + JSON-RPC on http://%s:%s (%s) as %r; %d routed agent(s)",
             self.host, self.port, exposure, self.agent_name, len(self._agents),
@@ -502,9 +539,15 @@ class A2AAdapter(BasePlatformAdapter):
             raw = cfg.get("a2a_served_agents") or (cfg.get("a2a") or {}).get("served_agents")
 
         agents: dict[str, dict] = {}
-        default_desc = os.getenv(
-            "A2A_AGENT_DESCRIPTION",
-            "Hermes Agent — a general-purpose agent reachable over A2A.",
+        # Scope-aware for the same reason as port/toolsets above: a secondary
+        # profile must not inherit the default profile's A2A_AGENT_DESCRIPTION.
+        default_desc = (
+            "Hermes Agent — a general-purpose agent reachable over A2A."
+            if _profile_scoped()
+            else os.getenv(
+                "A2A_AGENT_DESCRIPTION",
+                "Hermes Agent — a general-purpose agent reachable over A2A.",
+            )
         )
         agents[""] = {
             "slug": "",
@@ -613,7 +656,7 @@ class A2AAdapter(BasePlatformAdapter):
             skills=self._advertised_skills(agent),
             streaming=bool(agent.get("local", True)),
             push_notifications=True,
-            auth_required=not security.localhost_only(),
+            auth_required=not self._security_context.localhost_only(),
             tenant=str(agent.get("tenant") or ""),
         )
 
@@ -1192,7 +1235,10 @@ class A2AAdapter(BasePlatformAdapter):
         if not callback_url:
             return
 
-        if not security.is_safe_callback_url(callback_url):
+        if not security.is_safe_callback_url(
+            callback_url,
+            localhost_mode=self._security_context.localhost_only(),
+        ):
             logger.warning("A2A: push notification for task %s blocked — unsafe callback URL: %s",
                            task_id, callback_url)
             protocol.metrics.push_failed += 1
@@ -1201,7 +1247,7 @@ class A2AAdapter(BasePlatformAdapter):
         # Push payload uses the StreamResponse format (same as streaming).
         payload = protocol.status_update(task_id, context_id, state, (reply or "")[:2000])
 
-        signature = security.sign_push_payload(payload)
+        signature = self._security_context.sign_push_payload(payload)
         headers = {"Content-Type": "application/json"}
         if signature:
             headers["X-A2A-Signature"] = signature
diff --git a/plugins/platforms/a2a/security.py b/plugins/platforms/a2a/security.py
index 753c202a54..350031b9df 100644
--- a/plugins/platforms/a2a/security.py
+++ b/plugins/platforms/a2a/security.py
@@ -31,29 +31,44 @@ import logging
 import os
 import re
 import time
+from dataclasses import dataclass
 from pathlib import Path
 from typing import Optional
 
 logger = logging.getLogger(__name__)
 
 
-# --------------------------------------------------------------------------
-# Bearer auth + peer identity
-# --------------------------------------------------------------------------
+def _profile_scoped() -> bool:
+    """True when running inside a multiplexed secondary profile's scope.
 
-def get_bearer_token() -> str:
-    """Return the configured shared inbound bearer token (empty if none)."""
-    return os.getenv("A2A_BEARER_TOKEN", "").strip()
-
-
-def get_peer_tokens() -> dict[str, str]:
-    """Parse A2A_PEER_TOKENS ("alice:tok1,bob:tok2") into {token: peer_name}.
-
-    Per-peer tokens give each remote agent its own credential, so the identity
-    used for rate limiting, trust, and audit is authenticated — not whatever
-    the request body claims.
+    Same discriminator as the Buzz/SimpleX/Raft adapters (#98738): secret
+    scope installed + multiplex active. The DEFAULT profile under
+    multiplexing (and every single-profile process) runs unscoped and keeps
+    its legacy ``os.environ`` precedence.
     """
-    raw = os.getenv("A2A_PEER_TOKENS", "").strip()
+    try:
+        from agent.secret_scope import current_secret_scope, is_multiplex_active
+
+        return bool(is_multiplex_active() and current_secret_scope() is not None)
+    except Exception:
+        return False
+
+
+def _startup_env(name: str) -> str:
+    """Read one A2A setting from the active profile's scope, else the env.
+
+    Inside a secondary profile's scope the scope is authoritative: a miss
+    yields "" and never falls through to ``os.environ`` (which holds the
+    default profile's tokens in a multiplexer).
+    """
+    if _profile_scoped():
+        from agent.secret_scope import get_secret
+
+        return (get_secret(name) or "").strip()
+    return os.getenv(name, "").strip()
+
+
+def _parse_peer_tokens(raw: str) -> dict[str, str]:
     out: dict[str, str] = {}
     for pair in raw.split(","):
         pair = pair.strip()
@@ -66,6 +81,115 @@ def get_peer_tokens() -> dict[str, str]:
     return out
 
 
+def _configured_trusted_peers() -> frozenset[str]:
+    raw = _startup_env("A2A_TRUSTED_PEERS")
+    if raw:
+        return frozenset(p.strip() for p in raw.split(",") if p.strip())
+    try:
+        from hermes_cli.config import load_config
+
+        cfg = load_config() or {}
+        peers = (cfg.get("a2a") or {}).get("trusted_peers", [])
+        if isinstance(peers, list):
+            return frozenset(str(peer).strip() for peer in peers if str(peer).strip())
+    except Exception:
+        pass
+    return frozenset()
+
+
+@dataclass(frozen=True)
+class A2ASecurityContext:
+    """Immutable, profile-scoped security settings captured at adapter startup.
+
+    ``ThreadingHTTPServer`` handles requests on fresh threads that do not inherit
+    the gateway's profile ContextVars. Keeping the resolved settings on the
+    adapter prevents those threads from falling back to another profile's
+    process-global environment.
+    """
+
+    bearer_token: str
+    peer_tokens: tuple[tuple[str, str], ...]
+    trusted_peers: frozenset[str]
+    allow_all_users: bool
+    requested_host: str
+    push_secret: str
+
+    @classmethod
+    def capture(cls) -> "A2ASecurityContext":
+        bearer_token = _startup_env("A2A_BEARER_TOKEN")
+        return cls(
+            bearer_token=bearer_token,
+            peer_tokens=tuple(_parse_peer_tokens(_startup_env("A2A_PEER_TOKENS")).items()),
+            trusted_peers=_configured_trusted_peers(),
+            allow_all_users=_startup_env("A2A_ALLOW_ALL_USERS").lower()
+            in {"1", "true", "yes"},
+            requested_host=_startup_env("A2A_HOST") or "127.0.0.1",
+            push_secret=_startup_env("A2A_PUSH_SECRET") or bearer_token,
+        )
+
+    def localhost_only(self) -> bool:
+        return not (self.bearer_token or self.peer_tokens)
+
+    def resolve_bind_host(self) -> str:
+        loopback = {"127.0.0.1", "localhost", "::1"}
+        if self.requested_host in loopback:
+            return self.requested_host
+        if self.localhost_only():
+            logger.warning(
+                "A2A: A2A_HOST=%s ignored — no A2A_BEARER_TOKEN or "
+                "A2A_PEER_TOKENS set; binding to 127.0.0.1. Configure a token "
+                "to expose A2A remotely.",
+                self.requested_host,
+            )
+            return "127.0.0.1"
+        return self.requested_host
+
+    def authenticate(self, auth_header: Optional[str], client_ip: str = "") -> Optional[str]:
+        if self.localhost_only():
+            return f"ip:{client_ip or 'local'}"
+        presented = _parse_bearer(auth_header)
+        if presented is None:
+            return None
+        for token, name in self.peer_tokens:
+            if hmac.compare_digest(presented, token):
+                return name
+        if self.bearer_token and hmac.compare_digest(presented, self.bearer_token):
+            return f"ip:{client_ip or 'unknown'}"
+        return None
+
+    def is_trusted_peer(self, identity: str) -> bool:
+        if self.allow_all_users or self.localhost_only() or not self.trusted_peers:
+            return True
+        return identity in self.trusted_peers
+
+    def sign_push_payload(self, payload: dict) -> str:
+        if not self.push_secret:
+            return ""
+        body = json.dumps(payload, sort_keys=True, ensure_ascii=False).encode("utf-8")
+        return hmac.new(
+            self.push_secret.encode("utf-8"), body, hashlib.sha256
+        ).hexdigest()
+
+
+# --------------------------------------------------------------------------
+# Bearer auth + peer identity
+# --------------------------------------------------------------------------
+
+def get_bearer_token() -> str:
+    """Return the configured shared inbound bearer token (empty if none)."""
+    return _startup_env("A2A_BEARER_TOKEN")
+
+
+def get_peer_tokens() -> dict[str, str]:
+    """Parse A2A_PEER_TOKENS ("alice:tok1,bob:tok2") into {token: peer_name}.
+
+    Per-peer tokens give each remote agent its own credential, so the identity
+    used for rate limiting, trust, and audit is authenticated — not whatever
+    the request body claims.
+    """
+    return _parse_peer_tokens(_startup_env("A2A_PEER_TOKENS"))
+
+
 def _parse_bearer(auth_header: Optional[str]) -> Optional[str]:
     if not auth_header:
         return None
@@ -85,24 +209,12 @@ def authenticate(auth_header: Optional[str], client_ip: str = "") -> Optional[st
 
     Comparisons are constant-time (hmac.compare_digest).
     """
-    peer_tokens = get_peer_tokens()
-    shared = get_bearer_token()
-    if not peer_tokens and not shared:
-        return f"ip:{client_ip or 'local'}"
-    presented = _parse_bearer(auth_header)
-    if presented is None:
-        return None
-    for token, name in peer_tokens.items():
-        if hmac.compare_digest(presented, token):
-            return name
-    if shared and hmac.compare_digest(presented, shared):
-        return f"ip:{client_ip or 'unknown'}"
-    return None
+    return A2ASecurityContext.capture().authenticate(auth_header, client_ip)
 
 
 def localhost_only() -> bool:
     """True when we must refuse non-loopback binds (no token of any kind set)."""
-    return not (get_bearer_token() or get_peer_tokens())
+    return A2ASecurityContext.capture().localhost_only()
 
 
 def resolve_bind_host() -> str:
@@ -112,18 +224,7 @@ def resolve_bind_host() -> str:
     per-peer) AND explicitly asked for a wider host. A token alone does not
     widen the bind — opting into remote exposure must be deliberate.
     """
-    requested = os.getenv("A2A_HOST", "").strip() or "127.0.0.1"
-    loopback = {"127.0.0.1", "localhost", "::1"}
-    if requested in loopback:
-        return requested
-    if localhost_only():
-        logger.warning(
-            "A2A: A2A_HOST=%s ignored — no A2A_BEARER_TOKEN or A2A_PEER_TOKENS "
-            "set; binding to 127.0.0.1. Configure a token to expose A2A remotely.",
-            requested,
-        )
-        return "127.0.0.1"
-    return requested
+    return A2ASecurityContext.capture().resolve_bind_host()
 
 
 # --------------------------------------------------------------------------
@@ -138,18 +239,7 @@ def get_trusted_peers() -> set[str]:
     names from ``authenticate()`` — peer-token names, or ``ip:<addr>`` for
     shared-token callers.
     """
-    env_peers = os.getenv("A2A_TRUSTED_PEERS", "").strip()
-    if env_peers:
-        return {p.strip() for p in env_peers.split(",") if p.strip()}
-    try:
-        from hermes_cli.config import load_config
-        cfg = load_config() or {}
-        peers_list = (cfg.get("a2a") or {}).get("trusted_peers", [])
-        if isinstance(peers_list, list):
-            return {str(p).strip() for p in peers_list if p}
-    except Exception:
-        pass
-    return set()
+    return set(_configured_trusted_peers())
 
 
 def is_trusted_peer(identity: str) -> bool:
@@ -160,14 +250,7 @@ def is_trusted_peer(identity: str) -> bool:
     otherwise any *authenticated* identity is allowed (authentication is the
     primary gate — the allow-list is an optional restriction on top).
     """
-    if os.getenv("A2A_ALLOW_ALL_USERS", "").strip().lower() in ("1", "true", "yes"):
-        return True
-    if localhost_only():
-        return True
-    trusted = get_trusted_peers()
-    if not trusted:
-        return True
-    return identity in trusted
+    return A2ASecurityContext.capture().is_trusted_peer(identity)
 
 
 # --------------------------------------------------------------------------
@@ -259,10 +342,7 @@ def get_push_secret() -> str:
     Falls back to the bearer token if no dedicated push secret is set.
     If neither is configured, push notifications are unsigned (localhost-only mode).
     """
-    secret = os.getenv("A2A_PUSH_SECRET", "").strip()
-    if secret:
-        return secret
-    return get_bearer_token()
+    return A2ASecurityContext.capture().push_secret
 
 
 def sign_push_payload(payload: dict) -> str:
@@ -304,12 +384,14 @@ _BLOCKED_PREFIXES = (
 )
 
 
-def is_safe_callback_url(url: str) -> bool:
+def is_safe_callback_url(url: str, *, localhost_mode: Optional[bool] = None) -> bool:
     """Check if a push notification callback URL is safe from SSRF.
 
     Blocks internal/private/loopback/metadata addresses.
     Only allows http:// and https:// schemes.
     """
+    if localhost_mode is None:
+        localhost_mode = localhost_only()
     if not url or not isinstance(url, str):
         return False
     try:
@@ -324,16 +406,16 @@ def is_safe_callback_url(url: str) -> bool:
     hostname_lower = hostname.lower()
     if hostname_lower == "localhost":
         # Loopback callbacks only make sense for local testing.
-        return localhost_only()
+        return localhost_mode
     for prefix in _BLOCKED_PREFIXES:
         if hostname_lower.startswith(prefix.lower()):
-            if localhost_only() and prefix in ("127.", "::1"):
+            if localhost_mode and prefix in ("127.", "::1"):
                 return True
             return False
     try:
         ip = ipaddress.ip_address(hostname)
         if ip.is_loopback or ip.is_link_local or ip.is_private or ip.is_reserved:
-            if localhost_only() and ip.is_loopback:
+            if localhost_mode and ip.is_loopback:
                 return True
             return False
     except ValueError:
diff --git a/plugins/platforms/discord/adapter.py b/plugins/platforms/discord/adapter.py
index 79268849df..1839d57dd0 100644
--- a/plugins/platforms/discord/adapter.py
+++ b/plugins/platforms/discord/adapter.py
@@ -142,6 +142,47 @@ import sys
 from pathlib import Path as _Path
 sys.path.insert(0, str(_Path(__file__).resolve().parents[3]))
 
+
+def _is_discord_transport_error(exc: BaseException) -> bool:
+    """Return True for connection-shaped send failures (dead/dropping WS).
+
+    These are the failures where the message demonstrably did NOT reach
+    Discord because the transport itself was down — the delivery-obligation
+    ledger can safely replay them after reconnect (#95382). HTTP-level
+    rejections (permissions, formatting, 4xx) are NOT transport errors and
+    must keep their original error string. Timeouts are excluded: a timed-out
+    send may have reached Discord, so replaying it risks a duplicate.
+    """
+    if isinstance(exc, asyncio.TimeoutError):
+        return False
+    if isinstance(exc, (ConnectionError, OSError)):
+        return True
+    if DISCORD_AVAILABLE and discord is not None:
+        _transport_types = tuple(
+            t
+            for t in (
+                getattr(discord, "ConnectionClosed", None),
+                getattr(discord, "GatewayNotFound", None),
+                getattr(discord, "DiscordServerError", None),
+            )
+            if isinstance(t, type)
+        )
+        if _transport_types and isinstance(exc, _transport_types):
+            return True
+    text = str(exc).lower()
+    return any(
+        marker in text
+        for marker in (
+            "websocket closed",
+            "connection reset",
+            "connection closed",
+            "session is closed",
+            "cannot write to closing transport",
+            "not connected",
+        )
+    )
+
+
 try:
     from .ffmpeg_utils import resolve_ffmpeg_executable
 except ImportError:
@@ -3451,7 +3492,15 @@ class DiscordAdapter(BasePlatformAdapter):
         created automatically.
         """
         if not self._client:
-            return SendResult(success=False, error="Not connected")
+            # Dead transport (client gone / gateway reconnecting): classify as
+            # send_path_degraded so the delivery-obligation ledger's reconnect
+            # sweep (_redeliver_failed_obligations_for_platform) can replay
+            # this final response once the adapter is live again — a generic
+            # "Not connected" error is not runtime-retryable and left the
+            # turn's output stranded until a full process restart (#95382).
+            return SendResult(
+                success=False, error="send_path_degraded", retryable=True
+            )
         if not (content or "").strip():
             logger.warning(
                 "[%s] Dropped empty message to chat=%s (caller bug). Call site:\n%s",
@@ -3582,7 +3631,16 @@ class DiscordAdapter(BasePlatformAdapter):
 
         except Exception as e:  # pragma: no cover - defensive logging
             logger.error("[%s] Failed to send Discord message: %s", self.name, e, exc_info=True)
-            result = SendResult(success=False, error=str(e))
+            if _is_discord_transport_error(e):
+                # Connection-shaped failure (WS drop / closed session): use
+                # the ledger's runtime-retryable marker so the reconnect
+                # sweep can replay this final response instead of stranding
+                # it until a process restart (#95382 silent partial loss).
+                result = SendResult(
+                    success=False, error="send_path_degraded", retryable=True
+                )
+            else:
+                result = SendResult(success=False, error=str(e))
             await asyncio.to_thread(
                 self._record_discord_response,
                 reply_to=reply_to,
@@ -6398,6 +6456,14 @@ class DiscordAdapter(BasePlatformAdapter):
         )
         return (len(self._skill_entries), self._skill_group_hidden_count)
 
+    def _interaction_guild_id(self, interaction: discord.Interaction) -> Optional[str]:
+        """Resolve the guild id of a slash interaction (mirrors the message path)."""
+        guild_id = getattr(interaction, "guild_id", None)
+        if guild_id is None:
+            guild = getattr(getattr(interaction, "channel", None), "guild", None)
+            guild_id = getattr(guild, "id", None)
+        return str(guild_id) if guild_id else None
+
     def _build_slash_event(self, interaction: discord.Interaction, text: str) -> MessageEvent:
         """Build a MessageEvent from a Discord slash command interaction."""
         is_dm = isinstance(interaction.channel, discord.DMChannel)
@@ -6422,6 +6488,12 @@ class DiscordAdapter(BasePlatformAdapter):
         # For forum threads, inherit the parent forum's topic.
         chat_topic = self._get_effective_topic(interaction.channel, is_thread=is_thread)
 
+        # guild_id/parent_chat_id feed profile_routes matching in build_source,
+        # exactly as on_message passes them — without them a guild- or
+        # channel-routed profile never matches a native slash command (#69178).
+        parent_id = (
+            self._get_parent_channel_id(interaction.channel) if is_thread else None
+        ) or ""
         source = self.build_source(
             chat_id=str(interaction.channel_id),
             chat_name=chat_name,
@@ -6430,11 +6502,12 @@ class DiscordAdapter(BasePlatformAdapter):
             user_name=interaction.user.display_name,
             thread_id=thread_id,
             chat_topic=chat_topic,
+            guild_id=self._interaction_guild_id(interaction),
+            parent_chat_id=parent_id or None,
         )
 
         msg_type = MessageType.COMMAND if text.startswith("/") else MessageType.TEXT
         channel_id = str(interaction.channel_id)
-        parent_id = str(getattr(getattr(interaction, "channel", None), "parent_id", "") or "")
         return MessageEvent(
             text=text,
             message_type=msg_type,
@@ -6516,6 +6589,8 @@ class DiscordAdapter(BasePlatformAdapter):
         _chan = getattr(interaction, "channel", None)
         chat_topic = self._get_effective_topic(_chan, is_thread=True) if _chan else None
 
+        _parent_channel = self._thread_parent_channel(getattr(interaction, "channel", None))
+        _parent_id = str(getattr(_parent_channel, "id", "") or "")
         source = self.build_source(
             chat_id=thread_id,
             chat_name=chat_name,
@@ -6524,10 +6599,10 @@ class DiscordAdapter(BasePlatformAdapter):
             user_name=interaction.user.display_name,
             thread_id=thread_id,
             chat_topic=chat_topic,
+            guild_id=self._interaction_guild_id(interaction),
+            parent_chat_id=_parent_id or None,
         )
 
-        _parent_channel = self._thread_parent_channel(getattr(interaction, "channel", None))
-        _parent_id = str(getattr(_parent_channel, "id", "") or "")
         _skills = self._resolve_channel_skills(thread_id, _parent_id or None)
         _channel_prompt = self._resolve_channel_prompt(thread_id, _parent_id or None)
         event = MessageEvent(
diff --git a/plugins/platforms/email/adapter.py b/plugins/platforms/email/adapter.py
index 89ead8a82a..228cad281f 100644
--- a/plugins/platforms/email/adapter.py
+++ b/plugins/platforms/email/adapter.py
@@ -7,8 +7,12 @@ Uses IMAP to receive and SMTP to send messages.
 Environment variables:
     EMAIL_IMAP_HOST     — IMAP server host (e.g., imap.gmail.com)
     EMAIL_IMAP_PORT     — IMAP server port (default: 993)
+    EMAIL_IMAP_SECURITY — IMAP transport: tls, starttls, or plain (default: tls)
+    EMAIL_IMAP_TLS_VERIFY — Verify the IMAP TLS certificate (default: true)
     EMAIL_SMTP_HOST     — SMTP server host (e.g., smtp.gmail.com)
     EMAIL_SMTP_PORT     — SMTP server port (default: 587)
+    EMAIL_SMTP_SECURITY — SMTP transport: tls, starttls, or plain (port-based default)
+    EMAIL_SMTP_TLS_VERIFY — Verify the SMTP TLS certificate (default: true)
     EMAIL_ADDRESS       — Email address for the agent
     EMAIL_PASSWORD      — Email password or app-specific password
     EMAIL_POLL_INTERVAL — Seconds between mailbox checks (default: 15)
@@ -88,7 +92,40 @@ def _esecret_int(name: str, default: int) -> int:
 
 def _esecret_bool(name: str, default: bool = False) -> bool:
     """Scope-aware boolean read (``env_bool`` variant of ``_get_esecret``)."""
-    return is_truthy_value(_get_esecret(name, ""), default=default)
+    raw = str(_get_esecret(name, "")).strip()
+    return is_truthy_value(raw, default=default) if raw else default
+
+
+_SECURITY_ALIASES = {
+    "tls": "tls", "ssl": "tls", "implicit": "tls",
+    "starttls": "starttls",
+    "plain": "plain", "none": "plain",
+}
+
+
+def _normalize_security(value: Any, default: str = "tls") -> str:
+    """Map an IMAP/SMTP security setting to ``tls`` | ``starttls`` | ``plain``.
+
+    Unknown values log a warning and fall back to *default* rather than
+    failing the connection, so a typo never silently downgrades to plaintext.
+    """
+    raw = str(value or "").strip().lower().replace("-", "").replace("_", "")
+    if not raw:
+        return default
+    mode = _SECURITY_ALIASES.get(raw)
+    if mode is None:
+        logger.warning("Unknown email security mode %r; using %r", value, default)
+        return default
+    return mode
+
+
+def _tls_context(verify: bool, host: str) -> ssl.SSLContext:
+    """Verified context by default; unverified only when explicitly opted out."""
+    if verify:
+        return ssl.create_default_context()
+    if host not in ("127.0.0.1", "::1", "localhost"):
+        logger.warning("TLS verification disabled for non-loopback host %s", host)
+    return ssl._create_unverified_context()
 
 
 # Automated sender patterns — emails from these are silently ignored
@@ -554,8 +591,23 @@ class EmailAdapter(BasePlatformAdapter):
         self._password = _get_secret("EMAIL_PASSWORD", "")
         self._imap_host = (_get_secret("EMAIL_IMAP_HOST", "") or extra.get("imap_host", "")).strip()
         self._imap_port = _esecret_int("EMAIL_IMAP_PORT", 993)
+        self._imap_security = _normalize_security(
+            _get_secret("EMAIL_IMAP_SECURITY", "") or extra.get("imap_security", "")
+        )
+        self._imap_tls_verify = _esecret_bool(
+            "EMAIL_IMAP_TLS_VERIFY",
+            is_truthy_value(extra.get("imap_tls_verify"), default=True),
+        )
         self._smtp_host = (_get_secret("EMAIL_SMTP_HOST", "") or extra.get("smtp_host", "")).strip()
         self._smtp_port = _esecret_int("EMAIL_SMTP_PORT", 587)
+        self._smtp_security = _normalize_security(
+            _get_secret("EMAIL_SMTP_SECURITY", "") or extra.get("smtp_security", ""),
+            default="tls" if self._smtp_port == 465 else "starttls",
+        )
+        self._smtp_tls_verify = _esecret_bool(
+            "EMAIL_SMTP_TLS_VERIFY",
+            is_truthy_value(extra.get("smtp_tls_verify"), default=True),
+        )
         self._poll_interval = _esecret_int("EMAIL_POLL_INTERVAL", 15)
 
         # Skip attachments — configured via config.yaml:
@@ -627,6 +679,25 @@ class EmailAdapter(BasePlatformAdapter):
             # Fallback: just clear old entries if sort fails
             self._seen_uids = set(list(self._seen_uids)[-self._seen_uids_max // 2:])
 
+    def _connect_imap(self) -> imaplib.IMAP4:
+        """Create an IMAP connection using implicit TLS, STARTTLS, or plaintext."""
+        if self._imap_security == "tls":
+            return imaplib.IMAP4_SSL(
+                self._imap_host,
+                self._imap_port,
+                timeout=30,
+                ssl_context=_tls_context(self._imap_tls_verify, self._imap_host),
+            )
+
+        imap = imaplib.IMAP4(self._imap_host, self._imap_port, timeout=30)
+        if self._imap_security == "starttls":
+            try:
+                imap.starttls(ssl_context=_tls_context(self._imap_tls_verify, self._imap_host))
+            except Exception:
+                _close_imap(imap)
+                raise
+        return imap
+
     def _connect_smtp(self) -> smtplib.SMTP:
         """Create an SMTP connection, selecting the correct protocol for the port.
 
@@ -642,22 +713,24 @@ class EmailAdapter(BasePlatformAdapter):
         Returns a connected SMTP object with TLS established — callers
         can proceed directly to ``login()``.
         """
-        ctx = ssl.create_default_context()
         host = self._smtp_host
         port = self._smtp_port
+        security = self._smtp_security
+        ctx = _tls_context(self._smtp_tls_verify, host)
 
         def _connect(*, ipv4_only: bool = False) -> smtplib.SMTP:
             """Attempt one SMTP connection."""
             smtp_cls = _IPv4SMTP if ipv4_only else smtplib.SMTP
             smtp_ssl_cls = _IPv4SMTP_SSL if ipv4_only else smtplib.SMTP_SSL
-            if port == 465:
+            if security == "tls":
                 return smtp_ssl_cls(host, port, timeout=SMTP_CONNECT_TIMEOUT, context=ctx)
             smtp = smtp_cls(host, port, timeout=SMTP_CONNECT_TIMEOUT)
-            try:
-                smtp.starttls(context=ctx)
-            except Exception:
-                smtp.close()
-                raise
+            if security == "starttls":
+                try:
+                    smtp.starttls(context=ctx)
+                except Exception:
+                    smtp.close()
+                    raise
             return smtp
 
         try:
@@ -711,7 +784,7 @@ class EmailAdapter(BasePlatformAdapter):
             # (#79889).
             imap = None
             try:
-                imap = imaplib.IMAP4_SSL(self._imap_host, self._imap_port, timeout=30)
+                imap = self._connect_imap()
                 imap.login(self._address, self._password)
                 _send_imap_id(imap)
                 imap.select("INBOX")
@@ -855,7 +928,7 @@ class EmailAdapter(BasePlatformAdapter):
         results = []
         imap: Optional[imaplib.IMAP4] = None
         try:
-            imap = imaplib.IMAP4_SSL(self._imap_host, self._imap_port, timeout=30)
+            imap = self._connect_imap()
             try:
                 imap.login(self._address, self._password)
                 _send_imap_id(imap)
@@ -1438,7 +1511,6 @@ async def _standalone_send(
     """Out-of-process Email delivery via SMTP (one-shot). Implements the
     standalone_sender_fn contract; replaces the legacy _send_email helper."""
     import smtplib
-    import ssl as _ssl
     from email.mime.text import MIMEText
     from email.utils import formatdate
 
@@ -1450,6 +1522,14 @@ async def _standalone_send(
         smtp_port = int(_get_secret("EMAIL_SMTP_PORT", "587") or "587")
     except (ValueError, TypeError):
         smtp_port = 587
+    smtp_security = _normalize_security(
+        _get_secret("EMAIL_SMTP_SECURITY", "") or extra.get("smtp_security"),
+        default="tls" if smtp_port == 465 else "starttls",
+    )
+    smtp_tls_verify = _esecret_bool(
+        "EMAIL_SMTP_TLS_VERIFY",
+        is_truthy_value(extra.get("smtp_tls_verify"), default=True),
+    )
 
     if not all([address, password, smtp_host]):
         return {"error": "Email not configured (EMAIL_ADDRESS, EMAIL_PASSWORD, EMAIL_SMTP_HOST required)"}
@@ -1461,8 +1541,17 @@ async def _standalone_send(
         msg["Subject"] = "Hermes Agent"
         msg["Date"] = formatdate(localtime=True)
 
-        server = smtplib.SMTP(smtp_host, smtp_port)
-        server.starttls(context=_ssl.create_default_context())
+        ctx = _tls_context(smtp_tls_verify, smtp_host)
+        if smtp_security == "tls":
+            server = smtplib.SMTP_SSL(smtp_host, smtp_port, context=ctx)
+        else:
+            server = smtplib.SMTP(smtp_host, smtp_port)
+            if smtp_security == "starttls":
+                try:
+                    server.starttls(context=ctx)
+                except Exception:
+                    server.close()
+                    raise
         server.login(address, password)
         server.send_message(msg)
         server.quit()
diff --git a/plugins/platforms/feishu/adapter.py b/plugins/platforms/feishu/adapter.py
index 153f2d4d0c..d0546f6339 100644
--- a/plugins/platforms/feishu/adapter.py
+++ b/plugins/platforms/feishu/adapter.py
@@ -436,6 +436,9 @@ class FeishuAdapterSettings:
     group_rules: Dict[str, FeishuGroupRule] = field(default_factory=dict)
     allow_bots: str = "none"  # "none" | "mentions" | "all"
     require_mention: bool = True
+    # DM allow-all (FEISHU_ALLOW_ALL_USERS / GATEWAY_ALLOW_ALL_USERS), resolved
+    # per-profile so multiplexed secondary adapters honor their own .env.
+    allow_all_dm: bool = False
 
 
 @dataclass
@@ -1322,16 +1325,96 @@ def _strip_edge_self_mentions(
             return remaining
 
 
+# ---------------------------------------------------------------------------
+# Multiplex isolation for the lark_oapi WebSocket client (#73779)
+# ---------------------------------------------------------------------------
+#
+# ``lark_oapi.ws.client`` keeps the asyncio loop used by ``Client.start()``
+# and every coroutine it spawns in a *module-level global* (``loop``), and
+# Hermes also monkey-patches ``websockets.connect`` on the shared
+# ``websockets`` module to inject per-adapter ping settings. In multiplex
+# mode every profile runs its own WS client on a dedicated thread, so the N
+# threads overwrite each other's module globals (last-write-wins): a client
+# ends up scheduling tasks on a sibling profile's loop ("Future attached to
+# a different loop" crashes) or binds to the wrong loop at construction time
+# and goes deaf from the start.
+#
+# The fix installs process-wide, thread-dispatching shims exactly once:
+#
+#   * ``ws_client_module.loop`` becomes a proxy that forwards every attribute
+#     access to the loop registered by the *current thread*. All SDK reads of
+#     the global happen on the thread that owns the loop (``start()`` blocks
+#     in ``run_until_complete`` and every ``create_task`` callback runs on
+#     the loop's own thread), so each profile transparently sees its own
+#     loop. Threads that never registered one (single-profile installs, CLI)
+#     fall back to the SDK's original module loop.
+#   * ``websockets.connect`` becomes a single dispatcher that merges the
+#     per-thread ping overrides registered by the calling profile, so
+#     profiles no longer race over the global patch or restore each other's
+#     hooks while a sibling is still connected.
+
+_WS_ISOLATION_LOCK = threading.Lock()
+_WS_ISOLATION_INSTALLED = False
+# Per-WS-thread registration: ``.loop`` (the thread's asyncio loop) and
+# ``.connect_kwargs`` (websockets.connect overrides, e.g. ping settings).
+_ws_isolation_state = threading.local()
+
+
+class _ThreadLocalLoopProxy:
+    """Forwards attribute access to the current thread's registered loop."""
+
+    def __init__(self, fallback: Any) -> None:
+        self._fallback = fallback
+
+    def _target(self) -> Any:
+        return getattr(_ws_isolation_state, "loop", None) or self._fallback
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._target(), name)
+
+    def __repr__(self) -> str:  # pragma: no cover - debugging aid
+        return f"<ThreadLocalLoopProxy target={self._target()!r}>"
+
+
+def _install_lark_ws_isolation(ws_client_module: Any) -> None:
+    """Install the thread-dispatching shims once per process (idempotent)."""
+    global _WS_ISOLATION_INSTALLED
+    with _WS_ISOLATION_LOCK:
+        if _WS_ISOLATION_INSTALLED:
+            return
+
+        ws_client_module.loop = _ThreadLocalLoopProxy(ws_client_module.loop)
+
+        real_connect = ws_client_module.websockets.connect
+
+        def _dispatch_connect(*args: Any, **kwargs: Any) -> Any:
+            overrides = getattr(_ws_isolation_state, "connect_kwargs", None) or {}
+            for key, value in overrides.items():
+                kwargs.setdefault(key, value)
+            return real_connect(*args, **kwargs)
+
+        # Keep ``inspect.signature(websockets.connect)`` honest: the SDK's
+        # ``_ws_connect_kwargs()`` probes the real signature to decide whether
+        # the installed websockets generation supports the ``proxy`` kwarg.
+        _dispatch_connect.__wrapped__ = real_connect
+        _dispatch_connect.__name__ = getattr(real_connect, "__name__", "connect")
+        ws_client_module.websockets.connect = _dispatch_connect
+        _WS_ISOLATION_INSTALLED = True
+
+
 def _run_official_feishu_ws_client(ws_client: Any, adapter: Any) -> None:
-    """Run the official Lark WS client in its own thread-local event loop."""
+    """Run the official Lark WS client in its own thread-local event loop.
+
+    In multiplex mode several profiles run this concurrently; the shims
+    installed by ``_install_lark_ws_isolation`` make each thread see its own
+    loop and connect overrides (see the isolation comment block above).
+    """
     import lark_oapi.ws.client as ws_client_module
 
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
-    ws_client_module.loop = loop
     adapter._ws_thread_loop = loop
 
-    original_connect = ws_client_module.websockets.connect
     original_configure = getattr(ws_client, "_configure", None)
 
     def _apply_runtime_ws_overrides() -> None:
@@ -1343,12 +1426,15 @@ def _run_official_feishu_ws_client(ws_client: Any, adapter: Any) -> None:
         except Exception:
             logger.debug("[Feishu] Failed to apply websocket runtime overrides", exc_info=True)
 
-    def _connect_with_overrides(*args: Any, **kwargs: Any) -> Any:
-        if adapter._ws_ping_interval is not None and "ping_interval" not in kwargs:
-            kwargs["ping_interval"] = adapter._ws_ping_interval
-        if adapter._ws_ping_timeout is not None and "ping_timeout" not in kwargs:
-            kwargs["ping_timeout"] = adapter._ws_ping_timeout
-        return original_connect(*args, **kwargs)
+    connect_overrides: Dict[str, Any] = {}
+    if adapter._ws_ping_interval is not None:
+        connect_overrides["ping_interval"] = adapter._ws_ping_interval
+    if adapter._ws_ping_timeout is not None:
+        connect_overrides["ping_timeout"] = adapter._ws_ping_timeout
+
+    _install_lark_ws_isolation(ws_client_module)
+    _ws_isolation_state.loop = loop
+    _ws_isolation_state.connect_kwargs = connect_overrides
 
     def _configure_with_overrides(conf: Any) -> Any:
         if original_configure is None:
@@ -1357,7 +1443,6 @@ def _run_official_feishu_ws_client(ws_client: Any, adapter: Any) -> None:
         _apply_runtime_ws_overrides()
         return result
 
-    ws_client_module.websockets.connect = _connect_with_overrides
     if original_configure is not None:
         setattr(ws_client, "_configure", _configure_with_overrides)
     _apply_runtime_ws_overrides()
@@ -1366,7 +1451,8 @@ def _run_official_feishu_ws_client(ws_client: Any, adapter: Any) -> None:
     except Exception:
         pass
     finally:
-        ws_client_module.websockets.connect = original_connect
+        _ws_isolation_state.loop = None
+        _ws_isolation_state.connect_kwargs = None
         if original_configure is not None:
             setattr(ws_client, "_configure", original_configure)
         pending = [t for t in asyncio.all_tasks(loop) if not t.done()]
@@ -1517,6 +1603,8 @@ class FeishuAdapter(BasePlatformAdapter):
         self._sdk_executor_closing = False
         self._ws_client: Optional[Any] = None
         self._ws_future: Optional[asyncio.Future] = None
+        self._ws_supervisor: Optional[asyncio.Task] = None
+        self._ws_restart_backoff = 5.0
         self._ws_thread_loop: Optional[asyncio.AbstractEventLoop] = None
         self._loop: Optional[asyncio.AbstractEventLoop] = None
         self._webhook_runner: Optional[Any] = None
@@ -1591,7 +1679,9 @@ class FeishuAdapter(BasePlatformAdapter):
 
         # Env-only so adapter and gateway auth bypass share one source; yaml
         # feishu.allow_bots is bridged to this env var at config load.
-        allow_bots = os.getenv("FEISHU_ALLOW_BOTS", "none").strip().lower()
+        # Scope-aware read: under multiplex a secondary profile's .env must
+        # govern its own adapter (same pattern as app_secret below) — #86905.
+        allow_bots = _get_scoped_secret("FEISHU_ALLOW_BOTS", "none").strip().lower()
         if allow_bots not in {"none", "mentions", "all"}:
             logger.warning(
                 "[Feishu] Unknown allow_bots=%r, falling back to 'none'. Valid: none, mentions, all.",
@@ -1599,8 +1689,13 @@ class FeishuAdapter(BasePlatformAdapter):
             )
             allow_bots = "none"
 
+        allow_all_dm = any(
+            _get_scoped_secret(var, "").strip().lower() in {"true", "1", "yes"}
+            for var in ("FEISHU_ALLOW_ALL_USERS", "GATEWAY_ALLOW_ALL_USERS")
+        )
+
         return FeishuAdapterSettings(
-            app_id=str(extra.get("app_id") or os.getenv("FEISHU_APP_ID", "")).strip(),
+            app_id=str(extra.get("app_id") or _get_scoped_secret("FEISHU_APP_ID", "")).strip(),
             app_secret=str(extra.get("app_secret") or _get_scoped_secret("FEISHU_APP_SECRET", "")).strip(),
             domain_name=str(extra.get("domain") or os.getenv("FEISHU_DOMAIN", "feishu")).strip().lower(),
             connection_mode=str(
@@ -1610,15 +1705,15 @@ class FeishuAdapter(BasePlatformAdapter):
             verification_token=str(
                 extra.get("verification_token") or _get_scoped_secret("FEISHU_VERIFICATION_TOKEN", "")
             ).strip(),
-            group_policy=os.getenv("FEISHU_GROUP_POLICY", "allowlist").strip().lower(),
+            group_policy=_get_scoped_secret("FEISHU_GROUP_POLICY", "allowlist").strip().lower(),
             allowed_group_users=frozenset(
                 item.strip()
-                for item in os.getenv("FEISHU_ALLOWED_USERS", "").split(",")
+                for item in _get_scoped_secret("FEISHU_ALLOWED_USERS", "").split(",")
                 if item.strip()
             ),
-            bot_open_id=os.getenv("FEISHU_BOT_OPEN_ID", "").strip(),
-            bot_user_id=os.getenv("FEISHU_BOT_USER_ID", "").strip(),
-            bot_name=os.getenv("FEISHU_BOT_NAME", "").strip(),
+            bot_open_id=_get_scoped_secret("FEISHU_BOT_OPEN_ID", "").strip(),
+            bot_user_id=_get_scoped_secret("FEISHU_BOT_USER_ID", "").strip(),
+            bot_name=_get_scoped_secret("FEISHU_BOT_NAME", "").strip(),
             dedup_cache_size=max(
                 32,
                 env_int("HERMES_FEISHU_DEDUP_CACHE_SIZE", _DEFAULT_DEDUP_CACHE_SIZE),
@@ -1658,8 +1753,9 @@ class FeishuAdapter(BasePlatformAdapter):
             default_group_policy=default_group_policy,
             group_rules=group_rules,
             allow_bots=allow_bots,
+            allow_all_dm=allow_all_dm,
             require_mention=_to_boolean(
-                extra.get("require_mention", os.getenv("FEISHU_REQUIRE_MENTION", "true"))
+                extra.get("require_mention", _get_scoped_secret("FEISHU_REQUIRE_MENTION", "true"))
             ),
         )
 
@@ -1692,6 +1788,7 @@ class FeishuAdapter(BasePlatformAdapter):
         self._ws_ping_interval = settings.ws_ping_interval
         self._ws_ping_timeout = settings.ws_ping_timeout
         self._allow_bots = settings.allow_bots
+        self._allow_all_dm = settings.allow_all_dm
         self._require_mention = settings.require_mention
 
     def _build_event_handler(self) -> Any:
@@ -1814,6 +1911,13 @@ class FeishuAdapter(BasePlatformAdapter):
 
             self._loop = asyncio.get_running_loop()
             await self._connect_with_retry()
+            if self._connection_mode == "websocket":
+                # Supervised reconnect (#73779): the WS thread can die without
+                # any external signal; keep a watcher alive for as long as this
+                # adapter is supposed to be connected.
+                self._ws_supervisor = asyncio.ensure_future(
+                    self._supervise_websocket_thread()
+                )
             self._mark_connected()
             logger.info("[Feishu] Connected in %s mode (%s)", self._connection_mode, self._domain_name)
             # Plugin-registered native handlers (lark_oapi client).
@@ -1829,6 +1933,9 @@ class FeishuAdapter(BasePlatformAdapter):
     async def disconnect(self) -> None:
         """Disconnect from Feishu/Lark."""
         self._running = False
+        if self._ws_supervisor is not None:
+            self._ws_supervisor.cancel()
+            self._ws_supervisor = None
         await self._cancel_pending_tasks(self._pending_text_batch_tasks)
         await self._cancel_pending_tasks(self._pending_media_batch_tasks)
         self._reset_batch_buffers()
@@ -4390,9 +4497,10 @@ class FeishuAdapter(BasePlatformAdapter):
                 return "bot_not_mentioned"
 
         if not is_group:
-            if os.getenv("FEISHU_ALLOW_ALL_USERS", "").strip().lower() in {"true", "1", "yes"}:
-                return None
-            if os.getenv("GATEWAY_ALLOW_ALL_USERS", "").strip().lower() in {"true", "1", "yes"}:
+            # Snapshotted per-profile in _load_settings: _admit runs on the
+            # lark_oapi WS thread with no secret scope, and a bare os.getenv
+            # here would read the default profile's value (#86905).
+            if self._allow_all_dm:
                 return None
             # Empty FEISHU_ALLOWED_USERS is the pairing-mode default from setup:
             # forward DMs to gateway intake so the pairing handshake can run.
@@ -4946,6 +5054,52 @@ class FeishuAdapter(BasePlatformAdapter):
                 )
                 await asyncio.sleep(wait_seconds)
 
+    async def _supervise_websocket_thread(self) -> None:
+        """Restart the WS client thread if it dies while the adapter is up.
+
+        ``lark_oapi``'s ``start()`` blocks forever on a healthy connection
+        and only returns on fatal errors. Before this watcher existed the
+        executor future was awaited solely by ``disconnect()``, so a dead
+        thread left the profile silently deaf until a gateway restart
+        (#73779). Watch the future and, on unexpected exit, rebuild the
+        client with capped exponential backoff.
+        """
+        backoff = initial_backoff = float(self._ws_restart_backoff)
+        last_dead: Optional[asyncio.Future] = None
+        while self._running:
+            ws_future = self._ws_future
+            if ws_future is None:
+                return
+            try:
+                await asyncio.shield(ws_future)
+            except asyncio.CancelledError:
+                raise
+            except Exception:
+                pass
+            # Deliberate disconnect paths nil ``_ws_client`` / ``_running``
+            # before the thread exits; only restart when the link is still
+            # expected to be up.
+            if not self._running or self._ws_client is None:
+                return
+            if ws_future is not last_dead:
+                logger.error(
+                    "[Feishu] WebSocket client thread exited unexpectedly; "
+                    "restarting in %.0fs",
+                    backoff,
+                )
+                last_dead = ws_future
+            await asyncio.sleep(backoff)
+            if not self._running:
+                return
+            try:
+                await self._connect_websocket()
+                backoff = initial_backoff
+            except Exception as exc:
+                logger.warning(
+                    "[Feishu] WebSocket restart failed (retrying): %s", exc
+                )
+                backoff = min(backoff * 2, 60.0)
+
     async def _connect_websocket(self) -> None:
         if not FEISHU_WEBSOCKET_AVAILABLE:
             raise RuntimeError("websockets not installed; websocket mode unavailable")
diff --git a/plugins/platforms/google_chat/adapter.py b/plugins/platforms/google_chat/adapter.py
index 41c9b65500..7be34ceee2 100644
--- a/plugins/platforms/google_chat/adapter.py
+++ b/plugins/platforms/google_chat/adapter.py
@@ -48,6 +48,45 @@ import time
 from pathlib import Path as _Path
 from typing import Any, Callable, Dict, List, Optional, Tuple
 
+from agent.secret_scope import UnscopedSecretError as _UnscopedSecretError
+from agent.secret_scope import get_secret as _scoped_get_secret
+from agent.secret_scope import is_multiplex_active
+
+
+def _get_scoped_secret(name: str, default: Optional[str] = None) -> Optional[str]:
+    """Scope-aware config/credential read with the default-profile fallback.
+
+    Secondary profiles construct their adapters under a profile secret
+    scope -- the scope is authoritative and a scoped miss returns ``default``
+    (no cross-profile borrow from ``os.environ``, which may hold another
+    profile's value). The DEFAULT profile's adapter constructs and connects
+    *unscoped* under multiplexing, where a bare ``get_secret`` would raise
+    ``UnscopedSecretError`` and crash startup/reconnect (#70652 class); there
+    ``os.environ`` is that profile's own value, so fall back to it. Same
+    pattern as ``whatsapp_common._get_wsecret`` and the WeCom/IRC/ntfy
+    plugin adapters.
+    """
+    try:
+        val = _scoped_get_secret(name, default)
+    except _UnscopedSecretError:
+        val = os.getenv(name)
+    return val if val is not None else default
+
+
+def _adc_would_borrow_foreign_credentials() -> bool:
+    """True when ADC would silently read another profile's SA from process env.
+
+    ``google.auth.default()`` consults ``os.environ`` directly. Under
+    multiplexing a scoped profile only reaches the ADC branch after its own
+    scope had no service-account setting -- if the process env still carries
+    one (the default profile's), ADC would authenticate this profile as that
+    other identity. Fail closed instead.
+    """
+    return is_multiplex_active() and bool(
+        os.environ.get("GOOGLE_CHAT_SERVICE_ACCOUNT_JSON")
+        or os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")
+    )
+
 # Heavy google-cloud + googleapiclient imports are deferred to first
 # adapter use. Importing them eagerly here added ~110ms wall and ~33MB
 # RSS to *every* CLI invocation (the plugin loader imports this module at
@@ -184,6 +223,7 @@ from gateway.config import Platform, PlatformConfig
 Platform("google_chat")
 from gateway.platforms.helpers import MessageDeduplicator
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -736,28 +776,48 @@ class GoogleChatAdapter(BasePlatformAdapter):
         # end-of-turn by on_processing_complete via patch-to-empty so
         # they don't sit in the chat forever as "Hermes is thinking…".
         self._orphan_typing_messages: Dict[str, List[str]] = {}
-        # FlowControl knobs (env-configurable).
+        # Snapshot profile-scoped settings while adapter construction still
+        # runs inside _profile_runtime_scope. Pub/Sub invokes callbacks from
+        # its own threads, where the ContextVar secret scope is intentionally
+        # unavailable; callbacks must use these instance values rather than
+        # consulting process-global environment state.
+        extra = self.config.extra
         try:
-            self._max_messages = int(os.getenv("GOOGLE_CHAT_MAX_MESSAGES", "1"))
+            self._max_messages = int(
+                extra.get("max_messages")
+                or _get_scoped_secret("GOOGLE_CHAT_MAX_MESSAGES", "1")
+            )
         except (ValueError, TypeError):
             self._max_messages = 1
         try:
-            self._max_bytes = int(os.getenv("GOOGLE_CHAT_MAX_BYTES", str(16 * 1024 * 1024)))
+            self._max_bytes = int(
+                extra.get("max_bytes")
+                or _get_scoped_secret("GOOGLE_CHAT_MAX_BYTES", str(16 * 1024 * 1024))
+            )
         except (ValueError, TypeError):
             self._max_bytes = 16 * 1024 * 1024
+        self._bootstrap_spaces = str(
+            extra.get("bootstrap_spaces")
+            or _get_scoped_secret("GOOGLE_CHAT_BOOTSTRAP_SPACES", "")
+            or ""
+        ).strip()
+        self._debug_raw = bool(
+            extra.get("debug_raw")
+            or _get_scoped_secret("GOOGLE_CHAT_DEBUG_RAW")
+        )
         self._http_events_url = (
-            self.config.extra.get("http_events_url")
-            or os.getenv("GOOGLE_CHAT_HTTP_EVENTS_URL", "")
+            extra.get("http_events_url")
+            or _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_URL", "")
             or ""
         ).strip()
         self._http_events_audience = (
-            self.config.extra.get("http_events_audience")
-            or os.getenv("GOOGLE_CHAT_HTTP_EVENTS_AUDIENCE", "")
+            extra.get("http_events_audience")
+            or _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_AUDIENCE", "")
             or self._http_events_url
         ).strip()
         self._http_events_service_account_email = (
-            self.config.extra.get("http_events_service_account_email")
-            or os.getenv("GOOGLE_CHAT_HTTP_EVENTS_SERVICE_ACCOUNT_EMAIL", "")
+            extra.get("http_events_service_account_email")
+            or _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_SERVICE_ACCOUNT_EMAIL", "")
             or ""
         ).strip().lower()
 
@@ -779,7 +839,7 @@ class GoogleChatAdapter(BasePlatformAdapter):
         """
         sa_path = (
             self.config.extra.get("service_account_json")
-            or os.getenv("GOOGLE_APPLICATION_CREDENTIALS")
+            or _get_scoped_secret("GOOGLE_APPLICATION_CREDENTIALS")
         )
         if sa_path:
             # Inline JSON (rare, but supported).
@@ -811,6 +871,13 @@ class GoogleChatAdapter(BasePlatformAdapter):
 
         # No explicit SA configured — try ADC. This is the Cloud Run / GCE
         # path; google-auth picks up the workload identity automatically.
+        if _adc_would_borrow_foreign_credentials():
+            raise ValueError(
+                "Google Chat ADC skipped for this profile: service-account "
+                "credentials are set in the process environment but not in "
+                "this profile's secret scope. Set "
+                "GOOGLE_CHAT_SERVICE_ACCOUNT_JSON in this profile's .env."
+            )
         try:
             import google.auth as google_auth
         except ImportError:
@@ -916,8 +983,12 @@ class GoogleChatAdapter(BasePlatformAdapter):
     # ------------------------------------------------------------------
     def _bot_id_cache_path(self) -> _Path:
         """Location where the resolved bot user_id is cached across restarts."""
-        base = os.getenv("HERMES_HOME", str(_Path.home() / ".hermes"))
-        return _Path(base) / "google_chat_bot_id.json"
+        # Resolve at call time (connect() runs inside the profile scope) so
+        # multiplexed profiles do not share one bot-identity cache file; the
+        # thread-count store above already resolves the same way.
+        from hermes_constants import get_hermes_home as _get_hermes_home
+
+        return _get_hermes_home() / "google_chat_bot_id.json"
 
     def _load_cached_bot_id(self) -> Optional[str]:
         path = self._bot_id_cache_path()
@@ -952,7 +1023,7 @@ class GoogleChatAdapter(BasePlatformAdapter):
         if self.config.home_channel and self.config.home_channel.chat_id:
             candidate_spaces.append(self.config.home_channel.chat_id)
         # Env-configured allowed spaces (comma-separated). Optional.
-        extra_spaces = os.getenv("GOOGLE_CHAT_BOOTSTRAP_SPACES", "").strip()
+        extra_spaces = self._bootstrap_spaces
         if extra_spaces:
             candidate_spaces.extend(
                 s.strip() for s in extra_spaces.split(",") if s.strip()
@@ -1401,7 +1472,7 @@ class GoogleChatAdapter(BasePlatformAdapter):
             list(envelope.keys()),
             ce_type,
         )
-        if os.getenv("GOOGLE_CHAT_DEBUG_RAW"):
+        if self._debug_raw:
             # Dangerous flag: contains message text and sender email. Route
             # through the global redaction filter and gate at DEBUG level so
             # default log configurations never surface it. Operators must
@@ -3362,14 +3433,14 @@ def _check_for_registry() -> bool:
     if not check_google_chat_requirements():
         return False
     project = (
-        os.getenv("GOOGLE_CHAT_PROJECT_ID")
-        or os.getenv("GOOGLE_CLOUD_PROJECT")
+        _get_scoped_secret("GOOGLE_CHAT_PROJECT_ID")
+        or _get_scoped_secret("GOOGLE_CLOUD_PROJECT")
     )
     subscription = (
-        os.getenv("GOOGLE_CHAT_SUBSCRIPTION_NAME")
-        or os.getenv("GOOGLE_CHAT_SUBSCRIPTION")
+        _get_scoped_secret("GOOGLE_CHAT_SUBSCRIPTION_NAME")
+        or _get_scoped_secret("GOOGLE_CHAT_SUBSCRIPTION")
     )
-    http_events_url = os.getenv("GOOGLE_CHAT_HTTP_EVENTS_URL")
+    http_events_url = _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_URL")
     return bool(http_events_url or (project and subscription))
 
 
@@ -3393,14 +3464,14 @@ def _env_enablement() -> Optional[Dict[str, Any]]:
     ``PlatformConfig`` rather than being merged into ``extra``.
     """
     project = (
-        os.getenv("GOOGLE_CHAT_PROJECT_ID")
-        or os.getenv("GOOGLE_CLOUD_PROJECT")
+        _get_scoped_secret("GOOGLE_CHAT_PROJECT_ID")
+        or _get_scoped_secret("GOOGLE_CLOUD_PROJECT")
     )
     subscription = (
-        os.getenv("GOOGLE_CHAT_SUBSCRIPTION_NAME")
-        or os.getenv("GOOGLE_CHAT_SUBSCRIPTION")
+        _get_scoped_secret("GOOGLE_CHAT_SUBSCRIPTION_NAME")
+        or _get_scoped_secret("GOOGLE_CHAT_SUBSCRIPTION")
     )
-    http_events_url = os.getenv("GOOGLE_CHAT_HTTP_EVENTS_URL")
+    http_events_url = _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_URL")
     if not (http_events_url or (project and subscription)):
         return None
     seed: Dict[str, Any] = {}
@@ -3410,23 +3481,32 @@ def _env_enablement() -> Optional[Dict[str, Any]]:
         seed["subscription_name"] = subscription
     if http_events_url:
         seed["http_events_url"] = http_events_url
-    http_events_audience = os.getenv("GOOGLE_CHAT_HTTP_EVENTS_AUDIENCE")
+    http_events_audience = _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_AUDIENCE")
     if http_events_audience:
         seed["http_events_audience"] = http_events_audience
-    http_events_sa_email = os.getenv("GOOGLE_CHAT_HTTP_EVENTS_SERVICE_ACCOUNT_EMAIL")
+    http_events_sa_email = _get_scoped_secret("GOOGLE_CHAT_HTTP_EVENTS_SERVICE_ACCOUNT_EMAIL")
     if http_events_sa_email:
         seed["http_events_service_account_email"] = http_events_sa_email
+    for env_name, extra_name in (
+        ("GOOGLE_CHAT_MAX_MESSAGES", "max_messages"),
+        ("GOOGLE_CHAT_MAX_BYTES", "max_bytes"),
+        ("GOOGLE_CHAT_BOOTSTRAP_SPACES", "bootstrap_spaces"),
+        ("GOOGLE_CHAT_DEBUG_RAW", "debug_raw"),
+    ):
+        value = _get_scoped_secret(env_name)
+        if value:
+            seed[extra_name] = value
     sa_json = (
-        os.getenv("GOOGLE_CHAT_SERVICE_ACCOUNT_JSON")
-        or os.getenv("GOOGLE_APPLICATION_CREDENTIALS")
+        _get_scoped_secret("GOOGLE_CHAT_SERVICE_ACCOUNT_JSON")
+        or _get_scoped_secret("GOOGLE_APPLICATION_CREDENTIALS")
     )
     if sa_json:
         seed["service_account_json"] = sa_json
-    home = os.getenv("GOOGLE_CHAT_HOME_CHANNEL")
+    home = _get_scoped_secret("GOOGLE_CHAT_HOME_CHANNEL")
     if home:
         seed["home_channel"] = {
             "chat_id": home,
-            "name": os.getenv("GOOGLE_CHAT_HOME_CHANNEL_NAME", "Home"),
+            "name": _get_scoped_secret("GOOGLE_CHAT_HOME_CHANNEL_NAME", "Home"),
         }
     return seed
 
@@ -3576,8 +3656,8 @@ async def _standalone_send(
     extra = getattr(pconfig, "extra", {}) or {}
     sa_value = (
         extra.get("service_account_json")
-        or os.getenv("GOOGLE_CHAT_SERVICE_ACCOUNT_JSON")
-        or os.getenv("GOOGLE_APPLICATION_CREDENTIALS")
+        or _get_scoped_secret("GOOGLE_CHAT_SERVICE_ACCOUNT_JSON")
+        or _get_scoped_secret("GOOGLE_APPLICATION_CREDENTIALS")
     )
 
     if service_account is None:
@@ -3607,6 +3687,12 @@ async def _standalone_send(
                     return {"error": f"Google Chat standalone send: SA JSON file is invalid: {exc}"}
                 creds = service_account.Credentials.from_service_account_info(info, scopes=_CHAT_SCOPES)
         else:
+            if _adc_would_borrow_foreign_credentials():
+                return {"error": (
+                    "Google Chat standalone send: ADC skipped for this profile: "
+                    "service-account credentials are set in the process environment "
+                    "but not in this profile's secret scope"
+                )}
             try:
                 import google.auth as _google_auth
             except ImportError:
@@ -3655,7 +3741,7 @@ async def _standalone_send(
         return {"error": "Google Chat standalone send: aiohttp not installed"}
 
     try:
-        async with _aiohttp.ClientSession(timeout=_aiohttp.ClientTimeout(total=30.0), trust_env=True) as session:
+        async with _aiohttp.ClientSession(timeout=_aiohttp.ClientTimeout(total=30.0), trust_env=gateway_trust_env()) as session:
             async with session.post(
                 url,
                 json=body,
diff --git a/plugins/platforms/homeassistant/adapter.py b/plugins/platforms/homeassistant/adapter.py
index 37a7397d4b..bfdd136cdf 100644
--- a/plugins/platforms/homeassistant/adapter.py
+++ b/plugins/platforms/homeassistant/adapter.py
@@ -30,6 +30,7 @@ except ImportError:
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -141,7 +142,8 @@ class HomeAssistantAdapter(BasePlatformAdapter):
 
             # Dedicated REST session for send() calls
             self._rest_session = aiohttp.ClientSession(
-                timeout=aiohttp.ClientTimeout(total=30)
+                timeout=aiohttp.ClientTimeout(total=30),
+                trust_env=gateway_trust_env(),
             )
 
             # Warn if no event filters are configured
@@ -171,7 +173,8 @@ class HomeAssistantAdapter(BasePlatformAdapter):
         ws_url = f"{ws_url}/api/websocket"
 
         self._session = aiohttp.ClientSession(
-            timeout=aiohttp.ClientTimeout(total=30)
+            timeout=aiohttp.ClientTimeout(total=30),
+            trust_env=gateway_trust_env(),
         )
         self._ws = await self._session.ws_connect(ws_url, heartbeat=30, timeout=30)
 
@@ -447,7 +450,7 @@ class HomeAssistantAdapter(BasePlatformAdapter):
                         body = await resp.text()
                         return SendResult(success=False, error=f"HTTP {resp.status}: {body}")
             else:
-                async with aiohttp.ClientSession() as session:
+                async with aiohttp.ClientSession(trust_env=gateway_trust_env()) as session:
                     async with session.post(
                         url,
                         headers=headers,
@@ -532,7 +535,8 @@ async def _standalone_send(
 
     try:
         async with aiohttp.ClientSession(
-            timeout=aiohttp.ClientTimeout(total=30)
+            timeout=aiohttp.ClientTimeout(total=30),
+            trust_env=gateway_trust_env(),
         ) as session:
             async with session.post(url, headers=headers, json=payload) as resp:
                 if resp.status not in {200, 201}:
diff --git a/plugins/platforms/irc/adapter.py b/plugins/platforms/irc/adapter.py
index ce3ec4ed59..8afce0ff19 100644
--- a/plugins/platforms/irc/adapter.py
+++ b/plugins/platforms/irc/adapter.py
@@ -130,16 +130,17 @@ class IRCAdapter(BasePlatformAdapter):
         extra = getattr(config, "extra", {}) or {}
 
         # Connection settings (env vars override config.yaml)
-        self.server = os.getenv("IRC_SERVER") or extra.get("server", "")
+        self.server = _get_scoped_secret("IRC_SERVER") or extra.get("server", "")
         try:
-            self.port = int(os.getenv("IRC_PORT") or extra.get("port", 6697))
+            self.port = int(_get_scoped_secret("IRC_PORT") or extra.get("port", 6697))
         except (ValueError, TypeError):
             self.port = 6697
-        self.nickname = os.getenv("IRC_NICKNAME") or extra.get("nickname", "hermes-bot")
-        self.channel = os.getenv("IRC_CHANNEL") or extra.get("channel", "")
+        self.nickname = _get_scoped_secret("IRC_NICKNAME") or extra.get("nickname", "hermes-bot")
+        self.channel = _get_scoped_secret("IRC_CHANNEL") or extra.get("channel", "")
+        _use_tls_raw = _get_scoped_secret("IRC_USE_TLS")
         self.use_tls = (
-            os.getenv("IRC_USE_TLS", "").lower() in {"1", "true", "yes"}
-            if os.getenv("IRC_USE_TLS")
+            _use_tls_raw.lower() in {"1", "true", "yes"}
+            if _use_tls_raw
             else extra.get("use_tls", True)
         )
         self.server_password = _get_scoped_secret("IRC_SERVER_PASSWORD") or extra.get("server_password", "")
@@ -545,8 +546,8 @@ def check_requirements() -> bool:
 
     Only requires the server and channel — no external pip packages needed.
     """
-    server = os.getenv("IRC_SERVER", "")
-    channel = os.getenv("IRC_CHANNEL", "")
+    server = _get_scoped_secret("IRC_SERVER", "")
+    channel = _get_scoped_secret("IRC_CHANNEL", "")
     # Also accept config.yaml-only configuration (no env vars).
     # The gateway passes PlatformConfig; we just check env for the
     # hermes setup / requirements check path.
@@ -556,8 +557,8 @@ def check_requirements() -> bool:
 def validate_config(config) -> bool:
     """Validate that the platform config has enough info to connect."""
     extra = getattr(config, "extra", {}) or {}
-    server = os.getenv("IRC_SERVER") or extra.get("server", "")
-    channel = os.getenv("IRC_CHANNEL") or extra.get("channel", "")
+    server = _get_scoped_secret("IRC_SERVER") or extra.get("server", "")
+    channel = _get_scoped_secret("IRC_CHANNEL") or extra.get("channel", "")
     return bool(server and channel)
 
 
@@ -671,8 +672,8 @@ def interactive_setup() -> None:
 def is_connected(config) -> bool:
     """Check whether IRC is configured (env or config.yaml)."""
     extra = getattr(config, "extra", {}) or {}
-    server = os.getenv("IRC_SERVER") or extra.get("server", "")
-    channel = os.getenv("IRC_CHANNEL") or extra.get("channel", "")
+    server = _get_scoped_secret("IRC_SERVER") or extra.get("server", "")
+    channel = _get_scoped_secret("IRC_CHANNEL") or extra.get("channel", "")
     return bool(server and channel)
 
 
@@ -689,24 +690,24 @@ def _env_enablement() -> dict | None:
     the core hook — it becomes a proper ``HomeChannel`` dataclass on the
     ``PlatformConfig`` rather than being merged into ``extra``.
     """
-    server = os.getenv("IRC_SERVER", "").strip()
-    channel = os.getenv("IRC_CHANNEL", "").strip()
+    server = _get_scoped_secret("IRC_SERVER", "").strip()
+    channel = _get_scoped_secret("IRC_CHANNEL", "").strip()
     if not (server and channel):
         return None
     seed: dict = {
         "server": server,
         "channel": channel,
     }
-    port = os.getenv("IRC_PORT", "").strip()
+    port = _get_scoped_secret("IRC_PORT", "").strip()
     if port:
         try:
             seed["port"] = int(port)
         except ValueError:
             pass
-    nickname = os.getenv("IRC_NICKNAME", "").strip()
+    nickname = _get_scoped_secret("IRC_NICKNAME", "").strip()
     if nickname:
         seed["nickname"] = nickname
-    use_tls = os.getenv("IRC_USE_TLS", "").strip().lower()
+    use_tls = _get_scoped_secret("IRC_USE_TLS", "").strip().lower()
     if use_tls:
         seed["use_tls"] = use_tls in {"1", "true", "yes"}
     # Passwords live in PlatformConfig.extra as well for back-compat with
@@ -718,11 +719,11 @@ def _env_enablement() -> dict | None:
     # Optional home-channel (usually the same as IRC_CHANNEL, but can be a
     # dedicated reports channel).  Defaults to IRC_CHANNEL so cron jobs
     # with ``deliver=irc`` have a sensible target without extra config.
-    home = os.getenv("IRC_HOME_CHANNEL") or channel
+    home = _get_scoped_secret("IRC_HOME_CHANNEL") or channel
     if home:
         seed["home_channel"] = {
             "chat_id": home,
-            "name": os.getenv("IRC_HOME_CHANNEL_NAME", home),
+            "name": _get_scoped_secret("IRC_HOME_CHANNEL_NAME", home),
         }
     return seed
 
@@ -770,19 +771,19 @@ async def _standalone_send(
     primitive.
     """
     extra = getattr(pconfig, "extra", {}) or {}
-    server = os.getenv("IRC_SERVER") or extra.get("server", "")
-    channel = os.getenv("IRC_CHANNEL") or extra.get("channel", "")
+    server = _get_scoped_secret("IRC_SERVER") or extra.get("server", "")
+    channel = _get_scoped_secret("IRC_CHANNEL") or extra.get("channel", "")
     if not server or not channel:
         return {"error": "IRC standalone send: IRC_SERVER and IRC_CHANNEL must be configured"}
 
-    port_value = os.getenv("IRC_PORT") or extra.get("port", 6697)
+    port_value = _get_scoped_secret("IRC_PORT") or extra.get("port", 6697)
     try:
         port = int(port_value)
     except (TypeError, ValueError):
         return {"error": f"IRC standalone send: invalid port {port_value!r}"}
 
-    nickname = os.getenv("IRC_NICKNAME") or extra.get("nickname", "hermes-bot")
-    use_tls_env = os.getenv("IRC_USE_TLS")
+    nickname = _get_scoped_secret("IRC_NICKNAME") or extra.get("nickname", "hermes-bot")
+    use_tls_env = _get_scoped_secret("IRC_USE_TLS")
     if use_tls_env is not None:
         use_tls = use_tls_env.lower() in {"1", "true", "yes"}
     else:
diff --git a/plugins/platforms/line/adapter.py b/plugins/platforms/line/adapter.py
index b8d3ae10cd..1150556b4e 100644
--- a/plugins/platforms/line/adapter.py
+++ b/plugins/platforms/line/adapter.py
@@ -113,6 +113,7 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -514,7 +515,7 @@ class _LineClient:
     async def reply(self, reply_token: str, messages: List[Dict[str, Any]]) -> None:
         import aiohttp
         timeout = aiohttp.ClientTimeout(total=self._timeout)
-        async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+        async with aiohttp.ClientSession(timeout=timeout, trust_env=gateway_trust_env()) as session:
             async with session.post(
                 LINE_REPLY_URL,
                 headers=self._headers,
@@ -527,7 +528,7 @@ class _LineClient:
     async def push(self, chat_id: str, messages: List[Dict[str, Any]]) -> None:
         import aiohttp
         timeout = aiohttp.ClientTimeout(total=self._timeout)
-        async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+        async with aiohttp.ClientSession(timeout=timeout, trust_env=gateway_trust_env()) as session:
             async with session.post(
                 LINE_PUSH_URL,
                 headers=self._headers,
@@ -546,7 +547,7 @@ class _LineClient:
         clamped = max(5, min(60, (seconds // 5) * 5 or 5))
         try:
             timeout = aiohttp.ClientTimeout(total=5.0)
-            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=gateway_trust_env()) as session:
                 await session.post(
                     LINE_LOADING_URL,
                     headers=self._headers,
@@ -560,7 +561,7 @@ class _LineClient:
         import aiohttp
         url = LINE_CONTENT_URL_FMT.format(message_id=message_id)
         timeout = aiohttp.ClientTimeout(total=30.0)
-        async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+        async with aiohttp.ClientSession(timeout=timeout, trust_env=gateway_trust_env()) as session:
             async with session.get(url, headers={"Authorization": f"Bearer {self._token}"}) as resp:
                 if resp.status >= 400:
                     raise RuntimeError(f"LINE content {resp.status}")
@@ -571,7 +572,7 @@ class _LineClient:
         import aiohttp
         timeout = aiohttp.ClientTimeout(total=10.0)
         try:
-            async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
+            async with aiohttp.ClientSession(timeout=timeout, trust_env=gateway_trust_env()) as session:
                 async with session.get(LINE_BOT_INFO_URL, headers=self._headers) as resp:
                     if resp.status >= 400:
                         return None
diff --git a/plugins/platforms/matrix/adapter.py b/plugins/platforms/matrix/adapter.py
index 3268fd9d19..6a2eb362ff 100644
--- a/plugins/platforms/matrix/adapter.py
+++ b/plugins/platforms/matrix/adapter.py
@@ -128,6 +128,7 @@ except ImportError:
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -593,13 +594,14 @@ def _resolve_max_message_length(config) -> int:
 # Back-compat alias for callers/tests that import the module constant.
 MAX_MESSAGE_LENGTH = DEFAULT_MAX_MESSAGE_LENGTH
 
-# Store directory for E2EE keys and sync state.
-# Uses get_hermes_home() so each profile gets its own Matrix store.
+# Store directory for E2EE keys and sync state. Resolved per adapter in
+# ``connect()`` (see ``_resolve_store_dir``), NOT at module scope: the
+# multiplex gateway imports this module once, so a module-level constant
+# would pin the root HERMES_HOME for every profile and all bots' Olm
+# identities would collide in one crypto.db (#89168). Mirrors the
+# pairing-store fix (a6397c379).
 from hermes_constants import get_hermes_dir as _get_hermes_dir
 
-_STORE_DIR = _get_hermes_dir("platforms/matrix/store", "matrix/store")
-_CRYPTO_DB_PATH = _STORE_DIR / "crypto.db"
-
 # Grace period: ignore messages older than this many seconds before startup.
 _STARTUP_GRACE_SECONDS = 5
 
@@ -763,7 +765,7 @@ def _create_matrix_session(proxy_url: str | None):
     import aiohttp
 
     if not proxy_url:
-        return aiohttp.ClientSession(trust_env=True)
+        return aiohttp.ClientSession(trust_env=gateway_trust_env())
 
     if proxy_url.split("://")[0].lower().startswith("socks"):
         try:
@@ -778,7 +780,7 @@ def _create_matrix_session(proxy_url: str | None):
                 "Run: pip install aiohttp-socks",
                 proxy_url,
             )
-            return aiohttp.ClientSession(trust_env=True)
+            return aiohttp.ClientSession(trust_env=gateway_trust_env())
 
     return aiohttp.ClientSession(proxy=proxy_url)
 
@@ -1018,7 +1020,7 @@ def check_matrix_requirements() -> bool:
     """
     token = _startup_env_secret("MATRIX_ACCESS_TOKEN")
     password = _startup_env_secret("MATRIX_PASSWORD")
-    homeserver = os.getenv("MATRIX_HOMESERVER", "")
+    homeserver = _startup_env_secret("MATRIX_HOMESERVER")
 
     if not token and not password:
         logger.debug("Matrix: neither MATRIX_ACCESS_TOKEN nor MATRIX_PASSWORD set")
@@ -1187,6 +1189,23 @@ class MatrixAdapter(BasePlatformAdapter):
     max_message_length = DEFAULT_MAX_MESSAGE_LENGTH
     _split_threshold = DEFAULT_MAX_MESSAGE_LENGTH - 100
 
+    def _resolve_store_dir(self) -> Path:
+        """Pin this adapter's crypto-store directory to the active profile.
+
+        Called from ``connect()``, which the multiplex gateway runs inside
+        ``_profile_runtime_scope`` -- ``get_hermes_dir`` honors that
+        context-local HERMES_HOME, so each profile's adapter gets its own
+        store. Cached on the instance so later reads (diagnostics, error
+        logs) outside the scope still report the store actually in use.
+        """
+        self._store_dir = _get_hermes_dir("platforms/matrix/store", "matrix/store")
+        return self._store_dir
+
+    @property
+    def _crypto_db_path(self) -> Path:
+        store_dir = self._store_dir or _get_hermes_dir("platforms/matrix/store", "matrix/store")
+        return store_dir / "crypto.db"
+
     def __init__(self, config: PlatformConfig):
         super().__init__(config, Platform.MATRIX)
 
@@ -1217,6 +1236,7 @@ class MatrixAdapter(BasePlatformAdapter):
 
         self._client: Any = None  # mautrix.client.Client
         self._crypto_db: Any = None  # mautrix.util.async_db.Database
+        self._store_dir: Optional[Path] = None  # pinned per profile in connect()
         self._sync_task: Optional[asyncio.Task] = None
         self._invite_join_tasks: Dict[str, asyncio.Task] = {}
         self._closing = False
@@ -1672,7 +1692,7 @@ class MatrixAdapter(BasePlatformAdapter):
                     "Matrix: server has different identity keys for device %s — "
                     "local crypto state is stale. Delete %s and restart.",
                     client.device_id,
-                    _CRYPTO_DB_PATH,
+                    str(self._crypto_db_path),
                 )
                 return False
 
@@ -1728,8 +1748,9 @@ class MatrixAdapter(BasePlatformAdapter):
             logger.error("Matrix: homeserver URL not configured")
             return False
 
-        # Ensure store dir exists for E2EE key persistence.
-        _STORE_DIR.mkdir(parents=True, exist_ok=True)
+        # Ensure store dir exists for E2EE key persistence (resolved here,
+        # inside the profile scope, so multiplexed profiles never share it).
+        self._resolve_store_dir().mkdir(parents=True, exist_ok=True)
 
         # Create the HTTP API layer.
         client_session = _create_matrix_session(self._proxy_url)
@@ -1886,7 +1907,7 @@ class MatrixAdapter(BasePlatformAdapter):
                     from mautrix.crypto.store.asyncpg import PgCryptoStore
                     from mautrix.util.async_db import Database
 
-                    _STORE_DIR.mkdir(parents=True, exist_ok=True)
+                    self._store_dir.mkdir(parents=True, exist_ok=True)
                 except Exception as exc:
                     if self._e2ee_mode == "optional":
                         logger.warning(
@@ -1907,7 +1928,7 @@ class MatrixAdapter(BasePlatformAdapter):
             if self._encryption:
                 try:
                     # Remove legacy pickle file from pre-SQLite era.
-                    legacy_pickle = _STORE_DIR / "crypto_store.pickle"
+                    legacy_pickle = self._store_dir / "crypto_store.pickle"
                     if legacy_pickle.exists():
                         logger.info(
                             "Matrix: removing legacy crypto_store.pickle (migrated to SQLite)"
@@ -1915,7 +1936,7 @@ class MatrixAdapter(BasePlatformAdapter):
                         legacy_pickle.unlink()
 
                     crypto_db = Database.create(
-                        f"sqlite:///{_CRYPTO_DB_PATH}",
+                        f"sqlite:///{self._crypto_db_path}",
                         upgrade_table=PgCryptoStore.upgrade_table,
                     )
                     await crypto_db.start()
@@ -2043,7 +2064,7 @@ class MatrixAdapter(BasePlatformAdapter):
                     client.crypto = olm
                     logger.info(
                         "Matrix: E2EE enabled (store: %s%s)",
-                        str(_CRYPTO_DB_PATH),
+                        str(self._crypto_db_path),
                         f", device_id={client.device_id}" if client.device_id else "",
                     )
                 except Exception as exc:
@@ -2287,7 +2308,7 @@ class MatrixAdapter(BasePlatformAdapter):
                 "mode": self._e2ee_mode,
                 "enabled": bool(self._encryption),
                 "deps_available": _check_e2ee_deps(),
-                "crypto_store_path": str(_CRYPTO_DB_PATH),
+                "crypto_store_path": str(self._crypto_db_path),
                 "recovery_key_configured": bool(
                     _scoped_recovery_key().strip()
                 ),
diff --git a/plugins/platforms/mattermost/adapter.py b/plugins/platforms/mattermost/adapter.py
index 6962fbf615..6f5172bb01 100644
--- a/plugins/platforms/mattermost/adapter.py
+++ b/plugins/platforms/mattermost/adapter.py
@@ -24,6 +24,7 @@ from typing import Any, Dict, List, Optional, Tuple
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.helpers import MessageDeduplicator
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -100,7 +101,7 @@ def validate_mattermost_config(config: PlatformConfig) -> bool:
     """Return True when Mattermost has enough config to connect."""
     extra = getattr(config, "extra", {}) or {}
     token = (getattr(config, "token", None) or _get_scoped_secret("MATTERMOST_TOKEN", "")).strip()
-    url = (extra.get("url", "") or os.getenv("MATTERMOST_URL", "")).strip()
+    url = (extra.get("url", "") or _get_scoped_secret("MATTERMOST_URL", "")).strip()
     if not token:
         logger.debug("Mattermost: MATTERMOST_TOKEN not set")
         return False
@@ -120,7 +121,7 @@ class MattermostAdapter(BasePlatformAdapter):
 
         self._base_url: str = (
             config.extra.get("url", "")
-            or os.getenv("MATTERMOST_URL", "")
+            or _get_scoped_secret("MATTERMOST_URL", "")
         ).rstrip("/")
         self._token: str = config.token or _get_scoped_secret("MATTERMOST_TOKEN", "")
 
@@ -137,7 +138,7 @@ class MattermostAdapter(BasePlatformAdapter):
         # Reply mode: "thread" to nest replies, "off" for flat messages.
         self._reply_mode: str = (
             config.extra.get("reply_mode", "")
-            or os.getenv("MATTERMOST_REPLY_MODE", "off")
+            or _get_scoped_secret("MATTERMOST_REPLY_MODE", "off")
         ).lower()
 
         self._last_post_status: Optional[int] = None
@@ -316,7 +317,8 @@ class MattermostAdapter(BasePlatformAdapter):
             return False
 
         self._session = aiohttp.ClientSession(
-            timeout=aiohttp.ClientTimeout(total=30)
+            timeout=aiohttp.ClientTimeout(total=30),
+            trust_env=gateway_trust_env(),
         )
         self._closing = False
 
@@ -870,7 +872,7 @@ class MattermostAdapter(BasePlatformAdapter):
             # ignored, even if @mentioned.  DMs are already excluded above.
             allowed_raw = self.config.extra.get("allowed_channels") if self.config.extra else None
             if allowed_raw is None:
-                allowed_raw = os.getenv("MATTERMOST_ALLOWED_CHANNELS", "")
+                allowed_raw = _get_scoped_secret("MATTERMOST_ALLOWED_CHANNELS", "")
             if isinstance(allowed_raw, list):
                 allowed_channels = {str(c).strip() for c in allowed_raw if str(c).strip()}
             else:
@@ -884,12 +886,18 @@ class MattermostAdapter(BasePlatformAdapter):
                 )
                 return
 
-            require_mention = os.getenv(
-                "MATTERMOST_REQUIRE_MENTION", "true"
-            ).lower() not in {"false", "0", "no"}
+            require_mention_raw = self.config.extra.get("require_mention") if self.config.extra else None
+            if require_mention_raw is None:
+                require_mention_raw = _get_scoped_secret("MATTERMOST_REQUIRE_MENTION", "true")
+            require_mention = str(require_mention_raw).lower() not in {"false", "0", "no"}
 
-            free_channels_raw = os.getenv("MATTERMOST_FREE_RESPONSE_CHANNELS", "")
-            free_channels = {ch.strip() for ch in free_channels_raw.split(",") if ch.strip()}
+            free_channels_raw = self.config.extra.get("free_response_channels") if self.config.extra else None
+            if free_channels_raw is None:
+                free_channels_raw = _get_scoped_secret("MATTERMOST_FREE_RESPONSE_CHANNELS", "")
+            if isinstance(free_channels_raw, list):
+                free_channels = {str(ch).strip() for ch in free_channels_raw if str(ch).strip()}
+            else:
+                free_channels = {ch.strip() for ch in str(free_channels_raw).split(",") if ch.strip()}
             is_free_channel = channel_id in free_channels
 
             mention_patterns = [
@@ -1057,7 +1065,7 @@ async def _standalone_send(
 
     base_url = (
         (getattr(pconfig, "extra", {}) or {}).get("url")
-        or os.getenv("MATTERMOST_URL", "")
+        or _get_scoped_secret("MATTERMOST_URL", "")
     ).rstrip("/")
     token = (getattr(pconfig, "token", None) or _get_scoped_secret("MATTERMOST_TOKEN", "")).strip()
     if not base_url or not token:
@@ -1232,40 +1240,62 @@ def interactive_setup() -> None:
 # ---------------------------------------------------------------------------
 
 
+def _profile_scoped_config_load() -> bool:
+    """True when running inside a multiplexed secondary profile's scope.
+
+    Secondary-profile adapters are constructed and connected inside
+    ``_profile_runtime_scope`` (secret scope installed + multiplex active) --
+    the same discriminator the Buzz/Discord/Telegram/WhatsApp/LINE/DingTalk
+    adapters use for this bug class (#98738 / #72348 / #80099). The DEFAULT
+    profile under multiplexing runs unscoped: ``os.environ`` holds its own
+    bridge output there and keeps its legacy precedence.
+    """
+    try:
+        from agent.secret_scope import current_secret_scope, is_multiplex_active
+
+        return bool(is_multiplex_active() and current_secret_scope() is not None)
+    except Exception:
+        return False
+
+
 def _apply_yaml_config(yaml_cfg: dict, mattermost_cfg: dict) -> dict | None:
-    """Translate ``config.yaml`` ``mattermost:`` keys into env vars.
+    """Translate ``config.yaml`` ``mattermost:`` keys into env vars and
+    ``PlatformConfig.extra`` entries.
 
     Implements the ``apply_yaml_config_fn`` contract (#24836 / #25443).
     Mirrors the legacy ``mattermost_cfg`` block that used to live in
     ``gateway/config.py::load_gateway_config()`` before this migration.
 
-    The MattermostAdapter reads its runtime configuration via
-    ``os.getenv()`` for ``MATTERMOST_REQUIRE_MENTION``,
-    ``MATTERMOST_FREE_RESPONSE_CHANNELS``, and
-    ``MATTERMOST_ALLOWED_CHANNELS``.  Rather than rewrite those call sites
-    to read from ``PlatformConfig.extra``, this hook keeps the env-driven
-    model and merely owns the YAML→env translation here, next to the
-    adapter that consumes it.
-
-    Env vars take precedence over YAML — every assignment is guarded
-    by ``not os.getenv(...)`` so an explicit env var survives a config.yaml
-    update.  Returns ``None`` because no extras are seeded into
-    ``PlatformConfig.extra`` directly (everything flows through env).
+    Env vars take precedence over YAML for single-profile deployments --
+    each env write is guarded by ``not os.getenv(...)`` so an explicit env
+    var survives a config.yaml update. Under a multiplexed secondary
+    profile's scope, the env write is skipped entirely (it would otherwise
+    leak into the process-global ``os.environ`` and be inherited by every
+    other profile); instead the values are returned so the caller merges
+    them into this profile's own ``PlatformConfig.extra``, which the
+    require_mention/free_response_channels/allowed_channels read sites now
+    check first.
     """
-    if "require_mention" in mattermost_cfg and not os.getenv("MATTERMOST_REQUIRE_MENTION"):
-        os.environ["MATTERMOST_REQUIRE_MENTION"] = str(mattermost_cfg["require_mention"]).lower()
+    _skip_env_bridge = _profile_scoped_config_load()
+    seeded: dict = {}
+    if "require_mention" in mattermost_cfg:
+        seeded["require_mention"] = mattermost_cfg["require_mention"]
+        if not _skip_env_bridge and not os.getenv("MATTERMOST_REQUIRE_MENTION"):
+            os.environ["MATTERMOST_REQUIRE_MENTION"] = str(mattermost_cfg["require_mention"]).lower()
     frc = mattermost_cfg.get("free_response_channels")
-    if frc is not None and not os.getenv("MATTERMOST_FREE_RESPONSE_CHANNELS"):
-        if isinstance(frc, list):
-            frc = ",".join(str(v) for v in frc)
-        os.environ["MATTERMOST_FREE_RESPONSE_CHANNELS"] = str(frc)
+    if frc is not None:
+        seeded["free_response_channels"] = frc
+        if not _skip_env_bridge and not os.getenv("MATTERMOST_FREE_RESPONSE_CHANNELS"):
+            _frc = ",".join(str(v) for v in frc) if isinstance(frc, list) else str(frc)
+            os.environ["MATTERMOST_FREE_RESPONSE_CHANNELS"] = _frc
     # allowed_channels: if set, bot ONLY responds in these channels (whitelist)
     ac = mattermost_cfg.get("allowed_channels")
-    if ac is not None and not os.getenv("MATTERMOST_ALLOWED_CHANNELS"):
-        if isinstance(ac, list):
-            ac = ",".join(str(v) for v in ac)
-        os.environ["MATTERMOST_ALLOWED_CHANNELS"] = str(ac)
-    return None  # all settings flow through env; nothing to merge into extras
+    if ac is not None:
+        seeded["allowed_channels"] = ac
+        if not _skip_env_bridge and not os.getenv("MATTERMOST_ALLOWED_CHANNELS"):
+            _ac = ",".join(str(v) for v in ac) if isinstance(ac, list) else str(ac)
+            os.environ["MATTERMOST_ALLOWED_CHANNELS"] = _ac
+    return seeded or None
 
 
 # ---------------------------------------------------------------------------
diff --git a/plugins/platforms/ntfy/adapter.py b/plugins/platforms/ntfy/adapter.py
index b9fb08c7ef..87986416ef 100644
--- a/plugins/platforms/ntfy/adapter.py
+++ b/plugins/platforms/ntfy/adapter.py
@@ -155,21 +155,21 @@ def check_requirements() -> bool:
     """
     if not HTTPX_AVAILABLE:
         return False
-    topic = os.getenv("NTFY_TOPIC", "").strip()
+    topic = _get_scoped_secret("NTFY_TOPIC", "").strip()
     return bool(topic)
 
 
 def validate_config(config) -> bool:
     """Validate that the configured ntfy platform has a topic set."""
     extra = getattr(config, "extra", {}) or {}
-    topic = extra.get("topic") or os.getenv("NTFY_TOPIC", "")
+    topic = extra.get("topic") or _get_scoped_secret("NTFY_TOPIC", "")
     return bool(topic)
 
 
 def is_connected(config) -> bool:
     """Check whether ntfy is configured (env or config.yaml)."""
     extra = getattr(config, "extra", {}) or {}
-    topic = os.getenv("NTFY_TOPIC") or extra.get("topic", "")
+    topic = _get_scoped_secret("NTFY_TOPIC") or extra.get("topic", "")
     return bool(topic)
 
 
@@ -189,12 +189,12 @@ class NtfyAdapter(BasePlatformAdapter):
         extra = config.extra or {}
         self._server: str = (
             extra.get("server")
-            or os.getenv("NTFY_SERVER_URL", DEFAULT_SERVER)
+            or _get_scoped_secret("NTFY_SERVER_URL", DEFAULT_SERVER)
         ).rstrip("/")
-        self._topic: str = extra.get("topic") or os.getenv("NTFY_TOPIC", "")
+        self._topic: str = extra.get("topic") or _get_scoped_secret("NTFY_TOPIC", "")
         self._publish_topic: str = (
             extra.get("publish_topic")
-            or os.getenv("NTFY_PUBLISH_TOPIC", "")
+            or _get_scoped_secret("NTFY_PUBLISH_TOPIC", "")
             or self._topic
         )
         self._token: str = extra.get("token") or _get_scoped_secret("NTFY_TOKEN", "")
@@ -488,27 +488,27 @@ def _env_enablement() -> dict | None:
     core hook — it becomes a proper ``HomeChannel`` dataclass on the
     ``PlatformConfig`` rather than being merged into ``extra``.
     """
-    topic = os.getenv("NTFY_TOPIC", "").strip()
+    topic = _get_scoped_secret("NTFY_TOPIC", "").strip()
     if not topic:
         return None
     seed: dict = {
         "topic": topic,
-        "server": os.getenv("NTFY_SERVER_URL", DEFAULT_SERVER).rstrip("/"),
+        "server": _get_scoped_secret("NTFY_SERVER_URL", DEFAULT_SERVER).rstrip("/"),
     }
-    publish_topic = os.getenv("NTFY_PUBLISH_TOPIC", "").strip()
+    publish_topic = _get_scoped_secret("NTFY_PUBLISH_TOPIC", "").strip()
     if publish_topic:
         seed["publish_topic"] = publish_topic
     token = _get_scoped_secret("NTFY_TOKEN", "").strip()
     if token:
         seed["token"] = token
-    markdown = os.getenv("NTFY_MARKDOWN", "").strip().lower()
+    markdown = _get_scoped_secret("NTFY_MARKDOWN", "").strip().lower()
     if markdown:
         seed["markdown"] = markdown in ("1", "true", "yes")
-    home = os.getenv("NTFY_HOME_CHANNEL", "").strip() or topic
+    home = _get_scoped_secret("NTFY_HOME_CHANNEL", "").strip() or topic
     if home:
         seed["home_channel"] = {
             "chat_id": home,
-            "name": os.getenv("NTFY_HOME_CHANNEL_NAME", home),
+            "name": _get_scoped_secret("NTFY_HOME_CHANNEL_NAME", home),
         }
     return seed
 
@@ -540,20 +540,20 @@ async def _standalone_send(
     extra = getattr(pconfig, "extra", {}) or {}
     server = (
         extra.get("server")
-        or os.getenv("NTFY_SERVER_URL", DEFAULT_SERVER)
+        or _get_scoped_secret("NTFY_SERVER_URL", DEFAULT_SERVER)
     ).rstrip("/")
     publish_topic = (
         chat_id
         or extra.get("publish_topic")
-        or os.getenv("NTFY_PUBLISH_TOPIC", "").strip()
+        or _get_scoped_secret("NTFY_PUBLISH_TOPIC", "").strip()
         or extra.get("topic")
-        or os.getenv("NTFY_TOPIC", "").strip()
+        or _get_scoped_secret("NTFY_TOPIC", "").strip()
     )
     if not publish_topic:
         return {"error": "ntfy standalone send: NTFY_TOPIC not configured"}
 
     token = extra.get("token") or _get_scoped_secret("NTFY_TOKEN", "")
-    markdown_env = os.getenv("NTFY_MARKDOWN", "").strip().lower()
+    markdown_env = _get_scoped_secret("NTFY_MARKDOWN", "").strip().lower()
     markdown_enabled = bool(extra.get("markdown")) or markdown_env in ("1", "true", "yes")
 
     headers = {"Content-Type": "text/plain; charset=utf-8", "X-Tags": _ECHO_TAG, **_build_auth_header(token)}
diff --git a/plugins/platforms/photon/adapter.py b/plugins/platforms/photon/adapter.py
index ddc32c569d..0d07a15009 100644
--- a/plugins/platforms/photon/adapter.py
+++ b/plugins/platforms/photon/adapter.py
@@ -423,10 +423,10 @@ def check_requirements() -> bool:
     if not HTTPX_AVAILABLE:
         logger.warning("photon: httpx not installed — pip install httpx")
         return False
-    if not shutil.which(os.getenv("PHOTON_NODE_BIN") or "node"):
+    if not shutil.which(_get_scoped_secret("PHOTON_NODE_BIN") or "node"):
         logger.warning(
             "photon: node binary '%s' not found on PATH",
-            os.getenv("PHOTON_NODE_BIN") or "node",
+            _get_scoped_secret("PHOTON_NODE_BIN") or "node",
         )
         return False
     if not sidecar_deps_installed():
@@ -551,7 +551,7 @@ def _reinstall_sidecar_deps() -> None:
 
 def validate_config(cfg: PlatformConfig) -> bool:
     extra = cfg.extra or {}
-    project_id = extra.get("project_id") or os.getenv("PHOTON_PROJECT_ID")
+    project_id = extra.get("project_id") or _get_scoped_secret("PHOTON_PROJECT_ID")
     project_secret = extra.get("project_secret") or _get_scoped_secret("PHOTON_PROJECT_SECRET")
     if not project_id or not project_secret:
         # Fall back to auth.json
@@ -574,11 +574,11 @@ def _env_enablement() -> Optional[dict]:
     if not (project_id and project_secret):
         return None
     seed: dict = {"project_id": project_id, "project_secret": project_secret}
-    home = os.getenv("PHOTON_HOME_CHANNEL", "").strip()
+    home = _get_scoped_secret("PHOTON_HOME_CHANNEL", "").strip()
     if home:
         seed["home_channel"] = {
             "chat_id": home,
-            "name": os.getenv("PHOTON_HOME_CHANNEL_NAME", "Home"),
+            "name": _get_scoped_secret("PHOTON_HOME_CHANNEL_NAME", "Home"),
         }
     return seed
 
@@ -591,7 +591,7 @@ def _markdown_enabled() -> bool:
     ``PHOTON_MARKDOWN=false`` is the kill-switch back to stripped plain
     text without a release.
     """
-    return os.getenv("PHOTON_MARKDOWN", "true").strip().lower() not in {
+    return _get_scoped_secret("PHOTON_MARKDOWN", "true").strip().lower() not in {
         "false", "0", "no",
     }
 
@@ -729,7 +729,7 @@ class PhotonAdapter(BasePlatformAdapter):
         # the spectrum-ts SDK authenticates with.
         stored_id, stored_sec = load_project_credentials()
         self._project_id: str = (
-            os.getenv("PHOTON_PROJECT_ID")
+            _get_scoped_secret("PHOTON_PROJECT_ID")
             or extra.get("project_id")
             or stored_id
             or ""
@@ -743,7 +743,7 @@ class PhotonAdapter(BasePlatformAdapter):
 
         # Sidecar
         self._sidecar_port = _coerce_port(
-            extra.get("sidecar_port") or os.getenv("PHOTON_SIDECAR_PORT"),
+            extra.get("sidecar_port") or _get_scoped_secret("PHOTON_SIDECAR_PORT"),
             _DEFAULT_SIDECAR_PORT,
         )
         self._sidecar_bind = _DEFAULT_SIDECAR_BIND
@@ -751,9 +751,9 @@ class PhotonAdapter(BasePlatformAdapter):
             _get_scoped_secret("PHOTON_SIDECAR_TOKEN") or secrets.token_hex(16)
         )
         self._autostart_sidecar = str(
-            os.getenv("PHOTON_SIDECAR_AUTOSTART", "true")
+            _get_scoped_secret("PHOTON_SIDECAR_AUTOSTART", "true")
         ).lower() not in ("0", "false", "no")
-        self._node_bin = os.getenv("PHOTON_NODE_BIN") or shutil.which("node") or "node"
+        self._node_bin = _get_scoped_secret("PHOTON_NODE_BIN") or shutil.which("node") or "node"
 
         # Presence watchdog. spectrum-ts only reconnects when its inbound
         # iterator throws or ends; a half-open ("zombie") gRPC socket makes the
@@ -776,21 +776,21 @@ class PhotonAdapter(BasePlatformAdapter):
         self._probe_interval = _coerce_float(
             _first_set(
                 extra.get("probe_interval_seconds"),
-                os.getenv("PHOTON_PROBE_INTERVAL_SECONDS"),
+                _get_scoped_secret("PHOTON_PROBE_INTERVAL_SECONDS"),
             ),
             600.0,
         )
         self._probe_timeout = _coerce_float(
             _first_set(
                 extra.get("probe_timeout_seconds"),
-                os.getenv("PHOTON_PROBE_TIMEOUT_SECONDS"),
+                _get_scoped_secret("PHOTON_PROBE_TIMEOUT_SECONDS"),
             ),
             10.0,
         )
         self._probe_max_failures = _coerce_int(
             _first_set(
                 extra.get("probe_max_failures"),
-                os.getenv("PHOTON_PROBE_MAX_FAILURES"),
+                _get_scoped_secret("PHOTON_PROBE_MAX_FAILURES"),
             ),
             3,
         )
@@ -843,14 +843,14 @@ class PhotonAdapter(BasePlatformAdapter):
         # always processed. Config key wins, then env var.
         _require_mention = extra.get("require_mention")
         if _require_mention is None:
-            _require_mention = os.getenv("PHOTON_REQUIRE_MENTION")
+            _require_mention = _get_scoped_secret("PHOTON_REQUIRE_MENTION")
         self.require_mention = str(_require_mention).strip().lower() in {
             "true", "1", "yes", "on",
         }
         self._mention_patterns = self._compile_mention_patterns(
             extra["mention_patterns"]
             if "mention_patterns" in extra
-            else os.getenv("PHOTON_MENTION_PATTERNS")
+            else _get_scoped_secret("PHOTON_MENTION_PATTERNS")
         )
 
     # -- Group-mention gating (parity with BlueBubbles) -------------------
@@ -2274,7 +2274,7 @@ class PhotonAdapter(BasePlatformAdapter):
         return True
 
     def _reactions_enabled(self) -> bool:
-        return os.getenv("PHOTON_REACTIONS", "false").strip().lower() in {
+        return _get_scoped_secret("PHOTON_REACTIONS", "false").strip().lower() in {
             "true", "1", "yes", "on",
         }
 
@@ -2805,7 +2805,7 @@ async def _standalone_send(
     if not HTTPX_AVAILABLE:
         return {"error": "httpx not installed"}
     port = _coerce_port(
-        (pconfig.extra or {}).get("sidecar_port") or os.getenv("PHOTON_SIDECAR_PORT"),
+        (pconfig.extra or {}).get("sidecar_port") or _get_scoped_secret("PHOTON_SIDECAR_PORT"),
         _DEFAULT_SIDECAR_PORT,
     )
     token = _get_scoped_secret("PHOTON_SIDECAR_TOKEN")
diff --git a/plugins/platforms/photon/auth.py b/plugins/platforms/photon/auth.py
index 34b573a2d8..14fecee80f 100644
--- a/plugins/platforms/photon/auth.py
+++ b/plugins/platforms/photon/auth.py
@@ -254,7 +254,7 @@ def load_project_credentials() -> Tuple[Optional[str], Optional[str]]:
     use.  This is the pair the Node sidecar feeds to ``spectrum-ts``; the id
     is the unified project id (dashboard id == spectrumProjectId).
     """
-    env_id = os.getenv("PHOTON_PROJECT_ID")
+    env_id = _get_scoped_secret("PHOTON_PROJECT_ID")
     env_sec = _get_scoped_secret("PHOTON_PROJECT_SECRET")
     if env_id and env_sec:
         return env_id, env_sec
@@ -277,7 +277,7 @@ def load_dashboard_project_id() -> Optional[str]:
     rewrote (it now 404s), while the Spectrum id always matches the live row.
     Falls back to the legacy keys for older records.
     """
-    env_id = os.getenv("PHOTON_DASHBOARD_PROJECT_ID")
+    env_id = _get_scoped_secret("PHOTON_DASHBOARD_PROJECT_ID")
     if env_id:
         return env_id
     auth = _load_auth()
diff --git a/plugins/platforms/raft/adapter.py b/plugins/platforms/raft/adapter.py
index d31ee4601a..49f9224675 100644
--- a/plugins/platforms/raft/adapter.py
+++ b/plugins/platforms/raft/adapter.py
@@ -97,6 +97,52 @@ _RAFT_TURN_IDS: set[str] = set()
 _RAFT_PROMPT_TURN_IDS: set[str] = set()
 
 
+def _profile_scoped() -> bool:
+    """True when running inside a multiplexed secondary profile's scope.
+
+    Secondary-profile adapters are constructed, connected, and reloaded
+    inside ``_profile_runtime_scope`` (secret scope installed + multiplex
+    active) — the same discriminator the Buzz/SimpleX adapters use for this
+    bug class (#98738). The DEFAULT profile under multiplexing runs
+    unscoped: ``os.environ`` holds its own bridge output there and keeps its
+    legacy precedence.
+    """
+    try:
+        from agent.secret_scope import current_secret_scope, is_multiplex_active
+
+        return bool(is_multiplex_active() and current_secret_scope() is not None)
+    except Exception:
+        return False
+
+
+def _resolve_raft_profile() -> str:
+    """Scope-aware resolution of the ``RAFT_PROFILE`` slug.
+
+    Raft has no ``config.yaml`` equivalent for this value (env-only), so a
+    secondary multiplex profile's only way to configure Raft is via its own
+    ``.env`` file — which the installed secret scope (built from that
+    profile's ``.env`` by ``_profile_runtime_scope``) already carries.
+    Reading raw ``os.environ.get("RAFT_PROFILE")`` here would instead return
+    the DEFAULT profile's bridged value, misdirecting the bridge subprocess
+    or CLI hint at another profile's external Raft workspace/agent identity.
+
+    ``get_secret()`` is only called when ``_profile_scoped()`` is True — the
+    callers of this helper (``connect()``/``register()``) run inside
+    ``_profile_runtime_scope`` for secondary profiles, but the DEFAULT
+    profile's own startup path never installs a scope, where ``get_secret()``
+    would raise ``UnscopedSecretError``; the guard keeps that path on the
+    unchanged ``os.environ`` read.
+    """
+    if _profile_scoped():
+        try:
+            from agent.secret_scope import get_secret
+
+            return (get_secret("RAFT_PROFILE") or "").strip()
+        except Exception:
+            return ""
+    return os.environ.get("RAFT_PROFILE", "").strip()
+
+
 def check_raft_requirements() -> bool:
     """Check if Raft channel dependencies are available.
 
@@ -533,7 +579,7 @@ class RaftAdapter(BasePlatformAdapter):
             logger.warning("[raft] raft CLI not found in PATH; bridge not spawned — wake-only polling mode")
             return
 
-        profile = os.environ.get("RAFT_PROFILE", "")
+        profile = _resolve_raft_profile()
         if not profile:
             logger.warning("[raft] RAFT_PROFILE not set; bridge not spawned")
             return
@@ -777,8 +823,12 @@ def _env_enablement() -> Optional[dict]:
     """Seed PlatformConfig.extra from env vars during gateway config load.
 
     Auto-enables when RAFT_PROFILE is set (the adapter needs it anyway).
+    Scope-aware: consults the active profile's own RAFT_PROFILE (env, or a
+    secondary profile's own .env via the secret scope) instead of the
+    default profile's bridged env value (mirrors the Buzz/SimpleX fix for
+    #98738) — see ``_resolve_raft_profile``.
     """
-    if not os.getenv("RAFT_PROFILE"):
+    if not _resolve_raft_profile():
         return None
 
     return {"enabled": True}
@@ -839,12 +889,18 @@ def register(ctx) -> None:
         setup_fn=interactive_setup,
         env_enablement_fn=_env_enablement,
         emoji="🔔",
+        # Scope-aware (mirrors _resolve_raft_profile's docstring): register()
+        # runs inside _profile_runtime_scope for a secondary multiplex
+        # profile (via discover_plugins() in
+        # gateway/run.py::_start_one_profile_adapters), so this resolves
+        # that profile's own RAFT_PROFILE instead of the default profile's
+        # bridged env value baked into a shared registry entry.
         platform_hint=(
             "You are connected to Raft via an external-agent channel. "
             "Run `raft --profile {profile} profile show` to confirm which agent profile is active. "
             "Run `raft --profile {profile} manual get raft-cli-overview` to learn available Raft commands. "
             "Always pass `--profile {profile}` to every raft CLI call."
-        ).format(profile=os.environ.get("RAFT_PROFILE", "your-agent-profile")),
+        ).format(profile=_resolve_raft_profile() or "your-agent-profile"),
     )
     ctx.register_hook("on_session_start", _on_session_start)
     ctx.register_hook("pre_llm_call", _on_pre_llm_call)
diff --git a/plugins/platforms/simplex/adapter.py b/plugins/platforms/simplex/adapter.py
index b4f493e456..979c1e6ea3 100644
--- a/plugins/platforms/simplex/adapter.py
+++ b/plugins/platforms/simplex/adapter.py
@@ -56,6 +56,28 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
+from agent.secret_scope import UnscopedSecretError as _UnscopedSecretError
+from agent.secret_scope import get_secret as _scoped_get_secret
+
+
+def _get_scoped_secret(name, default=None):
+    """Scope-aware env read with the default-profile startup fallback.
+
+    Secondary profiles construct their adapters under a profile secret
+    scope -- the scope is authoritative and a scoped miss returns ``default``
+    (no cross-profile borrow from ``os.environ``, which holds the DEFAULT
+    profile's YAML-to-env bridge output under multiplexing). The default
+    profile's adapter constructs *unscoped*, where a bare ``get_secret``
+    would raise ``UnscopedSecretError``; there ``os.environ`` is that
+    profile's own value, so fall back to it. Same helper as the IRC/ntfy/
+    Mattermost plugins.
+    """
+    try:
+        val = _scoped_get_secret(name, default)
+    except _UnscopedSecretError:
+        val = os.getenv(name)
+    return val if val is not None else default
+
 # Lazy import: BasePlatformAdapter and friends live in the main repo.
 # Imported at module top because they're stdlib-only inside Hermes — no
 # external dependency that would block the plugin from loading.
@@ -153,7 +175,7 @@ class SimplexAdapter(BasePlatformAdapter):
         # Contact-request auto-accept (on by default — matches the way most
         # bot deployments expect to behave). Read from env first, then fall
         # back to the value seeded by ``_env_enablement``.
-        env_auto = os.getenv("SIMPLEX_AUTO_ACCEPT")
+        env_auto = _get_scoped_secret("SIMPLEX_AUTO_ACCEPT")
         if env_auto is not None:
             self.auto_accept = env_auto.strip().lower() not in {"0", "false", "no", ""}
         else:
@@ -162,7 +184,7 @@ class SimplexAdapter(BasePlatformAdapter):
         # Group allowlist. Without ``SIMPLEX_GROUP_ALLOWED``, group messages
         # are ignored entirely (safer default — a bot in a group otherwise
         # processes every member's traffic). Use ``*`` to accept any group.
-        group_allowed_str = os.getenv("SIMPLEX_GROUP_ALLOWED", "") or extra.get(
+        group_allowed_str = _get_scoped_secret("SIMPLEX_GROUP_ALLOWED", "") or extra.get(
             "group_allowed", ""
         )
         self.group_allow_from = set(_parse_comma_list(group_allowed_str))
@@ -1172,7 +1194,7 @@ def check_requirements() -> bool:
     so the gateway never instantiates the adapter when the dependency is
     missing or no daemon URL is configured.
     """
-    if not os.getenv("SIMPLEX_WS_URL"):
+    if not _get_scoped_secret("SIMPLEX_WS_URL"):
         return False
     try:
         import websockets  # noqa: F401
@@ -1184,14 +1206,14 @@ def check_requirements() -> bool:
 def validate_config(config) -> bool:
     """Validate that the platform config has enough info to connect."""
     extra = getattr(config, "extra", {}) or {}
-    ws_url = os.getenv("SIMPLEX_WS_URL") or extra.get("ws_url", "")
+    ws_url = _get_scoped_secret("SIMPLEX_WS_URL") or extra.get("ws_url", "")
     return bool(ws_url)
 
 
 def is_connected(config) -> bool:
     """Check whether SimpleX is configured (env or config.yaml)."""
     extra = getattr(config, "extra", {}) or {}
-    ws_url = os.getenv("SIMPLEX_WS_URL") or extra.get("ws_url", "")
+    ws_url = _get_scoped_secret("SIMPLEX_WS_URL") or extra.get("ws_url", "")
     return bool(ws_url)
 
 
@@ -1207,24 +1229,24 @@ def _env_enablement() -> Optional[dict]:
     becomes a proper ``HomeChannel`` dataclass on the ``PlatformConfig``
     rather than being merged into ``extra``.
     """
-    ws_url = os.getenv("SIMPLEX_WS_URL", "").strip()
+    ws_url = _get_scoped_secret("SIMPLEX_WS_URL", "").strip()
     if not ws_url:
         return None
     seed: dict = {"ws_url": ws_url}
 
-    auto_accept = os.getenv("SIMPLEX_AUTO_ACCEPT", "").strip().lower()
+    auto_accept = _get_scoped_secret("SIMPLEX_AUTO_ACCEPT", "").strip().lower()
     if auto_accept:
         seed["auto_accept"] = auto_accept not in {"0", "false", "no"}
 
-    group_allowed = os.getenv("SIMPLEX_GROUP_ALLOWED", "").strip()
+    group_allowed = _get_scoped_secret("SIMPLEX_GROUP_ALLOWED", "").strip()
     if group_allowed:
         seed["group_allowed"] = group_allowed
 
-    home = os.getenv("SIMPLEX_HOME_CHANNEL", "").strip()
+    home = _get_scoped_secret("SIMPLEX_HOME_CHANNEL", "").strip()
     if home:
         seed["home_channel"] = {
             "chat_id": home,
-            "name": os.getenv("SIMPLEX_HOME_CHANNEL_NAME", "").strip() or home,
+            "name": _get_scoped_secret("SIMPLEX_HOME_CHANNEL_NAME", "").strip() or home,
         }
     return seed
 
@@ -1257,7 +1279,7 @@ async def _standalone_send(
         return {"error": "websockets not installed. Run: pip install websockets"}
 
     extra = getattr(pconfig, "extra", {}) or {}
-    ws_url = os.getenv("SIMPLEX_WS_URL") or extra.get(
+    ws_url = _get_scoped_secret("SIMPLEX_WS_URL") or extra.get(
         "ws_url", "ws://127.0.0.1:5225"
     )
     if not ws_url:
diff --git a/plugins/platforms/slack/adapter.py b/plugins/platforms/slack/adapter.py
index cd8e237d3b..b4cd21c143 100644
--- a/plugins/platforms/slack/adapter.py
+++ b/plugins/platforms/slack/adapter.py
@@ -43,6 +43,7 @@ from agent.secret_scope import UnscopedSecretError, get_secret
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.helpers import MessageDeduplicator
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -1825,7 +1826,7 @@ class SlackAdapter(BasePlatformAdapter):
                 "Slack's ephemeral reply limit.]_"
             )
         try:
-            async with aiohttp.ClientSession(trust_env=True) as session:
+            async with aiohttp.ClientSession(trust_env=gateway_trust_env()) as session:
                 for idx, chunk in enumerate(chunks):
                     payload = {
                         "response_type": "ephemeral",
@@ -3838,6 +3839,30 @@ class SlackAdapter(BasePlatformAdapter):
             return "none"
         return value
 
+    def _slack_api_human_users(self) -> frozenset:
+        """Slack user IDs whose Web-API posts count as human-authored.
+
+        A message posted with a *user* token (``xoxp-``) is authored by a real
+        person, but Slack still stamps it with the posting ``app_id`` and it
+        carries no ``client_msg_id`` — exactly the #35777 app/bot signature in
+        ``_event_declares_bot_sender``. Operators running their own front-end
+        (dashboard, mobile shell) allowlist those *users* via
+        ``platforms.slack.extra.api_human_users`` (``SLACK_API_HUMAN_USERS``
+        fallback) instead of ``allow_bots: all``. Users only — an app-id
+        allowlist would also admit the app's own ``xoxb`` bot posts, which
+        carry the same user+app_id shape.
+        """
+        cached = getattr(self, "_api_human_users_cache", None)
+        if cached is None:
+            raw = self.config.extra.get("api_human_users")
+            if raw is None:
+                raw = os.getenv("SLACK_API_HUMAN_USERS", "")
+            parts = raw if isinstance(raw, (list, tuple, set)) else str(raw).split(",")
+            cached = self._api_human_users_cache = frozenset(
+                str(p).strip() for p in parts if str(p).strip()
+            )
+        return cached
+
     def _event_declares_bot_sender(self, event: dict) -> bool:
         """Return True when the Slack event itself identifies a bot sender."""
         if event.get("bot_id") or event.get("bot_profile"):
@@ -3852,7 +3877,11 @@ class SlackAdapter(BasePlatformAdapter):
         # human-authored messages normally carry client_msg_id, so treat the
         # combination as app/bot-authored (#35777).
         if event.get("app_id") and not event.get("client_msg_id"):
-            return True
+            # ...unless the operator allowlisted this user's API posts
+            # (_slack_api_human_users). ``user`` is required so classic bot
+            # posts (no ``user``) never match; bot_message/bot_id already
+            # returned True above.
+            return event.get("user") not in self._slack_api_human_users()
         return False
 
     def _resolve_thread_ts(
@@ -6324,9 +6353,19 @@ class SlackAdapter(BasePlatformAdapter):
         # or file downloads.  The final gateway runner auth check happens
         # after MessageEvent construction, so adapter-side media fetches need
         # the same auth chain up front.
+        # Prefer the injected profile-bound check (survives the multiplex
+        # closure handler, which has no ``__self__``); fall back to runner
+        # introspection for adapters wired without one.
+        _early_decision = (
+            self._is_sender_authorized(
+                user_id, "dm" if is_dm else "group", channel_id
+            )
+            if user_id and getattr(self, "_authorization_check", None) is not None
+            else None
+        )
         _runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
         _auth_fn = getattr(_runner, "_is_user_authorized", None)
-        if user_id and callable(_auth_fn):
+        if _early_decision is None and user_id and callable(_auth_fn):
             _source = self.build_source(
                 chat_id=channel_id,
                 chat_name="",
@@ -6334,13 +6373,14 @@ class SlackAdapter(BasePlatformAdapter):
                 user_id=user_id,
                 user_name="",
             )
-            if not _auth_fn(_source):
-                logger.warning(
-                    "[Slack] Early reject of unauthorized user %s in channel %s",
-                    user_id,
-                    channel_id,
-                )
-                return
+            _early_decision = bool(_auth_fn(_source))
+        if _early_decision is False:
+            logger.warning(
+                "[Slack] Early reject of unauthorized user %s in channel %s",
+                user_id,
+                channel_id,
+            )
+            return
 
         # Build thread_ts for session keying.
         # In channels: fall back to ts so each top-level @mention starts a
@@ -7049,7 +7089,9 @@ class SlackAdapter(BasePlatformAdapter):
             # subtype=bot_message with user=None; flag them so the
             # gateway SLACK_ALLOW_BOTS bypass can authorize them
             # (they carry no user_id to match against the allowlist).
-            is_bot=bool(event.get("bot_id")) or event.get("subtype") == "bot_message",
+            # Same predicate as the drop gate above, so an api_human_users
+            # post is a plain human here too.
+            is_bot=self._event_declares_bot_sender(event),
         )
 
         # Per-channel ephemeral prompt
@@ -7459,6 +7501,23 @@ class SlackAdapter(BasePlatformAdapter):
         if not normalized_user_id:
             return False
 
+        chat_type = "dm" if str(channel_id or "").startswith("D") else "group"
+
+        # Preferred path: the auth callback GatewayRunner injects at connect
+        # time (``set_authorization_check``) runs the full, profile-bound
+        # ``_is_user_authorized`` chain. Unlike the ``__self__`` introspection
+        # below it also resolves on a multiplexed adapter, whose message
+        # handler is a profile closure with no ``__self__`` (#72657, same
+        # class as Telegram's #86296).
+        # ``getattr``: adapters built via ``object.__new__`` never ran
+        # ``BasePlatformAdapter.__init__``.
+        if getattr(self, "_authorization_check", None) is not None:
+            injected = self._is_sender_authorized(
+                normalized_user_id, chat_type, str(channel_id or "")
+            )
+            if injected is not None:
+                return injected
+
         runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
         auth_fn = getattr(runner, "_is_user_authorized", None)
         if callable(auth_fn):
@@ -7468,7 +7527,7 @@ class SlackAdapter(BasePlatformAdapter):
                 source = SessionSource(
                     platform=Platform.SLACK,
                     chat_id=str(channel_id or normalized_user_id),
-                    chat_type="dm" if str(channel_id or "").startswith("D") else "group",
+                    chat_type=chat_type,
                     user_id=normalized_user_id,
                     user_name=str(user_name).strip() if user_name else None,
                     scope_id=str(team_id) if team_id else None,
@@ -7481,21 +7540,15 @@ class SlackAdapter(BasePlatformAdapter):
                     exc_info=True,
                 )
 
-        if os.getenv("SLACK_ALLOW_ALL_USERS", "").lower() in {"true", "1", "yes"}:
+        # Env-only fallback (no injected check, no bound runner). Gate reads go
+        # through the shared per-profile accessor: under multiplex a scoped
+        # miss returns "" instead of falling through to ``os.environ``, which
+        # holds the DEFAULT profile's allow-all flag / allowlist.
+        from gateway.authz_mixin import _platform_gate_env as _env
+
+        if _env("SLACK_ALLOW_ALL_USERS").lower() in {"true", "1", "yes"}:
             return True
 
-        def _env(name: str) -> str:
-            # Multiplex: profile .env is in secret_scope, not process environ.
-            try:
-                from agent.secret_scope import get_secret
-
-                val = get_secret(name)
-                if val is not None and str(val).strip():
-                    return str(val).strip()
-            except Exception:
-                pass
-            return (os.getenv(name) or "").strip()
-
         allowed_ids = set()
         platform_allowlist = _env("SLACK_ALLOWED_USERS")
         if platform_allowlist:
@@ -7507,8 +7560,6 @@ class SlackAdapter(BasePlatformAdapter):
         if allowed_ids:
             return "*" in allowed_ids or normalized_user_id in allowed_ids
 
-        if _env("SLACK_ALLOW_ALL_USERS").lower() in {"true", "1", "yes"}:
-            return True
         return _env("GATEWAY_ALLOW_ALL_USERS").lower() in {"true", "1", "yes"}
 
     async def _handle_slash_confirm_action(self, ack, body, action) -> None:
@@ -8184,7 +8235,7 @@ class SlackAdapter(BasePlatformAdapter):
             skip_for_delta = bool(after_ts and msg_ts and msg_ts <= after_ts)
             if skip_for_delta and not is_parent:
                 continue
-            is_bot = bool(msg.get("bot_id")) or msg.get("subtype") == "bot_message"
+            is_bot = self._event_declares_bot_sender(msg)
             msg_user = msg.get("user", "")
 
             # Identify "our own" bot for this workspace (multi-workspace safe).
diff --git a/plugins/platforms/sms/adapter.py b/plugins/platforms/sms/adapter.py
index 37db336e7a..8d2592bc7b 100644
--- a/plugins/platforms/sms/adapter.py
+++ b/plugins/platforms/sms/adapter.py
@@ -29,6 +29,7 @@ from typing import Any, Dict, Optional
 
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -156,7 +157,7 @@ class SmsAdapter(BasePlatformAdapter):
         await site.start()
         self._http_session = aiohttp.ClientSession(
             timeout=aiohttp.ClientTimeout(total=30),
-            trust_env=True,
+            trust_env=gateway_trust_env(),
         )
         self._running = True
 
@@ -200,7 +201,7 @@ class SmsAdapter(BasePlatformAdapter):
 
         session = self._http_session or aiohttp.ClientSession(
             timeout=aiohttp.ClientTimeout(total=30),
-            trust_env=True,
+            trust_env=gateway_trust_env(),
         )
         try:
             for chunk in chunks:
diff --git a/plugins/platforms/teams/adapter.py b/plugins/platforms/teams/adapter.py
index f6b357208f..172d89d946 100644
--- a/plugins/platforms/teams/adapter.py
+++ b/plugins/platforms/teams/adapter.py
@@ -103,6 +103,7 @@ TextBlock = None  # type: ignore[assignment,misc]
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.helpers import MessageDeduplicator
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -641,7 +642,7 @@ async def _standalone_send(
         # Per-request timeouts so a slow STS endpoint cannot starve the
         # subsequent activity POST of its budget.
         per_request_timeout = _aiohttp.ClientTimeout(total=15.0)
-        async with _aiohttp.ClientSession(trust_env=True) as session:
+        async with _aiohttp.ClientSession(trust_env=gateway_trust_env()) as session:
             async with session.post(
                 token_url,
                 data={
diff --git a/plugins/platforms/telegram/adapter.py b/plugins/platforms/telegram/adapter.py
index b8ed8d11f0..15d2541d30 100644
--- a/plugins/platforms/telegram/adapter.py
+++ b/plugins/platforms/telegram/adapter.py
@@ -1213,18 +1213,40 @@ class TelegramAdapter(BasePlatformAdapter):
         if not normalized_user_id:
             return False
 
+        normalized_chat_type = str(chat_type or "dm").strip().lower() or "dm"
+        if normalized_chat_type == "private":
+            normalized_chat_type = "dm"
+        elif normalized_chat_type == "supergroup":
+            normalized_chat_type = "forum" if thread_id is not None else "group"
+
+        # Preferred path: the auth callback GatewayRunner injects at
+        # connection time (set_authorization_check), which delegates to the
+        # full _is_user_authorized chain -- env allowlists, group allowlists,
+        # pairing store, allow-all flags. Unlike the __self__ introspection
+        # below, this also works for a secondary multiplexed adapter, whose
+        # _message_handler is a profile closure with no __self__ (the same
+        # gap the admin-tier check had -- resolved the same way). The getattr
+        # tolerates partially-constructed adapters (object.__new__ in tests)
+        # that never ran BasePlatformAdapter.__init__.
+        if getattr(self, "_authorization_check", None) is not None:
+            injected = self._is_sender_authorized(
+                normalized_user_id,
+                chat_type=normalized_chat_type,
+                chat_id=str(chat_id or normalized_user_id),
+                thread_id=str(thread_id) if thread_id is not None else None,
+            )
+            if injected is not None:
+                return injected
+
+        # Legacy path: resolve the runner off the bound message handler.
+        # Still reachable for adapters wired without set_authorization_check
+        # (bare-adapter tests, direct embedding).
         runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
         auth_fn = getattr(runner, "_is_user_authorized", None)
         if callable(auth_fn):
             try:
                 from gateway.session import SessionSource
 
-                normalized_chat_type = str(chat_type or "dm").strip().lower() or "dm"
-                if normalized_chat_type == "private":
-                    normalized_chat_type = "dm"
-                elif normalized_chat_type == "supergroup":
-                    normalized_chat_type = "forum" if thread_id is not None else "group"
-
                 source = SessionSource(
                     platform=Platform.TELEGRAM,
                     chat_id=str(chat_id or normalized_user_id),
@@ -1264,6 +1286,9 @@ class TelegramAdapter(BasePlatformAdapter):
         user = getattr(message, "from_user", None)
         chat = getattr(message, "chat", None)
         user_id = str(getattr(user, "id", "")).strip() or None
+        # Carry the bot flag so the runner's ``*_ALLOW_BOTS`` policy branch is
+        # reachable from this prefilter, exactly as it is for ``build_source``.
+        is_bot = bool(getattr(user, "is_bot", False)) if user is not None else False
         user_name = (
             str(getattr(user, "username", "") or getattr(user, "full_name", "") or "").strip()
             or None
@@ -1309,6 +1334,7 @@ class TelegramAdapter(BasePlatformAdapter):
             user_id=user_id,
             user_name=user_name,
             thread_id=thread_id,
+            is_bot=is_bot,
         )
 
     def _source_from_reaction_for_auth(self, update):
@@ -1390,14 +1416,20 @@ class TelegramAdapter(BasePlatformAdapter):
         if source.chat_type != "dm":
             return False
 
-        runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
+        # The bound-handler ``__self__`` is None under multiplex (the handler is
+        # a profile closure); ``gateway_runner`` is injected on every adapter
+        # by ``GatewayRunner._create_adapter`` and survives that wrapping.
+        runner = getattr(
+            getattr(self, "_message_handler", None), "__self__", None
+        ) or getattr(self, "gateway_runner", None)
         behavior_fn = getattr(runner, "_get_unauthorized_dm_behavior", None)
         if callable(behavior_fn):
             try:
                 return (
                     behavior_fn(
                         Platform.TELEGRAM,
-                        profile=getattr(source, "profile", None),
+                        profile=getattr(source, "profile", None)
+                        or getattr(self, "_owner_profile", None),
                     )
                     == "pair"
                 )
@@ -1490,6 +1522,8 @@ class TelegramAdapter(BasePlatformAdapter):
                         user_id,
                         chat_type=source.chat_type,
                         chat_id=source.chat_id,
+                        is_bot=source.is_bot,
+                        thread_id=source.thread_id,
                     )
                     if has_callback
                     else None
@@ -1686,7 +1720,11 @@ class TelegramAdapter(BasePlatformAdapter):
         return "thread not found" in str(error).lower()
 
     def _prune_stale_dm_topic_binding(
-        self, chat_id: Any, thread_id: Any,
+        self,
+        chat_id: Any,
+        thread_id: Any,
+        *,
+        metadata: Optional[Dict[str, Any]] = None,
     ) -> None:
         """Drop the stale ``telegram_dm_topic_bindings`` row for a
         topic Telegram has confirmed deleted.
@@ -1699,6 +1737,12 @@ class TelegramAdapter(BasePlatformAdapter):
         on to a fresh topic).  Best-effort: we never raise from a
         send-fallback path — a failed cleanup must not turn into a
         failed user-facing send.
+
+        Rows are namespaced by profile (#76423). Under
+        ``gateway.profile_routes`` the transport adapter may not be the
+        profile that wrote the binding, so the send's ``hermes_profile``
+        metadata wins over the adapter's own profile stamp; single-profile
+        bots fall back to ``"default"``.
         """
         if chat_id is None or thread_id is None:
             return
@@ -1709,8 +1753,15 @@ class TelegramAdapter(BasePlatformAdapter):
         if db is None or not hasattr(db, "delete_telegram_topic_binding"):
             return
         try:
+            profile_name = (
+                (metadata or {}).get("hermes_profile")
+                or getattr(self, "_hermes_profile_name", None)
+                or "default"
+            )
             removed = db.delete_telegram_topic_binding(
-                chat_id=str(chat_id), thread_id=str(thread_id),
+                chat_id=str(chat_id),
+                thread_id=str(thread_id),
+                profile_name=profile_name,
             )
         except Exception:
             logger.debug(
@@ -5590,7 +5641,9 @@ class TelegramAdapter(BasePlatformAdapter):
                                     self.name, effective_thread_id,
                                 )
                                 self._prune_stale_dm_topic_binding(
-                                    chat_id, effective_thread_id,
+                                    chat_id,
+                                    effective_thread_id,
+                                    metadata=metadata,
                                 )
                                 used_thread_fallback = True
                                 effective_thread_id = None
@@ -6380,7 +6433,8 @@ class TelegramAdapter(BasePlatformAdapter):
                 # Same prune as the streaming send path — the
                 # control-message retry tells us the topic is gone,
                 # so the binding row in state.db must go too
-                # (#31501).
+                # (#31501). Control sends carry no gateway metadata, so
+                # the prune namespaces by this adapter's profile stamp.
                 self._prune_stale_dm_topic_binding(
                     kwargs.get("chat_id"), message_thread_id,
                 )
diff --git a/plugins/platforms/wecom/adapter.py b/plugins/platforms/wecom/adapter.py
index c26d4a8350..27fbf52e2b 100644
--- a/plugins/platforms/wecom/adapter.py
+++ b/plugins/platforms/wecom/adapter.py
@@ -63,6 +63,7 @@ except ImportError:
 from gateway.config import Platform, PlatformConfig
 from gateway.platforms.helpers import MessageDeduplicator
 from gateway.platforms.base import (
+    gateway_trust_env,
     BasePlatformAdapter,
     MessageEvent,
     MessageType,
@@ -317,12 +318,12 @@ class WeComAdapter(BasePlatformAdapter):
         super().__init__(config, Platform.WECOM)
 
         extra = config.extra or {}
-        self._bot_id = str(extra.get("bot_id") or os.getenv("WECOM_BOT_ID", "")).strip()
+        self._bot_id = str(extra.get("bot_id") or _get_scoped_secret("WECOM_BOT_ID", "")).strip()
         self._secret = str(extra.get("secret") or _get_scoped_secret("WECOM_SECRET", "")).strip()
         self._ws_url = str(
             extra.get("websocket_url")
             or extra.get("websocketUrl")
-            or os.getenv("WECOM_WEBSOCKET_URL", DEFAULT_WS_URL)
+            or _get_scoped_secret("WECOM_WEBSOCKET_URL", DEFAULT_WS_URL)
         ).strip() or DEFAULT_WS_URL
 
         self._dm_policy = str(extra.get("dm_policy") or _get_scoped_secret("WECOM_DM_POLICY", "pairing")).strip().lower()
@@ -723,7 +724,7 @@ class WeComAdapter(BasePlatformAdapter):
         except ImportError:
             _ssl_ctx = _ssl.create_default_context()
         _connector = aiohttp.TCPConnector(ssl=_ssl_ctx)
-        self._session = aiohttp.ClientSession(trust_env=True, connector=_connector)
+        self._session = aiohttp.ClientSession(trust_env=gateway_trust_env(), connector=_connector)
         self._ws = await self._session.ws_connect(
             self._ws_url,
             heartbeat=HEARTBEAT_INTERVAL_SECONDS * 2,
diff --git a/plugins/web/brave_free/provider.py b/plugins/web/brave_free/provider.py
index 769a850587..0da8d11c99 100644
--- a/plugins/web/brave_free/provider.py
+++ b/plugins/web/brave_free/provider.py
@@ -34,7 +34,7 @@ class BraveFreeWebSearchProvider(WebSearchProvider):
     """Search-only Brave provider using the free-tier Data-for-Search API.
 
     Free tier is 2,000 queries/month (1 qps). No content-extraction capability —
-    users pair this with Firecrawl/Keenable/Exa for ``web_extract``.
+    users pair this with Firecrawl/Tavily/Exa for ``web_extract``.
     """
 
     @property
diff --git a/plugins/web/searxng/__init__.py b/plugins/web/searxng/__init__.py
index 62e12a5c7d..cea8eabb18 100644
--- a/plugins/web/searxng/__init__.py
+++ b/plugins/web/searxng/__init__.py
@@ -1,7 +1,7 @@
 """SearXNG search plugin — bundled, auto-loaded.
 
 Backed by a user-hosted SearXNG instance (URL configured via ``SEARXNG_URL``).
-Search-only — pair with an extract provider (firecrawl/keenable/exa) for
+Search-only — pair with an extract provider (firecrawl/tavily/exa) for
 ``web_extract`` calls.
 """
 
diff --git a/plugins/web/tavily/__init__.py b/plugins/web/tavily/__init__.py
new file mode 100644
index 0000000000..1e0ced61d1
--- /dev/null
+++ b/plugins/web/tavily/__init__.py
@@ -0,0 +1,10 @@
+"""Tavily web search + extract plugin — bundled, auto-loaded."""
+
+from __future__ import annotations
+
+from plugins.web.tavily.provider import TavilyWebSearchProvider
+
+
+def register(ctx) -> None:
+    """Register the Tavily provider with the plugin context."""
+    ctx.register_web_search_provider(TavilyWebSearchProvider())
diff --git a/plugins/web/tavily/plugin.yaml b/plugins/web/tavily/plugin.yaml
new file mode 100644
index 0000000000..3ac90594e5
--- /dev/null
+++ b/plugins/web/tavily/plugin.yaml
@@ -0,0 +1,7 @@
+name: web-tavily
+version: 1.0.0
+description: "Tavily web search + extract. Opt-in keyless via hermes tools; set TAVILY_API_KEY for higher limits — https://app.tavily.com/home."
+author: NousResearch
+kind: backend
+provides_web_providers:
+  - tavily
diff --git a/plugins/web/tavily/provider.py b/plugins/web/tavily/provider.py
new file mode 100644
index 0000000000..621aa3ea03
--- /dev/null
+++ b/plugins/web/tavily/provider.py
@@ -0,0 +1,313 @@
+"""Tavily web search + content extraction — plugin form.
+
+Subclasses :class:`agent.web_search_provider.WebSearchProvider`. Two
+capabilities advertised:
+
+- ``supports_search()``  -> True (Tavily ``/search``)
+- ``supports_extract()`` -> True (Tavily ``/extract``)
+
+Both are sync — the underlying call is ``httpx.post(...)``.
+
+Config keys this provider responds to::
+
+    web:
+      search_backend: "tavily"     # explicit per-capability
+      extract_backend: "tavily"    # explicit per-capability
+      backend: "tavily"            # shared fallback for both
+
+Env vars::
+
+    TAVILY_API_KEY=...           # https://app.tavily.com/home (optional)
+    TAVILY_BASE_URL=...          # optional override of https://api.tavily.com
+
+Auth is header-based. A key uses ``Authorization: Bearer``; without a
+key the request is keyless (``X-Tavily-Access-Mode: keyless``). Both
+paths send ``X-Client-Name: hermes-agent``.
+
+Tavily is **not** a member of the zero-config keyless ring
+(``plugins.web.keyless_mcp._KEYLESS_RING``). Keyless access is opt-in:
+select Tavily in ``hermes tools`` (or set ``web.backend: tavily``).
+Fresh installs with no web credentials rotate across Exa / Parallel /
+Firecrawl / Keenable instead.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, Dict, List, Optional
+
+import httpx
+
+from agent.web_search_provider import WebSearchProvider
+
+logger = logging.getLogger(__name__)
+
+_CLIENT_NAME = "hermes-agent"
+
+_SEARCH_PAYLOAD = {
+    "include_raw_content": False,
+    "include_images": False,
+}
+
+
+def _tavily_headers(api_key: str) -> Dict[str, str]:
+    """Build Tavily request headers for keyed or keyless access."""
+    headers = {"X-Client-Name": _CLIENT_NAME}
+    if api_key:
+        headers["Authorization"] = f"Bearer {api_key}"
+    else:
+        headers["X-Tavily-Access-Mode"] = "keyless"
+    return headers
+
+
+def _tavily_request(
+    endpoint: str,
+    payload: Dict[str, Any],
+    *,
+    api_key: Optional[str] = None,
+) -> Dict[str, Any]:
+    """POST to the Tavily API and return the parsed JSON response.
+
+    Keyed when *api_key* (or ``TAVILY_API_KEY``) is set (Bearer auth);
+    otherwise keyless. Pass ``api_key=""`` to force the keyless header even
+    when a key is present (``web.provider_tier.tavily: free``). Non-2xx
+    responses raise ``ValueError`` with the response body so Tavily's
+    keyless rate-limit / upgrade text reaches the model.
+    """
+    from agent.web_search_provider import get_provider_env
+
+    if api_key is None:
+        api_key = get_provider_env("TAVILY_API_KEY")
+    base_url = get_provider_env("TAVILY_BASE_URL") or "https://api.tavily.com"
+    url = f"{base_url}/{endpoint.lstrip('/')}"
+    logger.info("Tavily %s request to %s", endpoint, url)
+
+    response = httpx.post(
+        url,
+        json=payload,
+        timeout=60,
+        headers=_tavily_headers(api_key),
+    )
+    if response.status_code >= 400:
+        body = (response.text or "").strip()
+        detail = body or f"HTTP {response.status_code}"
+        raise ValueError(detail)
+    return response.json()
+
+
+def _normalize_tavily_search_results(response: Dict[str, Any]) -> Dict[str, Any]:
+    """Map Tavily ``/search`` response to ``{success, data: {web: [...]}}``."""
+    web_results = []
+    for i, result in enumerate(response.get("results", [])):
+        web_results.append(
+            {
+                "title": result.get("title", ""),
+                "url": result.get("url", ""),
+                "description": result.get("content", ""),
+                "position": i + 1,
+            }
+        )
+    return {"success": True, "data": {"web": web_results}}
+
+
+def _normalize_tavily_documents(
+    response: Dict[str, Any], fallback_url: str = ""
+) -> List[Dict[str, Any]]:
+    """Map Tavily ``/extract`` response to standard documents.
+
+    Documents follow the legacy LLM post-processing shape::
+
+        {"url", "title", "content", "raw_content", "metadata"}
+
+    Failures (``failed_results``, ``failed_urls``) become result entries
+    with an ``error`` field rather than raising.
+    """
+    documents: List[Dict[str, Any]] = []
+    for result in response.get("results", []):
+        url = result.get("url", fallback_url)
+        raw = result.get("raw_content", "") or result.get("content", "")
+        documents.append(
+            {
+                "url": url,
+                "title": result.get("title", ""),
+                "content": raw,
+                "raw_content": raw,
+                "metadata": {"sourceURL": url, "title": result.get("title", "")},
+            }
+        )
+    for fail in response.get("failed_results", []):
+        documents.append(
+            {
+                "url": fail.get("url", fallback_url),
+                "title": "",
+                "content": "",
+                "raw_content": "",
+                "error": fail.get("error", "extraction failed"),
+                "metadata": {"sourceURL": fail.get("url", fallback_url)},
+            }
+        )
+    for fail_url in response.get("failed_urls", []):
+        url_str = fail_url if isinstance(fail_url, str) else str(fail_url)
+        documents.append(
+            {
+                "url": url_str,
+                "title": "",
+                "content": "",
+                "raw_content": "",
+                "error": "extraction failed",
+                "metadata": {"sourceURL": url_str},
+            }
+        )
+    return documents
+
+
+def _missing_key_error(action: str) -> str:
+    return (
+        f"TAVILY_API_KEY is not set. Get a key at https://app.tavily.com/home "
+        f"or select Tavily in `hermes tools` for opt-in keyless {action}."
+    )
+
+
+class TavilyWebSearchProvider(WebSearchProvider):
+    """Tavily search + extract provider (keyed, or opt-in keyless)."""
+
+    @property
+    def name(self) -> str:
+        return "tavily"
+
+    @property
+    def display_name(self) -> str:
+        return "Tavily"
+
+    def is_available(self) -> bool:
+        """Return True when ``TAVILY_API_KEY`` is set to a non-empty value."""
+        from agent.web_search_provider import get_provider_env
+
+        return bool(get_provider_env("TAVILY_API_KEY"))
+
+    def is_keyless_available(self) -> bool:
+        """Tavily serves anonymous keyless requests (X-Tavily-Access-Mode).
+
+        Opt-in only — Tavily is not a member of the zero-config keyless
+        ring. ``is_keyless_available`` is True so an explicit
+        ``web.backend: tavily`` (or ``hermes tools`` pick) works without a
+        key. False when the user pinned ``web.provider_tier.tavily: paid``.
+        """
+        from plugins.web.keyless_mcp import keyless_enabled, provider_tier
+
+        return keyless_enabled() and provider_tier("tavily") != "paid"
+
+    def supports_search(self) -> bool:
+        return True
+
+    def supports_extract(self) -> bool:
+        return True
+
+    def search(self, query: str, limit: int = 5) -> Dict[str, Any]:
+        """Execute a Tavily search (keyed path or opt-in keyless)."""
+        try:
+            from tools.interrupt import is_interrupted
+
+            if is_interrupted():
+                return {"success": False, "error": "Interrupted"}
+
+            from agent.web_search_provider import get_provider_env
+
+            from plugins.web.keyless_mcp import use_keyless
+
+            api_key = get_provider_env("TAVILY_API_KEY")
+            force_keyless = use_keyless("tavily", api_key)
+            if not force_keyless and not api_key:
+                return {"success": False, "error": _missing_key_error("search")}
+
+            logger.info(
+                "Tavily %ssearch: '%s' (limit=%d)",
+                "keyless " if force_keyless else "",
+                query,
+                limit,
+            )
+            raw = _tavily_request(
+                "search",
+                {
+                    "query": query,
+                    "max_results": min(limit, 20),
+                    **_SEARCH_PAYLOAD,
+                },
+                api_key="" if force_keyless else api_key,
+            )
+            return _normalize_tavily_search_results(raw)
+        except ValueError as exc:
+            return {"success": False, "error": str(exc)}
+        except Exception as exc:  # noqa: BLE001 — including httpx errors
+            logger.warning("Tavily search error: %s", exc)
+            return {"success": False, "error": f"Tavily search failed: {exc}"}
+
+    def extract(self, urls: List[str], **kwargs: Any) -> List[Dict[str, Any]]:
+        """Extract content from one or more URLs via Tavily.
+
+        Sync — the underlying call is httpx.post(...). Returns the legacy
+        list-of-results shape; per-URL failures become items with ``error``.
+        Keyless uses Tavily's own endpoint, not the keyless ring.
+        """
+        try:
+            from tools.interrupt import is_interrupted
+
+            if is_interrupted():
+                return [
+                    {"url": u, "error": "Interrupted", "title": ""} for u in urls
+                ]
+
+            from agent.web_search_provider import get_provider_env
+
+            from plugins.web.keyless_mcp import use_keyless
+
+            api_key = get_provider_env("TAVILY_API_KEY")
+            force_keyless = use_keyless("tavily", api_key)
+            if not force_keyless and not api_key:
+                err = _missing_key_error("extract")
+                return [
+                    {"url": u, "title": "", "content": "", "error": err}
+                    for u in urls
+                ]
+
+            logger.info(
+                "Tavily %sextract: %d URL(s)",
+                "keyless " if force_keyless else "",
+                len(urls),
+            )
+            raw = _tavily_request(
+                "extract",
+                {
+                    "urls": urls,
+                    "include_images": False,
+                },
+                api_key="" if force_keyless else api_key,
+            )
+            return _normalize_tavily_documents(
+                raw, fallback_url=urls[0] if urls else ""
+            )
+        except ValueError as exc:
+            return [{"url": u, "title": "", "content": "", "error": str(exc)} for u in urls]
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("Tavily extract error: %s", exc)
+            return [
+                {"url": u, "title": "", "content": "", "error": f"Tavily extract failed: {exc}"}
+                for u in urls
+            ]
+
+    def get_setup_schema(self) -> Dict[str, Any]:
+        return {
+            "name": "Tavily",
+            "badge": "free · key optional",
+            "tag": (
+                "Search + extract. Opt-in keyless; "
+                "set TAVILY_API_KEY for higher limits."
+            ),
+            "env_vars": [
+                {
+                    "key": "TAVILY_API_KEY",
+                    "prompt": "Tavily API key (optional — keyless works when Tavily is selected)",
+                    "url": "https://app.tavily.com/home",
+                },
+            ],
+        }
diff --git a/plugins/web/xai/provider.py b/plugins/web/xai/provider.py
index 922b9856be..77d80a4398 100644
--- a/plugins/web/xai/provider.py
+++ b/plugins/web/xai/provider.py
@@ -101,12 +101,12 @@ class XAIWebSearchProvider(WebSearchProvider):
     back to the Responses API ``citations`` list if Grok ignores the JSON
     schema instruction (rare for grok-4.3 but cheap insurance).
 
-    No extract capability — pair with Firecrawl / Keenable / Exa for
+    No extract capability — pair with Firecrawl / Tavily / Exa for
     ``web_extract`` if you need page content.
 
     Trust model
     -----------
-    Unlike index-backed providers (Brave / Keenable / Exa) which return
+    Unlike index-backed providers (Brave / Tavily / Exa) which return
     verbatim search-engine results, this backend is an LLM in a trench
     coat: Grok decides which URLs to surface, generates the titles and
     descriptions itself, and is influenced by the *content of the query*.
diff --git a/pyproject.toml b/pyproject.toml
index f455c40ed5..fbd324439c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -587,7 +587,7 @@ py-modules = [
 include = ["agent", "agent.*", "tools", "tools.*", "hermes_cli", "hermes_cli.*", "gateway", "gateway.*", "tui_gateway", "tui_gateway.*", "cron", "cron.*", "acp_adapter", "plugins", "plugins.*", "providers", "providers.*"]
 
 [tool.setuptools.package-data]
-hermes_cli = ["observability/schemas/*.json", "data/*.json"]
+hermes_cli = ["observability/schemas/*.json", "data/*.json", "local_runtime/*.json"]
 # gateway/assets/ ships status_phrases.yaml and the Telegram BotFather
 # screenshot. Without this, sealed venvs (uv2nix) silently lose both —
 # status phrases fall back to the tiny hardcoded set and the Telegram
diff --git a/run_agent.py b/run_agent.py
index 261945efd2..b3d2bf89cf 100644
--- a/run_agent.py
+++ b/run_agent.py
@@ -876,6 +876,7 @@ class AIAgent:
         # transcript — a fresh/branched/resumed session must fall back to
         # full estimation until its first provider response re-anchors.
         self._usage_anchor = None
+        self._turn_base_usage_anchor = None
         
         # Turn counter (added after reset_session_state was first written — #2635)
         self._user_turn_count = 0
@@ -1884,12 +1885,26 @@ class AIAgent:
         (LiteLLM/sglang/vLLM/LM Studio proxies, Tailscale boxes), which
         report finish_reason correctly and were the source of #13971's
         false-positive truncation continuations.
+
+        Also excludes Ollama Cloud — the hosted service correctly reports
+        finish_reason and is not affected by the local Ollama stop-reason
+        bug (GH-72316).  Two signatures identify it: the ``ollama.com`` host
+        (provider ``ollama-cloud``) and the ``:cloud`` model suffix (cloud
+        generation proxied through a local 11434 endpoint, #98406).  Applying
+        the stop→length rewrite to them manufactures false truncations and
+        causes the continuation nudge to consume the model's output budget
+        on the next retry, making further false-positives more likely.
         """
         model_lower = (self.model or "").lower()
         provider_lower = (self.provider or "").lower()
         if "glm" not in model_lower and provider_lower != "zai":
             return False
-        if "ollama" in self._base_url_lower or ":11434" in self._base_url_lower:
+        base = self._base_url_lower
+        # Ollama Cloud (hosted service or :cloud proxy) forwards finish_reason
+        # faithfully — do not rewrite.
+        if "ollama.com" in base or ":cloud" in model_lower:
+            return False
+        if "ollama" in base or ":11434" in base:
             return True
         return provider_lower == "ollama"
 
@@ -1976,6 +1991,71 @@ class AIAgent:
         review_memory: bool = False,
         review_skills: bool = False,
         focus: Optional[str] = None,
+        explicit: bool = False,
+    ) -> None:
+        """Post-turn review entry point: decide WHEN, then spawn.
+
+        The decision to review (nudge intervals, enabled gate) already
+        happened at the call site. This wrapper adds one policy: a review
+        whose runtime resolves to the MANAGED LOCAL llama-server is queued
+        for machine idle instead of spawned into the user's GPU mid-session
+        (auxiliary.background_review.defer: auto|never). Everything else —
+        cloud runtimes, external local servers, explicit /refine — spawns
+        immediately, exactly as before.
+
+        ``explicit`` marks a user-initiated review (/refine, with or
+        without focus text): never deferred. It does NOT touch the
+        delegate/enabled gates below — those stay keyed on ``focus`` so a
+        bare /refine keeps its historical gating behavior.
+        """
+        # Delegation-subagent and enabled gates run here at enqueue/spawn
+        # time; the idle dispatcher re-checks the enabled gate again at
+        # dispatch time so a review queued for minutes cannot be
+        # resurrected after the user disables reviews.
+        if focus is None and getattr(self, "_delegate_depth", 0) > 0:
+            return
+        task_cfg = None
+        if focus is None:
+            from agent.background_review import load_background_review_settings
+            enabled, task_cfg = load_background_review_settings()
+            if not enabled:
+                return
+
+        # Structural clone at the single chokepoint every review path
+        # (automatic, /refine, idle-queue deferral) goes through. The fork
+        # sanitizes its transcript in place; a shallow copy would alias the
+        # nested tool_calls/content containers of the live history (#100795).
+        from agent.turn_finalizer import _clone_background_review_messages
+        messages_snapshot = _clone_background_review_messages(messages_snapshot)
+
+        kwargs = dict(
+            messages_snapshot=messages_snapshot,
+            review_memory=review_memory,
+            review_skills=review_skills,
+            focus=focus,
+            task_cfg=task_cfg,
+        )
+        if focus is None and not explicit:
+            from agent.review_idle_queue import (
+                QUEUE,
+                defer_mode,
+                review_targets_managed_local,
+            )
+            if (defer_mode(task_cfg) == "auto"
+                    and review_targets_managed_local(self, task_cfg)):
+                session_key = str(getattr(self, "session_id", None) or id(self))
+                QUEUE.enqueue(self, session_key, kwargs)
+                return
+        self._spawn_background_review_now(**kwargs)
+
+    def _spawn_background_review_now(
+        self,
+        messages_snapshot: List[Dict],
+        review_memory: bool = False,
+        review_skills: bool = False,
+        focus: Optional[str] = None,
+        task_cfg: Optional[Dict[str, Any]] = None,
+        _requeue_attempts: int = 0,
     ) -> None:
         """Spawn the background memory/skill review thread.
 
@@ -1988,28 +2068,17 @@ class AIAgent:
         ``focus`` is optional user-supplied steering (from ``/refine``)
         appended to the review prompt — e.g. "save the deploy workflow as a
         skill". The automatic post-turn triggers never set it.
+
+        ``task_cfg`` is the pre-loaded ``auxiliary.background_review``
+        block from the entry wrapper (None on direct calls, e.g. /refine —
+        the spawn path reads config itself then).
+
+        A deferred review preempted by a live turn is REQUEUED (bounded by
+        ``_requeue_attempts``) instead of lost: on the managed local
+        runtime a review takes minutes, so cancel-and-forget — harmless on
+        cloud, where reviews finish in seconds — would silently discard
+        most learning on an active session.
         """
-        # A delegation subagent (``_delegate_depth > 0``) must not run the
-        # automatic post-turn review. Subagents are ephemeral workers already
-        # barred from writing shared MEMORY.md (``DELEGATE_BLOCKED_TOOLS``) and
-        # are spawned with ``skip_memory=True``, so a review here has little to
-        # persist — yet it inherits the subagent's (often premium) delegation
-        # model and replays the whole conversation at premium rates, silently
-        # inflating token cost (#85859). An explicit ``/refine`` (``focus`` set)
-        # is a deliberate user request and still runs.
-        if focus is None and getattr(self, "_delegate_depth", 0) > 0:
-            return
-        # Explicit off-switch for automatic post-turn forks
-        # (``auxiliary.background_review.enabled: false``). Manual ``/refine``
-        # still works — same contract as zeroing the nudge intervals (#87250).
-        # Load the task block once here and pass it into the spawn path so
-        # aux routing does not re-read config.
-        task_cfg = None
-        if focus is None:
-            from agent.background_review import load_background_review_settings
-            enabled, task_cfg = load_background_review_settings()
-            if not enabled:
-                return
         from agent.background_review import (
             finish_background_review_run,
             prepare_background_review_run,
@@ -2030,10 +2099,25 @@ class AIAgent:
                 task_cfg=task_cfg,
                 review_run=review_run,
             )
+
+            def _target_with_requeue() -> None:
+                target()
+                self._maybe_requeue_preempted_review(
+                    review_run,
+                    dict(
+                        messages_snapshot=messages_snapshot,
+                        review_memory=review_memory,
+                        review_skills=review_skills,
+                        focus=focus,
+                        task_cfg=task_cfg,
+                        _requeue_attempts=_requeue_attempts + 1,
+                    ),
+                )
+
             # Carry the active profile into the review thread so MEMORY.md /
             # skill review writes land in the right profile (#54937).
             t = threading.Thread(
-                target=propagate_context_to_thread(target),
+                target=propagate_context_to_thread(_target_with_requeue),
                 daemon=True,
                 name="bg-review",
             )
@@ -2042,6 +2126,42 @@ class AIAgent:
             finish_background_review_run(self, review_run)
             raise
 
+    _REVIEW_REQUEUE_MAX_ATTEMPTS = 3
+
+    def _maybe_requeue_preempted_review(self, review_run, kwargs) -> None:
+        """Requeue a deferred-mode review that a live turn cancelled.
+
+        Only fires for automatic reviews whose runtime targets the managed
+        local server (the deferred population); bounded attempts prevent a
+        busy box from cycling one review forever — past the cap it is
+        dropped exactly like the pre-deferral behavior dropped every
+        cancelled review.
+        """
+        try:
+            if not review_run.cancel_requested.is_set():
+                return  # ran to completion (or never admitted for other reasons)
+            if kwargs.get("focus") is not None:
+                return
+            if kwargs.get("_requeue_attempts", 0) > self._REVIEW_REQUEUE_MAX_ATTEMPTS:
+                logger.info("Preempted background review dropped after %d requeues",
+                            self._REVIEW_REQUEUE_MAX_ATTEMPTS)
+                return
+            from agent.review_idle_queue import (
+                QUEUE,
+                defer_mode,
+                review_targets_managed_local,
+            )
+            task_cfg = kwargs.get("task_cfg")
+            if (defer_mode(task_cfg) != "auto"
+                    or not review_targets_managed_local(self, task_cfg)):
+                return
+            session_key = str(getattr(self, "session_id", None) or id(self))
+            # kwargs carries the incremented _requeue_attempts through the
+            # queue so the cap survives the round trip.
+            QUEUE.enqueue(self, session_key, dict(kwargs))
+        except Exception:  # noqa: BLE001 — requeue is best-effort
+            logger.debug("Preempted-review requeue failed", exc_info=True)
+
     def _build_memory_write_metadata(
         self,
         *,
@@ -2550,13 +2670,17 @@ class AIAgent:
             # ("storage was busy, send it again") from disk-full/read-only.
             from hermes_state import (
                 CompressionSessionClosedError,
+                StateDbCorruptError,
                 StateDbReplacedError,
                 classify_persistence_error,
                 divert_session_transcript_jsonl,
             )
 
             self._last_persistence_error_cause = classify_persistence_error(e)
-            if isinstance(e, StateDbReplacedError):
+            if isinstance(e, (StateDbReplacedError, StateDbCorruptError)):
+                # Replaced generation or quarantined (structurally corrupt)
+                # handle: SQLite will not take this batch again, so keep it
+                # on disk instead of only in RAM.
                 try:
                     divert_session_transcript_jsonl(
                         getattr(self, "session_id", "") or "",
@@ -2564,7 +2688,8 @@ class AIAgent:
                     )
                 except Exception:
                     logger.warning(
-                        "JSONL divert failed after state.db replace for %s",
+                        "JSONL divert failed after state.db %s for %s",
+                        self._last_persistence_error_cause,
                         getattr(self, "session_id", None),
                         exc_info=True,
                     )
@@ -5599,6 +5724,75 @@ class AIAgent:
                 exc,
             )
 
+    def _drain_transports_after_abandonment(self, *, reason: str) -> int:
+        """FD-safe transport drain for an abandoned (timed-out) worker (#94248).
+
+        A delegation deadline abandons this agent's daemon worker while it may
+        still be blocked inside an in-flight OpenSSL ``read`` (Codex Responses
+        stream, httpx request). The timeout thread must never hard-close those
+        transports — ``client.close()`` releases raw FDs under a live SSL BIO,
+        the #29507 / #67142 / #70773 native-corruption family and the SIGSEGV
+        shape reported in #94248. This helper only ``shutdown()``s pooled
+        sockets (safe from any thread), settling blocked reads with EOF/EPIPE
+        so the worker can unwind and run the real close from its own thread.
+
+        Returns the number of sockets shut down across all transports.
+        """
+        drained = 0
+        # Shared primary client (codex-direct / MoA stream on it directly).
+        try:
+            client = getattr(self, "client", None)
+            if client is not None:
+                drained += self._force_close_tcp_sockets(client)
+        except Exception:
+            logger.debug("Abandoned-worker drain: shared client sweep failed",
+                         exc_info=True)
+        # Cached per-request wire clients: abort (shutdown + poison the reuse
+        # slot) so the unwinding worker discards them instead of re-caching.
+        try:
+            with self._openai_client_lock():
+                cache = getattr(self, "_request_client_cache", None)
+                cached = cache["client"] if cache else None
+            if cached is not None:
+                self._abort_request_openai_client(cached, reason=reason)
+        except Exception:
+            logger.debug("Abandoned-worker drain: request client abort failed",
+                         exc_info=True)
+        try:
+            with self._openai_client_lock():
+                cache = getattr(self, "_request_anthropic_client_cache", None)
+                cached = cache["client"] if cache else None
+            if cached is not None:
+                self._abort_request_anthropic_client(cached, reason=reason)
+        except Exception:
+            logger.debug("Abandoned-worker drain: anthropic client abort failed",
+                         exc_info=True)
+        # Codex app-server session watches a private interrupt event.
+        try:
+            codex_session = getattr(self, "_codex_session", None)
+            request_interrupt = getattr(codex_session, "request_interrupt", None)
+            if callable(request_interrupt):
+                request_interrupt()
+        except Exception:
+            logger.debug("Abandoned-worker drain: codex interrupt failed",
+                         exc_info=True)
+        # Inline (cron-style) request abort hook, when registered.
+        try:
+            abort_active = getattr(self, "_active_request_abort", None)
+            if callable(abort_active):
+                abort_active(reason)
+        except Exception:
+            logger.debug("Abandoned-worker drain: active request abort failed",
+                         exc_info=True)
+        logger.info(
+            "Abandoned-worker transports drained (%s, tcp_shutdown=%d, "
+            "fd_release=deferred_to_worker) %s",
+            reason,
+            drained,
+            self._client_log_context(),
+        )
+        return drained
+
     def _build_primary_client_for_active_provider(self, *, reason: str) -> Any:
         """Build the shared client shape required by the active provider.
 
@@ -8352,6 +8546,7 @@ class AIAgent:
         task_id: str = "default",
         focus_topic: str = None,
         force: bool = False,
+        bypass_cooldown: bool = False,
         defer_context_engine_notification: bool = False,
         commit_fence=None,
     ) -> tuple:
@@ -8360,7 +8555,9 @@ class AIAgent:
         ``force=True`` is passed by the manual ``/compress`` slash command
         so users can bypass the summary-failure cooldown after an
         auto-compress abort.  Auto-compress callers use the default
-        ``force=False``.
+        ``force=False``.  ``bypass_cooldown=True`` is passed by the
+        provider-proven overflow recovery path so one real attempt runs while
+        the cooldown is armed (#100661) — without clearing it.
         """
         # Per-attempt signal consumed by turn-start preflight (#98424) and the
         # in-loop pre-API/overflow consumers. A stalled compression must not
@@ -8441,6 +8638,7 @@ class AIAgent:
                     approx_tokens=approx_tokens, task_id=task_id,
                     focus_topic=focus_topic,
                     force=force,
+                    bypass_cooldown=bypass_cooldown,
                     defer_context_engine_notification=(
                         defer_context_engine_notification
                     ),
@@ -8821,6 +9019,13 @@ class AIAgent:
             function_result = append_toolguard_guidance(function_result, decision)
         if decision.should_halt:
             self._set_tool_guardrail_halt(decision)
+        else:
+            # observe_call may have raised the identical-call streak halt
+            # (hard_stop_enabled, tool-agnostic) — surface it the same way.
+            streak_halt = self._tool_guardrails.halt_decision
+            if streak_halt is not None and streak_halt.code == "identical_call_streak_halt":
+                function_result = append_toolguard_guidance(function_result, streak_halt)
+                self._set_tool_guardrail_halt(streak_halt)
         if stall_notice:
             function_result = (function_result or "") + "\n\n" + stall_notice
         return function_result
@@ -9026,6 +9231,13 @@ class AIAgent:
 
         cancel_background_review_for_live_turn(self)
 
+        # Turn liveness for the deferred-review idle queue: a queued review
+        # must not dispatch into the settle gap between two quick prompts.
+        # Marked inside the try below so the balancing note_turn_finished in
+        # its finally covers every exit; the actual start-mark happens as the
+        # first statement of the try.
+        from agent.review_idle_queue import QUEUE as _review_queue
+
         from agent.aux_accounting import (
             reset_accounting_context,
             set_accounting_context,
@@ -9111,6 +9323,7 @@ class AIAgent:
                     _clear_if_owned()
 
         try:
+            _review_queue.note_turn_started()
             # Serialize the full load -> run -> flush region across Hermes
             # processes. Gateway's asyncio lease closes alias routing inside one
             # process; this durable lease covers Desktop, CLI resume, gateway,
@@ -9657,6 +9870,13 @@ class AIAgent:
                         reset_conversation_context(token)
                     if affinity_token is not None:
                         reset_affinity_scope(affinity_token)
+                    # Balance the note_turn_started above — every exit path
+                    # lands here, so the idle queue's live-turn count cannot
+                    # leak upward and starve deferred reviews.
+                    try:
+                        _review_queue.note_turn_finished()
+                    except Exception:
+                        pass
 
     def chat(self, message: str, stream_callback: Optional[callable] = None) -> str:
         """
diff --git a/scripts/aa_quality_sync.py b/scripts/aa_quality_sync.py
new file mode 100644
index 0000000000..66e61c7f7d
--- /dev/null
+++ b/scripts/aa_quality_sync.py
@@ -0,0 +1,94 @@
+"""Propose catalog quality updates from Artificial Analysis.
+
+Authoring-time helper — NEVER called at runtime (their terms forbid
+client-side keys, the fleet would burn the rate limit, and a
+recommendation must not change because a third-party endpoint
+hiccuped). Run it when adding a model or refreshing the ordering;
+review the printed diff and edit catalog.json yourself. The script
+proposes, the commit decides.
+
+The catalog's `quality` stays OUR field: AA-informed where they cover a
+model, editorially set where they don't (day-0 releases lag their evals;
+some entries never appear). AA's Intelligence Index grades the
+full-precision cloud model, not our Q4 build — fine for ordering, never
+for display.
+
+Usage:
+    export AA_API_KEY=...   # from https://artificialanalysis.ai (free tier)
+    python scripts/aa_quality_sync.py
+
+Attribution: scores by Artificial Analysis (https://artificialanalysis.ai).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import urllib.request
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+CATALOG_PATH = REPO_ROOT / "hermes_cli" / "local_runtime" / "catalog.json"
+AA_URL = "https://artificialanalysis.ai/api/v2/data/llms/models"
+
+# Catalog entry id -> AA slug. Hand-maintained: AA's naming rarely matches
+# HF repo names, and a wrong match silently mis-ranks a model. An entry
+# absent here (or mapped to None) is editorial-only and never overwritten.
+AA_SLUG_BY_ENTRY = {
+    "qwen3.8-27b": "qwen3-8-27b",
+    "qwen3.8-flash-next": "qwen3-8-flash-next",
+    "qwen3.6-35b-a3b": "qwen3-6-35b-a3b",
+    "deepseek-v4-flash": "deepseek-v4-flash",
+}
+
+
+def fetch_aa_models(api_key: str) -> dict[str, dict]:
+    req = urllib.request.Request(AA_URL, headers={"x-api-key": api_key})
+    with urllib.request.urlopen(req, timeout=30) as r:
+        doc = json.load(r)
+    return {m["slug"]: m for m in doc.get("data", [])}
+
+
+def main() -> int:
+    api_key = os.environ.get("AA_API_KEY", "").strip()
+    if not api_key:
+        print("AA_API_KEY not set — create a free key at "
+              "https://artificialanalysis.ai and export it.", file=sys.stderr)
+        return 2
+
+    catalog = json.loads(CATALOG_PATH.read_text(encoding="utf-8"))
+    aa = fetch_aa_models(api_key)
+
+    print(f"{'entry':24s} {'catalog q':>9s} {'AA index':>9s}  note")
+    print("-" * 70)
+    for model in catalog["models"]:
+        entry_id = model["id"]
+        current = model.get("quality", 0)
+        slug = AA_SLUG_BY_ENTRY.get(entry_id)
+        if not slug:
+            print(f"{entry_id:24s} {current:>9d} {'—':>9s}  editorial only (no AA mapping)")
+            continue
+        hit = aa.get(slug)
+        if hit is None:
+            print(f"{entry_id:24s} {current:>9d} {'—':>9s}  not in AA data (slug {slug!r})")
+            continue
+        index = (hit.get("evaluations") or {}).get(
+            "artificial_analysis_intelligence_index")
+        if index is None:
+            print(f"{entry_id:24s} {current:>9d} {'—':>9s}  AA row lacks the index")
+            continue
+        proposed = round(float(index))
+        marker = "" if proposed == current else "  <-- proposes change"
+        print(f"{entry_id:24s} {current:>9d} {proposed:>9d}{marker}")
+
+    print("\nReview against the decision table before editing: a quality "
+          "change that flips cells in tests/hermes_cli/"
+          "test_local_recommendation.py is the actual decision being made.")
+    print("Attribution: scores by Artificial Analysis "
+          "(https://artificialanalysis.ai).")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/add_contributor.py b/scripts/add_contributor.py
index cb64b331cb..6e408b2a83 100644
--- a/scripts/add_contributor.py
+++ b/scripts/add_contributor.py
@@ -55,6 +55,24 @@ def _legacy_login(email: str) -> str | None:
         return None
 
 
+def _case_collision(email: str) -> str | None:
+    """An existing mapping whose filename differs from `email` only in case.
+
+    Returns the colliding filename, or None. Exact matches are not collisions --
+    that is the ordinary "already mapped" path handled by the caller.
+    """
+    if not EMAILS_DIR.is_dir():
+        return None
+
+    # casefold (not lower) matches how macOS/Windows fold non-ASCII text —
+    # same key scripts/check-case-collisions.py uses repo-wide.
+    folded = email.casefold()
+    for entry in EMAILS_DIR.iterdir():
+        if entry.name != email and entry.name.casefold() == folded:
+            return entry.name
+    return None
+
+
 def add_contributor(email: str, login: str, comment: str = "") -> int:
     email = email.strip()
     login = login.strip().lstrip("@")
@@ -67,6 +85,23 @@ def add_contributor(email: str, login: str, comment: str = "") -> int:
         return 2
 
     path = EMAILS_DIR / email
+
+    # One file per email means the FILENAME is the key, and on a
+    # case-insensitive filesystem (Windows, default macOS) two emails differing
+    # only in case are the same file. Creating both makes the repo impossible to
+    # check out cleanly there -- `git status` reports a phantom modification
+    # forever, because whichever file git wrote second wins on disk. Refuse for
+    # the same reason a conflicting login is refused: resolve it deliberately.
+    collision = _case_collision(email)
+    if collision is not None:
+        print(
+            f"error: {email} collides with existing mapping {collision} on "
+            "case-insensitive filesystems (Windows/macOS) — the two are the same "
+            "file there. Reuse that mapping, or resolve manually.",
+            file=sys.stderr,
+        )
+        return 1
+
     existing = read_mapping_file(path) if path.is_file() else None
     if existing is None:
         existing = _legacy_login(email)
diff --git a/scripts/check-case-collisions.py b/scripts/check-case-collisions.py
new file mode 100644
index 0000000000..0ef0becfb8
--- /dev/null
+++ b/scripts/check-case-collisions.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""
+Blocking check for tracked files whose paths collide when case is ignored.
+
+Linux is case-sensitive; Windows and macOS (default) are not. Two tracked
+paths that differ only by case — ``README.md`` and ``readme.md``, or
+``src/Foo.py`` and ``SRC/foo.py`` — coexist happily in a Linux checkout and
+silently break every clone on a case-insensitive host: the filesystem can
+hold only one of them, so checkout either refuses or whichever file is
+written last wins and clobbers the other. Git itself won't stop the pair
+from landing — it only warns at checkout time, on a case-insensitive FS,
+for whichever client happens to do the checkout, and the collision is
+invisible on Linux. This check is the enforcement point: scan the index,
+fail the build, name the offenders.
+
+Usage:
+    # Check the checkout this script lives in (CI + the common local case)
+    python scripts/check-case-collisions.py
+
+    # Check an arbitrary git checkout (tests, other worktrees)
+    python scripts/check-case-collisions.py /path/to/other/repo
+
+Exit status:
+    0 — no case-colliding tracked paths
+    1 — at least one collision group (paths printed to stdout)
+    2 — not in a git repository / git failed
+
+Comparison key: the casefolded FULL path (``str.casefold``), not the
+basename — on a case-insensitive filesystem the entire path is
+case-insensitive, so ``dir/Foo.txt`` and ``DIR/foo.txt`` collide just like
+same-directory pairs. ``casefold`` (not ``lower``) is used because it
+matches how the OSes fold case for non-ASCII text (straße vs strasse,
+sigma variants); a pair it flags is a genuine collision on macOS/Windows
+even when Linux disagrees.
+
+Deliberately out of scope: Unicode NFC/NFD normalization collisions (macOS
+stores NFD, Linux NFC). git already handles those at checkout via
+``core.precomposeunicode``; this check is strictly about case.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import subprocess
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "root",
+        nargs="?",
+        default=str(REPO_ROOT),
+        help="git checkout to scan (default: the repo this script lives in)",
+    )
+    args = parser.parse_args()
+
+    try:
+        os.chdir(args.root)
+    except OSError as exc:
+        print(f"::error::cannot enter {args.root}: {exc}")
+        return 2
+
+    proc = subprocess.run(["git", "ls-files", "-z"], capture_output=True)
+    if proc.returncode != 0:
+        msg = proc.stderr.decode("utf-8", errors="replace").strip()
+        print(f"::error::git ls-files failed in {args.root}: {msg}")
+        return 2
+
+    paths = [
+        p.decode("utf-8", errors="surrogateescape")
+        for p in proc.stdout.split(b"\0")
+        if p
+    ]
+
+    by_casefold: dict[str, list[str]] = defaultdict(list)
+    for path in paths:
+        by_casefold[path.casefold()].append(path)
+
+    collisions = {key: group for key, group in by_casefold.items() if len(group) > 1}
+
+    if not collisions:
+        print(f"::notice::{len(paths)} tracked files, no case-colliding paths.")
+        return 0
+
+    print(
+        f"::error::Found {len(collisions)} case-collision group(s) among "
+        f"{len(paths)} tracked files."
+    )
+    print(
+        "Paths that differ only by case are ONE file on Windows/macOS but "
+        "several on Linux - the pair breaks every clone on a case-insensitive "
+        "host. Rename one member of each group so the paths differ beyond case."
+    )
+    print()
+    for key, group in sorted(collisions.items()):
+        for path in sorted(group):
+            print(f"  {path}")
+        print()
+    print(
+        "Fix: `git mv` one path in each group to a name that doesn't collide. "
+        "On Windows/macOS you may need two steps (`git mv a.txt tmp && git mv "
+        "tmp A.txt`) because the filesystem can't hold both spellings at once."
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/ci/classify_changes.py b/scripts/ci/classify_changes.py
index 935703c870..71afcda686 100644
--- a/scripts/ci/classify_changes.py
+++ b/scripts/ci/classify_changes.py
@@ -25,6 +25,12 @@ Lanes:
   must not run it.
 * ``npm_lock``    — semantic package-lock.json diff PR comment.
 * ``installer``   — PowerShell installer tests (Windows runner).
+* ``desktop_updater`` — the Windows desktop-update hand-off script and the
+  tests that drive the REAL ``windows.ps1`` (``-SelfTestUi`` / pipe drain /
+  retry policy). These are integration tests of a PowerShell process on a
+  shared runner; running them on every Python PR made their timing noise
+  everyone's problem. They still run on push (fail-open) and whenever the
+  script, its siblings, or their tests change.
 * ``rust``        — ``cargo test`` for the Tauri bootstrap installer. ``.rs``
   lives under ``apps/``, so without this lane a Rust change matched ``frontend``
   and only the TypeScript matrix ran.
@@ -110,6 +116,17 @@ _MCP_CATALOG_FILES = {"hermes_cli/mcp_catalog.py"}
 _INSTALLER_PATHS = ("scripts/tests/",)
 _INSTALLER_FILES = {"scripts/install.ps1", "scripts/install.cmd"}
 
+# Windows desktop-update hand-off (scripts/desktop-update/windows.ps1 + the
+# Electron side that launches it) and the pytest files that spawn it.
+_DESKTOP_UPDATER_PATHS = ("scripts/desktop-update/",)
+_DESKTOP_UPDATER_TEST_PREFIX = "tests/test_desktop_update_"
+_DESKTOP_UPDATER_FILES = {
+    "apps/desktop/electron/updater-process.ts",
+    "apps/desktop/electron/managed-ssh-update.ts",
+    "tests/conftest.py",
+    "pyproject.toml",
+}
+
 # Rust crates — currently just the Tauri bootstrap installer (Hermes-Setup).
 # These live under ``apps/``, so before this lane existed a ``.rs`` edit matched
 # ``frontend`` and nothing more: the TypeScript matrix built, cargo never ran,
@@ -163,6 +180,14 @@ def _is_installer(p: str) -> bool:
     return p.startswith(_INSTALLER_PATHS) or p in _INSTALLER_FILES
 
 
+def _is_desktop_updater(p: str) -> bool:
+    return (
+        p.startswith(_DESKTOP_UPDATER_PATHS)
+        or p.startswith(_DESKTOP_UPDATER_TEST_PREFIX)
+        or p in _DESKTOP_UPDATER_FILES
+    )
+
+
 def _is_rust(p: str) -> bool:
     return (
         p.endswith(".rs")
@@ -206,6 +231,7 @@ def classify(files: list[str]) -> dict[str, bool]:
         "uv_lock": any(f in ("pyproject.toml", "uv.lock") for f in files),
         "npm_lock": npm_lock,
         "installer": any(_is_installer(f) for f in files),
+        "desktop_updater": any(_is_desktop_updater(f) for f in files),
         "rust": any(_is_rust(f) for f in files),
         "mcp_catalog": any(_is_mcp_catalog(f) for f in files),
         "ci_review": any(_is_ci_review(f) for f in files),
@@ -223,6 +249,7 @@ def classify(files: list[str]) -> dict[str, bool]:
         ret["uv_lock"] = True
         ret["npm_lock"] = True
         ret["installer"] = True
+        ret["desktop_updater"] = True
         ret["rust"] = True
         ret["nix"] = True
         ret["ci_review"] = True
diff --git a/scripts/desktop-update/windows.ps1 b/scripts/desktop-update/windows.ps1
index 7067cff335..19c9d8615a 100644
--- a/scripts/desktop-update/windows.ps1
+++ b/scripts/desktop-update/windows.ps1
@@ -212,6 +212,36 @@ function Start-UiServer([string]$HtmlPath) {
         })
         [void]$ps.BeginInvoke()
 
+        # Readiness handshake. BeginInvoke returns before the runspace has
+        # opened its pipeline and JIT'd the script block — on a loaded machine
+        # that is seconds, during which the kernel ACCEPTS connections into
+        # the listener's backlog and nobody answers them. Anything that
+        # trusted "listener bound" as "server serving" (the browser window
+        # opening to a page that never loads; the -SelfTestUi URL that CI
+        # polls) raced that gap. Prove one /progress round-trip before
+        # handing the port out, so the URL means "serving", not "bound".
+        $ready = $false
+        $readyDeadline = [DateTime]::UtcNow.AddSeconds(15)
+        while (-not $ready -and [DateTime]::UtcNow -lt $readyDeadline) {
+            try {
+                $probe = [System.Net.HttpWebRequest]::Create("http://127.0.0.1:$port/progress")
+                $probe.Timeout = 1000
+                $probe.ReadWriteTimeout = 1000
+                $probe.KeepAlive = $false
+                $resp = $probe.GetResponse()
+                try { $ready = ([int]$resp.StatusCode -eq 200) } finally { $resp.Close() }
+            } catch {
+                Start-Sleep -Milliseconds 100
+            }
+        }
+        if (-not $ready) {
+            Write-HandoffLog "progress server did not answer /progress within 15s; continuing without UI"
+            try { $listener.Stop() } catch {}
+            try { $ps.Stop() } catch {}
+            try { $rs.Close() } catch {}
+            return $null
+        }
+
         return @{ Listener = $listener; Runspace = $rs; PowerShell = $ps; Port = $port; BrowserProc = $null; Profile = $null }
     } catch {
         try { if ($listener) { $listener.Stop() } } catch {}
diff --git a/scripts/e2e_shared_metrics_staging.py b/scripts/e2e_shared_metrics_staging.py
new file mode 100644
index 0000000000..666c9e51e9
--- /dev/null
+++ b/scripts/e2e_shared_metrics_staging.py
@@ -0,0 +1,198 @@
+"""Live staging E2E for the shared-metrics exporter.
+
+Sends REAL packages through the REAL sender to the REAL staging ingest
+service, then reports what the service acknowledged. Uses a throwaway
+HERMES_HOME so the operator's own telemetry state is untouched.
+
+Usage:
+    .venv/bin/python scripts/e2e_shared_metrics_staging.py
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import tempfile
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO))
+
+STAGING = "https://telemetry.staging-nousresearch.com/v1/telemetry"
+
+
+def main() -> int:
+    scratch = Path(tempfile.mkdtemp(prefix="hermes-telemetry-e2e-"))
+    os.environ["HERMES_HOME"] = str(scratch)
+
+    # Staging is selected by writing config into the THROWAWAY profile, not by
+    # an environment override: a runtime env var that can retarget consented
+    # telemetry would be a consent hazard in production.
+    (scratch / "config.yaml").write_text(
+        "telemetry:\n"
+        "  shared_metrics:\n"
+        "    enabled: true\n"
+        "    send: true\n"
+        f"    endpoint: {STAGING}\n",
+        encoding="utf-8",
+    )
+
+    from hermes_cli.observability.shared_metrics import SharedMetricsStore
+    from hermes_cli.observability.shared_metrics_send_config import (
+        resolve_send_config,
+    )
+    from hermes_cli.observability.shared_metrics_sender import SharedMetricsSender
+
+    # Resolve through the real config path so this exercises what a user gets.
+    import yaml
+
+    resolved = resolve_send_config(
+        yaml.safe_load((scratch / "config.yaml").read_text(encoding="utf-8"))
+    )
+    if not resolved.send or resolved.endpoint != STAGING:
+        print(f"FAIL: config did not resolve to staging: {resolved}")
+        return 1
+
+    store = SharedMetricsStore(
+        database_path=scratch / "metrics.sqlite3",
+        outbox_directory=scratch / "outbox",
+    )
+
+    today = datetime.now(timezone.utc).date().isoformat()
+    # The generator only exports COMPLETED periods, so the realistic E2E
+    # package is yesterday's. It also has to be: the consent gate only
+    # releases a package once its whole period is confirmed consented, and
+    # today's period cannot be confirmed before it ends.
+    from datetime import timedelta
+
+    period_day = (
+        datetime.now(timezone.utc).date() - timedelta(days=1)
+    ).isoformat()
+
+    # Open the consent window before the period, confirm it after — exactly
+    # what the runtime reconciler does across two days of hook fires.
+    from hermes_cli.observability.shared_metrics_sender import (
+        reconcile_send_consent,
+    )
+    from hermes_cli.sqlite_util import write_txn
+
+    with store._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(
+                connection,
+                True,
+                now=datetime.now(timezone.utc) - timedelta(days=2),
+            )
+            reconcile_send_consent(connection, True)
+    real_install_id = str(uuid.uuid4())
+    packages = []
+
+    # Two packages for today's period: the "head" and a later "tail", which is
+    # the real shape the outbox produces and the case the period gate exists
+    # for. One is large enough to exercise gzip.
+    for index, metric_count in ((0, 3), (1, 140)):
+        package_id = str(uuid.uuid4())
+        payload = {
+            "schema_version": "hermes.shared_metrics.v2",
+            "package_id": package_id,
+            "install_id": real_install_id,
+            "generated_at": datetime.now(timezone.utc).isoformat().replace(
+                "+00:00", "Z"
+            ),
+            "period_start": f"{period_day}T00:00:00Z",
+            "period_end": f"{period_day}T23:59:59Z",
+            "resource": {
+                "hermes_version": "e2e-test",
+                "os_family": "macos",
+                "architecture": "arm64",
+                "install_method": "git",
+            },
+            "metrics": [
+                {
+                    "name": f"hermes.e2e.metric.{i}",
+                    "type": "counter",
+                    "dimensions": {"outcome": "ok", "surface": "e2e"},
+                    "value": i + 1,
+                }
+                for i in range(metric_count)
+            ],
+        }
+        with store._connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO package_outbox(
+                    package_id, period_start, period_end, payload_json,
+                    created_at, exported_at
+                ) VALUES (?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    package_id,
+                    f"{period_day}T00:00:00Z",
+                    f"{period_day}T23:59:59Z",
+                    json.dumps(payload),
+                    f"{period_day}T0{index}:00:00Z",
+                    f"{period_day}T0{index}:00:01Z",
+                ),
+            )
+        packages.append((package_id, metric_count))
+
+    print(f"scratch HERMES_HOME : {scratch}")
+    print(f"endpoint            : {STAGING}")
+    print(f"local install_id    : {real_install_id}")
+    print(f"packages queued     : {len(packages)}")
+    for package_id, count in packages:
+        print(f"  - {package_id}  ({count} metrics)")
+    print()
+
+    outcome = SharedMetricsSender(store, resolved.endpoint).send_pending()
+    print(f"outcome: sent={outcome.sent} rejected={outcome.rejected} "
+          f"deferred={outcome.deferred}")
+    print()
+
+    failures = []
+    with store._connection() as connection:
+        rows = connection.execute(
+            """
+            SELECT package_id, send_state, sent_at, send_attempts,
+                   sent_install_id, last_error
+            FROM package_outbox ORDER BY created_at
+            """
+        ).fetchall()
+
+    for row in rows:
+        print(f"package        : {row[0]}")
+        print(f"  send_state   : {row[1]}")
+        print(f"  sent_at      : {row[2]}")
+        print(f"  attempts     : {row[3]}")
+        print(f"  transmitted  : {row[4]}")
+        print(f"  last_error   : {row[5]}")
+        if row[1] != "sent":
+            failures.append(f"{row[0]} is {row[1]}: {row[5]}")
+        # Product decision 2026-08-27: the stable install_id is transmitted
+        # as-is; the transmitted value must be exactly the local id.
+        if row[4] != real_install_id:
+            failures.append(
+                f"{row[0]} transmitted {row[4]!r}, expected the install_id"
+            )
+        print()
+
+    if failures:
+        print("FAILURES:")
+        for failure in failures:
+            print(f"  ✗ {failure}")
+        return 1
+
+    print("PASS: every package acknowledged 202 with the stable install_id.")
+    print()
+    print("Verify the objects in S3 with the package ids above:")
+    print("  aws s3 ls --recursive "
+          "s3://hermes-agent-telemetry-staging-767397871023-us-west-2-an/raw/ "
+          "| tail -20")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/install.sh b/scripts/install.sh
index 6f717b011b..eec308a5de 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -618,21 +618,64 @@ install_uv() {
 check_python() {
     if [ "$DISTRO" = "termux" ]; then
         log_info "Checking Termux Python..."
-        if command -v python >/dev/null 2>&1; then
-            PYTHON_PATH="$(command -v python)"
-            if "$PYTHON_PATH" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)' 2>/dev/null; then
-                PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null)"
-                log_success "Python found: $PYTHON_FOUND_VERSION"
-                return 0
+        # Hermes currently declares requires-python >=3.11,<3.14.  Termux can
+        # expose a newer default `python` before dependencies have compatible
+        # wheels, so do not accept the default interpreter until the upper bound
+        # is verified. Prefer the project's pinned minor when present, then
+        # other explicit compatible interpreters.
+        for python_cmd in python3.11 python3.12 python3.13 python; do
+            if command -v "$python_cmd" >/dev/null 2>&1; then
+                local candidate_path
+                candidate_path="$(command -v "$python_cmd")"
+                if "$candidate_path" -c 'import sys; raise SystemExit(0 if (3, 11) <= sys.version_info[:2] < (3, 14) else 1)' 2>/dev/null; then
+                    PYTHON_PATH="$candidate_path"
+                    PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null)"
+                    log_success "Python found: $PYTHON_FOUND_VERSION"
+                    return 0
+                fi
             fi
-        fi
+        done
 
         log_info "Installing Python via pkg..."
         pkg install -y python >/dev/null
         PYTHON_PATH="$(command -v python)"
-        PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null)"
-        log_success "Python installed: $PYTHON_FOUND_VERSION"
-        return 0
+        if "$PYTHON_PATH" -c 'import sys; raise SystemExit(0 if (3, 11) <= sys.version_info[:2] < (3, 14) else 1)' 2>/dev/null; then
+            PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null)"
+            log_success "Python installed: $PYTHON_FOUND_VERSION"
+            return 0
+        fi
+
+        # Termux's default `python` package is outside the supported range
+        # (e.g. 3.14.x before Rust transitives ship cp314 wheels). The Termux
+        # User Repository (TUR) publishes versioned CPython packages
+        # (python3.13, python3.11), so try to provision a supported
+        # interpreter from there before giving up.
+        PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null || true)"
+        log_warn "Termux Python $PYTHON_FOUND_VERSION is outside the supported range (>=3.11,<3.14)"
+        log_info "Trying the Termux User Repository (TUR) for a supported Python..."
+        pkg install -y tur-repo >/dev/null 2>&1 || true
+        local tur_pkg
+        for tur_pkg in python3.13 python3.12 python3.11; do
+            if ! pkg install -y "$tur_pkg" >/dev/null 2>&1; then
+                continue
+            fi
+            if ! command -v "$tur_pkg" >/dev/null 2>&1; then
+                continue
+            fi
+            local tur_path
+            tur_path="$(command -v "$tur_pkg")"
+            if "$tur_path" -c 'import sys; raise SystemExit(0 if (3, 11) <= sys.version_info[:2] < (3, 14) else 1)' 2>/dev/null; then
+                PYTHON_PATH="$tur_path"
+                PYTHON_FOUND_VERSION="$("$PYTHON_PATH" --version 2>/dev/null)"
+                log_success "Python installed from TUR: $PYTHON_FOUND_VERSION"
+                return 0
+            fi
+        done
+
+        log_error "Termux Python $PYTHON_FOUND_VERSION is not supported; Hermes requires Python >=3.11,<3.14"
+        log_info "Install a supported interpreter and re-run this script:"
+        log_info "  pkg install tur-repo && pkg install python3.13"
+        exit 1
     fi
 
     log_info "Checking Python $PYTHON_VERSION..."
diff --git a/setup-hermes.sh b/setup-hermes.sh
index 0358bf1f7b..4f71fade62 100755
--- a/setup-hermes.sh
+++ b/setup-hermes.sh
@@ -133,19 +133,32 @@ fi
 echo -e "${CYAN}→${NC} Checking Python $PYTHON_VERSION..."
 
 if is_termux; then
-    if command -v python >/dev/null 2>&1; then
-        PYTHON_PATH="$(command -v python)"
-        if "$PYTHON_PATH" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else 1)' 2>/dev/null; then
-            PYTHON_FOUND_VERSION=$($PYTHON_PATH --version 2>/dev/null)
-            echo -e "${GREEN}✓${NC} $PYTHON_FOUND_VERSION found"
-        else
-            echo -e "${RED}✗${NC} Termux Python must be 3.11+"
-            echo "    Run: pkg install python"
-            exit 1
+    # Hermes currently declares requires-python >=3.11,<3.14. Termux can expose
+    # a newer default `python` before dependencies have compatible wheels, so
+    # prefer explicit compatible minors and verify the upper bound before using
+    # the interpreter to create the venv.
+    for python_cmd in python3.11 python3.12 python3.13 python; do
+        if command -v "$python_cmd" >/dev/null 2>&1; then
+            CANDIDATE_PATH="$(command -v "$python_cmd")"
+            if "$CANDIDATE_PATH" -c 'import sys; raise SystemExit(0 if (3, 11) <= sys.version_info[:2] < (3, 14) else 1)' 2>/dev/null; then
+                PYTHON_PATH="$CANDIDATE_PATH"
+                PYTHON_FOUND_VERSION=$($PYTHON_PATH --version 2>/dev/null)
+                echo -e "${GREEN}✓${NC} $PYTHON_FOUND_VERSION found"
+                break
+            fi
+        fi
+    done
+
+    if [ -z "${PYTHON_PATH:-}" ]; then
+        if command -v python >/dev/null 2>&1; then
+            PYTHON_FOUND_VERSION="$(python --version 2>/dev/null || true)"
+            echo -e "${RED}✗${NC} Termux Python $PYTHON_FOUND_VERSION is not supported; Hermes requires Python >=3.11,<3.14"
+            echo "    Install a supported interpreter and re-run this script:"
+            echo "      pkg install tur-repo && pkg install python3.13"
+        else
+            echo -e "${RED}✗${NC} Python not found in Termux"
+            echo "    Run: pkg install python"
         fi
-    else
-        echo -e "${RED}✗${NC} Python not found in Termux"
-        echo "    Run: pkg install python"
         exit 1
     fi
 else
diff --git a/tests/agent/test_acp_openai_bridge.py b/tests/agent/test_acp_openai_bridge.py
index d1c0402604..f687461818 100644
--- a/tests/agent/test_acp_openai_bridge.py
+++ b/tests/agent/test_acp_openai_bridge.py
@@ -200,7 +200,10 @@ def test_copilot_prompt_still_carries_the_contract_and_the_tools():
     assert "<tool_call>{...}</tool_call>" in prompt
     assert '"name": "memory"' in prompt
     assert '"name": "read_file"' in prompt  # copilot forwards everything
-    assert "Hermes requested model hint: gpt-5" in prompt
+    # No prompt-text model mention: the model is applied via ACP
+    # session/set_model, and a prompt hint makes a substituted backend
+    # falsely self-identify as the requested model.
+    assert "model hint" not in prompt
     assert "hi" in prompt
 
 
diff --git a/tests/agent/test_anthropic_adapter.py b/tests/agent/test_anthropic_adapter.py
index 9619925194..61754a4307 100644
--- a/tests/agent/test_anthropic_adapter.py
+++ b/tests/agent/test_anthropic_adapter.py
@@ -983,19 +983,23 @@ class TestBuildAnthropicKwargs:
 
 
     def test_supports_fast_mode_predicate(self):
-        """Fast mode is Opus 4.6 only — Opus 4.7 and others must be excluded.
+        """The speed-param allowlist tracks the live fast-mode docs.
 
-        For Opus 4.8 the fast variant is a separate model ID
-        (anthropic/claude-opus-4.8-fast) routed through the normal model
-        field, NOT via the ``speed: "fast"`` request parameter. So
-        ``_supports_fast_mode`` (which gates the parameter) must stay
-        False for both opus-4-8 and opus-4-8-fast.
+        Per https://platform.claude.com/docs/en/build-with-claude/fast-mode:
+        Opus 4.8 and Opus 5 support ``speed: "fast"``. Opus 4.6 LOST fast
+        mode (param silently ignored → standard speed at standard billing);
+        Opus 4.7 hard-400s. Dedicated ``…-fast`` model ids select fast
+        inference via the model field and must not also get the param.
         """
         from agent.anthropic_adapter import _supports_fast_mode
-        assert _supports_fast_mode("claude-opus-4-6") is True
-        assert _supports_fast_mode("anthropic/claude-opus-4-6") is True
+        assert _supports_fast_mode("claude-opus-4-8") is True
+        assert _supports_fast_mode("claude-opus-4.8") is True
+        assert _supports_fast_mode("anthropic/claude-opus-4-8") is True
+        assert _supports_fast_mode("claude-opus-5") is True
+        assert _supports_fast_mode("anthropic/claude-opus-5") is True
+        assert _supports_fast_mode("claude-opus-4-6") is False
+        assert _supports_fast_mode("anthropic/claude-opus-4-6") is False
         assert _supports_fast_mode("claude-opus-4-7") is False
-        assert _supports_fast_mode("claude-opus-4-8") is False
         assert _supports_fast_mode("claude-opus-4-8-fast") is False
         assert _supports_fast_mode("claude-sonnet-4-6") is False
         assert _supports_fast_mode("claude-haiku-4-5") is False
diff --git a/tests/agent/test_aux_stream_host_deadline.py b/tests/agent/test_aux_stream_host_deadline.py
new file mode 100644
index 0000000000..924b0766a8
--- /dev/null
+++ b/tests/agent/test_aux_stream_host_deadline.py
@@ -0,0 +1,295 @@
+"""#99692 — the streamed auxiliary summary must not outlive its compression host.
+
+Background
+----------
+``run_compress_context_with_progress_timeout`` arms a wall-clock deadline on the
+``CompressionCommitFence`` (``set_total_ceiling_seconds``), whose docstring calls
+it "the wall-clock deadline **shared by the host and worker**".  Only the host
+ever read it.
+
+``8207862212`` (fix(compression): stop timeout paths from blocking retries)
+closed the first half: a cancelled fence now releases the compression OWNER,
+which frees the pool slot and the session lease.  It left the second half open
+by design — its own comment says the isolated provider daemon runs on "until
+the auxiliary stream's longer absolute ceiling expires".
+
+That ceiling is ``_aux_stream_total_ceiling`` = ``max(600, 4 * aux_timeout)``:
+>= the default host ceiling (600s) for every configured timeout, and it starts
+counting later (after pool admission, serialization, prompt build and TTFT).
+So the daemon holding the socket is *always* still streaming when its host gives
+up — 2400s with the reporter's ``auxiliary.compression.timeout: 600`` — billing
+every token of a summary the fence is already guaranteed to refuse, and stacking
+one fresh orphan per turn because the session never shrank.
+
+These tests pin the missing half of that shared deadline: the stream consumer
+must stop at the host's deadline, including on the isolated provider daemon
+that ``_run_protected_sync_provider_call`` spawns.
+"""
+
+from __future__ import annotations
+
+import ast
+import asyncio
+import inspect
+import threading
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from agent import auxiliary_client as aux
+from agent.conversation_compression import (
+    DEFAULT_CONTEXT_TOTAL_CEILING_SECONDS,
+    CompressionCommitFence,
+)
+
+
+def _chunk(text: str) -> SimpleNamespace:
+    return SimpleNamespace(
+        id="resp-1",
+        model="test-model",
+        usage=None,
+        choices=[
+            SimpleNamespace(
+                index=0,
+                finish_reason=None,
+                delta=SimpleNamespace(content=text, tool_calls=None),
+            )
+        ],
+    )
+
+
+class _Stream:
+    """Chunk iterator that records how far the consumer drained it."""
+
+    def __init__(self, count: int = 50) -> None:
+        self._count = count
+        self.yielded = 0
+        self.closed = False
+
+    def __iter__(self):
+        for _ in range(self._count):
+            self.yielded += 1
+            yield _chunk("x")
+
+    def close(self) -> None:
+        self.closed = True
+
+
+class _AsyncStream(_Stream):
+    async def __aiter__(self):  # pragma: no cover - exercised via asyncio.run
+        for _ in range(self._count):
+            self.yielded += 1
+            yield _chunk("x")
+
+
+# ── The structural gap the bug lives in ──────────────────────────────────
+
+
+def test_stream_ceiling_structurally_outlives_the_default_host_ceiling():
+    """The worker's own budget is >= the host's for every configured timeout.
+
+    This is the arithmetic that guarantees the orphan: there is no aux timeout
+    for which ``_aux_stream_total_ceiling`` lands below the 600s default host
+    ceiling, and the reporter's ``auxiliary.compression.timeout: 600`` puts it
+    at 2400s — a 30-minute window in which an abandoned provider daemon keeps
+    streaming a summary nobody can commit.
+    """
+    for aux_timeout in (None, 0, 30.0, 120.0, 300.0):
+        assert (
+            aux._aux_stream_total_ceiling(aux_timeout)
+            >= DEFAULT_CONTEXT_TOTAL_CEILING_SECONDS
+        )
+    assert aux._aux_stream_total_ceiling(600.0) == 2400.0
+    assert (
+        aux._aux_stream_total_ceiling(600.0)
+        - DEFAULT_CONTEXT_TOTAL_CEILING_SECONDS
+        == 1800.0
+    )
+
+
+# ── The fence must publish the deadline it already owns ──────────────────
+
+
+def test_commit_fence_publishes_its_shared_deadline():
+    fence = CompressionCommitFence()
+    assert fence.deadline_monotonic is None
+
+    fence.set_total_ceiling_seconds(600.0)
+    published = fence.deadline_monotonic
+    assert published is not None
+    assert 590.0 < published - time.monotonic() <= 600.0
+    assert not fence.deadline_exceeded
+
+    fence.set_total_ceiling_seconds(0.001)
+    time.sleep(0.01)
+    assert fence.deadline_exceeded
+    assert fence.deadline_monotonic <= time.monotonic()
+
+
+# ── The stream consumer must honour it ───────────────────────────────────
+
+
+def test_streamed_summary_stops_at_an_elapsed_host_deadline():
+    """A host that already gave up must not leave the worker streaming on."""
+    stream = _Stream(count=50)
+    with aux.aux_stream_deadline(time.monotonic() - 1.0):
+        with pytest.raises(TimeoutError) as excinfo:
+            aux._aggregate_chat_stream(stream, model="m", total_ceiling=2400.0)
+
+    # "timed out" keeps _is_timeout_error classification identical to a
+    # request timeout, so the existing recovery chains are unchanged.
+    assert "timed out" in str(excinfo.value)
+    assert "host compression deadline" in str(excinfo.value)
+    # Stopped on the first frame instead of draining the whole stream, and the
+    # HTTP response was closed rather than left dangling.
+    assert stream.yielded == 1
+    assert stream.closed is True
+
+
+def test_streamed_summary_runs_to_completion_under_a_live_host_deadline():
+    stream = _Stream(count=5)
+    with aux.aux_stream_deadline(time.monotonic() + 600.0):
+        response = aux._aggregate_chat_stream(
+            stream, model="m", total_ceiling=2400.0
+        )
+    assert response.choices[0].message.content == "xxxxx"
+    assert stream.yielded == 5
+
+
+def test_no_host_deadline_keeps_the_historical_ceiling_behaviour():
+    """Every non-compression aux caller must be byte-for-byte unchanged."""
+    stream = _Stream(count=5)
+    response = aux._aggregate_chat_stream(stream, model="m", total_ceiling=2400.0)
+    assert response.choices[0].message.content == "xxxxx"
+    assert stream.yielded == 5
+
+    # An installed-then-exited scope must not leak into the next call.
+    with aux.aux_stream_deadline(time.monotonic() - 1.0):
+        pass
+    stream2 = _Stream(count=3)
+    assert (
+        aux._aggregate_chat_stream(
+            stream2, model="m", total_ceiling=2400.0
+        ).choices[0].message.content
+        == "xxx"
+    )
+
+
+def test_none_deadline_is_a_no_op_passthrough():
+    """Callers wire the scope unconditionally; a fenceless call must not break."""
+    stream = _Stream(count=3)
+    with aux.aux_stream_deadline(None):
+        response = aux._aggregate_chat_stream(
+            stream, model="m", total_ceiling=2400.0
+        )
+    assert response.choices[0].message.content == "xxx"
+
+
+def test_nested_none_inherits_rather_than_escaping_the_host_deadline():
+    """A fenceless aux call nested inside a fenced one stays bounded.
+
+    ``None`` means "I have no deadline of my own", not "clear the one in
+    force" — mirroring ``_aux_thread_local_hook``'s passthrough contract. If it
+    cleared, any nested auxiliary call made during compression would escape the
+    host ceiling that the whole attempt is supposed to live inside.
+    """
+    outer = time.monotonic() - 1.0
+    stream = _Stream(count=50)
+    with aux.aux_stream_deadline(outer):
+        with aux.aux_stream_deadline(None):
+            assert aux._current_aux_stream_deadline() == outer
+            with pytest.raises(TimeoutError):
+                aux._aggregate_chat_stream(stream, model="m", total_ceiling=2400.0)
+    assert stream.yielded == 1
+
+
+def test_deadline_scope_restores_the_previous_value():
+    outer = time.monotonic() + 900.0
+    with aux.aux_stream_deadline(outer):
+        assert aux._current_aux_stream_deadline() == outer
+        with aux.aux_stream_deadline(time.monotonic() + 10.0):
+            assert aux._current_aux_stream_deadline() != outer
+        assert aux._current_aux_stream_deadline() == outer
+    assert aux._current_aux_stream_deadline() is None
+
+
+def test_async_stream_mirror_honours_the_host_deadline():
+    """The async consumer must not drift from the sync one."""
+    stream = _AsyncStream(count=50)
+
+    async def _run():
+        with aux.aux_stream_deadline(time.monotonic() - 1.0):
+            return await aux._aggregate_chat_stream_async(
+                stream, model="m", total_ceiling=2400.0
+            )
+
+    with pytest.raises(TimeoutError):
+        asyncio.run(_run())
+    assert stream.yielded == 1
+
+
+# ── The isolated provider daemon must inherit it ─────────────────────────
+
+
+def test_protected_provider_daemon_inherits_the_host_deadline():
+    """``_run_protected_sync_provider_call`` runs the stream on ANOTHER thread.
+
+    Thread-locals do not cross that boundary, so without explicit propagation
+    the fix would be inert on exactly the path large-session compression takes
+    (protected + hard-cancel source installed).
+    """
+    seen: dict[str, object] = {}
+
+    def _callback(_kwargs):
+        seen["deadline"] = aux._current_aux_stream_deadline()
+        seen["thread"] = threading.current_thread().name
+        return "ok"
+
+    deadline = time.monotonic() + 42.0
+    cancel_event = threading.Event()
+    with aux.aux_progress_hook(lambda: None), aux.aux_interrupt_protection(
+        cancel_event=cancel_event
+    ), aux.aux_stream_deadline(deadline):
+        assert aux._run_protected_sync_provider_call(_callback, {}) == "ok"
+
+    assert seen["thread"] == "hermes-protected-aux-provider"
+    assert seen["deadline"] == deadline
+
+
+# ── The compression worker must actually install it ──────────────────────
+
+
+def _summary_dispatch_source() -> str:
+    from agent import conversation_compression
+
+    path = Path(inspect.getsourcefile(conversation_compression))
+    return path.read_text(encoding="utf-8")
+
+
+def test_compression_summary_dispatch_installs_the_fence_deadline():
+    """Source guard: the wiring is one line and trivially droppable.
+
+    A behavioural test would have to drive the whole ``compress_context`` body
+    (durable lock, watermark, telemetry, commit). This asserts the seam itself:
+    the same ``with`` statement that installs the progress hook must also
+    install the stream deadline.
+    """
+    tree = ast.parse(_summary_dispatch_source())
+    wired = False
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.With):
+            continue
+        names = set()
+        for item in node.items:
+            call = item.context_expr
+            if isinstance(call, ast.Call) and isinstance(call.func, ast.Name):
+                names.add(call.func.id)
+        if "aux_progress_hook" in names:
+            assert "aux_stream_deadline" in names, (
+                "the summary dispatch scope installs the progress hook but not "
+                "the host stream deadline — #99692 would regress"
+            )
+            wired = True
+    assert wired, "summary dispatch scope not found"
diff --git a/tests/agent/test_aux_stream_host_deadline_sibling_wires.py b/tests/agent/test_aux_stream_host_deadline_sibling_wires.py
new file mode 100644
index 0000000000..250b5ac132
--- /dev/null
+++ b/tests/agent/test_aux_stream_host_deadline_sibling_wires.py
@@ -0,0 +1,189 @@
+"""#99692 sibling wires — the host compression deadline must stop EVERY aux
+stream consumer, not only the chat.completions accumulator.
+
+``aux_stream_deadline`` (salvaged from PR #99779 by @JoaoMarcos44) publishes
+the ``CompressionCommitFence`` ceiling to the streamed chat.completions path.
+Two other auxiliary wires consume their streams internally and were left with
+their own, always-larger budgets:
+
+* the Codex Responses adapter (``_CodexCompletionsAdapter.create``) — its
+  re-armable watchdog only knew ``_aux_stream_total_ceiling`` (>= 600s);
+* the Anthropic Messages adapter — its ``on_stream_event`` hook only ticked
+  progress and never stopped the stream at all (nor honoured a hard cancel).
+
+Both now stop at the host's absolute deadline, so an abandoned summary is not
+billed to completion on a socket nobody is waiting for.
+"""
+
+from __future__ import annotations
+
+import time
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from agent import auxiliary_client as aux
+from agent.anthropic_adapter import create_anthropic_message
+
+
+# ── Codex Responses wire ─────────────────────────────────────────────────
+
+
+def _codex_content_event(text="tok"):
+    return SimpleNamespace(type="response.output_text.delta", delta=text)
+
+
+def _consume_codex(stream, *, model, on_event):
+    del model
+    for event in stream:
+        on_event(event)
+    return SimpleNamespace(
+        output=[SimpleNamespace(
+            type="message",
+            content=[SimpleNamespace(type="output_text", text="summary")],
+        )],
+        usage=None,
+    )
+
+
+def _make_codex_adapter(event_iter):
+    real_client = SimpleNamespace(
+        base_url="https://chatgpt.com/backend-api/codex",
+        responses=SimpleNamespace(create=lambda **_kwargs: event_iter),
+        close=lambda: None,
+    )
+    return aux._CodexCompletionsAdapter(real_client, "gpt-5.6-sol")
+
+
+def test_codex_stream_stops_at_the_host_deadline_not_its_own_ceiling():
+    """A live (re-arming) Codex stream must die at the host's deadline even
+    though its own hard ceiling is >= 600s and every token re-arms the
+    no-progress window."""
+    yielded = [0]
+
+    def _live_forever():
+        while True:
+            time.sleep(0.02)
+            yielded[0] += 1
+            yield _codex_content_event()
+
+    adapter = _make_codex_adapter(_live_forever())
+    start = time.monotonic()
+    with (
+        patch("agent.codex_runtime._consume_codex_event_stream", _consume_codex),
+        aux.aux_stream_deadline(time.monotonic() + 0.4),
+        pytest.raises(TimeoutError, match="hard ceiling"),
+    ):
+        adapter.create(
+            messages=[{"role": "user", "content": "summarize"}],
+            timeout=300,
+        )
+    elapsed = time.monotonic() - start
+    assert elapsed < 5.0, f"stream outlived the host deadline by {elapsed:.1f}s"
+    assert yielded[0] < 100
+
+
+def test_codex_stream_without_host_deadline_keeps_its_ceiling():
+    def _short():
+        for _ in range(3):
+            yield _codex_content_event()
+
+    adapter = _make_codex_adapter(_short())
+    with patch("agent.codex_runtime._consume_codex_event_stream", _consume_codex):
+        response = adapter.create(
+            messages=[{"role": "user", "content": "summarize"}], timeout=300,
+        )
+    assert response.choices[0].message.content == "summary"
+
+
+# ── Anthropic Messages wire ──────────────────────────────────────────────
+
+
+class _AnthropicStream:
+    def __init__(self, count=10_000, delay=0.01):
+        self._count, self._delay = count, delay
+        self.yielded = 0
+        self.exited = False
+        self.response = None
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        self.exited = True
+        return False
+
+    def __iter__(self):
+        for _ in range(self._count):
+            time.sleep(self._delay)
+            self.yielded += 1
+            yield SimpleNamespace(
+                type="content_block_delta", delta=SimpleNamespace(text="tok"),
+            )
+
+    def get_final_message(self):
+        return SimpleNamespace(content=[SimpleNamespace(type="text", text="summary")])
+
+
+def _anthropic_client(stream):
+    return SimpleNamespace(
+        messages=SimpleNamespace(
+            stream=lambda **_kw: stream,
+            create=lambda **_kw: pytest.fail("must not fall back to create()"),
+        )
+    )
+
+
+def test_anthropic_stream_stops_at_the_host_deadline():
+    stream = _AnthropicStream()
+    ticks = []
+    with (
+        aux.aux_progress_hook(lambda: ticks.append(1)),
+        aux.aux_stream_deadline(time.monotonic() + 0.3),
+    ):
+        hook = aux._anthropic_aux_stream_event_hook()
+        start = time.monotonic()
+        with pytest.raises(TimeoutError, match="timed out at the host compression deadline"):
+            create_anthropic_message(
+                _anthropic_client(stream), {"model": "m", "messages": []},
+                on_stream_event=hook,
+            )
+    assert time.monotonic() - start < 5.0
+    assert stream.exited, "stream context must be closed on the deadline"
+    assert ticks, "substantive deltas must still tick the progress hook"
+    assert stream.yielded < 1000
+
+
+def test_anthropic_stream_honours_an_explicit_hard_cancel():
+    stream = _AnthropicStream()
+    cancelled = {"v": False}
+    with (
+        aux.aux_progress_hook(lambda: None),
+        aux.aux_interrupt_protection(cancel_check=lambda: cancelled["v"]),
+    ):
+        hook = aux._anthropic_aux_stream_event_hook()
+
+        def _flip_after_first(event, _inner=hook):
+            cancelled["v"] = True
+            _inner(event)
+
+        with pytest.raises(aux.AuxiliaryExplicitCancellation):
+            create_anthropic_message(
+                _anthropic_client(stream), {"model": "m", "messages": []},
+                on_stream_event=_flip_after_first,
+            )
+    assert stream.yielded == 1
+    assert stream.exited
+
+
+def test_anthropic_stream_without_host_deadline_runs_to_completion():
+    stream = _AnthropicStream(count=5, delay=0)
+    with aux.aux_progress_hook(lambda: None):
+        hook = aux._anthropic_aux_stream_event_hook()
+        message = create_anthropic_message(
+            _anthropic_client(stream), {"model": "m", "messages": []},
+            on_stream_event=hook,
+        )
+    assert message.content[0].text == "summary"
+    assert stream.yielded == 5
diff --git a/tests/agent/test_codex_happy_eyeballs.py b/tests/agent/test_codex_happy_eyeballs.py
index 48e0bbe38f..91804555af 100644
--- a/tests/agent/test_codex_happy_eyeballs.py
+++ b/tests/agent/test_codex_happy_eyeballs.py
@@ -146,3 +146,180 @@ def test_connection_staggers_past_blackholed_ipv6(monkeypatch):
     assert clock[0] == process_bootstrap._HAPPY_EYEBALLS_DELAY_SECONDS
     assert sockets[0].closed is True
     assert sockets[1].closed is False
+
+
+def test_async_codex_client_relies_on_native_anyio_racing(no_proxy_env):
+    """The async transport needs no custom backend — anyio races natively.
+
+    httpcore's ``AnyIOBackend.connect_tcp`` delegates to
+    ``anyio.connect_tcp``, whose ``happy_eyeballs_delay`` default (0.25s)
+    implements RFC 8305 staggered family racing. This pins the contract the
+    ``async_mode`` branch of ``build_keepalive_http_client`` documents: if
+    anyio ever drops the parameter (or the default stops racing), this fails
+    and the async path needs an explicit backend like the sync one.
+    """
+    import inspect
+
+    import anyio
+
+    params = inspect.signature(anyio.connect_tcp).parameters
+    assert "happy_eyeballs_delay" in params
+    assert params["happy_eyeballs_delay"].default == pytest.approx(0.25)
+
+    client = process_bootstrap.build_keepalive_http_client(
+        "https://chatgpt.com/backend-api/codex", async_mode=True
+    )
+    try:
+        assert all(
+            not isinstance(backend, process_bootstrap._HappyEyeballsSyncBackend)
+            for backend in _client_backends(client)
+        )
+    finally:
+        import asyncio
+
+        asyncio.get_event_loop_policy().new_event_loop().run_until_complete(
+            client.aclose()
+        )
+
+
+def test_async_connect_races_past_blackholed_ipv6(monkeypatch):
+    """IPv4 completes ~250ms after a hanging IPv6 attempt on the async path.
+
+    Mirrors ``test_connection_staggers_past_blackholed_ipv6`` for the async
+    transport: resolve a fake host to a blackholed IPv6 address plus a live
+    local IPv4 listener and assert httpcore's async backend connects fast
+    instead of serially waiting out the IPv6 connect timeout.
+    """
+    import asyncio
+    import threading
+    import time as _time
+
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server.bind(("127.0.0.1", 0))
+    server.listen(5)
+    port = server.getsockname()[1]
+
+    def _accept_loop():
+        while True:
+            try:
+                conn, _ = server.accept()
+                conn.close()
+            except OSError:
+                return
+
+    thread = threading.Thread(target=_accept_loop, daemon=True)
+    thread.start()
+
+    real_getaddrinfo = socket.getaddrinfo
+
+    def fake_getaddrinfo(host, *args, **kwargs):
+        name = host.decode() if isinstance(host, (bytes, bytearray)) else str(host)
+        if name == "codex-he-async.test":
+            return [
+                (
+                    socket.AF_INET6,
+                    socket.SOCK_STREAM,
+                    socket.IPPROTO_TCP,
+                    "",
+                    ("100::1", port, 0, 0),  # RFC 6666 discard prefix: blackhole
+                ),
+                (
+                    socket.AF_INET,
+                    socket.SOCK_STREAM,
+                    socket.IPPROTO_TCP,
+                    "",
+                    ("127.0.0.1", port),
+                ),
+            ]
+        return real_getaddrinfo(host, *args, **kwargs)
+
+    monkeypatch.setattr(socket, "getaddrinfo", fake_getaddrinfo)
+
+    async def _connect():
+        from httpcore._backends.auto import AutoBackend
+
+        backend = AutoBackend()
+        start = _time.monotonic()
+        stream = await backend.connect_tcp(
+            "codex-he-async.test", port, timeout=30.0
+        )
+        elapsed = _time.monotonic() - start
+        await stream.aclose()
+        return elapsed
+
+    try:
+        elapsed = asyncio.run(_connect())
+    finally:
+        server.close()
+
+    # Native anyio racing: IPv6 is attempted first, IPv4 starts 0.25s later
+    # and wins immediately. Serial behavior would block until the IPv6
+    # connect timeout (tens of seconds). Generous bound for slow CI hosts.
+    assert elapsed < 5.0
+
+
+class _RecordingPool:
+    def __init__(self):
+        self._network_backend = "default"
+
+
+class _RecordingTransport:
+    def __init__(self):
+        self._pool = _RecordingPool()
+
+
+def test_enable_happy_eyeballs_on_client_covers_transport_and_mounts():
+    class _Client:
+        pass
+
+    client = _Client()
+    client._transport = _RecordingTransport()
+    client._mounts = {"https://": _RecordingTransport(), "http://": None}
+
+    process_bootstrap.enable_happy_eyeballs_on_client(client)
+
+    assert isinstance(
+        client._transport._pool._network_backend,
+        process_bootstrap._HappyEyeballsSyncBackend,
+    )
+    assert isinstance(
+        client._mounts["https://"]._pool._network_backend,
+        process_bootstrap._HappyEyeballsSyncBackend,
+    )
+
+
+def test_enable_happy_eyeballs_on_client_skips_proxy_pools(no_proxy_env):
+    import httpcore
+    import httpx
+
+    client = httpx.Client(proxy="http://127.0.0.1:3128")
+    try:
+        process_bootstrap.enable_happy_eyeballs_on_client(client)
+        proxy_pools = [
+            transport._pool
+            for transport in client._mounts.values()
+            if transport is not None
+            and isinstance(getattr(transport, "_pool", None), httpcore.HTTPProxy)
+        ]
+        assert proxy_pools  # the all:// mount is proxy-backed
+        assert all(
+            not isinstance(
+                pool._network_backend, process_bootstrap._HappyEyeballsSyncBackend
+            )
+            for pool in proxy_pools
+        )
+    finally:
+        client.close()
+
+
+def test_codex_auth_http_client_uses_happy_eyeballs_backend(no_proxy_env):
+    from hermes_cli.auth import _codex_http_client
+
+    client = _codex_http_client(timeout=5.0)
+    try:
+        assert any(
+            isinstance(backend, process_bootstrap._HappyEyeballsSyncBackend)
+            for backend in _client_backends(client)
+        )
+    finally:
+        client.close()
diff --git a/tests/agent/test_codex_ttfb_watchdog.py b/tests/agent/test_codex_ttfb_watchdog.py
index 66208a8e1a..bdf53061f3 100644
--- a/tests/agent/test_codex_ttfb_watchdog.py
+++ b/tests/agent/test_codex_ttfb_watchdog.py
@@ -108,6 +108,89 @@ def test_ttfb_includes_silent_hang_hint_for_gpt_5_5(tmp_path, monkeypatch):
         stop["flag"] = True
 
 
+def test_ttfb_installs_and_retires_the_codex_request_token(tmp_path, monkeypatch):
+    """The watchdog must publish a per-request token and clear it on the kill.
+
+    ``run_codex_stream`` reads ``agent._active_codex_stream_request_token`` to
+    tell whether it is still the owning attempt. Without an install here the
+    whole retirement guard would be inert, and without the clear on kill a
+    retired worker would keep normalizing partial deltas into a "completed"
+    response.
+
+    The worker also unwinds with its own local error after the force-close;
+    that error must not replace the watchdog's retryable ``TimeoutError``.
+    """
+    from agent import chat_completion_helpers as h
+
+    agent = _make_codex_agent(tmp_path, monkeypatch)
+    monkeypatch.setenv("HERMES_CODEX_TTFB_TIMEOUT_SECONDS", "1")
+
+    closes: list = []
+    seen = {"token_while_running": None}
+    dummy_client = SimpleNamespace()
+    monkeypatch.setattr(agent, "_create_request_openai_client", lambda **k: dummy_client)
+    monkeypatch.setattr(
+        agent,
+        "_abort_request_openai_client",
+        lambda c, reason=None: closes.append(reason),
+    )
+    monkeypatch.setattr(
+        agent,
+        "_close_request_openai_client",
+        lambda c, reason=None: closes.append(reason),
+    )
+
+    def fake_stream(api_kwargs, client=None, on_first_delta=None):
+        seen["token_while_running"] = getattr(
+            agent, "_active_codex_stream_request_token", None
+        )
+        deadline = time.time() + 30
+        while time.time() < deadline:
+            if getattr(agent, "_active_codex_stream_request_token", None) is None:
+                # Retired by the watchdog — mimic the transport unwinding.
+                raise RuntimeError("retired worker stream ended without terminal")
+            time.sleep(0.02)
+        raise RuntimeError("test timed out waiting for retirement")
+
+    monkeypatch.setattr(agent, "_run_codex_stream", fake_stream)
+
+    with pytest.raises(TimeoutError) as excinfo:
+        h.interruptible_api_call(agent, {"model": "gpt-5.5", "input": "hi"})
+
+    assert seen["token_while_running"] is not None, (
+        "interruptible_api_call must install a request token before the worker runs"
+    )
+    assert "TTFB" in str(excinfo.value)
+    assert "retired worker" not in str(excinfo.value)
+    assert "codex_ttfb_kill" in closes
+    assert getattr(agent, "_active_codex_stream_request_token", None) is None
+
+
+def test_non_codex_api_mode_installs_no_request_token(tmp_path, monkeypatch):
+    """The token is codex_responses-only — other api_modes stay untouched."""
+    from agent import chat_completion_helpers as h
+
+    agent = _make_codex_agent(tmp_path, monkeypatch)
+    agent.api_mode = "chat_completions"
+
+    seen = {"token": "unset"}
+    dummy_client = SimpleNamespace()
+    monkeypatch.setattr(agent, "_create_request_openai_client", lambda **k: dummy_client)
+
+    def fake_dispatch(_agent, _api_kwargs, *, make_client):
+        make_client("test")
+        seen["token"] = getattr(
+            _agent, "_active_codex_stream_request_token", "absent"
+        )
+        return SimpleNamespace(choices=[])
+
+    monkeypatch.setattr(h, "_dispatch_nonstreaming_api_request", fake_dispatch)
+
+    h.interruptible_api_call(agent, {"model": "gpt-5.5", "messages": []})
+
+    assert seen["token"] in (None, "absent")
+
+
 
 
 def test_ttfb_does_not_kill_when_events_flow(tmp_path, monkeypatch):
diff --git a/tests/agent/test_compression_anti_thrash_recovery.py b/tests/agent/test_compression_anti_thrash_recovery.py
index 109f23c18e..cf245ac9a5 100644
--- a/tests/agent/test_compression_anti_thrash_recovery.py
+++ b/tests/agent/test_compression_anti_thrash_recovery.py
@@ -17,10 +17,13 @@ The recovery contract pinned here:
   next recovery waits a FULL fresh window (no immediate re-probe loop).
 * An effective probe (or any fitting real-usage reading) fully clears the
   counters through the existing ``update_from_response`` path.
-* The recovery clock is armed lazily on the first blocked evaluation and is
-  NOT durable: a process restart that loads a durable tripped counter
-  (#69872) starts a full fresh window blocked — a restart must never disarm
-  or shorten the guard (#54923).
+* The recovery clock is armed lazily on the first blocked evaluation and
+  persisted on the session row as a wall-clock deadline (#100185): a fresh
+  compressor that loads a durable tripped counter (#69872) with NO stored
+  deadline starts a full window blocked — a restart must never disarm or
+  shorten the guard (#54923) — while one that loads an armed deadline
+  resumes that window instead of restarting it, so gateway agent rebuilds
+  cannot block a session forever.
 * The protection itself is preserved: inside the window the gate stays
   blocked exactly as before.
 """
@@ -57,10 +60,10 @@ class TestRecoveryWindow:
         cc = _compressor()
         _trip(cc)
         base = 1000.0
-        with patch("agent.context_compressor.time.monotonic", return_value=base):
+        with patch("agent.context_compressor.time.time", return_value=base):
             assert cc.should_compress(cc.threshold_tokens + 1) is False
         with patch(
-            "agent.context_compressor.time.monotonic",
+            "agent.context_compressor.time.time",
             return_value=base + cc._ANTI_THRASH_RECOVERY_SECONDS + 1,
         ):
             assert cc.should_compress(cc.threshold_tokens + 1) is True
@@ -73,10 +76,10 @@ class TestRecoveryWindow:
         cc = _compressor()
         cc._fallback_compression_streak = 2
         base = 1000.0
-        with patch("agent.context_compressor.time.monotonic", return_value=base):
+        with patch("agent.context_compressor.time.time", return_value=base):
             assert cc.should_compress(cc.threshold_tokens + 1) is False
         with patch(
-            "agent.context_compressor.time.monotonic",
+            "agent.context_compressor.time.time",
             return_value=base + cc._ANTI_THRASH_RECOVERY_SECONDS + 1,
         ):
             assert cc.should_compress(cc.threshold_tokens + 1) is True
@@ -95,13 +98,13 @@ class TestRestartSemantics:
         cc = _compressor()
         cc.bind_session_state(session_db=db, session_id="sess-1")
         assert cc._ineffective_compression_count == 2
-        # The recovery clock is process-local and must come up disarmed.
+        # No stored deadline yet -> the clock comes up disarmed.
         assert cc._anti_thrash_recovery_deadline == 0.0
         base = 5000.0
-        with patch("agent.context_compressor.time.monotonic", return_value=base):
+        with patch("agent.context_compressor.time.time", return_value=base):
             assert cc.should_compress(cc.threshold_tokens + 1) is False
         with patch(
-            "agent.context_compressor.time.monotonic",
+            "agent.context_compressor.time.time",
             return_value=base + cc._ANTI_THRASH_RECOVERY_SECONDS + 1,
         ):
             assert cc.should_compress(cc.threshold_tokens + 1) is True
@@ -113,9 +116,92 @@ class TestRestartSemantics:
         cc = _compressor()
         _trip(cc)
         base = 1000.0
-        with patch("agent.context_compressor.time.monotonic", return_value=base):
+        with patch("agent.context_compressor.time.time", return_value=base):
             assert cc.should_compress(cc.threshold_tokens + 1) is False
         assert cc._anti_thrash_recovery_deadline > 0.0
         cc.on_session_reset()
         assert cc._anti_thrash_recovery_deadline == 0.0
         assert cc._ineffective_compression_count == 0
+
+
+class TestDurableDeadline:
+    """#100185: the gateway rebuilds the compressor on every cache eviction."""
+
+    def _bound(self, db, session_id="sess-1"):
+        cc = _compressor()
+        cc.bind_session_state(session_db=db, session_id=session_id)
+        return cc
+
+    def test_fresh_compressors_resume_the_same_window(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        db.create_session(session_id="sess-1", source="telegram")
+        db.set_compression_ineffective_count("sess-1", 2)
+        base = 5000.0
+        first = self._bound(db)
+        with patch("agent.context_compressor.time.time", return_value=base):
+            assert first.should_compress(first.threshold_tokens + 1) is False
+        # Deadline is durable, as a wall-clock epoch.
+        assert db.get_compression_recovery_deadline("sess-1") == (
+            base + first._ANTI_THRASH_RECOVERY_SECONDS
+        )
+        # Fresh compressor (gateway rebuilt the agent) well past the window:
+        # before the fix it re-armed a new window and stayed blocked forever.
+        second = self._bound(db)
+        assert second._anti_thrash_recovery_deadline == (
+            base + first._ANTI_THRASH_RECOVERY_SECONDS
+        )
+        with patch(
+            "agent.context_compressor.time.time",
+            return_value=base + first._ANTI_THRASH_RECOVERY_SECONDS + 1,
+        ):
+            assert second.should_compress(second.threshold_tokens + 1) is True
+        assert db.get_compression_ineffective_count("sess-1") == 1
+        assert db.get_compression_recovery_deadline("sess-1") == 0.0
+
+    def test_fresh_compressor_inside_window_stays_blocked(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        db.create_session(session_id="sess-1", source="telegram")
+        db.set_compression_ineffective_count("sess-1", 2)
+        base = 5000.0
+        first = self._bound(db)
+        with patch("agent.context_compressor.time.time", return_value=base):
+            assert first.should_compress(first.threshold_tokens + 1) is False
+        second = self._bound(db)
+        with patch("agent.context_compressor.time.time", return_value=base + 10):
+            assert second.should_compress(second.threshold_tokens + 1) is False
+        assert db.get_compression_ineffective_count("sess-1") == 2
+
+    def test_backward_clock_jump_is_bounded_to_one_window(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        db.create_session(session_id="sess-1", source="telegram")
+        db.set_compression_ineffective_count("sess-1", 2)
+        window = ContextCompressor._ANTI_THRASH_RECOVERY_SECONDS
+        db.set_compression_recovery_deadline("sess-1", 1_000_000.0)
+        cc = self._bound(db)
+        # Wall clock now far BEFORE the stored deadline (clock stepped back).
+        with patch("agent.context_compressor.time.time", return_value=100.0):
+            assert cc.should_compress(cc.threshold_tokens + 1) is False
+        assert db.get_compression_recovery_deadline("sess-1") == 100.0 + window
+
+    def test_clearing_the_guard_disarms_the_durable_deadline(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        db.create_session(session_id="sess-1", source="telegram")
+        db.set_compression_ineffective_count("sess-1", 2)
+        cc = self._bound(db)
+        with patch("agent.context_compressor.time.time", return_value=5000.0):
+            assert cc.should_compress(cc.threshold_tokens + 1) is False
+        assert db.get_compression_recovery_deadline("sess-1") > 0.0
+        cc._record_ineffective_compression_verdict(0)
+        with patch("agent.context_compressor.time.time", return_value=5001.0):
+            assert cc.should_compress(cc.threshold_tokens + 1) is True
+        assert db.get_compression_recovery_deadline("sess-1") == 0.0
+
+    def test_session_db_round_trip(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        db.create_session(session_id="sess-1", source="cli")
+        assert db.get_compression_recovery_deadline("sess-1") == 0.0
+        db.set_compression_recovery_deadline("sess-1", 1234.5)
+        assert db.get_compression_recovery_deadline("sess-1") == 1234.5
+        db.set_compression_recovery_deadline("sess-1", 0.0)
+        assert db.get_compression_recovery_deadline("sess-1") == 0.0
+        assert db.get_compression_recovery_deadline("missing") == 0.0
diff --git a/tests/agent/test_compression_attempt_lifecycle.py b/tests/agent/test_compression_attempt_lifecycle.py
index d7cf68be4f..84879151fb 100644
--- a/tests/agent/test_compression_attempt_lifecycle.py
+++ b/tests/agent/test_compression_attempt_lifecycle.py
@@ -287,3 +287,73 @@ class TestTransientBlockIsNotExhaustion:
         mock_agent = MagicMock()
         # MagicMock auto-attributes are truthy but not str.
         assert compression_blocked_transiently(mock_agent) is False
+
+
+def _summary_response(content: str):
+    from unittest.mock import MagicMock
+
+    response = MagicMock()
+    response.choices = [MagicMock()]
+    response.choices[0].message.content = content
+    return response
+
+
+class TestProviderOverflowBypassesCooldown:
+    """#100661: a provider-proven overflow must get one REAL summary attempt
+    while the summary-failure cooldown is armed. Before the fix every turn of
+    a wedged session hit the cooldown gate, returned the soft "temporarily
+    paused" deferral, and the next failure extended the ladder — 4 long
+    sessions were lost this way. Ordinary (non-overflow) automatic passes
+    must still defer."""
+
+    def _armed_agent(self, tmp_path: Path, session_id: str):
+        db, agent = _build_agent(tmp_path, session_id)
+        # Realistic arming: a failed/stalled attempt recorded the ladder.
+        agent.context_compressor.record_timeout_failure(
+            "stall", failure_kind="stalled"
+        )
+        assert agent.context_compressor.should_compress_info(500_000)[0] is False
+        return db, agent
+
+    def test_overflow_attempt_invokes_summarizer_while_cooldown_armed(
+        self, tmp_path: Path
+    ):
+        db, agent = self._armed_agent(tmp_path, "OVERFLOW_BYPASS")
+        calls = []
+
+        def fake_call_llm(**kwargs):
+            calls.append(kwargs)
+            return _summary_response("## Goal\nRecovered after overflow.")
+
+        # Bulky turns so the compacted transcript is genuinely smaller.
+        live = [
+            {"role": "user" if i % 2 == 0 else "assistant", "content": f"m{i} " * 400}
+            for i in range(20)
+        ]
+        with patch("agent.context_compressor.call_llm", fake_call_llm):
+            out, _ = compress_context(
+                agent, live, "sys", approx_tokens=500_000, bypass_cooldown=True
+            )
+        assert len(calls) == 1, (
+            "provider-proven overflow must reach the summary LLM even while "
+            "the failure cooldown is armed (#100661)"
+        )
+        assert compression_blocked_transiently(agent) is False
+        assert len(out) < len(live), "the attempt must actually compact"
+
+    def test_non_overflow_pass_still_deferred_by_cooldown(self, tmp_path: Path):
+        db, agent = self._armed_agent(tmp_path, "OVERFLOW_ORDINARY")
+        calls = []
+
+        def fake_call_llm(**kwargs):  # pragma: no cover - must not run
+            calls.append(kwargs)
+            return _summary_response("unexpected")
+
+        live = _messages()
+        before = copy.deepcopy(live)
+        with patch("agent.context_compressor.call_llm", fake_call_llm):
+            out, _ = compress_context(agent, live, "sys", approx_tokens=500_000)
+        assert calls == [] and out == before
+        assert compression_blocked_transiently(agent) is True, (
+            "ordinary threshold pressure keeps honoring the cooldown (#11529)"
+        )
diff --git a/tests/agent/test_compression_busy_steer_anchor.py b/tests/agent/test_compression_busy_steer_anchor.py
new file mode 100644
index 0000000000..3aed06bece
--- /dev/null
+++ b/tests/agent/test_compression_busy_steer_anchor.py
@@ -0,0 +1,146 @@
+"""Regression coverage for busy-steer preservation across compaction (#100053).
+
+With ``display.busy_input_mode: steer`` the follow-up rides inside the latest
+``role=tool`` result (``apply_pending_steer_to_tool_results``), never as a
+``role=user`` row. ``_ensure_compressed_has_user_turn`` must treat that marker
+as live user intent — and must pick whichever intent-bearing row is LAST in
+the original transcript, so an older steer never outranks a newer real user
+request.
+"""
+
+import pytest
+
+from agent.context_compressor import (
+    COMPRESSION_CONTINUATION_USER_CONTENT,
+    SUMMARY_PREFIX,
+)
+from agent.conversation_compression import (
+    _compressed_has_busy_steer,
+    _ensure_compressed_has_user_turn,
+)
+from agent.prompt_builder import STEER_MARKER_OPEN, format_steer_marker
+
+REQUEST_A = "Historical request A: audit the auth module."
+STEER_B = "Steer B: stop, switch to fixing the login bug instead."
+REQUEST_C = "Newer real user request C: now write the release notes."
+
+
+def _tool_turns(start: int, count: int, *, steer_at: int | None = None) -> list[dict]:
+    turns: list[dict] = []
+    for idx in range(start, start + count):
+        turns.append(
+            {
+                "role": "assistant",
+                "content": "Working.",
+                "tool_calls": [
+                    {
+                        "id": f"call-{idx}",
+                        "function": {"name": "terminal", "arguments": "{}"},
+                    }
+                ],
+            }
+        )
+        content = f"tool output {idx}"
+        if steer_at == idx:
+            content += format_steer_marker(STEER_B)
+        turns.append({"role": "tool", "tool_call_id": f"call-{idx}", "content": content})
+    return turns
+
+
+def _summary_row() -> dict:
+    return {"role": "user", "content": f"{SUMMARY_PREFIX}\n\nEarlier work summarized."}
+
+
+def _assert_alternation(messages: list[dict]) -> None:
+    roles = [m.get("role") for m in messages]
+    for left, right in zip(roles, roles[1:]):
+        assert not (left == right == "user"), f"user/user adjacency in {roles}"
+        assert not (left == right == "assistant"), f"assistant/assistant adjacency in {roles}"
+
+
+def _user_rows(messages: list[dict]) -> list[str]:
+    return [str(m.get("content")) for m in messages if m.get("role") == "user"]
+
+
+def test_s1_steer_summarized_away_becomes_anchor_not_historical_request():
+    """S1: the steer lived in a tool row that compaction dropped; the only
+    ``role=user`` row in history is the already-consumed request A. The steer
+    must be restored as the anchor, and A must not be replayed."""
+    original = [{"role": "user", "content": REQUEST_A}] + _tool_turns(0, 6, steer_at=2)
+    compressed = [_summary_row(), *_tool_turns(5, 1)]
+
+    outcome = _ensure_compressed_has_user_turn(original, compressed)
+
+    assert outcome == "inserted"
+    _assert_alternation(compressed)
+    users = _user_rows(compressed)
+    assert STEER_B in users, users
+    assert REQUEST_A not in users, "historical request replayed as new input"
+    assert COMPRESSION_CONTINUATION_USER_CONTENT not in users
+    # Steer text is used exactly once across the whole compressed transcript.
+    assert sum(str(m.get("content")).count(STEER_B) for m in compressed) == 1
+
+
+def test_s2_steer_surviving_in_tail_tool_row_counts_as_present():
+    """S2: the steer-bearing tool row survived into the tail. No anchor may be
+    inserted (the intent is already there) and A must not be cloned."""
+    original = [{"role": "user", "content": REQUEST_A}] + _tool_turns(0, 6, steer_at=5)
+    compressed = [_summary_row(), *_tool_turns(5, 1, steer_at=5)]
+    before = [dict(m) for m in compressed]
+
+    outcome = _ensure_compressed_has_user_turn(original, compressed)
+
+    assert outcome == "already_present"
+    assert compressed == before, "transcript mutated despite live steer present"
+    assert REQUEST_A not in _user_rows(compressed)
+    assert sum(str(m.get("content")).count(STEER_B) for m in compressed) == 1
+
+
+def test_s3_newer_real_user_turn_outranks_older_steer():
+    """S3: ``[user A, tool(steer B), ..., user C]`` — C is the newest intent.
+    A steer-first scan would anchor the consumed steer B and replay it."""
+    original = (
+        [{"role": "user", "content": REQUEST_A}]
+        + _tool_turns(0, 3, steer_at=1)
+        + [{"role": "user", "content": REQUEST_C}]
+        + _tool_turns(3, 4)
+    )
+    compressed = [_summary_row(), *_tool_turns(6, 1)]
+
+    outcome = _ensure_compressed_has_user_turn(original, compressed)
+
+    assert outcome == "inserted"
+    _assert_alternation(compressed)
+    users = _user_rows(compressed)
+    assert REQUEST_C in users, users
+    assert STEER_B not in users, "older consumed steer replayed over newer user turn"
+    assert REQUEST_A not in users
+    assert not any(STEER_B in u for u in users)
+
+
+def test_newer_steer_outranks_older_real_user_turn():
+    """Mirror of S3: ``[user A, ..., tool(steer B)]`` — the steer is newest."""
+    original = [{"role": "user", "content": REQUEST_A}] + _tool_turns(0, 4, steer_at=3)
+    compressed = [_summary_row(), *_tool_turns(4, 1)]
+
+    outcome = _ensure_compressed_has_user_turn(original, compressed)
+
+    assert outcome == "inserted"
+    _assert_alternation(compressed)
+    users = _user_rows(compressed)
+    assert STEER_B in users
+    assert REQUEST_A not in users
+
+
+@pytest.mark.parametrize(
+    "role",
+    ["user", "assistant"],
+)
+def test_compressed_steer_presence_only_counts_tool_rows(role):
+    """A summary or assistant row that merely quotes the marker text is not a
+    live steer delivery — only ``role=tool`` rows carry real steers."""
+    quoted = {"role": role, "content": f"{SUMMARY_PREFIX}\n{format_steer_marker(STEER_B)}"}
+    assert _compressed_has_busy_steer([quoted]) is False
+    assert STEER_MARKER_OPEN in quoted["content"]
+    live = {"role": "tool", "tool_call_id": "c", "content": f"ok{format_steer_marker(STEER_B)}"}
+    assert _compressed_has_busy_steer([live]) is True
diff --git a/tests/agent/test_context_compressor.py b/tests/agent/test_context_compressor.py
index 7e373f209e..10997fe94a 100644
--- a/tests/agent/test_context_compressor.py
+++ b/tests/agent/test_context_compressor.py
@@ -855,6 +855,19 @@ class TestAuthFailureAborts:
         )
         assert _is_summary_access_or_quota_error(err) is True
 
+    def test_unscoped_secret_read_is_terminal_access_failure(self):
+        # Multiplexed gateway: a credential read reached get_secret() from a
+        # worker thread without the profile scope. The summary model is
+        # unreachable until the spawn site is fixed — abort and preserve the
+        # session rather than truncating the middle window (#100849 bundle).
+        from agent.secret_scope import UnscopedSecretError
+
+        err = UnscopedSecretError(
+            "get_secret('SURPLUS_API_KEY') called with no profile secret scope "
+            "active while multiplexing is on."
+        )
+        assert _is_summary_access_or_quota_error(err) is True
+
 
 
 
diff --git a/tests/agent/test_copilot_acp_client.py b/tests/agent/test_copilot_acp_client.py
index 100dca67f4..1b2b08f01a 100644
--- a/tests/agent/test_copilot_acp_client.py
+++ b/tests/agent/test_copilot_acp_client.py
@@ -317,3 +317,107 @@ def test_probe_skipped_for_custom_args_without_acp():
     with _patch("agent.copilot_acp_client.subprocess.run") as run_mock:
         assert _acp_supported("mycli", ["--custom-transport"]) is True
     run_mock.assert_not_called()
+
+
+# --- session/set_model: honor the picker-selected model ----------------------
+#
+# `copilot --acp` validates but IGNORES the `--model` spawn flag; the ACP
+# session runs the CLI's own default unless the client issues the ACP-native
+# `session/set_model` call. Without it, picking gpt-5.6-terra in Hermes
+# visibly answers as the CLI's default model.
+
+
+# --- session model selection -------------------------------------------------
+
+
+def _session_with_config_options():
+    return {
+        "sessionId": "s1",
+        "configOptions": [
+            {
+                "id": "model",
+                "category": "model",
+                "type": "select",
+                "currentValue": "auto",
+                "options": [
+                    {"value": "auto", "name": "Auto"},
+                    {"value": "gpt-5.6-terra", "name": "GPT-5.6 Terra"},
+                    {
+                        "value": "claude-fable-5",
+                        "name": "Claude Fable 5",
+                        "_meta": {"copilotEnablement": "disabled"},
+                    },
+                ],
+            }
+        ],
+    }
+
+
+def test_model_selection_prefers_stable_config_option():
+    from agent.copilot_acp_client import _model_selection_request
+
+    assert _model_selection_request(
+        _session_with_config_options(), "gpt-5.6-terra"
+    ) == (
+        "session/set_config_option",
+        {"sessionId": "s1", "configId": "model", "value": "gpt-5.6-terra"},
+    )
+
+
+def test_model_selection_rejects_disabled_config_option():
+    from agent.copilot_acp_client import _model_selection_request
+
+    assert _model_selection_request(
+        _session_with_config_options(), "claude-fable-5"
+    ) is None
+
+
+def test_model_selection_rejects_unknown_config_option():
+    from agent.copilot_acp_client import _model_selection_request
+
+    assert _model_selection_request(
+        _session_with_config_options(), "not-served-here"
+    ) is None
+
+
+def test_model_selection_falls_back_to_legacy_extension():
+    from agent.copilot_acp_client import _model_selection_request
+
+    legacy_session = {
+        "sessionId": "s1",
+        "models": {
+            "availableModels": [
+                {"modelId": "auto"},
+                {"modelId": "gpt-5.6-terra"},
+            ]
+        },
+    }
+    assert _model_selection_request(legacy_session, "gpt-5.6-terra") == (
+        "session/set_model",
+        {"sessionId": "s1", "modelId": "gpt-5.6-terra"},
+    )
+
+
+def test_model_selection_skips_provider_virtual_slug():
+    from agent.copilot_acp_client import _model_selection_request
+
+    assert _model_selection_request(
+        _session_with_config_options(), "copilot-acp"
+    ) is None
+
+
+def test_run_prompt_receives_picker_model():
+    # _create_chat_completion must forward `model` into _run_prompt — the
+    # original wiring dropped it, reducing the selection to prompt text.
+    client = CopilotACPClient(acp_cwd="/tmp")
+    seen = {}
+
+    def fake_run_prompt(prompt_text, *, timeout_seconds, model=None):
+        seen["model"] = model
+        return "ok", ""
+
+    with patch.object(CopilotACPClient, "_run_prompt", side_effect=fake_run_prompt):
+        client._create_chat_completion(
+            model="gpt-5.6-terra", messages=[{"role": "user", "content": "hi"}]
+        )
+    assert seen["model"] == "gpt-5.6-terra"
diff --git a/tests/agent/test_credential_pool_profile_oauth_fork.py b/tests/agent/test_credential_pool_profile_oauth_fork.py
new file mode 100644
index 0000000000..057db3021d
--- /dev/null
+++ b/tests/agent/test_credential_pool_profile_oauth_fork.py
@@ -0,0 +1,452 @@
+"""Regression tests for #100339: cloned / borrowed single-use Anthropic OAuth
+grants must never fork across profiles.
+
+Real imports, real temp HERMES_HOME root + named profile, real auth.json I/O.
+The Anthropic token endpoint is replaced at the ``urllib.request.urlopen``
+boundary with genuine single-use semantics (a refresh token redeems once;
+a second POST returns ``invalid_grant``).
+"""
+from __future__ import annotations
+
+import io
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+
+@pytest.fixture
+def fleet(tmp_path, monkeypatch):
+    """Root HERMES_HOME with an expired-but-refreshable Anthropic pool row."""
+    root = tmp_path / "hermes-root"
+    root.mkdir()
+    (tmp_path / "fakehome").mkdir()
+    # Keep host ~/.claude and host auth.json out of the picture.
+    monkeypatch.setenv("HOME", str(tmp_path / "fakehome"))
+    monkeypatch.setenv("CLAUDE_CONFIG_DIR", str(tmp_path / "fakehome"))
+    for var in ("ANTHROPIC_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"):
+        monkeypatch.delenv(var, raising=False)
+    monkeypatch.setenv("HERMES_HOME", str(root))
+    # The pytest seat-belt in the root write-through compares the global path
+    # against $HOME/.hermes/auth.json; our root is elsewhere, so writes go.
+    import hermes_constants
+    hermes_constants._default_hermes_root_memo = None  # type: ignore[attr-defined]
+
+    expired = int((time.time() - 3600) * 1000)
+    store = {
+        "version": 1,
+        "providers": {},
+        "credential_pool": {
+            "anthropic": [{
+                "id": "abc123", "label": "team-grant", "auth_type": "oauth",
+                "priority": 0, "source": "manual:hermes_pkce",
+                "access_token": "sk-ant-oat01-AT0", "refresh_token": "sk-ant-ort-RT0",
+                "expires_at_ms": expired, "base_url": "https://api.anthropic.com",
+            }],
+            "openai": [{
+                "id": "key001", "label": "static", "auth_type": "api_key",
+                "priority": 0, "source": "manual", "access_token": "sk-static-key",
+            }],
+        },
+    }
+    (root / "auth.json").write_text(json.dumps(store))
+
+    server = {"valid": {"sk-ant-ort-RT0"}, "spent": set(), "n": 0, "log": []}
+
+    class _Resp(io.BytesIO):
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    def fake_urlopen(req, timeout=None):
+        assert "oauth/token" in req.full_url
+        body = req.data.decode()
+        if req.get_header("Content-type", "").startswith("application/json"):
+            rt = json.loads(body)["refresh_token"]
+        else:
+            from urllib.parse import parse_qsl
+            rt = dict(parse_qsl(body))["refresh_token"]
+        if rt in server["spent"] or rt not in server["valid"]:
+            server["log"].append(("REUSE", rt))
+            raise urllib.error.HTTPError(
+                req.full_url, 400, "Bad Request", {},
+                io.BytesIO(b'{"error":"invalid_grant","error_description":"refresh_token_reused"}'),
+            )
+        server["n"] += 1
+        server["spent"].add(rt)
+        server["valid"].discard(rt)
+        new_rt = f"sk-ant-ort-RT{server['n']}"
+        server["valid"].add(new_rt)
+        server["log"].append(("ROTATE", rt, new_rt))
+        return _Resp(json.dumps({
+            "access_token": f"sk-ant-oat01-AT{server['n']}",
+            "refresh_token": new_rt, "expires_in": 28800, "token_type": "Bearer",
+        }).encode())
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+
+    def use(home):
+        """Switch the process to *home* (root or a profile dir)."""
+        monkeypatch.setenv("HERMES_HOME", str(home))
+        hermes_constants._default_hermes_root_memo = None  # type: ignore[attr-defined]
+        import hermes_cli.auth as auth_mod
+        auth_mod._global_auth_store_cache = None
+        auth_mod._oauth_heal_clean_marks.clear()
+
+    # Process-wide notice buffer: start each test clean.
+    import hermes_cli.auth as _auth_mod
+    _auth_mod._oauth_heal_notices.clear()
+    _auth_mod._oauth_heal_clean_marks.clear()
+
+    def pool_rows(home):
+        p = home / "auth.json"
+        if not p.exists():
+            return None
+        return (json.loads(p.read_text()).get("credential_pool") or {}).get("anthropic")
+
+    return {"root": root, "server": server, "use": use, "rows": pool_rows}
+
+
+def _profile(fleet, name, **kw):
+    from hermes_cli.profiles import create_profile
+    fleet["use"](fleet["root"])
+    return create_profile(name, **kw)
+
+
+# ── A. cloning never copies single-use OAuth grants ──────────────────────
+
+def test_clone_all_strips_oauth_grant_but_keeps_api_keys(fleet):
+    (fleet["root"] / ".anthropic_oauth.json").write_text(
+        json.dumps({"accessToken": "sk-ant-oat01-AT0", "refreshToken": "sk-ant-ort-RT0", "expiresAt": 1})
+    )
+    pdir = _profile(fleet, "forge", clone_all=True)
+    store = json.loads((pdir / "auth.json").read_text())
+    assert "anthropic" not in store["credential_pool"], "OAuth grant was forked into the clone"
+    assert store["credential_pool"]["openai"][0]["access_token"] == "sk-static-key"
+    assert not (pdir / ".anthropic_oauth.json").exists()
+
+
+def test_strip_helper_drops_device_code_blocks_and_reports(tmp_path):
+    from hermes_cli.auth import strip_cloned_single_use_oauth_grants
+    pdir = tmp_path / "p"
+    pdir.mkdir()
+    (pdir / "auth.json").write_text(json.dumps({
+        "version": 1,
+        "providers": {"openai-codex": {"access_token": "a", "refresh_token": "r"}, "nous": {"agent_key": "k"}},
+        "credential_pool": {
+            "xai-oauth": [{"id": "x", "auth_type": "oauth", "access_token": "t", "refresh_token": "r"}],
+            "anthropic": [
+                {"id": "legacy", "access_token": "sk-ant-oat01-legacy"},  # no auth_type field
+                {"id": "key", "auth_type": "api_key", "access_token": "sk-ant-api03-x"},
+            ],
+        },
+    }))
+    summary = strip_cloned_single_use_oauth_grants(pdir)
+    store = json.loads((pdir / "auth.json").read_text())
+    assert sorted(summary["pool"]) == ["anthropic", "xai-oauth"]
+    assert summary["providers"] == ["openai-codex"]
+    assert "xai-oauth" not in store["credential_pool"]
+    assert [e["id"] for e in store["credential_pool"]["anthropic"]] == ["key"]
+    assert "openai-codex" not in store["providers"] and "nous" in store["providers"]
+
+
+def test_strip_helper_is_a_noop_without_credentials(tmp_path):
+    from hermes_cli.auth import strip_cloned_single_use_oauth_grants
+    assert strip_cloned_single_use_oauth_grants(tmp_path) == {"pool": [], "providers": [], "files": []}
+
+
+# ── B. borrowed rotation commits to root, never a profile copy ───────────
+
+def test_first_profile_rotation_does_not_strand_root_or_siblings(fleet):
+    from agent.credential_pool import load_pool
+
+    forge = _profile(fleet, "forge")
+    atlas = _profile(fleet, "atlas")
+
+    fleet["use"](forge)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
+    # The rotated pair landed in ROOT; forge did not grow a local copy.
+    assert fleet["rows"](forge) is None
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT1"
+
+    for home in (atlas, fleet["root"], forge):
+        fleet["use"](home)
+        sel = load_pool("anthropic").select()
+        assert sel is not None and sel.access_token == "sk-ant-oat01-AT1", home
+    assert [e[0] for e in fleet["server"]["log"]] == ["ROTATE"], fleet["server"]["log"]
+    assert fleet["rows"](atlas) is None and fleet["rows"](forge) is None
+
+
+def test_agent_init_resolver_sees_sibling_rotation(fleet):
+    from agent.anthropic_credentials import resolve_anthropic_token
+    from agent.credential_pool import load_pool
+
+    forge = _profile(fleet, "forge")
+    atlas = _profile(fleet, "atlas")
+    fleet["use"](forge)
+    load_pool("anthropic").select()
+    fleet["use"](atlas)
+    assert resolve_anthropic_token() == "sk-ant-oat01-AT1"
+
+
+def test_borrowing_profile_load_pool_does_not_materialize_local_copy(fleet):
+    from agent.credential_pool import load_pool
+
+    fresh = _profile(fleet, "fresh")
+    fleet["use"](fresh)
+    pool = load_pool("anthropic")
+    assert [e.id for e in pool.entries()] == ["abc123"]
+    assert pool._borrowed_root_ids == {"abc123"}
+    assert fleet["rows"](fresh) is None
+
+
+def test_borrower_prune_never_deletes_root_singleton_grant(fleet, tmp_path):
+    """Root's hermes_pkce row is seeded from ROOT's .anthropic_oauth.json; a
+    profile without that file must not prune (and write-through-delete) it."""
+    from agent.credential_pool import load_pool
+
+    root = fleet["root"]
+    (root / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT0", "refreshToken": "sk-ant-ort-RT0",
+        "expiresAt": int((time.time() - 3600) * 1000),
+    }))
+    store = json.loads((root / "auth.json").read_text())
+    store["active_provider"] = "anthropic"
+    del store["credential_pool"]["anthropic"]
+    (root / "auth.json").write_text(json.dumps(store))
+    fleet["use"](root)
+    root_rows = [e for e in load_pool("anthropic").entries()]
+    assert [e.source for e in root_rows] == ["hermes_pkce"]
+
+    kid = _profile(fleet, "kid")
+    fleet["use"](kid)
+    pool = load_pool("anthropic")
+    assert [e.source for e in pool.entries()] == ["hermes_pkce"], "borrowed root grant was pruned"
+    assert fleet["rows"](root) and fleet["rows"](root)[0]["source"] == "hermes_pkce"
+    assert fleet["rows"](kid) is None
+
+    # Rotating from the profile commits BOTH the pool row and the singleton at ROOT.
+    sel = pool.select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
+    assert json.loads((root / ".anthropic_oauth.json").read_text())["refreshToken"] == "sk-ant-ort-RT1"
+    assert not (kid / ".anthropic_oauth.json").exists()
+    assert fleet["rows"](root)[0]["refresh_token"] == "sk-ant-ort-RT1"
+
+
+def test_profile_auth_add_owns_only_its_own_rows(fleet):
+    from agent.credential_pool import AUTH_TYPE_OAUTH, PooledCredential, load_pool
+
+    kid = _profile(fleet, "kid")
+    fleet["use"](kid)
+    pool = load_pool("anthropic")
+    pool.add_entry(PooledCredential(
+        provider="anthropic", id="own001", label="mine", auth_type=AUTH_TYPE_OAUTH,
+        priority=0, source="manual:hermes_pkce", access_token="sk-ant-oat01-MINE",
+        refresh_token="rt-mine",
+    ))
+    assert [e["id"] for e in fleet["rows"](kid)] == ["own001"], "borrowed root row was copied into the profile"
+    assert [e["id"] for e in fleet["rows"](fleet["root"])] == ["abc123"]
+
+
+def test_classic_mode_persist_is_unchanged(fleet):
+    from agent.credential_pool import load_pool
+
+    fleet["use"](fleet["root"])
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT1"
+
+
+# ── C. one-time heal for installs that ALREADY forked the grant ──────────
+#
+# Fleets created on pre-fix code hold profile-local copies of the root grant
+# (verbatim --clone-all, or the old borrowed-persist). The heal runs inside
+# the profile's load_pool(): consolidate to ROOT (freshest rotation wins),
+# strip the profile copy, borrow root from then on.
+
+def _fork(fleet, name, *, rotated_to=None):
+    """Create *name* with a pre-fix style verbatim copy of root's auth.json.
+
+    ``rotated_to=N`` makes the copy the LIVE pair (RT<N>, spent RT0 server-side)
+    to emulate a profile that already refreshed on the old code.
+    """
+    pdir = _profile(fleet, name)
+    pdir.mkdir(parents=True, exist_ok=True)
+    store = json.loads((fleet["root"] / "auth.json").read_text())
+    if rotated_to is not None:
+        row = store["credential_pool"]["anthropic"][0]
+        row["access_token"] = f"sk-ant-oat01-AT{rotated_to}"
+        row["refresh_token"] = f"sk-ant-ort-RT{rotated_to}"
+        row["expires_at_ms"] = int((time.time() - 60) * 1000)  # newer, still expired
+        srv = fleet["server"]
+        srv["spent"].add("sk-ant-ort-RT0")
+        srv["valid"].discard("sk-ant-ort-RT0")
+        srv["valid"].add(f"sk-ant-ort-RT{rotated_to}")
+        srv["n"] = rotated_to
+    (pdir / "auth.json").write_text(json.dumps(store))
+    return pdir
+
+
+def test_heal_consolidates_existing_forks_to_the_live_copy(fleet, caplog):
+    """root + atlas hold spent RT0; forge already rotated to RT1 on old code."""
+    import logging
+    from agent.credential_pool import load_pool
+
+    forge = _fork(fleet, "forge", rotated_to=1)
+    atlas = _fork(fleet, "atlas")
+    assert fleet["rows"](forge)[0]["refresh_token"] == "sk-ant-ort-RT1"
+    assert fleet["rows"](atlas)[0]["refresh_token"] == "sk-ant-ort-RT0"
+
+    with caplog.at_level(logging.INFO, logger="hermes_cli.auth"):
+        fleet["use"](forge)
+        sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    # forge's live pair was adopted by ROOT, then rotated there; forge holds nothing.
+    assert fleet["rows"](forge) is None
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT2"
+    assert fleet["rows"](fleet["root"])[0]["id"] == "abc123"
+    healed = [r.message for r in caplog.records if "consolidated forked anthropic OAuth grant" in r.message]
+    assert len(healed) == 1 and "profile forge" in healed[0] and "root updated" in healed[0]
+
+    for home in (atlas, fleet["root"], forge):
+        fleet["use"](home)
+        sel = load_pool("anthropic").select()
+        assert sel is not None and sel.access_token == "sk-ant-oat01-AT2", home
+    assert fleet["rows"](atlas) is None and fleet["rows"](forge) is None
+    # Exactly one rotation by us (RT1 -> RT2); the spent RT0 was never replayed.
+    assert [e[0] for e in fleet["server"]["log"]] == ["ROTATE"], fleet["server"]["log"]
+    # API-key rows in the profiles were not touched.
+    for home in (forge, atlas):
+        store = json.loads((home / "auth.json").read_text())
+        assert store["credential_pool"]["openai"][0]["access_token"] == "sk-static-key"
+
+
+def test_heal_is_idempotent_and_logs_once(fleet, caplog):
+    import logging
+    from agent.credential_pool import load_pool
+    from hermes_cli.auth import consume_oauth_heal_notices, heal_forked_single_use_oauth_grants
+
+    kid = _fork(fleet, "kid")
+    fleet["use"](kid)
+    with caplog.at_level(logging.INFO, logger="hermes_cli.auth"):
+        load_pool("anthropic")
+        assert fleet["rows"](kid) is None
+        notices = consume_oauth_heal_notices()
+        assert len(notices) == 1 and "profile kid" in notices[0]
+        root_before = (fleet["root"] / "auth.json").read_text()
+        # Second and third loads: nothing to do, nothing written, nothing logged.
+        assert heal_forked_single_use_oauth_grants("anthropic") is None
+        load_pool("anthropic")
+    assert consume_oauth_heal_notices() == []
+    assert (fleet["root"] / "auth.json").read_text() == root_before
+    assert sum("consolidated forked" in r.message for r in caplog.records) == 1
+
+
+def test_heal_never_deletes_the_only_surviving_copy(fleet):
+    """Root lost its grant (user ran `hermes auth remove` at root); the profile's
+    copy is the only one left — and an independent second account stays put."""
+    from agent.credential_pool import load_pool
+
+    kid = _fork(fleet, "kid", rotated_to=1)
+    store = json.loads((fleet["root"] / "auth.json").read_text())
+    del store["credential_pool"]["anthropic"]
+    (fleet["root"] / "auth.json").write_text(json.dumps(store))
+
+    fleet["use"](kid)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert fleet["rows"](kid) and fleet["rows"](kid)[0]["refresh_token"] == "sk-ant-ort-RT2"
+    assert "anthropic" not in (json.loads((fleet["root"] / "auth.json").read_text())["credential_pool"])
+
+
+def test_heal_leaves_a_different_account_alone(fleet):
+    """A profile row whose JWT identity names ANOTHER account is not root's grant."""
+    import base64
+    from agent.credential_pool import load_pool
+
+    def jwt(sub):
+        payload = base64.urlsafe_b64encode(json.dumps({"sub": sub, "exp": int(time.time()) + 3600}).encode()).rstrip(b"=")
+        return "h." + payload.decode() + ".s"
+
+    root_store = json.loads((fleet["root"] / "auth.json").read_text())
+    root_store["credential_pool"]["xai-oauth"] = [{
+        "id": "rootx", "auth_type": "oauth", "priority": 0, "source": "manual:device_code",
+        "access_token": jwt("alice"), "refresh_token": "xr-alice",
+    }]
+    (fleet["root"] / "auth.json").write_text(json.dumps(root_store))
+    kid = _profile(fleet, "kid")
+    kid.mkdir(parents=True, exist_ok=True)
+    (kid / "auth.json").write_text(json.dumps({
+        "version": 1, "providers": {},
+        "credential_pool": {"xai-oauth": [
+            {"id": "kidx", "auth_type": "oauth", "priority": 0, "source": "manual:device_code",
+             "access_token": jwt("bob"), "refresh_token": "xr-bob"},
+            {"id": "kidk", "auth_type": "api_key", "priority": 1, "source": "manual",
+             "access_token": "xai-static"},
+        ]},
+    }))
+    fleet["use"](kid)
+    load_pool("xai-oauth")
+    rows = (json.loads((kid / "auth.json").read_text())["credential_pool"])["xai-oauth"]
+    assert [r["id"] for r in rows] == ["kidx", "kidk"]
+    assert json.loads((fleet["root"] / "auth.json").read_text())["credential_pool"]["xai-oauth"][0]["refresh_token"] == "xr-alice"
+
+
+def test_heal_pkce_singleton_shape_commits_live_pair_to_root_singleton(fleet):
+    """`hermes auth` PKCE shape: root + profile each have .anthropic_oauth.json +
+    a hermes_pkce-seeded row; the profile's copy is the rotated (live) one."""
+    from agent.credential_pool import load_pool
+
+    root = fleet["root"]
+    store = json.loads((root / "auth.json").read_text())
+    store["active_provider"] = "anthropic"
+    del store["credential_pool"]["anthropic"]
+    (root / "auth.json").write_text(json.dumps(store))
+    (root / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT0", "refreshToken": "sk-ant-ort-RT0",
+        "expiresAt": int((time.time() - 3600) * 1000),
+    }))
+    fleet["use"](root)
+    load_pool("anthropic")  # seeds root's hermes_pkce row from the singleton
+
+    kid = _profile(fleet, "kid")
+    kid.mkdir(parents=True, exist_ok=True)
+    import shutil
+    shutil.copy2(root / "auth.json", kid / "auth.json")
+    (kid / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT1", "refreshToken": "sk-ant-ort-RT1",
+        "expiresAt": int((time.time() - 60) * 1000),
+    }))
+    kstore = json.loads((kid / "auth.json").read_text())
+    kstore["credential_pool"]["anthropic"][0].update(
+        access_token="sk-ant-oat01-AT1", refresh_token="sk-ant-ort-RT1",
+        expires_at_ms=int((time.time() - 60) * 1000),
+    )
+    (kid / "auth.json").write_text(json.dumps(kstore))
+    srv = fleet["server"]
+    srv["spent"].add("sk-ant-ort-RT0"); srv["valid"] = {"sk-ant-ort-RT1"}; srv["n"] = 1
+
+    fleet["use"](kid)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert not (kid / ".anthropic_oauth.json").exists()
+    assert fleet["rows"](kid) is None
+    assert json.loads((root / ".anthropic_oauth.json").read_text())["refreshToken"] == "sk-ant-ort-RT2"
+    fleet["use"](root)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert [e[0] for e in srv["log"]] == ["ROTATE"], srv["log"]
+
+
+def test_heal_is_a_noop_in_classic_mode(fleet):
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+    fleet["use"](fleet["root"])
+    before = (fleet["root"] / "auth.json").read_text()
+    assert heal_forked_single_use_oauth_grants("anthropic") is None
+    assert (fleet["root"] / "auth.json").read_text() == before
diff --git a/tests/agent/test_curator.py b/tests/agent/test_curator.py
index eac61e01c5..f14ef73ea9 100644
--- a/tests/agent/test_curator.py
+++ b/tests/agent/test_curator.py
@@ -931,7 +931,7 @@ def test_review_fork_toolset_surface_excludes_execution_tools():
     # The incident class stays out: no command execution, no background
     # process steering (stdin is a second unguarded write sink), and no
     # generic filesystem-write tool.
-    for tool in ("terminal", "process", "write_file", "patch",
+    for tool in ("terminal", "process_manage", "write_file", "patch",
                  "execute_code", "computer_use", "browser_exec"):
         assert tool not in surface, (
             f"execution/write tool {tool!r} leaked into the curator fork's "
diff --git a/tests/agent/test_display_todo_progress.py b/tests/agent/test_display_todo_progress.py
index d182be9269..3d6d657ca5 100644
--- a/tests/agent/test_display_todo_progress.py
+++ b/tests/agent/test_display_todo_progress.py
@@ -26,7 +26,7 @@ class TestTodoRead:
     """get_cute_tool_message(…, result=…) when todos_arg is None (read path)."""
 
     def test_read_no_result(self):
-        msg = get_cute_tool_message("todo", {}, 0.5)
+        msg = get_cute_tool_message("todo_list", {}, 0.5)
         assert "reading tasks" in msg
         assert "0.5s" in msg
 
@@ -34,7 +34,7 @@ class TestTodoRead:
 
     def test_read_zero_total(self):
         """Edge case: empty todo list returns summary with total=0."""
-        msg = get_cute_tool_message("todo", {}, 0.5,
+        msg = get_cute_tool_message("todo_list", {}, 0.5,
                                     result=_todo_result(0, 0))
         assert "reading tasks" in msg
 
@@ -46,7 +46,7 @@ class TestTodoCreate:
 
     def test_create_default(self):
         """Brand-new plan: all pending, no result — plain count."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [
                                         {"id": "a", "content": "x", "status": "pending"},
                                     ]}, 0.3)
@@ -58,7 +58,7 @@ class TestTodoCreate:
 
     def test_create_with_result_zero_done(self):
         """New plan with 0 done — plain count, no progress fraction."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [
                                         {"id": "a", "content": "x", "status": "pending"},
                                         {"id": "b", "content": "y", "status": "pending"},
@@ -74,7 +74,7 @@ class TestTodoUpdate:
 
     def test_update_no_result(self):
         """No result available — plain update N task(s)."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [{"id": "a", "status": "completed"}],
                                      "merge": True}, 0.5)
         assert "update 1 task(s)" in msg
@@ -82,7 +82,7 @@ class TestTodoUpdate:
 
     def test_update_halfway(self):
         """2/4 — midpoint progress."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [{"id": "b", "status": "in_progress"}],
                                      "merge": True},
                                     0.7,
@@ -96,7 +96,7 @@ class TestTodoUpdate:
 
     def test_update_total_not_in_summary(self):
         """Result summary missing total key."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [{"id": "a", "status": "completed"}],
                                      "merge": True},
                                     0.3,
@@ -111,7 +111,7 @@ class TestTodoEdgeCases:
 
     def test_merge_default_value(self):
         """merge defaults to False in function signature, should be False when absent."""
-        msg = get_cute_tool_message("todo",
+        msg = get_cute_tool_message("todo_list",
                                     {"todos": [{"id": "a", "content": "x", "status": "pending"}]},
                                     1.0)
         assert "1 task(s)" in msg
@@ -120,7 +120,7 @@ class TestTodoEdgeCases:
     def test_large_task_count(self):
         """Many tasks should not break formatting."""
         many = [{"id": str(i), "content": "x", "status": "pending"} for i in range(50)]
-        msg = get_cute_tool_message("todo", {"todos": many}, 0.5)
+        msg = get_cute_tool_message("todo_list", {"todos": many}, 0.5)
         assert "50 task(s)" in msg
 
 
@@ -131,7 +131,7 @@ class TestTodoSkinIntegration:
     """
 
     def test_default_skin_prefix(self):
-        msg = get_cute_tool_message("todo", {}, 0.5)
+        msg = get_cute_tool_message("todo_list", {}, 0.5)
         assert msg.startswith("┊")
 
 
diff --git a/tests/agent/test_fast_mode_auto.py b/tests/agent/test_fast_mode_auto.py
new file mode 100644
index 0000000000..a9af81a8df
--- /dev/null
+++ b/tests/agent/test_fast_mode_auto.py
@@ -0,0 +1,143 @@
+"""Bounded /fast auto|cold windows and the shared route-aware gate."""
+
+from types import SimpleNamespace
+
+from agent import fast_mode
+
+
+def _agent(**kw):
+    base = dict(
+        service_tier="auto",
+        model="gpt-5.4",
+        provider="openai",
+        base_url="https://api.openai.com/v1",
+        api_mode="chat_completions",
+        request_overrides={"extra_body": {"keep": 1}},
+        fast_auto_seconds=60,
+    )
+    base.update(kw)
+    return SimpleNamespace(**base)
+
+
+def test_bounded_fast_window_policy(monkeypatch):
+    clock = [1000.0]
+    monkeypatch.setattr(fast_mode.time, "monotonic", lambda: clock[0])
+
+    # auto: window open -> fast override layered over existing overrides
+    agent = _agent()
+    fast_mode.begin_turn(agent, conversation_history=[])
+    assert fast_mode.effective_request_overrides(agent) == {
+        "extra_body": {"keep": 1},
+        "service_tier": "priority",
+    }
+    assert agent.request_overrides == {"extra_body": {"keep": 1}}  # never mutated
+
+    # window expired -> override absent
+    clock[0] += 61
+    assert fast_mode.effective_request_overrides(agent) == {"extra_body": {"keep": 1}}
+
+    # auto re-opens on the next turn
+    fast_mode.begin_turn(agent, conversation_history=[{"role": "user", "content": "x"}])
+    assert "service_tier" in fast_mode.effective_request_overrides(agent)
+
+    # cold: prior history -> no window at all
+    cold = _agent(service_tier="cold")
+    fast_mode.begin_turn(cold, conversation_history=[{"role": "user", "content": "x"}])
+    assert "service_tier" not in fast_mode.effective_request_overrides(cold)
+    fast_mode.begin_turn(cold, conversation_history=None)
+    assert fast_mode.effective_request_overrides(cold)["service_tier"] == "priority"
+
+    # Anthropic route uses the speed param
+    anth = _agent(
+        service_tier="auto",
+        model="claude-opus-5",
+        provider="anthropic",
+        base_url="https://api.anthropic.com",
+        api_mode="anthropic_messages",
+    )
+    fast_mode.begin_turn(anth, conversation_history=[])
+    assert fast_mode.effective_request_overrides(anth)["speed"] == "fast"
+
+    # unsupported routes never get fast params, in auto or static mode
+    from hermes_cli.models import resolve_fast_mode_overrides
+
+    for provider, base_url in (
+        ("openrouter", "https://openrouter.ai/api/v1"),
+        ("nous", "https://inference-api.nousresearch.com/v1"),
+        ("copilot", "https://api.githubcopilot.com"),
+        ("azure", "https://foo.openai.azure.com"),
+        ("custom", "http://10.0.0.1:8000/v1"),
+        ("openai", "https://proxy.example.com/v1"),
+    ):
+        proxied = _agent(provider=provider, base_url=base_url)
+        fast_mode.begin_turn(proxied, conversation_history=[])
+        assert "service_tier" not in fast_mode.effective_request_overrides(proxied), provider
+        assert resolve_fast_mode_overrides("gpt-5.4", provider=provider, base_url=base_url) is None
+    assert resolve_fast_mode_overrides(
+        "claude-opus-5", provider="bedrock", base_url="https://bedrock-runtime.us-east-1.amazonaws.com"
+    ) is None
+    # first-party routes (and the legacy model-only call) still resolve
+    assert resolve_fast_mode_overrides("gpt-5.4", provider="openai-codex", base_url="https://chatgpt.com/backend-api/codex")
+    assert resolve_fast_mode_overrides("grok-4.6", provider="xai", base_url="https://api.x.ai/v1")
+    assert resolve_fast_mode_overrides("gpt-5.4") == {"service_tier": "priority"}
+
+    # normal / static modes are untouched by the window logic
+    static = _agent(service_tier="priority", request_overrides={"service_tier": "priority"})
+    fast_mode.begin_turn(static, conversation_history=[])
+    assert fast_mode.effective_request_overrides(static) == {"service_tier": "priority"}
+    off = _agent(service_tier=None)
+    fast_mode.begin_turn(off, conversation_history=[])
+    assert fast_mode.effective_request_overrides(off) == {"extra_body": {"keep": 1}}
+
+
+def test_fast_auto_and_cold_parse_and_slash_command(monkeypatch):
+    import hermes_cli.config as config_mod
+
+    if not hasattr(config_mod, "save_env_value_secure"):
+        config_mod.save_env_value_secure = lambda key, value: {"success": True}
+    import cli as cli_mod
+    from gateway.run import GatewayRunner
+    from hermes_cli.commands import COMMAND_REGISTRY
+    from hermes_cli.config import DEFAULT_CONFIG
+
+    # config parsing: CLI, gateway, TUI all accept auto/cold; default stays off
+    for raw, expected in (("auto", "auto"), ("COLD", "cold"), ("fast", "priority"), ("", None), ("bogus", None)):
+        assert cli_mod._parse_service_tier_config(raw) == expected
+        monkeypatch.setattr(
+            "gateway.run._load_gateway_runtime_config", lambda: {"agent": {"service_tier": raw}}
+        )
+        assert GatewayRunner._load_service_tier() == expected
+    assert DEFAULT_CONFIG["agent"]["service_tier"] == ""
+    assert DEFAULT_CONFIG["agent"]["fast_auto_seconds"] == 60
+
+    # /fast auto — session-scoped, agent rebuilt, status reports the mode
+    fast_cmd = next(c for c in COMMAND_REGISTRY if c.name == "fast")
+    assert {"auto", "cold"} <= set(fast_cmd.subcommands)
+    printed = []
+    monkeypatch.setattr(cli_mod, "_cprint", lambda *a, **k: printed.append(" ".join(map(str, a))))
+    monkeypatch.setattr(cli_mod, "save_config_value", lambda *a, **k: (_ for _ in ()).throw(AssertionError("no config write")))
+    stub = SimpleNamespace(
+        service_tier=None, model="gpt-5.4", agent=object(), _fast_command_available=lambda: True
+    )
+    cli_mod.HermesCLI._handle_fast_command(stub, "/fast auto")
+    assert stub.service_tier == "auto"
+    assert stub.agent is None
+    cli_mod.HermesCLI._handle_fast_command(stub, "/fast status")
+    assert any("auto" in line for line in printed)
+    cli_mod.HermesCLI._handle_fast_command(stub, "/fast cold")
+    assert stub.service_tier == "cold"
+
+    # auto/cold do NOT pin a static override into the turn route
+    route_stub = SimpleNamespace(
+        model="gpt-5.4", api_key="k", base_url="https://api.openai.com/v1", provider="openai",
+        api_mode="chat_completions", acp_command=None, acp_args=[], _credential_pool=None,
+        service_tier="auto",
+    )
+    assert cli_mod.HermesCLI._resolve_turn_agent_config(route_stub, "hi")["request_overrides"] is None
+    route_stub.service_tier = "priority"
+    assert cli_mod.HermesCLI._resolve_turn_agent_config(route_stub, "hi")["request_overrides"] == {
+        "service_tier": "priority"
+    }
+    route_stub.base_url = "https://openrouter.ai/api/v1"
+    route_stub.provider = "openrouter"
+    assert cli_mod.HermesCLI._resolve_turn_agent_config(route_stub, "hi")["request_overrides"] is None
diff --git a/tests/agent/test_model_metadata.py b/tests/agent/test_model_metadata.py
index a6334eb71c..3d0ccd4101 100644
--- a/tests/agent/test_model_metadata.py
+++ b/tests/agent/test_model_metadata.py
@@ -799,6 +799,36 @@ class TestFetchEndpointModelMetadata:
         not_found.close.assert_called_once()
         success.close.assert_called_once()
 
+    def test_remote_probe_is_memoized_on_disk_across_processes(self, tmp_path, monkeypatch):
+        """A fresh process (cleared in-memory cache) must answer from the disk
+        memo within the TTL instead of re-probing the endpoint — the cost every
+        one-shot Bot Mode DM hop paid on startup. Expired memos re-probe."""
+        import agent.model_metadata as mm
+
+        monkeypatch.setattr(
+            mm, "_get_endpoint_metadata_cache_path", lambda: tmp_path / "endpoint_model_metadata.json"
+        )
+        success = MagicMock()
+        success.status_code = 200
+        success.json.return_value = {"data": [{"id": "test/model", "context_length": 32768}]}
+
+        with patch("agent.model_metadata.requests.get", return_value=success) as mock_get:
+            assert mm.fetch_endpoint_model_metadata("https://custom.example/v1")["test/model"]["context_length"] == 32768
+            # "New process": drop the in-memory cache only.
+            mm._endpoint_model_metadata_cache.clear()
+            mm._endpoint_model_metadata_cache_time.clear()
+            assert mm.fetch_endpoint_model_metadata("https://custom.example/v1")["test/model"]["context_length"] == 32768
+        mock_get.assert_called_once()
+
+        # Past the TTL the memo is stale and the endpoint is probed again.
+        mm._endpoint_model_metadata_cache.clear()
+        mm._endpoint_model_metadata_cache_time.clear()
+        with patch("agent.model_metadata.time.time", return_value=time.time() + mm._ENDPOINT_MODEL_CACHE_TTL + 1), patch(
+            "agent.model_metadata.requests.get", return_value=success
+        ) as mock_get:
+            mm.fetch_endpoint_model_metadata("https://custom.example/v1")
+        mock_get.assert_called_once()
+
 
 # =========================================================================
 # Nous Portal context-window resolution (provider="nous")
diff --git a/tests/agent/test_outbound_webhooks.py b/tests/agent/test_outbound_webhooks.py
index 29e05a4cdb..39c8a25221 100644
--- a/tests/agent/test_outbound_webhooks.py
+++ b/tests/agent/test_outbound_webhooks.py
@@ -301,6 +301,23 @@ class TestPayload:
         assert payload["delivery_id"] == "did_1234"
         assert payload["timestamp"].endswith("Z")
 
+    def test_profile_field_reflects_bound_profile_home(self, tmp_path, monkeypatch):
+        """Receivers behind a multiplexed gateway need to know which profile
+        fired (#92674): ``profile`` follows the bound home at fire time."""
+        from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+        profile_home = tmp_path / "profiles" / "b"
+        profile_home.mkdir(parents=True)
+        token = set_hermes_home_override(profile_home)
+        try:
+            body = outbound_webhooks._serialize_payload("on_session_end", {}, "did_1")
+        finally:
+            reset_hermes_home_override(token)
+        assert json.loads(body)["profile"] == "b"
+        body = outbound_webhooks._serialize_payload("on_session_end", {}, "did_2")
+        assert json.loads(body)["profile"] == "default"
+
     def test_unserialisable_values_stringified(self):
         body = outbound_webhooks._serialize_payload(
             "on_session_end", {"weird": object()}, "did_1"
@@ -345,6 +362,46 @@ class TestRegistration:
         assert len(http_server.captured) == 1
 
 
+class TestForceReloadHomeScoping:
+    """Force-reloading one profile's plugin manager must restore that
+    profile's own outbound webhook and leave it firing exactly once —
+    the mirror of the shell-hook force-reload symmetry fix (#92682
+    review: outbound webhooks were the "same symptom class... after a
+    supported lifecycle transition instead of initial startup").
+    """
+
+    def test_force_reload_restores_webhook_and_fires_once(
+        self, monkeypatch, http_server,
+    ):
+        from hermes_cli import plugins
+
+        cfg = _cfg({"url": _url(http_server), "events": ["on_session_end"]})
+        monkeypatch.setattr("hermes_cli.config.load_config", lambda: cfg)
+
+        monkeypatch.setenv("HERMES_HOME", "/tmp/profile-b-webhook")
+        mgr_b = plugins.PluginManager()
+        plugins._plugin_manager = mgr_b
+        outbound_webhooks.register_from_config(cfg)
+        assert len(mgr_b._hooks.get("on_session_end", [])) == 1
+
+        # Force-reload: unload() wipes _hooks (config-owned webhook
+        # callbacks included, same as the ledger-driven plugin sweep), so
+        # without the fix the idempotence key alone would survive and a
+        # later register_from_config() call would see it and skip
+        # re-wiring — leaving the webhook silently inert.
+        mgr_b.unload()
+        assert mgr_b._hooks.get("on_session_end", []) == []
+
+        outbound_webhooks.re_register_config_hooks()
+        assert len(mgr_b._hooks.get("on_session_end", [])) == 1
+
+        plugins.get_plugin_manager().invoke_hook(
+            "on_session_end", session_id="s1",
+        )
+        assert outbound_webhooks.flush()
+        assert len(http_server.captured) == 1
+
+
 # ── E2E delivery against a real HTTP server ──────────────────────────────
 
 
diff --git a/tests/agent/test_phantom_tool_references.py b/tests/agent/test_phantom_tool_references.py
index 045f356198..836522827a 100644
--- a/tests/agent/test_phantom_tool_references.py
+++ b/tests/agent/test_phantom_tool_references.py
@@ -65,8 +65,8 @@ class TestCodingBriefTodoGating:
         return prefix[0]
 
     def test_todo_kept_when_tool_available(self):
-        brief = self._brief({"todo", "terminal", "read_file"})
-        assert "Track multi-step work with `todo`" in brief
+        brief = self._brief({"todo_list", "terminal", "read_file"})
+        assert "Track multi-step work with `todo_list`" in brief
 
     def test_todo_dropped_when_tool_missing(self):
         brief = self._brief({"terminal", "read_file"})
@@ -76,7 +76,7 @@ class TestCodingBriefTodoGating:
 
     def test_unknown_toolset_keeps_full_brief(self):
         brief = self._brief(None)
-        assert "Track multi-step work with `todo`" in brief
+        assert "Track multi-step work with `todo_list`" in brief
 
 
 class TestEssentialSkillsUndisableable:
diff --git a/tests/agent/test_redact.py b/tests/agent/test_redact.py
index e51dfdf12b..d70c8146c1 100644
--- a/tests/agent/test_redact.py
+++ b/tests/agent/test_redact.py
@@ -100,6 +100,37 @@ class TestEnvAssignments:
         result = redact_sensitive_text(text)
         assert result == text
 
+    @pytest.mark.parametrize(
+        "text",
+        [
+            'IDENTITY_TOKEN="bailu"',
+            "--override-tensor per_layer_token_embd.weight=CPU",
+            'runtime.token="local"',
+            '{"token": "CPU"}',
+            "token: CPU",
+        ],
+    )
+    def test_ambiguous_key_preserves_obviously_noncredential_value(self, text):
+        assert redact_sensitive_text(text, force=True) == text
+
+    @pytest.mark.parametrize(
+        "text, cleartext",
+        [
+            ("PASSWORD=hunter2", "hunter2"),
+            ("SECRET_TOKEN=bailu", "bailu"),
+            ("id_token=local", "local"),
+            ("CUSTOM_TOKEN=opaqueValue123456789", "opaqueValue123456789"),
+            ('{"token": "opaqueValue123456789"}', "opaqueValue123456789"),
+            ('{"key_material": "CPU"}', "CPU"),
+            ('{"bearer": "local"}', "local"),
+            ("TOKEN=" + "sk-" + "a" * 30, "a" * 20),
+        ],
+    )
+    def test_strong_key_or_credential_shaped_value_still_redacts(
+        self, text, cleartext
+    ):
+        assert cleartext not in redact_sensitive_text(text, force=True)
+
 
 
 
@@ -1081,3 +1112,69 @@ class TestMaskSecretControlStripping:
     def test_all_control_value_returns_empty_fallback(self):
         assert mask_secret("\n\x85\u200b") == ""
         assert mask_secret("\n\x85\u200b", empty="(not set)") == "(not set)"
+
+
+class TestValueAwareGatingCorpus:
+    """Issue #96607: corpus-level before/after for value-aware gating.
+
+    Redaction must mask a keyword-named assignment ONLY when the value has
+    credential shape (vendor prefix, hex/base64/high-entropy, or a strong
+    credential-specific key name). Bare technical vocabulary — ``token``,
+    ``key``, ``cpu`` — in ordinary technical prose/config must pass through
+    byte-for-byte, on every assignment family (ENV, dotted config, JSON,
+    YAML).
+    """
+
+    # Realistic technical prose. On pre-fix main every line was corrupted
+    # to ``***`` despite containing no secret.
+    TECHNICAL_CORPUS = [
+        'IDENTITY_TOKEN="bailu"',
+        "--override-tensor per_layer_token_embd.weight=CPU",
+        "MAX_TOKENS=4096",
+        "runtime.token=local",
+        "The tokenizer splits on whitespace; set max_new_tokens=256.",
+        "num_key_value_heads=8",
+        "token: CPU",
+        "llm_load_tensors: per_layer_token_embd.weight=CPU buffer",
+    ]
+
+    # Obviously-fake but shape-realistic secrets: every one of these must
+    # STAY masked after the gating change (fail-closed on credential shape
+    # or strong key names).
+    FAKE_SECRET_CORPUS = [
+        ("API_KEY=sk-fakefakefakefakefake1234567890abcd", "fakefake"),
+        ("GITHUB_TOKEN=ghp_FAKEfakeFAKEfake1234567890fake", "FAKEfake"),
+        ("MY_SERVICE_TOKEN=A9f3kZq7Lm2Xw8Rt4Yv6", "A9f3kZq7"),
+        ("TOKEN=6f1d2a9c8b3e4f5a6d7c8b9a0e1f2d3c", "6f1d2a9c"),
+        ("password=hunter2", "hunter2"),
+        ("db_password: hunter2", "hunter2"),
+        ("auth_token: 9f8e7d6c5b4a39281706f5e4d3c2b1a0", "9f8e7d6c"),
+        ('"token": "Zx9Qw8Er7Ty6Ui5Op4As3"', "Zx9Qw8Er"),
+        ("SESSION_TOKEN=shrt", "shrt"),
+        ("client_secret=abc", "abc"),
+        ("spring.datasource.password=fakePass123", "fakePass123"),
+    ]
+
+    def test_technical_prose_survives_intact(self):
+        for line in self.TECHNICAL_CORPUS:
+            assert redact_sensitive_text(line, force=True) == line, line
+
+    def test_technical_corpus_as_one_block_survives_intact(self):
+        # The multi-line shape a model actually reads from tool output.
+        block = "\n".join(self.TECHNICAL_CORPUS)
+        assert redact_sensitive_text(block, force=True) == block
+
+    def test_shape_realistic_fake_secrets_still_masked(self):
+        for line, cleartext in self.FAKE_SECRET_CORPUS:
+            result = redact_sensitive_text(line, force=True)
+            assert result != line, line
+            assert cleartext not in result, line
+
+    def test_mixed_block_masks_only_the_secret_lines(self):
+        # Precondition guard: both halves must actually exercise the gate.
+        secret_line = "MY_SERVICE_TOKEN=A9f3kZq7Lm2Xw8Rt4Yv6"
+        prose_line = 'IDENTITY_TOKEN="bailu"'
+        block = f"{prose_line}\n{secret_line}"
+        result = redact_sensitive_text(block, force=True)
+        assert prose_line in result
+        assert "A9f3kZq7Lm2Xw8Rt4Yv6" not in result
diff --git a/tests/agent/test_refine_snapshot_isolation.py b/tests/agent/test_refine_snapshot_isolation.py
new file mode 100644
index 0000000000..234beb1993
--- /dev/null
+++ b/tests/agent/test_refine_snapshot_isolation.py
@@ -0,0 +1,101 @@
+"""Every review path hands the fork a snapshot that cannot alias the live transcript.
+
+``AIAgent._spawn_background_review`` is the single chokepoint the automatic
+post-turn review, the idle-queue deferral and both explicit ``/refine`` entry
+points (CLI mixin + gateway slash command) go through; it clones the snapshot
+structurally there. A shallow ``list()`` would share the nested
+``tool_calls`` / ``content`` containers with the persisted history, so the
+fork's in-place transcript sanitization would rewrite the parent's messages
+(#100795). These tests drive the real /refine handlers into the real
+chokepoint and capture what reaches the spawn.
+"""
+
+import threading
+from unittest.mock import MagicMock
+
+import pytest
+
+
+def _agent_with_real_chokepoint():
+    """MagicMock agent whose _spawn_background_review is the REAL method.
+
+    Everything below the chokepoint (thread spawn) is captured at
+    ``_spawn_background_review_now`` so no fork actually runs.
+    """
+    from run_agent import AIAgent
+
+    agent = MagicMock()
+    agent.valid_tool_names = {"memory"}
+    agent._delegate_depth = 0
+    agent._spawn_background_review = AIAgent._spawn_background_review.__get__(agent)
+    return agent
+
+
+def _nested_history():
+    return [
+        {"role": "user", "content": [{"type": "text", "text": "ask"}]},
+        {
+            "role": "assistant",
+            "content": "ok",
+            "tool_calls": [{
+                "id": "call-1",
+                "function": {"name": "read_file", "arguments": '{"path":"x"}'},
+            }],
+        },
+    ]
+
+
+def _assert_isolated(live, snapshot):
+    assert snapshot == live  # same shape/bytes …
+    for live_msg, snap_msg in zip(live, snapshot):
+        assert snap_msg is not live_msg  # … but no shared containers
+        for key in ("content", "tool_calls"):
+            if isinstance(live_msg.get(key), (dict, list)):
+                assert snap_msg[key] is not live_msg[key]
+    # Mutating the snapshot the way the fork's sanitizers do must not leak.
+    snapshot[0]["content"][0]["text"] = "mutated"
+    snapshot[1]["tool_calls"][0]["function"]["arguments"] = "{}"
+    assert live[0]["content"][0]["text"] == "ask"
+    assert live[1]["tool_calls"][0]["function"]["arguments"] == '{"path":"x"}'
+
+
+def test_cli_refine_snapshot_does_not_alias_live_history(monkeypatch):
+    from hermes_cli.cli_commands_mixin import CLICommandsMixin
+
+    monkeypatch.setattr("cli._cprint", lambda *a, **k: None, raising=False)
+    agent = _agent_with_real_chokepoint()
+    cli = object.__new__(CLICommandsMixin)
+    cli.agent = agent
+    cli.conversation_history = _nested_history()
+
+    cli._handle_refine_command("/refine")
+
+    agent._spawn_background_review_now.assert_called_once()
+    snapshot = agent._spawn_background_review_now.call_args.kwargs["messages_snapshot"]
+    _assert_isolated(cli.conversation_history, snapshot)
+
+
+@pytest.mark.asyncio
+async def test_gateway_refine_snapshot_does_not_alias_live_history():
+    from gateway.run import GatewayRunner
+
+    key = "agent:main:test:dm:1"
+    agent = _agent_with_real_chokepoint()
+    agent._session_messages = _nested_history()
+
+    runner = object.__new__(GatewayRunner)
+    runner._running_agents = {}
+    runner._agent_cache = {key: agent}
+    runner._agent_cache_lock = threading.Lock()
+    runner._session_key_for_source = lambda source: key
+
+    event = MagicMock()
+    event.source = object()
+    event.get_command_args.return_value = ""
+
+    out = await runner._handle_refine_command(event)
+
+    assert out.startswith("⚗")
+    agent._spawn_background_review_now.assert_called_once()
+    snapshot = agent._spawn_background_review_now.call_args.kwargs["messages_snapshot"]
+    _assert_isolated(agent._session_messages, snapshot)
diff --git a/tests/agent/test_review_idle_queue.py b/tests/agent/test_review_idle_queue.py
new file mode 100644
index 0000000000..43082f76e9
--- /dev/null
+++ b/tests/agent/test_review_idle_queue.py
@@ -0,0 +1,347 @@
+"""Deferred background review on the managed local runtime.
+
+Behavior contracts for agent/review_idle_queue.py and the decision
+wrapper in run_agent.AIAgent._spawn_background_review:
+
+- defer: auto + review runtime == managed local  -> queued, not spawned
+- defer: never, or non-managed runtime, or /refine -> immediate spawn
+- queue coalesces per session (newest snapshot wins, age preserved)
+- dispatch requires sustained process-quiet AND server idle
+- aged-out items dispatch regardless of idleness (delay, never lose)
+- preempted deferred reviews requeue with a bounded attempt cap
+"""
+
+import threading
+import time
+import types
+
+import pytest
+
+from agent.review_idle_queue import (
+    ReviewIdleQueue,
+    _IDLE_SETTLE_S,
+    defer_max_age_s,
+    defer_mode,
+)
+
+
+# ── config parsing ───────────────────────────────────────────────
+
+
+def test_defer_mode_values():
+    assert defer_mode(None) == "auto"
+    assert defer_mode({}) == "auto"
+    assert defer_mode({"defer": "auto"}) == "auto"
+    assert defer_mode({"defer": "never"}) == "never"
+    assert defer_mode({"defer": "NEVER"}) == "never"
+    # Unknown values fall back to auto (the safe, documented default).
+    assert defer_mode({"defer": "sometimes"}) == "auto"
+    assert defer_mode({"defer": 3}) == "auto"
+
+
+def test_defer_max_age_parsing():
+    assert defer_max_age_s(None) == 30 * 60
+    assert defer_max_age_s({"defer_max_age_s": 120}) == 120.0
+    assert defer_max_age_s({"defer_max_age_s": "600"}) == 600.0
+    # Nonsense and non-positive fall back to the default.
+    assert defer_max_age_s({"defer_max_age_s": "soon"}) == 30 * 60
+    assert defer_max_age_s({"defer_max_age_s": 0}) == 30 * 60
+    assert defer_max_age_s({"defer_max_age_s": -5}) == 30 * 60
+
+
+# ── queue harness ────────────────────────────────────────────────
+
+
+class _FakeAgent:
+    def __init__(self):
+        self.spawned = []
+        self.session_id = "sess-x"
+
+    def _spawn_background_review_now(self, **kwargs):
+        self.spawned.append(kwargs)
+
+
+def _make_queue(now=None, server_idle=True):
+    q = ReviewIdleQueue()
+    clock = {"t": 0.0}
+    if now is None:
+        q._now = lambda: clock["t"]
+    else:
+        q._now = now
+    q._server_idle = lambda: server_idle
+    # Never start the real dispatcher thread in unit tests.
+    q._ensure_thread = lambda: None
+    return q, clock
+
+
+def test_enqueue_coalesces_per_session_newest_wins_oldest_age():
+    q, clock = _make_queue()
+    agent = _FakeAgent()
+
+    clock["t"] = 100.0
+    q.enqueue(agent, "s1", {"messages_snapshot": ["old"], "task_cfg": {}})
+    clock["t"] = 200.0
+    q.enqueue(agent, "s1", {"messages_snapshot": ["new"], "task_cfg": {}})
+    q.enqueue(agent, "s2", {"messages_snapshot": ["other"], "task_cfg": {}})
+
+    assert q.pending_count() == 2
+    with q._lock:
+        item = q._pending["s1"]
+    # Newest snapshot won, but the age clock kept the ORIGINAL enqueue
+    # time so a busy session cannot push its own age-out forever.
+    assert item.kwargs["messages_snapshot"] == ["new"]
+    assert item.enqueued_at == 100.0
+
+
+def test_dispatch_waits_for_sustained_quiet():
+    q, clock = _make_queue()
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {}})
+
+    # A live turn: nothing dispatches.
+    q.note_turn_started()
+    assert q._pop_dispatchable() is None
+
+    # Turn finished, but the settle window hasn't elapsed.
+    q.note_turn_finished()
+    assert q._pop_dispatchable() is None
+
+    # Quiet long enough -> dispatchable.
+    clock["t"] += _IDLE_SETTLE_S + 1
+    item = q._pop_dispatchable()
+    assert item is not None and item.session_key == "s1"
+    assert q.pending_count() == 0
+
+
+def test_dispatch_blocked_by_busy_server():
+    q, clock = _make_queue(server_idle=False)
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {}})
+    q.note_turn_started()
+    q.note_turn_finished()
+    clock["t"] += _IDLE_SETTLE_S + 1
+    # Process is quiet but the managed server has a processing slot
+    # (another profile's session, a live prefill): hold.
+    assert q._pop_dispatchable() is None
+    assert q.pending_count() == 1
+
+
+def test_aged_out_item_dispatches_despite_busy_server():
+    q, clock = _make_queue(server_idle=False)
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {"defer_max_age_s": 60}})
+    q.note_turn_started()  # never goes quiet
+    clock["t"] += 61
+    item = q._pop_dispatchable()
+    assert item is not None
+    assert item.session_key == "s1"
+
+
+def test_new_turn_resets_the_quiet_clock():
+    q, clock = _make_queue()
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {}})
+    q.note_turn_started()
+    q.note_turn_finished()
+    clock["t"] += _IDLE_SETTLE_S - 2
+    # A new prompt arrives just before the settle window closes.
+    q.note_turn_started()
+    clock["t"] += 30
+    assert q._pop_dispatchable() is None  # still live
+    q.note_turn_finished()
+    assert q._pop_dispatchable() is None  # settle restarts
+    clock["t"] += _IDLE_SETTLE_S + 1
+    assert q._pop_dispatchable() is not None
+
+
+def test_nested_turns_require_all_to_finish():
+    q, clock = _make_queue()
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {}})
+    q.note_turn_started()
+    q.note_turn_started()
+    q.note_turn_finished()
+    clock["t"] += _IDLE_SETTLE_S + 1
+    assert q._pop_dispatchable() is None  # one turn still live
+    q.note_turn_finished()
+    clock["t"] += _IDLE_SETTLE_S + 1
+    assert q._pop_dispatchable() is not None
+
+
+# ── the decision wrapper ─────────────────────────────────────────
+
+
+def _wrapper_agent(monkeypatch, defer="auto", managed=True):
+    """A minimal object wearing the real _spawn_background_review."""
+    import run_agent
+    from agent import review_idle_queue as riq
+
+    agent = _FakeAgent()
+    agent._delegate_depth = 0
+    calls = {"enqueued": [], "spawned": []}
+
+    monkeypatch.setattr(
+        "agent.background_review.load_background_review_settings",
+        lambda: (True, {"defer": defer}),
+    )
+    monkeypatch.setattr(
+        riq, "review_targets_managed_local", lambda a, cfg: managed
+    )
+    monkeypatch.setattr(
+        riq.QUEUE, "enqueue",
+        lambda a, key, kw: calls["enqueued"].append((key, kw)),
+    )
+    agent._spawn_background_review_now = (
+        lambda **kw: calls["spawned"].append(kw)
+    )
+    bound = types.MethodType(run_agent.AIAgent._spawn_background_review, agent)
+    return bound, calls
+
+
+def test_wrapper_defers_managed_local_auto(monkeypatch):
+    spawn, calls = _wrapper_agent(monkeypatch, defer="auto", managed=True)
+    spawn([{"role": "user", "content": "hi"}], review_memory=True)
+    assert len(calls["enqueued"]) == 1
+    assert calls["spawned"] == []
+    key, kwargs = calls["enqueued"][0]
+    assert key == "sess-x"
+    assert kwargs["review_memory"] is True
+
+
+def test_wrapper_spawns_immediately_for_non_managed(monkeypatch):
+    spawn, calls = _wrapper_agent(monkeypatch, defer="auto", managed=False)
+    spawn([{"role": "user", "content": "hi"}], review_skills=True)
+    assert calls["enqueued"] == []
+    assert len(calls["spawned"]) == 1
+
+
+def test_wrapper_defer_never_is_old_behavior(monkeypatch):
+    spawn, calls = _wrapper_agent(monkeypatch, defer="never", managed=True)
+    spawn([{"role": "user", "content": "hi"}], review_memory=True)
+    assert calls["enqueued"] == []
+    assert len(calls["spawned"]) == 1
+
+
+def test_wrapper_refine_bypasses_queue(monkeypatch):
+    spawn, calls = _wrapper_agent(monkeypatch, defer="auto", managed=True)
+    spawn([{"role": "user", "content": "hi"}], review_memory=True,
+          focus="save the deploy workflow")
+    assert calls["enqueued"] == []
+    assert len(calls["spawned"]) == 1
+    assert calls["spawned"][0]["focus"] == "save the deploy workflow"
+
+
+def test_wrapper_bare_refine_bypasses_queue(monkeypatch):
+    """/refine with no focus text is still explicit: never deferred."""
+    spawn, calls = _wrapper_agent(monkeypatch, defer="auto", managed=True)
+    spawn([{"role": "user", "content": "hi"}], review_memory=True,
+          focus=None, explicit=True)
+    assert calls["enqueued"] == []
+    assert len(calls["spawned"]) == 1
+
+
+def test_wrapper_cloud_fast_path_skips_runtime_resolution(monkeypatch):
+    """No managed server on the machine -> the classifier answers from the
+    TTL-cached netloc probe alone, without resolving the review runtime.
+    Guards the cloud-only turn tail from growing new work."""
+    from agent import review_idle_queue as riq
+
+    resolved = {"count": 0}
+
+    def _explode(agent, cfg):
+        resolved["count"] += 1
+        raise AssertionError("runtime resolution must not run")
+
+    monkeypatch.setattr(
+        "agent.auxiliary_client._managed_local_netloc", lambda: "")
+    monkeypatch.setattr(
+        "agent.background_review._resolve_review_runtime", _explode)
+    assert riq.review_targets_managed_local(object(), {}) is False
+    assert resolved["count"] == 0
+
+
+def test_dispatcher_rechecks_enabled_gate(monkeypatch):
+    """A review disabled while queued must not be resurrected at dispatch."""
+    from agent import review_idle_queue as riq
+
+    q, clock = _make_queue()
+    agent = _FakeAgent()
+    q.enqueue(agent, "s1", {"task_cfg": {}})
+    monkeypatch.setattr(
+        "agent.background_review.load_background_review_settings",
+        lambda: (False, {}),
+    )
+    item = None
+    clock["t"] += _IDLE_SETTLE_S + 1
+    q.note_turn_started()
+    q.note_turn_finished()
+    clock["t"] += _IDLE_SETTLE_S + 1
+    item = q._pop_dispatchable()
+    assert item is not None
+    assert q._still_enabled(item) is False
+
+
+# ── requeue on preemption ────────────────────────────────────────
+
+
+class _Run:
+    def __init__(self, cancelled):
+        self.cancel_requested = threading.Event()
+        if cancelled:
+            self.cancel_requested.set()
+
+
+def _requeue_agent(monkeypatch, managed=True):
+    import run_agent
+    from agent import review_idle_queue as riq
+
+    agent = _FakeAgent()
+    calls = {"enqueued": []}
+    monkeypatch.setattr(
+        riq, "review_targets_managed_local", lambda a, cfg: managed
+    )
+    monkeypatch.setattr(
+        riq.QUEUE, "enqueue",
+        lambda a, key, kw: calls["enqueued"].append(kw),
+    )
+    agent._REVIEW_REQUEUE_MAX_ATTEMPTS = (
+        run_agent.AIAgent._REVIEW_REQUEUE_MAX_ATTEMPTS
+    )
+    bound = types.MethodType(
+        run_agent.AIAgent._maybe_requeue_preempted_review, agent
+    )
+    return bound, calls
+
+
+def test_preempted_review_requeues(monkeypatch):
+    requeue, calls = _requeue_agent(monkeypatch)
+    requeue(_Run(cancelled=True),
+            {"task_cfg": {"defer": "auto"}, "focus": None,
+             "_requeue_attempts": 1})
+    assert len(calls["enqueued"]) == 1
+    # The attempt counter rides along so the cap survives the round trip.
+    assert calls["enqueued"][0]["_requeue_attempts"] == 1
+
+
+def test_completed_review_does_not_requeue(monkeypatch):
+    requeue, calls = _requeue_agent(monkeypatch)
+    requeue(_Run(cancelled=False),
+            {"task_cfg": {"defer": "auto"}, "focus": None,
+             "_requeue_attempts": 1})
+    assert calls["enqueued"] == []
+
+
+def test_requeue_attempt_cap(monkeypatch):
+    requeue, calls = _requeue_agent(monkeypatch)
+    requeue(_Run(cancelled=True),
+            {"task_cfg": {"defer": "auto"}, "focus": None,
+             "_requeue_attempts": 4})
+    assert calls["enqueued"] == []
+
+
+def test_requeue_skips_non_managed(monkeypatch):
+    requeue, calls = _requeue_agent(monkeypatch, managed=False)
+    requeue(_Run(cancelled=True),
+            {"task_cfg": {"defer": "auto"}, "focus": None,
+             "_requeue_attempts": 1})
+    assert calls["enqueued"] == []
diff --git a/tests/agent/test_secret_scope.py b/tests/agent/test_secret_scope.py
index 7e73f12dbc..5a42f842d8 100644
--- a/tests/agent/test_secret_scope.py
+++ b/tests/agent/test_secret_scope.py
@@ -347,3 +347,34 @@ class TestRelayRoutingStampGlobals:
             ss.set_multiplex_active(False)
         for name in self.AUTH_VARS:
             assert not ss._is_global_env(name), name
+
+
+class TestSecretScopeAcrossExecutorThreads:
+    """Multiplexed profile state must reach pool workers (see #95119).
+
+    The context-compression timeout fence runs auxiliary LLM calls in a
+    daemon thread pool.  Bundled CPython runtime builds omit
+    ``ThreadPoolExecutor``'s context propagation, so the profile secret
+    scope was absent in the worker and ``get_secret`` failed closed with
+    ``UnscopedSecretError``, silently degrading compression to lossy
+    deterministic summaries.  ``DaemonThreadPoolExecutor.submit`` restores
+    stdlib context semantics; these tests lock that in.
+    """
+
+    def test_scoped_read_works_in_daemon_pool_worker(self, monkeypatch):
+        from tools.daemon_pool import DaemonThreadPoolExecutor
+
+        monkeypatch.setenv("SURPLUS_API_KEY", "env-key")
+        ss.set_multiplex_active(True)
+        token = ss.set_secret_scope({"SURPLUS_API_KEY": "scope-key"})
+        pool = DaemonThreadPoolExecutor(max_workers=1)
+        try:
+            # The scope (authoritative under multiplex) must reach the worker.
+            seen = pool.submit(ss.get_secret, "SURPLUS_API_KEY").result(timeout=10)
+            assert seen == "scope-key"
+            # A scoped miss must still not borrow the (cross-profile) env value.
+            monkeypatch.setenv("OPENAI_API_KEY", "env-leak")
+            assert pool.submit(ss.get_secret, "OPENAI_API_KEY").result(timeout=10) is None
+        finally:
+            pool.shutdown(wait=True)
+            ss.reset_secret_scope(token)
diff --git a/tests/agent/test_skill_commands.py b/tests/agent/test_skill_commands.py
index 623f5a5c05..02e7bfd149 100644
--- a/tests/agent/test_skill_commands.py
+++ b/tests/agent/test_skill_commands.py
@@ -255,6 +255,41 @@ class TestScanSkillCommands:
             assert "/b-only" in profile_b_commands
             assert "/a-only" not in profile_b_commands
 
+    def test_get_skill_commands_scans_profile_skills_dir_not_frozen_import_dir(self, tmp_path):
+        """Under a profile home override the scan must read <profile>/skills/,
+        not the launch home's import-time ``SKILLS_DIR`` (#67277): a
+        multiplexed webhook routed to profile B otherwise sees default's skills.
+        Deliberately does NOT patch ``tools.skills_tool.SKILLS_DIR``.
+        """
+        import agent.skill_commands as sc_mod
+        from agent.skill_commands import build_skill_invocation_message, get_skill_commands
+        from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+        profile_b = tmp_path / "profiles" / "b"
+        _make_skill(profile_b / "skills", "b-only", body="Body of b-only.")
+        (profile_b / "config.yaml").write_text("{}\n")
+
+        with (
+            patch.object(sc_mod, "_skill_commands", {}),
+            patch.object(sc_mod, "_skill_commands_platform", None),
+            patch.object(sc_mod, "_skill_commands_home", None),
+        ):
+            token = set_hermes_home_override(profile_b)
+            try:
+                commands = dict(get_skill_commands())
+                assert "/b-only" in commands
+                # Frozen SKILLS_DIR (the launch home) must not leak in.
+                launch_dir = str(skills_tool_module._SKILLS_DIR_AT_IMPORT)
+                assert not any(
+                    info["skill_dir"].startswith(launch_dir) for info in commands.values()
+                )
+                # And the absolute skill_dir round-trips through skill_view
+                # (normalize_skill_lookup_name must use the same live root).
+                msg = build_skill_invocation_message("/b-only", user_instruction="go")
+            finally:
+                reset_hermes_home_override(token)
+        assert msg is not None and "Body of b-only." in msg
+
     def test_get_skill_commands_rescans_when_leaving_platform_scope(self, tmp_path, monkeypatch):
         """Returning to no-platform-scope (CLI / cron / RL) after a gateway
         session must rescan so the unfiltered view is repopulated (#14536).
diff --git a/tests/agent/test_stall_guards.py b/tests/agent/test_stall_guards.py
index b79ba55c5b..013f8b83f8 100644
--- a/tests/agent/test_stall_guards.py
+++ b/tests/agent/test_stall_guards.py
@@ -92,7 +92,7 @@ def test_arg_canonicalization_ignores_key_order():
 
 def test_allowlisted_pollers_never_fire():
     c = ToolCallGuardrailController()
-    for tool in ("process", "vendor_get_result", "job_poll"):
+    for tool in ("process_manage", "vendor_get_result", "job_poll"):
         for _ in range(STALL_GUARD_IDENTICAL_CALL_THRESHOLD + 2):
             assert c.observe_identical_call(tool, {"id": "j1"}, "Generating") is None
 
diff --git a/tests/agent/test_subagent_progress.py b/tests/agent/test_subagent_progress.py
index 4ec939780b..8fc656ac06 100644
--- a/tests/agent/test_subagent_progress.py
+++ b/tests/agent/test_subagent_progress.py
@@ -132,11 +132,12 @@ class TestBuildChildProgressCallback:
         parent._delegate_spinner = spinner
         parent.tool_progress_callback = None
         
-        # task_index=0 in a batch of 3 → prefix "[1]"
+        # task_index=0 in a batch of 3 → prefix "[1/3]" (batch slot; a
+        # delegation batch tag is prepended when the id is known)
         cb0 = _build_child_progress_callback(0, "test goal", parent, task_count=3)
         cb0("tool.started", "web_search", "test", {})
         output = buf.getvalue()
-        assert "[1]" in output
+        assert "[1/3]" in output
 
         # task_index=2 in a batch of 3 → prefix "[3]"
         buf.truncate(0)
@@ -144,7 +145,7 @@ class TestBuildChildProgressCallback:
         cb2 = _build_child_progress_callback(2, "test goal", parent, task_count=3)
         cb2("tool.started", "web_search", "test", {})
         output = buf.getvalue()
-        assert "[3]" in output
+        assert "[3/3]" in output
 
 
 
diff --git a/tests/agent/test_summarize_tool_result_type_safety.py b/tests/agent/test_summarize_tool_result_type_safety.py
index 2899c9be27..f05cca0c0c 100644
--- a/tests/agent/test_summarize_tool_result_type_safety.py
+++ b/tests/agent/test_summarize_tool_result_type_safety.py
@@ -112,7 +112,7 @@ class TestBackstopWrapper:
             "terminal", "read_file", "write_file", "search_files", "patch",
             "browser_navigate", "web_search", "web_extract", "delegate_task",
             "execute_code", "skill_view", "vision_analyze", "memory",
-            "cronjob", "process", "totally_unknown_tool",
+            "cronjob_manage", "process_manage", "totally_unknown_tool",
         ]
         keys = ["command", "path", "content", "pattern", "url", "query",
                 "urls", "goal", "code", "name", "question", "action",
@@ -151,12 +151,12 @@ class TestDisplayPreviewTypeSafety:
     def test_process_preview_non_string_data(self):
         from agent.display import build_tool_preview
         result = build_tool_preview(
-            "process", {"action": "submit", "session_id": "abc", "data": 42}
+            "process_manage", {"action": "submit", "session_id": "abc", "data": 42}
         )
         assert result == 'submit abc "42"'
 
     def test_process_preview_none_action(self):
         from agent.display import build_tool_preview
-        result = build_tool_preview("process", {"action": None, "session_id": "abc"})
+        result = build_tool_preview("process_manage", {"action": None, "session_id": "abc"})
         assert isinstance(result, str)
 
diff --git a/tests/agent/test_tool_guardrails.py b/tests/agent/test_tool_guardrails.py
index dbeb2d9d3f..63ae5debd3 100644
--- a/tests/agent/test_tool_guardrails.py
+++ b/tests/agent/test_tool_guardrails.py
@@ -33,6 +33,18 @@ def test_tool_call_signature_hashes_canonical_nested_unicode_args_without_exposi
     assert "☤" not in json.dumps(metadata)
 
 
+def test_default_config_is_soft_warning_only_with_hard_stop_disabled():
+    cfg = ToolCallGuardrailConfig()
+
+    assert cfg.warnings_enabled is True
+    assert cfg.hard_stop_enabled is False
+    assert cfg.non_interactive_hard_stop_enabled is True
+    assert cfg.exact_failure_warn_after == 2
+    assert cfg.same_tool_failure_warn_after == 3
+    assert cfg.no_progress_warn_after == 2
+    assert cfg.exact_failure_block_after == 5
+    assert cfg.same_tool_failure_halt_after == 8
+    assert cfg.no_progress_block_after == 5
 
 
 def test_config_parses_nested_warn_and_hard_stop_thresholds():
@@ -63,6 +75,29 @@ def test_config_parses_nested_warn_and_hard_stop_thresholds():
     assert cfg.no_progress_block_after == 8
 
 
+def test_gateway_platform_defaults_to_hard_stop_without_changing_interactive_defaults():
+    interactive_configs = [
+        ToolCallGuardrailConfig.from_mapping({}, platform=platform)
+        for platform in ("cli", "tui", "desktop", "acp")
+    ]
+    telegram_cfg = ToolCallGuardrailConfig.from_mapping({}, platform="telegram")
+    cron_cfg = ToolCallGuardrailConfig.from_mapping({}, platform="cron")
+
+    assert all(cfg.hard_stop_enabled is False for cfg in interactive_configs)
+    assert telegram_cfg.hard_stop_enabled is True
+    assert cron_cfg.hard_stop_enabled is True
+
+
+def test_non_interactive_hard_stop_can_be_disabled_explicitly():
+    cfg = ToolCallGuardrailConfig.from_mapping(
+        {"non_interactive_hard_stop_enabled": False},
+        platform="telegram",
+    )
+
+    assert cfg.hard_stop_enabled is False
+    assert cfg.non_interactive_hard_stop_enabled is False
+
+
 def test_default_repeated_identical_failed_call_warns_without_blocking():
     controller = ToolCallGuardrailController()
     args = {"query": "same"}
@@ -119,6 +154,41 @@ def test_hard_stop_enabled_blocks_repeated_exact_failure_before_next_execution()
 
 
 
+def test_skill_read_tools_are_idempotent_and_block_repeated_identical_success_output():
+    cases = [
+        (
+            "skill_view",
+            {"name": "gui-agent-ml-operations"},
+            '{"success":true,"name":"gui-agent-ml-operations","content":"same"}',
+        ),
+        (
+            "skills_list",
+            {"category": "mlops"},
+            '{"success":true,"skills":[{"name":"gui-agent-ml-operations"}]}',
+        ),
+    ]
+
+    for tool_name, args, result in cases:
+        controller = ToolCallGuardrailController(
+            ToolCallGuardrailConfig(
+                hard_stop_enabled=True,
+                no_progress_warn_after=2,
+                no_progress_block_after=2,
+            )
+        )
+
+        assert controller.before_call(tool_name, args).action == "allow"
+        assert controller.after_call(tool_name, args, result, failed=False).action == "allow"
+        assert controller.before_call(tool_name, args).action == "allow"
+        warn = controller.after_call(tool_name, args, result, failed=False)
+        assert warn.action == "warn"
+        assert warn.code == "idempotent_no_progress_warning"
+
+        blocked = controller.before_call(tool_name, args)
+        assert blocked.action == "block"
+        assert blocked.code == "idempotent_no_progress_block"
+
+
 def test_mutating_or_unknown_tools_are_not_blocked_for_repeated_identical_success_output_by_default():
     controller = ToolCallGuardrailController(
         ToolCallGuardrailConfig(no_progress_warn_after=2, no_progress_block_after=2)
@@ -131,6 +201,49 @@ def test_mutating_or_unknown_tools_are_not_blocked_for_repeated_identical_succes
         assert controller.after_call("custom_tool", {"x": 1}, "ok", failed=False).action == "allow"
 
 
+def test_identical_call_streak_halts_any_tool_when_hard_stop_enabled():
+    # #89069 / #100849 bundle: a model replaying the same SUCCESSFUL
+    # terminal/skill_view call with a byte-identical result is not covered by
+    # the idempotent_tools no-progress block. The consecutive-identical
+    # streak (observe_call) is tool-agnostic; under hard_stop it must halt.
+    controller = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(hard_stop_enabled=True, no_progress_block_after=5)
+    )
+    args = {"command": "hermes config get memory.provider"}
+    for i in range(1, 5):
+        controller.after_call("terminal", args, "local\n", failed=False)
+        controller.observe_call("terminal", args, "local\n", failed=False)
+        assert controller.halt_decision is None, f"halted early at {i}"
+
+    controller.after_call("terminal", args, "local\n", failed=False)
+    controller.observe_call("terminal", args, "local\n", failed=False)
+    halt = controller.halt_decision
+    assert halt is not None and halt.should_halt
+    assert halt.code == "identical_call_streak_halt"
+    assert halt.tool_name == "terminal" and halt.count == 5
+
+
+def test_identical_call_streak_never_halts_when_hard_stop_disabled_or_for_pollers():
+    soft = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(hard_stop_enabled=False, no_progress_block_after=2)
+    )
+    for _ in range(6):
+        soft.observe_call("terminal", {"command": "ls"}, "a\nb\n", failed=False)
+    assert soft.halt_decision is None  # notice-only in interactive sessions
+
+    hard = ToolCallGuardrailController(
+        ToolCallGuardrailConfig(hard_stop_enabled=True, no_progress_block_after=2)
+    )
+    for _ in range(6):
+        hard.observe_call("process_manage", {"action": "poll", "session_id": "p1"}, "running", failed=False)
+    assert hard.halt_decision is None  # an unchanged poll is legitimate progress
+
+    # A changed result resets the streak.
+    for i in range(6):
+        hard.observe_call("terminal", {"command": "date"}, f"t{i}", failed=False)
+    assert hard.halt_decision is None
+
+
 
 
 
@@ -177,3 +290,89 @@ def test_web_search_cap_blocks_after_limit_regardless_of_hard_stop():
 
 
 
+
+
+# ── Legitimate flows must survive hard stops (Teknium, Sep 2026) ────────────
+# Hard stops default ON for unattended platforms. These pin the flows that
+# must NEVER be cut off there: edit -> re-run loops, diagnostic sweeps of
+# distinct red commands, and browser retry-after-action — while the pure
+# replay (same call, nothing changed between attempts) is still stopped.
+
+_HARD = lambda: ToolCallGuardrailController(  # noqa: E731
+    ToolCallGuardrailConfig(hard_stop_enabled=True)
+)
+_PYTEST = {"command": "pytest tests/test_x.py -q"}
+_RED = '{"output": "1 failed", "exit_code": 1}'
+
+
+def _run_red(c, args=_PYTEST):
+    assert c.before_call("terminal", args).allows_execution
+    return c.after_call("terminal", args, _RED, failed=True)
+
+
+def test_fix_retest_loop_is_never_hard_stopped():
+    c = _HARD()
+    for i in range(12):
+        d = _run_red(c)
+        assert not d.should_halt, f"halted on red run {i + 1}"
+        # the model edits between runs — a landed mutation is progress
+        c.after_call("patch", {"path": "x.py", "old_string": "a", "new_string": f"b{i}"},
+                     '{"success": true, "diff": "..."}', failed=False)
+    assert c.halt_decision is None
+    assert c.before_call("terminal", _PYTEST).allows_execution
+
+
+def test_pure_replay_with_no_intervening_change_is_still_blocked():
+    c = _HARD()
+    for _ in range(5):
+        _run_red(c)
+    d = c.before_call("terminal", _PYTEST)
+    assert d.action == "block" and d.code == "repeated_exact_failure_block"
+
+
+def test_intervening_mutation_resets_the_replay_streak_only_once():
+    # 4 reds, one edit, then 4 reds with NO edit: the second run of 4 is a
+    # fresh streak, and the 5th unchanged retry after it is blocked.
+    c = _HARD()
+    for _ in range(4):
+        _run_red(c)
+    c.after_call("write_file", {"path": "x.py", "content": "y"}, '{"bytes_written": 1}', failed=False)
+    for _ in range(5):
+        assert c.before_call("terminal", _PYTEST).allows_execution
+        c.after_call("terminal", _PYTEST, _RED, failed=True)
+    assert c.before_call("terminal", _PYTEST).action == "block"
+
+
+def test_distinct_failing_terminal_commands_warn_but_never_halt():
+    # A diagnostic sweep: grep with no matches, missing binaries, red builds.
+    c = _HARD()
+    for i in range(12):
+        args = {"command": f"grep -q needle{i} haystack.txt"}
+        d = c.after_call("terminal", args, _RED, failed=True)
+        assert not d.should_halt, f"same_tool halt on distinct command #{i + 1}"
+    assert c.halt_decision is None
+    # ...while a non-tolerant tool failing 8 distinct ways still halts.
+    c2 = _HARD()
+    last = None
+    for i in range(8):
+        last = c2.after_call("send_message", {"to": f"u{i}"}, '{"error": "no route"}', failed=True)
+    assert last.should_halt and last.code == "same_tool_failure_halt"
+
+
+def test_browser_retry_after_action_is_not_a_replay():
+    c = _HARD()
+    nav = {"url": "https://example.test/app"}
+    for _ in range(8):
+        assert c.before_call("browser_navigate", nav).allows_execution
+        c.after_call("browser_navigate", nav, '{"error": "timeout"}', failed=True)
+        c.after_call("browser_click", {"selector": "#retry"}, '{"ok": true}', failed=False)
+    assert c.halt_decision is None
+
+
+def test_supervised_task_platforms_keep_warning_only_default():
+    for platform in ("subagent", "api_server", "cli"):
+        cfg = ToolCallGuardrailConfig.from_mapping({}, platform=platform)
+        assert cfg.hard_stop_enabled is False, platform
+    for platform in ("telegram", "discord", "cron", "kanban"):
+        cfg = ToolCallGuardrailConfig.from_mapping({}, platform=platform)
+        assert cfg.hard_stop_enabled is True, platform
diff --git a/tests/agent/test_turn_base_display_anchor.py b/tests/agent/test_turn_base_display_anchor.py
new file mode 100644
index 0000000000..6c1a6f1183
--- /dev/null
+++ b/tests/agent/test_turn_base_display_anchor.py
@@ -0,0 +1,201 @@
+"""Turn-base display anchor: the context meter shows durable-transcript cost.
+
+On reasoning models a long tool loop replays the current turn's thinking +
+scaffolding on every request, so the LAST request's ``prompt_tokens`` can
+exceed the durable transcript by hundreds of K — all of which evaporates at
+the turn boundary. Display surfaces (CLI status bar, /context breakdown)
+therefore anchor on the turn's FIRST response (``_turn_base_usage_anchor``)
+plus a stale-thinking-free delta estimate, instead of the raw last-request
+figure. Compression trigger math is unchanged (real last-request usage).
+
+Covers:
+  * anchored_context_tokens(charge_stale_thinking=False) excludes stale
+    reasoning text in the delta while keeping the newest assistant turn;
+  * the CLI status snapshot prefers the turn-base anchored figure over
+    compressor.last_prompt_tokens and falls back cleanly without an anchor;
+  * compute_session_context_breakdown prefers the turn-base anchor over the
+    last-response anchor;
+  * invalidation sites clear _turn_base_usage_anchor alongside _usage_anchor.
+"""
+
+from types import SimpleNamespace
+
+from agent.model_metadata import (
+    anchored_context_tokens,
+    capture_usage_anchor,
+    estimate_messages_tokens_rough,
+)
+
+
+def _msg(role, content, **extra):
+    m = {"role": role, "content": content}
+    m.update(extra)
+    return m
+
+
+class TestChargeStaleThinkingKwarg:
+    def test_delta_excludes_stale_reasoning(self):
+        messages = [_msg("user", "start"), _msg("assistant", "base reply")]
+        anchor = capture_usage_anchor(10_000, 100, messages)
+        assert anchor is not None
+
+        # Simulate a tool loop appending reasoning-heavy assistant turns.
+        big_thinking = "deliberation " * 5_000  # ~65K chars ≈ 16K tokens
+        messages.append(_msg("assistant", "the anchored reply itself"))
+        messages.append(
+            _msg("assistant", "step one", reasoning_content=big_thinking)
+        )
+        messages.append(_msg("tool", "tool output", tool_call_id="c1"))
+        messages.append(
+            _msg("assistant", "step two", reasoning_content=big_thinking)
+        )
+
+        charged = anchored_context_tokens(messages, anchor)
+        uncharged = anchored_context_tokens(
+            messages, anchor, charge_stale_thinking=False
+        )
+        assert charged is not None and uncharged is not None
+        # Stale thinking on the non-newest assistant message is excluded;
+        # the newest assistant message keeps its reasoning charge.
+        one_thinking_tokens = estimate_messages_tokens_rough(
+            [_msg("assistant", "", reasoning_content=big_thinking)]
+        )
+        assert charged - uncharged >= one_thinking_tokens * 0.9
+        assert uncharged >= 10_000 + 100  # anchor base still counted exactly
+
+    def test_default_remains_full_charge(self):
+        messages = [_msg("user", "s"), _msg("assistant", "r")]
+        anchor = capture_usage_anchor(1_000, 10, messages)
+        messages.append(_msg("assistant", "reply"))
+        assert anchored_context_tokens(messages, anchor) == anchored_context_tokens(
+            messages, anchor, charge_stale_thinking=True
+        )
+
+
+class TestCliStatusSnapshotPrefersTurnBaseAnchor:
+    def _agent_with(self, last_prompt_tokens, messages, anchor):
+        compressor = SimpleNamespace(
+            last_prompt_tokens=last_prompt_tokens,
+            context_length=1_000_000,
+            compression_count=0,
+        )
+        return SimpleNamespace(
+            context_compressor=compressor,
+            _session_messages=messages,
+            _turn_base_usage_anchor=anchor,
+        )
+
+    def _snapshot_context_tokens(self, agent):
+        """Mirror the cli.py snapshot block's context_tokens resolution."""
+        compressor = agent.context_compressor
+        context_tokens = getattr(compressor, "last_prompt_tokens", 0) or 0
+        if context_tokens < 0:
+            context_tokens = 0
+        msgs = getattr(agent, "_session_messages", None)
+        anchored = anchored_context_tokens(
+            msgs if isinstance(msgs, list) else [],
+            getattr(agent, "_turn_base_usage_anchor", None),
+            charge_stale_thinking=False,
+        )
+        if anchored is not None and anchored > 0:
+            context_tokens = anchored
+        return context_tokens
+
+    def test_turn_base_anchor_wins_over_inflated_last_request(self):
+        messages = [_msg("user", "start"), _msg("assistant", "reply")]
+        anchor = capture_usage_anchor(600_000, 500, messages)
+        messages.append(_msg("assistant", "anchored reply"))
+        agent = self._agent_with(850_000, messages, anchor)
+        # Bar shows the durable figure, not the inflated last request.
+        tokens = self._snapshot_context_tokens(agent)
+        assert 600_000 <= tokens < 650_000
+
+    def test_fallback_without_anchor(self):
+        agent = self._agent_with(123_456, [_msg("user", "x")], None)
+        assert self._snapshot_context_tokens(agent) == 123_456
+
+    def test_stale_anchor_falls_back(self):
+        messages = [_msg("user", "start"), _msg("assistant", "reply")]
+        anchor = capture_usage_anchor(50_000, 10, messages)
+        agent = self._agent_with(77_000, [_msg("user", "rebuilt")], anchor)
+        # Compaction rebuilt the list: structural check fails, raw fallback.
+        assert self._snapshot_context_tokens(agent) == 77_000
+
+    def test_negative_sentinel_still_clamped(self):
+        agent = self._agent_with(-1, [], None)
+        assert self._snapshot_context_tokens(agent) == 0
+
+
+class TestContextBreakdownPrefersTurnBaseAnchor:
+    def test_breakdown_uses_turn_base_over_last_response(self, monkeypatch):
+        from agent import context_breakdown as cb
+
+        messages = [_msg("user", "start"), _msg("assistant", "reply")]
+        turn_base = capture_usage_anchor(400_000, 200, messages)
+        messages.append(_msg("assistant", "anchored reply"))
+        last_anchor = capture_usage_anchor(900_000, 50, messages)
+
+        agent = SimpleNamespace(
+            _usage_anchor=last_anchor,
+            _turn_base_usage_anchor=turn_base,
+            _memory_store=None,
+            tools=[],
+            model="test/model",
+            context_compressor=SimpleNamespace(
+                context_length=1_000_000, last_prompt_tokens=900_000
+            ),
+        )
+        monkeypatch.setattr(
+            "agent.system_prompt.build_system_prompt_parts",
+            lambda a: {"stable": "sys", "context": "", "volatile": ""},
+        )
+        payload = cb.compute_session_context_breakdown(agent, messages)
+        assert 400_000 <= payload["context_used"] < 450_000
+
+    def test_breakdown_falls_back_to_last_response_anchor(self, monkeypatch):
+        from agent import context_breakdown as cb
+
+        messages = [_msg("user", "start"), _msg("assistant", "reply")]
+        last_anchor = capture_usage_anchor(300_000, 50, messages)
+
+        agent = SimpleNamespace(
+            _usage_anchor=last_anchor,
+            _turn_base_usage_anchor=None,
+            _memory_store=None,
+            tools=[],
+            model="test/model",
+            context_compressor=SimpleNamespace(
+                context_length=1_000_000, last_prompt_tokens=1
+            ),
+        )
+        monkeypatch.setattr(
+            "agent.system_prompt.build_system_prompt_parts",
+            lambda a: {"stable": "sys", "context": "", "volatile": ""},
+        )
+        payload = cb.compute_session_context_breakdown(agent, messages)
+        assert payload["context_used"] >= 300_000
+
+
+class TestInvalidationSitesClearTurnBaseAnchor:
+    def test_compression_invalidation_clears_both(self):
+        import inspect
+        from agent import conversation_compression
+
+        src = inspect.getsource(conversation_compression)
+        block = src.split("agent._usage_anchor = None", 1)[1][:200]
+        assert "_turn_base_usage_anchor = None" in block
+
+    def test_codex_native_invalidation_clears_both(self):
+        import inspect
+        from agent import codex_runtime
+
+        src = inspect.getsource(codex_runtime)
+        block = src.split("agent._usage_anchor = None", 1)[1][:200]
+        assert "_turn_base_usage_anchor = None" in block
+
+    def test_agent_init_defines_turn_base_anchor(self):
+        import inspect
+        from agent import agent_init
+
+        src = inspect.getsource(agent_init)
+        assert "_turn_base_usage_anchor = None" in src
diff --git a/tests/ci/test_classify_changes.py b/tests/ci/test_classify_changes.py
index 81e93d6809..43e33dd620 100644
--- a/tests/ci/test_classify_changes.py
+++ b/tests/ci/test_classify_changes.py
@@ -41,13 +41,14 @@ DEFAULT = {
     "uv_lock": True,
     "npm_lock": True,
     "installer": True,
+    "desktop_updater": True,
     "rust": True,
     "mcp_catalog": False,
     "ci_review": True,
 }
 
 
-def _lanes(python=False, frontend=False, site=False, scan=False, deps=False, uv_lock=False, npm_lock=False, installer=False, rust=False, mcp_catalog=False, docker_meta=False, ci_review=False, python_prod=None, nix=None, docker=None) -> dict[str, bool]:
+def _lanes(python=False, frontend=False, site=False, scan=False, deps=False, uv_lock=False, npm_lock=False, installer=False, desktop_updater=False, rust=False, mcp_catalog=False, docker_meta=False, ci_review=False, python_prod=None, nix=None, docker=None) -> dict[str, bool]:
     # python_prod tracks python except for tests-only diffs; default it to
     # python so the majority of cases don't need to spell it out.
     #
@@ -69,6 +70,7 @@ def _lanes(python=False, frontend=False, site=False, scan=False, deps=False, uv_
         "uv_lock": uv_lock,
         "npm_lock": npm_lock,
         "installer": installer,
+        "desktop_updater": desktop_updater,
         "rust": rust,
         "mcp_catalog": mcp_catalog,
         "ci_review": ci_review,
@@ -78,7 +80,9 @@ def _lanes(python=False, frontend=False, site=False, scan=False, deps=False, uv_
 CASES = {
     "docs-only → nothing heavy": (["README.md", "docs/guide.md"], _lanes()),
     "python source → python": (["run_agent.py"], _lanes(python=True, scan=True)),
-    "dep manifest → python": (["pyproject.toml"], _lanes(python=True, scan=True, deps=True, uv_lock=True)),
+    # pyproject.toml declares the pytest markers the OS lanes select on, so it
+    # also re-arms the desktop_updater integration tests (fail-open).
+    "dep manifest → python": (["pyproject.toml"], _lanes(python=True, scan=True, deps=True, uv_lock=True, desktop_updater=True)),
     "uv.lock → python": (["uv.lock"], _lanes(python=True, uv_lock=True)),
     "ts package → frontend": (["apps/desktop/src/app.tsx"], _lanes(frontend=True)),
     "ui-tui → frontend": (["ui-tui/src/entry.ts"], _lanes(frontend=True)),
@@ -141,6 +145,23 @@ CASES = {
         _lanes(python=True, installer=True),
     ),
     "python source alone → no installer lane": (["run_agent.py"], _lanes(python=True, scan=True)),
+    # The Windows desktop-update hand-off is a PowerShell integration surface:
+    # its tests spawn the real script and poll its loopback server. They run
+    # when the script, the Electron side that launches it, or their own test
+    # files change — not on every hermes_state.py PR.
+    "windows.ps1 → desktop_updater": (
+        ["scripts/desktop-update/windows.ps1"],
+        _lanes(python=True, desktop_updater=True),
+    ),
+    "desktop-update test → desktop_updater": (
+        ["tests/test_desktop_update_windows_progress.py"],
+        _lanes(python=True, python_prod=False, scan=True, desktop_updater=True),
+    ),
+    "updater-process.ts → desktop_updater": (
+        ["apps/desktop/electron/updater-process.ts"],
+        _lanes(frontend=True, desktop_updater=True),
+    ),
+    "python source alone → no desktop_updater lane": (["hermes_state.py"], _lanes(python=True, scan=True)),
     # `.rs` lives under apps/, so it matches `frontend` too. That lane builds
     # TypeScript and cannot notice a Rust error — before `rust` existed it was
     # the ONLY lane a Rust change ran, and the crate's tests never executed.
@@ -168,9 +189,15 @@ CASES = {
     # tests-only diffs: pytest lanes stay ON, product jobs (Desktop E2E,
     # Docker) gate on python_prod and skip.
     "tests-only → python without python_prod": (
-        ["tests/agent/test_foo.py", "tests/conftest.py"],
+        ["tests/agent/test_foo.py"],
         _lanes(python=True, python_prod=False, scan=True),
     ),
+    # conftest.py owns the _OS_MARKS skip logic, so it re-arms the
+    # desktop_updater integration tests too (fail-open).
+    "conftest → python + desktop_updater": (
+        ["tests/conftest.py"],
+        _lanes(python=True, python_prod=False, scan=True, desktop_updater=True),
+    ),
     "tests + prod source → both lanes": (
         ["tests/agent/test_foo.py", "agent/x.py"],
         _lanes(python=True, scan=True),
diff --git a/tests/cli/test_cli_clarify_batch.py b/tests/cli/test_cli_clarify_batch.py
index c839780bbb..a19575956c 100644
--- a/tests/cli/test_cli_clarify_batch.py
+++ b/tests/cli/test_cli_clarify_batch.py
@@ -341,3 +341,33 @@ class TestClarifyBatchNavigation:
         thread.join(timeout=2)
         assert result["value"] == {"answers": {"q0": "red", "q1": "small"}}
 
+
+
+class TestClarifyBellOnPrompt:
+    """display.bell_on_prompt rings BEL when a clarify modal opens; off is silent."""
+
+    @staticmethod
+    def _run_clarify(bell_on_prompt):
+        import io
+
+        cli = _make_cli_stub()
+        cli.bell_on_prompt = bell_on_prompt
+        out = io.StringIO()
+        with patch("cli.sys.stdout", out), patch(
+            "tools.clarify_gateway.resolve_clarify_timeout", return_value=60
+        ):
+            thread = threading.Thread(
+                target=cli._clarify_callback, args=("Color?", ["red", "blue"]), daemon=True
+            )
+            thread.start()
+            deadline = time.time() + 2
+            while cli._clarify_state is None and time.time() < deadline:
+                time.sleep(0.01)
+            assert cli._clarify_state is not None
+            cli._clarify_state["response_queue"].put("red")
+            thread.join(timeout=2)
+        return out.getvalue()
+
+    def test_bell_on_prompt_rings_and_off_is_silent(self):
+        assert "\a" in self._run_clarify(True)
+        assert "\a" not in self._run_clarify(False)
diff --git a/tests/cli/test_cli_init.py b/tests/cli/test_cli_init.py
index cca40f831e..059508991f 100644
--- a/tests/cli/test_cli_init.py
+++ b/tests/cli/test_cli_init.py
@@ -465,6 +465,25 @@ class TestNestedDictModelDefaultPairing:
         assert "unrestricted" in output
         assert "Slash commands: all available" in output
 
+    def test_provider_prefixed_startup_model_overrides_stale_provider(self):
+        cli = _make_cli(
+            config_overrides={
+                "model": {
+                    "default": "anthropic/claude-opus-4.6",
+                    "provider": "anthropic",
+                },
+                "providers": {
+                    "nous": {
+                        "base_url": "https://inference-api.nousresearch.com/v1",
+                    },
+                },
+            },
+            model="nous/deepseek-v4-pro",
+        )
+
+        assert cli.model == "deepseek-v4-pro"
+        assert cli.requested_provider == "nous"
+
 
 class TestRootLevelProviderOverride:
     """Root-level provider/base_url in config.yaml must NOT override model.provider."""
diff --git a/tests/cli/test_fast_command.py b/tests/cli/test_fast_command.py
index 87a6b2689c..203dfe329d 100644
--- a/tests/cli/test_fast_command.py
+++ b/tests/cli/test_fast_command.py
@@ -159,8 +159,8 @@ class TestFastModeRouting(unittest.TestCase):
         stub = SimpleNamespace(
             model="gpt-5.4",
             api_key="primary-key",
-            base_url="https://openrouter.ai/api/v1",
-            provider="openrouter",
+            base_url="https://api.openai.com/v1",
+            provider="openai",
             api_mode="chat_completions",
             acp_command=None,
             acp_args=[],
@@ -171,11 +171,16 @@ class TestFastModeRouting(unittest.TestCase):
         route = cli_mod.HermesCLI._resolve_turn_agent_config(stub, "hi")
 
         # Provider should NOT have changed
-        assert route["runtime"]["provider"] == "openrouter"
+        assert route["runtime"]["provider"] == "openai"
         assert route["runtime"]["api_mode"] == "chat_completions"
         # But request_overrides should be set
         assert route["request_overrides"] == {"service_tier": "priority"}
 
+        # Proxied routes (OpenRouter etc.) strip/400 on the param — never sent.
+        stub.base_url = "https://openrouter.ai/api/v1"
+        stub.provider = "openrouter"
+        assert cli_mod.HermesCLI._resolve_turn_agent_config(stub, "hi")["request_overrides"] is None
+
     def test_turn_route_keeps_primary_runtime_when_model_has_no_fast_backend(self):
         cli_mod = _import_cli()
         stub = SimpleNamespace(
@@ -202,28 +207,36 @@ class TestAnthropicFastMode(unittest.TestCase):
     def test_anthropic_opus_supported(self):
         from hermes_cli.models import model_supports_fast_mode
 
+        # Per the live fast-mode docs: Opus 4.8 + Opus 5, Claude API only.
         # Native Anthropic format (hyphens)
-        assert model_supports_fast_mode("claude-opus-4-6") is True
+        assert model_supports_fast_mode("claude-opus-4-8") is True
         # OpenRouter format (dots)
-        assert model_supports_fast_mode("claude-opus-4.6") is True
+        assert model_supports_fast_mode("claude-opus-4.8") is True
         # With vendor prefix
-        assert model_supports_fast_mode("anthropic/claude-opus-4-6") is True
-        assert model_supports_fast_mode("anthropic/claude-opus-4.6") is True
+        assert model_supports_fast_mode("anthropic/claude-opus-4-8") is True
+        assert model_supports_fast_mode("anthropic/claude-opus-4.8") is True
+        assert model_supports_fast_mode("claude-opus-5") is True
+        assert model_supports_fast_mode("anthropic/claude-opus-5") is True
 
-    def test_anthropic_non_opus46_models_excluded(self):
-        """The speed=fast parameter is gated to Opus 4.6 — others excluded.
+    def test_anthropic_unsupported_models_excluded(self):
+        """The speed=fast parameter is gated to Opus 4.8 / Opus 5.
 
-        Per https://platform.claude.com/docs/en/build-with-claude/fast-mode,
-        sending speed=fast to Opus 4.7, Sonnet, or Haiku returns HTTP 400.
-        Opus 4.8 uses a separate ``…-fast`` model id, not this parameter.
+        Per https://platform.claude.com/docs/en/build-with-claude/fast-mode:
+        Opus 4.6 LOST fast mode 2026-06-29 (the param is silently ignored —
+        standard speed at standard billing — so a toggle would do nothing);
+        Opus 4.7 hard-400s; Sonnet/Haiku never had it; dedicated ``…-fast``
+        ids select fast inference via the model field, not the parameter.
         """
         from hermes_cli.models import model_supports_fast_mode
 
         assert model_supports_fast_mode("claude-sonnet-4-6") is False
         assert model_supports_fast_mode("claude-sonnet-4.6") is False
         assert model_supports_fast_mode("claude-haiku-4-5") is False
+        assert model_supports_fast_mode("claude-opus-4-6") is False
+        assert model_supports_fast_mode("claude-opus-4.6") is False
         assert model_supports_fast_mode("claude-opus-4-7") is False
-        assert model_supports_fast_mode("claude-opus-4-8") is False
+        assert model_supports_fast_mode("claude-opus-4-8-fast") is False
+        assert model_supports_fast_mode("anthropic/claude-opus-4.8-fast") is False
         assert model_supports_fast_mode("anthropic/claude-sonnet-4.6") is False
         assert model_supports_fast_mode("anthropic/claude-opus-4-7") is False
 
@@ -232,10 +245,10 @@ class TestAnthropicFastMode(unittest.TestCase):
     def test_resolve_overrides_returns_speed_for_anthropic(self):
         from hermes_cli.models import resolve_fast_mode_overrides
 
-        result = resolve_fast_mode_overrides("claude-opus-4-6")
+        result = resolve_fast_mode_overrides("claude-opus-4-8")
         assert result == {"speed": "fast"}
 
-        result = resolve_fast_mode_overrides("anthropic/claude-opus-4.6")
+        result = resolve_fast_mode_overrides("anthropic/claude-opus-4.8")
         assert result == {"speed": "fast"}
 
 
@@ -243,7 +256,7 @@ class TestAnthropicFastMode(unittest.TestCase):
 
 
     def test_fast_command_hidden_for_anthropic_sonnet(self):
-        """Sonnet doesn't support fast mode (Opus 4.6 only) — /fast must be hidden."""
+        """Sonnet doesn't support fast mode (Opus 4.8/5 only) — /fast must be hidden."""
         cli_mod = _import_cli()
         stub = SimpleNamespace(
             provider="anthropic", requested_provider="anthropic",
@@ -257,7 +270,7 @@ class TestAnthropicFastMode(unittest.TestCase):
         """Anthropic models should get speed:'fast' override, not service_tier."""
         cli_mod = _import_cli()
         stub = SimpleNamespace(
-            model="claude-opus-4-6",
+            model="claude-opus-4-8",
             api_key="sk-ant-test",
             base_url="https://api.anthropic.com",
             provider="anthropic",
@@ -281,7 +294,7 @@ class TestAnthropicFastModeAdapter(unittest.TestCase):
         from agent.anthropic_adapter import build_anthropic_kwargs, _FAST_MODE_BETA
 
         kwargs = build_anthropic_kwargs(
-            model="claude-opus-4-6",
+            model="claude-opus-4-8",
             messages=[{"role": "user", "content": [{"type": "text", "text": "hi"}]}],
             tools=None,
             max_tokens=None,
@@ -297,7 +310,7 @@ class TestAnthropicFastModeAdapter(unittest.TestCase):
         from agent.anthropic_adapter import build_anthropic_kwargs
 
         kwargs = build_anthropic_kwargs(
-            model="claude-opus-4-6",
+            model="claude-opus-4-8",
             messages=[{"role": "user", "content": [{"type": "text", "text": "hi"}]}],
             tools=None,
             max_tokens=None,
@@ -312,7 +325,7 @@ class TestAnthropicFastModeAdapter(unittest.TestCase):
         from agent.anthropic_adapter import build_anthropic_kwargs
 
         kwargs = build_anthropic_kwargs(
-            model="claude-opus-4-6",
+            model="claude-opus-4-8",
             messages=[{"role": "user", "content": [{"type": "text", "text": "hi"}]}],
             tools=None,
             max_tokens=None,
diff --git a/tests/cli/test_personality_none.py b/tests/cli/test_personality_none.py
index ba4847607c..5a8752122c 100644
--- a/tests/cli/test_personality_none.py
+++ b/tests/cli/test_personality_none.py
@@ -87,7 +87,6 @@ class TestGatewayPersonalityNone:
     def _make_runner(self, personalities=None):
         from gateway.run import GatewayRunner
         runner = GatewayRunner.__new__(GatewayRunner)
-        runner._ephemeral_system_prompt = "You are kawaii~"
         runner.config = {
             "agent": {
                 "personalities": personalities or {"helpful": "You are helpful."}
@@ -125,7 +124,9 @@ class TestGatewayPersonalityNone:
         saved = yaml.safe_load(config_file.read_text())
         assert saved["agent"]["system_prompt"] == "manual forever"
         assert saved.get("display", {}).get("personality", None) == ""
-        assert runner._ephemeral_system_prompt == "manual forever"
+        # The next turn re-resolves from config (no in-memory snapshot).
+        with p1, p2:
+            assert runner._get_system_prompt_for_channel(None, "c") == "manual forever"
 
     @pytest.mark.asyncio
     async def test_set_persists_display_personality_not_system_prompt(self, tmp_path):
@@ -147,7 +148,8 @@ class TestGatewayPersonalityNone:
         saved = yaml.safe_load(config_file.read_text())
         assert saved["agent"]["system_prompt"] == "manual forever"
         assert saved["display"]["personality"] == "helpful"
-        assert runner._ephemeral_system_prompt == "You are helpful."
+        with p1, p2:
+            assert runner._get_system_prompt_for_channel(None, "c") == "You are helpful."
         assert "helpful" in result.lower()
 
     @pytest.mark.asyncio
diff --git a/tests/cli/test_resume_display.py b/tests/cli/test_resume_display.py
index 3c8755c31b..e1c8fb2e5b 100644
--- a/tests/cli/test_resume_display.py
+++ b/tests/cli/test_resume_display.py
@@ -323,6 +323,27 @@ class TestPreloadResumedSession:
         assert "safe resume limit is 20000" in output.getvalue()
         mock_db.get_resume_conversations.assert_not_called()
 
+    def test_tip_only_guard_goes_through_the_shared_resume_guard(self):
+        """The mid-setup path loads only the tip, so it asks the ONE resume
+        guard for a tip-only bound instead of borrowing the export guard."""
+        from hermes_state import SessionResumeTooLargeError
+
+        cli = _make_cli(resume="deep-lineage")
+        cli.session_id = "deep-lineage"
+        mock_db = MagicMock()
+        guard = MagicMock(return_value=666)
+        mock_db.assert_resume_safe = guard
+        cli._session_db = mock_db
+
+        assert cli._resume_history_limit_error(tip_only=True) is None
+        guard.assert_called_once_with("deep-lineage", tip_only=True)
+
+        guard.side_effect = SessionResumeTooLargeError(
+            20_001, 20_000, scope="in its tip segment"
+        )
+        error = cli._resume_history_limit_error(tip_only=True)
+        assert error and "in its tip segment" in error
+
 
 
 # ── Tests for _handle_resume_command recap display ───────────────────
diff --git a/tests/conftest.py b/tests/conftest.py
index ffa5e7b928..e4dfb0ed06 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -186,7 +186,7 @@ _CREDENTIAL_NAMES = frozenset({
     "FIRECRAWL_API_KEY",
     "PARALLEL_API_KEY",
     "EXA_API_KEY",
-    "TAVILY_API_KEY",  # removed backend; still blanked for hermeticity
+    "TAVILY_API_KEY",
     "WANDB_API_KEY",
     "ELEVENLABS_API_KEY",
     "HONCHO_API_KEY",
diff --git a/tests/cron/test_cleanup_timeout.py b/tests/cron/test_cleanup_timeout.py
index 6d17502e34..6b967afc2a 100644
--- a/tests/cron/test_cleanup_timeout.py
+++ b/tests/cron/test_cleanup_timeout.py
@@ -70,8 +70,8 @@ def test_run_job_bounds_sessiondb_finalization(tmp_path):
             success, _output, final_response, error = run_job(job)
             elapsed = time.monotonic() - started
 
-        assert fake_db.entered.wait(timeout=0.5)
-        assert elapsed < 0.5
+        assert fake_db.entered.wait(timeout=2.0)
+        assert elapsed < 5.0
         assert success is True
         assert final_response == "ok"
         assert error is None
@@ -88,8 +88,8 @@ def test_agent_teardown_is_bounded():
         _teardown_cron_agent(agent, "cleanup-agent-hang", timeout_seconds=0.02)
         elapsed = time.monotonic() - started
 
-        assert agent.entered.wait(timeout=0.5)
-        assert elapsed < 0.5
+        assert agent.entered.wait(timeout=2.0)
+        assert elapsed < 5.0
     finally:
         release.set()
 
diff --git a/tests/cron/test_cron_drift_alert_once.py b/tests/cron/test_cron_drift_alert_once.py
index a6014f2591..c3e57eab29 100644
--- a/tests/cron/test_cron_drift_alert_once.py
+++ b/tests/cron/test_cron_drift_alert_once.py
@@ -48,7 +48,7 @@ def _tick(job, tmp_path, current_provider, deliveries):
     """Run one run_one_job tick with the provider resolution pinned."""
     fake_db = MagicMock()
 
-    def fake_deliver(job, content, adapters=None, loop=None):
+    def fake_deliver(job, content, adapters=None, loop=None, **kwargs):
         deliveries.append(content)
         return None
 
@@ -129,7 +129,7 @@ class TestDriftAlertOnce:
         job = _job(provider_snapshot=None, drift_alerted=True)
         deliveries = []
 
-        def fake_deliver(jb, content, adapters=None, loop=None):
+        def fake_deliver(jb, content, adapters=None, loop=None, **kwargs):
             deliveries.append(content)
             return None
 
diff --git a/tests/cron/test_cron_failure_deliver.py b/tests/cron/test_cron_failure_deliver.py
new file mode 100644
index 0000000000..1695447ad0
--- /dev/null
+++ b/tests/cron/test_cron_failure_deliver.py
@@ -0,0 +1,462 @@
+"""Per-job ``failure_deliver`` routing (NS-788).
+
+A job's FAILURE notices (run failed, escaped scheduler exception, drift-skip /
+blocked-config alerts) resolve their delivery targets from ``failure_deliver``
+when the job sets it, falling back to ``deliver`` when unset — so existing
+jobs behave byte-identically. ``failure_deliver: local`` is structural silence
+for failures: nothing is sent, but state (last_status, run history, output
+file) is still recorded. Success-path delivery never reads ``failure_deliver``.
+
+The grammar is exactly the ``deliver`` grammar — same normalization, same
+validation — reused, not duplicated.
+"""
+
+import json
+
+import pytest
+
+import cron.scheduler as s
+from cron.scheduler import _resolve_delivery_targets
+
+
+@pytest.fixture
+def cron_env(tmp_path, monkeypatch):
+    """Isolated cron environment with temp HERMES_HOME."""
+    hermes_home = tmp_path / ".hermes"
+    hermes_home.mkdir()
+    (hermes_home / "cron").mkdir()
+    (hermes_home / "cron" / "output").mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+
+    import cron.jobs as jobs_mod
+    monkeypatch.setattr(jobs_mod, "HERMES_DIR", hermes_home)
+    monkeypatch.setattr(jobs_mod, "CRON_DIR", hermes_home / "cron")
+    monkeypatch.setattr(jobs_mod, "JOBS_FILE", hermes_home / "cron" / "jobs.json")
+    monkeypatch.setattr(jobs_mod, "OUTPUT_DIR", hermes_home / "cron" / "output")
+
+    return hermes_home
+
+
+@pytest.fixture
+def run_env(monkeypatch, tmp_path):
+    """Drive run_one_job with the REAL delivery path down to a fake sender.
+
+    Bookkeeping primitives are stubbed (recorded), but _deliver_result and
+    _resolve_delivery_targets are the genuine articles — the send that would
+    leave the process is captured at the platform-registry sender seam,
+    exactly where a real slack delivery exits.
+    """
+    home = tmp_path / "hermes-home"
+    home.mkdir()
+    (home / "config.yaml").write_text(
+        "platforms:\n  slack:\n    enabled: true\n    token: xoxb-test\n"
+    )
+    monkeypatch.setenv("HERMES_HOME", str(home))
+
+    send_calls = []
+
+    async def fake_sender(pconfig, chat_id, message, *, thread_id=None,
+                          media_files=None, force_document=False, caption=None):
+        send_calls.append({"chat_id": chat_id, "message": message})
+        return {"success": True, "chat_id": chat_id, "message_id": "1.2"}
+
+    import gateway.platform_registry as reg
+    import hermes_cli.plugins as hp
+
+    entry = reg.platform_registry.get("slack")
+    if entry is None:
+        hp.discover_plugins()
+        entry = reg.platform_registry.get("slack")
+    if entry is None:
+        pytest.skip("slack platform entry not registered")
+    monkeypatch.setattr(entry, "standalone_sender_fn", fake_sender)
+    monkeypatch.setattr(hp, "discover_plugins", lambda *a, **k: None)
+
+    state = {"send": send_calls, "marked": [], "saved": [], "finished": []}
+
+    monkeypatch.setattr(s, "create_execution", lambda *_a, **_kw: {"id": "exec-t"})
+    monkeypatch.setattr(s, "claim_dispatch", lambda _job_id: True)
+    monkeypatch.setattr(s, "mark_execution_running", lambda _execution_id: None)
+    monkeypatch.setattr(
+        s, "save_job_output",
+        lambda jid, out: state["saved"].append(jid) or f"/tmp/{jid}.txt",
+    )
+    monkeypatch.setattr(
+        s, "mark_job_run",
+        lambda *a, **kw: state["marked"].append((a, kw)) or True,
+    )
+    monkeypatch.setattr(
+        s, "finish_execution",
+        lambda *a, **kw: state["finished"].append((a, kw)),
+    )
+    # No durable incident store in play: never acked, no id.
+    monkeypatch.setattr(
+        s, "_upsert_incident_for_failure", lambda *_a, **_kw: (False, None)
+    )
+    monkeypatch.setattr(s, "load_config", lambda: {})
+    return state
+
+
+def _failing_run_job(error="provider exploded"):
+    def _fake(job, **_kw):
+        return (False, "raw output", "", error)
+    return _fake
+
+
+def _succeeding_run_job(final="all good, here is the brief"):
+    def _fake(job, **_kw):
+        return (True, "raw output", final, None)
+    return _fake
+
+
+class TestFailureDeliverRouting:
+    def test_failure_without_failure_deliver_goes_to_deliver_targets(
+        self, run_env, monkeypatch
+    ):
+        """(a) Unset failure_deliver = today's behavior: failure summary to
+        the job's deliver targets."""
+        monkeypatch.setattr(s, "run_job", _failing_run_job())
+
+        s.run_one_job({"id": "j1", "name": "scout", "deliver": "slack:D0MAIN"})
+
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0MAIN"]
+        assert "failed" in run_env["send"][0]["message"].lower()
+
+    def test_failure_deliver_local_is_silent_but_state_is_recorded(
+        self, run_env, monkeypatch
+    ):
+        """(b) failure_deliver: local — no delivery leaves the process, but
+        the run is still saved and marked failed."""
+        monkeypatch.setattr(s, "run_job", _failing_run_job())
+
+        s.run_one_job({
+            "id": "j2", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "local",
+        })
+
+        assert run_env["send"] == []
+        # State recording is untouched by the silence.
+        assert run_env["saved"] == ["j2"]
+        assert len(run_env["marked"]) == 1
+        args, _kw = run_env["marked"][0]
+        assert args[0] == "j2" and args[1] is False
+        assert "provider exploded" in args[2]
+
+    def test_failure_deliver_explicit_target_wins_over_deliver(
+        self, run_env, monkeypatch
+    ):
+        """(c) failure_deliver set to a different target: the failure notice
+        goes THERE, and nothing goes to the deliver target."""
+        monkeypatch.setattr(s, "run_job", _failing_run_job())
+
+        s.run_one_job({
+            "id": "j3", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "slack:D0ALERTS",
+        })
+
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0ALERTS"]
+        assert "failed" in run_env["send"][0]["message"].lower()
+
+    def test_success_ignores_failure_deliver(self, run_env, monkeypatch):
+        """(d) Success output still goes to deliver — failure_deliver is
+        never consulted on the success path."""
+        monkeypatch.setattr(s, "run_job", _succeeding_run_job())
+
+        ok = s.run_one_job({
+            "id": "j4", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "slack:D0ALERTS",
+        })
+
+        assert ok is True
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0MAIN"]
+        assert "all good, here is the brief" in run_env["send"][0]["message"]
+
+
+class TestEscapedExceptionPath:
+    """The scheduler-layer exception handler is the second failure-delivery
+    site — it must honor failure_deliver identically."""
+
+    def _raise_run_job(self, monkeypatch):
+        monkeypatch.setattr(
+            s, "run_job",
+            lambda *_a, **_kw: (_ for _ in ()).throw(
+                RuntimeError("cannot import name X")
+            ),
+        )
+
+    def test_escaped_failure_honors_failure_deliver_target(
+        self, run_env, monkeypatch
+    ):
+        self._raise_run_job(monkeypatch)
+
+        ok = s.run_one_job({
+            "id": "j5", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "slack:D0ALERTS",
+        })
+
+        assert ok is False
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0ALERTS"]
+
+    def test_escaped_failure_with_failure_deliver_local_is_silent(
+        self, run_env, monkeypatch
+    ):
+        self._raise_run_job(monkeypatch)
+
+        ok = s.run_one_job({
+            "id": "j6", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "local",
+        })
+
+        assert ok is False
+        assert run_env["send"] == []
+        # Failure is still recorded.
+        assert len(run_env["marked"]) == 1
+        args, _kw = run_env["marked"][0]
+        assert args[1] is False and "cannot import name X" in args[2]
+
+
+class TestResolutionGrammar:
+    """(e) failure_deliver shares deliver's exact value grammar — the same
+    normalization/expansion path, not a parallel one."""
+
+    def test_for_failure_resolves_failure_deliver_value(self):
+        job = {"deliver": "local", "failure_deliver": "slack:D0ALERTS"}
+        targets = _resolve_delivery_targets(job, for_failure=True)
+        assert [(t["platform"], t["chat_id"]) for t in targets] == [
+            ("slack", "D0ALERTS")
+        ]
+
+    def test_for_failure_falls_back_to_deliver_when_unset(self):
+        job = {"deliver": "slack:D0MAIN"}
+        targets = _resolve_delivery_targets(job, for_failure=True)
+        assert [(t["platform"], t["chat_id"]) for t in targets] == [
+            ("slack", "D0MAIN")
+        ]
+
+    def test_success_resolution_never_reads_failure_deliver(self):
+        job = {"deliver": "slack:D0MAIN", "failure_deliver": "slack:D0ALERTS"}
+        targets = _resolve_delivery_targets(job)
+        assert [(t["platform"], t["chat_id"]) for t in targets] == [
+            ("slack", "D0MAIN")
+        ]
+
+    def test_local_yields_zero_failure_targets(self):
+        job = {"deliver": "slack:D0MAIN", "failure_deliver": "local"}
+        assert _resolve_delivery_targets(job, for_failure=True) == []
+
+    def test_comma_list_and_thread_grammar(self):
+        """The comma-combine + platform:chat:thread forms deliver's grammar
+        supports work identically for failure_deliver."""
+        job = {
+            "deliver": "local",
+            "failure_deliver": "slack:D0ALERTS,telegram:-1001:17",
+        }
+        targets = _resolve_delivery_targets(job, for_failure=True)
+        assert [(t["platform"], t["chat_id"], t.get("thread_id")) for t in targets] == [
+            ("slack", "D0ALERTS", None),
+            ("telegram", "-1001", "17"),
+        ]
+
+    def test_legacy_list_value_is_flattened_like_deliver(self):
+        """Same list/tuple tolerance _normalize_deliver_value grants deliver."""
+        job = {"deliver": "local", "failure_deliver": ["slack:D0ALERTS"]}
+        targets = _resolve_delivery_targets(job, for_failure=True)
+        assert [(t["platform"], t["chat_id"]) for t in targets] == [
+            ("slack", "D0ALERTS")
+        ]
+
+
+class TestToolSurface:
+    """cronjob(action=create/update) accepts failure_deliver with deliver's
+    validation — reusing the same normalize/validate helpers."""
+
+    def test_create_stores_failure_deliver(self, cron_env):
+        from tools.cronjob_tools import cronjob
+        from cron.jobs import get_job
+
+        result = json.loads(cronjob(
+            action="create",
+            prompt="scan",
+            schedule="every 1h",
+            deliver="slack:D0MAIN",
+            failure_deliver="local",
+        ))
+        assert result["success"] is True
+        assert get_job(result["job_id"])["failure_deliver"] == "local"
+
+    def test_create_without_failure_deliver_does_not_persist_the_key(self, cron_env):
+        """Existing-job byte-identity: the field only exists when set."""
+        from tools.cronjob_tools import cronjob
+        from cron.jobs import get_job
+
+        result = json.loads(cronjob(
+            action="create", prompt="scan", schedule="every 1h",
+        ))
+        assert result["success"] is True
+        assert "failure_deliver" not in get_job(result["job_id"])
+
+    def test_create_flattens_list_value_like_deliver(self, cron_env):
+        from tools.cronjob_tools import cronjob
+        from cron.jobs import get_job
+
+        result = json.loads(cronjob(
+            action="create",
+            prompt="scan",
+            schedule="every 1h",
+            failure_deliver=["slack", "telegram"],
+        ))
+        assert result["success"] is True
+        assert get_job(result["job_id"])["failure_deliver"] == "slack,telegram"
+
+    def test_create_rejects_bad_bot_chat_profile_same_as_deliver(self, cron_env):
+        from tools.cronjob_tools import cronjob
+
+        via_failure = json.loads(cronjob(
+            action="create", prompt="scan", schedule="every 1h",
+            failure_deliver="bot-chat:no-such-profile-xyz",
+        ))
+        via_deliver = json.loads(cronjob(
+            action="create", prompt="scan", schedule="every 1h",
+            deliver="bot-chat:no-such-profile-xyz",
+        ))
+        assert via_failure["success"] is False
+        assert via_deliver["success"] is False
+        # Same validator, same message.
+        assert via_failure["error"] == via_deliver["error"]
+
+    def test_update_sets_and_clears_failure_deliver(self, cron_env):
+        from cron.jobs import create_job, get_job
+        from tools.cronjob_tools import cronjob
+
+        job = create_job(prompt="scan", schedule="every 1h")
+        result = json.loads(cronjob(
+            action="update", job_id=job["id"], failure_deliver="slack:D0ALERTS",
+        ))
+        assert result["success"] is True
+        assert get_job(job["id"])["failure_deliver"] == "slack:D0ALERTS"
+
+        # '' clears — job falls back to deliver on failures again.
+        result = json.loads(cronjob(
+            action="update", job_id=job["id"], failure_deliver="",
+        ))
+        assert result["success"] is True
+        assert not get_job(job["id"]).get("failure_deliver")
+
+
+class TestOutcomeBookkeeping:
+    """Review finding B1 (NS-788): delivery bookkeeping — outcome
+    classification, unresolved-origin, incident 'alerted' marking — must
+    read the SAME lane the notice was actually routed through, or the
+    execution history and incident store record lies (silenced failures
+    logged 'delivered'; delivered failures logged 'not_configured')."""
+
+    @staticmethod
+    def _outcome(state):
+        assert state["finished"], "finish_execution never called"
+        _a, kw = state["finished"][-1]
+        return kw.get("delivery_outcome")
+
+    def test_fd_local_failure_records_suppressed_not_delivered(
+        self, run_env, monkeypatch
+    ):
+        alerted = []
+        monkeypatch.setattr(s, "_mark_incident_alerted", alerted.append)
+        monkeypatch.setattr(s, "run_job", _failing_run_job())
+
+        s.run_one_job({
+            "id": "b1a", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "local",
+        })
+
+        assert run_env["send"] == []
+        assert self._outcome(run_env) == "suppressed"
+        assert alerted == [], "silenced failure must NOT mark incident alerted"
+
+    def test_fd_explicit_target_failure_records_delivered(
+        self, run_env, monkeypatch
+    ):
+        """deliver=origin (unresolvable) + failure_deliver=explicit target:
+        the notice IS delivered — outcome must say so, not 'not_configured'."""
+        alerted = []
+        monkeypatch.setattr(s, "_mark_incident_alerted", alerted.append)
+        monkeypatch.setattr(
+            s, "_upsert_incident_for_failure", lambda *_a, **_kw: (False, "inc-b1")
+        )
+        monkeypatch.setattr(s, "run_job", _failing_run_job())
+
+        s.run_one_job({
+            "id": "b1b", "name": "scout",
+            "deliver": "origin", "failure_deliver": "slack:D0OPS",
+        })
+
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0OPS"]
+        assert self._outcome(run_env) == "delivered"
+        assert alerted == ["inc-b1"], "delivered failure ping must mark incident alerted"
+
+    def test_success_outcome_still_reads_deliver_lane(self, run_env, monkeypatch):
+        """Success bookkeeping is untouched: fd set, success delivers to
+        deliver and records 'delivered'."""
+        monkeypatch.setattr(s, "run_job", _succeeding_run_job())
+
+        s.run_one_job({
+            "id": "b1c", "name": "scout",
+            "deliver": "slack:D0MAIN", "failure_deliver": "local",
+        })
+
+        assert [c["chat_id"] for c in run_env["send"]] == ["D0MAIN"]
+        assert self._outcome(run_env) == "delivered"
+
+
+class TestPreflightAndDashboardLanes:
+    """Follow-up (salvage): the failure lane is validated everywhere the
+    deliver lane is — preflight config checks and the dashboard update
+    normalizer — so a typo'd failure target is caught before a failure
+    needs it."""
+
+    def test_preflight_blocks_unknown_failure_platform(self, monkeypatch):
+        """A bogus failure_deliver platform blocks at preflight, exactly
+        like a bogus deliver platform would."""
+        monkeypatch.setattr(s, "_is_known_delivery_platform", lambda _p: False)
+        err = s._preflight_check_delivery({
+            "id": "p1", "deliver": "local",
+            "failure_deliver": "nonexistent-platform:C1",
+        })
+        assert err is not None and "not a known" in err
+
+    def test_preflight_failure_deliver_local_adds_no_platforms(self):
+        """failure_deliver: local adds nothing to check — a deliver=local
+        job with suppressed failures stays zero-cost at preflight."""
+        assert s._preflight_check_delivery({
+            "id": "p2", "deliver": "local", "failure_deliver": "local",
+        }) is None
+
+    def test_preflight_duplicate_lane_not_checked_twice(self, monkeypatch):
+        """failure_deliver equal to deliver must not double-check (or
+        double-report) the same platform."""
+        seen = []
+
+        def _known(p):
+            seen.append(p)
+            return False
+
+        monkeypatch.setattr(s, "_is_known_delivery_platform", _known)
+        s._preflight_check_delivery({
+            "id": "p3", "deliver": "ghost:C1", "failure_deliver": "ghost:C1",
+        })
+        assert seen == ["ghost"]
+
+    def test_dashboard_update_normalizes_failure_deliver(self, tmp_path):
+        """The dashboard update lane normalizes failure_deliver like
+        deliver: text stripped, empty clears (None) instead of
+        coalescing to a target."""
+        from hermes_cli.web_server import _normalize_dashboard_cron_updates
+
+        out = _normalize_dashboard_cron_updates(
+            {"failure_deliver": "  slack:D0ALERTS  "}, tmp_path
+        )
+        assert out["failure_deliver"] == "slack:D0ALERTS"
+
+        cleared = _normalize_dashboard_cron_updates(
+            {"failure_deliver": ""}, tmp_path
+        )
+        assert cleared["failure_deliver"] is None
diff --git a/tests/cron/test_cron_incidents.py b/tests/cron/test_cron_incidents.py
index c495506336..22ec1c1d95 100644
--- a/tests/cron/test_cron_incidents.py
+++ b/tests/cron/test_cron_incidents.py
@@ -46,7 +46,7 @@ def _tick_failing(job, tmp_path, deliveries, error="boom unrelated"):
     harness so the incident gating is exercised through the real scheduler."""
     fake_db = MagicMock()
 
-    def fake_deliver(jb, content, adapters=None, loop=None):
+    def fake_deliver(jb, content, adapters=None, loop=None, **kwargs):
         deliveries.append(content)
         return None
 
diff --git a/tests/cron/test_cron_live_delivery_confirmation.py b/tests/cron/test_cron_live_delivery_confirmation.py
new file mode 100644
index 0000000000..b2822edc24
--- /dev/null
+++ b/tests/cron/test_cron_live_delivery_confirmation.py
@@ -0,0 +1,404 @@
+"""Live-adapter delivery confirmation for cron (#77763).
+
+A ``no_agent`` job fired, the scheduler logged
+``delivered to telegram:<chat> via live adapter``, and the user received
+nothing — no message row, no delivery obligation. The log line was not
+evidence of a send:
+
+* the silence-narration filter returns ``{"success": True, "delivered": False}``
+  (a successful *drop*), and the normalization block read only ``success``;
+* an empty payload skipped the send entirely and still fell into the
+  "delivered" branch;
+* the log line named the chat but not the lane, so a wrong-thread delivery and
+  a phantom one look identical after the fact.
+
+These tests pin the confirmation contract: positive evidence, honest logging,
+and fail-closed on nothing-to-send.
+"""
+
+import asyncio
+import logging
+from concurrent.futures import Future
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from cron import scheduler as sched
+from cron.scheduler import _confirm_adapter_delivery, _deliver_result
+from gateway.config import Platform, PlatformConfig
+
+
+# ---------------------------------------------------------------------------
+# _confirm_adapter_delivery: the contract in isolation
+# ---------------------------------------------------------------------------
+
+class _SendResult:
+    """Minimal stand-in for an adapter SendResult."""
+
+    def __init__(self, success=True, message_id=None, raw_response=None, **extra):
+        self.success = success
+        self.message_id = message_id
+        self.raw_response = raw_response
+        for key, value in extra.items():
+            setattr(self, key, value)
+
+
+class TestConfirmAdapterDelivery:
+    def test_none_is_not_delivered(self):
+        assert _confirm_adapter_delivery(None, "j1") is False
+
+    def test_missing_success_is_not_delivered(self):
+        assert _confirm_adapter_delivery(object(), "j1") is False
+        assert _confirm_adapter_delivery({"message_id": 7}, "j1") is False
+
+    def test_explicit_failure_is_not_delivered(self):
+        assert _confirm_adapter_delivery(_SendResult(success=False), "j1") is False
+        assert _confirm_adapter_delivery({"success": False}, "j1") is False
+
+    def test_filtered_dict_is_not_delivered(self):
+        """The exact silence-filter shape: a successful DROP is not a delivery."""
+        filtered = {"success": True, "filtered": "silence_narration", "delivered": False}
+        assert _confirm_adapter_delivery(filtered, "j1") is False
+
+    def test_delivered_false_on_an_object_is_not_delivered(self):
+        result = _SendResult(success=True, message_id=42, delivered=False)
+        assert _confirm_adapter_delivery(result, "j1") is False
+
+    def test_positive_evidence_is_delivered_without_warning(self, caplog):
+        with caplog.at_level(logging.WARNING, logger="cron.scheduler"):
+            assert _confirm_adapter_delivery(_SendResult(message_id=1234), "j1") is True
+        assert "UNVERIFIED" not in caplog.text
+
+    def test_raw_response_alone_counts_as_evidence(self, caplog):
+        with caplog.at_level(logging.WARNING, logger="cron.scheduler"):
+            result = _SendResult(raw_response={"ok": True})
+            assert _confirm_adapter_delivery(result, "j1") is True
+        assert "UNVERIFIED" not in caplog.text
+
+    def test_evidence_free_success_is_accepted_but_warned(self, caplog):
+        """Not proof of failure either — accept it, but say so in the log."""
+        with caplog.at_level(logging.WARNING, logger="cron.scheduler"):
+            assert _confirm_adapter_delivery(_SendResult(), "92e639af907f") is True
+        assert "UNVERIFIED" in caplog.text
+        assert "92e639af907f" in caplog.text
+
+    def test_evidence_free_success_dict_is_accepted_but_warned(self, caplog):
+        with caplog.at_level(logging.WARNING, logger="cron.scheduler"):
+            assert _confirm_adapter_delivery({"success": True}, "j1") is True
+        assert "UNVERIFIED" in caplog.text
+
+
+# ---------------------------------------------------------------------------
+# _deliver_result: the live lane end to end
+# ---------------------------------------------------------------------------
+
+CHAT_ID = "-1001234567890"
+
+
+def _job(thread_id=None):
+    origin = {"platform": "telegram", "chat_id": CHAT_ID}
+    if thread_id is not None:
+        origin["thread_id"] = thread_id
+    return {
+        "id": "92e639af907f",
+        "name": "Ghost Delivery",
+        "deliver": "origin",
+        "origin": origin,
+    }
+
+
+def _gateway_config(relay=False):
+    config = MagicMock()
+    platforms = {Platform.TELEGRAM: PlatformConfig(enabled=True)}
+    if relay:
+        platforms[Platform.RELAY] = PlatformConfig(enabled=True)
+    config.platforms = platforms
+    config.get_home_channel = lambda p: None
+    return config
+
+
+def _adapters(relay=False):
+    adapter = MagicMock()
+    if relay:
+        adapter.fronts_platform = lambda p: p == Platform.TELEGRAM
+        return {Platform.RELAY: adapter}
+    return {Platform.TELEGRAM: adapter}
+
+
+RECORDED_VERIFICATION = []
+
+
+def _record_verification(job, unverified_targets):
+    RECORDED_VERIFICATION.append((job["id"], list(unverified_targets)))
+
+
+def _run(job, content, send_result, relay=False, standalone_result=None, cron_cfg=None):
+    """Drive ``_deliver_result`` over the live lane with a stubbed router.
+
+    Returns ``(error, router_calls, standalone_calls)``. ``cron_cfg`` extends
+    the ``cron:`` section handed to the scheduler (default: unwrapped output).
+    """
+    loop = MagicMock()
+    loop.is_running.return_value = True
+
+    def fake_run_coro(coro, _loop):
+        future = Future()
+        try:
+            future.set_result(asyncio.run(coro))
+        except BaseException as e:  # noqa: BLE001
+            future.set_exception(e)
+        return future
+
+    router_calls = []
+    standalone_calls = []
+    RECORDED_VERIFICATION.clear()
+
+    router = MagicMock()
+
+    async def _deliver_to_platform(target, text, metadata):
+        router_calls.append({"target": target, "text": text, "metadata": metadata})
+        return send_result
+
+    router._deliver_to_platform = _deliver_to_platform
+
+    async def _fake_send_to_platform(platform, pconfig, chat_id, text, **kwargs):
+        standalone_calls.append({"chat_id": chat_id, "text": text, "kwargs": kwargs})
+        return standalone_result if standalone_result is not None else {}
+
+    with patch("gateway.config.load_gateway_config", return_value=_gateway_config(relay)), \
+         patch("cron.scheduler.load_config",
+               return_value={"cron": {"wrap_response": False, **(cron_cfg or {})}}), \
+         patch("cron.scheduler._record_delivery_verification", side_effect=_record_verification), \
+         patch("gateway.delivery.DeliveryRouter", return_value=router), \
+         patch("tools.send_message_tool._send_to_platform", _fake_send_to_platform), \
+         patch("asyncio.run_coroutine_threadsafe", side_effect=fake_run_coro):
+        error = _deliver_result(job, content, adapters=_adapters(relay), loop=loop)
+    return error, router_calls, standalone_calls
+
+
+class TestFilteredResultIsNotDelivered:
+    FILTERED = {"success": True, "filtered": "silence_narration", "delivered": False}
+
+    def test_filtered_dict_does_not_log_a_live_delivery(self, caplog):
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            _, router_calls, standalone_calls = _run(_job(), "...", self.FILTERED)
+
+        assert len(router_calls) == 1                     # the live send was attempted
+        assert "via live adapter" not in caplog.text      # but never claimed as delivered
+        assert len(standalone_calls) == 1                 # fell back instead of lying
+
+    def test_filtered_dict_fails_closed_on_the_relay_lane(self):
+        """Relay owns the destination, so there is no fallback — report it."""
+        error, _, standalone_calls = _run(_job(), "...", self.FILTERED, relay=True)
+
+        assert error is not None
+        assert "unconfirmed result" in error
+        assert "silence_narration" in error  # names the filter, not "unknown"
+        assert standalone_calls == []
+
+    def test_confirmed_send_result_still_delivers(self, caplog):
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            error, router_calls, standalone_calls = _run(
+                _job(), "Nightly report.", _SendResult(message_id=1234),
+            )
+
+        assert error is None
+        assert len(router_calls) == 1
+        assert standalone_calls == []
+        assert "via live adapter" in caplog.text
+
+
+class TestEmptyPayloadFailsClosed:
+    def test_empty_payload_never_reaches_the_adapter(self, caplog):
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            _, router_calls, _ = _run(_job(), "   ", _SendResult(message_id=1))
+
+        assert router_calls == []                     # nothing was sent
+        assert "via live adapter" not in caplog.text  # and nothing was claimed
+        assert "empty text and no media" in caplog.text
+
+    def test_empty_payload_never_reaches_the_standalone_sender(self, caplog):
+        """The native fallback must not re-open the hole the live lane closed.
+
+        Telegram's adapter returns ``SendResult(success=True)`` for empty
+        content without an API call, so an unguarded fallback would log a
+        standalone "delivered" for the same phantom payload (#77763).
+        """
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            error, router_calls, standalone_calls = _run(
+                _job(), "   ", _SendResult(message_id=1),
+            )
+
+        assert router_calls == []
+        assert standalone_calls == []  # _send_to_platform never called
+        assert error is not None
+        assert "standalone send skipped (empty text and no media)" in error
+        assert "delivered to" not in caplog.text
+
+    def test_empty_payload_is_reported_on_the_relay_lane(self):
+        error, router_calls, _ = _run(_job(), "", _SendResult(message_id=1), relay=True)
+
+        assert router_calls == []
+        assert error is not None
+        assert "live adapter send skipped (empty text and no media)" in error
+
+
+class TestDeliveredLogNamesTheLane:
+    def test_log_includes_thread_and_message_id(self, caplog):
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            error, _, _ = _run(
+                _job(thread_id="99"), "Nightly report.", _SendResult(message_id=1234),
+            )
+
+        assert error is None
+        assert "via live adapter thread=99 message_id=1234" in caplog.text
+
+    def test_log_uses_a_dash_when_the_lane_is_unknown(self, caplog):
+        """No thread and an evidence-free result must still be attributable."""
+        with caplog.at_level(logging.INFO, logger="cron.scheduler"):
+            error, _, _ = _run(_job(), "Nightly report.", _SendResult())
+
+        assert error is None
+        assert "via live adapter thread=- message_id=-" in caplog.text
+        assert "UNVERIFIED" in caplog.text
+
+
+class TestLiveDeliveryIsAFinalNotification:
+    """Cron output is a final user-visible delivery, not a progress send.
+
+    Telegram's adapter defaults to ``_notifications_mode = "important"`` and
+    sends with ``disable_notification=True`` unless ``metadata["notify"]`` is
+    set — so a cron brief without the marker lands silently, which users
+    report as "never delivered" (#77763 thread, #58258 typing bubble). The
+    marker must ride both the text route and the media route, in every
+    Telegram routing mode.
+    """
+
+    def test_text_route_metadata_carries_notify(self):
+        _, router_calls, _ = _run(_job(), "Nightly report.", _SendResult(message_id=1))
+        assert len(router_calls) == 1
+        metadata = router_calls[0]["metadata"]
+        assert metadata["job_id"] == "92e639af907f"
+        assert metadata["notify"] is True
+
+    def test_forum_topic_route_keeps_thread_and_notify(self):
+        _, router_calls, _ = _run(
+            _job(thread_id="99"), "Nightly report.", _SendResult(message_id=1),
+        )
+        metadata = router_calls[0]["metadata"]
+        assert metadata["thread_id"] == "99"
+        assert metadata["notify"] is True
+
+    def test_media_route_metadata_carries_notify(self, tmp_path):
+        media = tmp_path / "report.png"
+        media.write_bytes(b"\x89PNG\r\n\x1a\n")
+        sent = []
+
+        def fake_send_media(adapter, chat_id, media_files, metadata, loop, job, platform=None):
+            sent.append({"media": list(media_files), "metadata": metadata})
+            return []
+
+        with patch("cron.scheduler._send_media_via_adapter", side_effect=fake_send_media), \
+             patch("gateway.platforms.base.BasePlatformAdapter.filter_media_delivery_paths",
+                   side_effect=lambda files: files):
+            error, router_calls, _ = _run(
+                _job(), f"Nightly report.\nMEDIA:{media}", _SendResult(message_id=1),
+            )
+
+        assert error is None
+        assert len(router_calls) == 1
+        assert len(sent) == 1
+        assert sent[0]["metadata"]["notify"] is True
+
+
+class TestNotifyIsConfigurable:
+    """``cron.delivery.notify`` (config.yaml) gates the notify marker.
+
+    The current behaviour (push notification) stays the default; only an
+    explicit ``false`` restores silent deliveries. The knob rides both the
+    text route and the media route so the two never disagree.
+    """
+
+    def test_default_is_notify(self):
+        _, router_calls, _ = _run(_job(), "Nightly report.", _SendResult(message_id=1))
+        assert router_calls[0]["metadata"]["notify"] is True
+
+    def test_explicit_false_disables_notify_on_text_route(self):
+        _, router_calls, _ = _run(
+            _job(thread_id="99"), "Nightly report.", _SendResult(message_id=1),
+            cron_cfg={"delivery": {"notify": False}},
+        )
+        metadata = router_calls[0]["metadata"]
+        assert metadata["notify"] is False
+        assert metadata["thread_id"] == "99"  # routing untouched
+
+    def test_explicit_false_disables_notify_on_media_route(self, tmp_path):
+        media = tmp_path / "report.png"
+        media.write_bytes(b"\x89PNG\r\n\x1a\n")
+        sent = []
+
+        def fake_send_media(adapter, chat_id, media_files, metadata, loop, job, platform=None):
+            sent.append(metadata)
+            return []
+
+        with patch("cron.scheduler._send_media_via_adapter", side_effect=fake_send_media), \
+             patch("gateway.platforms.base.BasePlatformAdapter.filter_media_delivery_paths",
+                   side_effect=lambda files: files):
+            _run(
+                _job(), f"Nightly report.\nMEDIA:{media}", _SendResult(message_id=1),
+                cron_cfg={"delivery": {"notify": False}},
+            )
+        assert sent[0]["notify"] is False
+
+    @pytest.mark.parametrize("cron_cfg", [
+        {"delivery": None},            # `delivery:` with no body parses to null
+        {"delivery": "yes"},           # malformed scalar
+        {"delivery": {"notify": None}},  # `notify:` with no value
+    ])
+    def test_malformed_section_keeps_the_default(self, cron_cfg):
+        _, router_calls, _ = _run(_job(), "Nightly report.", _SendResult(message_id=1), cron_cfg=cron_cfg)
+        assert router_calls[0]["metadata"]["notify"] is True
+
+    def test_default_config_ships_notify_true(self):
+        from hermes_cli.config_defaults import DEFAULT_CONFIG
+
+        assert DEFAULT_CONFIG["cron"]["delivery"]["notify"] is True
+
+
+class TestUnverifiedDeliveryIsRecordedOnTheJob:
+    """An evidence-free ack is accepted, but the state must reach the job
+    record (and from there ``hermes cron list`` / ``cron doctor``), not only a
+    WARNING log line."""
+
+    def test_evidence_free_ack_records_the_target(self):
+        error, _, _ = _run(_job(), "Nightly report.", _SendResult())
+        assert error is None
+        assert RECORDED_VERIFICATION == [("92e639af907f", [f"telegram:{CHAT_ID}"])]
+
+    def test_positive_evidence_clears_the_marker(self):
+        error, _, _ = _run(_job(), "Nightly report.", _SendResult(message_id=1234))
+        assert error is None
+        assert RECORDED_VERIFICATION == [("92e639af907f", [])]
+
+    def test_recorder_skips_the_write_when_nothing_changed(self):
+        with patch("cron.jobs.update_job") as update_job:
+            sched._record_delivery_verification({"id": "j1", "last_delivery_unverified": None}, [])
+            update_job.assert_not_called()
+            sched._record_delivery_verification({"id": "j1", "last_delivery_unverified": None}, ["slack:C1"])
+            update_job.assert_called_once_with("j1", {"last_delivery_unverified": ["slack:C1"]})
+
+    def test_recorder_clears_a_stale_marker(self):
+        with patch("cron.jobs.update_job") as update_job:
+            sched._record_delivery_verification({"id": "j1", "last_delivery_unverified": ["slack:C1"]}, [])
+            update_job.assert_called_once_with("j1", {"last_delivery_unverified": None})
+
+    def test_tool_listing_exposes_the_field(self):
+        from tools.cronjob_tools import _format_job
+
+        assert _format_job({"id": "j1", "name": "n", "prompt": "p",
+                            "last_delivery_unverified": ["slack:C1"]})["last_delivery_unverified"] == ["slack:C1"]
+
+
+def test_scheduler_module_exposes_the_confirmation_helper():
+    """Guard the import surface the delivery block depends on."""
+    assert callable(sched._confirm_adapter_delivery)
diff --git a/tests/cron/test_cron_multiplex_desktop_ticker_scope.py b/tests/cron/test_cron_multiplex_desktop_ticker_scope.py
new file mode 100644
index 0000000000..a01aa0ae3c
--- /dev/null
+++ b/tests/cron/test_cron_multiplex_desktop_ticker_scope.py
@@ -0,0 +1,139 @@
+"""Regression tests for #100489 — desktop multiplex ticker must not deliver a
+secondary profile's cron output through the default profile's identity.
+
+Two halves:
+
+1. ``_deliver_result``'s standalone fallback pool (taken when the caller has a
+   RUNNING event loop — the desktop dashboard shape) spawns a fresh thread that
+   did not inherit the profile ContextVars; it must run inside a copy of the
+   active context so the sender reads THIS profile's home + secrets.
+2. The desktop ticker must stand down, per tick, for a profile whose OWN
+   gateway is running — that gateway ticks it with live adapters, and racing it
+   on the tick lock lets the adapter-less desktop ticker deliver standalone.
+"""
+import asyncio
+import threading
+from unittest.mock import patch
+
+
+
+def test_standalone_fallback_pool_keeps_profile_scope(tmp_path, monkeypatch):
+    from agent.secret_scope import (
+        get_secret,
+        set_multiplex_active,
+        set_secret_scope,
+    )
+    from hermes_constants import get_hermes_home, set_hermes_home_override
+    import cron.scheduler as sched
+    import tools.send_message_tool as smt
+
+    default_home = tmp_path / "default"
+    sec_home = tmp_path / "profiles" / "ops"
+    for home in (default_home, sec_home):
+        (home / "cron").mkdir(parents=True)
+        (home / "config.yaml").write_text("platforms:\n  telegram:\n    enabled: true\n")
+    monkeypatch.setenv("HERMES_HOME", str(default_home))
+    monkeypatch.setenv("TELEGRAM_BOT_TOKEN", "DEFAULT-TOKEN")
+    set_multiplex_active(True)
+
+    seen = {}
+
+    async def fake_send(platform, pconfig, chat_id, message, **kwargs):
+        seen["home"] = str(get_hermes_home())
+        seen["token"] = get_secret("TELEGRAM_BOT_TOKEN", None)
+        return {"success": True, "message_id": "1"}
+
+    job = {"id": "j1", "name": "probe", "deliver": "telegram:12345", "schedule": {"kind": "cron"}}
+
+    async def _inside_running_loop():
+        # Emulate the multiplex ticker's per-profile scope on the caller.
+        set_hermes_home_override(str(sec_home))
+        set_secret_scope({"TELEGRAM_BOT_TOKEN": "OPS-TOKEN"})
+        return sched._deliver_result(job, "hello", adapters={}, loop=None)
+
+    try:
+        with patch.object(smt, "_send_to_platform", fake_send):
+            err = asyncio.run(_inside_running_loop())
+    finally:
+        set_multiplex_active(False)
+
+    assert err is None, err
+    assert seen["home"] == str(sec_home.resolve())
+    assert seen["token"] == "OPS-TOKEN"
+
+
+def test_multiplex_ticker_profile_gate_skips_rejected_profile(tmp_path):
+    from cron.scheduler_provider import InProcessCronScheduler
+    from hermes_constants import get_hermes_home
+
+    own_gateway = tmp_path / "own-gateway"
+    orphan = tmp_path / "orphan"
+    for home in (own_gateway, orphan):
+        (home / "cron").mkdir(parents=True)
+
+    stop = threading.Event()
+    ticked: list[str] = []
+
+    def _tick(*args, **kwargs):
+        ticked.append(str(get_hermes_home()))
+        if len(ticked) >= 3:
+            stop.set()
+        return 0
+
+    provider = InProcessCronScheduler()
+    with patch("cron.scheduler.tick", side_effect=_tick):
+        thread = threading.Thread(
+            target=provider.start,
+            args=(stop,),
+            kwargs={
+                "interval": 0,
+                "profile_homes": [("own-gateway", own_gateway), ("orphan", orphan)],
+                "profile_gate": lambda name, home: name != "own-gateway",
+            },
+            daemon=True,
+        )
+        thread.start()
+        thread.join(timeout=5)
+        stop.set()
+        thread.join(timeout=5)
+
+    assert not thread.is_alive()
+    assert set(ticked) == {str(orphan)}
+    # The gated profile gets no tick-loop success marker either: its own
+    # gateway owns that status surface.
+    assert not (own_gateway / "cron" / "ticker_last_success").exists()
+    assert (orphan / "cron" / "ticker_last_success").exists()
+
+
+def test_desktop_ticker_gates_on_profile_gateway_running(tmp_path, monkeypatch):
+    """The desktop ticker wires the gate to ``_check_gateway_running``."""
+    from hermes_cli import web_server
+
+    homes = [("default", tmp_path / "default"), ("ops", tmp_path / "ops")]
+    monkeypatch.setattr(
+        "hermes_cli.profiles.profiles_to_serve", lambda multiplex=False: list(homes)
+    )
+    monkeypatch.setattr(
+        "hermes_cli.profiles._check_gateway_running", lambda home: home.name == "ops"
+    )
+    captured = {}
+
+    class _Provider:
+        name = "fake"
+
+        def start(self, stop_event, **kwargs):
+            captured.update(kwargs)
+
+    from cron import scheduler_provider as sp
+
+    monkeypatch.setattr(web_server, "resolve_cron_scheduler", lambda: _Provider(), raising=False)
+    monkeypatch.setattr(sp, "resolve_cron_scheduler", lambda: _Provider())
+    monkeypatch.setattr(sp, "InProcessCronScheduler", _Provider)
+    monkeypatch.setattr("hermes_logging.enable_profile_log_routing", lambda homes: None)
+
+    web_server._start_desktop_cron_ticker(threading.Event(), interval=0)
+
+    gate = captured.get("profile_gate")
+    assert gate is not None, "desktop ticker did not install a profile gate"
+    assert gate("default", tmp_path / "default") is True
+    assert gate("ops", tmp_path / "ops") is False
diff --git a/tests/cron/test_cron_multiplex_shared_route_delivery.py b/tests/cron/test_cron_multiplex_shared_route_delivery.py
new file mode 100644
index 0000000000..92aa6b4f7b
--- /dev/null
+++ b/tests/cron/test_cron_multiplex_shared_route_delivery.py
@@ -0,0 +1,112 @@
+"""Regression tests for #101113 — a credentialless satellite profile under
+``gateway.profile_routes`` delivers cron output through the PRIMARY adapter
+for exactly the targets the primary routes to it, and fails closed otherwise.
+
+The multiplex ticker hands such a profile a ``SharedRouteAdapters`` view over
+the primary adapter map; ``_deliver_result`` resolves a transport from it per
+target using the same ``ProfileRoute.matches`` predicate as inbound routing.
+"""
+import asyncio
+from concurrent.futures import Future
+from unittest.mock import MagicMock, patch
+
+import yaml
+
+from cron.scheduler import (
+    SharedRouteAdapters,
+    _deliver_result,
+    _primary_profile_routes_for_current_home,
+)
+from gateway.config import Platform, PlatformConfig
+from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+PRIMARY_YAML = {
+    "gateway": {
+        "multiplex_profiles": True,
+        "profile_routes": [
+            {"name": "fit", "platform": "discord", "chat_id": "1543065293755256852", "profile": "fitness"},
+            {"name": "off", "platform": "discord", "chat_id": "999", "profile": "fitness", "enabled": False},
+            {"name": "other", "platform": "discord", "chat_id": "777", "profile": "other"},
+        ],
+    }
+}
+
+
+def _job(chat_id: str) -> dict:
+    return {"id": "a7ae1520356c", "name": "brief", "deliver": f"discord:{chat_id}"}
+
+
+def _run(job, adapters):
+    """Drive ``_deliver_result`` with a live loop and a real DeliveryRouter."""
+    loop = MagicMock()
+    loop.is_running.return_value = True
+
+    def fake_run_coro(coro, _loop):
+        future = Future()
+        future.set_result(asyncio.run(coro))
+        return future
+
+    standalone = []
+
+    async def _fake_send_to_platform(platform, pconfig, chat_id, text, **kwargs):
+        standalone.append(chat_id)
+        return {"success": False, "error": "DISCORD_BOT_TOKEN is not set"}
+
+    config = MagicMock()
+    config.platforms = {Platform.DISCORD: PlatformConfig(enabled=True)}
+    config.get_home_channel = lambda p: None
+    with patch("gateway.config.load_gateway_config", return_value=config), \
+         patch("cron.scheduler.load_config", return_value={"cron": {"wrap_response": False}}), \
+         patch("tools.send_message_tool._send_to_platform", _fake_send_to_platform), \
+         patch("asyncio.run_coroutine_threadsafe", side_effect=fake_run_coro):
+        error = _deliver_result(job, "hello", adapters=adapters, loop=loop)
+    return error, standalone
+
+
+def _primary_adapter():
+    adapter = MagicMock()
+    adapter.sent = []
+
+    async def send(chat_id, content, metadata=None):
+        adapter.sent.append(chat_id)
+        return {"success": True, "message_id": "m1"}
+
+    adapter.send = send
+    return adapter
+
+
+def test_satellite_routes_exact_target_through_primary_adapter(tmp_path, monkeypatch):
+    root = tmp_path / "root"
+    fitness_home = root / "profiles" / "fitness"
+    fitness_home.mkdir(parents=True)
+    (root / "config.yaml").write_text(yaml.safe_dump(PRIMARY_YAML), encoding="utf-8")
+    monkeypatch.setattr("hermes_constants.get_default_hermes_root", lambda: root)
+    primary = _primary_adapter()
+
+    token = set_hermes_home_override(str(fitness_home))
+    try:
+        shared = SharedRouteAdapters(
+            {Platform.DISCORD: primary}, _primary_profile_routes_for_current_home()
+        )
+        # exact enabled route → primary adapter sends, no standalone attempt
+        error, standalone = _run(_job("1543065293755256852"), shared)
+        assert error is None, error
+        assert primary.sent == ["1543065293755256852"]
+        assert standalone == []
+
+        # unmatched chat, disabled route, route for another profile → the
+        # primary bot is NEVER used; delivery stays on the satellite's own
+        # (credentialless) standalone path and reports its failure.
+        for chat in ("424242", "999", "777"):
+            primary.sent.clear()
+            error, standalone = _run(_job(chat), shared)
+            assert error is not None and "DISCORD_BOT_TOKEN" in error
+            assert primary.sent == []
+            assert standalone == [chat]
+    finally:
+        reset_hermes_home_override(token)
+
+
+def test_shared_view_is_falsy_without_routes_or_primary_adapters():
+    assert not SharedRouteAdapters({}, [])
+    assert SharedRouteAdapters({Platform.DISCORD: object()}, []).get(Platform.DISCORD) is None
diff --git a/tests/cron/test_cron_reasoning_effort.py b/tests/cron/test_cron_reasoning_effort.py
index cea6d11230..4f45549a05 100644
--- a/tests/cron/test_cron_reasoning_effort.py
+++ b/tests/cron/test_cron_reasoning_effort.py
@@ -194,7 +194,7 @@ class TestCronjobToolReasoningEffort:
     def _tool_handler(self):
         import tools.cronjob_tools as mod
 
-        return mod.registry._tools["cronjob"].handler
+        return mod.registry._tools["cronjob_manage"].handler
 
     def test_schema_does_not_expose_reasoning_effort(self):
         """Policy pin: the model-facing surface must NOT offer the
diff --git a/tests/cron/test_cron_timezone_migration_catchup.py b/tests/cron/test_cron_timezone_migration_catchup.py
new file mode 100644
index 0000000000..ef4cf4a108
--- /dev/null
+++ b/tests/cron/test_cron_timezone_migration_catchup.py
@@ -0,0 +1,213 @@
+"""Timezone-migration silent misfire on the cron fire path.
+
+Production incident: after upgrading from a build that scheduled in UTC to
+one that honours the profile timezone (Europe/Brussels), daily cron jobs
+stopped running. Their ``jobs.json`` rows still held pre-migration instants
+like ``2026-09-02T04:00:00+00:00`` for expr ``0 4 * * *``. ``_ensure_aware``
+normalizes that to ``06:00+02``, which ``0 4 * * *`` excludes, so the
+stale-expression guard (#93049) classified it as a direct ``jobs.json`` edit,
+logged exactly that, and re-anchored to tomorrow WITHOUT firing — the due
+occurrence vanished with no failure anywhere.
+
+The fix classifies the mismatch instead of assuming an edit: an instant whose
+own wall clock is a legal occurrence, and which only left the lattice because
+normalization changed its offset, is a representation migration and fires.
+
+These exercise the real store against a temp ``HERMES_HOME`` (no mocks) per
+the E2E-over-mocks discipline for file-touching code.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+import pytest
+
+
+@pytest.fixture
+def temp_home(tmp_path, monkeypatch):
+    """Isolated HERMES_HOME so jobs.json doesn't touch the real store."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    yield tmp_path
+
+
+@pytest.fixture(autouse=True)
+def _reset_migration_counters(monkeypatch):
+    """Module-level telemetry counters must not leak between tests."""
+    from cron import jobs as J
+
+    monkeypatch.setattr(J, "_timezone_migration_catchups", 0)
+    monkeypatch.setattr(J, "_timezone_migration_catchups_recent", [])
+    yield
+
+
+# Europe/Brussels is +02:00 on this date; the legacy row was written by a
+# build that scheduled everything at the UTC offset.
+_BRUSSELS_NOW = datetime.fromisoformat("2026-09-02T06:05:00+02:00")
+_LEGACY_UTC_NEXT_RUN = "2026-09-02T04:00:00+00:00"
+_DAILY_0400 = "0 4 * * *"
+
+
+def _write_cron_job(expr: str, next_run_at: str, name: str = "t") -> str:
+    """Persist a cron job with a pinned next_run_at (the legacy-row shape)."""
+    from cron.jobs import create_job, load_jobs, save_jobs
+
+    job = create_job(prompt="x", schedule="every 5m", name=name)
+    jobs = load_jobs()
+    for j in jobs:
+        if j["id"] == job["id"]:
+            j["schedule"] = {"kind": "cron", "expr": expr}
+            j["next_run_at"] = next_run_at
+    save_jobs(jobs)
+    return job["id"]
+
+
+def test_legacy_utc_offset_next_run_still_fires(temp_home, monkeypatch):
+    """The incident case: a pre-migration +00:00 instant for a Brussels
+    ``0 4 * * *`` job must fire its due occurrence, not be re-anchored away."""
+    from cron.jobs import get_due_jobs, get_timezone_migration_catchup_stats
+
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: _BRUSSELS_NOW)
+    jid = _write_cron_job(_DAILY_0400, _LEGACY_UTC_NEXT_RUN)
+
+    due = get_due_jobs()
+
+    assert jid in [j["id"] for j in due]
+    stats = get_timezone_migration_catchup_stats()
+    assert stats["timezone_migration_catchups"] == 1
+    record = stats["recent"][0]
+    assert record["job_id"] == jid
+    assert record["expr"] == _DAILY_0400
+    assert record["stored_next_run_at"] == _LEGACY_UTC_NEXT_RUN
+    assert record["normalized_next_run_at"] == "2026-09-02T06:00:00+02:00"
+
+
+def test_legacy_offset_catchup_fires_at_most_once(temp_home, monkeypatch):
+    """The catch-up run is a single fire: once the scheduler advances the
+    job, the legacy instant is gone and a second scan finds nothing due."""
+    from cron.jobs import advance_next_run, get_due_jobs, get_job
+
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: _BRUSSELS_NOW)
+    jid = _write_cron_job(_DAILY_0400, _LEGACY_UTC_NEXT_RUN)
+
+    assert jid in [j["id"] for j in get_due_jobs()]
+    assert advance_next_run(jid) is True
+
+    # Re-anchored to tomorrow's occurrence, expressed in the configured zone.
+    assert get_job(jid)["next_run_at"] == "2026-09-03T04:00:00+02:00"
+    assert [j["id"] for j in get_due_jobs() if j["id"] == jid] == []
+
+
+def test_genuine_expr_edit_still_reanchors_without_firing(temp_home, monkeypatch):
+    """#93049 protection intact: a stale instant in the CURRENT offset (no
+    representation change) is still treated as an edit and does not fire."""
+    from cron.jobs import get_due_jobs, get_job, get_timezone_migration_catchup_stats
+
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: _BRUSSELS_NOW)
+    # Stored at the configured offset, but the expr was edited to 09:00.
+    jid = _write_cron_job("0 9 * * *", "2026-09-02T04:00:00+02:00")
+
+    due = get_due_jobs()
+
+    assert [j["id"] for j in due if j["id"] == jid] == []
+    assert get_job(jid)["next_run_at"] == "2026-09-02T09:00:00+02:00"
+    assert (
+        get_timezone_migration_catchup_stats()["timezone_migration_catchups"] == 0
+    )
+
+
+def test_expr_edit_on_a_legacy_offset_row_still_does_not_fire(temp_home, monkeypatch):
+    """A legacy +00:00 row whose expr was ALSO edited must not fire: the
+    stored wall clock is not an occurrence of the new expression either, so
+    the migration escape hatch does not open."""
+    from cron.jobs import get_due_jobs, get_job, get_timezone_migration_catchup_stats
+
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: _BRUSSELS_NOW)
+    jid = _write_cron_job("0 9 * * *", _LEGACY_UTC_NEXT_RUN)
+
+    due = get_due_jobs()
+
+    assert [j["id"] for j in due if j["id"] == jid] == []
+    assert get_job(jid)["next_run_at"] == "2026-09-02T09:00:00+02:00"
+    assert (
+        get_timezone_migration_catchup_stats()["timezone_migration_catchups"] == 0
+    )
+
+
+def test_future_local_wall_clock_is_left_scheduled(temp_home, monkeypatch):
+    """A legacy row whose normalized instant has not arrived yet is simply
+    not due — no catch-up, no re-anchor, no telemetry."""
+    from cron.jobs import get_due_jobs, get_job, get_timezone_migration_catchup_stats
+
+    before_due = datetime.fromisoformat("2026-09-02T05:00:00+02:00")
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: before_due)
+    jid = _write_cron_job(_DAILY_0400, _LEGACY_UTC_NEXT_RUN)
+
+    due = get_due_jobs()
+
+    assert [j["id"] for j in due if j["id"] == jid] == []
+    assert get_job(jid)["next_run_at"] == _LEGACY_UTC_NEXT_RUN
+    assert (
+        get_timezone_migration_catchup_stats()["timezone_migration_catchups"] == 0
+    )
+
+
+def test_future_stored_wall_clock_still_takes_the_offset_repair_path(
+    temp_home, monkeypatch
+):
+    """#28934 regression: a westward TZ move (+10 -> +02) that makes a still-
+    future wall clock look due recomputes rather than firing early, and is
+    NOT reclassified as a migration catch-up."""
+    from cron.jobs import get_due_jobs, get_job, get_timezone_migration_catchup_stats
+
+    scan_time = datetime.fromisoformat("2026-09-02T14:00:00+02:00")
+    monkeypatch.setattr("cron.jobs._hermes_now", lambda: scan_time)
+    jid = _write_cron_job("0 21 * * *", "2026-09-02T21:00:00+10:00")
+
+    due = get_due_jobs()
+
+    assert [j["id"] for j in due if j["id"] == jid] == []
+    assert get_job(jid)["next_run_at"] == "2026-09-02T21:00:00+02:00"
+    assert (
+        get_timezone_migration_catchup_stats()["timezone_migration_catchups"] == 0
+    )
+
+
+def test_classifier_separates_migration_from_edit(temp_home):
+    """Unit-level: the three classifications the fire path branches on."""
+    from cron.jobs import (
+        STALE_CRON_EXPR_EDIT,
+        STALE_CRON_MATCH,
+        STALE_CRON_TIMEZONE_MIGRATION,
+        _classify_stale_cron_next_run,
+    )
+
+    daily = {"kind": "cron", "expr": _DAILY_0400}
+    raw_legacy = datetime.fromisoformat(_LEGACY_UTC_NEXT_RUN)
+    normalized = datetime.fromisoformat("2026-09-02T06:00:00+02:00")
+    on_lattice = datetime.fromisoformat("2026-09-02T04:00:00+02:00")
+
+    # Stored instant already occurs under the current expression.
+    assert (
+        _classify_stale_cron_next_run(daily, on_lattice, on_lattice)
+        == STALE_CRON_MATCH
+    )
+    # Only the offset representation changed.
+    assert (
+        _classify_stale_cron_next_run(daily, raw_legacy, normalized)
+        == STALE_CRON_TIMEZONE_MIGRATION
+    )
+    # Wall clock never moved, so a mismatch can only be a schedule edit.
+    assert (
+        _classify_stale_cron_next_run(
+            {"kind": "cron", "expr": "0 9 * * *"}, on_lattice, on_lattice
+        )
+        == STALE_CRON_EXPR_EDIT
+    )
+    # Wall clock moved, but the stored wall clock is not an occurrence either.
+    assert (
+        _classify_stale_cron_next_run(
+            {"kind": "cron", "expr": "0 9 * * *"}, raw_legacy, normalized
+        )
+        == STALE_CRON_EXPR_EDIT
+    )
diff --git a/tests/cron/test_jobs.py b/tests/cron/test_jobs.py
index 6a3492f390..f993928890 100644
--- a/tests/cron/test_jobs.py
+++ b/tests/cron/test_jobs.py
@@ -645,6 +645,8 @@ class TestMarkJobRun:
         assert updated is not None
         assert updated["state"] == "completed"
         assert updated["last_delivery_error"] == "platform 'telegram' not configured"
+        # A terminal completion that never reached the user is not a success.
+        assert updated["last_status"] == "delivery_failed"
 
     def test_completed_oneshot_visible_in_list(self, tmp_cron_dir):
         """list_jobs(include_disabled=True) surfaces the completed record."""
@@ -654,6 +656,7 @@ class TestMarkJobRun:
         assert job["id"] in listed
         assert listed[job["id"]]["state"] == "completed"
         assert listed[job["id"]]["last_delivery_error"] == "send failed: 502"
+        assert listed[job["id"]]["last_status"] == "delivery_failed"
         # Default (enabled-only) listing hides it, matching paused/disabled jobs.
         assert job["id"] not in {j["id"] for j in list_jobs()}
 
@@ -672,13 +675,53 @@ class TestMarkJobRun:
         assert updated["last_error"] == "timeout"
 
     def test_delivery_error_tracked_separately(self, tmp_cron_dir):
-        """Agent succeeds but delivery fails — both tracked independently."""
+        """Agent succeeds but delivery fails — surfaced, not hidden behind ok.
+
+        Regression guard for #83993: recording ``last_status="ok"`` made a run
+        the user never received look like a quiet success everywhere that keys
+        off "ok". The agent error stays independent of the delivery error, and
+        the delivery failure is not an agent failure (no streak).
+        """
         job = create_job(prompt="Report", schedule="every 1h")
-        mark_job_run(job["id"], success=True, delivery_error="platform 'telegram' not configured")
+        mark_job_run(job["id"], success=True, delivery_error="send failed: 502")
         updated = get_job(job["id"])
-        assert updated["last_status"] == "ok"
+        assert updated["last_status"] == "delivery_failed"
         assert updated["last_error"] is None
-        assert updated["last_delivery_error"] == "platform 'telegram' not configured"
+        assert updated["last_delivery_error"] == "send failed: 502"
+        assert updated["failure_streak"] == 0
+
+    def test_success_without_delivery_error_stays_ok(self, tmp_cron_dir):
+        """A fully successful run is still plain "ok"."""
+        job = create_job(prompt="Report", schedule="every 1h")
+        mark_job_run(job["id"], success=True)
+        assert get_job(job["id"])["last_status"] == "ok"
+        # An empty delivery error is no error at all.
+        mark_job_run(job["id"], success=True, delivery_error="")
+        assert get_job(job["id"])["last_status"] == "ok"
+
+    def test_agent_failure_still_error_with_delivery_error(self, tmp_cron_dir):
+        """An agent failure outranks delivery: still "error", still a streak."""
+        job = create_job(prompt="Report", schedule="every 1h")
+        mark_job_run(
+            job["id"], success=False, error="timeout",
+            delivery_error="send failed: 502",
+        )
+        updated = get_job(job["id"])
+        assert updated["last_status"] == "error"
+        assert updated["last_error"] == "timeout"
+        assert updated["failure_streak"] == 1
+
+    def test_explicit_status_override_wins_over_delivery_failed(self, tmp_cron_dir):
+        """An explicit terminal status (T1-26 blocked_config) still wins."""
+        job = create_job(prompt="Report", schedule="every 1h")
+        mark_job_run(
+            job["id"], success=True,
+            delivery_error="send failed: 502",
+            status="blocked_config",
+        )
+        updated = get_job(job["id"])
+        assert updated["last_status"] == "blocked_config"
+        assert updated["last_delivery_error"] == "send failed: 502"
 
     def test_failure_streak_increments_and_resets(self, tmp_cron_dir):
         """failure_streak counts consecutive agent failures; success resets."""
diff --git a/tests/cron/test_notepad.py b/tests/cron/test_notepad.py
index 9d140e5099..e91c1ac139 100644
--- a/tests/cron/test_notepad.py
+++ b/tests/cron/test_notepad.py
@@ -8,6 +8,7 @@ use the notepad, and the `hermes cron notepad` CLI handler.
 from __future__ import annotations
 
 import argparse
+import importlib
 import sys
 from pathlib import Path
 
@@ -103,6 +104,33 @@ class TestNotepadCrud:
         assert not notepad.NOTEPAD_FILE.exists()
 
 
+class TestNotepadProfileIsolation:
+    def test_profile_override_routes_writes_to_current_home(self, tmp_path):
+        from hermes_constants import (
+            reset_hermes_home_override,
+            set_hermes_home_override,
+        )
+        import cron.notepad as notepad_mod
+
+        profile_a = tmp_path / "profile-a"
+        profile_b = tmp_path / "profile-b"
+
+        import_token = set_hermes_home_override(profile_a)
+        try:
+            importlib.reload(notepad_mod)
+        finally:
+            reset_hermes_home_override(import_token)
+
+        runtime_token = set_hermes_home_override(profile_b)
+        try:
+            notepad_mod.set_note("job-1", "cursor", "page=7")
+        finally:
+            reset_hermes_home_override(runtime_token)
+
+        assert (profile_b / "cron" / "notepad.db").exists()
+        assert not (profile_a / "cron" / "notepad.db").exists()
+
+
 class TestJobRemovalCleanup:
     def test_remove_job_clears_notepad(self, cron_env, notepad):
         """remove_job must clear the job's notepad rows — without this,
diff --git a/tests/cron/test_preflight_config.py b/tests/cron/test_preflight_config.py
index 0a12721d8b..4e56b3d6e9 100644
--- a/tests/cron/test_preflight_config.py
+++ b/tests/cron/test_preflight_config.py
@@ -129,7 +129,7 @@ class TestMissingProviderKeyBlocks:
         job = _job()
         deliveries = []
 
-        def fake_deliver(job, content, adapters=None, loop=None):
+        def fake_deliver(job, content, adapters=None, loop=None, **kwargs):
             deliveries.append(content)
             return None
 
@@ -233,7 +233,7 @@ class TestOptOut:
         job = _job()
         deliveries = []
 
-        def fake_deliver(job, content, adapters=None, loop=None):
+        def fake_deliver(job, content, adapters=None, loop=None, **kwargs):
             deliveries.append(content)
             return None
 
diff --git a/tests/cron/test_run_one_job.py b/tests/cron/test_run_one_job.py
index a3b8bb425a..93bcef00a5 100644
--- a/tests/cron/test_run_one_job.py
+++ b/tests/cron/test_run_one_job.py
@@ -29,7 +29,7 @@ def _patch_pipeline(monkeypatch, *, success=True, output="out", final="final res
         calls.append(("save", jid))
         return f"/tmp/{jid}.txt"
 
-    def fake_deliver(job, content, adapters=None, loop=None):
+    def fake_deliver(job, content, adapters=None, loop=None, **kwargs):
         calls.append(("deliver", job["id"]))
         return None
 
diff --git a/tests/cron/test_scheduler_provider.py b/tests/cron/test_scheduler_provider.py
index 12ac73560c..6bf710e4ed 100644
--- a/tests/cron/test_scheduler_provider.py
+++ b/tests/cron/test_scheduler_provider.py
@@ -786,3 +786,109 @@ def test_multiplex_missing_secondary_does_not_fall_back_to_shared(tmp_path):
     assert default_ad is shared
     assert sec_ad is not shared
     assert not sec_ad
+
+
+def test_multiplex_ticker_isolates_profile_failures(tmp_path):
+    """A failing profile's tick must not skip healthy siblings in the same
+    cycle, nor darken their status (#74878)."""
+    from cron.jobs import get_ticker_last_error, record_ticker_error, use_cron_store
+    from cron.scheduler_provider import InProcessCronScheduler
+    from hermes_constants import get_hermes_home
+
+    failing_home = tmp_path / "failing"
+    healthy_home = tmp_path / "healthy"
+    for home in (failing_home, healthy_home):
+        (home / "cron").mkdir(parents=True)
+        with use_cron_store(home):
+            record_ticker_error("RuntimeError: stale failure")
+
+    stop = threading.Event()
+    tick_homes: list[str] = []
+
+    def _tick(*args, **kwargs):
+        home = str(get_hermes_home())
+        tick_homes.append(home)
+        if home == str(failing_home):
+            raise RuntimeError("profile-local failure")
+        stop.set()
+        return 0
+
+    provider = InProcessCronScheduler()
+    with patch("cron.scheduler.tick", side_effect=_tick):
+        thread = threading.Thread(
+            target=provider.start,
+            args=(stop,),
+            kwargs={
+                "interval": 0,
+                "profile_homes": [("failing", failing_home), ("healthy", healthy_home)],
+            },
+            daemon=True,
+        )
+        thread.start()
+        thread.join(timeout=5)
+        stop.set()
+        thread.join(timeout=5)
+
+    assert not thread.is_alive()
+    assert str(healthy_home) in tick_homes, "healthy sibling was skipped"
+    assert not (failing_home / "cron" / "ticker_last_success").exists()
+    assert (healthy_home / "cron" / "ticker_last_success").exists()
+    with use_cron_store(failing_home):
+        assert get_ticker_last_error() == "RuntimeError: profile-local failure"
+    with use_cron_store(healthy_home):
+        assert get_ticker_last_error() is None
+
+
+def test_multiplex_recovery_isolates_profile_failures(tmp_path):
+    """A startup-recovery error in one profile's ledger must not kill the
+    ticker thread before it ever ticks (#74878)."""
+    import sqlite3
+
+    from cron.scheduler_provider import InProcessCronScheduler
+    from hermes_constants import get_hermes_home
+
+    failing_home = tmp_path / "failing"
+    healthy_home = tmp_path / "healthy"
+    for home in (failing_home, healthy_home):
+        (home / "cron").mkdir(parents=True)
+
+    stop = threading.Event()
+    recovery_homes: list[str] = []
+    tick_homes: list[str] = []
+
+    def _recover():
+        home = str(get_hermes_home())
+        recovery_homes.append(home)
+        if home == str(failing_home):
+            raise sqlite3.OperationalError("unable to open database file")
+        return 0
+
+    def _tick(*args, **kwargs):
+        tick_homes.append(str(get_hermes_home()))
+        if len(tick_homes) >= 2:
+            stop.set()
+        return 0
+
+    provider = InProcessCronScheduler()
+    with (
+        patch.object(provider, "recover_interrupted", side_effect=_recover),
+        patch("cron.scheduler.tick", side_effect=_tick),
+    ):
+        thread = threading.Thread(
+            target=provider.start,
+            args=(stop,),
+            kwargs={
+                "interval": 0,
+                "profile_homes": [("failing", failing_home), ("healthy", healthy_home)],
+            },
+            daemon=True,
+        )
+        thread.start()
+        thread.join(timeout=5)
+        stop.set()
+        thread.join(timeout=5)
+
+    assert not thread.is_alive()
+    assert recovery_homes == [str(failing_home), str(healthy_home)]
+    # The failing profile stays in rotation: its ledger may still hold jobs.
+    assert set(tick_homes) == {str(failing_home), str(healthy_home)}
diff --git a/tests/cron/test_suggestions.py b/tests/cron/test_suggestions.py
index 605686f52c..3abaf54d31 100644
--- a/tests/cron/test_suggestions.py
+++ b/tests/cron/test_suggestions.py
@@ -19,7 +19,6 @@ def store(tmp_path, monkeypatch):
     home = tmp_path / ".hermes"
     home.mkdir()
     monkeypatch.setenv("HERMES_HOME", str(home))
-    # Reload so module-level CRON_DIR/SUGGESTIONS_FILE pick up the temp home.
     import hermes_constants
     importlib.reload(hermes_constants)
     import cron.suggestions as s
@@ -38,6 +37,51 @@ def _add(store, key="k1", title="Test", source="catalog", schedule="0 9 * * *"):
 
 
 class TestStore:
+    def test_explicit_file_override_wins_over_profile_home(self, tmp_path, monkeypatch):
+        from hermes_constants import (
+            reset_hermes_home_override,
+            set_hermes_home_override,
+        )
+        import cron.suggestions as suggestions_mod
+
+        explicit_file = tmp_path / "explicit" / "suggestions.json"
+        profile_home = tmp_path / "profile"
+        monkeypatch.setattr(suggestions_mod, "SUGGESTIONS_FILE", explicit_file)
+
+        token = set_hermes_home_override(profile_home)
+        try:
+            _add(suggestions_mod, key="explicit-file")
+        finally:
+            reset_hermes_home_override(token)
+
+        assert explicit_file.exists()
+        assert not (profile_home / "cron" / "suggestions.json").exists()
+
+    def test_profile_override_routes_writes_to_current_home(self, tmp_path):
+        from hermes_constants import (
+            reset_hermes_home_override,
+            set_hermes_home_override,
+        )
+        import cron.suggestions as suggestions_mod
+
+        profile_a = tmp_path / "profile-a"
+        profile_b = tmp_path / "profile-b"
+
+        import_token = set_hermes_home_override(profile_a)
+        try:
+            importlib.reload(suggestions_mod)
+        finally:
+            reset_hermes_home_override(import_token)
+
+        runtime_token = set_hermes_home_override(profile_b)
+        try:
+            _add(suggestions_mod, key="profile-b")
+        finally:
+            reset_hermes_home_override(runtime_token)
+
+        assert (profile_b / "cron" / "suggestions.json").exists()
+        assert not (profile_a / "cron" / "suggestions.json").exists()
+
     def test_add_and_list_pending(self, store):
         rec = _add(store)
         assert rec is not None
diff --git a/tests/gateway/feishu_helpers.py b/tests/gateway/feishu_helpers.py
index ae8a4bfc37..97771daaa3 100644
--- a/tests/gateway/feishu_helpers.py
+++ b/tests/gateway/feishu_helpers.py
@@ -34,6 +34,7 @@ def make_adapter_skeleton(
     allow_bots: str = "none",
     require_mention: bool = True,
     group_policy: str = "allowlist",
+    allow_all_dm: bool = False,
 ) -> Any:
     from plugins.platforms.feishu.adapter import FeishuAdapter
 
@@ -48,6 +49,7 @@ def make_adapter_skeleton(
     adapter._default_group_policy = group_policy
     adapter._allowed_group_users = frozenset()
     adapter._allow_bots = allow_bots
+    adapter._allow_all_dm = allow_all_dm
     adapter._require_mention = require_mention
     return adapter
 
diff --git a/tests/gateway/relay/test_relay_passthrough.py b/tests/gateway/relay/test_relay_passthrough.py
index 2150e9bf0b..a8e27e4335 100644
--- a/tests/gateway/relay/test_relay_passthrough.py
+++ b/tests/gateway/relay/test_relay_passthrough.py
@@ -44,7 +44,7 @@ def adapter():
     return RelayAdapter(PlatformConfig(), _desc(), transport=StubConnector(_desc()))
 
 
-def _interaction_forward(payload: dict) -> PassthroughForward:
+def _interaction_forward(payload: dict, *, profile: str | None = None) -> PassthroughForward:
     body = json.dumps(payload).encode("utf-8")
     return PassthroughForward(
         platform="discord",
@@ -53,6 +53,7 @@ def _interaction_forward(payload: dict) -> PassthroughForward:
         path="/interactions/discord/appShared",
         headers=[("content-type", "application/json")],
         body=body,
+        profile=profile,
     )
 
 
@@ -75,6 +76,27 @@ def test_passthrough_from_wire_byte_preserves_body():
     assert fwd.headers == [("content-type", "application/json")]
 
 
+def test_passthrough_from_wire_stamps_routed_profile():
+    """A connector-routed profile on the wire frame lands on PassthroughForward.
+
+    Mirrors _event_from_wire's profile stamping for the ``inbound`` frame
+    (#60586) — the passthrough plane needs the same carry-through so a
+    Team-Gateway's Discord interactions route to the same profile a plain
+    message would.
+    """
+    wire = {
+        "platform": "discord",
+        "botId": "appShared",
+        "method": "POST",
+        "path": "/interactions/discord/appShared",
+        "headers": [],
+        "bodyB64": "",
+        "profile": "reviewer",
+    }
+    fwd = _passthrough_from_wire(wire)
+    assert fwd.profile == "reviewer"
+
+
 @pytest.mark.asyncio
 async def test_connect_wires_passthrough_handler_over_ws(adapter):
     """connect() registers the passthrough handler on the transport so a
@@ -137,6 +159,40 @@ async def test_discord_interaction_routes_through_handle_message(adapter, monkey
     assert adapter._platform_by_chat.get("chan-9") == "discord"
 
 
+@pytest.mark.asyncio
+async def test_discord_interaction_stamps_routed_profile(adapter, monkeypatch):
+    """A connector-routed profile on the passthrough forward lands on the
+    resulting event's SessionSource, the same way it does for a plain relayed
+    message (#60586) — so a Team-Gateway's Discord slash-command/button/modal
+    routes to the same profile a plain message would, instead of always
+    falling back to agent:main."""
+    await adapter.connect()
+    stub = adapter._transport
+
+    seen = []
+
+    async def fake_handle(event):
+        seen.append(event)
+
+    monkeypatch.setattr(adapter, "handle_message", fake_handle)
+
+    fwd = _interaction_forward(
+        {
+            "id": "interaction-2",
+            "type": 2,  # APPLICATION_COMMAND
+            "channel_id": "chan-9",
+            "guild_id": "guild-7",
+            "data": {"name": "summarize"},
+            "member": {"user": {"id": "user-3", "username": "ben"}},
+        },
+        profile="reviewer",
+    )
+    await stub.push_passthrough(fwd, buffer_id=None)
+
+    assert len(seen) == 1
+    assert seen[0].source.profile == "reviewer"
+
+
 @pytest.mark.asyncio
 async def test_application_command_subcommand_nesting_renders_names_then_values(
     adapter, monkeypatch
diff --git a/tests/gateway/test_42039_duplicate_user_message.py b/tests/gateway/test_42039_duplicate_user_message.py
index 13a73181f6..3ddc30d90e 100644
--- a/tests/gateway/test_42039_duplicate_user_message.py
+++ b/tests/gateway/test_42039_duplicate_user_message.py
@@ -24,7 +24,7 @@ import pytest
 import gateway.run as gateway_run
 from gateway.config import GatewayConfig, Platform
 from gateway.platforms.base import MessageEvent
-from gateway.session import SessionEntry, SessionSource
+from gateway.session import SessionEntry, SessionSource, TranscriptReadError
 
 
 def _bootstrap(monkeypatch, tmp_path):
@@ -185,6 +185,24 @@ async def test_not_new_messages_skip_db_when_agent_has_session_db(
     )
 
 
+@pytest.mark.asyncio
+async def test_transcript_read_failure_stops_turn_before_agent_or_append(
+    monkeypatch, tmp_path
+):
+    runner = _bootstrap(monkeypatch, tmp_path)
+    runner.session_store.load_transcript.side_effect = TranscriptReadError("sess-dedup")
+    runner._run_agent = AsyncMock()
+
+    response = await runner._handle_message_with_agent(
+        _event(), _source(), "agent:main:telegram:group:-1001:12345", 1
+    )
+
+    assert "history is temporarily unavailable" in response
+    assert "not processed" in response
+    runner._run_agent.assert_not_awaited()
+    runner.session_store.append_to_transcript.assert_not_called()
+
+
 # ── Post-stream MEDIA delivery keeps prior-turn deduplication ──────────
 
 
diff --git a/tests/gateway/test_64674_multiplex_primary_token_scope.py b/tests/gateway/test_64674_multiplex_primary_token_scope.py
index 44398aec19..b11fedb177 100644
--- a/tests/gateway/test_64674_multiplex_primary_token_scope.py
+++ b/tests/gateway/test_64674_multiplex_primary_token_scope.py
@@ -119,6 +119,60 @@ class TestPlatformHasBotCredential:
             Platform.TELEGRAM, PlatformConfig(enabled=True, token=None)
         ) is False
 
+    def test_matrix_password_login_is_a_credential(self):
+        """Matrix password auth has no .token but is fully reconnectable.
+
+        MATRIX_USER_ID + MATRIX_PASSWORD with no MATRIX_ACCESS_TOKEN is a
+        supported setup (build_config puts it on extra). Treating it as
+        credential-less evicted it from the reconnect queue on the first
+        transient failure, so a momentary DNS blip took Matrix down until
+        the gateway was restarted by hand.
+        """
+        from gateway.run import _platform_has_bot_credential
+
+        cfg = PlatformConfig(enabled=True)
+        cfg.extra = {
+            "homeserver": "https://matrix.example.org",
+            "user_id": "@bot:matrix.example.org",
+            "password": "hunter2",
+        }
+        assert _platform_has_bot_credential(Platform.MATRIX, cfg) is True
+
+    @pytest.mark.parametrize(
+        "extra",
+        [
+            {},
+            {"homeserver": "https://matrix.example.org", "password": "hunter2"},
+            {"user_id": "@bot:matrix.example.org", "password": "hunter2"},
+            {"homeserver": "https://matrix.example.org", "user_id": "@bot:m.example.org"},
+            {"homeserver": "  ", "user_id": "  ", "password": "  "},
+        ],
+        ids=["empty", "no-user-id", "no-homeserver", "no-password", "blank"],
+    )
+    def test_matrix_incomplete_password_config_still_dropped(self, extra, monkeypatch):
+        """An incomplete Matrix config can never connect — keep evicting it.
+
+        Guards the #64674 intent, and specifically pins "read extra, not the
+        environment". A fully-populated MATRIX_* environment is set here on
+        purpose: on a real host those vars are present (build_config exports
+        them, and importing gateway.run loads ~/.hermes/.env), so an
+        implementation that falls back to os.getenv would report every Matrix
+        config as credentialed and never evict anything.
+
+        conftest sandboxes HERMES_HOME and scrubs MATRIX_* from the
+        environment, so without these explicit setenv calls this test would
+        pass against an env-reading implementation and guard nothing.
+        """
+        from gateway.run import _platform_has_bot_credential
+
+        monkeypatch.setenv("MATRIX_HOMESERVER", "https://env.example.org")
+        monkeypatch.setenv("MATRIX_USER_ID", "@envbot:env.example.org")
+        monkeypatch.setenv("MATRIX_PASSWORD", "env-password")
+
+        cfg = PlatformConfig(enabled=True)
+        cfg.extra = dict(extra)
+        assert _platform_has_bot_credential(Platform.MATRIX, cfg) is False
+
 
 class TestPrimaryStartupSkipsEmptyTokenUnderMultiplex:
     @pytest.mark.asyncio
diff --git a/tests/gateway/test_73771_media_resend_dedup.py b/tests/gateway/test_73771_media_resend_dedup.py
index d0490e8056..3c54e1c055 100644
--- a/tests/gateway/test_73771_media_resend_dedup.py
+++ b/tests/gateway/test_73771_media_resend_dedup.py
@@ -353,18 +353,19 @@ async def test_bare_path_history_lookup_timeout_fails_open(tmp_path, monkeypatch
     started = time.monotonic()
     await adapter._process_message_background(event, build_session_key(event.source))
 
-    # The lookup times out after 0.02s and fails open; the generous 1.0s
-    # bound only guards against delivery hanging on the wedged read
-    # indefinitely, without flaking on loaded CI hosts. Delivery of the
-    # document below is the real fail-open assertion.
-    assert time.monotonic() - started < 1.0
+    # The lookup times out after 0.02s and fails open; the bound only guards
+    # against delivery hanging on the wedged read indefinitely. 1.0s still
+    # flaked on loaded CI runners (observed 1.55s on main run 33455779041),
+    # so keep it >= 5s per the flake policy. Delivery of the document below
+    # is the real fail-open assertion.
+    assert time.monotonic() - started < 5.0
     assert adapter.documents == [str(pdf)]
 
 
 @pytest.mark.asyncio
 async def test_history_lookup_saturation_fails_open_without_new_worker(monkeypatch):
     """Wedged lookups are bounded and cannot consume unbounded worker threads."""
-    monkeypatch.setattr("gateway.platforms.base._HISTORY_MEDIA_LOOKUP_TIMEOUT_SECONDS", 1.0)
+    monkeypatch.setattr("gateway.platforms.base._HISTORY_MEDIA_LOOKUP_TIMEOUT_SECONDS", 5.0)
     monkeypatch.setattr(
         "gateway.platforms.base._HISTORY_MEDIA_LOOKUP_ADMISSION",
         threading.BoundedSemaphore(2),
@@ -381,13 +382,13 @@ async def test_history_lookup_saturation_fails_open_without_new_worker(monkeypat
             calls += 1
             if calls == 2:
                 two_started.set()
-        release.wait(timeout=1)
+        release.wait(timeout=10)
         return None
 
     monkeypatch.setattr(adapter, "_history_media_paths_for_session", blocked_lookup)
     first = asyncio.create_task(adapter._bounded_history_media_paths_for_session("one"))
     second = asyncio.create_task(adapter._bounded_history_media_paths_for_session("two"))
-    deadline = time.monotonic() + 1
+    deadline = time.monotonic() + 5
     while not two_started.is_set() and time.monotonic() < deadline:
         await asyncio.sleep(0.005)
     assert two_started.is_set()
@@ -397,9 +398,10 @@ async def test_history_lookup_saturation_fails_open_without_new_worker(monkeypat
     elapsed = time.monotonic() - began
 
     assert third is None
-    # Saturation must fail open immediately (no waiting on the 1.0s lookup
-    # timeout); 0.5s is a generous bound that stays flake-free on loaded CI.
-    assert elapsed < 0.5
+    # Saturation must fail open immediately (no waiting on the 5.0s lookup
+    # timeout); 2.0s keeps the distinction while staying flake-free on
+    # loaded CI runners.
+    assert elapsed < 2.0
     assert calls == 2
     release.set()
     await asyncio.gather(first, second)
diff --git a/tests/gateway/test_api_server.py b/tests/gateway/test_api_server.py
index ecb49cd7a8..56e298dc06 100644
--- a/tests/gateway/test_api_server.py
+++ b/tests/gateway/test_api_server.py
@@ -611,7 +611,9 @@ class TestDisconnectedAgentReap:
         adapter._active_run_agents["run_x"] = agent
 
         request = MagicMock()
+        request.headers = {}
         request.match_info = {"run_id": "run_x"}
+        adapter._run_owners["run_x"] = adapter._run_idempotency_scope(request)
         resp = await adapter._handle_stop_run(request)
         assert resp.status == 200
 
diff --git a/tests/gateway/test_api_server_runs.py b/tests/gateway/test_api_server_runs.py
index 0f9f573ac4..8d68f919c9 100644
--- a/tests/gateway/test_api_server_runs.py
+++ b/tests/gateway/test_api_server_runs.py
@@ -22,6 +22,7 @@ from aiohttp.test_utils import TestClient, TestServer
 from gateway.config import PlatformConfig
 from gateway.platforms.api_server import (
     APIServerAdapter,
+    _api_request_profile,
     _approval_event_choices,
     cors_middleware,
     security_headers_middleware,
@@ -68,6 +69,13 @@ def _make_adapter(api_key: str = "") -> APIServerAdapter:
     return adapter
 
 
+def _claim_run(adapter: APIServerAdapter, run_id: str) -> None:
+    """Stamp *run_id* as owned by the unprefixed (default) request scope."""
+    request = MagicMock()
+    request.headers = {}
+    adapter._run_owners[run_id] = adapter._run_idempotency_scope(request)
+
+
 def _create_runs_app(adapter: APIServerAdapter) -> web.Application:
     """Create an aiohttp app with /v1/runs routes registered."""
     mws = [mw for mw in (cors_middleware, security_headers_middleware) if mw is not None]
@@ -468,6 +476,7 @@ class TestSteerRun:
         adapter._active_run_agents["run_123"] = agent
         adapter._run_streams["run_123"] = queue
         adapter._set_run_status("run_123", "running")
+        _claim_run(adapter, "run_123")
 
         async with TestClient(TestServer(app)) as cli:
             resp = await cli.post("/v1/runs/run_123/steer", json={"input": "tighten the ending"})
@@ -500,6 +509,7 @@ class TestSteerRun:
     async def test_steer_inactive_run_returns_409(self, adapter):
         app = _create_runs_app(adapter)
         adapter._set_run_status("run_done", "completed")
+        _claim_run(adapter, "run_done")
 
         async with TestClient(TestServer(app)) as cli:
             resp = await cli.post("/v1/runs/run_done/steer", json={"input": "hello"})
@@ -515,6 +525,7 @@ class TestSteerRun:
         agent.steer.return_value = True
         adapter._active_run_agents["run_123"] = agent
         adapter._set_run_status("run_123", "running")
+        _claim_run(adapter, "run_123")
 
         async with TestClient(TestServer(app)) as cli:
             resp = await cli.post("/v1/runs/run_123/steer", json={"input": ""})
@@ -681,6 +692,92 @@ class TestRunLifecycleSweep:
                 mock_agent.interrupt.assert_called_once_with("Stop requested via API")
 
 
+# ---------------------------------------------------------------------------
+# Run ownership across served profiles (#93689 / #90415)
+# ---------------------------------------------------------------------------
+
+
+class TestRunOwnershipAcrossProfiles:
+    """Every served profile holds a valid key under multiplex; only the
+    creating profile may see or control a run."""
+
+    KEYS = {"victim": "sk-victim-profile-key-0001", "attacker": "sk-attacker-profile-key-01"}
+
+    @classmethod
+    def _profile_app(cls, adapter: APIServerAdapter) -> web.Application:
+        """Runs routes behind a stand-in for the /p/<profile>/ middleware:
+        the routed profile arrives in ``X-Test-Profile`` and each profile
+        authenticates with its own key, as under gateway.multiplex_profiles."""
+
+        @web.middleware
+        async def stamp_profile(request, handler):
+            token = _api_request_profile.set(request.headers.get("X-Test-Profile"))
+            try:
+                return await handler(request)
+            finally:
+                _api_request_profile.reset(token)
+
+        adapter._expected_api_key = lambda: cls.KEYS.get(_api_request_profile.get(), "")
+        app = _create_runs_app(adapter)
+        app.middlewares.append(stamp_profile)
+        app.router.add_post(
+            "/api/sessions/{session_id}/chat/stream", adapter._handle_session_chat_stream
+        )
+        return app
+
+    @pytest.mark.asyncio
+    async def test_unstamped_run_state_fails_closed(self, adapter):
+        """Run state with no owner stamp is nobody's — not everybody's."""
+        app = _create_runs_app(adapter)
+        adapter._active_run_agents["run_unstamped"] = MagicMock()
+        adapter._set_run_status("run_unstamped", "running")
+
+        async with TestClient(TestServer(app)) as cli:
+            get_resp = await cli.get("/v1/runs/run_unstamped")
+            stop_resp = await cli.post("/v1/runs/run_unstamped/stop")
+
+        assert (get_resp.status, stop_resp.status) == (404, 404)
+
+    @pytest.mark.asyncio
+    async def test_session_chat_stream_run_is_owned_by_creating_profile(self, adapter):
+        """The session-chat-stream run mint claims ownership like /v1/runs does."""
+        app = self._profile_app(adapter)
+        victim = {"X-Test-Profile": "victim", "Authorization": f"Bearer {self.KEYS['victim']}"}
+        attacker = {"X-Test-Profile": "attacker", "Authorization": f"Bearer {self.KEYS['attacker']}"}
+        gate = asyncio.Event()
+
+        async def slow_run_agent(**kwargs):
+            await gate.wait()
+            return {"final_response": "ok"}, {}
+
+        async with TestClient(TestServer(app)) as cli:
+            with (
+                patch.object(adapter, "_get_existing_session_or_404", new=AsyncMock(return_value=({"id": "s1"}, None))),
+                patch.object(adapter, "_conversation_history_for_session", new=AsyncMock(return_value=[])),
+                patch.object(adapter, "_run_agent", new=slow_run_agent),
+            ):
+                stream = await cli.post(
+                    "/api/sessions/s1/chat/stream", json={"message": "hi"}, headers=victim
+                )
+                await stream.content.readline()
+                (run_id,) = list(adapter._run_statuses)
+                assert run_id in adapter._run_owners
+
+                foreign_get = await cli.get(f"/v1/runs/{run_id}", headers=attacker)
+                foreign_stop = await cli.post(f"/v1/runs/{run_id}/stop", headers=attacker)
+                own_get = await cli.get(f"/v1/runs/{run_id}", headers=victim)
+                assert (foreign_get.status, foreign_stop.status, own_get.status) == (404, 404, 200)
+
+                gate.set()
+                await stream.text()
+
+        # The owner outlives the terminal status and goes with the last surface.
+        assert run_id in adapter._run_owners
+        adapter._run_statuses.pop(run_id)
+        adapter._release_run_owner_if_forgotten(run_id)
+        assert run_id not in adapter._run_owners
+
+
 # ---------------------------------------------------------------------------
 # POST /v1/runs/{run_id}/stop — interrupt a running agent
 # ---------------------------------------------------------------------------
diff --git a/tests/gateway/test_api_server_toolset.py b/tests/gateway/test_api_server_toolset.py
index fb9fe9176b..debdbbfb52 100644
--- a/tests/gateway/test_api_server_toolset.py
+++ b/tests/gateway/test_api_server_toolset.py
@@ -17,11 +17,11 @@ class TestHermesApiServerToolset:
     def test_toolset_includes_core_tools(self):
         tools = resolve_toolset("hermes-api-server")
         expected = [
-            "terminal", "process",
+            "terminal", "process_manage",
             "read_file", "write_file", "patch", "search_files",
             "vision_analyze", "image_generate",
             "execute_code", "delegate_task",
-            "todo", "memory", "session_search", "cronjob",
+            "todo_list", "memory", "session_search", "cronjob_manage",
         ]
         for tool in expected:
             assert tool in tools, f"Missing expected tool: {tool}"
diff --git a/tests/gateway/test_choice_picker.py b/tests/gateway/test_choice_picker.py
index a2c9a52961..c8e6712ec0 100644
--- a/tests/gateway/test_choice_picker.py
+++ b/tests/gateway/test_choice_picker.py
@@ -126,7 +126,7 @@ class TestFastChoicePicker:
 
         assert result is None
         values = [c["value"] for c in adapter.calls[0]["choices"]]
-        assert values == ["fast", "normal"]
+        assert values == ["fast", "normal", "auto", "cold"]
 
     @pytest.mark.asyncio
     async def test_fast_picker_selection_is_session_scoped(self, tmp_path, monkeypatch):
diff --git a/tests/gateway/test_codex_hygiene_compaction.py b/tests/gateway/test_codex_hygiene_compaction.py
index 71dd907f3b..7fa795d694 100644
--- a/tests/gateway/test_codex_hygiene_compaction.py
+++ b/tests/gateway/test_codex_hygiene_compaction.py
@@ -336,3 +336,46 @@ def test_manual_compress_without_live_thread_reports_honestly():
         host._compress_codex_app_server_session("tg:123", "sess-1")
     )
     assert "Nothing to compact" in reply
+
+
+# ---------------------------------------------------------------------------
+# Multiplexed gateway: the hygiene worker must see the caller's ContextVars
+# (profile secret scope / HERMES_HOME override). A bare run_in_executor worker
+# starts with an EMPTY Context, so get_secret(<PROVIDER>_API_KEY) inside the
+# summary path fails closed and every hygiene compaction degrades to a lossy
+# truncation (#100849 bundle).
+# ---------------------------------------------------------------------------
+
+def test_hygiene_worker_inherits_caller_contextvars(tmp_path):
+    import contextvars
+    import threading
+
+    marker = contextvars.ContextVar("hygiene_scope_marker", default=None)
+    seen = {}
+
+    class ScopeProbeAgent(LiveCodexAgent):
+        def _compress_context(self, messages, system_message, **kwargs):
+            seen["value"] = marker.get()
+            seen["thread"] = threading.current_thread().name
+            return super()._compress_context(messages, system_message, **kwargs)
+
+    agent = ScopeProbeAgent(mode="hermes")
+    key = "tg:ctx"
+    gw, _db = _gateway(tmp_path, key, agent)
+
+    async def _scoped():
+        token = marker.set("profile-scope")
+        try:
+            return await run_codex_hygiene_compaction(
+                gw, key, agent.session_id, auto_mode="hermes",
+                history=_history(), approx_tokens=345_000, timeout_seconds=30.0,
+            )
+        finally:
+            marker.reset(token)
+
+    assert asyncio.run(_scoped()) == "compacted"
+    assert seen["thread"] != "MainThread", "compaction must still run off-loop"
+    assert seen["value"] == "profile-scope", (
+        "hygiene worker lost the caller's ContextVars — under multiplex_profiles "
+        "this is the UnscopedSecretError / lossy-truncation regression"
+    )
diff --git a/tests/gateway/test_config.py b/tests/gateway/test_config.py
index 2e4285f68f..480e26d48c 100644
--- a/tests/gateway/test_config.py
+++ b/tests/gateway/test_config.py
@@ -1409,3 +1409,58 @@ class TestApiServerEnvOverride:
         assert config.platforms[Platform.API_SERVER].enabled is False
         # The key is still wired through for the shared listener.
         assert config.platforms[Platform.API_SERVER].extra.get("key") == api_server_key
+
+
+class TestWebhookEnvOverride:
+    def test_env_key_does_not_reenable_explicitly_disabled_webhook(self):
+        """An explicit ``platforms.webhook.enabled: false`` must survive
+        _apply_env_overrides() even when WEBHOOK_ENABLED is truthy in the env.
+
+        Regression (#85637): _apply_env_overrides() force-set
+        webhook.enabled = True whenever WEBHOOK_ENABLED was truthy. In
+        multiplex mode a secondary profile pins ``webhook.enabled: false`` so
+        it shares the default profile's listener instead of binding its own
+        port, but it still inherits the process-level WEBHOOK_ENABLED
+        (or carries one in its own .env). The unconditional re-enable
+        flipped it back on and tripped the MultiplexConfigError check.
+
+        The fix honors the explicit disable, flagged by ``_enabled_explicit``
+        in the platform's extra (set when the config.yaml pins enabled).
+        The MSGRAPH_WEBHOOK branch shares the shape and the fix.
+        """
+        config = GatewayConfig(
+            platforms={
+                Platform.WEBHOOK: PlatformConfig(
+                    enabled=False,
+                    extra={"_enabled_explicit": True},
+                ),
+                Platform.MSGRAPH_WEBHOOK: PlatformConfig(
+                    enabled=False,
+                    extra={"_enabled_explicit": True},
+                ),
+            },
+        )
+
+        with patch.dict(
+            os.environ,
+            {
+                "WEBHOOK_ENABLED": "true",
+                "WEBHOOK_PORT": "9999",
+                "WEBHOOK_SECRET": "shared-secret",
+                "MSGRAPH_WEBHOOK_ENABLED": "true",
+                "MSGRAPH_WEBHOOK_PORT": "9998",
+            },
+            clear=True,
+        ):
+            _apply_env_overrides(config)
+
+        # Explicit disable wins over the env-var presence.
+        assert config.platforms[Platform.WEBHOOK].enabled is False
+        assert config.platforms[Platform.MSGRAPH_WEBHOOK].enabled is False
+        assert config.platforms[Platform.MSGRAPH_WEBHOOK].extra.get("port") == 9998
+        # Port/secret are still wired through for the shared listener.
+        assert config.platforms[Platform.WEBHOOK].extra.get("port") == 9999
+        assert (
+            config.platforms[Platform.WEBHOOK].extra.get("secret")
+            == "shared-secret"
+        )
diff --git a/tests/gateway/test_cron_interrupt_notification.py b/tests/gateway/test_cron_interrupt_notification.py
index bde4738c20..f157e17478 100644
--- a/tests/gateway/test_cron_interrupt_notification.py
+++ b/tests/gateway/test_cron_interrupt_notification.py
@@ -120,6 +120,37 @@ class TestNotifyInterruptedCronJobs:
         assert sent == 0
         assert adapter.sent == []
 
+    @pytest.mark.asyncio
+    async def test_failure_deliver_local_suppresses_interrupt_notice(self):
+        """Interrupted notices are failure-category engine status (NS-788):
+        a job with failure_deliver='local' opted out of failure pings, and
+        the shutdown notice must honor that. Real target resolution — no
+        _resolve_delivery_targets patch — so the failure_deliver override is
+        actually exercised."""
+        runner, adapter = make_restart_runner()
+        _bind_notifier(runner)
+        job = dict(_telegram_job(), failure_deliver="local")
+
+        with patch("cron.jobs.get_job", return_value=job):
+            sent = await runner._notify_interrupted_cron_jobs([job["id"]])
+
+        assert sent == 0
+        assert adapter.sent == []
+
+    @pytest.mark.asyncio
+    async def test_failure_deliver_unset_notice_reaches_deliver_target(self):
+        """Control for the suppress test: same job without failure_deliver,
+        same real resolution path — the notice goes to the deliver target."""
+        runner, adapter = make_restart_runner()
+        _bind_notifier(runner)
+        job = _telegram_job()
+
+        with patch("cron.jobs.get_job", return_value=job):
+            sent = await runner._notify_interrupted_cron_jobs([job["id"]])
+
+        assert sent == 1
+        assert adapter.sent_calls[0][0] == "123456"
+
     @pytest.mark.asyncio
     async def test_empty_job_list_is_a_noop(self):
         runner, adapter = make_restart_runner()
diff --git a/tests/gateway/test_delivery_silence_filter.py b/tests/gateway/test_delivery_silence_filter.py
index 1013e4bc75..11b7ba3296 100644
--- a/tests/gateway/test_delivery_silence_filter.py
+++ b/tests/gateway/test_delivery_silence_filter.py
@@ -124,6 +124,50 @@ async def test_env_override_enables_filter_over_config(tmp_path, monkeypatch):
     assert result["filtered"] == "silence_narration"
 
 
+# --- Cron artifacts are exempt ----------------------------------------------
+#
+# The filter exists to stop bot-to-bot mirror loops of *model chatter*. Cron
+# output is an artifact: a job that legitimately emits "..." (a quiet script,
+# a terse digest) has no loop partner, and dropping it while returning
+# {"success": True} produced a cron the scheduler logged as delivered and the
+# user never received (#77763). Cron sends carry job_id in metadata.
+
+
+@pytest.mark.asyncio
+async def test_cron_job_id_metadata_bypasses_the_filter(tmp_path, monkeypatch):
+    monkeypatch.setattr("gateway.delivery.get_hermes_home", lambda: tmp_path)
+    monkeypatch.delenv("HERMES_FILTER_SILENCE_NARRATION", raising=False)
+    adapter = RecordingAdapter()
+    router = DeliveryRouter(GatewayConfig(), adapters={Platform.DISCORD: adapter})
+    target = DeliveryTarget.parse("discord:99887766")
+
+    result = await router._deliver_to_platform(
+        target, "*(silent)*", metadata={"job_id": "92e639af907f"},
+    )
+
+    assert len(adapter.calls) == 1
+    assert adapter.calls[0]["content"] == "*(silent)*"
+    assert result.get("filtered") is None
+    assert result.get("delivered") is not False
+
+
+@pytest.mark.asyncio
+async def test_non_cron_metadata_still_filters(tmp_path, monkeypatch):
+    """The exemption keys on job_id alone — everything else is unchanged."""
+    monkeypatch.setattr("gateway.delivery.get_hermes_home", lambda: tmp_path)
+    monkeypatch.delenv("HERMES_FILTER_SILENCE_NARRATION", raising=False)
+    adapter = RecordingAdapter()
+    router = DeliveryRouter(GatewayConfig(), adapters={Platform.DISCORD: adapter})
+    target = DeliveryTarget.parse("discord:99887766")
+
+    result = await router._deliver_to_platform(
+        target, "*(silent)*", metadata={"thread_id": "42", "user_id": "u1"},
+    )
+
+    assert adapter.calls == []
+    assert result["filtered"] == "silence_narration"
+
+
 # --- Config round-trip ------------------------------------------------------
 
 
diff --git a/tests/gateway/test_discord_slash_commands.py b/tests/gateway/test_discord_slash_commands.py
index e3e5a39ff5..4f602a8768 100644
--- a/tests/gateway/test_discord_slash_commands.py
+++ b/tests/gateway/test_discord_slash_commands.py
@@ -602,3 +602,43 @@ def test_register_skill_command_payload_fits_discord_8kb_limit(adapter):
     )
 
 
+
+
+# ------------------------------------------------------------------
+# _build_slash_event — guild/parent ids reach profile_routes (#69178, #91633)
+# ------------------------------------------------------------------
+
+
+def test_build_slash_event_routes_guild_profile_like_messages(adapter, monkeypatch):
+    """A guild-keyed profile route must match a native slash command exactly
+    as it matches a regular message: build_source needs guild_id (and the
+    thread's parent_chat_id) or the route never fires and /new resets the
+    default profile's session instead of the routed one."""
+    from gateway import run as gateway_run
+    from gateway.config import GatewayConfig
+    from gateway.profile_routing import ProfileRoute
+
+    runner = object.__new__(gateway_run.GatewayRunner)
+    runner.config = GatewayConfig(
+        multiplex_profiles=True,
+        profile_routes=[ProfileRoute(name="work", profile="work", platform="discord", guild_id="1")],
+    )
+    monkeypatch.setattr(gateway_run, "_multiplex_profile_homes", lambda _cfg: [("work", None)])
+    adapter.gateway_runner = runner
+    user = SimpleNamespace(display_name="Jezza", id=42)
+
+    channel_event = adapter._build_slash_event(
+        SimpleNamespace(channel=SimpleNamespace(id=200, name="general", guild=SimpleNamespace(id=1, name="G"), topic=None),
+                        channel_id=200, guild_id=1, user=user),
+        "/new",
+    )
+    thread_event = adapter._build_slash_event(
+        SimpleNamespace(channel=_FakeThreadChannel(channel_id=555), channel_id=555, guild_id=None, user=user),
+        "/status",
+    )
+
+    assert channel_event.source.guild_id == "1"
+    assert channel_event.source.profile == "work"
+    assert thread_event.source.guild_id == "1"
+    assert thread_event.source.parent_chat_id == "100"
+    assert thread_event.source.profile == "work"
diff --git a/tests/gateway/test_email_robustness.py b/tests/gateway/test_email_robustness.py
index c1266196c6..5df979fb78 100644
--- a/tests/gateway/test_email_robustness.py
+++ b/tests/gateway/test_email_robustness.py
@@ -77,5 +77,39 @@ class TestMessageIdDomain(unittest.TestCase):
         self.assertEqual(adapter._message_id_domain(), "localhost")
 
 
+class TestTransportSecurity(unittest.TestCase):
+    """platforms.email.extra.imap_security / smtp_security select the transport (#99641)."""
+
+    def _adapter(self, **extra):
+        from gateway.config import PlatformConfig
+
+        with patch.dict(os.environ, {
+            "EMAIL_ADDRESS": "hermes@test.com", "EMAIL_PASSWORD": "secret",
+            "EMAIL_IMAP_HOST": "127.0.0.1", "EMAIL_IMAP_PORT": "1143",
+            "EMAIL_SMTP_HOST": "127.0.0.1", "EMAIL_SMTP_PORT": "1025",
+        }, clear=True):
+            from plugins.platforms.email.adapter import EmailAdapter
+
+            return EmailAdapter(PlatformConfig(enabled=True, extra=extra))
+
+    def test_starttls_builds_plain_imap_then_upgrades(self):
+        adapter = self._adapter(imap_security="starttls", imap_tls_verify=False)
+        imap = MagicMock()
+        with patch("imaplib.IMAP4", return_value=imap) as imap_cls, \
+             patch("imaplib.IMAP4_SSL") as imap_ssl_cls:
+            self.assertIs(adapter._connect_imap(), imap)
+        imap_cls.assert_called_once_with("127.0.0.1", 1143, timeout=30)
+        imap_ssl_cls.assert_not_called()
+        imap.starttls.assert_called_once()
+
+    def test_unknown_mode_falls_back_to_secure_default(self):
+        adapter = self._adapter(imap_security="bogus", smtp_security="bogus")
+        self.assertEqual(adapter._imap_security, "tls")
+        self.assertEqual(adapter._smtp_security, "starttls")  # port 1025 != 465
+        # verification stays ON unless explicitly opted out
+        self.assertTrue(adapter._imap_tls_verify)
+        self.assertTrue(adapter._smtp_tls_verify)
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/gateway/test_env_override_explicit_disable_48820.py b/tests/gateway/test_env_override_explicit_disable_48820.py
new file mode 100644
index 0000000000..1d8452c5a0
--- /dev/null
+++ b/tests/gateway/test_env_override_explicit_disable_48820.py
@@ -0,0 +1,199 @@
+"""Regression tests for #48820 Bug 2: an explicit ``platforms.<x>.enabled: false``
+in config.yaml must survive ``_apply_env_overrides`` when that platform's
+credentials are present in the environment.
+
+Before the fix, twelve credential-presence branches (weixin, whatsapp_cloud,
+homeassistant, email, sms, dingtalk, feishu, wecom, wecom_callback, bluebubbles,
+qqbot, yuanbao) force-set ``enabled = True`` unconditionally, while Telegram /
+Discord / Slack routed through ``_enable_from_env`` and honored the
+``_enabled_explicit`` marker.  These tests drive the real ``load_gateway_config``
+against a temp HERMES_HOME — real YAML I/O, no mocks of the code under test.
+"""
+
+import logging
+
+import pytest
+
+from gateway import config as gateway_config
+from gateway.config import Platform, load_gateway_config
+
+
+# platform -> env credentials that trigger its env-enable branch
+CRED_ENV = {
+    "weixin": {
+        "WEIXIN_TOKEN": "wx_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e",
+        "WEIXIN_ACCOUNT_ID": "acct_12345",
+    },
+    "whatsapp_cloud": {
+        "WHATSAPP_CLOUD_PHONE_NUMBER_ID": "1234567890",
+        "WHATSAPP_CLOUD_ACCESS_TOKEN": "EAAB-test-access-token",
+    },
+    "homeassistant": {"HASS_TOKEN": "hass-long-lived-token"},
+    "email": {
+        "EMAIL_ADDRESS": "bot@example.com",
+        "EMAIL_PASSWORD": "app-password",
+        "EMAIL_IMAP_HOST": "imap.example.com",
+        "EMAIL_SMTP_HOST": "smtp.example.com",
+    },
+    "sms": {"TWILIO_ACCOUNT_SID": "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
+    "dingtalk": {"DINGTALK_CLIENT_ID": "ding-id", "DINGTALK_CLIENT_SECRET": "ding-secret"},
+    "feishu": {"FEISHU_APP_ID": "cli_feishu", "FEISHU_APP_SECRET": "feishu-secret"},
+    "wecom": {"WECOM_BOT_ID": "wecom-bot", "WECOM_SECRET": "wecom-secret"},
+    "wecom_callback": {
+        "WECOM_CALLBACK_CORP_ID": "corp-id",
+        "WECOM_CALLBACK_CORP_SECRET": "corp-secret",
+    },
+    "bluebubbles": {
+        "BLUEBUBBLES_SERVER_URL": "http://127.0.0.1:1234",
+        "BLUEBUBBLES_PASSWORD": "bb-password",
+    },
+    "qqbot": {"QQ_APP_ID": "qq-app", "QQ_CLIENT_SECRET": "qq-secret"},
+    "yuanbao": {"YUANBAO_APP_ID": "yb-app", "YUANBAO_APP_SECRET": "yb-secret"},
+    # control: the pattern that always honored the explicit disable
+    "telegram": {"TELEGRAM_BOT_TOKEN": "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11"},
+}
+
+_PLATFORM_ENV_PREFIXES = (
+    "TELEGRAM_", "DISCORD_", "SLACK_", "WEIXIN_", "WHATSAPP_", "HASS_", "EMAIL_",
+    "TWILIO_", "DINGTALK_", "FEISHU_", "WECOM_", "BLUEBUBBLES_", "QQ_", "QQBOT_",
+    "YUANBAO_", "GATEWAY_RELAY", "SIGNAL_", "MATTERMOST_", "MATRIX_",
+)
+
+
+def _isolate(monkeypatch, tmp_path, env):
+    import os
+
+    for key in list(os.environ):
+        if key.startswith(_PLATFORM_ENV_PREFIXES):
+            monkeypatch.delenv(key, raising=False)
+    hermes_home = tmp_path / ".hermes"
+    hermes_home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+    for k, v in env.items():
+        monkeypatch.setenv(k, v)
+    return hermes_home
+
+
+@pytest.mark.parametrize("platform", sorted(CRED_ENV))
+def test_yaml_explicit_disable_survives_env_credentials(platform, tmp_path, monkeypatch):
+    """``platforms.<x>.enabled: false`` + credentials in env -> stays disabled."""
+    hermes_home = _isolate(monkeypatch, tmp_path, CRED_ENV[platform])
+    (hermes_home / "config.yaml").write_text(
+        f"platforms:\n  {platform}:\n    enabled: false\n", encoding="utf-8"
+    )
+
+    config = load_gateway_config()
+
+    cfg = config.platforms.get(Platform(platform))
+    assert cfg is not None
+    assert cfg.enabled is False, (
+        f"{platform}: env credentials re-enabled a platform the user explicitly "
+        "disabled in config.yaml (#48820 Bug 2)"
+    )
+
+
+@pytest.mark.parametrize("platform", sorted(CRED_ENV))
+def test_env_credentials_still_enable_without_yaml_opinion(platform, tmp_path, monkeypatch):
+    """No ``enabled`` key in YAML + credentials in env -> env-only setup still works."""
+    hermes_home = _isolate(monkeypatch, tmp_path, CRED_ENV[platform])
+    (hermes_home / "config.yaml").write_text("platforms: {}\n", encoding="utf-8")
+
+    config = load_gateway_config()
+
+    cfg = config.platforms.get(Platform(platform))
+    assert cfg is not None and cfg.enabled is True, (
+        f"{platform}: env-only configuration must still enable the platform"
+    )
+
+
+def test_env_credentials_still_populate_extra_when_yaml_disables(tmp_path, monkeypatch):
+    """The disable only gates ``enabled``; credentials are still wired through
+    (mirrors the Slack/API-server contract so send-only tooling keeps working)."""
+    hermes_home = _isolate(monkeypatch, tmp_path, CRED_ENV["weixin"])
+    (hermes_home / "config.yaml").write_text(
+        "platforms:\n  weixin:\n    enabled: false\n", encoding="utf-8"
+    )
+
+    config = load_gateway_config()
+
+    cfg = config.platforms[Platform.WEIXIN]
+    assert cfg.enabled is False
+    assert cfg.token == CRED_ENV["weixin"]["WEIXIN_TOKEN"]
+    assert cfg.extra.get("account_id") == "acct_12345"
+    # marker never leaks out of config load
+    assert "_enabled_explicit" not in cfg.extra
+
+
+@pytest.fixture()
+def _fresh_warn_dedup(monkeypatch):
+    """The explicit-disable notice is one-time per process; start each test clean."""
+    monkeypatch.setattr(gateway_config, "_EXPLICIT_DISABLE_WARNED", set())
+
+
+@pytest.mark.usefixtures("_fresh_warn_dedup")
+@pytest.mark.parametrize("platform", sorted(CRED_ENV))
+def test_explicit_disable_with_env_credentials_warns_once(platform, tmp_path, monkeypatch, caplog):
+    """Users who relied on 'creds in .env = platform on' must be told why it went
+    dark: one WARNING naming the platform, the winning config key, and the env
+    credential(s) — emitted once per process, not on every config reload."""
+    hermes_home = _isolate(monkeypatch, tmp_path, CRED_ENV[platform])
+    (hermes_home / "config.yaml").write_text(
+        f"platforms:\n  {platform}:\n    enabled: false\n", encoding="utf-8"
+    )
+
+    with caplog.at_level(logging.WARNING, logger="gateway.config"):
+        load_gateway_config()
+        load_gateway_config()  # reload: must not repeat
+
+    hits = [
+        r for r in caplog.records
+        if r.levelno == logging.WARNING and f"platforms.{platform}.enabled: false" in r.getMessage()
+    ]
+    assert len(hits) == 1, [r.getMessage() for r in caplog.records]
+    msg = hits[0].getMessage()
+    assert f"Platform '{platform}'" in msg
+    for env_name in CRED_ENV[platform]:
+        assert env_name in msg
+    assert f"platforms.{platform}.enabled: true" in msg  # the remedy
+
+
+@pytest.mark.usefixtures("_fresh_warn_dedup")
+def test_no_warning_when_yaml_has_no_opinion_or_is_enabled(tmp_path, monkeypatch, caplog):
+    hermes_home = _isolate(monkeypatch, tmp_path, {**CRED_ENV["weixin"], **CRED_ENV["homeassistant"]})
+    (hermes_home / "config.yaml").write_text(
+        "platforms:\n  homeassistant:\n    enabled: true\n", encoding="utf-8"
+    )
+
+    with caplog.at_level(logging.WARNING, logger="gateway.config"):
+        config = load_gateway_config()
+
+    assert config.platforms[Platform.WEIXIN].enabled is True
+    assert config.platforms[Platform.HOMEASSISTANT].enabled is True
+    assert not [r for r in caplog.records if "explicitly disabled" in r.getMessage()]
+
+
+@pytest.mark.usefixtures("_fresh_warn_dedup")
+def test_no_warning_when_disabled_and_no_env_credentials(tmp_path, monkeypatch, caplog):
+    """The notice is about credentials being IGNORED; a plain disable is silent."""
+    hermes_home = _isolate(monkeypatch, tmp_path, {})
+    (hermes_home / "config.yaml").write_text(
+        "platforms:\n  weixin:\n    enabled: false\n", encoding="utf-8"
+    )
+
+    with caplog.at_level(logging.WARNING, logger="gateway.config"):
+        config = load_gateway_config()
+
+    assert config.platforms[Platform.WEIXIN].enabled is False
+    assert not [r for r in caplog.records if "explicitly disabled" in r.getMessage()]
+
+
+def test_every_env_enable_branch_is_named_for_the_warning():
+    """Each platform routed through ``_enable_from_env`` needs a credential
+    entry so the WARNING can name what is being ignored."""
+    import inspect, re
+
+    src = inspect.getsource(gateway_config._apply_env_overrides)
+    routed = {Platform[name] for name in re.findall(r"_enable_from_env\(Platform\.([A-Z_]+)\)", src)}
+    routed.add(Platform.SLACK)  # Slack has its own inline copy of the logic
+    missing = {p.value for p in routed} - {p.value for p in gateway_config._ENV_ENABLE_CREDENTIALS}
+    assert not missing, f"platforms without a credential entry for the explicit-disable warning: {missing}"
diff --git a/tests/gateway/test_fast_command.py b/tests/gateway/test_fast_command.py
index c714b76e84..b8792ecce4 100644
--- a/tests/gateway/test_fast_command.py
+++ b/tests/gateway/test_fast_command.py
@@ -109,8 +109,8 @@ def test_turn_route_injects_priority_processing_without_changing_runtime():
     runner._service_tier = "priority"
     runtime_kwargs = {
         "api_key": "***",
-        "base_url": "https://openrouter.ai/api/v1",
-        "provider": "openrouter",
+        "base_url": "https://api.openai.com/v1",
+        "provider": "openai",
         "api_mode": "chat_completions",
         "command": None,
         "args": [],
@@ -119,10 +119,15 @@ def test_turn_route_injects_priority_processing_without_changing_runtime():
 
     route = gateway_run.GatewayRunner._resolve_turn_agent_config(runner, "hi", "gpt-5.4", runtime_kwargs)
 
-    assert route["runtime"]["provider"] == "openrouter"
+    assert route["runtime"]["provider"] == "openai"
     assert route["runtime"]["api_mode"] == "chat_completions"
     assert route["request_overrides"] == {"service_tier": "priority"}
 
+    # Proxied routes never receive the param (OpenRouter strips it / others 400).
+    runtime_kwargs.update(base_url="https://openrouter.ai/api/v1", provider="openrouter")
+    route = gateway_run.GatewayRunner._resolve_turn_agent_config(runner, "hi", "gpt-5.4", runtime_kwargs)
+    assert route["request_overrides"] == {}
+
 
 @pytest.mark.asyncio
 async def test_handle_fast_command_global_flag_persists_config(monkeypatch, tmp_path):
diff --git a/tests/gateway/test_feishu_bot_admission.py b/tests/gateway/test_feishu_bot_admission.py
index 09157c757e..b396e90d29 100644
--- a/tests/gateway/test_feishu_bot_admission.py
+++ b/tests/gateway/test_feishu_bot_admission.py
@@ -566,3 +566,77 @@ def test_handle_message_event_data_forwards_sender_when_admitted():
     assert captured.get("sender_id") is sender.sender_id
     assert captured.get("is_bot") is True
     assert captured.get("message_id") == "om_bot_ok"
+
+
+# --- Profile-scoped admission config (#86905) -------------------------------
+
+
+def test_dm_admission_config_resolves_from_profile_scope_under_multiplex(tmp_path, monkeypatch):
+    """os.environ holds the DEFAULT profile's admission view; a secondary
+    profile's .env must govern its own adapter — Feishu open_ids are
+    app-scoped, so the default allow-list can never match the role app's
+    senders, and the role profile's allow-all flag must be honored."""
+    import agent.secret_scope as ss
+    from plugins.platforms.feishu.adapter import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_default")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_default")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_default_view")
+    monkeypatch.setenv("FEISHU_ALLOW_BOTS", "all")
+    monkeypatch.delenv("GATEWAY_ALLOW_ALL_USERS", raising=False)
+    monkeypatch.delenv("FEISHU_ALLOW_ALL_USERS", raising=False)
+    (tmp_path / ".env").write_text(
+        "FEISHU_APP_ID=cli_role\nFEISHU_APP_SECRET=secret_role\n"
+        "FEISHU_ALLOWED_USERS=ou_role_view\n",
+        encoding="utf-8",
+    )
+
+    ss.set_multiplex_active(True)
+    tok = ss.set_secret_scope(ss.build_profile_secret_scope(tmp_path))
+    try:
+        settings = FeishuAdapter._load_settings(extra={})
+    finally:
+        ss.reset_secret_scope(tok)
+    (tmp_path / ".env").write_text(
+        "FEISHU_APP_ID=cli_role\nFEISHU_APP_SECRET=secret_role\nGATEWAY_ALLOW_ALL_USERS=true\n",
+        encoding="utf-8",
+    )
+    tok = ss.set_secret_scope(ss.build_profile_secret_scope(tmp_path))
+    try:
+        allow_all = FeishuAdapter._load_settings(extra={})
+    finally:
+        ss.reset_secret_scope(tok)
+        ss.set_multiplex_active(False)
+
+    assert settings.app_id == "cli_role"
+    assert settings.allowed_group_users == frozenset({"ou_role_view"})
+    assert settings.allow_bots == "none"  # default's "all" must not leak in
+    assert settings.allow_all_dm is False
+
+    # _admit runs on the WS thread with no scope: the snapshot must carry.
+    adapter = object.__new__(FeishuAdapter)
+    adapter._apply_settings(settings)
+    assert adapter._admit(make_sender(open_id="ou_role_view"), make_message(chat_type="p2p")) is None
+    assert adapter._admit(make_sender(open_id="ou_default_view"), make_message(chat_type="p2p")) == "dm_policy_rejected"
+
+    assert allow_all.allow_all_dm is True
+    adapter = object.__new__(FeishuAdapter)
+    adapter._apply_settings(allow_all)
+    assert adapter._admit(make_sender(open_id="ou_anyone"), make_message(chat_type="p2p")) is None
+
+
+def test_dm_admission_config_falls_back_to_os_environ_when_unscoped(monkeypatch):
+    """Single-profile behavior unchanged: process env still configures DMs."""
+    from plugins.platforms.feishu.adapter import FeishuAdapter
+
+    monkeypatch.setenv("FEISHU_APP_ID", "cli_test")
+    monkeypatch.setenv("FEISHU_APP_SECRET", "secret_test")
+    monkeypatch.setenv("GATEWAY_ALLOW_ALL_USERS", "true")
+    monkeypatch.setenv("FEISHU_ALLOWED_USERS", "ou_a,ou_b")
+
+    settings = FeishuAdapter._load_settings(extra={})
+    assert settings.allow_all_dm is True
+    assert settings.allowed_group_users == frozenset({"ou_a", "ou_b"})
+    adapter = object.__new__(FeishuAdapter)
+    adapter._apply_settings(settings)
+    assert adapter._admit(make_sender(open_id="ou_anyone"), make_message(chat_type="p2p")) is None
diff --git a/tests/gateway/test_feishu_ws_multiplex_isolation.py b/tests/gateway/test_feishu_ws_multiplex_isolation.py
new file mode 100644
index 0000000000..ca7d514cc3
--- /dev/null
+++ b/tests/gateway/test_feishu_ws_multiplex_isolation.py
@@ -0,0 +1,167 @@
+"""Multiplex isolation for the lark_oapi WS client (issue #73779).
+
+``lark_oapi.ws.client`` keeps the loop used by ``Client.start()`` in a
+module-level global and Hermes monkey-patches ``websockets.connect`` on the
+shared module. With N profile WS threads the globals were last-write-wins:
+"Future attached to a different loop" crashes or a client bound to a
+sibling's loop that never hears anything again.
+"""
+
+import asyncio
+import sys
+import threading
+import types
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+from plugins.platforms.feishu import adapter as feishu_adapter
+
+
+def _inject_fake_lark_module(monkeypatch, connect=None):
+    """Make ``import lark_oapi.ws.client`` resolve to a module with the SDK's
+    global layout (``loop`` + ``websockets.connect``)."""
+    if connect is None:
+        connect = MagicMock(name="real-connect")
+    lark = types.ModuleType("lark_oapi")
+    lark_ws = types.ModuleType("lark_oapi.ws")
+    client_mod = types.ModuleType("lark_oapi.ws.client")
+    client_mod.loop = SimpleNamespace(name="sdk-default-loop")
+    client_mod.websockets = SimpleNamespace(connect=connect)
+    lark.ws = lark_ws
+    lark_ws.client = client_mod
+    monkeypatch.setitem(sys.modules, "lark_oapi", lark)
+    monkeypatch.setitem(sys.modules, "lark_oapi.ws", lark_ws)
+    monkeypatch.setitem(sys.modules, "lark_oapi.ws.client", client_mod)
+    monkeypatch.setattr(feishu_adapter, "_WS_ISOLATION_INSTALLED", False)
+    return client_mod
+
+
+def _adapter_stub(**overrides):
+    stub = SimpleNamespace(
+        _ws_thread_loop=None,
+        _ws_reconnect_nonce=None,
+        _ws_reconnect_interval=None,
+        _ws_ping_interval=None,
+        _ws_ping_timeout=None,
+    )
+    for key, value in overrides.items():
+        setattr(stub, key, value)
+    return stub
+
+
+def test_two_concurrent_clients_each_use_their_own_loop_and_overrides(monkeypatch):
+    """Two profiles start() concurrently through the module global: each must
+    run on its own loop, and websockets.connect must receive only the
+    calling profile's ping overrides. On main both are last-write-wins."""
+    real_connect = MagicMock(name="real-connect")
+    client_mod = _inject_fake_lark_module(monkeypatch, connect=real_connect)
+
+    results = {}
+    barrier = threading.Barrier(2)
+
+    class FakeClient:
+        def __init__(self, name):
+            self._name = name
+
+        def start(self):
+            barrier.wait(timeout=10)  # both threads past the global "assign"
+
+            async def probe():
+                await asyncio.sleep(0.02)
+                return id(asyncio.get_running_loop())
+
+            results[self._name] = client_mod.loop.run_until_complete(probe())
+            client_mod.websockets.connect(f"wss://{self._name}")
+
+    pings = {"p0": 10, "p1": 20}
+
+    def run(name):
+        feishu_adapter._run_official_feishu_ws_client(
+            FakeClient(name), _adapter_stub(_ws_ping_interval=pings[name])
+        )
+
+    threads = [threading.Thread(target=run, args=(f"p{i}",)) for i in range(2)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout=15)
+        assert not t.is_alive()
+
+    assert results["p0"] != results["p1"]
+    calls = {c.args[0]: c.kwargs for c in real_connect.call_args_list}
+    assert calls == {"wss://p0": {"ping_interval": 10}, "wss://p1": {"ping_interval": 20}}
+    # Thread-local registrations are cleared for the pooled executor thread.
+    assert getattr(feishu_adapter._ws_isolation_state, "loop", None) is None
+    assert getattr(feishu_adapter._ws_isolation_state, "connect_kwargs", None) is None
+
+
+def _supervisor_stub():
+    stub = SimpleNamespace(
+        _running=True,
+        _ws_future=None,
+        _ws_client=object(),
+        _ws_restart_backoff=0.01,
+        connect_calls=0,
+        connect_should_fail=0,
+    )
+
+    async def _connect_websocket():
+        stub.connect_calls += 1
+        if stub.connect_should_fail > 0:
+            stub.connect_should_fail -= 1
+            raise RuntimeError("simulated restart failure")
+        fut = asyncio.get_running_loop().create_future()
+        fut.set_result(None)  # new thread dies immediately too
+        stub._ws_future = fut
+
+    stub._connect_websocket = _connect_websocket
+    return stub
+
+
+def test_supervisor_restarts_a_dead_ws_thread_with_backoff():
+    """A dead WS thread used to leave the profile silently deaf (the future
+    was awaited only by disconnect()). The supervisor must rebuild the client
+    and survive a failed restart without hot-looping."""
+
+    async def scenario():
+        stub = _supervisor_stub()
+        stub.connect_should_fail = 1
+        fut = asyncio.get_running_loop().create_future()
+        fut.set_result(None)  # the WS "thread" is already dead
+        stub._ws_future = fut
+
+        task = asyncio.ensure_future(
+            feishu_adapter.FeishuAdapter._supervise_websocket_thread(stub)
+        )
+        for _ in range(300):
+            await asyncio.sleep(0.01)
+            if stub.connect_calls >= 2:
+                break
+        task.cancel()
+        try:
+            await task
+        except asyncio.CancelledError:
+            pass
+        return stub.connect_calls
+
+    assert asyncio.run(scenario()) == 2  # failed restart, then a successful one
+
+
+def test_supervisor_stops_when_disconnect_nils_the_client():
+    async def scenario():
+        stub = _supervisor_stub()
+        fut = asyncio.get_running_loop().create_future()  # thread "alive"
+        stub._ws_future = fut
+
+        task = asyncio.ensure_future(
+            feishu_adapter.FeishuAdapter._supervise_websocket_thread(stub)
+        )
+        await asyncio.sleep(0.01)
+        stub._ws_client = None  # deliberate disconnect ...
+        fut.set_result(None)  # ... then the thread exits
+        await asyncio.wait_for(asyncio.shield(task), timeout=2.0)
+        return stub, task
+
+    stub, task = asyncio.run(scenario())
+    assert task.done()
+    assert stub.connect_calls == 0
diff --git a/tests/gateway/test_fifo_overflow_rescue.py b/tests/gateway/test_fifo_overflow_rescue.py
new file mode 100644
index 0000000000..e1f3efd110
--- /dev/null
+++ b/tests/gateway/test_fifo_overflow_rescue.py
@@ -0,0 +1,159 @@
+"""Regression tests for #99882: FIFO overflow orphan rescue.
+
+When a follow-up is demoted to /queue during compression-in-flight,
+it lands in SessionState.conversation.queued_events (overflow) with
+the current turn's event occupying adapter._pending_messages[session_key]
+(slot).  After the slot's turn completes, _promote_queued_event moves
+the overflow head into the slot.  When that drain never runs — the
+busy window ended through an exit that skipped the promotion site
+(/stop, turn exception, generation bump) — the overflow is silently
+orphaned: never dispatched, never persisted, never logged.
+
+The rescue in GatewayRunner._rescue_orphaned_overflow pops the oldest
+orphan for the caller to run as the current turn and stages the next
+orphan in the slot, so FIFO order (#28503) holds and nothing runs twice.
+"""
+
+from unittest.mock import MagicMock
+
+from gateway.platforms.base import (
+    BasePlatformAdapter,
+    MessageEvent,
+    MessageType,
+    Platform,
+    PlatformConfig,
+)
+from gateway.run import GatewayRunner
+
+
+class _StubAdapter(BasePlatformAdapter):
+    def __init__(self):
+        super().__init__(PlatformConfig(enabled=True, token="test"), Platform.TELEGRAM)
+
+    async def connect(self, *, is_reconnect: bool = False) -> bool:
+        return True
+
+    async def disconnect(self) -> None:
+        self._mark_disconnected()
+
+    async def send(self, chat_id, content, reply_to=None, metadata=None):
+        from gateway.platforms.base import SendResult
+
+        return SendResult(success=True, message_id="msg-1")
+
+    async def get_chat_info(self, chat_id):
+        return {"id": chat_id, "type": "dm"}
+
+
+def _text_event(text: str, msg_id: str) -> MessageEvent:
+    return MessageEvent(
+        text=text,
+        message_type=MessageType.TEXT,
+        source=MagicMock(chat_id="123", platform=Platform.TELEGRAM, profile=None),
+        message_id=msg_id,
+    )
+
+
+def _runner() -> GatewayRunner:
+    runner = GatewayRunner.__new__(GatewayRunner)
+    runner._queued_events = {}
+    return runner
+
+
+class TestRescueOrphanedOverflow:
+    def test_single_orphan_is_returned_and_removed_from_both_stores(self):
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:1"
+        runner._session_state(session_key).conversation.queued_events.append(
+            _text_event("orphan-1", "o1")
+        )
+        assert session_key not in adapter._pending_messages
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+
+        assert rescued is not None and rescued.text == "orphan-1"
+        # The rescued event runs as the current turn, so it must NOT also
+        # sit in the slot — the post-turn drain would run it a second time.
+        assert session_key not in adapter._pending_messages
+        assert runner._session_state(session_key).conversation.queued_events == []
+
+    def test_two_orphans_return_oldest_and_stage_next_in_slot(self):
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:1b"
+        runner._session_state(session_key).conversation.queued_events.extend(
+            [_text_event("orphan-1", "o1"), _text_event("orphan-2", "o2")]
+        )
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+
+        assert rescued is not None and rescued.text == "orphan-1"
+        # Slot now holds the NEXT orphan so the drain continues the chain.
+        assert adapter._pending_messages[session_key].text == "orphan-2"
+        assert runner._session_state(session_key).conversation.queued_events == []
+
+    def test_noop_when_slot_occupied(self):
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:2"
+        runner._session_state(session_key).conversation.queued_events.append(
+            _text_event("orphan", "o1")
+        )
+        adapter._pending_messages[session_key] = _text_event("busy-slot", "slot")
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+
+        assert rescued is None
+        assert adapter._pending_messages[session_key].text == "busy-slot"
+        assert len(runner._session_state(session_key).conversation.queued_events) == 1
+
+    def test_noop_when_no_overflow(self):
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:3"
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+
+        assert rescued is None
+        assert session_key not in adapter._pending_messages
+
+    def test_fifo_order_preserved_across_rescue_and_new_message(self):
+        """Oldest orphan runs first, new arrival last — FIFO (#28503).
+
+        Mirrors the idle-arrival call site: rescue → _enqueue_fifo(new).
+        """
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:4"
+        runner._session_state(session_key).conversation.queued_events.extend(
+            [_text_event("orphan-1", "o1"), _text_event("orphan-2", "o2")]
+        )
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+        assert rescued is not None and rescued.text == "orphan-1"
+        runner._enqueue_fifo(session_key, _text_event("new-msg", "new1"), adapter)
+
+        # Drain order after this turn: slot (orphan-2), then overflow (new-msg)
+        assert adapter._pending_messages[session_key].text == "orphan-2"
+        overflow_texts = [
+            e.text for e in runner._session_state(session_key).conversation.queued_events
+        ]
+        assert overflow_texts == ["new-msg"]
+
+    def test_single_orphan_then_new_message_lands_in_slot(self):
+        """With one orphan the slot is free after rescue, so the incoming
+        message must go to the slot (not overflow) or the drain never sees it."""
+        runner = _runner()
+        adapter = _StubAdapter()
+        session_key = "telegram:user:5"
+        runner._session_state(session_key).conversation.queued_events.append(
+            _text_event("orphan-1", "o1")
+        )
+
+        rescued = runner._rescue_orphaned_overflow(session_key, adapter)
+        assert rescued is not None and rescued.text == "orphan-1"
+        runner._enqueue_fifo(session_key, _text_event("new-msg", "new1"), adapter)
+
+        assert adapter._pending_messages[session_key].text == "new-msg"
+        assert runner._session_state(session_key).conversation.queued_events == []
diff --git a/tests/gateway/test_gateway_trust_env.py b/tests/gateway/test_gateway_trust_env.py
new file mode 100644
index 0000000000..78965ee66b
--- /dev/null
+++ b/tests/gateway/test_gateway_trust_env.py
@@ -0,0 +1,47 @@
+"""gateway.trust_env — one config key controls aiohttp proxy-env honoring at every adapter site (#48820)."""
+import re
+from pathlib import Path
+
+import pytest
+
+from gateway.platforms import base as gw_base
+
+REPO = Path(__file__).resolve().parents[2]
+_ADAPTER_FILES = sorted(
+    list((REPO / "gateway" / "platforms").rglob("*.py"))
+    + list((REPO / "plugins" / "platforms").rglob("*.py"))
+)
+
+
+def _write_config(tmp_path, monkeypatch, body: str) -> None:
+    # load_config caches on (path, mtime) — a fresh tmp HERMES_HOME per test is a fresh cache key.
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    (tmp_path / "config.yaml").write_text(body)
+
+
+@pytest.mark.parametrize(
+    "yaml_body, expected",
+    [("gateway:\n  trust_env: false\n", False), ("gateway:\n  trust_env: true\n", True), ("{}\n", True)],
+)
+def test_gateway_trust_env_reads_config(tmp_path, monkeypatch, yaml_body, expected):
+    """gateway.trust_env in config.yaml drives the shared helper; absent → True (default)."""
+    _write_config(tmp_path, monkeypatch, yaml_body)
+    assert gw_base.gateway_trust_env() is expected
+    # The generic-proxy discovery path is gated by the same knob; explicit per-platform vars are not.
+    monkeypatch.setenv("HTTPS_PROXY", "http://127.0.0.1:7890")
+    monkeypatch.delenv("NO_PROXY", raising=False)
+    monkeypatch.delenv("no_proxy", raising=False)
+    assert (gw_base.resolve_proxy_url() is not None) is expected
+    monkeypatch.setenv("X_PLATFORM_PROXY", "http://127.0.0.1:1080")
+    assert gw_base.resolve_proxy_url("X_PLATFORM_PROXY") == "http://127.0.0.1:1080"
+
+
+def test_no_bare_trust_env_literal_in_adapters():
+    """Every aiohttp session in gateway/ + plugins/platforms/ must go through gateway_trust_env()."""
+    bare = re.compile(r"trust_env\s*=\s*(True|False)\b")
+    offenders = []
+    for path in _ADAPTER_FILES:
+        for lineno, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            if bare.search(line) and "httpx" not in line:
+                offenders.append(f"{path.relative_to(REPO)}:{lineno}: {line.strip()}")
+    assert not offenders, "hard-coded aiohttp trust_env literal(s); use gateway_trust_env():\n" + "\n".join(offenders)
diff --git a/tests/gateway/test_goal_continuation_drain.py b/tests/gateway/test_goal_continuation_drain.py
index 662f541fc6..6a969c07e3 100644
--- a/tests/gateway/test_goal_continuation_drain.py
+++ b/tests/gateway/test_goal_continuation_drain.py
@@ -87,6 +87,11 @@ def hermes_home(tmp_path, monkeypatch):
     from hermes_cli import goals
 
     goals._DB_CACHE.clear()
+    # Pre-warm the SessionDB cache from this sync (non-loop) context so the
+    # async tests' GoalManager.set() never races the bounded loop-thread
+    # bootstrap window on loaded CI runners (goal silently not persisted →
+    # continuation never enqueued; flaked on main run 33455779041).
+    goals._get_session_db()
     yield home
     goals._DB_CACHE.clear()
 
diff --git a/tests/gateway/test_goal_max_turns_config.py b/tests/gateway/test_goal_max_turns_config.py
index 4e4f8657d9..3d3c81e3a0 100644
--- a/tests/gateway/test_goal_max_turns_config.py
+++ b/tests/gateway/test_goal_max_turns_config.py
@@ -59,6 +59,10 @@ async def test_gateway_goal_uses_goals_max_turns_from_full_config(tmp_path, monk
     (home / "config.yaml").write_text("goals:\n  max_turns: 7\n", encoding="utf-8")
     monkeypatch.setenv("HERMES_HOME", str(home))
     goals._DB_CACHE.clear()
+    # Pre-warm from sync context: the /goal handler runs on the event loop,
+    # where a cold cache only waits the bounded bootstrap window — under CI
+    # load the goal write can be dropped and the state assertion flakes.
+    goals._get_session_db()
 
     runner = _make_runner()
 
diff --git a/tests/gateway/test_goal_resume_restart.py b/tests/gateway/test_goal_resume_restart.py
index 7b9be97ad3..2fcf1f34c5 100644
--- a/tests/gateway/test_goal_resume_restart.py
+++ b/tests/gateway/test_goal_resume_restart.py
@@ -46,6 +46,10 @@ def hermes_home(tmp_path, monkeypatch):
 
     token = set_hermes_home_override(str(home))
     goals._DB_CACHE.clear()
+    # Pre-warm the SessionDB cache from sync context so async GoalManager
+    # writes never race the bounded loop-thread bootstrap window on loaded
+    # CI runners (goal silently unpersisted; main run 33455779041).
+    goals._get_session_db()
     yield home
     try:
         reset_hermes_home_override(token)
diff --git a/tests/gateway/test_google_chat.py b/tests/gateway/test_google_chat.py
index 19aa5163e6..d3a05ea00c 100644
--- a/tests/gateway/test_google_chat.py
+++ b/tests/gateway/test_google_chat.py
@@ -270,6 +270,61 @@ class TestEnvConfigLoading:
         cfg = load_gateway_config()
         assert _GC not in cfg.platforms
 
+    def test_multiplex_scoped_profile_never_borrows_process_env(
+        self, monkeypatch, tmp_path
+    ):
+        """Under multiplex a scoped profile sees ONLY its own Google Chat
+        settings, and the ADC branch fails closed instead of authenticating
+        as the default profile's service account (#73439)."""
+        from agent.secret_scope import (
+            build_profile_secret_scope,
+            set_multiplex_active,
+            set_secret_scope,
+        )
+
+        self._clean_env(monkeypatch)
+        monkeypatch.setenv("GOOGLE_CHAT_PROJECT_ID", "default-proj")
+        monkeypatch.setenv("GOOGLE_CHAT_SUBSCRIPTION_NAME", "default-sub")
+        monkeypatch.setenv("GOOGLE_APPLICATION_CREDENTIALS", "/secrets/default.json")
+        monkeypatch.setenv("GOOGLE_CHAT_BOOTSTRAP_SPACES", "spaces/DEFAULT")
+        profile_home = tmp_path / "beta"
+        profile_home.mkdir()
+        (profile_home / ".env").write_text(
+            "GOOGLE_CHAT_PROJECT_ID=beta-proj\nGOOGLE_CHAT_SUBSCRIPTION_NAME=beta-sub\n"
+        )
+        set_multiplex_active(True)
+        token = set_secret_scope(build_profile_secret_scope(profile_home))
+        try:
+            seed = _gc_mod._env_enablement() or {}
+            beta = GoogleChatAdapter(
+                PlatformConfig(enabled=True, extra={"project_id": "beta-proj", "subscription_name": "beta-sub"})
+            )
+            with pytest.raises(ValueError, match="ADC skipped"):
+                beta._load_sa_credentials()
+        finally:
+            from agent.secret_scope import reset_secret_scope
+
+            reset_secret_scope(token)
+            set_multiplex_active(False)
+        assert seed["project_id"] == "beta-proj"
+        assert "service_account_json" not in seed
+        assert beta._bootstrap_spaces == ""
+
+    def test_multiplex_default_profile_constructs_unscoped(self, monkeypatch):
+        """The default profile's adapter is built OUTSIDE any scope while
+        multiplex is active (gateway startup/reconnect); it must keep reading
+        its own process env instead of raising UnscopedSecretError."""
+        from agent.secret_scope import set_multiplex_active
+
+        self._clean_env(monkeypatch)
+        monkeypatch.setenv("GOOGLE_CHAT_BOOTSTRAP_SPACES", "spaces/DEFAULT")
+        set_multiplex_active(True)
+        try:
+            default = GoogleChatAdapter(_base_config())
+        finally:
+            set_multiplex_active(False)
+        assert default._bootstrap_spaces == "spaces/DEFAULT"
+
 
 # ===========================================================================
 # Pure helpers
diff --git a/tests/gateway/test_handoff_secondary_profile_adapter.py b/tests/gateway/test_handoff_secondary_profile_adapter.py
index e637b293c1..b65e75bfd6 100644
--- a/tests/gateway/test_handoff_secondary_profile_adapter.py
+++ b/tests/gateway/test_handoff_secondary_profile_adapter.py
@@ -167,6 +167,34 @@ async def test_default_profile_handoff_keeps_primary_adapter(monkeypatch):
     assert used["home_chat_id"] == "1111"
 
 
+@pytest.mark.asyncio
+async def test_secondary_profile_config_load_failure_fails_closed(monkeypatch):
+    """A secondary profile whose config cannot load must fail the handoff.
+
+    Falling back to the primary's config delivers through the right bot to
+    the WRONG chat (the primary's home channel) and reports completed.
+    """
+    runner, _ = _make_multiplex_runner()
+    used = {}
+
+    def _boom():
+        raise RuntimeError("config.yaml exploded")
+
+    monkeypatch.setattr(
+        "gateway.run.resolve_delivery_transport", _spy_transport_factory(used),
+    )
+    monkeypatch.setattr("gateway.run.load_gateway_config", _boom)
+
+    with pytest.raises(RuntimeError, match="could not load config"):
+        await runner._process_handoff(
+            {"id": "cli-session", "title": "work", "handoff_platform": "telegram"},
+            profile_name="medicina",
+        )
+    assert used == {}, (
+        "nothing may be delivered when the profile config fails to load"
+    )
+
+
 @pytest.mark.asyncio
 async def test_secondary_profile_without_live_adapters_fails_loudly(monkeypatch):
     """Never silently fall back to the primary's bot — that ships to the wrong chat.
diff --git a/tests/gateway/test_handoff_watcher_multiprofile.py b/tests/gateway/test_handoff_watcher_multiprofile.py
index 08bcf95710..bea32bc7bc 100644
--- a/tests/gateway/test_handoff_watcher_multiprofile.py
+++ b/tests/gateway/test_handoff_watcher_multiprofile.py
@@ -15,6 +15,7 @@ These tests pin the two halves of the fix:
 """
 
 import asyncio
+import threading
 import types
 from pathlib import Path
 
@@ -111,14 +112,14 @@ async def test_watcher_enters_profile_scope_for_each_home(monkeypatch):
         def __init__(self, home):
             self.home = home
 
-        def __enter__(self):
+        async def __aenter__(self):
             entered.append(self.home)
             return self
 
-        def __exit__(self, *exc):
+        async def __aexit__(self, *exc):
             return False
 
-    monkeypatch.setattr(run, "_profile_runtime_scope", _SpyScope)
+    monkeypatch.setattr(run, "_async_profile_runtime_scope", _SpyScope)
 
     async def _no_sleep(_seconds):
         return None
@@ -159,6 +160,68 @@ async def test_watcher_enters_profile_scope_for_each_home(monkeypatch):
     assert db.polls == 3, "root + both profiles polled once each per tick"
 
 
+@pytest.mark.asyncio
+async def test_slow_profile_secret_load_does_not_block_event_loop(monkeypatch, tmp_path):
+    """A slow profile ``.env`` read must not stall unrelated loop work."""
+    profile_home = tmp_path / "profiles" / "slow"
+    profile_home.mkdir(parents=True)
+    monkeypatch.setattr(
+        run,
+        "_handoff_watch_scopes",
+        lambda _runner: [(None, None), ("slow", profile_home)],
+    )
+
+    from agent import secret_scope
+
+    load_started = threading.Event()
+    ticker_progressed = threading.Event()
+    ticker_progressed_while_loading = []
+
+    def _slow_build(_home):
+        load_started.set()
+        ticker_progressed_while_loading.append(
+            ticker_progressed.wait(timeout=2)
+        )
+        return {}
+
+    monkeypatch.setattr(secret_scope, "build_profile_secret_scope", _slow_build)
+
+    class _DB:
+        async def list_pending_handoffs(self):
+            return []
+
+    fake = types.SimpleNamespace(
+        _session_db=_DB(),
+        _running=False,
+    )
+
+    async def _process_handoff(_row, _profile_name=None):
+        return None
+
+    fake._process_handoff = _process_handoff
+
+    real_sleep = asyncio.sleep
+
+    async def _skip_initial_delay(seconds):
+        await real_sleep(0 if seconds == 5 else seconds)
+
+    monkeypatch.setattr(run.asyncio, "sleep", _skip_initial_delay)
+    async def _ticker():
+        assert await asyncio.to_thread(load_started.wait, 5)
+        ticker_progressed.set()
+
+    watcher = asyncio.create_task(
+        run.GatewayRunner._handoff_watcher(fake, interval=0.0)
+    )
+    ticker = asyncio.create_task(_ticker())
+    await asyncio.wait_for(asyncio.gather(watcher, ticker), timeout=5)
+
+    assert ticker_progressed_while_loading == [True], (
+        "profile secret loading blocked the asyncio event loop until the "
+        "filesystem operation completed"
+    )
+
+
 @pytest.mark.asyncio
 async def test_each_scope_resolves_its_own_store_and_profile(monkeypatch):
     """The whole point: a DIFFERENT ``state.db`` per scope, and the profile
@@ -183,15 +246,15 @@ async def test_each_scope_resolves_its_own_store_and_profile(monkeypatch):
         def __init__(self, home):
             self.home = home
 
-        def __enter__(self):
+        async def __aenter__(self):
             active["home"] = self.home
             return self
 
-        def __exit__(self, *exc):
+        async def __aexit__(self, *exc):
             active["home"] = None
             return False
 
-    monkeypatch.setattr(run, "_profile_runtime_scope", _SpyScope)
+    monkeypatch.setattr(run, "_async_profile_runtime_scope", _SpyScope)
 
     async def _no_sleep(_seconds):
         return None
diff --git a/tests/gateway/test_handoff_watcher_resilience.py b/tests/gateway/test_handoff_watcher_resilience.py
index cfe672b784..b7b4e25d73 100644
--- a/tests/gateway/test_handoff_watcher_resilience.py
+++ b/tests/gateway/test_handoff_watcher_resilience.py
@@ -219,13 +219,13 @@ async def test_reclaim_runs_per_profile_store(monkeypatch):
         def __init__(self, home):
             self.home = home
 
-        def __enter__(self):
+        async def __aenter__(self):
             return self
 
-        def __exit__(self, *exc):
+        async def __aexit__(self, *exc):
             return False
 
-    monkeypatch.setattr(run, "_profile_runtime_scope", _Scope)
+    monkeypatch.setattr(run, "_async_profile_runtime_scope", _Scope)
 
     async def _no_sleep(_seconds):
         return None
diff --git a/tests/gateway/test_hosted_room_gateway_lifecycle.py b/tests/gateway/test_hosted_room_gateway_lifecycle.py
index fe692d41cc..679d7ac145 100644
--- a/tests/gateway/test_hosted_room_gateway_lifecycle.py
+++ b/tests/gateway/test_hosted_room_gateway_lifecycle.py
@@ -185,7 +185,7 @@ def test_gateway_restart_resumes_queued_room_for_multiplexed_profile(tmp_path):
             )
         )
     finally:
-        assert resumed.stop(timeout=1.0)
+        assert resumed.stop(timeout=5.0)
 
     assert rpc.submits == ["ops"]
     assert hosted_room_driver.list_tasks(db, room_id="room-1", status="settled")
@@ -226,8 +226,8 @@ def test_dashboard_and_gateway_workers_share_one_fenced_execution_owner(tmp_path
         )
         time.sleep(0.05)
     finally:
-        assert gateway.stop(timeout=1.0)
-        assert dashboard.stop(timeout=1.0)
+        assert gateway.stop(timeout=5.0)
+        assert dashboard.stop(timeout=5.0)
 
     assert len(gateway_rpc.submits) + len(dashboard_rpc.submits) == 1
     events = hosted_rooms.read_events(db, room_id="room-1", since_seq=0)["events"]
diff --git a/tests/gateway/test_irc_adapter.py b/tests/gateway/test_irc_adapter.py
index f08cf73614..e703f5e1fd 100644
--- a/tests/gateway/test_irc_adapter.py
+++ b/tests/gateway/test_irc_adapter.py
@@ -18,6 +18,8 @@ check_requirements = _irc_mod.check_requirements
 validate_config = _irc_mod.validate_config
 register = _irc_mod.register
 _standalone_send = _irc_mod._standalone_send
+is_connected = _irc_mod.is_connected
+_env_enablement = _irc_mod._env_enablement
 
 
 class TestIRCProtocolHelpers:
@@ -406,3 +408,96 @@ class TestIRCStandaloneSend:
         assert "registration" in result["error"].lower() or "timeout" in result["error"].lower()
 
 
+# ---------------------------------------------------------------------------
+# Multiplex secondary-profile scope
+# ---------------------------------------------------------------------------
+#
+# __init__'s server/port/nickname/channel/use_tls, check_requirements/
+# validate_config/is_connected's server/channel, and _env_enablement's
+# server/channel/port/nickname/use_tls/home_channel, all previously read raw
+# os.getenv unconditionally (only IRC_SERVER_PASSWORD/IRC_NICKSERV_PASSWORD
+# were already scoped). Under multiplex, os.environ holds the DEFAULT
+# profile's YAML-to-env bridge output -- a secondary profile with its own
+# (different or absent) IRC config would silently connect to the default
+# profile's server/channel, or (for _env_enablement) get auto-enabled using
+# the default's channel as its cron home_channel -- a real message-
+# misdelivery risk, not just cosmetic. Mirrors the LINE/Buzz/SimpleX fix for
+# #98738.
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("IRC_SERVER", "default.example.net")
+    monkeypatch.setenv("IRC_CHANNEL", "#default")
+    monkeypatch.setenv("IRC_PORT", "6667")
+    monkeypatch.setenv("IRC_NICKNAME", "default-bot")
+    monkeypatch.setenv("IRC_USE_TLS", "false")
+
+
+class TestMultiplexProfileScope:
+
+    def test_secondary_extra_wins_over_default_profile_env(
+        self, multiplex_scope, default_profile_env
+    ):
+        """The secondary profile's own config.yaml extra is authoritative,
+        not the default profile's bridged server/channel/port/nick/tls."""
+        from gateway.config import PlatformConfig
+
+        multiplex_scope()
+        cfg = PlatformConfig(
+            enabled=True,
+            extra={
+                "server": "profile.example.net",
+                "channel": "#profile",
+                "port": 6697,
+                "nickname": "profile-bot",
+                "use_tls": True,
+            },
+        )
+        adapter = IRCAdapter(cfg)
+        assert adapter.server == "profile.example.net"
+        assert adapter.channel == "#profile"
+        assert adapter.port == 6697
+        assert adapter.nickname == "profile-bot"
+        assert adapter.use_tls is True
+
+    def test_secondary_missing_keys_fail_closed(
+        self, multiplex_scope, default_profile_env
+    ):
+        """Keys absent from the profile's own scope must NOT borrow the
+        default profile's bridged env values -- that would silently connect
+        the secondary profile's bot to the wrong IRC server/channel."""
+        from gateway.config import PlatformConfig
+
+        multiplex_scope()
+        adapter = IRCAdapter(PlatformConfig(enabled=True, extra={}))
+        assert adapter.server == ""
+        assert adapter.channel == ""
+        assert adapter.port == 6697  # falls through to the hardcoded default
+        assert adapter.nickname == "hermes-bot"
+        assert adapter.use_tls is True  # extra.get("use_tls", True) default
+        # Nor may the registry auto-enable IRC for this profile off the default's channel.
+        assert _env_enablement() is None
+        assert is_connected(PlatformConfig(enabled=True, extra={})) is False
+
diff --git a/tests/gateway/test_loop_command.py b/tests/gateway/test_loop_command.py
index f18d1c5d5c..7e8caee8fc 100644
--- a/tests/gateway/test_loop_command.py
+++ b/tests/gateway/test_loop_command.py
@@ -34,6 +34,13 @@ def loop_env(tmp_path, monkeypatch):
     home.mkdir()
     monkeypatch.setenv("HERMES_HOME", str(home))
     goals._DB_CACHE.clear()
+    # Pre-warm the SessionDB cache from this sync (non-loop) context. Inside
+    # the async tests, a cold cache makes GoalManager.set() kick the bounded
+    # background bootstrap (loop-thread path) and wait only
+    # _DB_BOOTSTRAP_INIT_WAIT_S — on a loaded CI runner the init overruns the
+    # window, the goal is never persisted, and the active-goal assertion
+    # flakes (main run 33455779041). Warming here removes the race entirely.
+    goals._get_session_db()
     yield home
     goals._DB_CACHE.clear()
 
diff --git a/tests/gateway/test_loop_liveness_watchdog.py b/tests/gateway/test_loop_liveness_watchdog.py
index ae07106b27..d763fbc461 100644
--- a/tests/gateway/test_loop_liveness_watchdog.py
+++ b/tests/gateway/test_loop_liveness_watchdog.py
@@ -3,8 +3,11 @@
 from __future__ import annotations
 
 import asyncio
+import json
+import os
 import pathlib
 import inspect
+import tempfile
 import threading
 import time
 from unittest.mock import MagicMock, patch
@@ -403,3 +406,100 @@ def test_loop_scheduling_witness_is_served_by_the_loop_itself():
     assert "await asyncio.start_unix_server(" in body, (
         "the loop-scheduling witness socket is not armed by the loop task"
     )
+
+
+def test_windows_tcp_witness_arms_and_publishes_port():
+    """On non-POSIX platforms the witness must arm over TCP loopback.
+
+    ``asyncio.start_unix_server`` does not exist on Windows (no AF_UNIX
+    event-loop support), so the producer arm fell into the broad except and
+    recorded ``loop_tick_socket=False`` — every stale-file probe then
+    classified UNKNOWN forever, disabling the wedge interlock on Windows
+    entirely. The TCP loopback witness restores the same contract: armed by
+    the loop task (an awaited ``asyncio.start_server`` is structurally
+    loop-owned exactly like the Unix variant), answered only while the loop
+    dispatches, port published in the heartbeat payload.
+    """
+    if os.name == "posix":
+        pytest.skip("TCP loopback witness is the non-POSIX arm")
+
+    async def scenario() -> tuple[dict, bool]:
+        task = asyncio.create_task(
+            loop_heartbeat_forever(interval_s=1.0, home=tmp_home)
+        )
+        try:
+            deadline = time.monotonic() + 5.0
+            payload = None
+            while time.monotonic() < deadline:
+                hb = tmp_home.joinpath(*("state", "gateway.heartbeat"))
+                if hb.exists():
+                    try:
+                        payload = json.loads(hb.read_text(encoding="utf-8"))
+                    except Exception:
+                        payload = None
+                    if payload and payload.get("loop_tick_tcp_port"):
+                        break
+                await asyncio.sleep(0.02)
+            assert payload is not None, "heartbeat never appeared"
+            assert payload.get("loop_tick_socket") is True, (
+                "witness reported unarmed on a platform where the TCP arm "
+                "must work"
+            )
+            port = int(payload["loop_tick_tcp_port"])
+            assert 0 < port <= 65535, "published port out of range"
+
+            # Probe from a worker thread so the blocking connect/recv never
+            # stalls the very loop we are witnessing (an external process
+            # probes from its own loop/thread — reproduce that shape).
+            from hermes_cli.gateway import _probe_loop_tick_tcp
+
+            result_box: dict[str, object] = {}
+
+            def _probe() -> None:
+                result_box["r"] = _probe_loop_tick_tcp(port, timeout=2.0)
+
+            worker = threading.Thread(target=_probe)
+            worker.start()
+            while worker.is_alive():
+                await asyncio.sleep(0.05)
+            worker.join()
+            return payload, bool(result_box.get("r") is True)
+        finally:
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
+
+    with tempfile.TemporaryDirectory(prefix="lw-tcp-") as raw:
+        tmp_home = pathlib.Path(raw)
+        payload, answered = asyncio.run(scenario())
+    assert answered, (
+        "the loop-tick TCP witness did not answer a probe while the loop "
+        "was dispatching — the two-witness interlock would misclassify "
+        "this gateway as UNKNOWN"
+    )
+
+
+def test_windows_tcp_witness_arms_on_loop_task_source_shape():
+    """The TCP arm must be awaited by the loop task, never thread-owned.
+
+    Structural companion to ``test_loop_scheduling_witness_is_served_by_the_
+    loop_itself``: the same property that makes the Unix socket an honest
+    witness (a coroutine cannot run inside a thread) must hold for the TCP
+    loopback arm, or a wedged loop could keep answering pings and the
+    interlock would be void on Windows.
+    """
+    src = pathlib.Path(
+        inspect.getsourcefile(loop_heartbeat_forever) or ""
+    ).read_text()
+    body = src[src.index("async def loop_heartbeat_forever("):]
+    body = body[: body.index("\ndef ") if "\ndef " in body else len(body)]
+    assert "await asyncio.start_server(" in body, (
+        "the TCP loop-scheduling witness is not armed by the loop task"
+    )
+    # The Unix arm must stay gated to POSIX-only code paths so the missing
+    # attribute can never raise on Windows again.
+    assert 'os.name == "posix"' in body, (
+        "the AF_UNIX witness arm is not gated to POSIX platforms"
+    )
diff --git a/tests/gateway/test_matrix_crypto_store_per_profile.py b/tests/gateway/test_matrix_crypto_store_per_profile.py
new file mode 100644
index 0000000000..3705689260
--- /dev/null
+++ b/tests/gateway/test_matrix_crypto_store_per_profile.py
@@ -0,0 +1,47 @@
+"""Matrix crypto store must be pinned per profile at connect(), not at import.
+
+Under ``gateway.multiplex_profiles`` one process imports
+``plugins.platforms.matrix.adapter`` once; the old module-level
+``_STORE_DIR``/``_CRYPTO_DB_PATH`` resolved against the root HERMES_HOME at
+import time, so every profile's adapter opened the SAME crypto.db and inbound
+E2EE failed with "no session found" (#89168). ``connect()`` calls
+``_resolve_store_dir()`` inside ``_profile_runtime_scope`` (context-local
+HERMES_HOME), so resolving there -- and caching on the instance -- gives each
+profile its own store. Exercised via ``_resolve_store_dir`` directly so the
+test needs no mautrix install.
+"""
+from gateway.config import PlatformConfig
+from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+from plugins.platforms.matrix import adapter as matrix_adapter
+
+
+def _make_adapter() -> matrix_adapter.MatrixAdapter:
+    return matrix_adapter.MatrixAdapter(
+        PlatformConfig(
+            enabled=True,
+            token="syt_test_token",
+            extra={"homeserver": "https://matrix.example.org", "user_id": "@bot:example.org"},
+        )
+    )
+
+
+def test_store_dir_pinned_to_each_profile_home(tmp_path):
+    """Two profiles resolving in one process get two stores, and each
+    adapter keeps reporting its own store after the scope is gone."""
+    stores = {}
+    for profile in ("accountant", "engineering-lead"):
+        home = tmp_path / "profiles" / profile
+        home.mkdir(parents=True)
+        adapter = _make_adapter()
+        token = set_hermes_home_override(str(home))
+        try:
+            adapter._resolve_store_dir().mkdir(parents=True, exist_ok=True)
+        finally:
+            reset_hermes_home_override(token)
+        # Cached on the instance: correct even when read outside the scope.
+        path = adapter.get_diagnostics()["e2ee"]["crypto_store_path"]
+        assert path.startswith(str(home)), f"store not profile-scoped: {path}"
+        assert adapter._store_dir.is_dir()
+        stores[profile] = path
+
+    assert stores["accountant"] != stores["engineering-lead"]
diff --git a/tests/gateway/test_mattermost.py b/tests/gateway/test_mattermost.py
index 3166ddea53..9cb56073a8 100644
--- a/tests/gateway/test_mattermost.py
+++ b/tests/gateway/test_mattermost.py
@@ -594,3 +594,118 @@ async def test_mattermost_top_level_channel_post_is_thread_root():
     assert msg_event.message_id == "top_post_123"
 
 
+# ---------------------------------------------------------------------------
+# Multiplex secondary-profile scope
+# ---------------------------------------------------------------------------
+#
+# __init__'s url/reply_mode, validate_mattermost_config's url,
+# _standalone_send's url, and _handle_ws_event's require_mention/
+# free_response_channels/allowed_channels, all previously read raw
+# os.getenv unconditionally (only MATTERMOST_TOKEN was already scoped).
+# _apply_yaml_config also wrote MATTERMOST_REQUIRE_MENTION/
+# MATTERMOST_FREE_RESPONSE_CHANNELS/MATTERMOST_ALLOWED_CHANNELS into the
+# process-global os.environ unconditionally. Under multiplex, os.environ
+# holds the DEFAULT profile's YAML-to-env bridge output -- a secondary
+# profile with its own (different or absent) Mattermost config would
+# silently connect to the default profile's server, or have its
+# mention-gating/channel-allowlist decisions driven by the default
+# profile's settings. Mirrors the LINE/DingTalk/IRC fix for #98738.
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("MATTERMOST_URL", "https://default.example.com")
+    monkeypatch.setenv("MATTERMOST_REPLY_MODE", "thread")
+    monkeypatch.setenv("MATTERMOST_REQUIRE_MENTION", "false")
+    monkeypatch.setenv("MATTERMOST_FREE_RESPONSE_CHANNELS", "chan_default")
+    monkeypatch.setenv("MATTERMOST_ALLOWED_CHANNELS", "chan_default")
+
+
+class TestMultiplexProfileScope:
+
+    @pytest.mark.asyncio
+    async def test_ws_event_gating_uses_scoped_settings_not_default(
+        self, monkeypatch
+    ):
+        """A secondary profile's own require_mention/free_response_channels/
+        allowed_channels (installed via the scope) must gate its messages --
+        not the default profile's bridged settings."""
+        from agent.secret_scope import (
+            reset_secret_scope,
+            set_multiplex_active,
+            set_secret_scope,
+        )
+        from plugins.platforms.mattermost.adapter import MattermostAdapter
+
+        monkeypatch.setenv("MATTERMOST_REQUIRE_MENTION", "true")
+        monkeypatch.delenv("MATTERMOST_FREE_RESPONSE_CHANNELS", raising=False)
+
+        adapter = _make_adapter()
+        adapter._bot_user_id = "bot_user_id"
+        adapter._bot_username = "hermes-bot"
+        adapter.handle_message = AsyncMock()
+
+        post_data = {
+            "id": "post_scoped",
+            "user_id": "user_123",
+            "channel_id": "chan_456",
+            "message": "hello with no mention",
+        }
+        event = {
+            "event": "posted",
+            "data": {
+                "post": json.dumps(post_data),
+                "channel_type": "O",
+                "sender_name": "@alice",
+            },
+        }
+
+        set_multiplex_active(True)
+        token = set_secret_scope({"MATTERMOST_REQUIRE_MENTION": "false"})
+        try:
+            await adapter._handle_ws_event(event)
+        finally:
+            reset_secret_scope(token)
+            set_multiplex_active(False)
+
+        # The profile's own scope disables require_mention -- the message
+        # must be dispatched even without an @mention, despite the default
+        # profile's env bridge saying require_mention=true.
+        assert adapter.handle_message.called
+
+    def test_apply_yaml_config_scoped_skips_env_write_and_seeds_extra(
+        self, multiplex_scope
+    ):
+        from plugins.platforms.mattermost.adapter import _apply_yaml_config
+
+        multiplex_scope()
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("MATTERMOST_REQUIRE_MENTION", None)
+            seeded = _apply_yaml_config({}, {"require_mention": False, "allowed_channels": ["c1"]})
+            assert seeded == {"require_mention": False, "allowed_channels": ["c1"]}
+            # Under a secondary profile's scope the env bridge must be
+            # skipped -- writing here would leak into every other profile's
+            # os.environ.
+            assert "MATTERMOST_REQUIRE_MENTION" not in os.environ
+
diff --git a/tests/gateway/test_multiplex_adapter_registry.py b/tests/gateway/test_multiplex_adapter_registry.py
index 3d0c196cbf..972701ddaf 100644
--- a/tests/gateway/test_multiplex_adapter_registry.py
+++ b/tests/gateway/test_multiplex_adapter_registry.py
@@ -1,6 +1,9 @@
 """Phase 3: secondary-profile adapter registry + same-token conflict detection."""
 import logging
 import asyncio
+import threading
+import time
+import types
 from contextlib import contextmanager
 from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock
@@ -39,6 +42,50 @@ class TestCredentialFingerprint:
         assert fp1 is not None
         assert "shared-project-secret" not in fp1
 
+    def test_reads_feishu_app_id(self):
+        """Feishu/Lark authenticates via app_id/app_secret, not a token.
+
+        Without _app_id in the fingerprint attribute list, every Feishu
+        adapter in a multiplexed gateway returns None here and the
+        same-credential conflict check is silently skipped — N profiles
+        spawn WebSocket clients against the same app, which evict each
+        other in a 1000 bye loop until all go offline.
+        """
+        class _FeishuAdapter:
+            def __init__(self):
+                self._app_id = "cli_a1b2c3"
+                self._app_secret = "top-secret"
+
+        fp1 = GatewayRunner._adapter_credential_fingerprint(_FeishuAdapter())
+        fp2 = GatewayRunner._adapter_credential_fingerprint(_FeishuAdapter())
+
+        assert fp1 is not None
+        assert fp1 == fp2  # same app -> same fingerprint -> conflict detected
+        assert "cli_a1b2c3" not in fp1  # log-safe, never the raw credential
+
+    def test_distinct_feishu_app_ids_distinct_fp(self):
+        class _FeishuAdapter:
+            def __init__(self, app_id):
+                self._app_id = app_id
+                self._app_secret = "s"
+
+        fp_a = GatewayRunner._adapter_credential_fingerprint(_FeishuAdapter("app-A"))
+        fp_b = GatewayRunner._adapter_credential_fingerprint(_FeishuAdapter("app-B"))
+
+        assert fp_a is not None and fp_b is not None
+        assert fp_a != fp_b
+
+    @pytest.mark.parametrize("attr", ["_client_id", "_bot_id"])
+    def test_reads_app_style_ids_teams_wecom(self, attr):
+        """Teams (_client_id) and WeCom (_bot_id) are the same class as Feishu:
+        id/secret pairs, no token — cloned profiles must collide."""
+        a = types.SimpleNamespace(**{attr: "app-1"})
+        b = types.SimpleNamespace(**{attr: "app-1"})
+        c = types.SimpleNamespace(**{attr: "app-2"})
+        fp = GatewayRunner._adapter_credential_fingerprint
+        assert fp(a) is not None and fp(a) == fp(b)
+        assert fp(a) != fp(c)
+        assert "app-1" not in fp(a)
 
     def test_reads_config_token(self):
         """Adapters like Discord store token on `config`, not on self.
@@ -182,11 +229,15 @@ def _secondary_recovery_runner(*, running=True):
     return runner
 
 
-def _install_secondary_reconnect_context(monkeypatch, runner, adapter, scoped_homes=None):
+def _install_secondary_reconnect_context(
+    monkeypatch, runner, adapter, scoped_homes=None, hydration_flags=None
+):
     @contextmanager
-    def fake_scope(profile_home):
+    def fake_scope(profile_home, *, hydrate_secrets=True):
         if scoped_homes is not None:
             scoped_homes.append(Path(profile_home))
+        if hydration_flags is not None:
+            hydration_flags.append(hydrate_secrets)
         yield
 
     monkeypatch.setattr(gateway_run, "_profile_runtime_scope", fake_scope)
@@ -208,6 +259,93 @@ def _install_secondary_reconnect_context(monkeypatch, runner, adapter, scoped_ho
 
 
 class TestSecondaryProfileFatalRecovery:
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("entry", ["startup", "reconnect"])
+    async def test_secondary_hydrates_secrets_off_the_event_loop(self, monkeypatch, entry):
+        """#99519 class: both secondary entry points (initial start + reconnect)
+        hydrate external secret sources in a worker thread, exactly once, and
+        enter the runtime scope with hydration disabled."""
+        runner = _secondary_recovery_runner()
+        replacement = _SecondaryRecoveryAdapter()
+        hydration_flags = []
+        _install_secondary_reconnect_context(
+            monkeypatch, runner, replacement, hydration_flags=hydration_flags
+        )
+        loop_thread_id = threading.get_ident()
+        hydration_started = threading.Event()
+        hydration_finished = threading.Event()
+        hydration_thread_ids = []
+        stop_ticker = asyncio.Event()
+        ticks_during_hydration = 0
+
+        def slow_hydrate(profile_home):
+            hydration_thread_ids.append(threading.get_ident())
+            hydration_started.set()
+            time.sleep(0.05)
+            hydration_finished.set()
+
+        async def ticker():
+            nonlocal ticks_during_hydration
+            while not stop_ticker.is_set():
+                if hydration_started.is_set() and not hydration_finished.is_set():
+                    ticks_during_hydration += 1
+                await asyncio.sleep(0)
+
+        async def connect(adapter, platform, **_kwargs):
+            assert adapter is replacement
+            assert platform is Platform.DISCORD
+            return True
+
+        monkeypatch.setattr(
+            "hermes_cli.env_loader.hydrate_profile_secret_sources", slow_hydrate
+        )
+        monkeypatch.setattr(runner, "_connect_adapter_with_timeout", connect)
+        monkeypatch.setattr(runner, "_connect_initial_adapter_with_timeout", connect)
+        monkeypatch.setattr(gateway_run, "_load_gateway_runtime_config", lambda: {})
+        monkeypatch.setattr(runner, "_snapshot_profile_busy_modes", lambda *a, **k: None)
+        monkeypatch.setattr("hermes_cli.plugins.discover_plugins", lambda: None)
+        if entry == "startup":
+            coro = runner._start_one_profile_adapters(
+                "reviewer", Path("/profiles/reviewer"), {}
+            )
+        else:
+            coro = runner._run_secondary_profile_reconnect("reviewer", Platform.DISCORD)
+        ticker_task = asyncio.create_task(ticker())
+        work = asyncio.create_task(coro)
+        try:
+            assert await asyncio.to_thread(hydration_started.wait, 1.0)
+            await work
+        finally:
+            stop_ticker.set()
+            await ticker_task
+
+        assert len(hydration_thread_ids) == 1
+        assert hydration_thread_ids[0] != loop_thread_id
+        assert ticks_during_hydration > 0
+        assert hydration_flags and set(hydration_flags) == {False}
+        assert runner._profile_adapters["reviewer"][Platform.DISCORD] is replacement
+
+    @pytest.mark.asyncio
+    async def test_secondary_initial_connect_syncs_voice_mode_state(self, monkeypatch):
+        """#84872: a secondary bot gets its persisted /voice state at INITIAL
+        connect, not only on reconnect."""
+        runner = _secondary_recovery_runner()
+        adapter = _SecondaryRecoveryAdapter()
+        _install_secondary_reconnect_context(monkeypatch, runner, adapter)
+        synced = []
+        runner._sync_voice_mode_state_to_adapter = synced.append
+        monkeypatch.setattr("hermes_cli.env_loader.hydrate_profile_secret_sources", lambda h: {})
+        monkeypatch.setattr(gateway_run, "_load_gateway_runtime_config", lambda: {})
+        monkeypatch.setattr(runner, "_snapshot_profile_busy_modes", lambda *a, **k: None)
+        monkeypatch.setattr("hermes_cli.plugins.discover_plugins", lambda: None)
+
+        async def connect(a, platform):
+            return True
+
+        monkeypatch.setattr(runner, "_connect_initial_adapter_with_timeout", connect)
+        assert await runner._start_one_profile_adapters("reviewer", Path("/profiles/reviewer"), {}) == 1
+        assert synced == [adapter]
+
     @pytest.mark.asyncio
     async def test_retryable_secondary_fatal_reconnects_with_its_profile_scope(
         self, monkeypatch
@@ -341,13 +479,15 @@ class TestSecondaryStartupFailureRecovery:
         # gateway is already running) to the regular reconnect task, which
         # publishes the replacement and clears its own slot.
         await asyncio.wait_for(bridge[0], timeout=0.5)
-        for _ in range(20):
-            if (
-                runner._profile_adapters.get("reviewer", {}).get(Platform.DISCORD)
-                is replacement
-            ):
-                break
-            await asyncio.sleep(0)
+        # The reconnect runner hops to a worker thread for secret hydration,
+        # so wait on a deadline rather than a fixed number of loop turns.
+        deadline = time.monotonic() + 1.0
+        while (
+            runner._profile_adapters.get("reviewer", {}).get(Platform.DISCORD)
+            is not replacement
+            and time.monotonic() < deadline
+        ):
+            await asyncio.sleep(0.005)
         assert (
             runner._profile_adapters["reviewer"][Platform.DISCORD] is replacement
         )
@@ -394,13 +534,15 @@ class TestSecondaryStartupFailureRecovery:
         bridge = list(runner._background_tasks)
         assert len(bridge) == 1
         await asyncio.wait_for(bridge[0], timeout=0.5)
-        for _ in range(20):
-            if (
-                runner._profile_adapters.get("reviewer", {}).get(Platform.DISCORD)
-                is replacement
-            ):
-                break
-            await asyncio.sleep(0)
+        # The reconnect runner hops to a worker thread for secret hydration,
+        # so wait on a deadline rather than a fixed number of loop turns.
+        deadline = time.monotonic() + 1.0
+        while (
+            runner._profile_adapters.get("reviewer", {}).get(Platform.DISCORD)
+            is not replacement
+            and time.monotonic() < deadline
+        ):
+            await asyncio.sleep(0.005)
         assert (
             runner._profile_adapters["reviewer"][Platform.DISCORD] is replacement
         )
@@ -435,6 +577,55 @@ class TestSecondaryStartupFailureRecovery:
         assert runner._background_tasks == set()
         assert runner._profile_failed_platforms == {}
 
+    @pytest.mark.asyncio
+    async def test_token_lock_initial_failure_parks_fatal_not_retried(
+        self, monkeypatch
+    ):
+        """Salvage of #83183 claim 2: a secondary whose token is held by a live
+        foreign gateway (``{scope}_lock``, emitted retryable by
+        ``_acquire_platform_lock``) is an ownership conflict — park it fatal
+        like ``duplicate_credential`` instead of retry-storming the token."""
+        runner = _secondary_recovery_runner()
+        failed = _SecondaryRecoveryAdapter()
+        failed.fatal_error_code = "discord-bot-token_lock"
+        failed.fatal_error_message = "Discord bot token already in use (PID 4242)."
+        _install_secondary_reconnect_context(
+            monkeypatch, runner, _SecondaryRecoveryAdapter()
+        )
+        monkeypatch.setattr(runner, "_create_adapter", lambda platform, config: failed)
+        statuses = []
+        monkeypatch.setattr(
+            runner,
+            "_update_platform_runtime_status",
+            lambda key, **kw: statuses.append((key, kw)),
+        )
+
+        async def fail_initial_connect(adapter, platform):
+            return False
+
+        monkeypatch.setattr(
+            runner, "_connect_initial_adapter_with_timeout", fail_initial_connect
+        )
+
+        connected = await runner._start_one_profile_adapters(
+            "reviewer", "/tmp/reviewer", {}
+        )
+
+        assert connected == 0
+        assert failed.disconnected is True
+        assert runner._background_tasks == set()
+        assert runner._profile_failed_platforms == {}
+        assert statuses == [
+            (
+                "reviewer:discord",
+                {
+                    "platform_state": "fatal",
+                    "error_code": "discord-bot-token_lock",
+                    "error_message": failed.fatal_error_message,
+                },
+            )
+        ]
+
     @pytest.mark.asyncio
     async def test_handoff_failure_is_logged_not_raised(self, monkeypatch, caplog):
         """If the scheduler raises at bridge handoff, the parked task must not
@@ -820,6 +1011,113 @@ class TestSecondaryProfileConfigHandling:
         assert second == 1
         assert runner._profile_adapters["later"][photon] is later
 
+    @pytest.mark.asyncio
+    async def test_secondary_teams_uses_degradable_error(self, monkeypatch):
+        from gateway.config import GatewayConfig, Platform, PlatformConfig
+        from gateway.run import SecondaryPortBindingConfigError
+
+        runner = GatewayRunner.__new__(GatewayRunner)
+        runner.config = GatewayConfig(multiplex_profiles=True)
+        runner._profile_adapters = {}
+
+        reviewer_cfg = GatewayConfig(multiplex_profiles=True)
+        reviewer_cfg.platforms = {
+            Platform("teams"): PlatformConfig(enabled=True, extra={"port": 3978}),
+        }
+        monkeypatch.setattr(
+            "gateway.config.load_gateway_config", lambda: reviewer_cfg
+        )
+
+        with pytest.raises(SecondaryPortBindingConfigError) as exc_info:
+            await runner._start_one_profile_adapters("reviewer", "/tmp/x", {})
+        assert "teams" in str(exc_info.value)
+        assert "reviewer" in str(exc_info.value)
+        assert "reviewer" not in runner._profile_adapters
+
+    @pytest.mark.asyncio
+    async def test_secondary_profile_adapter_start_skips_whatsapp(self, monkeypatch):
+        """WhatsApp is shared process-level ingress like Relay: the bridge is
+        one authenticated session tied to a single phone number, so a
+        credential-less secondary profile must be skipped (not stall startup
+        in a connect/retry loop) while its other platforms start normally."""
+        runner = _secondary_recovery_runner()
+        direct = _SecondaryRecoveryAdapter()
+        _install_secondary_reconnect_context(monkeypatch, runner, direct)
+        monkeypatch.setattr(
+            "gateway.config.load_gateway_config",
+            lambda: GatewayConfig(
+                multiplex_profiles=True,
+                platforms={
+                    Platform.WHATSAPP: PlatformConfig(enabled=True),
+                    Platform.DISCORD: PlatformConfig(enabled=True, token="profile-token"),
+                },
+            ),
+        )
+        factory_calls = []
+
+        def _create_adapter(platform, config):
+            factory_calls.append(platform)
+            return direct
+
+        async def _connect(adapter, platform):
+            return True
+
+        monkeypatch.setattr(runner, "_create_adapter", _create_adapter)
+        monkeypatch.setattr(runner, "_connect_initial_adapter_with_timeout", _connect)
+
+        connected = await runner._start_one_profile_adapters("clientbot", "/tmp/x", {})
+
+        assert connected == 1
+        assert factory_calls == [Platform.DISCORD]
+        assert runner._profile_adapters["clientbot"] == {Platform.DISCORD: direct}
+
+
+class TestSecondaryProfileHookRegistration:
+    """A secondary profile's own `hooks:` block must register on ITS
+    plugin manager, not just the root/default profile's (#92672).
+
+    Startup only calls agent.shell_hooks/outbound_webhooks
+    register_from_config() once, against the root config, before any
+    profile scope exists. Without a matching call inside
+    _start_one_profile_adapters, a secondary profile's config.yaml
+    `hooks:` block (shell hooks and outbound webhooks) never registers.
+    """
+
+    @pytest.mark.asyncio
+    async def test_registers_shell_hooks_and_webhooks_for_secondary_profile(
+        self, monkeypatch
+    ):
+        runner = _secondary_recovery_runner()
+        config = GatewayConfig(multiplex_profiles=True, platforms={})
+        monkeypatch.setattr("gateway.config.load_gateway_config", lambda: config)
+
+        profile_cfg = {
+            "hooks": {
+                "pre_tool_call": [
+                    {"matcher": "write_file", "command": "~/.hermes/deny.sh"}
+                ],
+                "outbound": [
+                    {"url": "http://127.0.0.1:9000/hook", "events": ["on_session_end"]}
+                ],
+            }
+        }
+        monkeypatch.setattr("hermes_cli.config.load_config", lambda: profile_cfg)
+
+        seen = []
+        monkeypatch.setattr(
+            "agent.shell_hooks.register_from_config",
+            lambda cfg, **kwargs: seen.append(("shell", cfg)) or [],
+        )
+        monkeypatch.setattr(
+            "agent.outbound_webhooks.register_from_config",
+            lambda cfg: seen.append(("webhook", cfg)) or [],
+        )
+
+        await runner._start_one_profile_adapters("second", "/tmp/second", {})
+
+        assert ("shell", profile_cfg) in seen
+        assert ("webhook", profile_cfg) in seen
+
 
 class TestFeishuPortBindingConditional:
     """Feishu websocket mode does NOT bind a port; only webhook mode does (#52563)."""
@@ -848,3 +1146,78 @@ class TestFeishuPortBindingConditional:
         assert connected == 0  # no error, just nothing connected
 
 
+class TestSecondarySkipsCredentiallessPlatforms:
+    """#84079 — multiplex must not build adapters for platforms a profile
+    has no credential for.
+
+    The shared config.yaml enables a platform once; under multiplex every
+    secondary profile reloads it inside its own secret scope, so a profile
+    whose scope lacks the platform credential resolves ``enabled=True`` with
+    an empty token. Constructing an adapter anyway treats every profile as
+    configured for the platform — one inbound message fans out across all of
+    them. These tests lock the credential gate on the secondary startup path
+    (the primary path got the same gate in #64674; the reconnect path shares
+    the helper). Also reported independently in #72313.
+    """
+
+    def _make_runner(self, monkeypatch, profile_cfg):
+        runner = GatewayRunner.__new__(GatewayRunner)
+        runner.config = GatewayConfig(multiplex_profiles=True)
+        runner._profile_adapters = {}
+        runner.adapters = {}
+        created = []
+
+        def fake_create(platform, platform_config):
+            created.append((platform, platform_config))
+            return _FakeAdapter(token=platform_config.token or None)
+
+        monkeypatch.setattr("gateway.config.load_gateway_config", lambda: profile_cfg)
+        monkeypatch.setattr(runner, "_create_adapter", fake_create)
+        monkeypatch.setattr(runner, "_configure_profile_adapter", lambda *a, **k: None)
+        monkeypatch.setattr(
+            runner,
+            "_connect_initial_adapter_with_timeout",
+            AsyncMock(return_value=True),
+        )
+        return runner, created
+
+    @pytest.mark.asyncio
+    async def test_credentialless_platform_builds_no_adapter(self, monkeypatch, tmp_path):
+        """Enabled-in-YAML but no credential in the profile scope -> no adapter."""
+        from gateway.config import GatewayConfig, Platform, PlatformConfig
+
+        profile_cfg = GatewayConfig(multiplex_profiles=True)
+        profile_cfg.platforms = {
+            # Shared config.yaml enables Slack; profile-b's .env has no
+            # SLACK_BOT_TOKEN, so its scoped load resolves token="" but
+            # keeps enabled=True (#84079).
+            Platform.SLACK: PlatformConfig(enabled=True, token=""),
+            Platform.TELEGRAM: PlatformConfig(enabled=True, token="telegram-token-b"),
+        }
+        runner, created = self._make_runner(monkeypatch, profile_cfg)
+
+        connected = await runner._start_one_profile_adapters("profile-b", tmp_path, {})
+
+        # Only Telegram (which profile-b has its own credential for) gets an
+        # adapter; Slack is skipped instead of fanning out a turn per profile.
+        assert [p for p, _ in created] == [Platform.TELEGRAM]
+        assert connected == 1
+        assert Platform.TELEGRAM in runner._profile_adapters["profile-b"]
+        assert Platform.SLACK not in runner._profile_adapters["profile-b"]
+
+    @pytest.mark.asyncio
+    async def test_profile_with_own_credential_still_connects(self, monkeypatch, tmp_path):
+        """A profile that defines its own credential keeps its adapter."""
+        from gateway.config import GatewayConfig, Platform, PlatformConfig
+
+        profile_cfg = GatewayConfig(multiplex_profiles=True)
+        profile_cfg.platforms = {
+            Platform.SLACK: PlatformConfig(enabled=True, token="slack-token-b"),
+        }
+        runner, created = self._make_runner(monkeypatch, profile_cfg)
+
+        connected = await runner._start_one_profile_adapters("profile-b", tmp_path, {})
+
+        assert connected == 1
+        assert created == [(Platform.SLACK, profile_cfg.platforms[Platform.SLACK])]
+        assert Platform.SLACK in runner._profile_adapters["profile-b"]
diff --git a/tests/gateway/test_multiplex_credential_isolation.py b/tests/gateway/test_multiplex_credential_isolation.py
index f5d2d5d8f6..a43ee8f440 100644
--- a/tests/gateway/test_multiplex_credential_isolation.py
+++ b/tests/gateway/test_multiplex_credential_isolation.py
@@ -88,6 +88,54 @@ class TestProfilePathResolutionUnderMultiplexScope:
         assert b_seen == prof_b / "skills"
 
 
+def test_turn_scoped_dotenv_reload_does_not_pollute_process_env(tmp_path, monkeypatch):
+    """A routed profile reload must stay inside its context-local scope.
+
+    ``load_hermes_dotenv`` has several lazy-import and cron call sites beyond
+    the gateway's guarded reload helper.  Any one of them can run during a
+    multiplexed turn, so the loader itself must not copy the active profile's
+    ``.env`` into the shared process environment.
+    """
+    import os
+
+    from agent.secret_scope import get_secret
+    from gateway.run import _profile_runtime_scope
+    from hermes_cli.env_loader import load_hermes_dotenv
+    from hermes_constants import get_hermes_home
+
+    profile_a = tmp_path / "profiles" / "a"
+    profile_b = tmp_path / "profiles" / "b"
+    profile_a.mkdir(parents=True)
+    profile_b.mkdir(parents=True)
+    (profile_a / ".env").write_text(
+        "PROFILE_SCOPED_API_KEY=secret-a\n"
+        "DISCORD_ALLOWED_CHANNELS=profile-a-only\n",
+        encoding="utf-8",
+    )
+    (profile_b / ".env").write_text(
+        "PROFILE_SCOPED_API_KEY=secret-b\n"
+        "DISCORD_ALLOWED_CHANNELS=profile-b-only\n",
+        encoding="utf-8",
+    )
+    monkeypatch.delenv("PROFILE_SCOPED_API_KEY", raising=False)
+    monkeypatch.setenv("DISCORD_ALLOWED_CHANNELS", "all-channels")
+
+    ss.set_multiplex_active(True)
+    with _profile_runtime_scope(profile_a):
+        assert get_secret("PROFILE_SCOPED_API_KEY") == "secret-a"
+        assert get_secret("DISCORD_ALLOWED_CHANNELS") == "profile-a-only"
+        assert load_hermes_dotenv(hermes_home=get_hermes_home()) == []
+        assert "PROFILE_SCOPED_API_KEY" not in os.environ
+        assert os.environ["DISCORD_ALLOWED_CHANNELS"] == "all-channels"
+
+    with _profile_runtime_scope(profile_b):
+        assert get_secret("PROFILE_SCOPED_API_KEY") == "secret-b"
+        assert get_secret("DISCORD_ALLOWED_CHANNELS") == "profile-b-only"
+        assert load_hermes_dotenv(hermes_home=get_hermes_home()) == []
+        assert "PROFILE_SCOPED_API_KEY" not in os.environ
+        assert os.environ["DISCORD_ALLOWED_CHANNELS"] == "all-channels"
+
+
 def test_cold_profile_hydrates_external_source_without_global_env(
     tmp_path, monkeypatch
 ):
@@ -164,5 +212,3 @@ def test_cold_profile_hydrates_external_source_without_global_env(
     assert calls["count"] == 1
     assert "TEST_PROVIDER_API_KEY" not in os.environ
     assert "EXPLICIT_API_KEY" not in os.environ
-
-
diff --git a/tests/gateway/test_multiplex_interactive_auth.py b/tests/gateway/test_multiplex_interactive_auth.py
new file mode 100644
index 0000000000..5ed97aa17c
--- /dev/null
+++ b/tests/gateway/test_multiplex_interactive_auth.py
@@ -0,0 +1,170 @@
+"""Multiplex interactive-auth regressions (#86296, #92840, #72657, #87240 egress).
+
+Real ``GatewayRunner`` methods on an ``object.__new__`` runner, real
+``PairingStore`` files under a temp HERMES_HOME, multiplex active.
+"""
+
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from gateway.config import GatewayConfig, Platform, PlatformConfig
+from gateway.pairing import PairingStore
+from gateway.profile_routing import ProfileRoute
+
+
+@pytest.fixture
+def mux_home(tmp_path, monkeypatch):
+    from agent import secret_scope
+
+    home = tmp_path / "hh"
+    (home / "profiles" / "secondary").mkdir(parents=True)
+    (home / ".env").write_text("")
+    (home / "profiles" / "secondary" / ".env").write_text("")
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    for key in (
+        "TELEGRAM_ALLOWED_USERS",
+        "TELEGRAM_ALLOW_BOTS",
+        "GATEWAY_ALLOW_ALL_USERS",
+        "GATEWAY_ALLOWED_USERS",
+        "SLACK_ALLOW_ALL_USERS",
+        "SLACK_ALLOWED_USERS",
+    ):
+        monkeypatch.delenv(key, raising=False)
+    prev = secret_scope.is_multiplex_active()
+    secret_scope.set_multiplex_active(True)
+    yield home
+    secret_scope.set_multiplex_active(prev)
+
+
+def _runner(home):
+    from gateway.run import GatewayRunner
+
+    runner = object.__new__(GatewayRunner)
+    runner.config = GatewayConfig(multiplex_profiles=True)
+    runner.config.profile_routes = [
+        ProfileRoute(name="r", platform="telegram", chat_id="-100555", profile="secondary")
+    ]
+    runner.config.platforms = {Platform.TELEGRAM: PlatformConfig(enabled=True, extra={})}
+    runner.pairing_store = PairingStore(profile="default")
+    runner.pairing_stores = {
+        "default": runner.pairing_store,
+        "secondary": PairingStore(profile="secondary"),
+    }
+    runner._primary_profile_name = "default"
+    runner._profile_adapters = {"secondary": {}}
+    return runner
+
+
+def _telegram(runner):
+    from plugins.platforms.telegram.adapter import TelegramAdapter
+
+    tg = object.__new__(TelegramAdapter)
+    tg.config = PlatformConfig(enabled=True, extra={})
+    tg._authorization_check = None
+    tg._message_handler = runner._primary_message_handler()  # closure, no __self__
+    runner.adapters = {Platform.TELEGRAM: tg}
+    tg.set_authorization_check(runner._make_adapter_auth_check(Platform.TELEGRAM))
+    return tg
+
+
+def test_routed_primary_callback_uses_routed_pairing_store_and_transport_allowlist(mux_home):
+    """#86296: shared primary bot + profile_routes → the inline-button caller
+    is authorized by the ROUTED profile's pairing store, while env allowlists
+    resolve under the transport (launch) home, exactly like inbound messages."""
+    runner = _runner(mux_home)
+    store = runner.pairing_stores["secondary"]
+    store._save_json(store._approved_path("telegram"), {"777": {}})
+    (mux_home / ".env").write_text("TELEGRAM_ALLOWED_USERS=999\n")
+    tg = _telegram(runner)
+
+    # Paired only in the routed profile → allowed in the routed chat only.
+    assert tg._is_callback_user_authorized("777", chat_id="-100555", chat_type="supergroup") is True
+    assert tg._is_callback_user_authorized("777", chat_id="-100999", chat_type="supergroup") is False
+    # Transport-home allowlist honored in the routed chat (not the routed profile's empty scope).
+    assert tg._is_callback_user_authorized("999", chat_id="-100555", chat_type="supergroup") is True
+    assert tg._is_callback_user_authorized("888", chat_id="-100555", chat_type="supergroup") is False
+
+
+def test_bot_sender_reaches_allow_bots_policy_through_callback(mux_home):
+    """#92840: the early prefilter must carry ``is_bot`` so TELEGRAM_ALLOW_BOTS
+    admits bot-authored messages under the multiplex closure handler."""
+    from gateway.run import _profile_runtime_scope
+
+    runner = _runner(mux_home)
+    (mux_home / ".env").write_text("TELEGRAM_ALLOWED_USERS=999\nTELEGRAM_ALLOW_BOTS=all\n")
+    tg = _telegram(runner)
+
+    def msg(uid, is_bot):
+        return SimpleNamespace(
+            from_user=SimpleNamespace(id=uid, is_bot=is_bot, username="x", full_name="X"),
+            chat=SimpleNamespace(id=-100777, type="supergroup", is_forum=False),
+            sender_chat=None,
+            message_thread_id=None,
+            is_topic_message=False,
+        )
+
+    with _profile_runtime_scope(mux_home):
+        assert tg._is_user_authorized_from_message(msg(4242, True)) is True
+        assert tg._is_user_authorized_from_message(msg(4343, False)) is False
+
+
+def test_slack_interactive_auth_prefers_wired_profile_check(mux_home, monkeypatch):
+    """#72657: a multiplexed Slack adapter's button gate resolves through the
+    wired ``_make_adapter_auth_check`` for its own profile; the DEFAULT
+    profile's process-env allow-all never leaks in — not through the
+    injected path, and not through the env-only fallback either."""
+    from gateway.run import _profile_runtime_scope
+    from plugins.platforms.slack.adapter import SlackAdapter
+
+    runner = _runner(mux_home)
+    runner.adapters = {}
+    sec_home = mux_home / "profiles" / "secondary"
+    (sec_home / ".env").write_text("SLACK_ALLOWED_USERS=U_SEC\n")
+    monkeypatch.setenv("SLACK_ALLOW_ALL_USERS", "true")
+
+    def slack(with_check):
+        sl = object.__new__(SlackAdapter)
+        sl.config = PlatformConfig(enabled=True, extra={})
+        sl._authorization_check = None
+        sl._message_handler = runner._make_profile_message_handler("secondary")
+        if with_check:
+            runner._profile_adapters = {"secondary": {Platform.SLACK: sl}}
+            sl.set_authorization_check(
+                runner._make_adapter_auth_check(Platform.SLACK, profile_name="secondary")
+            )
+        return sl
+
+    with _profile_runtime_scope(sec_home):
+        wired = slack(True)
+        assert wired._is_interactive_user_authorized("U_SEC", channel_id="C1") is True
+        assert wired._is_interactive_user_authorized("U_X", channel_id="C1") is False
+        assert slack(False)._is_interactive_user_authorized("U_X", channel_id="C1") is False
+
+
+def test_authorization_adapter_ignores_per_turn_active_profile(mux_home):
+    """#87240 egress half: inside a secondary profile's runtime scope the
+    default bot must not be handed to that profile (fail-closed None); the
+    launch profile still resolves ``self.adapters``."""
+    from gateway.run import _profile_runtime_scope
+
+    runner = _runner(mux_home)
+    default_bot = object()
+    runner.adapters = {Platform.TELEGRAM: default_bot}
+
+    with _profile_runtime_scope(mux_home / "profiles" / "secondary"):
+        assert runner._authorization_adapter(Platform.TELEGRAM, profile="secondary") is None
+    assert runner._authorization_adapter(Platform.TELEGRAM, profile="default") is default_bot
+
+
+def test_channel_directory_path_follows_current_home(mux_home):
+    """#87240: the directory file resolves against the CURRENT profile home,
+    not the home that happened to import the module."""
+    import gateway.channel_directory as cd
+    from gateway.run import _profile_runtime_scope
+
+    assert cd.DIRECTORY_PATH is None
+    with _profile_runtime_scope(mux_home / "profiles" / "secondary"):
+        assert cd._directory_path() == Path(mux_home / "profiles" / "secondary" / "channel_directory.json")
+    assert cd._directory_path() == Path(mux_home / "channel_directory.json")
diff --git a/tests/gateway/test_multiplex_log_routing.py b/tests/gateway/test_multiplex_log_routing.py
new file mode 100644
index 0000000000..529018b51a
--- /dev/null
+++ b/tests/gateway/test_multiplex_log_routing.py
@@ -0,0 +1,67 @@
+"""Multiplex gateway log routing (#82936, salvage of #84954).
+
+``setup_logging(mode="gateway")`` binds agent.log/errors.log/gateway.log to
+the launch home. Under ``multiplex_profiles`` every secondary profile's
+records — emitted inside ``_profile_runtime_scope`` — used to fan out into
+the DEFAULT profile's files. The gateway now enables the #99440 profile
+routers at startup so each record lands in its owner's ``logs/``.
+"""
+
+import logging
+import types
+from pathlib import Path
+
+import pytest
+
+import hermes_logging
+from gateway import run
+
+
+@pytest.fixture
+def clean_logging():
+    hermes_logging._reset_queued_handlers()
+    hermes_logging._logging_initialized = False
+    yield
+    hermes_logging._reset_queued_handlers()
+    hermes_logging._logging_initialized = False
+
+
+def _emit_under(home: Path, name: str, level: int, msg: str) -> None:
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+    token = set_hermes_home_override(home)
+    try:
+        logging.getLogger(name).log(level, msg)
+    finally:
+        reset_hermes_home_override(token)
+
+
+def _contains(home: Path, filename: str, needle: str) -> bool:
+    path = home / "logs" / filename
+    return path.exists() and needle in path.read_text()
+
+
+def test_multiplex_gateway_routes_profile_records_to_their_own_logs(
+    tmp_path, monkeypatch, clean_logging
+):
+    default_home = tmp_path / "default"
+    beta_home = tmp_path / "default" / "profiles" / "beta"
+    beta_home.mkdir(parents=True)
+    homes = [("default", default_home), ("beta", beta_home)]
+    monkeypatch.setattr(run, "_multiplex_profile_homes", lambda _cfg: homes)
+
+    hermes_logging.setup_logging(hermes_home=default_home, mode="gateway")
+
+    # Single-profile gateway: wiring is inert and handlers stay static.
+    assert run._enable_multiplex_log_routing(types.SimpleNamespace(multiplex_profiles=False)) is False
+    assert run._enable_multiplex_log_routing(types.SimpleNamespace(multiplex_profiles=True)) is True
+
+    _emit_under(beta_home, "gateway.run", logging.WARNING, "BETA-GATEWAY-WARN")
+    _emit_under(default_home, "gateway.run", logging.INFO, "DEFAULT-GATEWAY-INFO")
+    hermes_logging.flush_log_queue()
+
+    for filename in ("agent.log", "errors.log", "gateway.log"):
+        assert _contains(beta_home, filename, "BETA-GATEWAY-WARN"), filename
+        assert not _contains(default_home, filename, "BETA-GATEWAY-WARN"), filename
+    assert _contains(default_home, "gateway.log", "DEFAULT-GATEWAY-INFO")
+    assert not _contains(beta_home, "gateway.log", "DEFAULT-GATEWAY-INFO")
diff --git a/tests/gateway/test_multiplex_mcp_discovery.py b/tests/gateway/test_multiplex_mcp_discovery.py
new file mode 100644
index 0000000000..633b39b755
--- /dev/null
+++ b/tests/gateway/test_multiplex_mcp_discovery.py
@@ -0,0 +1,121 @@
+"""Multiplexed gateways discover and reload MCP servers per profile (#95518)."""
+
+from __future__ import annotations
+
+import threading
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from gateway.config import GatewayConfig, Platform
+from gateway.platforms.base import MessageEvent
+from gateway.session import SessionSource
+from hermes_constants import get_hermes_home, hermes_home_key
+
+
+@pytest.mark.asyncio
+async def test_gateway_boot_discovers_mcp_under_every_profile_home(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    import gateway.run as gateway_run
+    from tools import mcp_tool
+
+    homes = [("default", tmp_path / "default"), ("worker", tmp_path / "worker")]
+    for _name, home in homes:
+        home.mkdir()
+    seen: list[tuple[Path, str]] = []
+
+    def fake_discover() -> list[str]:
+        seen.append((get_hermes_home(), threading.current_thread().name))
+        return []
+
+    monkeypatch.setattr(
+        "hermes_cli.profiles.profiles_to_serve",
+        lambda multiplex, profile_allowlist=None: homes,
+    )
+    monkeypatch.setattr(mcp_tool, "discover_mcp_tools", fake_discover)
+
+    await gateway_run._discover_gateway_mcp_tools(GatewayConfig(multiplex_profiles=True))
+
+    # Ran once per profile, under that profile's home, off the loop thread.
+    assert [home for home, _ in seen] == [home for _, home in homes]
+    assert all(thread != threading.current_thread().name for _, thread in seen)
+
+
+@pytest.mark.asyncio
+async def test_reload_mcp_only_touches_requesting_profile(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from gateway.run import GatewayRunner
+    from tools import mcp_tool
+
+    worker_home = tmp_path / "profiles" / "worker"
+    worker_home.mkdir(parents=True)
+    worker_scope = hermes_home_key(worker_home)
+
+    runner = GatewayRunner.__new__(GatewayRunner)
+    runner.config = GatewayConfig(multiplex_profiles=True)
+    runner._resolve_profile_home_for_source = MagicMock(return_value=worker_home)
+    runner._agent_cache = {}
+    runner._agent_cache_lock = None
+    runner._async_session_store = SimpleNamespace(
+        get_or_create_session=MagicMock(side_effect=RuntimeError("skip transcript")),
+    )
+
+    monkeypatch.setattr(mcp_tool, "_servers", {"default-srv": object(), "worker-srv": object()})
+    monkeypatch.setattr(
+        mcp_tool, "_server_scope_keys",
+        {"default-srv": hermes_home_key(tmp_path), "worker-srv": worker_scope},
+    )
+    seen: list[tuple] = []
+
+    def fake_shutdown(*, scope=None) -> None:
+        seen.append(("shutdown", scope, get_hermes_home()))
+
+    def fake_discover() -> list[str]:
+        seen.append(("discover", get_hermes_home()))
+        return []
+
+    monkeypatch.setattr(mcp_tool, "shutdown_mcp_servers", fake_shutdown)
+    monkeypatch.setattr(mcp_tool, "discover_mcp_tools", fake_discover)
+
+    event = MessageEvent(
+        text="/reload-mcp", message_id="m1",
+        source=SessionSource(
+            platform=Platform.TELEGRAM, user_id="u1", chat_id="c1",
+            chat_type="dm", profile="worker",
+        ),
+    )
+    result = await runner._execute_mcp_reload(event)
+
+    # Entered worker's scope itself, shut down only worker's servers, and
+    # reported only worker's servers (default's untouched connection is not
+    # "removed").
+    assert seen == [
+        ("shutdown", worker_scope, worker_home),
+        ("discover", worker_home),
+    ]
+    assert "default-srv" not in result
+
+
+def test_deregister_scope_kwarg_targets_overlay_and_keeps_plugin_confinement() -> None:
+    from tools.registry import ToolRegistry
+
+    reg = ToolRegistry()
+    reg.register("mcp__s__t", "mcp-s", {"name": "mcp__s__t", "description": "d"},
+                 lambda **kw: None, scope="/home/p1")
+    assert reg.snapshot_registration("mcp__s__t", scope="/home/p1") is not None
+
+    reg.deregister("mcp__s__t")  # unscoped: global slot only, overlay untouched
+    assert reg.snapshot_registration("mcp__s__t", scope="/home/p1") is not None
+
+    reg.deregister("mcp__s__t", scope="/home/p1")
+    assert reg.snapshot_registration("mcp__s__t", scope="/home/p1") is None
+
+    # A plugin module may not name another profile's overlay.
+    reg._plugin_module_scopes["hermes_plugins.p"] = {"/home/p1"}
+    reg._caller_module = staticmethod(lambda: "hermes_plugins.p")
+    with pytest.raises(PermissionError):
+        reg.deregister("anything", scope="/home/p2")
diff --git a/tests/gateway/test_multiplex_pairing_stores.py b/tests/gateway/test_multiplex_pairing_stores.py
index 63c4a9ea9a..78dc2f3e1d 100644
--- a/tests/gateway/test_multiplex_pairing_stores.py
+++ b/tests/gateway/test_multiplex_pairing_stores.py
@@ -85,3 +85,40 @@ def test_pairing_store_scoped_to_profile_dir(tmp_path, monkeypatch):
     assert "profiles/ops/platforms/pairing" in str(store._dir).replace("\\", "/"), (
         f"store not profile-scoped: {store._dir}"
     )
+
+
+def test_routed_pairing_grant_mirror_stays_in_profile_scope(tmp_path, monkeypatch):
+    """A /pair grant mirrored under a routed profile scope must update THAT
+    profile's .env and installed scope, never the shared os.environ (#88441,
+    #77490). Outside multiplex the legacy os.environ publish is unchanged."""
+    import os
+
+    from agent import secret_scope as ss
+    from gateway.pairing import _sync_allowlist_add
+    from gateway.run import _profile_runtime_scope
+    from hermes_cli.config import save_env_value
+
+    root = tmp_path / ".hermes"
+    prof = root / "profiles" / "b"
+    prof.mkdir(parents=True)
+    (root / ".env").write_text("DISCORD_ALLOWED_USERS=default-admin\n")
+    (prof / ".env").write_text("DISCORD_ALLOWED_USERS=b-admin\n")
+    monkeypatch.setenv("HERMES_HOME", str(root))
+    monkeypatch.setenv("DISCORD_ALLOWED_USERS", "default-admin")
+
+    was_active = ss.is_multiplex_active()
+    ss.set_multiplex_active(True)
+    try:
+        with _profile_runtime_scope(prof):
+            _sync_allowlist_add("discord", "111")
+            assert ss.get_secret("DISCORD_ALLOWED_USERS") == "b-admin,111"
+    finally:
+        ss.set_multiplex_active(was_active)
+
+    assert (prof / ".env").read_text().strip() == "DISCORD_ALLOWED_USERS=b-admin,111"
+    assert (root / ".env").read_text().strip() == "DISCORD_ALLOWED_USERS=default-admin"
+    assert os.environ["DISCORD_ALLOWED_USERS"] == "default-admin"
+
+    # Single-profile: no multiplex -> save still publishes to the process env.
+    save_env_value("DISCORD_ALLOWED_USERS", "default-admin,222")
+    assert os.environ["DISCORD_ALLOWED_USERS"] == "default-admin,222"
diff --git a/tests/gateway/test_multiplex_phase0.py b/tests/gateway/test_multiplex_phase0.py
index 836a0d6355..6558d67f54 100644
--- a/tests/gateway/test_multiplex_phase0.py
+++ b/tests/gateway/test_multiplex_phase0.py
@@ -172,3 +172,27 @@ class TestSessionStoreUnmultiplexedRecovery:
         assert recovered.session_id == "sess-coder"
         assert recovered.session_key == "agent:main:telegram:dm:99"
         assert store._db.reopened == ["sess-coder"]
+
+    @pytest.mark.parametrize(
+        ("recovered_key", "adopted"),
+        [
+            ("agent:coder:telegram:dm:99", False),  # sibling namespace → fail closed
+            ("agent:main:telegram:dm:99:v1", True),  # same namespace → adoptable
+        ],
+        ids=["sibling-profile", "same-profile"],
+    )
+    def test_flag_on_fences_recovery_by_requested_namespace(
+        self, tmp_path, recovered_key, adopted
+    ):
+        """#74285: under multiplexing the guard compares the recovered row's
+        ``agent:<ns>:`` against the REQUESTED key, never the active profile."""
+        row = {"id": "sess", "started_at": 1700000000, "session_key": recovered_key}
+        store = self._store_with_row(tmp_path, row, multiplex_profiles=True)
+        store._db_pinned = store._db
+        with patch("hermes_cli.profiles.get_active_profile_name", return_value="coder"):
+            recovered = store._recover_session_from_db(
+                session_key="agent:main:telegram:dm:99",
+                source=_src(chat_id="99", chat_type="dm"),
+                now=datetime.fromtimestamp(1700000001),
+            )
+        assert (recovered is not None) is adopted
diff --git a/tests/gateway/test_multiplex_profile_authz.py b/tests/gateway/test_multiplex_profile_authz.py
index e20176efcb..cd1bbf5a59 100644
--- a/tests/gateway/test_multiplex_profile_authz.py
+++ b/tests/gateway/test_multiplex_profile_authz.py
@@ -74,6 +74,52 @@ def test_active_profile_stamp_resolves_primary_adapter(monkeypatch):
     assert runner._authorization_adapter(Platform.WECOM, profile="dev") is default_adapter
 
 
+def test_scoped_secondary_profile_still_uses_profile_adapters(monkeypatch):
+    """Runtime scope must not redirect secondary authz to primary adapters.
+
+    ``_make_profile_message_handler`` wraps ``_handle_message`` in
+    ``_profile_runtime_scope``, which overrides HERMES_HOME so
+    ``get_active_profile_name()`` equals the secondary profile for that turn.
+    Authorization must still read ``_profile_adapters[profile]``, not the
+    empty primary ``self.adapters`` map — otherwise upstream-auth platforms
+    such as A2A default-deny an already-authenticated peer (#80884). A
+    secondary profile with NO registry entry still fails closed.
+    """
+    from gateway.run import GatewayRunner
+
+    _clear_auth_env(monkeypatch)
+
+    runner = object.__new__(GatewayRunner)
+    runner.config = GatewayConfig(multiplex_profiles=True)
+    runner.adapters = {}
+    runner.pairing_store = MagicMock()
+    runner.pairing_store.is_approved.return_value = False
+
+    secondary = SimpleNamespace(
+        authorization_is_upstream=True,
+        enforces_own_access_policy=False,
+    )
+    runner._profile_adapters = {"beta": {Platform("a2a"): secondary}}
+    # Simulate the scoped turn: active profile name collapses to the secondary.
+    runner._active_profile_name = lambda: "beta"
+
+    assert runner._authorization_adapter(Platform("a2a"), profile="beta") is secondary
+
+    source = SessionSource(
+        platform=Platform("a2a"),
+        chat_id="a2a-context",
+        user_id="alpha",
+        user_name="alpha",
+        chat_type="dm",
+        profile="beta",
+    )
+    assert runner._is_user_authorized(source) is True
+
+    # Fail-closed guard is untouched: no registry entry -> no default fallback.
+    runner._profile_adapters = {"beta": {}}
+    assert runner._authorization_adapter(Platform("a2a"), profile="beta") is None
+
+
 def test_secondary_allowlist_dm_behavior_ignores_unauthorized(monkeypatch):
     """Unauthorized-DM behavior must read the secondary adapter's dm_policy."""
     runner, _default_adapter, secondary_adapter = _make_multiplex_runner(monkeypatch)
diff --git a/tests/gateway/test_ntfy_plugin.py b/tests/gateway/test_ntfy_plugin.py
index 9e992eeb3e..8cb86b7f8f 100644
--- a/tests/gateway/test_ntfy_plugin.py
+++ b/tests/gateway/test_ntfy_plugin.py
@@ -491,3 +491,82 @@ class TestTruncateHelper:
         assert _ntfy._truncate_body("hi", context="test") == b"hi"
 
 
+# ---------------------------------------------------------------------------
+# 13. Multiplex secondary-profile scope
+# ---------------------------------------------------------------------------
+#
+# __init__'s server/topic/publish_topic, _env_enablement's topic/server/
+# publish_topic/markdown/home_channel, and check_requirements/validate_config/
+# is_connected's topic reads, all previously read raw os.getenv
+# unconditionally (only NTFY_TOKEN was already scoped). Under multiplex,
+# os.environ holds the DEFAULT profile's YAML-to-env bridge output -- a
+# secondary profile with its own (different or absent) ntfy config would
+# silently subscribe to / publish on the default profile's topic, or get
+# auto-enabled using the default profile's topic entirely. Mirrors the
+# LINE/Buzz/SimpleX fix for #98738.
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("NTFY_TOPIC", "default-topic")
+    monkeypatch.setenv("NTFY_SERVER_URL", "https://default.example.com")
+    monkeypatch.setenv("NTFY_PUBLISH_TOPIC", "default-out")
+
+
+class TestMultiplexProfileScope:
+
+    def test_secondary_extra_wins_over_default_profile_env(
+        self, multiplex_scope, default_profile_env
+    ):
+        """The secondary profile's own config.yaml extra is authoritative,
+        not the default profile's bridged topic/server/publish_topic."""
+        multiplex_scope()
+        cfg = PlatformConfig(
+            enabled=True,
+            extra={
+                "topic": "profile-topic",
+                "server": "https://profile.example.com",
+                "publish_topic": "profile-out",
+            },
+        )
+        adapter = NtfyAdapter(cfg)
+        assert adapter._topic == "profile-topic"
+        assert adapter._server == "https://profile.example.com"
+        assert adapter._publish_topic == "profile-out"
+
+    def test_secondary_missing_keys_fail_closed(
+        self, multiplex_scope, default_profile_env
+    ):
+        """Keys absent from the profile's own scope must NOT borrow the
+        default profile's bridged env values -- that would silently
+        subscribe/publish on the wrong topic."""
+        multiplex_scope()
+        adapter = NtfyAdapter(PlatformConfig(enabled=True, extra={}))
+        assert adapter._topic == ""
+        assert adapter._server == DEFAULT_SERVER
+        assert adapter._publish_topic == ""
+        # Nor may the registry auto-enable ntfy for this profile off the default's topic.
+        assert _env_enablement() is None
+        assert is_connected(PlatformConfig(enabled=True, extra={})) is False
+
diff --git a/tests/gateway/test_pending_drain_no_recursion.py b/tests/gateway/test_pending_drain_no_recursion.py
index a406c9d602..acedc6ae4b 100644
--- a/tests/gateway/test_pending_drain_no_recursion.py
+++ b/tests/gateway/test_pending_drain_no_recursion.py
@@ -112,7 +112,9 @@ async def test_in_band_drain_does_not_grow_stack():
     # Drain the chain.  Each turn schedules the next via the in-band
     # drain block, so we wait until N handler runs have completed and
     # the session has been released.
-    for _ in range(400):
+    # 2000 * 0.01s = 20s budget: the old 4s budget flaked on loaded CI
+    # runners (11/12 turns completed; main run 33455779041).
+    for _ in range(2000):
         if len(depths) >= N and sk not in adapter._active_sessions:
             break
         await asyncio.sleep(0.01)
@@ -278,7 +280,9 @@ async def test_late_arrival_drain_still_fires_when_no_in_band_drain():
     await adapter.handle_message(_make_event(text="first"))
 
     # Wait for the late-arrival drain task to finish the second event.
-    for _ in range(400):
+    # 2000 * 0.01s = 20s budget: the old 4s budget flaked on loaded CI
+    # runners (11/12 turns completed; main run 33455779041).
+    for _ in range(2000):
         if "late" in results and sk not in adapter._active_sessions:
             break
         await asyncio.sleep(0.01)
diff --git a/tests/gateway/test_pending_drain_race.py b/tests/gateway/test_pending_drain_race.py
index 10ca90dc75..479e769264 100644
--- a/tests/gateway/test_pending_drain_race.py
+++ b/tests/gateway/test_pending_drain_race.py
@@ -109,7 +109,7 @@ async def test_pending_drain_keeps_active_session_guard_live():
     await adapter.handle_message(_make_event(text="M1"))
 
     # Wait until M1 is actively running inside the handler.
-    await asyncio.wait_for(first_started.wait(), timeout=1.0)
+    await asyncio.wait_for(first_started.wait(), timeout=5.0)
 
     # Assert: session is active.
     assert sk in adapter._active_sessions
@@ -126,7 +126,7 @@ async def test_pending_drain_keeps_active_session_guard_live():
     try:
         # Pause inside the handoff's typing cleanup. Production has already
         # cleared the guard and has not yet transferred task ownership.
-        await asyncio.wait_for(handoff_entered.wait(), timeout=2.0)
+        await asyncio.wait_for(handoff_entered.wait(), timeout=5.0)
 
         # Across the drain transition, the Event object must be the SAME
         # reference (not replaced, not deleted).
@@ -141,7 +141,7 @@ async def test_pending_drain_keeps_active_session_guard_live():
 
         # Finish drain without relying on scheduler speed.
         release_handoff.set()
-        await asyncio.wait_for(second_processed.wait(), timeout=2.0)
+        await asyncio.wait_for(second_processed.wait(), timeout=5.0)
     finally:
         release_handoff.set()
         await adapter.cancel_background_tasks()
@@ -190,7 +190,7 @@ async def test_finally_cleanup_drains_late_arrival_pending():
     await adapter.handle_message(_make_event(text="M1"))
 
     # Drain: wait for the late-drain task itself to process LATE.
-    await asyncio.wait_for(late_processed.wait(), timeout=2.0)
+    await asyncio.wait_for(late_processed.wait(), timeout=5.0)
 
     await adapter.cancel_background_tasks()
 
@@ -218,7 +218,7 @@ async def test_no_pending_cleans_up_normally():
     # Await the task that owns this session rather than sampling cleanup after
     # an arbitrary wall-clock delay.
     owner_task = adapter._session_tasks[sk]
-    await asyncio.wait_for(asyncio.shield(owner_task), timeout=2.0)
+    await asyncio.wait_for(asyncio.shield(owner_task), timeout=5.0)
 
     assert sk not in adapter._active_sessions, (
         "_active_sessions was not cleaned up after a normal turn with no pending"
diff --git a/tests/gateway/test_personality_routed_profile.py b/tests/gateway/test_personality_routed_profile.py
new file mode 100644
index 0000000000..9ad41b3628
--- /dev/null
+++ b/tests/gateway/test_personality_routed_profile.py
@@ -0,0 +1,45 @@
+"""#89161: a routed multiplex profile's personality must reach its turns.
+
+``GatewayRunner`` used to snapshot ``_ephemeral_system_prompt`` once at boot
+from the launch profile's config and hand that string to every routed turn,
+so a secondary profile's ``display.personality`` / ``agent.system_prompt`` never
+injected. ``_get_system_prompt_for_channel`` now resolves from the config of
+the profile currently in scope (``run_sync`` runs inside
+``_profile_runtime_scope``).
+"""
+
+from __future__ import annotations
+
+import gateway.run as gateway_run
+from gateway.config import Platform
+from gateway.run import GatewayRunner, _profile_runtime_scope
+
+
+def test_routed_profile_prompt_resolves_from_its_own_config(tmp_path, monkeypatch):
+    default_home = tmp_path / "default"
+    routed_home = tmp_path / "profiles" / "beta"
+    default_home.mkdir()
+    routed_home.mkdir(parents=True)
+    (default_home / "config.yaml").write_text("agent:\n  system_prompt: DEFAULT-PERSONA\n")
+    (routed_home / "config.yaml").write_text(
+        "agent:\n  system_prompt: BETA-PERSONA\n  personalities:\n    pirate: ARR\n"
+    )
+    monkeypatch.setattr(gateway_run, "_hermes_home", default_home)
+    monkeypatch.setenv("HERMES_HOME", str(default_home))
+    monkeypatch.delenv("HERMES_EPHEMERAL_SYSTEM_PROMPT", raising=False)
+
+    runner = object.__new__(GatewayRunner)
+    runner.config = None
+
+    with _profile_runtime_scope(routed_home):
+        assert runner._get_system_prompt_for_channel(Platform.TELEGRAM, "c") == "BETA-PERSONA"
+    assert runner._get_system_prompt_for_channel(Platform.TELEGRAM, "c") == "DEFAULT-PERSONA"
+
+    # /personality from the routed chat writes the routed profile and only it.
+    from hermes_cli.personality import persist_personality
+
+    with _profile_runtime_scope(routed_home):
+        assert persist_personality("pirate")
+        assert runner._get_system_prompt_for_channel(Platform.TELEGRAM, "c") == "ARR"
+    assert "pirate" not in (default_home / "config.yaml").read_text()
+    assert runner._get_system_prompt_for_channel(Platform.TELEGRAM, "c") == "DEFAULT-PERSONA"
diff --git a/tests/gateway/test_profile_resolution.py b/tests/gateway/test_profile_resolution.py
index 695b9c7b89..e79e0415ca 100644
--- a/tests/gateway/test_profile_resolution.py
+++ b/tests/gateway/test_profile_resolution.py
@@ -248,6 +248,69 @@ class TestGatewayRunnerInjection:
         assert hasattr(BasePlatformAdapter, "gateway_runner")
         assert BasePlatformAdapter.gateway_runner is None
 
+    def test_factory_binds_every_adapter_to_runner(self, monkeypatch):
+        """``_create_adapter`` binds the runner regardless of which branch
+        built the adapter (plugin registry OR built-in if/elif) — every
+        lifecycle path (startup, reconnect, secondary profiles) goes through
+        it, so this is the single seam that makes profile_routes reachable
+        for built-ins like Signal (#68332 / #70831)."""
+        from gateway.config import PlatformConfig
+
+        runner = object.__new__(GatewayRunner)
+        adapter = MagicMock(spec=BasePlatformAdapter)
+        monkeypatch.setattr(runner, "_instantiate_adapter", lambda platform, config: adapter)
+        assert runner._create_adapter(Platform.SIGNAL, PlatformConfig(enabled=True)) is adapter
+        assert adapter.gateway_runner is runner
+        monkeypatch.setattr(runner, "_instantiate_adapter", lambda platform, config: None)
+        assert runner._create_adapter(Platform.SIGNAL, PlatformConfig(enabled=True)) is None
+
+    @pytest.mark.asyncio
+    async def test_real_signal_factory_routes_inbound_group_event(self, monkeypatch):
+        """A factory-built (built-in) Signal adapter resolves profile_routes
+        for a real inbound envelope — fails on main where the Signal branch
+        returned a bare ``SignalAdapter(config)`` with no runner."""
+        from gateway.config import PlatformConfig
+
+        group_id = "test-signal-route"
+        monkeypatch.setenv("SIGNAL_GROUP_ALLOWED_USERS", group_id)
+        runner = object.__new__(GatewayRunner)
+        runner.config = GatewayConfig(
+            multiplex_profiles=True,
+            profile_routes=[
+                ProfileRoute(name="signal", platform="signal", profile="ops", chat_id=f"group:{group_id}"),
+            ],
+        )
+        adapter = runner._create_adapter(
+            Platform.SIGNAL,
+            PlatformConfig(enabled=True, extra={"http_url": "http://127.0.0.1:18080", "account": "+15555550123"}),
+        )
+        assert adapter is not None and adapter.gateway_runner is runner
+
+        captured = {}
+
+        async def capture_event(event):
+            captured["event"] = event
+
+        adapter.handle_message = capture_event
+        with patch(
+            "hermes_cli.profiles.profiles_to_serve",
+            return_value=[("default", Path("/profiles/default")), ("ops", Path("/profiles/ops"))],
+        ):
+            await adapter._handle_envelope({
+                "envelope": {
+                    "sourceNumber": "+15555550124",
+                    "sourceName": "Test Operator",
+                    "timestamp": 1700000000000,
+                    "dataMessage": {
+                        "message": "diagnose the cluster",
+                        "groupInfo": {"groupId": group_id, "groupName": "US East 7"},
+                    },
+                },
+            })
+        source = captured["event"].source
+        assert source.profile == "ops"
+        assert build_session_key(source, profile=source.profile).startswith("agent:ops:")
+
 
 # A concrete adapter we can instantiate without the full platform stack.
 # ``build_source`` only reads ``self.platform`` and ``self.gateway_runner``, so a
diff --git a/tests/gateway/test_profile_routing.py b/tests/gateway/test_profile_routing.py
index 73934ac52d..37ebb8f69a 100644
--- a/tests/gateway/test_profile_routing.py
+++ b/tests/gateway/test_profile_routing.py
@@ -1,5 +1,7 @@
 """Tests for gateway/profile_routing.py — profile-based routing."""
 
+import json
+
 import pytest
 from gateway.profile_routing import (
     ProfileRoute,
@@ -50,6 +52,40 @@ class TestParseProfileRoutes:
         assert parse_profile_routes(None) == []
         assert parse_profile_routes([]) == []
 
+    def test_coerces_yaml_native_int_ids_to_str(self):
+        # PyYAML loads unquoted snowflakes / negative Telegram ids as int;
+        # inbound SessionSource ids are str, so un-coerced routes never match.
+        routes = parse_profile_routes([
+            {"name": "server", "platform": "discord", "profile": "p",
+             "guild_id": 111, "chat_id": 222, "thread_id": 333},
+            {"name": "tg", "platform": "telegram", "profile": "p",
+             "chat_id": -1001234567890},
+            {"name": "platform-only", "platform": "discord", "profile": "p"},
+        ])
+        by_name = {r.name: r for r in routes}
+        assert (by_name["server"].guild_id, by_name["server"].chat_id,
+                by_name["server"].thread_id) == ("111", "222", "333")
+        assert match_profile_route(
+            routes, "discord", guild_id="111", chat_id="222", thread_id="333",
+        ).name == "server"
+        assert match_profile_route(
+            routes, "telegram", chat_id="-1001234567890",
+        ).name == "tg"
+        assert (by_name["platform-only"].guild_id, by_name["platform-only"].chat_id,
+                by_name["platform-only"].thread_id) == (None, None, None)
+
+    def test_non_int_numeric_ids_warn_instead_of_silently_coercing(self, caplog):
+        # #86470 nuance: float/bool stringify to values that can never match
+        # an inbound id, so surface the misconfiguration at load time.
+        with caplog.at_level("WARNING", logger="gateway.profile_routing"):
+            routes = parse_profile_routes([
+                {"name": "f", "platform": "discord", "profile": "p", "chat_id": 123.0},
+                {"name": "b", "platform": "discord", "profile": "p", "guild_id": True},
+            ])
+        assert {r.name for r in routes} == {"f", "b"}
+        assert match_profile_route(routes, "discord", chat_id="123") is None
+        assert sum("can never match" in rec.message for rec in caplog.records) == 2
+
 
 class TestMatchProfileRoute:
 
@@ -106,3 +142,48 @@ class TestForumPostMatching:
                                  parent_chat_id="forum_channel_123")
         assert m is not None
         assert m.profile == "forum_profile"
+
+
+class TestWhatsAppChatIdIdentityMatching:
+    """WhatsApp ``chat_id`` routes match across number / JID / LID forms (the
+    same alias canonicalization allowlists and session keys already use);
+    every other platform, and WhatsApp groups, stay exact-compare."""
+
+    PHONE = "15551234567"
+    LID = "999999999999999"
+
+    def _write_lid_mapping(self, tmp_path, monkeypatch):
+        mapping_dir = tmp_path / "platforms" / "whatsapp" / "session"
+        mapping_dir.mkdir(parents=True)
+        (mapping_dir / f"lid-mapping-{self.PHONE}.json").write_text(json.dumps(f"{self.LID}@lid"))
+        (mapping_dir / f"lid-mapping-{self.LID}_reverse.json").write_text(
+            json.dumps(f"{self.PHONE}@s.whatsapp.net")
+        )
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+
+    def test_number_route_matches_jid_and_mapped_lid_forms(self, tmp_path, monkeypatch):
+        self._write_lid_mapping(tmp_path, monkeypatch)
+        for platform in ("whatsapp", "whatsapp_cloud"):
+            r = ProfileRoute(name="owner", platform=platform, profile="owner", chat_id=self.PHONE)
+            assert r.matches(platform, chat_id=f"{self.PHONE}@s.whatsapp.net")
+            assert r.matches(platform, chat_id=f"{self.PHONE}:47@s.whatsapp.net")
+            assert r.matches(platform, chat_id=f"{self.LID}@lid")
+            # Alias fallback also applies to the thread-parent slot.
+            assert r.matches(platform, chat_id="thread-1", parent_chat_id=f"{self.LID}@lid")
+            assert not r.matches(platform, chat_id="15550001111@s.whatsapp.net")
+
+    def test_groups_and_other_platforms_stay_exact(self, tmp_path, monkeypatch):
+        self._write_lid_mapping(tmp_path, monkeypatch)
+        group = "120363012345678901@g.us"
+        owner = ProfileRoute(name="owner", platform="whatsapp", profile="owner", chat_id=self.PHONE)
+        assert not owner.matches("whatsapp", chat_id=group)
+        grp = ProfileRoute(name="grp", platform="whatsapp", profile="grp", chat_id=group)
+        assert grp.matches("whatsapp", chat_id=group)
+        assert not grp.matches("whatsapp", chat_id=f"{self.PHONE}@s.whatsapp.net")
+        # Stripping @g.us must never turn a group into a phone-identity match.
+        assert not ProfileRoute(
+            name="oops", platform="whatsapp", profile="owner", chat_id=group.split("@", 1)[0]
+        ).matches("whatsapp", chat_id=group)
+        tg = ProfileRoute(name="tg", platform="telegram", profile="owner", chat_id="640466638")
+        assert tg.matches("telegram", chat_id="640466638")
+        assert not tg.matches("telegram", chat_id="640466638@s.whatsapp.net")
diff --git a/tests/gateway/test_raft_adapter.py b/tests/gateway/test_raft_adapter.py
index 34a739f6e2..552c0da291 100644
--- a/tests/gateway/test_raft_adapter.py
+++ b/tests/gateway/test_raft_adapter.py
@@ -3,6 +3,7 @@
 import asyncio
 import json
 import os
+from types import SimpleNamespace
 from unittest.mock import AsyncMock, patch
 
 import pytest
@@ -218,3 +219,104 @@ class TestRaftConfig:
         assert os.environ["RAFT_PROFILE"] == "existing"
         assert "Keeping RAFT_PROFILE=existing" in capsys.readouterr().out
 
+
+# ---------------------------------------------------------------------------
+# Multiplex secondary-profile scope (RAFT_PROFILE resolution)
+# ---------------------------------------------------------------------------
+#
+# _spawn_bridge, _env_enablement, and register()'s platform_hint all
+# previously read RAFT_PROFILE via raw os.environ.get unconditionally. Under
+# a multiplexed secondary profile, os.environ holds the DEFAULT profile's
+# YAML-to-env bridge output — a secondary profile with its own RAFT_PROFILE
+# (set only in its own .env, resolved via the installed secret scope) would
+# silently connect the bridge subprocess / CLI hint to the default profile's
+# external Raft workspace/agent identity instead of its own. Mirrors the
+# Buzz/SimpleX fix for #98738.
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("RAFT_PROFILE", "default-profile-slug")
+
+
+class _FakeCtx:
+    """Minimal ``ctx`` capturing ``register_platform``'s kwargs."""
+
+    def __init__(self):
+        self.platform_kwargs = None
+
+    def register_platform(self, **kwargs):
+        self.platform_kwargs = kwargs
+
+    def register_hook(self, *args, **kwargs):
+        pass
+
+
+class TestMultiplexProfileScope:
+
+    def test_secondary_profile_uses_its_own_slug_and_never_borrows_default(
+        self, multiplex_scope, default_profile_env, monkeypatch
+    ):
+        """Bridge spawn, env-enablement and the register() hint all resolve
+        the secondary profile's own RAFT_PROFILE; with none of its own the
+        profile fails closed (bridge not spawned, not auto-enabled)."""
+        import plugins.platforms.raft.adapter as raft_mod
+
+        monkeypatch.setattr(raft_mod.shutil, "which", lambda name: "/usr/bin/raft")
+        spawned = []
+        monkeypatch.setattr(
+            raft_mod.subprocess, "Popen",
+            lambda cmd, **kwargs: spawned.append(cmd) or SimpleNamespace(pid=1),
+        )
+
+        multiplex_scope({"RAFT_PROFILE": "secondary-profile-slug"})
+        _make_adapter()._spawn_bridge(9999)
+        assert spawned[-1][:3] == ["/usr/bin/raft", "--profile", "secondary-profile-slug"]
+        assert _env_enablement() == {"enabled": True}
+        ctx = _FakeCtx()
+        register(ctx)
+        assert "--profile secondary-profile-slug" in ctx.platform_kwargs["platform_hint"]
+        assert "default-profile-slug" not in ctx.platform_kwargs["platform_hint"]
+
+        spawned.clear()
+        multiplex_scope({})
+        _make_adapter()._spawn_bridge(9999)
+        assert spawned == []
+        assert _env_enablement() is None
+
+    def test_default_profile_unscoped_keeps_env_precedence(
+        self, monkeypatch, default_profile_env
+    ):
+        """Multiplex ON but no scope (the DEFAULT profile constructs
+        unscoped): env is its own bridge output and still wins."""
+        from agent.secret_scope import set_multiplex_active
+
+        set_multiplex_active(True)
+        try:
+            assert _env_enablement() == {"enabled": True}
+            ctx = _FakeCtx()
+            register(ctx)
+            assert "--profile default-profile-slug" in ctx.platform_kwargs["platform_hint"]
+        finally:
+            set_multiplex_active(False)
diff --git a/tests/gateway/test_runner_startup_failures.py b/tests/gateway/test_runner_startup_failures.py
index 68fbfdf162..c3f906f171 100644
--- a/tests/gateway/test_runner_startup_failures.py
+++ b/tests/gateway/test_runner_startup_failures.py
@@ -3,11 +3,31 @@ from unittest.mock import AsyncMock
 
 from gateway.config import GatewayConfig, Platform, PlatformConfig
 from gateway.platforms.base import BasePlatformAdapter
-from gateway.restart import GATEWAY_FATAL_CONFIG_EXIT_CODE
+from gateway.restart import GATEWAY_FATAL_CONFIG_EXIT_CODE, is_global_startup_conflict
 from gateway.run import GatewayRunner
 from gateway.status import read_runtime_status
 
 
+@pytest.mark.parametrize(
+    "code, expected",
+    [
+        ("telegram-bot-token_lock", True),   # BasePlatformAdapter._acquire_platform_lock
+        ("discord-bot-token_lock", True),
+        ("whatsapp-session_lock", True),
+        ("feishu_app_lock", True),
+        ("lock_conflict", True),             # buzz / irc / line identity conflicts
+        ("telegram_connect_error", False),
+        ("telegram_auth_error", False),
+        ("relay_membership_required", False),
+        ("duplicate_credential", False),
+        ("", False),
+        (None, False),
+    ],
+)
+def test_is_global_startup_conflict_matches_lock_code_families(code, expected):
+    assert is_global_startup_conflict(code) is expected
+
+
 class _RetryableFailureAdapter(BasePlatformAdapter):
     def __init__(self):
         super().__init__(PlatformConfig(enabled=True, token="***"), Platform.TELEGRAM)
@@ -443,3 +463,115 @@ async def test_start_gateway_propagates_fatal_config_exit_code(monkeypatch, tmp_
         await start_gateway(config=GatewayConfig(), replace=False, verbosity=0)
 
     assert exc_info.value.code == GATEWAY_FATAL_CONFIG_EXIT_CODE
+
+
+class _ForeignTokenLockAdapter(BasePlatformAdapter):
+    """Connects exactly like telegram/discord do: production
+    ``_acquire_platform_lock`` first, which emits ``{scope}_lock`` with
+    ``retryable=True`` (so a mid-run reconnect can recover, #54167)."""
+
+    def __init__(self):
+        super().__init__(PlatformConfig(enabled=True, token="***"), Platform.TELEGRAM)
+
+    async def connect(self, *, is_reconnect: bool = False) -> bool:
+        return self._acquire_platform_lock(
+            "telegram-bot-token", self.config.token, "Telegram bot token"
+        )
+
+    async def disconnect(self) -> None:
+        self._release_platform_lock()
+        self._mark_disconnected()
+
+    async def send(self, chat_id, content, reply_to=None, metadata=None):
+        raise NotImplementedError
+
+    async def get_chat_info(self, chat_id):
+        return {"id": chat_id}
+
+
+@pytest.mark.asyncio
+async def test_live_foreign_token_lock_at_startup_exits_ex_config(monkeypatch, tmp_path):
+    """Salvage of #83183 claim 1: a LIVE foreign holder of the bot token at
+    zero-connected startup is a single-writer conflict, not a transient blip.
+
+    ``_acquire_platform_lock`` deliberately emits the conflict retryable so a
+    *mid-run* reconnect can recover once the holder exits.  The startup router
+    used to key solely off that flag, so the gateway stayed alive, deaf, and
+    retry-queued forever instead of exiting 78 (EX_CONFIG)."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    monkeypatch.setenv("HERMES_GATEWAY_LOCK_DIR", str(tmp_path / "locks"))
+    # A live foreign holder: acquire_scoped_lock reports (False, record).
+    monkeypatch.setattr(
+        "gateway.status.acquire_scoped_lock",
+        lambda scope, identity, metadata=None: (
+            False,
+            {"pid": 424242, "start_time": 1, "hermes_home": "/other/home", "profile": "other"},
+        ),
+    )
+    config = GatewayConfig(
+        platforms={Platform.TELEGRAM: PlatformConfig(enabled=True, token="***")},
+        sessions_dir=tmp_path / "sessions",
+    )
+    runner = GatewayRunner(config)
+    monkeypatch.setattr(
+        runner, "_create_adapter", lambda platform, platform_config: _ForeignTokenLockAdapter()
+    )
+
+    ok = await runner.start()
+
+    assert ok is True
+    assert runner.should_exit_cleanly is True
+    assert runner.exit_code == GATEWAY_FATAL_CONFIG_EXIT_CODE
+    assert runner._failed_platforms == {}
+    state = read_runtime_status()
+    assert state["gateway_state"] == "startup_failed"
+    assert state["platforms"]["telegram"]["state"] == "fatal"
+    assert state["platforms"]["telegram"]["error_code"] == "telegram-bot-token_lock"
+
+
+@pytest.mark.asyncio
+async def test_token_lock_plus_retryable_peer_stays_alive(monkeypatch, tmp_path):
+    """A lock conflict alongside a genuinely transient peer failure is the
+    NS-609 mixed mode: the lock is parked fatal, the peer keeps its retry, and
+    the gateway stays alive (no exit 78)."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    monkeypatch.setenv("HERMES_GATEWAY_LOCK_DIR", str(tmp_path / "locks"))
+    monkeypatch.setattr(
+        "gateway.status.acquire_scoped_lock",
+        lambda scope, identity, metadata=None: (False, {"pid": 424242, "start_time": 1}),
+    )
+    config = GatewayConfig(
+        platforms={
+            Platform.TELEGRAM: PlatformConfig(enabled=True, token="***"),
+            Platform.DISCORD: PlatformConfig(enabled=True, token="***"),
+        },
+        sessions_dir=tmp_path / "sessions",
+    )
+    runner = GatewayRunner(config)
+
+    class _DiscordBlip(_RetryableFailureAdapter):
+        def __init__(self):
+            BasePlatformAdapter.__init__(
+                self, PlatformConfig(enabled=True, token="***"), Platform.DISCORD
+            )
+
+    monkeypatch.setattr(
+        runner,
+        "_create_adapter",
+        lambda platform, cfg: (
+            _ForeignTokenLockAdapter() if platform is Platform.TELEGRAM else _DiscordBlip()
+        ),
+    )
+
+    ok = await runner.start()
+    try:
+        assert ok is True
+        assert runner.should_exit_cleanly is False
+        assert runner.exit_code is None
+        assert set(runner._failed_platforms) == {Platform.DISCORD}
+        state = read_runtime_status()
+        assert state["gateway_state"] == "running"
+        assert state["platforms"]["telegram"]["state"] == "fatal"
+        assert state["platforms"]["discord"]["state"] == "retrying"
+    finally:
+        await runner.stop()
diff --git a/tests/gateway/test_scale_to_zero_dashboard_client.py b/tests/gateway/test_scale_to_zero_dashboard_client.py
new file mode 100644
index 0000000000..93dbd73f1c
--- /dev/null
+++ b/tests/gateway/test_scale_to_zero_dashboard_client.py
@@ -0,0 +1,284 @@
+"""Scale-to-zero: an attached dashboard/desktop/TUI WS client counts as activity.
+
+Background (2026-09-02 fleet audit): 13 of 72 active opted-in prod instances
+flapped suspend -> proxy-wake every ~60s. The gateway only stamped
+``_last_inbound_at`` for messaging inbound, so it suspended under an open
+dashboard client; the client's reconnect loop re-poked the Fly-proxied hostname
+and autostart resumed the box. The dashboard runs in a separate process on
+hosted instances, so the signal crosses over as a marker-file mtime.
+
+These tests exercise the REAL seams — the pure helpers with a real temp
+HERMES_HOME, GatewayRunner._scale_to_zero_is_idle's composition, and
+tui_gateway.ws.handle_ws — rather than stubbing the collection under test
+(the F25 / #84327 lesson: bugs live at the call site, not in the pure predicate).
+"""
+from __future__ import annotations
+
+import asyncio
+import os
+import time
+
+import pytest
+
+from gateway import scale_to_zero as s2z
+from gateway.run import GatewayRunner
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    return tmp_path
+
+
+def _stat_denying(target):
+    """os.stat replacement that denies ONLY the marker path (stdlib callers unaffected)."""
+    real = os.stat
+
+    def _stat(path, *a, **k):
+        if os.fspath(path) == os.fspath(target):
+            raise PermissionError("nope")
+        return real(path, *a, **k)
+
+    return _stat
+
+
+# --- pure helpers -----------------------------------------------------------
+
+
+def test_heartbeat_path_lives_under_hermes_home_state(hermes_home):
+    p = s2z.dashboard_client_heartbeat_path()
+    assert p == hermes_home / "state" / "dashboard_clients.heartbeat"
+
+
+def test_last_seen_missing_marker_is_none_not_fail_awake(hermes_home):
+    # Steady state for a box nobody has the dashboard open on: must read as
+    # "no client", otherwise no instance would ever suspend.
+    assert s2z.dashboard_client_last_seen() is None
+
+
+def test_touch_creates_state_dir_and_marker(hermes_home):
+    assert s2z.touch_dashboard_client_heartbeat() is True
+    p = s2z.dashboard_client_heartbeat_path()
+    assert p.exists()
+    seen = s2z.dashboard_client_last_seen()
+    assert seen is not None and abs(seen - time.time()) < 5
+
+
+def test_last_seen_returns_raw_mtime_without_staleness_cutoff(hermes_home):
+    # No liveness cutoff here on purpose: is_idle decides recency. A 1h-old
+    # marker still reports its mtime; the gateway then finds it outside
+    # idle_timeout, same as an old _last_inbound_at.
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    mtime = os.stat(p).st_mtime
+    assert s2z.dashboard_client_last_seen(now=mtime + 10) == mtime
+    assert s2z.dashboard_client_last_seen(now=mtime + 3600) == mtime
+
+
+def test_last_seen_future_mtime_is_clamped_to_now(hermes_home):
+    # A wall-clock step-back can leave the marker in the future; it must not
+    # extend the idle window past "now".
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    future = time.time() + 600
+    os.utime(p, (future, future))
+    now = time.time()
+    assert s2z.dashboard_client_last_seen(now=now) == now
+
+
+def test_last_seen_unreadable_marker_fails_awake(hermes_home, monkeypatch):
+    s2z.touch_dashboard_client_heartbeat()
+
+    monkeypatch.setattr(s2z.os, "stat", _stat_denying(s2z.dashboard_client_heartbeat_path()))
+    now = 1_000_000.0
+    # Unreadable (not missing) => counts as activity right now.
+    assert s2z.dashboard_client_last_seen(now=now) == now
+
+
+def test_touch_never_raises(hermes_home, monkeypatch):
+    monkeypatch.setattr(s2z.os, "utime", lambda *a, **k: (_ for _ in ()).throw(OSError("ro")))
+    assert s2z.touch_dashboard_client_heartbeat() is False
+
+
+# --- gateway side: the idle predicate composition ---------------------------
+
+
+def _runner(monkeypatch, *, last_inbound_at):
+    r = GatewayRunner.__new__(GatewayRunner)
+    r._running = True
+    r._last_inbound_at = last_inbound_at
+    r._running_agents = {}
+    r._background_tasks = set()
+    r.adapters = {}
+    monkeypatch.setattr(r, "_scale_to_zero_idle_timeout_seconds", lambda: 120.0, raising=False)
+    monkeypatch.setattr(r, "_scale_to_zero_has_live_background_work", lambda: False, raising=False)
+    monkeypatch.setattr("cron.scheduler.get_running_job_ids", lambda: [])
+    return r
+
+
+def test_idle_without_dashboard_client_unchanged(hermes_home, monkeypatch):
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    assert r._scale_to_zero_is_idle() is True
+
+
+def test_attached_dashboard_client_blocks_idle(hermes_home, monkeypatch):
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    assert r._scale_to_zero_is_idle() is False
+
+
+def test_client_gets_the_same_idle_grace_as_a_message(hermes_home, monkeypatch):
+    """Last WS frame 100s ago with a 120s idle_timeout => still inside the
+    window => NOT idle. This is the 2-minute-after-the-app-closes contract; an
+    earlier draft cut the marker off at 45s and suspended ~50s after
+    disconnect (observed live on staging)."""
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    old = time.time() - 100
+    os.utime(p, (old, old))
+    assert r._scale_to_zero_is_idle() is False
+
+
+def test_client_gone_longer_than_idle_timeout_is_idle(hermes_home, monkeypatch):
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    old = time.time() - 121
+    os.utime(p, (old, old))
+    assert r._scale_to_zero_is_idle() is True
+
+
+def test_marker_predating_gateway_inbound_does_not_matter(hermes_home, monkeypatch):
+    # Ancient marker from a client that left hours ago, gateway idle 600s.
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    old = time.time() - 7200
+    os.utime(p, (old, old))
+    assert r._scale_to_zero_is_idle() is True
+
+
+def test_dashboard_client_seen_recently_extends_inbound_clock(hermes_home, monkeypatch):
+    # Marker 30s old: inbound clock moves to 30s ago, which is
+    # inside the 120s window => not idle, even though the gateway's own
+    # _last_inbound_at is ancient.
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    t = time.time() - 30
+    os.utime(p, (t, t))
+    assert r._scale_to_zero_is_idle() is False
+
+
+def test_newer_gateway_inbound_wins_over_older_marker(hermes_home, monkeypatch):
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 5)
+    monkeypatch.setattr(r, "_scale_to_zero_idle_timeout_seconds", lambda: 10.0, raising=False)
+    s2z.touch_dashboard_client_heartbeat()
+    p = s2z.dashboard_client_heartbeat_path()
+    t = time.time() - 40
+    os.utime(p, (t, t))
+    # Picking the marker (40s > 10s) would read idle; the chat message (5s) wins.
+    assert r._scale_to_zero_is_idle() is False
+    # _last_inbound_at itself is not mutated by the read.
+    assert time.time() - r._last_inbound_at < 10
+
+
+def test_unreadable_marker_keeps_gateway_awake(hermes_home, monkeypatch):
+    r = _runner(monkeypatch, last_inbound_at=time.time() - 600)
+    s2z.touch_dashboard_client_heartbeat()
+    monkeypatch.setattr(s2z.os, "stat", _stat_denying(s2z.dashboard_client_heartbeat_path()))
+    assert r._scale_to_zero_is_idle() is False
+
+
+# --- dashboard side: the real handle_ws path touches the marker -------------
+
+
+def test_handle_ws_connect_touches_marker(hermes_home, monkeypatch):
+    from tui_gateway import server, ws as ws_mod
+
+    monkeypatch.setattr(server, "_start_backend_heartbeat_refresher", lambda: None)
+    monkeypatch.setattr(server, "_schedule_startup_orphan_sweep", lambda: None, raising=False)
+    monkeypatch.setattr(server, "resolve_skin", lambda: "default")
+    monkeypatch.setattr(server, "_ensure_skin_watcher", lambda: None)
+    monkeypatch.setattr(server, "register_live_transport", lambda *_a, **_k: None)
+    monkeypatch.setattr(server, "_WS_ORPHAN_REAP_GRACE_S", 0)
+    monkeypatch.setattr(ws_mod, "_dashboard_client_touched_at", 0.0)
+
+    class FakeWS:
+        async def accept(self):
+            pass
+
+        async def send_text(self, line):
+            pass
+
+        async def receive_text(self):
+            raise ws_mod._WebSocketDisconnect()
+
+        async def close(self):
+            pass
+
+    assert s2z.dashboard_client_last_seen() is None
+    asyncio.run(ws_mod.handle_ws(FakeWS()))
+    seen = s2z.dashboard_client_last_seen()
+    assert seen is not None and abs(seen - time.time()) < 5
+
+
+def test_handle_ws_inbound_frames_refresh_marker(hermes_home, monkeypatch):
+    from tui_gateway import server, ws as ws_mod
+
+    monkeypatch.setattr(server, "_start_backend_heartbeat_refresher", lambda: None)
+    monkeypatch.setattr(server, "_schedule_startup_orphan_sweep", lambda: None, raising=False)
+    monkeypatch.setattr(server, "resolve_skin", lambda: "default")
+    monkeypatch.setattr(server, "_ensure_skin_watcher", lambda: None)
+    monkeypatch.setattr(server, "register_live_transport", lambda *_a, **_k: None)
+    monkeypatch.setattr(server, "_WS_ORPHAN_REAP_GRACE_S", 0)
+    monkeypatch.setattr(ws_mod, "_dashboard_client_touched_at", 0.0)
+    # Disable the throttle so each frame is observable.
+    monkeypatch.setattr(ws_mod, "_DASHBOARD_CLIENT_TOUCH_MIN_INTERVAL_S", 0.0)
+
+    frames = ['{"jsonrpc":"2.0","method":"gateway.ping","id":1}'] * 2
+    touches: list[float] = []
+    real_touch = s2z.touch_dashboard_client_heartbeat
+
+    def _spy(path=None):
+        touches.append(time.time())
+        return real_touch(path)
+
+    monkeypatch.setattr(s2z, "touch_dashboard_client_heartbeat", _spy)
+
+    class FakeWS:
+        async def accept(self):
+            pass
+
+        async def send_text(self, line):
+            pass
+
+        async def receive_text(self):
+            if frames:
+                return frames.pop()
+            raise ws_mod._WebSocketDisconnect()
+
+        async def close(self):
+            pass
+
+    asyncio.run(ws_mod.handle_ws(FakeWS()))
+    # 1 on connect + 1 per inbound frame.
+    assert len(touches) == 3
+    assert s2z.dashboard_client_last_seen() is not None
+
+
+def test_note_activity_is_throttled(hermes_home, monkeypatch):
+    from tui_gateway import ws as ws_mod
+
+    calls = {"n": 0}
+    monkeypatch.setattr(
+        s2z, "touch_dashboard_client_heartbeat", lambda path=None: calls.__setitem__("n", calls["n"] + 1) or True
+    )
+    monkeypatch.setattr(ws_mod, "_dashboard_client_touched_at", 0.0)
+    ws_mod._note_dashboard_client_activity(force=True)
+    ws_mod._note_dashboard_client_activity()
+    ws_mod._note_dashboard_client_activity()
+    assert calls["n"] == 1
+    ws_mod._note_dashboard_client_activity(force=True)
+    assert calls["n"] == 2
diff --git a/tests/gateway/test_session_continuity_82616.py b/tests/gateway/test_session_continuity_82616.py
index d99bccfa77..7f9a498dc6 100644
--- a/tests/gateway/test_session_continuity_82616.py
+++ b/tests/gateway/test_session_continuity_82616.py
@@ -201,6 +201,28 @@ class TestPeerResolutionRecency:
 
 
 class TestLoadTranscriptReroutes:
+    def test_load_transcript_raises_when_message_read_fails(self, tmp_path, monkeypatch):
+        from gateway.session import SessionStore, TranscriptReadError
+
+        from gateway.config import GatewayConfig
+
+        store = SessionStore(sessions_dir=tmp_path / "gw-failed-read", config=GatewayConfig())
+        db = store._db
+        assert db is not None
+        monkeypatch.setattr(db, "get_compression_tip", lambda _session_id: None)
+
+        def _malformed(_session_id, *, repair_alternation):
+            assert repair_alternation is True
+            raise RuntimeError("database disk image is malformed")
+
+        monkeypatch.setattr(db, "get_messages_as_conversation", _malformed)
+
+        with pytest.raises(TranscriptReadError) as exc_info:
+            store.load_transcript("existing-session")
+
+        assert exc_info.value.session_id == "existing-session"
+        assert isinstance(exc_info.value.__cause__, RuntimeError)
+
     def test_load_transcript_follows_reroute_chain(self, tmp_path):
         from gateway.session import SessionStore
 
diff --git a/tests/gateway/test_session_db_corrupt_fallback.py b/tests/gateway/test_session_db_corrupt_fallback.py
new file mode 100644
index 0000000000..9a6be9a114
--- /dev/null
+++ b/tests/gateway/test_session_db_corrupt_fallback.py
@@ -0,0 +1,70 @@
+"""Gateway SessionStore must divert, not retry forever, after structural corruption.
+
+Mirrors ``test_session_db_replaced_fallback.py``: once the SessionDB handle
+is quarantined (``StateDbCorruptError``) the pending transcript goes to the
+JSONL/spool fallback and no FTS surgery runs on the damaged file.
+"""
+
+import json
+import sqlite3
+
+from gateway.config import GatewayConfig
+from gateway.session import SessionStore
+
+
+class _MalformedConn:
+    def __init__(self, real_conn):
+        self._real = real_conn
+
+    def execute(self, *args, **kwargs):
+        raise sqlite3.DatabaseError("database disk image is malformed")
+
+    def __getattr__(self, name):
+        return getattr(self._real, name)
+
+
+def _assert_diverted(tmp_path, sid, needle):
+    pending = list((tmp_path / "pending_messages").glob("pending-*.json"))
+    assert pending, "expected pending_messages/pending-*.json spool"
+    spooled = False
+    for path in pending:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        message = (payload.get("data") or {}).get("message") or {}
+        if needle in str(message.get("content", "")):
+            spooled = True
+            break
+    assert spooled, f"{needle!r} missing from pending spool"
+    jsonl = tmp_path / "sessions" / f"{sid}.jsonl"
+    assert jsonl.is_file()
+    assert needle in jsonl.read_text(encoding="utf-8")
+
+
+def test_corrupt_state_db_diverts_pending_without_fts_rebuild(tmp_path, monkeypatch):
+    import hermes_state
+
+    live = tmp_path / "state.db"
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    monkeypatch.setattr(hermes_state, "DEFAULT_DB_PATH", live)
+
+    store = SessionStore(sessions_dir=tmp_path, config=GatewayConfig())
+    sid = "gw-corrupt"
+    store._db.create_session(session_id=sid, source="cli")
+    store.append_to_transcript(
+        sid, {"role": "user", "content": "before", "timestamp": 1.0}
+    )
+    real_conn = store._db._conn
+    store._db._conn = _MalformedConn(real_conn)
+    try:
+        store.append_to_transcript(
+            sid, {"role": "user", "content": "after-corrupt", "timestamp": 2.0}
+        )
+        assert store._db._db_corrupt is True
+        # No FTS surgery ran on either layer.
+        assert store._db._fts_enabled is True
+        assert store._db._fts_stale is False
+        assert store._fts_rebuild_attempted is False
+        assert sid not in store._dirty_transcripts
+        _assert_diverted(tmp_path, sid, "after-corrupt")
+    finally:
+        store._db._conn = real_conn
+        store.close_all_db_handles()
diff --git a/tests/gateway/test_session_hygiene_turnhold_adoption.py b/tests/gateway/test_session_hygiene_turnhold_adoption.py
new file mode 100644
index 0000000000..1b6c209cbd
--- /dev/null
+++ b/tests/gateway/test_session_hygiene_turnhold_adoption.py
@@ -0,0 +1,431 @@
+"""Regression tests for #97963 — hygiene turn-hold must not burn a
+watermark-fenced compression attempt.
+
+The 10s ``hygiene_max_turn_hold_seconds`` budget (#92318) releases the
+arriving user turn while a thinking summary model is still streaming its
+reasoning prefix. Before the fix, that release ALWAYS cancelled the commit
+fence, so 100% of the summary attempt (including the full thinking prefix)
+was discarded on every turn — auto-compression permanently failed for any
+deployment whose summary model thinks longer than the hold.
+
+The fix decouples the turn from the compression: when the worker's commit is
+watermark-fenced (rows appended after compression start survive its commit
+verbatim as concurrent tail), the detached worker KEEPS its commit admission
+and the summary is adopted at its own watermark-fenced commit boundary. The
+turn is still released at the same budget — the invariant pinned by
+``test_session_hygiene_turn_hold_budget_abandons_streaming_wait`` (#90845)
+is untouched (that test's worker is NOT watermark-fenced and still takes the
+cancel path).
+"""
+
+import asyncio
+import importlib
+import sys
+import threading
+import time
+import types
+from datetime import datetime
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from gateway.config import GatewayConfig, Platform, PlatformConfig
+from gateway.platforms.base import BasePlatformAdapter, MessageEvent, SendResult
+from gateway.session import SessionEntry, SessionSource
+
+
+def _make_history(n_messages: int, content_size: int = 100) -> list:
+    history = []
+    content = "x" * content_size
+    for i in range(n_messages):
+        role = "user" if i % 2 == 0 else "assistant"
+        history.append({"role": role, "content": content, "timestamp": f"t{i}"})
+    return history
+
+
+class _CaptureAdapter(BasePlatformAdapter):
+    def __init__(self):
+        super().__init__(
+            PlatformConfig(enabled=True, token="fake-token"), Platform.TELEGRAM
+        )
+        self.sent = []
+
+    async def connect(self, *, is_reconnect: bool = False) -> bool:
+        return True
+
+    async def disconnect(self) -> None:
+        return None
+
+    async def send(self, chat_id, content, reply_to=None, metadata=None):
+        self.sent.append({"chat_id": chat_id, "content": content})
+        return SendResult(success=True, message_id="x")
+
+    async def get_chat_info(self, chat_id: str):
+        return {"id": chat_id}
+
+
+def _write_turnhold_config(tmp_path):
+    cfg_path = tmp_path / "config.yaml"
+    cfg_path.write_text(
+        "compression:\n"
+        "  enabled: true\n"
+        "  hygiene_timeout_seconds: 60\n"
+        "  hygiene_total_ceiling_seconds: 600\n"
+        "  hygiene_max_turn_hold_seconds: 0.3\n"
+        "  hygiene_failure_cooldown_seconds: 120\n"
+    )
+
+
+def _build_runner(gateway_run, adapter, fake_db):
+    runner = object.__new__(gateway_run.GatewayRunner)
+    runner.config = GatewayConfig(
+        platforms={
+            Platform.TELEGRAM: PlatformConfig(enabled=True, token="fake-token")
+        }
+    )
+    runner.adapters = {Platform.TELEGRAM: adapter}
+    runner._voice_mode = {}
+    runner.hooks = SimpleNamespace(emit=AsyncMock(), loaded_hooks=False)
+    runner.session_store = MagicMock()
+    runner.session_store.get_or_create_session.return_value = SessionEntry(
+        session_key="agent:main:telegram:dm:12345",
+        session_id="sess-97963",
+        created_at=datetime.now(),
+        updated_at=datetime.now(),
+        platform=Platform.TELEGRAM,
+        chat_type="dm",
+    )
+    runner.session_store.load_transcript.return_value = _make_history(
+        6, content_size=400
+    )
+    runner.session_store.has_any_sessions.return_value = True
+    runner.session_store.rewrite_transcript = MagicMock()
+    runner.session_store.append_to_transcript = MagicMock()
+    runner._running_agents = {}
+    runner._pending_messages = {}
+    runner._pending_approvals = {}
+    runner._session_db = SimpleNamespace(_db=fake_db)
+    runner._is_user_authorized = lambda _source: True
+    runner._set_session_env = lambda _context: None
+    runner._run_agent = AsyncMock(
+        return_value={
+            "final_response": "ok",
+            "messages": [],
+            "tools": [],
+            "history_offset": 0,
+            "last_prompt_tokens": 0,
+        }
+    )
+    return runner
+
+
+def _make_event():
+    return MessageEvent(
+        text="hello",
+        source=SessionSource(
+            platform=Platform.TELEGRAM,
+            chat_id="12345",
+            chat_type="dm",
+            user_id="12345",
+        ),
+        message_id="1",
+    )
+
+
+def _install_fakes(monkeypatch, gateway_run, tmp_path, agent_cls):
+    fake_dotenv = types.ModuleType("dotenv")
+    fake_dotenv.load_dotenv = lambda *args, **kwargs: None
+    monkeypatch.setitem(sys.modules, "dotenv", fake_dotenv)
+    fake_run_agent = types.ModuleType("run_agent")
+    fake_run_agent.AIAgent = agent_cls
+    monkeypatch.setitem(sys.modules, "run_agent", fake_run_agent)
+    monkeypatch.setattr(gateway_run, "_hermes_home", tmp_path)
+    monkeypatch.setattr(
+        gateway_run, "_resolve_runtime_agent_kwargs", lambda: {"api_key": "fake"}
+    )
+    monkeypatch.setattr(
+        "agent.model_metadata.get_model_context_length",
+        lambda *_args, **_kwargs: 100,
+    )
+
+
+async def _drain_deferred(runner, timeout=10.0):
+    tasks = getattr(runner, "_deferred_agent_cleanup_tasks", None) or set()
+    if tasks:
+        await asyncio.wait_for(
+            asyncio.gather(*list(tasks), return_exceptions=True), timeout
+        )
+
+
+@pytest.mark.asyncio
+async def test_turn_hold_keeps_admission_and_adopts_watermark_fenced_summary(
+    monkeypatch, tmp_path
+):
+    """A watermark-fenced worker keeps its commit admission at turn-hold
+    expiry; its late summary is ADOPTED (committed), not discarded — while
+    the turn itself is still released at the budget (#90845 invariant).
+    """
+    worker_started = threading.Event()
+    release_worker = threading.Event()
+    committed = threading.Event()
+    cleanup_done = threading.Event()
+    fake_db = MagicMock()
+    fake_db.get_compression_failure_cooldown.return_value = None
+
+    class FencedStreamingAgent:
+        last_instance = None
+
+        def __init__(self, **kwargs):
+            self.session_id = kwargs.get("session_id", "sess-97963")
+            self._session_db = kwargs.get("session_db")
+            self._last_compaction_in_place = False
+            self.context_compressor = SimpleNamespace(
+                bind_session_state=MagicMock(),
+                _last_compress_aborted=False,
+                _last_aux_model_failure_model=None,
+            )
+            self.shutdown_memory_provider = MagicMock()
+            self.close = MagicMock(side_effect=cleanup_done.set)
+            type(self).last_instance = self
+
+        def _compress_context(
+            self, messages, *_args, commit_fence=None, **_kwargs
+        ):
+            # Real compress_context marks the fence right after capturing
+            # the active-row watermark under the durable compression lock.
+            if commit_fence is not None:
+                commit_fence.mark_commit_watermark_fenced()
+            worker_started.set()
+            # Thinking-model shape: continuous progress, no commit yet —
+            # only the turn-hold budget can release the waiting turn.
+            # Bounded spin: a failing assertion before release_worker.set()
+            # must not leave this executor thread alive forever (pytest
+            # would hang at interpreter exit joining executor threads).
+            _spin_started = time.monotonic()
+            while not release_worker.is_set():
+                if time.monotonic() - _spin_started > 20:
+                    return (messages, None)
+                if commit_fence is not None:
+                    commit_fence.touch_progress()
+                time.sleep(0.01)
+            if commit_fence is not None and not commit_fence.begin_commit():
+                return (messages, None)
+            try:
+                self._session_db.archive_and_compact(
+                    self.session_id,
+                    [{"role": "assistant", "content": "summary"}],
+                    watermark=6,
+                )
+                self._last_compaction_in_place = True
+                committed.set()
+                return ([{"role": "assistant", "content": "summary"}], None)
+            finally:
+                if commit_fence is not None:
+                    commit_fence.finish_commit()
+
+    gateway_run = importlib.import_module("gateway.run")
+    _write_turnhold_config(tmp_path)
+    _install_fakes(monkeypatch, gateway_run, tmp_path, FencedStreamingAgent)
+
+    adapter = _CaptureAdapter()
+    runner = _build_runner(gateway_run, adapter, fake_db)
+
+    started = time.monotonic()
+    result = await asyncio.wait_for(runner._handle_message(_make_event()), timeout=15)
+    elapsed = time.monotonic() - started
+
+    # #90845/#92318 invariant intact: the turn is released at the budget.
+    assert result == "ok"
+    assert elapsed < 5.0, f"turn held for {elapsed:.1f}s despite the turn-hold budget"
+    assert worker_started.is_set()
+    assert runner._run_agent.await_count == 1
+
+    # (b) NO retry-after was armed while the attempt is still running —
+    # arming it would block the agent-side preflight from adopting the
+    # finished summary ("same-session cooldown active", #97963).
+    assert not fake_db.record_compression_failure_cooldown.called, (
+        "keep-admission path must not arm the retry-after while the "
+        "detached attempt is still running"
+    )
+
+    # The detached worker finishes late; its commit is ADMITTED (adoption),
+    # not refused — the summary attempt is no longer burned.
+    release_worker.set()
+    await asyncio.wait_for(asyncio.to_thread(committed.wait, 5), timeout=6)
+    assert committed.is_set(), (
+        "watermark-fenced worker must keep its commit admission after "
+        "turn-hold expiry (fence was cancelled — attempt burned)"
+    )
+    fake_db.archive_and_compact.assert_called_once()
+    # The commit went through the watermark-fenced path (concurrent tail
+    # rows above the watermark survive the compaction).
+    assert fake_db.archive_and_compact.call_args.kwargs.get("watermark") == 6
+
+    await _drain_deferred(runner)
+    await asyncio.wait_for(asyncio.to_thread(cleanup_done.wait, 5), timeout=6)
+    FencedStreamingAgent.last_instance.close.assert_called_once()
+
+    # Successful adoption resets the hygiene failure streak and still never
+    # advances it (the deferral is not a failure).
+    assert not fake_db.increment_hygiene_failure_streak.called
+    assert fake_db.reset_hygiene_failure_streak.called
+    # Deferral notice still reaches the user.
+    sent = [m["content"] for m in adapter.sent]
+    assert any(
+        "deferred" in c.lower() or "still streaming" in c.lower() for c in sent
+    ), f"turn-hold must send deferral notice, got: {sent}"
+
+
+@pytest.mark.asyncio
+async def test_turn_hold_kept_admission_arms_flat_retry_only_when_nothing_commits(
+    monkeypatch, tmp_path
+):
+    """If the kept-admission worker ends WITHOUT committing (summary failed
+    / attempt superseded), the flat non-escalating retry-after is restored so
+    sustained traffic does not spawn-and-abandon a compressor every turn —
+    but only AFTER the attempt truly ended, and without touching the streak.
+    """
+    worker_started = threading.Event()
+    release_worker = threading.Event()
+    fake_db = MagicMock()
+    fake_db.get_compression_failure_cooldown.return_value = None
+
+    class FencedNoCommitAgent:
+        def __init__(self, **kwargs):
+            self.session_id = kwargs.get("session_id", "sess-97963")
+            self._session_db = kwargs.get("session_db")
+            self._last_compaction_in_place = False
+            self.context_compressor = SimpleNamespace(
+                bind_session_state=MagicMock(),
+                _last_compress_aborted=False,
+                _last_aux_model_failure_model=None,
+            )
+            self.shutdown_memory_provider = MagicMock()
+            self.close = MagicMock()
+
+        def _compress_context(
+            self, messages, *_args, commit_fence=None, **_kwargs
+        ):
+            if commit_fence is not None:
+                commit_fence.mark_commit_watermark_fenced()
+            worker_started.set()
+            _spin_started = time.monotonic()
+            while not release_worker.is_set():
+                if time.monotonic() - _spin_started > 20:
+                    return (messages, None)
+                if commit_fence is not None:
+                    commit_fence.touch_progress()
+                time.sleep(0.01)
+            # Summary failed — return unchanged, no commit.
+            return (messages, None)
+
+    gateway_run = importlib.import_module("gateway.run")
+    _write_turnhold_config(tmp_path)
+    _install_fakes(monkeypatch, gateway_run, tmp_path, FencedNoCommitAgent)
+
+    adapter = _CaptureAdapter()
+    runner = _build_runner(gateway_run, adapter, fake_db)
+
+    result = await asyncio.wait_for(runner._handle_message(_make_event()), timeout=15)
+    assert result == "ok"
+    assert worker_started.is_set()
+    # While the attempt still runs: no cooldown, so preflight adoption
+    # stays possible.
+    assert not fake_db.record_compression_failure_cooldown.called
+
+    release_worker.set()
+    await _drain_deferred(runner)
+    # Let the done-callback fire.
+    for _ in range(100):
+        if fake_db.record_compression_failure_cooldown.called:
+            break
+        await asyncio.sleep(0.05)
+
+    # Nothing committed → flat retry-after restored (spacing), streak intact.
+    assert fake_db.record_compression_failure_cooldown.called, (
+        "a kept-admission attempt that ends without committing must restore "
+        "the flat turn-hold retry-after spacing"
+    )
+    args = fake_db.record_compression_failure_cooldown.call_args[0]
+    retry = args[1] - time.time()
+    assert retry <= 120, (
+        f"retry-after must stay flat (~60s), got {retry:.0f}s"
+    )
+    assert "turn-hold" in (args[2] or "")
+    assert not fake_db.increment_hygiene_failure_streak.called, (
+        "turn-hold deferral must never advance the failure streak"
+    )
+
+
+@pytest.mark.asyncio
+async def test_turn_hold_without_watermark_fence_still_cancels(
+    monkeypatch, tmp_path
+):
+    """A worker whose commit is NOT watermark-fenced (no session_db /
+    watermark capture failed) must still be cancelled at turn-hold expiry —
+    a late unfenced commit could clobber newer turns. Never worse than the
+    status quo. (Complements the pinned #90845 test, which exercises the
+    same path through the public surface.)
+    """
+    worker_started = threading.Event()
+    release_worker = threading.Event()
+    fake_db = MagicMock()
+    fake_db.get_compression_failure_cooldown.return_value = None
+
+    class UnfencedStreamingAgent:
+        def __init__(self, **kwargs):
+            self.session_id = kwargs.get("session_id", "sess-97963")
+            self._session_db = kwargs.get("session_db")
+            self._last_compaction_in_place = False
+            self.context_compressor = SimpleNamespace(
+                bind_session_state=MagicMock(),
+                _last_compress_aborted=False,
+                _last_aux_model_failure_model=None,
+            )
+            self.shutdown_memory_provider = MagicMock()
+            self.close = MagicMock()
+
+        def _compress_context(
+            self, messages, *_args, commit_fence=None, **_kwargs
+        ):
+            # Deliberately NO mark_commit_watermark_fenced().
+            worker_started.set()
+            _spin_started = time.monotonic()
+            while not release_worker.is_set():
+                if time.monotonic() - _spin_started > 20:
+                    return (messages, None)
+                if commit_fence is not None:
+                    commit_fence.touch_progress()
+                time.sleep(0.01)
+            if commit_fence is not None and not commit_fence.begin_commit():
+                return (messages, None)
+            try:
+                self._session_db.archive_and_compact(
+                    self.session_id,
+                    [{"role": "assistant", "content": "too late"}],
+                )
+                return ([{"role": "assistant", "content": "too late"}], None)
+            finally:
+                if commit_fence is not None:
+                    commit_fence.finish_commit()
+
+    gateway_run = importlib.import_module("gateway.run")
+    _write_turnhold_config(tmp_path)
+    _install_fakes(monkeypatch, gateway_run, tmp_path, UnfencedStreamingAgent)
+
+    adapter = _CaptureAdapter()
+    runner = _build_runner(gateway_run, adapter, fake_db)
+
+    result = await asyncio.wait_for(runner._handle_message(_make_event()), timeout=15)
+    assert result == "ok"
+    assert worker_started.is_set()
+
+    release_worker.set()
+    await _drain_deferred(runner)
+    await asyncio.sleep(0.2)
+    # The unfenced late commit was refused — discard as before the fix.
+    fake_db.archive_and_compact.assert_not_called()
+    # Legacy path still records the flat retry-after immediately.
+    assert fake_db.record_compression_failure_cooldown.called
+    assert not fake_db.increment_hygiene_failure_streak.called
diff --git a/tests/gateway/test_shutdown_executor_quiesce.py b/tests/gateway/test_shutdown_executor_quiesce.py
new file mode 100644
index 0000000000..4f0233f0ec
--- /dev/null
+++ b/tests/gateway/test_shutdown_executor_quiesce.py
@@ -0,0 +1,266 @@
+"""Gateway shutdown quiesces its thread pool before closing state.db (#101093).
+
+``_shutdown_executor()`` used to run *after* the SessionDB close block in
+``_stop_impl``, and it never waited: ``cancel_futures`` only drops work that has
+not started, and cancelling the awaiting task does not stop the worker thread
+behind a ``run_in_executor`` future.  So blocking DB work could still be running
+when ``SessionDB.close()`` checkpointed the WAL and let SQLite unlink the
+sidecar.  The late write then reopens the handle (#94736) and mints a fresh WAL
+generation behind that checkpoint, leaving teardown to checkpoint the same file
+a second time from a connection the shutdown log never accounts for -- the
+close-time page-write damage in #101093 and the split WAL generation in #101064.
+
+The order is now: quiesce (bounded) -> close.
+"""
+
+import asyncio
+import concurrent.futures
+import threading
+import time
+from collections import OrderedDict
+
+import pytest
+
+import gateway.run as gw_mod
+
+
+class _FakeSessionDB:
+    """Records when the gateway closed it, on a shared event log."""
+
+    def __init__(self, events, name):
+        self._events = events
+        self._name = name
+
+    def close(self):
+        self._events.append(f"close:{self._name}")
+
+
+class _FakeGateway:
+    """Minimal stand-in with just enough state for ``stop()`` to run."""
+
+    def __init__(self, events):
+        self._events = events
+        self._running = True
+        self._draining = False
+        self._restart_requested = False
+        self._restart_detached = False
+        self._restart_via_service = False
+        self._stop_task = None
+        self._exit_cleanly = False
+        self._exit_with_failure = False
+        self._exit_reason = None
+        self._exit_code = None
+        self._restart_drain_timeout = 0.01
+        self._running_agents = {}
+        self._running_agents_ts = {}
+        self._agent_cache = OrderedDict()
+        self._agent_cache_lock = threading.Lock()
+        self.adapters = {}
+        self._background_tasks = set()
+        self._failed_platforms = []
+        self._shutdown_event = asyncio.Event()
+        self._pending_messages = {}
+        self._pending_approvals = {}
+        self._busy_ack_ts = {}
+        self._executor_lock = threading.Lock()
+        self._executor_closing = False
+        self._executor = concurrent.futures.ThreadPoolExecutor(
+            max_workers=2, thread_name_prefix="quiesce-test"
+        )
+        self._session_db = _FakeSessionDB(events, "session_db")
+        self.session_store = None
+
+    # -- shutdown collaborators the real stop() reaches into ---------------
+
+    def _running_agent_count(self):
+        return len(self._running_agents)
+
+    def _active_cron_job_count(self):
+        return 0
+
+    def _active_api_run_count(self):
+        return 0
+
+    def _update_runtime_status(self, *_a, **_kw):
+        pass
+
+    def _clear_plugin_message_injector(self):
+        pass
+
+    async def _run_in_executor_with_context(self, func, *args):
+        return func(*args)
+
+    async def _cleanup_agent_resources_off_loop(self, agent, *, context=""):
+        self._cleanup_agent_resources(agent)
+
+    async def _notify_active_sessions_of_shutdown(self):
+        pass
+
+    async def _cancel_secondary_profile_reconnect_tasks(self):
+        pass
+
+    async def _drain_active_agents(self, timeout, cron_timeout=None):
+        return {}, False
+
+    async def _finalize_shutdown_agents(self, agents):
+        pass
+
+    def _cleanup_agent_resources(self, agent):
+        pass
+
+    def _evict_cached_agent(self, key):
+        pass
+
+    def _release_running_agent_state(self, session_key, **_kwargs):
+        self._running_agents.pop(session_key, None)
+        self._running_agents_ts.pop(session_key, None)
+        return False
+
+    def close_all_session_db_handles(self):
+        pass
+
+
+@pytest.mark.asyncio
+async def test_running_executor_work_finishes_before_session_db_close():
+    """A future already running when stop() begins writes before the close."""
+    events = []
+    gw = _FakeGateway(events)
+    started = threading.Event()
+
+    def _blocking_db_write():
+        started.set()
+        # Longer than the rest of the shutdown tail (~0.4s), shorter than the
+        # 2s quiesce ceiling: without the wait the close lands first.
+        time.sleep(1.0)
+        events.append("worker_write")
+
+    future = gw._executor.submit(_blocking_db_write)
+    assert started.wait(2.0), "worker never started"
+
+    await gw_mod.GatewayRunner.stop(gw)
+    future.result(timeout=5)
+
+    assert "worker_write" in events, "worker never ran"
+    assert "close:session_db" in events, "SessionDB was never closed"
+    assert events.index("worker_write") < events.index("close:session_db"), (
+        f"state.db was closed while a worker was still writing: {events}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_executor_refuses_new_work_before_session_db_close():
+    """``_executor_closing`` is set before the close, so no fresh pool is minted."""
+    events = []
+    gw = _FakeGateway(events)
+
+    real_close = gw._session_db.close
+
+    def _close_and_probe():
+        # The flag must already be set by the time the DB is closed, or a
+        # coroutine reaching _get_executor() here would spin up a new pool and
+        # run more blocking DB work against the handle being torn down.
+        events.append(f"closing_flag:{gw._executor_closing}")
+        real_close()
+
+    gw._session_db.close = _close_and_probe
+
+    await gw_mod.GatewayRunner.stop(gw)
+
+    assert "closing_flag:True" in events, events
+    with pytest.raises(RuntimeError):
+        gw_mod.GatewayRunner._get_executor(gw)
+
+
+@pytest.mark.asyncio
+async def test_stuck_worker_skips_the_session_db_close():
+    """A worker that outlives the quiesce budget must not be raced by close().
+
+    Reporting the live worker with a "may reopen state.db" warning is not
+    enough: the close()/checkpoint itself is the operation that raced the
+    late write and produced the wrong-page-number corruption in #101093,
+    so the close path has to be skipped whenever a worker survives the
+    budget, not merely logged around.
+    """
+    events = []
+    gw = _FakeGateway(events)
+    release = threading.Event()
+    started = threading.Event()
+
+    def _stuck():
+        started.set()
+        release.wait(5.0)
+        events.append("worker_write")
+
+    future = gw._executor.submit(_stuck)
+    assert started.wait(2.0), "worker never started"
+
+    # Force the quiesce budget to 0 so the worker is deterministically still
+    # alive when `_shutdown_executor` returns, without sleeping through the
+    # real 2s ceiling.
+    original_timeout = gw_mod._EXECUTOR_QUIESCE_TIMEOUT
+    gw_mod._EXECUTOR_QUIESCE_TIMEOUT = 0.0
+    try:
+        await gw_mod.GatewayRunner.stop(gw)
+    finally:
+        gw_mod._EXECUTOR_QUIESCE_TIMEOUT = original_timeout
+
+    assert "close:session_db" not in events, (
+        f"SessionDB was closed/checkpointed while a worker was still alive: {events}"
+    )
+
+    release.set()
+    future.result(timeout=5)
+    assert "worker_write" in events, "worker never finished"
+
+
+def test_shutdown_executor_defaults_to_no_wait():
+    """The no-argument call keeps the historical fire-and-forget contract."""
+    gw = _FakeGateway([])
+    release = threading.Event()
+    started = threading.Event()
+
+    def _slow():
+        started.set()
+        release.wait(5.0)
+
+    future = gw._executor.submit(_slow)
+    assert started.wait(2.0)
+
+    began = time.monotonic()
+    still_live = gw_mod.GatewayRunner._shutdown_executor(gw)
+    elapsed = time.monotonic() - began
+
+    assert elapsed < 0.5, f"default call waited {elapsed:.2f}s"
+    assert still_live == 1
+    release.set()
+    future.result(timeout=5)
+
+
+def test_shutdown_executor_reports_a_stuck_worker():
+    """A worker that outlives the budget is reported, not waited on forever."""
+    gw = _FakeGateway([])
+    release = threading.Event()
+    started = threading.Event()
+
+    def _stuck():
+        started.set()
+        release.wait(5.0)
+
+    future = gw._executor.submit(_stuck)
+    assert started.wait(2.0)
+
+    began = time.monotonic()
+    still_live = gw_mod.GatewayRunner._shutdown_executor(gw, drain_timeout=0.2)
+    elapsed = time.monotonic() - began
+
+    assert still_live == 1
+    assert 0.15 <= elapsed < 2.0, f"budget not honoured: {elapsed:.2f}s"
+    release.set()
+    future.result(timeout=5)
+
+
+def test_shutdown_executor_without_executor_returns_zero():
+    gw = _FakeGateway([])
+    gw._executor.shutdown(wait=True)
+    gw._executor = None
+    assert gw_mod.GatewayRunner._shutdown_executor(gw, drain_timeout=1.0) == 0
diff --git a/tests/gateway/test_shutdown_flush.py b/tests/gateway/test_shutdown_flush.py
index efe6f59572..f966ea896d 100644
--- a/tests/gateway/test_shutdown_flush.py
+++ b/tests/gateway/test_shutdown_flush.py
@@ -11,6 +11,7 @@ import pytest
 
 from gateway.shutdown_flush import (
     _serialise_value,
+    flush_overflow_to_file,
     flush_pending_to_file,
     recover_pending_to_db,
 )
@@ -168,3 +169,72 @@ def test_get_flush_dir_uses_get_hermes_home(tmp_path, monkeypatch):
     assert result == tmp_path / "pending_messages"
 
 
+
+
+# ── FIFO overflow tail durability (#99882) ─────────────────────────────
+
+
+def _overflow_event(text: str, session_id: str = "20260901_120000_fifo"):
+    event = MagicMock()
+    event.text = text
+    event.session_id = session_id
+    event.platform = "telegram"
+    event.sender_id = "1572286605"
+    event.sender_name = "tester"
+    event.reply_to = None
+    event.media = None
+    event.raw_event = None
+    return event
+
+
+def test_flush_overflow_writes_one_payload_per_event_in_arrival_order(tmp_path, monkeypatch):
+    """The FIFO tail (queued_events) must survive shutdown like the slot does.
+
+    Each overflow entry is its own recover_pending_to_db-compatible payload,
+    with ``seq`` recording arrival order inside the session.
+    """
+    flush_dir = _make_flush_dir(tmp_path)
+    monkeypatch.setattr("gateway.shutdown_flush._get_flush_dir", lambda: flush_dir)
+
+    count = flush_overflow_to_file(
+        {
+            "agent:main:telegram:dm:1": [
+                _overflow_event("follow-up B"),
+                _overflow_event("follow-up C"),
+            ],
+            "agent:main:telegram:dm:2": [],
+            "": [_overflow_event("keyless — skipped")],
+        },
+        reason="shutdown",
+    )
+    assert count == 2
+    payloads = sorted(
+        (json.loads(f.read_text(encoding="utf-8")) for f in flush_dir.glob("*.json")),
+        key=lambda p: p["seq"],
+    )
+    assert [p["data"]["text"] for p in payloads] == ["follow-up B", "follow-up C"]
+    assert {p["session_key"] for p in payloads} == {"agent:main:telegram:dm:1"}
+    assert all(p["reason"] == "shutdown" for p in payloads)
+
+
+def test_flushed_overflow_is_replayed_by_recover_pending_to_db(tmp_path, monkeypatch):
+    """Round-trip: overflow payloads use the slot-flush shape, so the existing
+    startup recovery inserts them as user rows without any new reader."""
+    flush_dir = _make_flush_dir(tmp_path)
+    monkeypatch.setattr("gateway.shutdown_flush._get_flush_dir", lambda: flush_dir)
+    flush_overflow_to_file({"agent:main:telegram:dm:1": [_overflow_event("orphan-1")]})
+
+    db = MagicMock()
+    recovered = recover_pending_to_db(session_db=db)
+    assert recovered == 1
+    db.append_message.assert_called_once()
+    kwargs = db.append_message.call_args.kwargs
+    assert kwargs["session_id"] == "20260901_120000_fifo"
+    assert kwargs["role"] == "user"
+    assert kwargs["content"] == "orphan-1"
+    assert list(flush_dir.glob("*.json")) == []
+
+
+def test_flush_overflow_noop_on_empty():
+    assert flush_overflow_to_file({}) == 0
+    assert flush_overflow_to_file({"k": []}) == 0
diff --git a/tests/gateway/test_shutdown_watchdog.py b/tests/gateway/test_shutdown_watchdog.py
index b46437383b..ec0e93e5c3 100644
--- a/tests/gateway/test_shutdown_watchdog.py
+++ b/tests/gateway/test_shutdown_watchdog.py
@@ -8,11 +8,18 @@ structurally unable to fire. These tests pin the out-of-loop backstop
 from __future__ import annotations
 
 import asyncio
+import contextlib
 import json
+import logging
+import os
+import shutil
+import tempfile
 import threading
 import time
+from pathlib import Path
 from unittest.mock import patch
 
+import gateway.shutdown_watchdog as shutdown_watchdog_module
 import pytest
 
 from gateway.shutdown_watchdog import (
@@ -66,3 +73,105 @@ def test_arm_shutdown_watchdog_fires_with_dump_and_exit(tmp_path):
     assert get_shutdown_watchdog_dump_path(tmp_path).name == "gateway-shutdown-watchdog.log"
 
 
+
+
+async def _run_heartbeat_until_payload(tmp_path, timeout_s=10.0):
+    """Run loop_heartbeat_forever as a task until a heartbeat payload exists.
+
+    Returns (task, payload). Cancels the task and awaits it (suppressing
+    CancelledError) before returning so the tick server is closed cleanly.
+    """
+    task = asyncio.ensure_future(
+        loop_heartbeat_forever(interval_s=1.0, home=tmp_path)
+    )
+    heartbeat_path = get_loop_heartbeat_path(tmp_path)
+    deadline = time.monotonic() + timeout_s
+    payload = None
+    while time.monotonic() < deadline:
+        if heartbeat_path.is_file():
+            with contextlib.suppress(OSError, json.JSONDecodeError):
+                payload = json.loads(heartbeat_path.read_text(encoding="utf-8"))
+                if payload:
+                    break
+                payload = None
+        await asyncio.sleep(0.05)
+    task.cancel()
+    with contextlib.suppress(asyncio.CancelledError):
+        await task
+    if payload is None:
+        pytest.fail(
+            f"heartbeat payload did not appear at {heartbeat_path} within "
+            f"{timeout_s}s"
+        )
+    return payload
+
+
+@pytest.fixture()
+def short_home():
+    """Short HERMES_HOME for tests that bind a real AF_UNIX socket.
+
+    pytest's tmp_path nests deep enough on CI runners / macOS that
+    ``state/gateway.loop-tick.<pid>.sock`` exceeds the sockaddr_un limit and
+    bind() raises ``OSError: AF_UNIX path too long`` — which the producer
+    swallows into ``loop_tick_socket=False``, falsely failing the POSIX arm
+    test. Same pattern as tests/hermes_cli/test_update_wedged_gateway.py.
+    """
+    path = Path(tempfile.mkdtemp(prefix="hsw-"))
+    try:
+        yield path
+    finally:
+        shutil.rmtree(path, ignore_errors=True)
+
+
+@pytest.mark.asyncio
+async def test_loop_tick_witness_arms_over_tcp_on_windows(
+    short_home, caplog, monkeypatch
+):
+    """Non-POSIX never touches AF_UNIX; the witness arms over TCP loopback."""
+    tmp_path = short_home
+    # Pretend the platform is Windows as seen from the module under test.
+    # A plain monkeypatch of the global os.name would flip pathlib.Path
+    # dispatch (Path.__new__ reads os.name at runtime) and crash pytest's
+    # own tmp-dir machinery, so swap the module's `os` binding for a proxy
+    # whose `.name` is "nt" and which delegates everything else to real os.
+    class _WindowsOsProxy:
+        name = "nt"
+
+        def __getattr__(self, item):
+            return getattr(os, item)
+
+    monkeypatch.setattr(shutdown_watchdog_module, "os", _WindowsOsProxy())
+
+    start_unix_server_calls = []
+
+    def _forbid_start_unix_server(*args, **kwargs):
+        start_unix_server_calls.append((args, kwargs))
+        raise AssertionError("start_unix_server must not be called on non-POSIX")
+
+    with patch.object(
+        shutdown_watchdog_module.asyncio,
+        "start_unix_server",
+        side_effect=_forbid_start_unix_server,
+    ), caplog.at_level(logging.DEBUG, logger="gateway.shutdown_watchdog"):
+        payload = await _run_heartbeat_until_payload(tmp_path)
+
+    # (a) the AF_UNIX server was never attempted
+    assert start_unix_server_calls == []
+    # (b) no warning about an unavailable tick socket
+    assert not [
+        r
+        for r in caplog.records
+        if r.levelname == "WARNING"
+        and "Loop tick socket unavailable" in r.getMessage()
+    ]
+    # (c) the witness is armed over TCP and the port is published
+    assert payload["loop_tick_socket"] is True
+    assert 0 < int(payload["loop_tick_tcp_port"]) <= 65535
+    # (d) the POSIX socket node was never created
+    assert not list(tmp_path.glob("**/gateway.loop-tick.*.sock"))
+
+
+@pytest.mark.asyncio
+async def test_loop_tick_witness_arms_on_posix(short_home):
+    payload = await _run_heartbeat_until_payload(short_home)
+    assert payload["loop_tick_socket"] is True
diff --git a/tests/gateway/test_silent_partial_delivery_95382.py b/tests/gateway/test_silent_partial_delivery_95382.py
new file mode 100644
index 0000000000..1f41063771
--- /dev/null
+++ b/tests/gateway/test_silent_partial_delivery_95382.py
@@ -0,0 +1,481 @@
+"""Regression coverage for #95382 / #98552 — silent partial delivery.
+
+#95382 (Discord): the WebSocket drops after the first streaming edit (which
+carried only a prefix). The consumer's delivery flags could suppress the
+gateway's normal final send even though no recorded payload proved the
+COMPLETE ``final_response`` ever reached the platform; and when the normal
+final send then failed on the dead transport, the failure was recorded with a
+non-retryable error string, so the delivery-obligation ledger's reconnect
+sweep never replayed it — the turn's output was silently lost until a full
+process restart.
+
+#98552 (Telegram): a finalize path that sets ``final_content_delivered=True``
+without recording what was actually delivered produced the same false
+positive on a 624-char message truncated at 333 chars.
+
+Class contract under test:
+
+1. ``delivered_final_matches`` judges a payload-less delivery flag against
+   the FINAL content (via ``has_delivered_text``) instead of returning the
+   legacy-trust ``None`` — only the explicitly-marked ambiguous-timeout path
+   keeps legacy trust.
+2. Every flag-setting site records its delivered payload (fresh-final and
+   the optimistic native finalize were the record-less holdouts).
+3. Discord transport-shaped send failures are classified as
+   ``send_path_degraded`` (retryable) so the ledger reconnect sweep can
+   replay the stranded final response.
+
+Boundary tests drive the REAL ``GatewayRunner._run_agent`` with a live
+``GatewayStreamConsumer`` (pattern from test_stale_finalize_suppression.py).
+"""
+
+import asyncio
+import importlib
+import sys
+import types
+from types import SimpleNamespace
+
+import pytest
+
+from gateway.config import Platform, PlatformConfig, StreamingConfig
+from gateway.platforms.base import BasePlatformAdapter, SendResult
+from gateway.session import SessionSource
+from gateway.stream_consumer import GatewayStreamConsumer, StreamConsumerConfig
+
+
+STREAMED_PREFIX = "Deploy summary: 713 items published (578 as of 08-26"
+MISSING_TAIL = ", another 135 over the past 4 days). All checks green."
+FULL_RESPONSE = STREAMED_PREFIX + MISSING_TAIL
+
+
+# ---------------------------------------------------------------------------
+# Unit coverage — delivered_final_matches tri-state tightening
+# ---------------------------------------------------------------------------
+
+
+def _make_consumer(adapter=None, **overrides):
+    adapter = adapter or SimpleNamespace(
+        MAX_MESSAGE_LENGTH=4096,
+        splits_long_messages=True,
+    )
+    consumer = GatewayStreamConsumer.__new__(GatewayStreamConsumer)
+    consumer.adapter = adapter
+    consumer.chat_id = "c1"
+    consumer.cfg = StreamConsumerConfig(cursor="▉")
+    consumer._final_response_sent = True
+    consumer._final_content_delivered = True
+    consumer._delivered_final_text = None
+    consumer._turn_split_delivery = False
+    consumer._delivery_ambiguous = False
+    consumer._delivered_commentary_texts = []
+    consumer._delivered_segment_texts = []
+    consumer._last_sent_text = ""
+    consumer._accumulated = ""
+    consumer._stream_ledger = ""
+    consumer._initial_reply_to_id = None
+    consumer.metadata = None
+    consumer._already_sent = True
+    for key, value in overrides.items():
+        setattr(consumer, key, value)
+    return consumer
+
+
+class TestDeliveredFinalMatchesRecordless:
+    def test_recordless_flag_with_partial_visible_is_mismatch(self):
+        """#95382 core: flag set, no record, visible text is only a prefix —
+        the matcher must return False (recover), not None (legacy trust)."""
+        consumer = _make_consumer(_last_sent_text=STREAMED_PREFIX + "▉")
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is False
+
+    def test_recordless_flag_with_no_visible_text_is_mismatch(self):
+        """Flag set but nothing visibly delivered at all — mismatch."""
+        consumer = _make_consumer()
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is False
+
+    def test_recordless_flag_with_equal_visible_text_matches(self):
+        """Duplicate-suppression control: the visible text IS the final
+        answer — suppression must be retained (True)."""
+        consumer = _make_consumer(_last_sent_text=FULL_RESPONSE + "▉")
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is True
+
+    def test_ambiguous_timeout_keeps_legacy_trust(self):
+        """The explicitly-marked ambiguous full-final timeout is the ONE
+        record-less case that keeps legacy trust (None) — re-sending there
+        risks a duplicate, not a recovery."""
+        consumer = _make_consumer(_delivery_ambiguous=True)
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is None
+
+    def test_recorded_payload_still_wins_over_visible(self):
+        consumer = _make_consumer(
+            _delivered_final_text=FULL_RESPONSE,
+            _last_sent_text="something else entirely",
+        )
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is True
+
+    def test_payloadless_split_still_refuses_trust(self):
+        """#78541 behavior preserved by the tightening."""
+        consumer = _make_consumer(_turn_split_delivery=True)
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is False
+
+    def test_delivered_segment_text_matches(self):
+        """A segment-finalized delivery of the final text still suppresses."""
+        consumer = _make_consumer(
+            _delivered_segment_texts=[FULL_RESPONSE],
+        )
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is True
+
+
+class TestFlagSettingSitesRecordPayload:
+    @pytest.mark.asyncio
+    async def test_fresh_final_records_delivered_payload(self):
+        """_try_fresh_final must record what it sent (#95382 holdout)."""
+
+        class FreshAdapter:
+            MAX_MESSAGE_LENGTH = 4096
+            splits_long_messages = True
+
+            def __init__(self):
+                self.sent = []
+
+            async def send(self, chat_id, content, reply_to=None, metadata=None):
+                self.sent.append(content)
+                return SendResult(success=True, message_id="m-1")
+
+        adapter = FreshAdapter()
+        consumer = _make_consumer(adapter)
+        consumer._final_response_sent = False
+        consumer._final_content_delivered = False
+        consumer._preview_message_ids = set()
+        consumer._message_id = "m-0"
+        consumer._message_created_ts = None
+        consumer.metadata = None
+        consumer._already_sent = False
+
+        ok = await consumer._try_fresh_final(STREAMED_PREFIX, is_turn_final=True)
+        assert ok is True
+        assert consumer._final_response_sent is True
+        # The recorded payload lets the gateway detect a stale fresh-final.
+        assert consumer._delivered_final_text is not None
+        assert STREAMED_PREFIX in consumer._delivered_final_text
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is False
+        assert consumer.delivered_final_matches(STREAMED_PREFIX) is True
+
+
+# ---------------------------------------------------------------------------
+# Gateway-boundary regression — record-less flags must not swallow the reply
+# ---------------------------------------------------------------------------
+
+
+class CaptureAdapter(BasePlatformAdapter):
+    def __init__(self, platform=Platform.DISCORD):
+        super().__init__(PlatformConfig(enabled=True, token="***"), platform)
+        self.sent = []
+        self.edits = []
+        self._next_id = 0
+        self.fail_edits = False
+
+    async def connect(self, *, is_reconnect: bool = False) -> bool:
+        return True
+
+    async def disconnect(self) -> None:
+        return None
+
+    def _mint_id(self) -> str:
+        self._next_id += 1
+        return f"m-{self._next_id}"
+
+    async def send(self, chat_id, content, reply_to=None, metadata=None) -> SendResult:
+        self.sent.append({"chat_id": chat_id, "content": content})
+        return SendResult(success=True, message_id=self._mint_id())
+
+    async def edit_message(
+        self, chat_id, message_id, content, *, finalize: bool = False, metadata=None
+    ) -> SendResult:
+        if self.fail_edits:
+            return SendResult(success=False, error="websocket closed")
+        self.edits.append(
+            {"message_id": message_id, "content": content, "finalize": finalize}
+        )
+        return SendResult(success=True, message_id=message_id)
+
+    async def send_typing(self, chat_id, metadata=None) -> None:
+        return None
+
+    async def stop_typing(self, chat_id) -> None:
+        return None
+
+    async def get_chat_info(self, chat_id: str):
+        return {"id": chat_id}
+
+
+class PrefixOnlyAgent:
+    """Streams only a prefix; the completed response has a longer tail."""
+
+    def __init__(self, **kwargs):
+        self.stream_delta_callback = kwargs.get("stream_delta_callback")
+        self.tools = []
+
+    def run_conversation(self, message, conversation_history=None, task_id=None):
+        if self.stream_delta_callback:
+            self.stream_delta_callback(STREAMED_PREFIX)
+        return {
+            "final_response": FULL_RESPONSE,
+            "response_previewed": False,
+            "messages": [],
+            "api_calls": 1,
+        }
+
+
+class _RecordlessFlagConsumer(GatewayStreamConsumer):
+    """Sabotage subclass: models the #95382/#98552 incident state.
+
+    After a normal drain, claim final delivery via the flags but scrub the
+    recorded payload — the pre-fix gateway read matcher ``None`` as legacy
+    trust and suppressed the corrective send even though only the prefix was
+    ever visible.
+    """
+
+    async def run(self):
+        await super().run()
+        self._final_response_sent = True
+        self._final_content_delivered = True
+        self._turn_split_delivery = False
+        self._delivered_final_text = None
+        # Only the prefix was ever on screen.
+        self._last_sent_text = STREAMED_PREFIX
+        self._delivered_segment_texts = []
+        self._delivered_commentary_texts = []
+
+
+def _make_runner(adapter):
+    gateway_run = importlib.import_module("gateway.run")
+    runner = object.__new__(gateway_run.GatewayRunner)
+    runner.adapters = {adapter.platform: adapter}
+    runner._voice_mode = {}
+    runner._prefill_messages = []
+    runner._ephemeral_system_prompt = ""
+    runner._reasoning_config = None
+    runner._provider_routing = {}
+    runner._fallback_model = None
+    runner._session_db = None
+    runner._running_agents = {}
+    runner._session_run_generation = {}
+    runner.session_store = SimpleNamespace(_entries={}, _save=lambda: None)
+    runner.hooks = SimpleNamespace(loaded_hooks=False)
+    runner.config = SimpleNamespace(
+        thread_sessions_per_user=False,
+        group_sessions_per_user=False,
+        stt_enabled=False,
+        streaming=StreamingConfig.from_dict(
+            {"enabled": True, "edit_interval": 0.01, "buffer_threshold": 1}
+        ),
+    )
+    return runner
+
+
+async def _run_turn(monkeypatch, tmp_path, *, consumer_cls=None, session_id):
+    import yaml
+
+    (tmp_path / "config.yaml").write_text(
+        yaml.dump(
+            {
+                "display": {"tool_progress": "off", "interim_assistant_messages": False},
+                "streaming": {
+                    "enabled": True,
+                    "edit_interval": 0.01,
+                    "buffer_threshold": 1,
+                },
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    fake_dotenv = types.ModuleType("dotenv")
+    fake_dotenv.load_dotenv = lambda *args, **kwargs: None
+    monkeypatch.setitem(sys.modules, "dotenv", fake_dotenv)
+
+    fake_run_agent = types.ModuleType("run_agent")
+    fake_run_agent.AIAgent = PrefixOnlyAgent
+    monkeypatch.setitem(sys.modules, "run_agent", fake_run_agent)
+
+    gateway_run = importlib.import_module("gateway.run")
+    if consumer_cls is not None:
+        stream_consumer_mod = importlib.import_module("gateway.stream_consumer")
+        monkeypatch.setattr(
+            stream_consumer_mod, "GatewayStreamConsumer", consumer_cls
+        )
+    monkeypatch.setattr(gateway_run, "_hermes_home", tmp_path)
+    monkeypatch.setattr(
+        gateway_run, "_resolve_runtime_agent_kwargs", lambda: {"api_key": "***"}
+    )
+
+    adapter = CaptureAdapter()
+    runner = _make_runner(adapter)
+    source = SessionSource(
+        platform=Platform.DISCORD, chat_id="1534932197436424204", chat_type="group"
+    )
+    result = await runner._run_agent(
+        message="deploy status?",
+        context_prompt="",
+        history=[],
+        source=source,
+        session_id=session_id,
+        session_key=f"agent:main:discord:group:{session_id}",
+    )
+    return adapter, result
+
+
+@pytest.mark.asyncio
+async def test_recordless_delivery_flag_does_not_suppress_complete_response(
+    monkeypatch, tmp_path
+):
+    """#95382 boundary: flags claim delivery, nothing recorded, only the
+    prefix visible — the complete response must NOT be suppressed."""
+    adapter, result = await _run_turn(
+        monkeypatch,
+        tmp_path,
+        consumer_cls=_RecordlessFlagConsumer,
+        session_id="sess-95382-recordless",
+    )
+    assert result["final_response"] == FULL_RESPONSE
+    # Pre-fix behavior: already_sent=True and the tail appears in NO platform
+    # call (silent partial delivery). Post-fix: either the gateway performed
+    # the reconciliation edit itself (full text on the wire), or it declined
+    # to claim delivery so the caller's normal final send delivers it.
+    all_payloads = [c["content"] for c in adapter.sent] + [
+        e["content"] for e in adapter.edits
+    ]
+    delivered_here = any(FULL_RESPONSE in p for p in all_payloads)
+    assert delivered_here or not result.get("already_sent"), (
+        "silent partial delivery: gateway claimed delivery but the complete "
+        f"response never reached the platform; payloads={all_payloads!r}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_normal_streaming_turn_still_suppresses_exactly_once(
+    monkeypatch, tmp_path
+):
+    """Control: an honest streaming turn (finalize edit carries the full
+    response) must still suppress the duplicate normal send."""
+    adapter, result = await _run_turn(
+        monkeypatch, tmp_path, session_id="sess-95382-control"
+    )
+    assert result["final_response"] == FULL_RESPONSE
+    all_payloads = [c["content"] for c in adapter.sent] + [
+        e["content"] for e in adapter.edits
+    ]
+    assert any(FULL_RESPONSE in p for p in all_payloads)
+    full_sends = [c for c in adapter.sent if FULL_RESPONSE in c["content"]]
+    assert len(full_sends) <= 1, f"duplicate final delivery: {full_sends!r}"
+
+
+@pytest.mark.asyncio
+async def test_recordless_flag_with_dead_transport_leaves_normal_send(
+    monkeypatch, tmp_path
+):
+    """#95382 incident shape: the reconciliation edit ALSO fails (dead
+    transport). The gateway must NOT claim already_sent — the normal final
+    send (and, on failure there, the delivery ledger) owns recovery."""
+
+    class _DeadEditRecordlessConsumer(_RecordlessFlagConsumer):
+        async def run(self):
+            await super().run()
+            # Transport dies after the stream drained: every further edit
+            # fails, like a dropped Discord WebSocket.
+            self.adapter.fail_edits = True
+
+    adapter, result = await _run_turn(
+        monkeypatch,
+        tmp_path,
+        consumer_cls=_DeadEditRecordlessConsumer,
+        session_id="sess-95382-dead-transport",
+    )
+    assert result["final_response"] == FULL_RESPONSE
+    assert not result.get("already_sent"), (
+        "gateway claimed delivery although neither the stream nor the "
+        "reconciliation edit put the complete response on the wire"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Discord transport classification + ledger reconnect replay (#95382 lane 2)
+# ---------------------------------------------------------------------------
+
+
+class TestDiscordTransportClassification:
+    def _adapter_module(self):
+        import plugins.platforms.discord.adapter as mod
+
+        return mod
+
+    def test_connection_error_is_transport(self):
+        mod = self._adapter_module()
+        assert mod._is_discord_transport_error(ConnectionError("websocket closed"))
+        assert mod._is_discord_transport_error(
+            RuntimeError("Session is closed")
+        )
+        assert mod._is_discord_transport_error(OSError(104, "Connection reset"))
+
+    def test_http_and_timeout_errors_are_not_transport(self):
+        mod = self._adapter_module()
+        assert not mod._is_discord_transport_error(
+            RuntimeError("error code: 50013: Missing Permissions")
+        )
+        assert not mod._is_discord_transport_error(asyncio.TimeoutError())
+
+    @pytest.mark.asyncio
+    async def test_send_without_client_reports_send_path_degraded(self):
+        mod = self._adapter_module()
+        adapter = mod.DiscordAdapter.__new__(mod.DiscordAdapter)
+        adapter._client = None
+        result = await mod.DiscordAdapter.send(adapter, "c1", "hello")
+        assert result.success is False
+        assert result.error == "send_path_degraded"
+        assert result.retryable is True
+
+
+class TestLedgerReplaysDegradedDiscordSend:
+    def test_reconnect_sweep_claims_degraded_discord_row(self, tmp_path, monkeypatch):
+        """End-to-end ledger check: a final response rejected with
+        ``send_path_degraded`` on Discord is claimed by the runtime
+        reconnect sweep; a generic 'Not connected' row (pre-fix error
+        string) is stranded. This is the exact silent-loss mechanism from
+        the #95382 field logs."""
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+        import gateway.delivery_ledger as dl
+
+        importlib.reload(dl)
+
+        oid_degraded = dl.compute_obligation_id("sess-a", "msg-1", FULL_RESPONSE)
+        dl.record_obligation(
+            obligation_id=oid_degraded,
+            session_key="agent:main:discord:group:c1",
+            platform="discord",
+            chat_id="c1",
+            thread_id=None,
+            content=FULL_RESPONSE,
+        )
+        dl.mark_attempting(oid_degraded)
+        dl.mark_failed(oid_degraded, "send_path_degraded")
+
+        oid_generic = dl.compute_obligation_id("sess-b", "msg-2", FULL_RESPONSE)
+        dl.record_obligation(
+            obligation_id=oid_generic,
+            session_key="agent:main:discord:group:c2",
+            platform="discord",
+            chat_id="c2",
+            thread_id=None,
+            content=FULL_RESPONSE,
+        )
+        dl.mark_attempting(oid_generic)
+        dl.mark_failed(oid_generic, "Not connected")
+
+        claimed = dl.sweep_failed_for_runtime("discord")
+        claimed_ids = {row["obligation_id"] for row in claimed}
+        assert oid_degraded in claimed_ids, (
+            "send_path_degraded Discord row must be replayable after reconnect"
+        )
+        assert oid_generic not in claimed_ids, (
+            "non-transport errors must not be blindly replayed"
+        )
diff --git a/tests/gateway/test_simplex_plugin.py b/tests/gateway/test_simplex_plugin.py
index 1a88d56513..90d3aa8ed1 100644
--- a/tests/gateway/test_simplex_plugin.py
+++ b/tests/gateway/test_simplex_plugin.py
@@ -388,3 +388,73 @@ def _make_file_chat_item(file_path: str, file_name: str) -> dict:
     }
 
 
+
+
+# ---------------------------------------------------------------------------
+# Multiplex secondary-profile scope
+# ---------------------------------------------------------------------------
+#
+# Every SIMPLEX_* read (auto_accept / group_allowed in __init__, ws_url in the
+# registry gates, everything in _env_enablement) went through raw os.getenv,
+# which under multiplexing holds the DEFAULT profile's YAML-to-env bridge
+# output -- a secondary profile silently borrowed the default's daemon URL,
+# group allowlist and auto-accept setting. Reads now go through the module's
+# ``_get_scoped_secret`` (profile .env AND extra both honored; scoped miss
+# fails closed; unscoped default profile keeps env precedence).
+
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    from agent.secret_scope import (
+        reset_secret_scope,
+        set_multiplex_active,
+        set_secret_scope,
+    )
+
+    tokens = []
+
+    def install(scope=None):
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+
+    yield install
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("SIMPLEX_WS_URL", "ws://default:5225")
+    monkeypatch.setenv("SIMPLEX_GROUP_ALLOWED", "*")
+    monkeypatch.setenv("SIMPLEX_AUTO_ACCEPT", "true")
+
+
+def test_multiplex_scoped_miss_does_not_borrow_default_profile_env(
+    multiplex_scope, default_profile_env
+):
+    """A secondary profile with no SimpleX config of its own must not be
+    auto-enabled off the default's daemon URL, nor inherit its wide-open
+    group allowlist."""
+    from gateway.config import PlatformConfig
+
+    multiplex_scope({"SOMETHING_ELSE": "x"})
+    assert _env_enablement() is None
+    assert check_requirements() is False
+    assert is_connected(PlatformConfig(enabled=True, extra={})) is False
+    adapter = SimplexAdapter(PlatformConfig(enabled=True, extra={"auto_accept": False}))
+    assert adapter.group_allow_from == set()
+    assert adapter.auto_accept is False
+
+
+def test_multiplex_scope_reads_profile_own_env_not_default(
+    multiplex_scope, default_profile_env
+):
+    """A secondary profile's own .env (installed as the scope) is honored --
+    the extra-only shape would have ignored it."""
+    multiplex_scope({"SIMPLEX_WS_URL": "ws://profile:5225", "SIMPLEX_GROUP_ALLOWED": "g1"})
+    seeded = _env_enablement()
+    assert seeded == {"ws_url": "ws://profile:5225", "group_allowed": "g1"}
+    assert check_requirements() is True
diff --git a/tests/gateway/test_slack_api_human_senders.py b/tests/gateway/test_slack_api_human_senders.py
new file mode 100644
index 0000000000..5bde8bd103
--- /dev/null
+++ b/tests/gateway/test_slack_api_human_senders.py
@@ -0,0 +1,94 @@
+"""Tests for the Slack ``api_human_users`` allowlist.
+
+A message posted through the Web API with a *user* token (``xoxp-``) is
+authored by a real person, but it arrives with the posting ``app_id`` and no
+``client_msg_id`` — the #35777 app/bot signature — so
+``_event_declares_bot_sender`` drops it. ``platforms.slack.extra.api_human_users``
+allowlists those *users* (never apps: an app's own ``xoxb`` bot posts carry
+the same user+app_id shape).
+"""
+
+import sys
+from unittest.mock import MagicMock
+
+import pytest
+
+
+# Mock slack-bolt / slack-sdk the same way test_slack_mention.py does.
+def _ensure_slack_mock():
+    if "slack_bolt" in sys.modules and hasattr(sys.modules["slack_bolt"], "__file__"):
+        return
+    slack_bolt = MagicMock()
+    slack_bolt.async_app.AsyncApp = MagicMock
+    slack_bolt.adapter.socket_mode.async_handler.AsyncSocketModeHandler = MagicMock
+    slack_sdk = MagicMock()
+    slack_sdk.web.async_client.AsyncWebClient = MagicMock
+    for name, mod in [
+        ("slack_bolt", slack_bolt),
+        ("slack_bolt.async_app", slack_bolt.async_app),
+        ("slack_bolt.adapter", slack_bolt.adapter),
+        ("slack_bolt.adapter.socket_mode", slack_bolt.adapter.socket_mode),
+        (
+            "slack_bolt.adapter.socket_mode.async_handler",
+            slack_bolt.adapter.socket_mode.async_handler,
+        ),
+        ("slack_sdk", slack_sdk),
+        ("slack_sdk.web", slack_sdk.web),
+        ("slack_sdk.web.async_client", slack_sdk.web.async_client),
+    ]:
+        sys.modules.setdefault(name, mod)
+    sys.modules.setdefault("aiohttp", MagicMock())
+
+
+_ensure_slack_mock()
+
+import plugins.platforms.slack.adapter as _slack_mod  # noqa: E402
+
+_slack_mod.SLACK_AVAILABLE = True
+
+from plugins.platforms.slack.adapter import SlackAdapter  # noqa: E402
+
+from gateway.config import Platform, PlatformConfig  # noqa: E402
+
+
+HUMAN_ID = "U_human"
+
+
+def _make_adapter(extra=None):
+    adapter = object.__new__(SlackAdapter)
+    adapter.platform = Platform.SLACK
+    adapter.config = PlatformConfig(enabled=True, extra=dict(extra or {}))
+    return adapter
+
+
+def _api_post(**overrides):
+    """A user-token chat.postMessage as delivered over Socket Mode:
+    real ``user``, app_id stamp, no ``client_msg_id``."""
+    event = {"type": "message", "user": HUMAN_ID, "app_id": "A_frontend", "text": "hi"}
+    event.update(overrides)
+    return event
+
+
+@pytest.fixture(autouse=True)
+def _clean_env(monkeypatch):
+    monkeypatch.delenv("SLACK_API_HUMAN_USERS", raising=False)
+
+
+def test_api_post_is_bot_by_default():
+    assert _make_adapter()._event_declares_bot_sender(_api_post()) is True
+
+
+def test_allowlisted_user_api_post_is_human():
+    adapter = _make_adapter({"api_human_users": ["U_other", HUMAN_ID]})
+    assert adapter._event_declares_bot_sender(_api_post()) is False
+    # Same predicate everywhere: no other user, and no user-less app post, rides it.
+    assert adapter._event_declares_bot_sender(_api_post(user="U_stranger")) is True
+    assert adapter._event_declares_bot_sender({"app_id": "A_frontend", "text": "hi"}) is True
+
+
+def test_bot_markers_win_over_allowlist():
+    """Allowlisting a user never admits genuine bot posts, so the app's own
+    ``xoxb`` traffic (bot_id / subtype=bot_message) cannot loop back in."""
+    adapter = _make_adapter({"api_human_users": HUMAN_ID})
+    assert adapter._event_declares_bot_sender(_api_post(subtype="bot_message")) is True
+    assert adapter._event_declares_bot_sender(_api_post(bot_id="B_stamp")) is True
diff --git a/tests/gateway/test_slash_command_profile_scope.py b/tests/gateway/test_slash_command_profile_scope.py
new file mode 100644
index 0000000000..5a3dba7397
--- /dev/null
+++ b/tests/gateway/test_slash_command_profile_scope.py
@@ -0,0 +1,94 @@
+"""Gateway slash commands must do their blocking work inside the routed profile.
+
+The multiplexed inbound handler wraps the whole message in
+``_profile_runtime_scope``, which installs the routed profile's ``HERMES_HOME``
+override and its secret scope as **contextvars**. A bare
+``loop.run_in_executor(None, ...)`` starts the worker with an EMPTY context, so
+``SessionDB()`` / ``get_hermes_home()`` inside the worker resolve the LAUNCH
+home — /insights reported the default profile's conversations from another
+profile's chat. ``/compress`` already routes through
+``_run_in_executor_with_context``; every other hop in the mixin must too.
+
+Drives the real mixin methods and the real ``_profile_runtime_scope``: the
+contextvar loss is a property of the hop, so mocking the hop away would test
+nothing.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+
+@pytest.fixture
+def profile_home(tmp_path, monkeypatch):
+    root = tmp_path / ".hermes"
+    home = root / "profiles" / "coder"
+    home.mkdir(parents=True)
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.setenv("HERMES_HOME", str(root))
+    return home
+
+
+@pytest.fixture
+def runner():
+    """Minimal host exposing the mixin plus the runner's executor helpers."""
+    from gateway.run import GatewayRunner
+    from gateway.slash_commands import GatewaySlashCommandsMixin
+
+    class _Runner(GatewaySlashCommandsMixin):
+        _run_in_executor_with_context = GatewayRunner._run_in_executor_with_context
+        _get_executor = GatewayRunner._get_executor
+
+    r = _Runner()
+    r.adapters = {}
+    r._pending_skills_reload_notes = {}
+    return r
+
+
+class _Event:
+    def __init__(self, args: str = ""):
+        self._args = args
+        self.source = None
+
+    def get_command_args(self) -> str:
+        return self._args
+
+
+@pytest.mark.asyncio
+async def test_insights_opens_session_db_under_the_routed_home(
+    runner, profile_home, monkeypatch
+):
+    import agent.insights as insights_mod
+    import hermes_state
+    from gateway.run import _profile_runtime_scope
+    from hermes_constants import get_hermes_home
+
+    seen: dict = {}
+
+    class _RecordingDB:
+        def __init__(self, *a, **kw):
+            seen["home"] = str(get_hermes_home())
+
+        def close(self):
+            pass
+
+    class _Engine:
+        def __init__(self, db):
+            pass
+
+        def generate(self, **kw):
+            return {}
+
+        def format_gateway(self, report):
+            return "ok"
+
+    monkeypatch.setattr(hermes_state, "SessionDB", _RecordingDB)
+    monkeypatch.setattr(insights_mod, "InsightsEngine", _Engine)
+
+    with _profile_runtime_scope(profile_home):
+        result = await runner._handle_insights_command(_Event(""))
+
+    assert result == "ok"
+    assert seen["home"] == str(profile_home)
diff --git a/tests/gateway/test_slash_config_writes_routed_profile.py b/tests/gateway/test_slash_config_writes_routed_profile.py
new file mode 100644
index 0000000000..c1893156f5
--- /dev/null
+++ b/tests/gateway/test_slash_config_writes_routed_profile.py
@@ -0,0 +1,70 @@
+"""Slash-command config writes must land in the routed profile's config.yaml.
+
+Regression for #87939 / #75684: the multiplexed inbound handler already runs
+every slash handler inside ``_profile_runtime_scope`` (routed HERMES_HOME
+override), but several handlers built their write path from the module
+constant ``gateway.run._hermes_home`` — the LAUNCH home — so ``/reasoning
+--global``, ``/fast``, ``/memory approval``, ``/skills approval``, ``/verbose``
+and ``/footer`` persisted into the default profile's config.yaml. They now go
+through ``_gateway_config_home()`` like the reads do.
+"""
+
+from __future__ import annotations
+
+import pytest
+import yaml
+
+import gateway.run as gateway_run
+from gateway.run import GatewayRunner, _profile_runtime_scope
+from gateway.slash_commands import GatewaySlashCommandsMixin
+
+
+class _Runner(GatewaySlashCommandsMixin):
+    _run_in_executor_with_context = GatewayRunner._run_in_executor_with_context
+    _get_executor = GatewayRunner._get_executor
+
+    def _session_key_for_source(self, _source):
+        return "k"
+
+    def _evict_cached_agent(self, _session_key):
+        pass
+
+
+class _Event:
+    def __init__(self, args: str = ""):
+        self._args = args
+        self.source = None
+
+    def get_command_args(self) -> str:
+        return self._args
+
+
+@pytest.fixture
+def homes(tmp_path, monkeypatch):
+    default_home = tmp_path / "default"
+    routed_home = tmp_path / "profiles" / "beta"
+    default_home.mkdir()
+    routed_home.mkdir(parents=True)
+    (default_home / "config.yaml").write_text("agent:\n  reasoning_effort: medium\n")
+    (routed_home / "config.yaml").write_text("agent:\n  reasoning_effort: none\n")
+    monkeypatch.setattr(gateway_run, "_hermes_home", default_home)
+    monkeypatch.setenv("HERMES_HOME", str(default_home))
+    return default_home, routed_home
+
+
+@pytest.mark.asyncio
+async def test_slash_config_writes_hit_routed_profile_and_leave_default_untouched(homes):
+    default_home, routed_home = homes
+    default_before = (default_home / "config.yaml").read_bytes()
+    runner = _Runner()
+
+    with _profile_runtime_scope(routed_home):
+        assert runner._save_gateway_config_key("agent.reasoning_effort", "high")
+        await runner._handle_memory_command(_Event("approval on"))
+        await runner._handle_skills_command(_Event("approval on"))
+
+    routed = yaml.safe_load((routed_home / "config.yaml").read_text())
+    assert routed["agent"]["reasoning_effort"] == "high"
+    assert routed["memory"]["write_approval"] is True
+    assert routed["skills"]["write_approval"] is True
+    assert (default_home / "config.yaml").read_bytes() == default_before
diff --git a/tests/gateway/test_stale_finalize_suppression.py b/tests/gateway/test_stale_finalize_suppression.py
index 15d591c8c9..679e4f7e3e 100644
--- a/tests/gateway/test_stale_finalize_suppression.py
+++ b/tests/gateway/test_stale_finalize_suppression.py
@@ -373,8 +373,23 @@ def _consumer():
 
 
 class TestDeliveredFinalMatches:
-    def test_no_record_returns_none(self):
+    def test_no_record_no_visible_text_returns_false(self):
+        """#95382 tightening: a record-less consumer with no visible match
+        for the final text is a demonstrable non-delivery, not legacy trust."""
         consumer = _consumer()
+        assert consumer.delivered_final_matches("anything") is False
+
+    def test_no_record_but_visible_final_returns_true(self):
+        """Ambiguous-dedup control: visible text equals the final answer."""
+        consumer = _consumer()
+        consumer._already_sent = True
+        consumer._last_sent_text = FULL_RESPONSE
+        assert consumer.delivered_final_matches(FULL_RESPONSE) is True
+
+    def test_no_record_ambiguous_timeout_returns_none(self):
+        """The explicitly-marked ambiguous timeout keeps legacy trust."""
+        consumer = _consumer()
+        consumer._delivery_ambiguous = True
         assert consumer.delivered_final_matches("anything") is None
 
     def test_matching_record_returns_true(self):
diff --git a/tests/gateway/test_telegram_callback_auth_fail_closed.py b/tests/gateway/test_telegram_callback_auth_fail_closed.py
index ee92721e4e..db7d60d2a8 100644
--- a/tests/gateway/test_telegram_callback_auth_fail_closed.py
+++ b/tests/gateway/test_telegram_callback_auth_fail_closed.py
@@ -87,3 +87,46 @@ class TestCallbackAuthFailClosed:
         assert adapter._is_callback_user_authorized("12345") is True
 
 
+class TestCallbackAuthPrefersInjectedCheck:
+    """_is_callback_user_authorized must use the auth callback GatewayRunner
+    injects via set_authorization_check before the _message_handler.__self__
+    introspection.
+
+    A secondary multiplexed adapter's _message_handler is a profile closure
+    (no __self__), so the introspection path resolves to nothing and the old
+    code fell through to the env-only fallback — which knows nothing about
+    profile config allowlists or the pairing store. The injected callback is
+    registered for every gateway-connected adapter, including multiplexed
+    secondaries, and delegates to the full _is_user_authorized chain.
+    """
+
+    def test_injected_check_used_when_handler_is_a_closure(self, monkeypatch):
+        """Multiplexed shape: closure handler (no __self__) + injected check
+        registered → the injected check decides, not the env fallback."""
+        monkeypatch.delenv("TELEGRAM_ALLOWED_USERS", raising=False)
+        monkeypatch.delenv("GATEWAY_ALLOW_ALL_USERS", raising=False)
+        adapter = _make_adapter()
+        adapter._message_handler = lambda *a, **kw: None  # no __self__
+        seen = {}
+
+        def _check(user_id, chat_type=None, chat_id=None):
+            seen.update(user_id=user_id, chat_type=chat_type, chat_id=chat_id)
+            return user_id == "999"
+
+        adapter._authorization_check = _check
+
+        # Env fallback would deny (empty allowlist); the injected check allows.
+        assert adapter._is_callback_user_authorized(
+            "999", chat_id="777", chat_type="supergroup"
+        ) is True
+        assert seen == {"user_id": "999", "chat_type": "group", "chat_id": "777"}
+
+    def test_injected_check_deny_wins_over_env_allowlist(self, monkeypatch):
+        """The injected check is authoritative when registered — an env
+        allowlist entry must not override its deny."""
+        monkeypatch.setenv("TELEGRAM_ALLOWED_USERS", "12345")
+        adapter = _make_adapter()
+        adapter._message_handler = lambda *a, **kw: None
+        adapter._authorization_check = lambda user_id, chat_type=None, chat_id=None: False
+
+        assert adapter._is_callback_user_authorized("12345") is False
diff --git a/tests/gateway/test_telegram_final_delivery.py b/tests/gateway/test_telegram_final_delivery.py
index e5d378dcee..b5c85e73c3 100644
--- a/tests/gateway/test_telegram_final_delivery.py
+++ b/tests/gateway/test_telegram_final_delivery.py
@@ -122,6 +122,33 @@ async def test_empty_tail_commit_honors_retry_after(monkeypatch):
     assert consumer.final_content_delivered is True
 
 
+@pytest.mark.asyncio
+async def test_complete_preview_survives_long_flood_fallback_failure(monkeypatch):
+    """A complete ACKed preview must not trigger a duplicate normal final."""
+    adapter = _adapter()
+    adapter.send.return_value = SendResult(
+        success=False,
+        error="flood_control:20.0",
+        retry_after=20.0,
+    )
+    sleep = AsyncMock()
+    monkeypatch.setattr("gateway.stream_consumer.asyncio.sleep", sleep)
+
+    consumer = GatewayStreamConsumer(adapter, "chat-1")
+    consumer._message_id = "preview-1"
+    consumer._last_sent_text = "Final answer"
+    consumer._already_sent = True
+    consumer._fallback_final_send = True
+
+    await consumer._send_fallback_final("Final answer")
+
+    adapter.send.assert_awaited_once()
+    sleep.assert_not_awaited()
+    assert consumer.final_response_sent is False
+    assert consumer.final_content_delivered is True
+    assert consumer.delivered_final_matches("Final answer") is True
+
+
 @pytest.mark.asyncio
 async def test_telegram_long_flood_result_keeps_retry_after():
     """The real adapter contract preserves the server delay for consumers."""
@@ -139,3 +166,91 @@ async def test_telegram_long_flood_result_keeps_retry_after():
     assert result.retry_after == 30.0
 
 
+
+
+@pytest.mark.asyncio
+async def test_empty_fallback_resend_preserves_reply_anchor():
+    """The fresh-commit resend must carry the turn's reply anchor (#71047).
+
+    With reply_to_mode='first' the streamed preview is delivered as a reply
+    to the user's message. When a failed finalize edit forces the fresh
+    resend, the replacement message must use the same anchor so the visible
+    behavior matches the preview (and the non-streaming path).
+    """
+    adapter = _adapter()
+    adapter.send.return_value = SendResult(success=True, message_id="final-1")
+
+    consumer = GatewayStreamConsumer(
+        adapter, "chat-1", initial_reply_to_id="111",
+    )
+    consumer._message_id = "preview-1"
+    consumer._last_sent_text = "Final answer"
+    consumer._already_sent = True
+    consumer._fallback_final_send = True
+
+    await consumer._send_fallback_final("Final answer")
+
+    adapter.send.assert_awaited_once()
+    kwargs = adapter.send.await_args.kwargs
+    assert kwargs.get("reply_to") == "111"
+    # Preview replaced: deleted after the fresh final succeeded.
+    adapter.delete_message.assert_awaited_once_with("chat-1", "preview-1")
+    assert consumer.final_response_sent is True
+    assert consumer.final_content_delivered is True
+
+
+@pytest.mark.asyncio
+async def test_empty_fallback_preview_delete_retries_once(monkeypatch):
+    """A False (flood-rejected) preview delete gets one bounded retry."""
+    adapter = _adapter()
+    adapter.send.return_value = SendResult(success=True, message_id="final-1")
+    adapter.delete_message = AsyncMock(side_effect=[False, True])
+    sleep = AsyncMock()
+    monkeypatch.setattr("gateway.stream_consumer.asyncio.sleep", sleep)
+
+    consumer = GatewayStreamConsumer(adapter, "chat-1")
+    consumer._message_id = "preview-1"
+    consumer._last_sent_text = "Final answer"
+    consumer._already_sent = True
+    consumer._fallback_final_send = True
+
+    await consumer._send_fallback_final("Final answer")
+
+    assert adapter.delete_message.await_count == 2
+    sleep.assert_awaited_once_with(1.0)
+    assert consumer.final_response_sent is True
+
+
+@pytest.mark.asyncio
+async def test_flood_capped_resend_keeps_single_bubble_reply_first(monkeypatch):
+    """#71047 Problem B end-to-end shape: preview as reply, finalize edit and
+    fresh resend both flood-capped — the gateway suppression decision must
+    keep the complete ACKed preview as the single visible bubble instead of
+    letting the normal final send create a second one.
+    """
+    adapter = _adapter()
+    # Fresh-commit resend flood-capped past the inline retry budget.
+    adapter.send.return_value = SendResult(
+        success=False,
+        error="flood_control:41.0",
+        retry_after=41.0,
+    )
+    sleep = AsyncMock()
+    monkeypatch.setattr("gateway.stream_consumer.asyncio.sleep", sleep)
+
+    consumer = GatewayStreamConsumer(
+        adapter, "chat-1", initial_reply_to_id="111",
+    )
+    consumer._message_id = "preview-1"
+    consumer._last_sent_text = "Final answer"
+    consumer._already_sent = True
+    consumer._fallback_final_send = True
+
+    await consumer._send_fallback_final("Final answer")
+
+    # Preview must NOT be deleted — it is the only copy of the answer.
+    adapter.delete_message.assert_not_awaited()
+    # Mirror the gateway/run.py suppression decision: content delivered and
+    # the recorded payload reconciles, so the normal final send is skipped.
+    assert consumer.final_content_delivered is True
+    assert consumer.delivered_final_matches("Final answer") is True
diff --git a/tests/gateway/test_telegram_topic_profile_isolation_76423.py b/tests/gateway/test_telegram_topic_profile_isolation_76423.py
new file mode 100644
index 0000000000..32d8323335
--- /dev/null
+++ b/tests/gateway/test_telegram_topic_profile_isolation_76423.py
@@ -0,0 +1,118 @@
+"""Issue #76423 — SessionDB: telegram topic tables namespace by profile."""
+
+from __future__ import annotations
+
+import sqlite3
+from pathlib import Path
+
+from hermes_state import SessionDB
+
+
+CHAT = "208214988"
+
+
+def _session(db, sid, profile_name=None):
+    db.create_session(session_id=sid, source="telegram", user_id=CHAT, profile_name=profile_name)
+
+
+def test_legacy_rows_migrate_only_to_default(tmp_path: Path):
+    """v1 shape (no CASCADE, old user index) → v3: rows land in 'default' only."""
+    db_path = tmp_path / "legacy.db"
+    conn = sqlite3.connect(str(db_path))
+    conn.executescript(
+        f"""
+        CREATE TABLE state_meta (key TEXT PRIMARY KEY, value TEXT);
+        INSERT INTO state_meta(key, value) VALUES ('telegram_dm_topic_schema_version', '1');
+        CREATE TABLE sessions (
+            id TEXT PRIMARY KEY, source TEXT, user_id TEXT, model TEXT,
+            model_config TEXT, system_prompt TEXT, parent_session_id TEXT,
+            started_at REAL, ended_at REAL, end_reason TEXT,
+            message_count INTEGER DEFAULT 0, tool_call_count INTEGER DEFAULT 0,
+            input_tokens INTEGER DEFAULT 0, output_tokens INTEGER DEFAULT 0
+        );
+        INSERT INTO sessions(id, source, user_id, started_at)
+            VALUES ('legacy-sess', 'telegram', '{CHAT}', 1.0);
+        CREATE TABLE telegram_dm_topic_mode (
+            chat_id TEXT PRIMARY KEY, user_id TEXT NOT NULL,
+            enabled INTEGER NOT NULL DEFAULT 1,
+            activated_at REAL NOT NULL, updated_at REAL NOT NULL,
+            has_topics_enabled INTEGER, allows_users_to_create_topics INTEGER,
+            capability_checked_at REAL, intro_message_id TEXT, pinned_message_id TEXT
+        );
+        INSERT INTO telegram_dm_topic_mode(chat_id, user_id, enabled, activated_at, updated_at)
+            VALUES ('{CHAT}', '{CHAT}', 1, 1.0, 1.0);
+        CREATE TABLE telegram_dm_topic_bindings (
+            chat_id TEXT NOT NULL, thread_id TEXT NOT NULL, user_id TEXT NOT NULL,
+            session_key TEXT NOT NULL,
+            session_id TEXT NOT NULL REFERENCES sessions(id),
+            managed_mode TEXT NOT NULL DEFAULT 'auto',
+            linked_at REAL NOT NULL, updated_at REAL NOT NULL,
+            PRIMARY KEY (chat_id, thread_id)
+        );
+        CREATE INDEX idx_telegram_dm_topic_bindings_user
+            ON telegram_dm_topic_bindings(user_id, chat_id);
+        INSERT INTO telegram_dm_topic_bindings
+            VALUES ('{CHAT}', '99', '{CHAT}', 'k', 'legacy-sess', 'auto', 1.0, 1.0);
+        """
+    )
+    conn.close()
+
+    db = SessionDB(db_path=db_path)
+    db.apply_telegram_topic_migration()
+    assert db.get_meta("telegram_dm_topic_schema_version") == "3"
+    assert db.is_telegram_topic_mode_enabled(
+        chat_id=CHAT, user_id=CHAT, profile_name="default",
+    )
+    assert not db.is_telegram_topic_mode_enabled(
+        chat_id=CHAT, user_id=CHAT, profile_name="coder",
+    )
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="99", profile_name="default",
+    )["session_id"] == "legacy-sess"
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="99", profile_name="coder",
+    ) is None
+    fk = db._conn.execute("PRAGMA foreign_key_list('telegram_dm_topic_bindings')").fetchall()
+    assert any(row[2] == "sessions" and row[6] == "CASCADE" for row in fk)
+    db.close()
+
+
+def test_mode_and_bindings_isolated_across_profiles(tmp_path: Path):
+    db = SessionDB(db_path=tmp_path / "state.db")
+    _session(db, "sess-a", "alpha")
+    _session(db, "sess-b", "beta")
+
+    db.enable_telegram_topic_mode(chat_id=CHAT, user_id=CHAT, profile_name="alpha")
+    db.enable_telegram_topic_mode(chat_id=CHAT, user_id=CHAT, profile_name="beta")
+    db.disable_telegram_topic_mode(chat_id=CHAT, profile_name="alpha")
+    assert not db.is_telegram_topic_mode_enabled(chat_id=CHAT, user_id=CHAT, profile_name="alpha")
+    assert db.is_telegram_topic_mode_enabled(chat_id=CHAT, user_id=CHAT, profile_name="beta")
+
+    db.bind_telegram_topic(
+        chat_id=CHAT, thread_id="77", user_id=CHAT,
+        session_key="ka", session_id="sess-a", profile_name="alpha",
+    )
+    db.bind_telegram_topic(
+        chat_id=CHAT, thread_id="77", user_id=CHAT,
+        session_key="kb", session_id="sess-b", profile_name="beta",
+    )
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="77", profile_name="alpha",
+    )["session_id"] == "sess-a"
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="77", profile_name="beta",
+    )["session_id"] == "sess-b"
+
+    assert db.delete_telegram_topic_binding(
+        chat_id=CHAT, thread_id="77", profile_name="alpha",
+    ) == 1
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="77", profile_name="alpha",
+    ) is None
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="77", profile_name="beta",
+    ) is not None
+    # Omitted kwarg == the single-profile "default" namespace, not a wildcard.
+    assert not db.is_telegram_topic_mode_enabled(chat_id=CHAT, user_id=CHAT)
+    assert db.get_telegram_topic_binding(chat_id=CHAT, thread_id="77") is None
+    db.close()
diff --git a/tests/gateway/test_telegram_topic_profile_routing_76423.py b/tests/gateway/test_telegram_topic_profile_routing_76423.py
new file mode 100644
index 0000000000..9f9f16e1ac
--- /dev/null
+++ b/tests/gateway/test_telegram_topic_profile_routing_76423.py
@@ -0,0 +1,93 @@
+"""Issue #76423 — Gateway routes source.profile into telegram topic state."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+
+from hermes_state import SessionDB
+from gateway.config import Platform
+from gateway.session import SessionSource
+
+
+CHAT = "208214988"
+
+
+def _source(profile=None, thread_id="42"):
+    return SessionSource(
+        platform=Platform.TELEGRAM,
+        user_id=CHAT,
+        chat_id=CHAT,
+        user_name="tester",
+        chat_type="dm",
+        thread_id=thread_id,
+        profile=profile,
+    )
+
+
+def test_gateway_uses_source_profile_not_global(tmp_path: Path):
+    from gateway.run import GatewayRunner
+
+    assert GatewayRunner._telegram_topic_profile_name(_source("coder")) == "coder"
+    assert GatewayRunner._telegram_topic_profile_name(_source(None)) == "default"
+
+    db = SessionDB(db_path=tmp_path / "state.db")
+    db.create_session(session_id="sess-coder", source="telegram", user_id=CHAT, profile_name="coder")
+    db.enable_telegram_topic_mode(chat_id=CHAT, user_id=CHAT, profile_name="coder")
+
+    runner = object.__new__(GatewayRunner)
+    runner._session_db = db
+    assert runner._telegram_topic_mode_enabled(_source("coder")) is True
+    assert runner._telegram_topic_mode_enabled(_source("other")) is False
+    assert runner._telegram_topic_mode_enabled(_source(None)) is False
+
+    runner._record_telegram_topic_binding(
+        _source("coder", "42"),
+        SimpleNamespace(session_key="k", session_id="sess-coder"),
+    )
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="42", profile_name="coder",
+    ) is not None
+    assert db.get_telegram_topic_binding(
+        chat_id=CHAT, thread_id="42", profile_name="default",
+    ) is None
+    db.close()
+
+
+def test_routed_profile_flows_into_prune_via_send_metadata(tmp_path: Path):
+    """profile_routes: the transport adapter may be the primary (default) bot
+    while the turn is routed to another profile — the outbound metadata built
+    by the gateway carries the routed profile, and prune uses it over the
+    adapter's own stamp (#76423)."""
+    from gateway.run import GatewayRunner
+    from plugins.platforms.telegram.adapter import TelegramAdapter
+
+    runner = object.__new__(GatewayRunner)
+    runner._thread_metadata_for_target = lambda *a, **k: {"thread_id": "99"}
+    meta = runner._thread_metadata_for_source(_source("coder", "99"))
+    assert meta["hermes_profile"] == "coder"
+    assert "hermes_profile" not in runner._thread_metadata_for_source(_source(None, "99"))
+
+    # Cooldowns are keyed (profile, chat): alpha's reminder must not gag beta.
+    assert runner._should_send_telegram_lobby_reminder(_source("alpha")) is True
+    assert runner._should_send_telegram_lobby_reminder(_source("beta")) is True
+    assert runner._should_send_telegram_lobby_reminder(_source("alpha")) is False
+
+    db = SessionDB(db_path=tmp_path / "state.db")
+    db.create_session(session_id="sess-default", source="telegram", user_id=CHAT)
+    db.create_session(session_id="sess-coder", source="telegram", user_id=CHAT, profile_name="coder")
+    for prof, sid in (("default", "sess-default"), ("coder", "sess-coder")):
+        db.bind_telegram_topic(
+            chat_id=CHAT, thread_id="99", user_id=CHAT,
+            session_key=f"k-{prof}", session_id=sid, profile_name=prof,
+        )
+
+    adapter = object.__new__(TelegramAdapter)
+    adapter.platform = Platform.TELEGRAM
+    adapter._session_store = SimpleNamespace(_db=db)
+    adapter._hermes_profile_name = "default"  # transport = primary bot
+    adapter._prune_stale_dm_topic_binding(CHAT, "99", metadata=meta)
+
+    assert db.get_telegram_topic_binding(chat_id=CHAT, thread_id="99", profile_name="coder") is None
+    assert db.get_telegram_topic_binding(chat_id=CHAT, thread_id="99", profile_name="default") is not None
+    db.close()
diff --git a/tests/gateway/test_turn_request_overrides.py b/tests/gateway/test_turn_request_overrides.py
index c985125176..bd5da602d8 100644
--- a/tests/gateway/test_turn_request_overrides.py
+++ b/tests/gateway/test_turn_request_overrides.py
@@ -53,7 +53,7 @@ def test_provider_request_overrides_merged_under_fast_mode(monkeypatch):
     """/fast active: provider extra_body AND the service-tier marker both survive."""
     monkeypatch.setattr(
         "hermes_cli.models.resolve_fast_mode_overrides",
-        lambda model_id: {"service_tier": "priority"},
+        lambda model_id, **_route: {"service_tier": "priority"},
     )
     runner = _runner(service_tier="priority")
     rk = _runtime_kwargs(request_overrides=PROVIDER_OVERRIDES)
diff --git a/tests/gateway/test_voice_mode_platform_isolation.py b/tests/gateway/test_voice_mode_platform_isolation.py
index 68485ee14c..799029911f 100644
--- a/tests/gateway/test_voice_mode_platform_isolation.py
+++ b/tests/gateway/test_voice_mode_platform_isolation.py
@@ -9,7 +9,9 @@ same key. The fix prefixes keys with platform value: 'telegram:123' vs
 import json
 import tempfile
 from pathlib import Path
-from unittest.mock import MagicMock, patch
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
 
 
 from gateway.config import Platform
@@ -115,6 +117,88 @@ class TestSyncVoiceModeStateToAdapter:
         assert mock_adapter._auto_tts_disabled_chats == {"123"}
 
 
+class TestVoiceModeProfileIsolation:
+    """Two multiplexed bots in one Discord channel keep independent /voice
+    state and voice transcripts dispatch through the bot that heard them
+    (#75198 voice half)."""
+
+    @staticmethod
+    def _discord_adapter(owner=None):
+        from unittest.mock import AsyncMock
+
+        a = MagicMock()
+        a.platform = Platform.DISCORD
+        a._owner_profile = owner
+        a._voice_text_channels = {111: 123}
+        a._voice_sources = {}
+        a._voice_input_callback = None
+        a._on_voice_disconnect = None
+        a._voice_mode_getter = None
+        a._auto_tts_enabled_chats = set()
+        a._auto_tts_disabled_chats = set()
+        a._client = MagicMock()
+        a._client.get_channel = MagicMock(return_value=None)
+        a.handle_message = AsyncMock()
+        return a
+
+    @pytest.mark.asyncio
+    async def test_voice_state_and_transcripts_stay_with_the_owning_bot(self, tmp_path):
+        from types import SimpleNamespace
+
+        from gateway.platforms.base import MessageEvent, MessageType, SessionSource
+
+        runner = _make_runner()
+        runner._VOICE_MODE_PATH = tmp_path / "voice.json"
+        runner._is_user_authorized = lambda source: True
+        default_ad = self._discord_adapter()
+        bot2_ad = self._discord_adapter(owner="bot2")
+        runner.adapters = {Platform.DISCORD: default_ad}
+        runner._profile_adapters = {"bot2": {Platform.DISCORD: bot2_ad}}
+        # Inbound event from bot2's transport in channel 123 (same id the
+        # default bot also sees).
+        src = SessionSource(platform=Platform.DISCORD, chat_id="123", user_id="u1",
+                            chat_type="channel", profile="bot2")
+        src._transport_adapter_ref = lambda: bot2_ad
+
+        await runner._handle_voice_command(
+            MessageEvent(text="/voice tts", message_type=MessageType.TEXT, source=src)
+        )
+        assert runner._voice_mode == {"bot2:discord:123": "all"}
+        assert "123" in bot2_ad._auto_tts_enabled_chats
+        assert "123" not in default_ad._auto_tts_enabled_chats
+
+        # A transcript captured by bot2's adapter runs through bot2, not default.
+        runner._bind_voice_input_callback(bot2_ad)
+        await bot2_ad._voice_input_callback(guild_id=111, user_id=42, transcript="hi")
+        bot2_ad.handle_message.assert_awaited_once()
+        default_ad.handle_message.assert_not_awaited()
+        assert bot2_ad.handle_message.call_args[0][0].source.profile == "bot2"
+
+        # Timeout cleanup from bot2's channel disables bot2's auto-TTS only.
+        join = MessageEvent(text="/voice channel", message_type=MessageType.TEXT, source=src)
+        join.raw_message = SimpleNamespace(guild_id=111, guild=None)
+        bot2_ad.join_voice_channel = AsyncMock(return_value=True)
+        ch = MagicMock(); ch.name = "General"
+        bot2_ad.get_user_voice_channel = AsyncMock(return_value=ch)
+        await runner._handle_voice_channel_join(join)
+        bot2_ad._on_voice_disconnect("123")
+        assert runner._voice_mode["bot2:discord:123"] == "off"
+        assert "123" in bot2_ad._auto_tts_disabled_chats
+        assert "123" not in default_ad._auto_tts_disabled_chats
+
+    def test_sync_restores_only_the_owning_profiles_chats(self):
+        runner = _make_runner()
+        runner._voice_mode = {"discord:1": "all", "bot2:discord:2": "all"}
+        default_ad = MagicMock(); default_ad.platform = Platform.DISCORD
+        default_ad._owner_profile = None; default_ad._auto_tts_enabled_chats = set()
+        bot2_ad = MagicMock(); bot2_ad.platform = Platform.DISCORD
+        bot2_ad._owner_profile = "bot2"; bot2_ad._auto_tts_enabled_chats = set()
+        runner._sync_voice_mode_state_to_adapter(default_ad)
+        runner._sync_voice_mode_state_to_adapter(bot2_ad)
+        assert default_ad._auto_tts_enabled_chats == {"1"}
+        assert bot2_ad._auto_tts_enabled_chats == {"2"}
+
+
 # ---------------------------------------------------------------------------
 # Helper
 # ---------------------------------------------------------------------------
diff --git a/tests/gateway/test_webhook_adapter.py b/tests/gateway/test_webhook_adapter.py
index 4f5cdb1390..7ea8e8acde 100644
--- a/tests/gateway/test_webhook_adapter.py
+++ b/tests/gateway/test_webhook_adapter.py
@@ -1011,6 +1011,63 @@ class TestMultiplexProfileWebhookAuthentication:
             )
             assert default_profile.status == 404
 
+    @pytest.mark.asyncio
+    async def test_routed_profile_skills_resolve_under_that_profile(
+        self, tmp_path, monkeypatch
+    ):
+        """A /p/<profile>/ route's ``skills:`` must load from that profile's
+        skills/ dir (#67277). Before the fix the lookup ran with no profile
+        scope, so it scanned the launch profile and logged "Skill not found".
+        """
+        import agent.skill_commands as sc_mod
+
+        worker = tmp_path / "profiles" / "worker"
+        skill_dir = worker / "skills" / "worker-only"
+        skill_dir.mkdir(parents=True)
+        (skill_dir / "SKILL.md").write_text(
+            "---\nname: worker-only\ndescription: w\n---\n\nBody of worker-only.\n"
+        )
+        (worker / "config.yaml").write_text("{}\n")
+        (worker / ".env").write_text("")
+        monkeypatch.setattr(
+            "hermes_cli.profiles.get_profile_dir", lambda name: tmp_path / "profiles" / name
+        )
+        route_secret = "worker-route-secret-abc123"
+        adapter = _make_adapter(
+            routes={
+                "gh": {
+                    "profile": "worker",
+                    "secret": route_secret,
+                    "prompt": "PR: {action}",
+                    "skills": ["worker-only"],
+                }
+            },
+            host="127.0.0.1",
+        )
+        self._configure_profiles(adapter, tmp_path, monkeypatch)
+        seen = []
+
+        async def _capture(event):
+            seen.append(event)
+
+        adapter.handle_message = _capture
+        body = b'{"action":"opened"}'
+        headers = {
+            "Content-Type": "application/json",
+            "X-Hub-Signature-256": _github_signature(body, route_secret),
+        }
+        with (
+            patch.object(sc_mod, "_skill_commands", {}),
+            patch.object(sc_mod, "_skill_commands_home", None),
+        ):
+            async with TestClient(TestServer(self._app(adapter))) as cli:
+                resp = await cli.post("/p/worker/webhooks/gh", data=body, headers=headers)
+                assert resp.status == 202
+                await asyncio.sleep(0.05)
+        assert len(seen) == 1
+        assert seen[0].source.profile == "worker"
+        assert "Body of worker-only." in seen[0].text
+
 
 def test_route_profile_validation_fails_closed():
     assert WebhookAdapter._route_allows_profile({}, None) is True
diff --git a/tests/gateway/test_wecom.py b/tests/gateway/test_wecom.py
index a46a1caded..96886df995 100644
--- a/tests/gateway/test_wecom.py
+++ b/tests/gateway/test_wecom.py
@@ -76,6 +76,40 @@ class TestWeComAdapterAuthzScope:
         assert adapter._dm_policy == "pairing"
         assert adapter._allow_from == []
 
+    def test_scoped_construction_reads_bot_id_from_scope_not_environ(self, multiplex_on, monkeypatch):
+        """bot_id must honor the same scope as its neighboring _secret read
+        (both are read on adjacent lines in __init__) -- a secondary profile's
+        own bot_id must never fall back to the default profile's os.environ
+        value."""
+        from agent import secret_scope
+        from plugins.platforms.wecom.adapter import WeComAdapter
+
+        monkeypatch.setenv("WECOM_BOT_ID", "default-profile-bot-id")
+        monkeypatch.setenv("WECOM_SECRET", "default-profile-secret")
+        token = secret_scope.set_secret_scope(
+            {"WECOM_BOT_ID": "scoped-bot-id", "WECOM_SECRET": "scoped-secret"}
+        )
+        try:
+            adapter = WeComAdapter(PlatformConfig(enabled=True))
+        finally:
+            secret_scope.reset_secret_scope(token)
+        assert adapter._bot_id == "scoped-bot-id"
+        assert adapter._secret == "scoped-secret"
+
+    def test_scoped_miss_does_not_leak_default_profiles_bot_id(self, multiplex_on, monkeypatch):
+        from agent import secret_scope
+        from plugins.platforms.wecom.adapter import DEFAULT_WS_URL, WeComAdapter
+
+        monkeypatch.setenv("WECOM_BOT_ID", "default-profile-bot-id")
+        monkeypatch.setenv("WECOM_WEBSOCKET_URL", "wss://default-profile.example/ws")
+        token = secret_scope.set_secret_scope({"SOMETHING_ELSE": "x"})
+        try:
+            adapter = WeComAdapter(PlatformConfig(enabled=True))
+        finally:
+            secret_scope.reset_secret_scope(token)
+        assert adapter._bot_id == ""
+        assert adapter._ws_url == DEFAULT_WS_URL
+
 
 class TestWeComConnect:
 
diff --git a/tests/hermes_cli/test_alibaba_coding_plan_cn_provider_listing.py b/tests/hermes_cli/test_alibaba_coding_plan_cn_provider_listing.py
new file mode 100644
index 0000000000..6dc59e3338
--- /dev/null
+++ b/tests/hermes_cli/test_alibaba_coding_plan_cn_provider_listing.py
@@ -0,0 +1,30 @@
+"""alibaba-coding-plan and alibaba-coding-plan-cn must not both appear in the
+/model picker off a single shared key (#101122).
+
+The CN profile now has its own ALIBABA_CODING_PLAN_CN_API_KEY (checked first),
+keeping the shared ALIBABA_CODING_PLAN_API_KEY / DASHSCOPE_API_KEY as ordered
+fallbacks so existing CN users are not broken.  The picker hides a ``-cn`` row
+whose only lit vars are shared with a lit non-CN sibling row.
+"""
+
+import os
+from unittest.mock import patch
+
+from hermes_cli.model_switch import list_authenticated_providers
+
+_CLEAR = {k: "" for k in ("ALIBABA_CODING_PLAN_API_KEY", "ALIBABA_CODING_PLAN_CN_API_KEY", "DASHSCOPE_API_KEY")}
+
+
+def _alibaba_slugs(current_provider=""):
+    return [p["slug"] for p in list_authenticated_providers(current_provider=current_provider) if "coding-plan" in p["slug"]]
+
+
+@patch.dict(os.environ, {**_CLEAR, "ALIBABA_CODING_PLAN_CN_API_KEY": "sk-cn-fake"}, clear=False)
+def test_alibaba_cn_appears_when_only_cn_key_set():
+    assert _alibaba_slugs() == ["alibaba-coding-plan-cn"]
+
+
+@patch.dict(os.environ, {**_CLEAR, "ALIBABA_CODING_PLAN_API_KEY": "sk-intl-fake"}, clear=False)
+def test_alibaba_cn_does_not_appear_when_only_intl_key_set():
+    """#101122: the shared intl key alone must light only the intl row."""
+    assert _alibaba_slugs() == ["alibaba-coding-plan"]
diff --git a/tests/hermes_cli/test_backup.py b/tests/hermes_cli/test_backup.py
index f0e8e52e4d..aa4c80056b 100644
--- a/tests/hermes_cli/test_backup.py
+++ b/tests/hermes_cli/test_backup.py
@@ -158,6 +158,94 @@ class TestShouldExclude:
         # The .db itself is still included (and safe-copied separately)
         assert not _should_exclude(Path("state.db"))
 
+    def test_excludes_managed_runtime_trees_at_root(self):
+        """models/, runtimes/, and node/ at a profile-home root hold
+        re-downloadable GGUF weights and runtime binaries that reach
+        hundreds of GB — zipping them is the 20-minute-hang symptom."""
+        from hermes_cli.backup import _should_exclude
+        assert _should_exclude(Path("models/Qwen3.6-27B-Q4_K_M.gguf"))
+        assert _should_exclude(Path("models/assets/mmproj.gguf"))
+        assert _should_exclude(Path("runtimes/llamacpp/b10362/cuda/ggml-cuda.dll"))
+        assert _should_exclude(Path("node/node.exe"))
+        # Named profiles download their own copies.
+        assert _should_exclude(Path("profiles/clean/models/big.gguf"))
+        assert _should_exclude(Path("profiles/clean/runtimes/llamacpp/x.dll"))
+
+    def test_keeps_nested_dirs_named_like_runtime_trees(self):
+        """A deeper directory that happens to be called models/ or node/ is
+        user data (a skill's assets, project files) and must survive."""
+        from hermes_cli.backup import _should_exclude
+        assert not _should_exclude(Path("skills/mlops/models/notes.md"))
+        assert not _should_exclude(Path("scratch/node/index.js"))
+        assert not _should_exclude(Path("profiles/clean/skills/x/models/a.txt"))
+
+    def test_excludes_desktop_emergency_state_db_baks(self):
+        """The desktop updater's pre-flight drops timestamped
+        state.db.pre-update-emergency-*.bak files at the HERMES_HOME root —
+        backup artifacts in the same class as backups/, so a full backup
+        must not re-ship them."""
+        from hermes_cli.backup import _should_exclude
+        assert _should_exclude(
+            Path("state.db.pre-update-emergency-2026-08-15T04-55-33-619Z.bak")
+        )
+        assert _should_exclude(
+            Path("profiles/coder/state.db.pre-update-emergency-2026-08-15T04-55-33-619Z.bak")
+        )
+        # Other .bak files are user data and stay.
+        assert not _should_exclude(Path("config.yaml.bak"))
+
+
+# ---------------------------------------------------------------------------
+# _iter_backup_files tests
+# ---------------------------------------------------------------------------
+
+class TestIterBackupFiles:
+    def test_manual_and_automatic_paths_share_one_walk(self, tmp_path):
+        """Both backup entry points must select the identical file set.
+
+        Before the walks were unified, the automatic pre-update path pruned
+        ``hermes-agent`` at ANY depth, silently dropping nested skill dirs
+        like ``skills/autonomous-ai-agents/hermes-agent/`` that the manual
+        path preserved. One shared iterator makes that drift impossible;
+        this test pins the contract."""
+        from hermes_cli.backup import _iter_backup_files
+
+        root = tmp_path / ".hermes"
+        root.mkdir()
+        _make_hermes_tree(root)
+
+        # The case the old automatic walk got wrong: a nested dir named
+        # hermes-agent holding real skill content.
+        nested = root / "skills" / "autonomous-ai-agents" / "hermes-agent"
+        nested.mkdir(parents=True)
+        (nested / "SKILL.md").write_text("# nested skill\n")
+
+        # A root-level managed runtime tree that both paths must prune.
+        (root / "models").mkdir()
+        (root / "models" / "big.gguf").write_bytes(b"\x00" * 64)
+
+        out_path = tmp_path / "out.zip"
+        selected = {str(rel) for _, rel in _iter_backup_files(root, out_path)}
+
+        rel_nested = str(Path("skills/autonomous-ai-agents/hermes-agent/SKILL.md"))
+        assert rel_nested in selected
+        assert str(Path("models/big.gguf")) not in selected
+        assert not any(s.startswith("hermes-agent") for s in selected)
+
+    def test_skipped_dirs_collected_for_summary(self, tmp_path):
+        from hermes_cli.backup import _iter_backup_files
+
+        root = tmp_path / ".hermes"
+        root.mkdir()
+        _make_hermes_tree(root)
+        (root / "models").mkdir()
+        (root / "models" / "big.gguf").write_bytes(b"\x00")
+
+        skipped: set = set()
+        list(_iter_backup_files(root, tmp_path / "out.zip", skipped))
+        assert "models" in skipped
+        assert "hermes-agent" in skipped
+
 
 # ---------------------------------------------------------------------------
 # Backup tests
diff --git a/tests/hermes_cli/test_boot_preset_staleness.py b/tests/hermes_cli/test_boot_preset_staleness.py
new file mode 100644
index 0000000000..fd7256c8bf
--- /dev/null
+++ b/tests/hermes_cli/test_boot_preset_staleness.py
@@ -0,0 +1,126 @@
+"""Every staged model must launch with a policy decision, never stock fit.
+
+The managed server autoloads any GGUF in its models dir; a model missing
+from the preset INI loads with llama-server defaults (f16 KV at max
+context, no placement) — on Windows/WDDM that silently demotes VRAM and
+decodes at a crawl. Boot must therefore refuse to adopt a running server
+whose presets predate the staged set."""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    return home
+
+
+def _stage(home, name):
+    mdir = home / "models"
+    mdir.mkdir(parents=True, exist_ok=True)
+    (mdir / f"{name}.gguf").write_bytes(b"GGUF" + b"\x00" * 32)
+
+
+def _write_presets(home, *model_ids):
+    pdir = home / "runtimes" / "llamacpp"
+    pdir.mkdir(parents=True, exist_ok=True)
+    body = "\n".join(f"[{m}]\nctx-size = 65536\n" for m in model_ids)
+    (pdir / "presets.ini").write_text(body, encoding="utf-8")
+
+
+def test_presets_stale_when_a_staged_model_has_no_section(hermes_home):
+    from hermes_cli.local_runtime.bootstrap import _presets_stale
+
+    _stage(hermes_home, "model-a")
+    _stage(hermes_home, "model-b")
+    _write_presets(hermes_home, "model-a")
+    assert _presets_stale() is True
+
+
+def test_presets_current_when_every_staged_model_is_covered(hermes_home):
+    from hermes_cli.local_runtime.bootstrap import _presets_stale
+
+    _stage(hermes_home, "model-a")
+    _write_presets(hermes_home, "model-a")
+    assert _presets_stale() is False
+
+
+def test_no_models_is_never_stale(hermes_home):
+    from hermes_cli.local_runtime.bootstrap import _presets_stale
+
+    _write_presets(hermes_home, "model-a")
+    assert _presets_stale() is False
+
+
+def test_boot_replaces_incumbent_with_stale_presets(hermes_home, monkeypatch):
+    """ensure_local_runtime must not adopt a running server whose presets
+    miss a staged model — it stops it and boots fresh (boot itself is
+    stubbed; the contract under test is the adopt/replace decision)."""
+    import hermes_cli.local_runtime.bootstrap as boot
+
+    _stage(hermes_home, "model-a")
+    _stage(hermes_home, "model-b")
+    _write_presets(hermes_home, "model-a")
+
+    stopped = {}
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.endpoint._state_endpoint",
+        lambda: {"base_url": "http://127.0.0.1:18434/v1", "pid": 12345})
+    monkeypatch.setattr(boot, "_stop_state_server",
+                        lambda state: stopped.setdefault("pid", state["pid"]))
+
+    sentinel = object()
+
+    def fake_boot(*a, **k):
+        raise _BootReached()
+
+    class _BootReached(Exception):
+        pass
+
+    # Fail fast once boot proper begins — reaching it IS the assertion.
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed", fake_boot)
+
+    result = boot.ensure_local_runtime({"local_runtime": {"enabled": True}})
+    assert stopped.get("pid") == 12345, "stale incumbent was not stopped"
+    # Boot proceeded past adoption (our fake raised inside the try block,
+    # which ensure_local_runtime swallows into a None return).
+    assert result is None or result is sentinel
+
+
+def test_refresh_bounces_an_adopted_server(hermes_home, monkeypatch):
+    """refresh_local_runtime with no in-process supervisor but a running
+    state-file server (the post-restart shape) must stop that server and
+    boot fresh — NOT silently no-op. Regression: the no-op meant every
+    download/delete after a backend restart left the router serving a
+    stale model catalog, and picking the new model failed with
+    'not found in this provider's model listing'."""
+    import hermes_cli.local_runtime.bootstrap as boot
+
+    stopped = {}
+    monkeypatch.setattr(boot, "_SUPERVISOR", None)
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.endpoint._state_endpoint",
+        lambda: {"base_url": "http://127.0.0.1:18434/v1", "pid": 4242})
+    monkeypatch.setattr(boot, "_stop_state_server",
+                        lambda state: stopped.setdefault("pid", state["pid"]))
+    booted = {}
+    monkeypatch.setattr(boot, "ensure_local_runtime",
+                        lambda cfg, force=False: booted.setdefault("force", force) or object())
+
+    assert boot.refresh_local_runtime() is True
+    assert stopped.get("pid") == 4242, "adopted server was not stopped"
+    assert booted.get("force") is True, "fresh boot did not follow the stop"
+
+
+def test_refresh_no_server_anywhere_is_a_noop(hermes_home, monkeypatch):
+    import hermes_cli.local_runtime.bootstrap as boot
+
+    monkeypatch.setattr(boot, "_SUPERVISOR", None)
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.endpoint._state_endpoint", lambda: None)
+    assert boot.refresh_local_runtime() is False
diff --git a/tests/hermes_cli/test_budget_source.py b/tests/hermes_cli/test_budget_source.py
new file mode 100644
index 0000000000..744997f2be
--- /dev/null
+++ b/tests/hermes_cli/test_budget_source.py
@@ -0,0 +1,51 @@
+"""Launch and growth decisions must price against CAPACITY, not live-free
+VRAM. Both execute through a server bounce — the outgoing instance's memory
+is freed before the new one loads — so a probe that reads the predecessor's
+(or the grown model's own) residency as 'gone' vetoes configurations that
+genuinely fit. Symptom when this regresses: a model the pane promised
+'144K on GPU' launches with its weights pinned to CPU and single-digit
+tokens/s while the card sits 60% empty."""
+
+from __future__ import annotations
+
+import ast
+import inspect
+
+
+def _planning_probe_calls(source: str) -> list[bool]:
+    """Every probe_budget(...) call's planning= value in the source."""
+    tree = ast.parse(source)
+    out = []
+    for node in ast.walk(tree):
+        if (isinstance(node, ast.Call)
+                and getattr(node.func, "id", getattr(node.func, "attr", ""))
+                == "probe_budget"):
+            planning = any(
+                kw.arg == "planning"
+                and isinstance(kw.value, ast.Constant)
+                and kw.value.value is True
+                for kw in node.keywords)
+            out.append(planning)
+    return out
+
+
+def test_bootstrap_presets_price_against_capacity():
+    import hermes_cli.local_runtime.bootstrap as bootstrap
+
+    calls = _planning_probe_calls(inspect.getsource(bootstrap))
+    assert calls, "bootstrap no longer probes a budget? update this test"
+    assert all(calls), (
+        "bootstrap prices launch decisions against live-free VRAM; a "
+        "restart/refresh probes while the outgoing server still holds the "
+        "card, pinning fitting models to CPU")
+
+
+def test_growth_refit_prices_against_capacity():
+    import hermes_cli.local_runtime.growth as growth
+
+    calls = _planning_probe_calls(inspect.getsource(growth))
+    assert calls, "growth no longer probes a budget? update this test"
+    assert all(calls), (
+        "growth re-fits against live-free VRAM; the grown model's own "
+        "residency reads as unavailable and vetoes rungs that fit the "
+        "post-bounce card")
diff --git a/tests/hermes_cli/test_catalog_json.py b/tests/hermes_cli/test_catalog_json.py
new file mode 100644
index 0000000000..9aa8973b10
--- /dev/null
+++ b/tests/hermes_cli/test_catalog_json.py
@@ -0,0 +1,118 @@
+"""The pulled catalog: packaged JSON is the offline truth, a GitHub fetch
+swaps entries in memory only, and min_engine gates day-0 models.
+
+Nothing here touches disk beyond the packaged file — the design constraint
+is that a git checkout must never see a dirty tracked catalog.json."""
+
+from __future__ import annotations
+
+import dataclasses
+import io
+import json
+import urllib.request
+
+import pytest
+
+import hermes_cli.local_runtime.catalog as cat
+
+
+@pytest.fixture(autouse=True)
+def _reset_refresh_state(monkeypatch):
+    """Each test starts outside the TTL window with the packaged catalog."""
+    monkeypatch.setattr(cat, "_last_refresh_attempt", 0.0)
+    packaged = cat._packaged_catalog()
+    monkeypatch.setattr(cat, "CATALOG", packaged)
+    yield
+
+
+def _doc_from(entries):
+    """A fetchable catalog document built by mutating the packaged JSON."""
+    from importlib.resources import files
+
+    doc = json.loads(files("hermes_cli.local_runtime")
+                     .joinpath("catalog.json").read_text(encoding="utf-8"))
+    doc["models"] = entries(doc["models"])
+    return doc
+
+
+def _fetch_returns(monkeypatch, doc):
+    body = json.dumps(doc).encode()
+
+    class R(io.BytesIO):
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr(urllib.request, "urlopen",
+                        lambda *a, **k: R(body))
+
+
+def test_packaged_json_round_trips_the_catalog():
+    """The packaged JSON must produce a complete, selection-ready catalog:
+    every entry carries estimator inputs and at least one variant, and the
+    known invariants (best-first ordering, Q4 floor) hold — the same
+    contract the literals obeyed."""
+    assert len(cat.CATALOG) >= 4
+    for e in cat.CATALOG:
+        assert e.variants and e.n_ctx_train > 0 and e.per_layer_f16 >= 0
+        sizes = [v.size_bytes for v in e.variants]
+        assert sizes == sorted(sizes, reverse=True), f"{e.id} not best-first"
+
+
+def test_refresh_swaps_in_memory_only(monkeypatch, tmp_path):
+    """A fetched catalog replaces CATALOG in memory; the packaged file on
+    disk is untouched (checkout stays clean)."""
+    from importlib.resources import files
+
+    packaged_path = files("hermes_cli.local_runtime").joinpath("catalog.json")
+    before = packaged_path.read_text(encoding="utf-8")
+
+    def add_day0(models):
+        day0 = dict(models[0])
+        day0.update(id="day0-model", display_name="Day 0",
+                    description="new", min_engine="b99999")
+        return models + [day0]
+
+    _fetch_returns(monkeypatch, _doc_from(add_day0))
+    assert cat.refresh_catalog(force=True) is True
+    assert "day0-model" in {e.id for e in cat.CATALOG}
+    assert cat.catalog_by_id()["day0-model"].min_engine == "b99999"
+    assert packaged_path.read_text(encoding="utf-8") == before
+
+
+def test_refresh_failure_keeps_current_catalog(monkeypatch):
+    def boom(*a, **k):
+        raise OSError("offline")
+
+    monkeypatch.setattr(urllib.request, "urlopen", boom)
+    ids_before = [e.id for e in cat.CATALOG]
+    assert cat.refresh_catalog(force=True) is False
+    assert [e.id for e in cat.CATALOG] == ids_before
+
+
+def test_refresh_rejects_wrong_schema(monkeypatch):
+    doc = _doc_from(lambda m: m)
+    doc["schema_version"] = 2
+    _fetch_returns(monkeypatch, doc)
+    ids_before = [e.id for e in cat.CATALOG]
+    assert cat.refresh_catalog(force=True) is False
+    assert [e.id for e in cat.CATALOG] == ids_before
+
+
+def test_loader_ignores_unknown_fields():
+    doc = _doc_from(lambda m: m)
+    doc["models"][0]["future_field"] = {"anything": True}
+    entries = cat._load_catalog(doc)
+    assert entries[0].id == doc["models"][0]["id"]
+
+
+def test_min_engine_gate(monkeypatch):
+    from hermes_cli.web_routers.local_models import _engine_too_old
+
+    monkeypatch.setattr("hermes_cli.local_runtime.binaries.installed_tags",
+                        lambda: ["b10362"])
+    assert _engine_too_old("") is False, "no requirement, no gate"
+    assert _engine_too_old("b10000") is False, "installed engine suffices"
+    assert _engine_too_old("b10363") is True, "newer requirement gates"
diff --git a/tests/hermes_cli/test_catalog_reachability.py b/tests/hermes_cli/test_catalog_reachability.py
new file mode 100644
index 0000000000..1b7fa5b991
--- /dev/null
+++ b/tests/hermes_cli/test_catalog_reachability.py
@@ -0,0 +1,59 @@
+"""Catalog reachability: every entry's repo and files must exist upstream.
+
+Existence is the contract; SIZES are advisory (they feed the estimator and
+progress bars, and downloads deliberately tolerate a stale size when
+upstream re-uploads — completeness is judged against the server's own
+declared length, never the catalog). Size drift prints as a warning so a
+catalog refresh can be batched deliberately; only a MISSING file or repo
+fails.
+
+Network-marked (skipped in hermetic CI unless explicitly enabled) — this is
+the test that catches wrong repo names (the Nemotron 401) and moved files.
+Run before any catalog commit:
+
+    HERMES_TEST_NETWORK=1 scripts/run_tests.sh tests/hermes_cli/test_catalog_reachability.py
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.request
+
+import pytest
+
+pytestmark = pytest.mark.skipif(
+    not os.environ.get("HERMES_TEST_NETWORK"),
+    reason="network test; set HERMES_TEST_NETWORK=1 to run",
+)
+
+
+def test_every_catalog_file_resolves():
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    problems = []
+    drift = []
+    for entry in CATALOG:
+        url = f"https://huggingface.co/api/models/{entry.repo}/tree/main?recursive=true"
+        try:
+            with urllib.request.urlopen(url, timeout=30) as r:
+                files = {f["path"]: f.get("size") for f in json.load(r)}
+        except Exception as exc:  # noqa: BLE001
+            problems.append(f"{entry.id}: repo {entry.repo} unreachable ({exc})")
+            continue
+        for variant in entry.variants:
+            for asset in entry.download_files(variant):
+                if asset.path not in files:
+                    problems.append(
+                        f"{entry.id}/{variant.quant}: {asset.path} not in {entry.repo}")
+                    continue
+                live_size = files[asset.path]
+                if live_size and live_size != asset.size_bytes:
+                    drift.append(
+                        f"{entry.id}/{variant.quant}: size drift on {asset.path} — "
+                        f"catalog {asset.size_bytes} vs live {live_size}")
+    if drift:
+        print("\nADVISORY size drift (downloads tolerate this; refresh when convenient):")
+        print("\n".join(drift))
+    assert not problems, "\n".join(problems)
+
diff --git a/tests/hermes_cli/test_catalog_variants.py b/tests/hermes_cli/test_catalog_variants.py
new file mode 100644
index 0000000000..4912be4ec4
--- /dev/null
+++ b/tests/hermes_cli/test_catalog_variants.py
@@ -0,0 +1,182 @@
+"""Variant-selection contracts: fit the catalog's single Q4-class build
+to a machine and price it honestly. Pure decision-table tests over
+synthetic budgets."""
+
+from __future__ import annotations
+
+import pytest
+
+from hermes_cli.local_runtime.catalog import (
+    CATALOG,
+    catalog_by_id,
+    find_entry_for_model,
+    select_variant,
+)
+from hermes_cli.local_runtime.estimator import HardwareBudget
+
+GIB = 1 << 30
+
+
+def budget(vram_gib: float, ram_gib: float = 64) -> HardwareBudget:
+    return HardwareBudget(usable_vram_bytes=int(vram_gib * GIB),
+                          total_device_bytes=int(vram_gib * GIB),
+                          ram_available_bytes=int(ram_gib * GIB))
+
+
+def test_every_entry_ships_exactly_one_q4_build():
+    """No quant ladder: one Q4-class build per entry (K_M where the repo
+    ships it, XL elsewhere) — the quant class current engines optimize
+    for. Nothing below Q4 ever ships. Validation status is explicit per
+    variant in catalog.json; unvalidated builds are permitted (day-0
+    entries) and surface as unbadged rows in the pane."""
+    for entry in CATALOG:
+        assert len(entry.variants) == 1, (
+            f"{entry.id}: {len(entry.variants)} variants — expected exactly one")
+        build = entry.variants[0]
+        assert build.quant.startswith(("UD-Q4", "Q4")), (
+            f"{entry.id}: ships {build.quant}, not a Q4-class build")
+        for asset in entry.download_files(build):
+            assert asset.size_bytes > 0, f"{entry.id}: no size on {asset.path}"
+
+
+def test_split_variants_have_coherent_parts():
+    """Multi-file variants: same model_id from every part, exact sizes,
+    first file is the load target."""
+    entry = catalog_by_id()["deepseek-v4-flash"]
+    for v in entry.variants:
+        assert len(v.files) >= 2, "deepseek ships split GGUFs"
+        assert "00001-of" in v.files[0].path, "first part must be the load target"
+        assert v.size_bytes == sum(f.size_bytes for f in v.files)
+    assert entry.draft is not None, "DSpark draft rides along"
+
+
+def test_selection_is_the_q4_build_even_with_headroom():
+    """The selector picks the Q4 build even when bigger quants would fit
+    with room to spare — headroom buys window, not quant. Larger builds
+    stay one tile click away in the pane."""
+    entry = catalog_by_id()["qwen3.8-27b"]
+    choice = select_variant(entry, budget(60))
+    assert choice is not None
+    assert choice.zero_spill
+    assert choice.variant.quant == entry.variants[-1].quant  # the Q4 rung
+    assert choice.reason_key == "best-large-window"
+
+
+def test_selected_build_constant_and_fit_shape_monotone_in_vram():
+    """More VRAM never changes the selected build (always the Q4 rung);
+    what improves is the fit shape: spilled -> floor -> target window."""
+    entry = catalog_by_id()["qwen3.8-27b"]
+    quants = set()
+    shapes = []
+    rank = {"smallest-fits-spilled": 0, "best-fits": 1, "best-large-window": 2}
+    for vram in (8, 12, 16, 24, 32, 48):
+        choice = select_variant(entry, budget(vram))
+        assert choice is not None
+        quants.add(choice.variant.quant)
+        shapes.append(rank[choice.reason_key])
+    assert quants == {entry.variants[-1].quant}, f"selection not constant: {quants}"
+    assert shapes == sorted(shapes), f"fit shape not monotone in VRAM: {shapes}"
+
+
+def test_small_card_gets_q4_spilled_never_below():
+    """8 GiB card + 27B: nothing zero-spills. The floor holds — the
+    selector offers Q4 spilled (priced honestly), never a sub-Q4 build."""
+    entry = catalog_by_id()["qwen3.8-27b"]
+    choice = select_variant(entry, budget(8))
+    assert choice is not None
+    assert not choice.zero_spill
+    assert choice.reason_key == "smallest-fits-spilled"
+    assert choice.variant.quant == "UD-Q4_K_M"
+
+
+def test_frontier_model_refused_on_consumer_card_offered_on_big_ram():
+    """DeepSeek V4 Flash (161 GB at Q4): refused outright on a 32 GiB-RAM
+    desktop; offered spilled on a 192 GiB-RAM workstation. The catalog
+    carries frontier hardware honestly instead of hiding the model."""
+    entry = catalog_by_id()["deepseek-v4-flash"]
+    assert select_variant(entry, budget(32, ram_gib=32)) is None
+    big = select_variant(entry, budget(32, ram_gib=192))
+    assert big is not None and not big.zero_spill
+
+
+def test_selection_accounts_for_kv_not_just_weights():
+    """The zero-spill check prices weights + KV, not weights alone: give a
+    machine exactly enough VRAM for the build's weights and the fit must
+    come back spilled, not zero-spill."""
+    entry = catalog_by_id()["qwen3.8-27b"]
+    build = entry.variants[0]
+    exactly_weights = HardwareBudget(
+        usable_vram_bytes=build.size_bytes + (100 << 20),
+        total_device_bytes=build.size_bytes + (100 << 20),
+        ram_available_bytes=64 * GIB)
+    choice = select_variant(entry, exactly_weights)
+    assert choice is not None
+    assert not choice.zero_spill, "KV cost ignored — weights alone can't zero-spill"
+
+
+def test_floor_fallback_when_target_window_does_not_fit():
+    """Cards where nothing clears the target keep the old rule: highest
+    quality that zero-spills at the 64K floor (reason 'best-fits'), never
+    a needless step down."""
+    entry = catalog_by_id()["qwen3.8-27b"]
+    # ~23.5 GiB usable: Q4 weights (16.7 GiB in-memory) + floor KV (2.2)
+    # + overhead (1.5 + 0.9 mmproj + ~1.0 MTP-posture logits) fits, but
+    # the 144K-target KV (+2.7 more) does not.
+    choice = select_variant(entry, budget(23.5))
+    assert choice is not None and choice.zero_spill
+    assert choice.reason_key == "best-fits"
+    assert choice.variant.quant == "UD-Q4_K_M"
+
+
+def test_target_never_degrades_below_floor_choice():
+    """The target preference may only IMPROVE the window, never the
+    floor guarantees: whenever the old floor rule found a zero-spill pick,
+    the new rule also finds one (possibly a smaller quant, never spill)."""
+    for entry in CATALOG:
+        for vram in (8, 12, 16, 24, 32, 48, 96):
+            choice = select_variant(entry, budget(vram, ram_gib=256))
+            if choice is None:
+                continue
+            # Rule 2: whatever was chosen zero-spill must genuinely clear
+            # the floor (the selector's own invariant, re-checked).
+            if choice.zero_spill:
+                assert choice.reason_key in ("best-large-window", "best-fits")
+
+
+def test_find_entry_for_model_resolves_split_ids():
+    hit = find_entry_for_model("DeepSeek-V4-Flash-0731-UD-Q4_K_XL")
+    assert hit is not None
+    entry, variant = hit
+    assert entry.id == "deepseek-v4-flash"
+    assert variant.quant == "UD-Q4_K_XL"
+
+
+def test_hybrid_long_context_stays_cheap():
+    """The reason Nemotron/Qwen3.6 headline the catalog: their priced
+    64K-floor KV must be a small fraction of a dense model's."""
+    from hermes_cli.local_runtime.catalog import FLOOR
+    from hermes_cli.local_runtime.estimator import ctx_bytes
+
+    from hermes_cli.local_runtime.estimator import LayerKind, ModelProfile
+
+    hybrid = catalog_by_id()["qwen3.6-35b-a3b"]
+    hybrid_profile = hybrid.profile(hybrid.variants[-1])
+    # A fully-dense profile of the same layer count and per-layer cost:
+    # the contract is about LAYER ECONOMICS (recurrent layers pay no
+    # per-token KV), not about any particular catalog entry.
+    n_layers = len(hybrid_profile.layers)
+    dense_profile = ModelProfile(
+        name="synthetic-dense", weights_bytes=hybrid_profile.weights_bytes,
+        embd_table_bytes=0, n_ctx_train=hybrid.n_ctx_train,
+        layers=[(LayerKind.FULL, hybrid.per_layer_f16)] * n_layers)
+    dense_kv = ctx_bytes(dense_profile, FLOOR)
+    hybrid_kv = ctx_bytes(hybrid_profile, FLOOR)
+    # The contract is structural: recurrent layers pay no per-token KV,
+    # so the hybrid's KV must track its full-attention share (x kv_scale
+    # for MTP's draft context), not its total layer count.
+    full = sum(1 for kind, _ in hybrid_profile.layers if kind == LayerKind.FULL)
+    expected = dense_kv * full / n_layers * hybrid_profile.kv_scale
+    assert hybrid_kv < dense_kv, "hybrid must be cheaper than dense"
+    assert abs(hybrid_kv - expected) / expected < 0.25, (
+        f"hybrid KV ({hybrid_kv:,}) should track its full-attention share "
+        f"(expected ~{expected:,.0f})")
diff --git a/tests/hermes_cli/test_config.py b/tests/hermes_cli/test_config.py
index 968649e58a..0db5db5226 100644
--- a/tests/hermes_cli/test_config.py
+++ b/tests/hermes_cli/test_config.py
@@ -666,13 +666,23 @@ class TestOptionalEnvVarsRegistry:
         from hermes_cli.config import OPTIONAL_ENV_VARS
         assert OPTIONAL_ENV_VARS["KEENABLE_API_KEY"]["url"] == "https://keenable.ai"
 
-    def test_removed_tavily_var_not_in_env_vars_by_version(self):
-        """TAVILY_API_KEY was removed with the Tavily backend."""
+    def test_tavily_api_key_registered(self):
+        """TAVILY_API_KEY is listed in OPTIONAL_ENV_VARS."""
+        from hermes_cli.config import OPTIONAL_ENV_VARS
+        assert "TAVILY_API_KEY" in OPTIONAL_ENV_VARS
+
+    def test_tavily_api_key_has_url(self):
+        """TAVILY_API_KEY has a URL."""
+        from hermes_cli.config import OPTIONAL_ENV_VARS
+        assert OPTIONAL_ENV_VARS["TAVILY_API_KEY"]["url"] == "https://app.tavily.com/home"
+
+    def test_tavily_in_env_vars_by_version(self):
+        """TAVILY_API_KEY is listed in ENV_VARS_BY_VERSION."""
         from hermes_cli.config import ENV_VARS_BY_VERSION
         all_vars = []
         for vars_list in ENV_VARS_BY_VERSION.values():
             all_vars.extend(vars_list)
-        assert "TAVILY_API_KEY" not in all_vars
+        assert "TAVILY_API_KEY" in all_vars
 
     def test_max_iterations_not_offered_as_env_var(self):
         """HERMES_MAX_ITERATIONS must NOT be in OPTIONAL_ENV_VARS (issue #17534).
@@ -886,7 +896,9 @@ class TestConfigSupportFloor:
         },
         "memory": {"write_approval": True},
         "model": {"default": "openai/gpt-5.4", "provider": "openrouter"},
-        "model_catalog": {"ttl_hours": 1},
+        # v25 lowered the old 24h default to 1h; v40 drops that 1h default so
+        # the shipped ttl_minutes (20) applies.
+        "model_catalog": {},
         "plugins": {"enabled": []},
         "stt": {"provider": "local"},
     }
@@ -905,7 +917,7 @@ class TestConfigSupportFloor:
         # default (opt-in) so the write invariant strips it from disk.
         "agent": {},
         "model": {"default": "anthropic/claude-fable-5", "provider": "nous"},
-        "model_catalog": {"ttl_hours": 1},
+        "model_catalog": {},
         "plugins": {"disabled": ["foo"], "enabled": []},
     }
 
diff --git a/tests/hermes_cli/test_config_env_expansion.py b/tests/hermes_cli/test_config_env_expansion.py
index 207ae5625f..6571015245 100644
--- a/tests/hermes_cli/test_config_env_expansion.py
+++ b/tests/hermes_cli/test_config_env_expansion.py
@@ -122,3 +122,31 @@ class TestLoadCliConfigExpansion:
         config = load_cli_config()
 
         assert config["auxiliary"]["vision"]["api_key"] == "${UNSET_CLI_VAR_ABC}"
+
+
+class TestExpansionUnderProfileScope:
+    """``${VAR}`` refs must resolve against the active profile's secret scope,
+    not the shared process environment (#84079): under multiplex every
+    secondary profile otherwise "had" the default profile's token and fanned
+    out.  Outside multiplex the scope is an overlay and environ still applies."""
+
+    def test_scoped_ref_never_reads_another_profiles_environ(self, monkeypatch):
+        from agent import secret_scope as ss
+
+        monkeypatch.setenv("MATRIX_ACCESS_TOKEN", "default-token")
+        was_active = ss.is_multiplex_active()
+        ss.set_multiplex_active(True)
+        token = ss.set_secret_scope({"OTHER_KEY": "x"})  # profile-b: no matrix token
+        try:
+            assert _expand_env_vars("${MATRIX_ACCESS_TOKEN}") == "${MATRIX_ACCESS_TOKEN}"
+            assert _expand_env_vars("${env:MATRIX_ACCESS_TOKEN}") == "${env:MATRIX_ACCESS_TOKEN}"
+        finally:
+            ss.reset_secret_scope(token)
+        token = ss.set_secret_scope({"MATRIX_ACCESS_TOKEN": "c-token"})
+        try:
+            assert _expand_env_vars("${MATRIX_ACCESS_TOKEN}") == "c-token"
+        finally:
+            ss.reset_secret_scope(token)
+            ss.set_multiplex_active(was_active)
+        # Unscoped (default profile / single-profile CLI): legacy environ read.
+        assert _expand_env_vars("${MATRIX_ACCESS_TOKEN}") == "default-token"
diff --git a/tests/hermes_cli/test_config_set_platforms_redirect.py b/tests/hermes_cli/test_config_set_platforms_redirect.py
new file mode 100644
index 0000000000..803a70e58f
--- /dev/null
+++ b/tests/hermes_cli/test_config_set_platforms_redirect.py
@@ -0,0 +1,157 @@
+"""Regression tests for #71047 (Problem A): per-platform display settings.
+
+`hermes config set platforms.<name>.<display_setting> <value>` must write to
+`display.platforms.<name>.<display_setting>` — the path the gateway actually
+reads (gateway/display_config.py::resolve_display_setting). Writing to the
+top-level `platforms.<name>` block is silently ignored by the runtime, so the
+edit appeared to succeed while having no effect.
+"""
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+
+def _write_config(hermes_home: Path, data: dict) -> Path:
+    hermes_home.mkdir(parents=True, exist_ok=True)
+    config_path = hermes_home / "config.yaml"
+    config_path.write_text(yaml.dump(data))
+    return config_path
+
+
+def _set(monkeypatch, hermes_home, key, value, force=False):
+    """Isolated call to set_config_value against a temp HERMES_HOME."""
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+    # set_config_value resolves the home live via get_config_path()/get_hermes_home()
+    from hermes_cli.config import set_config_value
+    set_config_value(key, value, force=force)
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    # A config that already has a top-level platforms block (connection keys)
+    # AND a display.platforms block, mirroring the real-world report.
+    cfg = {
+        "model": {"default": "test-model", "provider": "openrouter"},
+        "platforms": {
+            "telegram": {"token": "secret-bot-token"},
+        },
+        "display": {
+            "skin": "default",
+            "platforms": {
+                "telegram": {"show_reasoning": True},
+            },
+        },
+    }
+    _write_config(home, cfg)
+    return home
+
+
+class TestPerPlatformDisplayRedirect:
+    def test_streaming_redirects_to_display_platforms(self, hermes_home, monkeypatch):
+        """platforms.telegram.streaming must land under display.platforms."""
+        _set(monkeypatch, hermes_home, "platforms.telegram.streaming", "false")
+
+        result = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        # Redirected target exists and is correct
+        assert result["display"]["platforms"]["telegram"]["streaming"] is False
+        # Top-level platforms.telegram must NOT gain a streaming key
+        assert "streaming" not in result["platforms"]["telegram"]
+        # Connection key untouched
+        assert result["platforms"]["telegram"]["token"] == "secret-bot-token"
+
+    def test_show_reasoning_redirects(self, hermes_home, monkeypatch):
+        _set(monkeypatch, hermes_home, "platforms.telegram.show_reasoning", "false")
+        result = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        assert result["display"]["platforms"]["telegram"]["show_reasoning"] is False
+
+    def test_tool_progress_redirects(self, hermes_home, monkeypatch):
+        # ``off`` is coerced to False by the bool-aware coercion in
+        # set_config_value; gateway/display_config._normalise turns False back
+        # into the canonical "off" string at read time, so the persisted value
+        # is the bool.
+        _set(monkeypatch, hermes_home, "platforms.discord.tool_progress", "off")
+        result = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        assert result["display"]["platforms"]["discord"]["tool_progress"] is False
+
+    def test_connection_key_not_redirected(self, hermes_home, monkeypatch):
+        """A real connection key (token) stays in top-level platforms.<name>."""
+        _set(monkeypatch, hermes_home, "platforms.telegram.token", "new-token")
+        result = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        assert result["platforms"]["telegram"]["token"] == "new-token"
+        # Nothing leaked into display.platforms.telegram.token
+        assert "token" not in result["display"]["platforms"]["telegram"]
+
+    def test_no_top_level_platforms_created_when_missing(self, tmp_path, monkeypatch):
+        """When there is no pre-existing top-level platforms block, a display
+        setting write must not invent one."""
+        home = tmp_path / ".hermes"
+        _write_config(home, {"model": {"default": "m"}})
+        _set(monkeypatch, home, "platforms.telegram.streaming", "true")
+        result = yaml.safe_load((home / "config.yaml").read_text())
+        assert result["display"]["platforms"]["telegram"]["streaming"] is True
+        assert "platforms" not in result  # no stray top-level platforms block
+
+
+class TestRedirectSiblingSurfaces:
+    """The canonicalization must hold for every CLI surface that takes a dotted
+    key — set, get, unset — and the written value must be what the gateway's
+    resolver actually reads (the #71047 symptom was CLI and runtime disagreeing).
+    """
+
+    def test_get_mirrors_gateway_resolution_after_set(self, hermes_home, monkeypatch, capsys):
+        from gateway.display_config import resolve_display_setting
+        from hermes_cli.config import get_config_value
+
+        _set(monkeypatch, hermes_home, "platforms.telegram.streaming", "false")
+        capsys.readouterr()
+        get_config_value("platforms.telegram.streaming")
+        assert capsys.readouterr().out.strip() == "false"
+
+        raw = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        assert resolve_display_setting(raw, "telegram", "streaming") is False
+
+    def test_unset_removes_the_redirected_leaf(self, hermes_home, monkeypatch):
+        from hermes_cli.config import unset_config_value
+
+        _set(monkeypatch, hermes_home, "platforms.telegram.streaming", "false")
+        unset_config_value("platforms.telegram.streaming")
+        result = yaml.safe_load((hermes_home / "config.yaml").read_text())
+        assert "streaming" not in result["display"]["platforms"]["telegram"]
+        # Sibling display override and connection block untouched.
+        assert result["display"]["platforms"]["telegram"]["show_reasoning"] is True
+        assert result["platforms"]["telegram"] == {"token": "secret-bot-token"}
+
+    def test_unset_missing_redirected_leaf_exits_nonzero(self, hermes_home, monkeypatch):
+        from hermes_cli.config import unset_config_value
+
+        monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+        with pytest.raises(SystemExit) as exc:
+            unset_config_value("platforms.telegram.streaming")
+        assert exc.value.code == 1
+
+    def test_set_prints_redirect_note(self, hermes_home, monkeypatch, capsys):
+        _set(monkeypatch, hermes_home, "platforms.telegram.streaming", "false")
+        out = capsys.readouterr().out
+        assert "saved as display.platforms.telegram.streaming" in out
+        assert "Set display.platforms.telegram.streaming = False" in out
+
+    def test_redirect_helper_only_touches_known_display_keys(self):
+        from gateway.display_config import OVERRIDEABLE_KEYS
+        from hermes_cli.config import _redirect_platform_display_key
+
+        for setting in OVERRIDEABLE_KEYS:
+            canonical, note = _redirect_platform_display_key(f"platforms.discord.{setting}")
+            assert canonical == f"display.platforms.discord.{setting}"
+            assert note
+        for key in (
+            "platforms.telegram.token",
+            "platforms.telegram.reply_to_mode",
+            "platforms.telegram.extra.foo",  # 4 segments — not a display leaf
+            "platforms.telegram",
+            "display.platforms.telegram.streaming",  # already canonical
+            "streaming.enabled",
+        ):
+            assert _redirect_platform_display_key(key) == (key, None)
diff --git a/tests/hermes_cli/test_container_boot.py b/tests/hermes_cli/test_container_boot.py
index 5838ffdb45..cb772eeb65 100644
--- a/tests/hermes_cli/test_container_boot.py
+++ b/tests/hermes_cli/test_container_boot.py
@@ -128,6 +128,49 @@ def test_running_profile_is_registered_and_autostarted(tmp_path: Path) -> None:
     assert not (svc / "down").exists()
 
 
+@pytest.mark.parametrize(
+    "config_value,env_value,expected",
+    [
+        pytest.param("true", None, "registered", id="config-only-multiplex"),
+        pytest.param("true", "false", "started", id="env-false-overrides-config"),
+    ],
+)
+def test_boot_honors_config_multiplex_profiles(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    config_value: str,
+    env_value: str | None,
+    expected: str,
+) -> None:
+    """Container boot must resolve multiplex_profiles like the gateway does:
+    config.yaml opt-in honored (#85413), env override keeps precedence."""
+    scandir = tmp_path / "run-service"
+    scandir.mkdir()
+    _make_profile(tmp_path, "coder", state="running")
+    (tmp_path / "config.yaml").write_text(
+        f"multiplex_profiles: {config_value}\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    if env_value is None:
+        monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
+    else:
+        monkeypatch.setenv("GATEWAY_MULTIPLEX_PROFILES", env_value)
+
+    actions = reconcile_profile_gateways(
+        hermes_home=tmp_path,
+        scandir=scandir,
+        dry_run=False,
+    )
+
+    assert _named_actions(actions) == [ReconcileAction(
+        profile="coder",
+        prior_state="running",
+        action=expected,
+    )]
+    assert (scandir / "gateway-coder" / "down").exists() is (expected == "registered")
+
+
 def test_registered_profile_has_finish_script(tmp_path: Path) -> None:
     """The finish script must be written so s6 stops restarting on
     fatal config errors (exit 78 → exit 125).  See #51228."""
@@ -299,5 +342,3 @@ def _write_lifecycle_sentinel(profile_dir: Path, payload: dict) -> None:
     (state_dir / "gateway.lifecycle.json").write_text(json.dumps(payload))
 
 
-
-
diff --git a/tests/hermes_cli/test_context_policy.py b/tests/hermes_cli/test_context_policy.py
new file mode 100644
index 0000000000..b98bcd49c1
--- /dev/null
+++ b/tests/hermes_cli/test_context_policy.py
@@ -0,0 +1,410 @@
+"""Context-policy decision-table tests (Rollout 3).
+
+Per the design's verification plan: synthetic per-layer profiles ->
+relationships, never exact numbers. Real-model spot checks pin the
+estimator to constants measured on real GGUFs (those ARE relationships —
+constants with tolerance bands, not change-detecting catalog snapshots).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from hermes_cli.local_runtime.context_policy import (
+    FLOOR,
+    SPEED_FLOOR_TOK_S,
+    GrowthDecision,
+    WindowDecision,
+    growth_decision,
+    initial_window,
+    ladder,
+    launch_args,
+    spill_overrides,
+    ub_logits_bytes,
+)
+from hermes_cli.local_runtime.estimator import (
+    HardwareBudget,
+    LayerKind,
+    ModelProfile,
+    PhysicsRefusal,
+    ctx_bytes,
+    kv_dtype_factor,
+    physics_check,
+)
+
+GIB = 1 << 30
+KIB = 1024
+
+
+# ── synthetic profiles (per-layer tuples, per the verification plan) ──
+
+
+def dense(name="dense-32b", layers=64, per_token_f16=4096, weights_gib=20,
+          native=128 * 1024) -> ModelProfile:
+    return ModelProfile(
+        name=name, weights_bytes=weights_gib * GIB, embd_table_bytes=0,
+        n_ctx_train=native,
+        layers=[(LayerKind.FULL, per_token_f16)] * layers)
+
+
+def hybrid(name="hybrid-30b", full_layers=16, recurrent_layers=48,
+           per_token_f16=4096, weights_gib=22, native=1024 * 1024) -> ModelProfile:
+    layers = ([(LayerKind.FULL, per_token_f16)] * full_layers
+              + [(LayerKind.RECURRENT, 0)] * recurrent_layers)
+    return ModelProfile(name=name, weights_bytes=weights_gib * GIB,
+                        embd_table_bytes=0, n_ctx_train=native, layers=layers)
+
+
+def moe(name="moe-30b", layers=48, per_token_f16=3072, weights_gib=17,
+        native=256 * 1024) -> ModelProfile:
+    return ModelProfile(name=name, weights_bytes=weights_gib * GIB,
+                        embd_table_bytes=0, n_ctx_train=native,
+                        layers=[(LayerKind.FULL, per_token_f16)] * layers,
+                        moe=True)
+
+
+def card(vram_gib, ram_gib=64, uma=False) -> HardwareBudget:
+    return HardwareBudget(usable_vram_bytes=int(vram_gib * GIB),
+                          total_device_bytes=int(vram_gib * GIB),
+                          ram_available_bytes=int(ram_gib * GIB), uma=uma)
+
+
+# ── estimator invariants ─────────────────────────────────────
+
+
+def test_full_attention_linear_in_window():
+    p = dense()
+    b32, b64, b128 = (ctx_bytes(p, w * KIB) for w in (32, 64, 128))
+    assert abs(b64 / b32 - 2) < 0.01
+    assert abs(b128 / b64 - 2) < 0.01
+
+
+def test_recurrent_state_constant_in_window():
+    p = hybrid()
+    full_share_32 = ctx_bytes(p, 32 * KIB)
+    full_share_1m = ctx_bytes(p, 1024 * KIB)
+    # Grows only through the 16 full-attn layers — the recurrent share is
+    # identical, so the ratio tracks the full-attn ratio exactly.
+    full_only = ModelProfile(name="x", weights_bytes=0, embd_table_bytes=0,
+                             n_ctx_train=p.n_ctx_train,
+                             layers=[(LayerKind.FULL, 4096)] * 16)
+    expected_delta = ctx_bytes(full_only, 1024 * KIB) - ctx_bytes(full_only, 32 * KIB)
+    assert abs((full_share_1m - full_share_32) - expected_delta) <= 1
+
+
+def test_swa_layers_capped_at_window():
+    p = ModelProfile(
+        name="swa", weights_bytes=0, embd_table_bytes=0, n_ctx_train=128 * KIB,
+        layers=[(LayerKind.SWA, 4096)] * 5 + [(LayerKind.FULL, 4096)] * 1,
+        swa_window=1024)
+    small, big = ctx_bytes(p, 4 * KIB), ctx_bytes(p, 32 * KIB)
+    # Full layer grew 8x; the 5 SWA layers stayed capped at 1024 — total
+    # growth must land well under the all-full 8x (here ~4.1x).
+    assert big / small < 0.6 * 8
+
+
+def test_q8_factor_is_exactly_34_over_64():
+    assert kv_dtype_factor(True) == pytest.approx(34 / 64)
+    assert kv_dtype_factor(False) == 1.0
+
+
+def test_non_fa_fallback_doubles_ctx_cost():
+    p = dense()
+    assert ctx_bytes(p, FLOOR, flash_attention=False) == pytest.approx(
+        ctx_bytes(p, FLOOR, flash_attention=True) * 64 / 34, rel=0.001)
+
+
+def test_hybrid_vs_dense_100x_class_spread():
+    """The whole reason for the per-layer walk: equal-size models, ~100x
+    per-token spread between classic dense and a mostly-recurrent hybrid."""
+    d = dense(layers=64, per_token_f16=8192)          # 256 KiB/tok class
+    h = hybrid(full_layers=4, recurrent_layers=60, per_token_f16=8192)
+    window = 256 * KIB
+    dense_cost = ctx_bytes(d, window)
+    hybrid_cost = ctx_bytes(h, window)
+    assert dense_cost / hybrid_cost > 10
+
+
+# ── measured-constant spot checks (real models, tolerance bands) ──
+
+
+def test_measured_dense_4b_per_token():
+    """Qwen3-4B: 36 layers x 8 kv-heads x (128+128) x 2B = 144 KiB/tok f16."""
+    p = ModelProfile(name="qwen3-4b", weights_bytes=0, embd_table_bytes=0,
+                     n_ctx_train=262144,
+                     layers=[(LayerKind.FULL, 8 * 256 * 2)] * 36)
+    per_token_bytes = ctx_bytes(p, 32 * KIB, flash_attention=False) / (32 * KIB)
+    assert per_token_bytes == pytest.approx(144 * KIB, rel=0.02)
+
+
+def test_measured_gdn_27b_per_token_q8():
+    """Qwen3.6-27B: 16 full-attn of 64; measured 34.0 KiB/tok @ q8 (B4).
+    Per-layer f16 = 34 KiB * 64/34 / 16 = 4 KiB."""
+    per_layer_f16 = 4 * KIB
+    kv_only = ModelProfile(name="kv", weights_bytes=0, embd_table_bytes=0,
+                           n_ctx_train=262144,
+                           layers=[(LayerKind.FULL, per_layer_f16)] * 16)
+    per_token_bytes = ctx_bytes(kv_only, 128 * KIB) / (128 * KIB)
+    assert per_token_bytes == pytest.approx(34 * KIB, rel=0.02)
+
+
+def test_measured_nemotron_1m_within_band():
+    """1M @ q8 measured 3264 MiB KV (B3): ~3.19 KiB/token TOTAL across the
+    16 full-attn layers -> per-layer f16 ~384 B. Estimator must land in the
+    measured band, not the dense-formula 100x miss."""
+    p = hybrid(full_layers=16, recurrent_layers=46, per_token_f16=384,
+               native=1024 * KIB)
+    total = ctx_bytes(p, 1024 * KIB)
+    assert 2.5 * GIB < total < 4.0 * GIB
+
+
+# ── physics check ────────────────────────────────────────────
+
+
+def test_physics_refusal_only_past_vram_plus_ram():
+    p = dense(weights_gib=60)
+    ok = physics_check(p, card(24, ram_gib=64), FLOOR)
+    assert ok is None  # 60 GiB weights fit in 24+64
+    refused = physics_check(p, card(24, ram_gib=16), FLOOR)
+    assert isinstance(refused, PhysicsRefusal)
+    assert "smaller quant" in refused.message
+
+
+def test_physics_check_prices_at_floor_not_native():
+    """A 1M-native hybrid must not be refused for its native window —
+    the check prices the floor only."""
+    p = hybrid(weights_gib=22)
+    assert physics_check(p, card(24, ram_gib=8), FLOOR) is None
+
+
+# ── ladder + initial window ──────────────────────────────────
+
+
+def test_ladder_shape():
+    rungs = ladder(262144)
+    assert rungs[0] == FLOOR
+    assert rungs[-1] == 262144
+    assert all(a < b for a, b in zip(rungs, rungs[1:]))
+    # geometric-ish: each step grows, none more than 2x
+    assert all(b / a <= 2.0 for a, b in zip(rungs, rungs[1:]))
+
+
+def test_initial_window_never_below_floor_and_never_above_native():
+    for profile in (dense(), hybrid(), moe(), dense(native=32 * KIB)):
+        for vram in (8, 16, 24, 32):
+            d = initial_window(profile, card(vram))
+            if isinstance(d, WindowDecision):
+                assert d.window >= min(FLOOR, profile.n_ctx_train)
+                assert d.window <= profile.n_ctx_train
+
+
+def test_initial_window_monotone_in_vram():
+    p = dense()
+    windows = []
+    for vram in (8, 12, 16, 24, 32, 48):
+        d = initial_window(p, card(vram))
+        assert isinstance(d, WindowDecision)
+        windows.append(d.window)
+    assert all(a <= b for a, b in zip(windows, windows[1:]))
+
+
+def test_flat_curve_reaches_native_where_dense_does_not():
+    """Design invariant: equal-size hybrid rides to native spill-free where
+    the dense model cannot. Hybrid KV priced at the B3 class (~3.2 KiB/tok
+    total: per-layer f16 384 B x 16 layers)."""
+    h = hybrid(weights_gib=18, native=1024 * KIB, per_token_f16=384)
+    d = dense(weights_gib=18, per_token_f16=8192, native=1024 * KIB)
+    vram = card(24)
+    dh = initial_window(h, vram)
+    dd = initial_window(d, vram)
+    assert isinstance(dh, WindowDecision) and isinstance(dd, WindowDecision)
+    assert dh.window == 1024 * KIB and not dh.spilled
+    assert dd.window < 1024 * KIB
+
+
+def test_dense_on_small_card_holds_floor_and_spills():
+    """The deliberate price of the guarantee (design table: dense 32B on
+    24 GB starts at the floor with a few GiB spilled)."""
+    d = initial_window(dense(weights_gib=20), card(12))
+    assert isinstance(d, WindowDecision)
+    assert d.window == FLOOR
+    assert d.spilled
+
+
+def test_uma_budget_caps_the_window_through_physics():
+    """Unified memory needs no special context rule: the budget already
+    encodes the constraint (usable = RAM minus headroom, ram_available=0),
+    so the ladder stops where weights + KV genuinely stop fitting."""
+    p = hybrid(weights_gib=8, native=1024 * KIB)
+    unified = card(38.4, ram_gib=0, uma=True)  # 48 GiB machine, 20% headroom
+    d = initial_window(p, unified)
+    assert isinstance(d, WindowDecision)
+    assert not d.spilled, "UMA budget must produce a resident decision"
+    need = 8 * GIB + ctx_bytes(p, d.window)
+    assert need <= unified.usable_vram_bytes
+
+
+# ── growth ───────────────────────────────────────────────────
+
+
+def _grow(profile, budget, **kw):
+    defaults = dict(current_window=FLOOR, session_tokens=int(FLOOR * 0.9),
+                    measured_decode_tok_s=40.0, server_idle=True)
+    defaults.update(kw)
+    return growth_decision(profile, budget, **defaults)
+
+
+def test_growth_holds_below_occupancy():
+    d = _grow(dense(), card(24), session_tokens=int(FLOOR * 0.5))
+    assert d.action == "hold"
+
+
+def test_growth_requires_idle_server():
+    d = _grow(dense(), card(24), server_idle=False)
+    assert d.action == "hold"
+    assert "idle" in d.reason
+
+
+def test_growth_steps_one_rung_and_is_monotone():
+    p = dense(native=262144)
+    d = _grow(p, card(32))
+    assert d.action == "grow"
+    assert d.next_window > FLOOR
+    rungs = ladder(262144)
+    assert d.next_window == rungs[rungs.index(FLOOR) + 1]
+
+
+def test_growth_stops_at_native():
+    p = dense(native=128 * KIB)
+    d = _grow(p, card(48), current_window=128 * KIB,
+              session_tokens=int(128 * KIB * 0.9))
+    assert d.action == "compress-default"
+
+
+def test_speed_floor_flips_default_to_compression():
+    d = _grow(dense(), card(24), measured_decode_tok_s=SPEED_FLOOR_TOK_S - 2)
+    assert d.action == "compress-default"
+    assert "explicit per-session choice" in d.reason
+
+
+def test_growth_refits_against_live_budget():
+    """V3C: a rung that no longer fits (external pressure ate the memory)
+    is not granted."""
+    p = dense(weights_gib=20)
+    starved = card(2, ram_gib=1)
+    d = _grow(p, starved)
+    assert d.action == "compress-default"
+    assert "physics" in d.reason
+
+
+# ── spill placement + launch args ────────────────────────────
+
+
+def test_spill_overrides_prefer_expert_and_recurrent_ffn():
+    assert "exps" in " ".join(spill_overrides(moe()))
+    assert "ffn" in " ".join(spill_overrides(hybrid()))
+    assert spill_overrides(dense()) == []
+
+
+def test_launch_args_contract():
+    p = moe()
+    spilled = WindowDecision(window=FLOOR, spill_bytes=4 * GIB, kv_on_gpu=True)
+    resident = WindowDecision(window=131072, spill_bytes=0, kv_on_gpu=True)
+
+    a = launch_args(p, spilled, mtp_capable=True)
+    assert a[:2] == ["-c", str(FLOOR)]           # explicit window, always
+    assert "q8_0" in a                            # q8 KV under flash attn
+    assert "-ot" in a                             # spill placement
+    assert "--spec-type" in a                     # MTP on spilled
+
+    # MTP is not gated on spill: resident decode measured +16% at depth 2.
+    b = launch_args(p, resident, mtp_capable=True, mtp_draft_depth=2)
+    assert "-ot" not in b, "placement is spill-only"
+    assert "--spec-type" in b, "MTP must run on resident configs too"
+    assert b[b.index("--spec-draft-n-max") + 1] == "2"
+    assert "--backend-sampling" in b
+    assert "--spec-draft-backend-sampling" in b
+
+    # Stacking MTP with the large microbatch is a FIT question, decided
+    # by the caller (presets' posture ladder) and passed as mtp_prefill.
+    # Default (no headroom proven): decode posture, small ubatch — the
+    # stacked logits buffers once packed a 32 GiB card 3.9 GiB past a
+    # fit that ignored them.
+    assert "-ub" not in b, "default MTP posture stays at the small ubatch"
+
+    # Headroom proven: the stacked posture carries the large microbatch
+    # (measured best on both axes where it fits: 93.3 vs 89.5 tok/s
+    # decode on Qwen3.8 Q4). ub_logits_bytes must price the same choice.
+    s = launch_args(p, resident, mtp_capable=True, mtp_draft_depth=2,
+                    mtp_prefill=True)
+    assert "-ub" in s and s[s.index("-ub") + 1] == "2048"
+    assert "--spec-type" in s
+    v = 248320
+    assert ub_logits_bytes(v, mtp_capable=True) == 512 * v * 4 * 2
+    assert ub_logits_bytes(v, mtp_capable=True, mtp_prefill=True) == int(2048 * v * 4 * 1.5)
+
+    c = launch_args(p, resident, mtp_capable=False)
+    assert "-ub" in c and c[c.index("-ub") + 1] == "2048"  # prefill hint
+    assert "--spec-type" not in c
+
+    d = launch_args(p, spilled, flash_attention=False, mtp_capable=False)
+    assert "q8_0" not in d                        # f16 on non-FA fallback
+
+
+def test_launch_args_uma_never_pins_tensors():
+    """On unified memory, -ot pinning is off even for spilled decisions:
+    "CPU" and "GPU" are the same silicon, and forcing FFN weights down
+    the host compute path measures far slower than letting the
+    allocator place everything. The discrete ~1.75x -ot win does not
+    transfer. Everything else about the launch shape is identical to
+    discrete."""
+    p = moe()
+    spilled = WindowDecision(window=FLOOR, spill_bytes=4 * GIB, kv_on_gpu=True)
+
+    u = launch_args(p, spilled, mtp_capable=False, uma=True)
+    assert "-ot" not in u, "UMA must never pin tensors to the host path"
+    assert u[:2] == ["-c", str(FLOOR)]            # window contract unchanged
+    assert "q8_0" in u                            # KV policy unchanged
+
+    # Same call on discrete keeps the pinning — the flag is the ONLY delta.
+    disc = launch_args(p, spilled, mtp_capable=False, uma=False)
+    assert "-ot" in disc
+    assert [x for x in disc if x != "-ot" and not x.startswith("blk")] == \
+        [x for x in u if x != "-ot" and not x.startswith("blk")]
+
+
+def test_ub_logits_bytes_prices_the_flag_choice():
+    """The logits-buffer price must match the microbatch launch_args
+    chooses: 2048 x vocab x 4 for non-MTP, 512 x vocab x 4 x 2 for MTP
+    (draft context doubles it). 248320-vocab receipts: ~1.9 GiB at
+    ub2048, ~0.95 GiB under MTP."""
+    v = 248320
+    assert ub_logits_bytes(v, mtp_capable=False) == 2048 * v * 4
+    assert ub_logits_bytes(v, mtp_capable=True) == 512 * v * 4 * 2
+    assert ub_logits_bytes(0, mtp_capable=True) == 0   # unknown vocab: no charge
+
+
+def test_no_refusal_branch_past_physics():
+    """Design invariant: anything past the physics check is servable —
+    initial_window never refuses on its own."""
+    for vram in (4, 6, 8, 12):
+        d = initial_window(dense(weights_gib=20), card(vram, ram_gib=64))
+        assert isinstance(d, WindowDecision)
+
+
+def test_kv_scale_prices_mtp_draft_context():
+    """MTP profiles carry kv_scale > 1 (the draft context's KV share,
+    calibrated from measured server RSS); ctx_bytes must scale with it so
+    every consumer — launch fit, catalog rows, growth — prices what the
+    server actually allocates. Four-point calibration held within
+    +1.4 GiB conservative, never optimistic."""
+    import dataclasses
+
+    p = moe()
+    base = ctx_bytes(p, 131072)
+    scaled = ctx_bytes(dataclasses.replace(p, kv_scale=1.2), 131072)
+    assert scaled == int(base * 1.2)
+
+    # The safety direction: the estimate must never be BELOW measured.
+    # (Calibration receipts: predicted-measured was +233..+1400 MiB.)
+    assert scaled > base
diff --git a/tests/hermes_cli/test_copilot_in_model_list.py b/tests/hermes_cli/test_copilot_in_model_list.py
index 83832b0c33..2889627964 100644
--- a/tests/hermes_cli/test_copilot_in_model_list.py
+++ b/tests/hermes_cli/test_copilot_in_model_list.py
@@ -3,6 +3,8 @@
 import os
 from unittest.mock import patch
 
+import pytest
+
 from hermes_cli.model_switch import list_authenticated_providers
 
 
@@ -20,3 +22,63 @@ def test_copilot_picker_uses_live_catalog_when_available():
     assert copilot is not None
     assert copilot["models"] == live_models
     assert copilot["total_models"] == len(live_models)
+
+
+# --- copilot-acp: external_process availability (#63662) -------------------
+#
+# copilot-acp holds no API key, OAuth token, or credential-pool entry by
+# design — the spawned `copilot --acp --stdio` subprocess brings its own auth.
+# The picker loop used to filter it out unconditionally (has_creds never had
+# an external_process branch), so the provider was invisible in every picker
+# even with a perfectly resolvable executable.
+
+
+@pytest.fixture()
+def _no_other_copilot_creds(monkeypatch):
+    """Make sure copilot-acp visibility comes ONLY from executable resolution:
+    no env tokens, no configured ACP endpoint, no auth-store entry, no seeded
+    credential pool."""
+    # COPILOT_ACP_BASE_URL is not a credential, but an `acp+tcp://` value marks
+    # the provider configured with no executable at all (hermes_cli/auth.py), so
+    # a host that sets it would decide the outcome instead of the test.
+    for var in ("GH_TOKEN", "GITHUB_TOKEN", "HERMES_COPILOT_ACP_COMMAND",
+                "COPILOT_CLI_PATH", "COPILOT_ACP_BASE_URL"):
+        monkeypatch.delenv(var, raising=False)
+    import hermes_cli.auth as auth
+    import hermes_cli.model_switch as model_switch
+
+    monkeypatch.setattr(auth, "_load_auth_store", lambda: {})
+    monkeypatch.setattr(model_switch, "_credential_pool_is_usable", lambda *a, **k: False)
+
+
+def test_copilot_acp_listed_when_executable_resolves(tmp_path, monkeypatch, _no_other_copilot_creds):
+    fake = tmp_path / ("copilot.exe" if os.name == "nt" else "copilot")
+    fake.write_text("", encoding="utf-8")
+    fake.chmod(0o755)
+    monkeypatch.setenv("HERMES_COPILOT_ACP_COMMAND", str(fake))
+
+    with patch("agent.models_dev.fetch_models_dev", return_value={}), \
+         patch("hermes_cli.models._resolve_copilot_catalog_api_key", return_value=None), \
+         patch("hermes_cli.models._fetch_github_models", return_value=[]):
+        providers = list_authenticated_providers(current_provider="openrouter", max_models=50)
+
+    acp = next((p for p in providers if p["slug"] == "copilot-acp"), None)
+
+    assert acp is not None, "copilot-acp must be listed when its executable resolves"
+    assert acp["models"], "copilot-acp row must offer at least the curated fallback models"
+
+
+def test_copilot_acp_hidden_when_executable_missing(monkeypatch, _no_other_copilot_creds):
+    # `copilot` may genuinely be installed on a dev machine — force the
+    # resolution miss so the test pins behaviour, not the host's PATH.
+    import hermes_cli.auth as auth
+
+    monkeypatch.setattr(auth.shutil, "which", lambda *_a, **_k: None)
+
+    with patch("agent.models_dev.fetch_models_dev", return_value={}), \
+         patch("hermes_cli.models._resolve_copilot_catalog_api_key", return_value=None), \
+         patch("hermes_cli.models._fetch_github_models", return_value=[]):
+        providers = list_authenticated_providers(current_provider="openrouter", max_models=50)
+
+    assert all(p["slug"] != "copilot-acp" for p in providers), \
+        "copilot-acp must stay hidden when no executable resolves"
diff --git a/tests/hermes_cli/test_cron.py b/tests/hermes_cli/test_cron.py
index f48ce6e0e6..1712e0ddab 100644
--- a/tests/hermes_cli/test_cron.py
+++ b/tests/hermes_cli/test_cron.py
@@ -129,6 +129,44 @@ class TestCronCommandLifecycle:
         assert jobs[0]["name"] == "Skill combo"
 
 
+class TestUnverifiedDeliveryVisibility:
+    """An evidence-free live-adapter ack (Slack/Matrix/Mattermost bare
+    ``SendResult(success=True)``) is accepted as delivered, but the UNVERIFIED
+    state must be visible in ``hermes cron list`` and ``hermes cron doctor``,
+    not only in a WARNING log line."""
+
+    def _seed(self):
+        job = create_job(prompt="Nightly brief", schedule="every 1h", deliver="slack:C0123456")
+        jobs = load_jobs()
+        jobs[0]["last_status"] = "ok"
+        jobs[0]["last_delivery_unverified"] = ["slack:C0123456"]
+        save_jobs(jobs)
+        return job
+
+    def test_list_shows_unverified_delivery(self, tmp_cron_dir, capsys):
+        job = self._seed()
+        cron_command(Namespace(cron_command="list", all=True, json=False))
+        out = capsys.readouterr().out
+        assert job["id"] in out
+        assert "Delivery UNVERIFIED" in out
+        assert "slack:C0123456" in out
+        assert "without message_id/raw_response" in out
+
+    def test_list_is_quiet_when_delivery_was_verified(self, tmp_cron_dir, capsys):
+        create_job(prompt="Nightly brief", schedule="every 1h", deliver="slack:C0123456")
+        cron_command(Namespace(cron_command="list", all=True, json=False))
+        assert "UNVERIFIED" not in capsys.readouterr().out
+
+    def test_doctor_reports_unverified_delivery(self, tmp_cron_dir, capsys):
+        job = self._seed()
+        rc = cron_command(Namespace(cron_command="doctor"))
+        out = capsys.readouterr().out
+        assert rc == 1
+        assert job["id"] in out
+        assert "last delivery unverified" in out
+        assert "slack:C0123456" in out
+
+
 class TestCronDoctor:
     def test_doctor_reports_cron_health_issues(self, tmp_cron_dir, capsys):
         job = create_job(prompt="Daily digest", schedule="every 1h", script="missing.py")
@@ -160,6 +198,28 @@ class TestCronDoctor:
         assert rc == 0
         assert "✓ Cron doctor found no issues" in out
 
+    def test_doctor_reports_delivery_failure_once(self, tmp_cron_dir, capsys):
+        """A delivery_failed run is a delivery issue, not a failed agent run.
+
+        The agent succeeded (last_error is None), so the generic last-run-failed
+        line would only ever say "unknown error" — double-reporting the same
+        incident (#83993).
+        """
+        create_job(prompt="Daily digest", schedule="every 1h")
+        jobs = load_jobs()
+        jobs[0]["last_status"] = "delivery_failed"
+        jobs[0]["last_error"] = None
+        jobs[0]["last_delivery_error"] = "telegram timeout"
+        save_jobs(jobs)
+
+        rc = cron_command(Namespace(cron_command="doctor"))
+
+        out = capsys.readouterr().out
+        assert rc == 1
+        assert "last delivery failed: telegram timeout" in out
+        assert "last run failed" not in out
+        assert "unknown error" not in out
+
     def test_doctor_flags_overdue_next_run(self, tmp_cron_dir, capsys):
         from datetime import datetime, timedelta, timezone
 
@@ -193,6 +253,48 @@ class TestCronDoctor:
         assert "✓ Cron doctor found no issues" in out
 
 
+class TestCronListStatusRendering:
+    """`cron list` must never paint an undelivered run as a success (#83993)."""
+
+    def test_delivery_failed_is_not_green_ok(self, tmp_cron_dir, capsys, monkeypatch):
+        monkeypatch.setattr("hermes_cli.gateway.find_gateway_pids", lambda: [1])
+        # capsys is not a tty, so force colors on to check the paint itself.
+        monkeypatch.setattr("hermes_cli.colors.should_use_color", lambda: True)
+        create_job(prompt="Daily digest", schedule="every 1h")
+        jobs = load_jobs()
+        jobs[0]["last_run_at"] = "2026-09-01T09:00:00+00:00"
+        jobs[0]["last_status"] = "delivery_failed"
+        jobs[0]["last_error"] = None
+        jobs[0]["last_delivery_error"] = "telegram timeout"
+        save_jobs(jobs)
+
+        cron_command(Namespace(cron_command="list", all=True))
+
+        out = capsys.readouterr().out
+        last_run_line = next(l for l in out.splitlines() if "Last run:" in l)
+        assert "delivery_failed" in last_run_line
+        assert "telegram timeout" in last_run_line, (
+            "the delivery detail lives in last_delivery_error, not last_error"
+        )
+        assert cron_cli.Colors.GREEN not in last_run_line
+
+    def test_ok_run_still_green(self, tmp_cron_dir, capsys, monkeypatch):
+        monkeypatch.setattr("hermes_cli.gateway.find_gateway_pids", lambda: [1])
+        monkeypatch.setattr("hermes_cli.colors.should_use_color", lambda: True)
+        create_job(prompt="Daily digest", schedule="every 1h")
+        jobs = load_jobs()
+        jobs[0]["last_run_at"] = "2026-09-01T09:00:00+00:00"
+        jobs[0]["last_status"] = "ok"
+        save_jobs(jobs)
+
+        cron_command(Namespace(cron_command="list", all=True))
+
+        out = capsys.readouterr().out
+        last_run_line = next(l for l in out.splitlines() if "Last run:" in l)
+        assert f"{cron_cli.Colors.GREEN}ok" in last_run_line
+        assert "delivery_failed" not in last_run_line
+
+
 class TestGatewayNotRunningWarning:
     """`cron create` / `cron list` must warn when the gateway (and thus the
     cron ticker) isn't running, since jobs only fire inside the gateway.
@@ -446,3 +548,41 @@ class TestCronRunBackgroundDispatch:
         assert rc == 0
         assert "Running in background (delegation del-xyz)." in out
         assert "failed" not in out.lower()
+
+
+class TestSlashCronListLastStatus:
+    """The in-chat ``/cron list`` (cli_commands_mixin) renders every
+    ``last_status`` literal explicitly — ``delivery_failed`` names the delivery
+    reason (last_error is None for those runs) instead of printing the bare
+    literal next to a run that looks otherwise fine."""
+
+    def _run_list(self, tmp_cron_dir, capsys):
+        from hermes_cli.cli_commands_mixin import CLICommandsMixin
+
+        class _Host(CLICommandsMixin):
+            pass
+
+        _Host()._handle_cron_command("/cron list --all")
+        return capsys.readouterr().out
+
+    def test_delivery_failed_names_the_delivery_error(self, tmp_cron_dir, capsys):
+        create_job(prompt="Nightly brief", schedule="every 1h", deliver="telegram:1")
+        jobs = load_jobs()
+        jobs[0]["last_run_at"] = "2026-09-01T07:00:00+00:00"
+        jobs[0]["last_status"] = "delivery_failed"
+        jobs[0]["last_error"] = None
+        jobs[0]["last_delivery_error"] = "telegram: 502 Bad Gateway"
+        save_jobs(jobs)
+
+        out = self._run_list(tmp_cron_dir, capsys)
+        assert "Last run: 2026-09-01T07:00:00+00:00 (delivery_failed: telegram: 502 Bad Gateway)" in out
+
+    def test_ok_stays_plain(self, tmp_cron_dir, capsys):
+        create_job(prompt="Nightly brief", schedule="every 1h")
+        jobs = load_jobs()
+        jobs[0]["last_run_at"] = "2026-09-01T07:00:00+00:00"
+        jobs[0]["last_status"] = "ok"
+        save_jobs(jobs)
+
+        out = self._run_list(tmp_cron_dir, capsys)
+        assert "(ok)" in out
diff --git a/tests/hermes_cli/test_cron_fire_dashboard.py b/tests/hermes_cli/test_cron_fire_dashboard.py
index aa898bf78e..d6d406398d 100644
--- a/tests/hermes_cli/test_cron_fire_dashboard.py
+++ b/tests/hermes_cli/test_cron_fire_dashboard.py
@@ -250,6 +250,41 @@ def test_fire_endpoint_multiplex_profile_prefix(tmp_path, monkeypatch):
     assert url == "http://127.0.0.1:8642/p/worker_alpha/api/cron/fire"
 
 
+def test_fire_endpoint_multiplex_reads_port_from_default_listener(tmp_path, monkeypatch):
+    """Multiplex mode: only the DEFAULT profile's api_server is bound, so a
+    secondary's fire URL must use the default home's port — not the
+    secondary's own config.yaml/.env port, which nothing listens on
+    (PR #84755). Real config files, real load_config()."""
+    default_home = tmp_path / "root"
+    worker_home = default_home / "profiles" / "worker_alpha"
+    default_home.mkdir()
+    worker_home.mkdir(parents=True)
+    (default_home / "config.yaml").write_text(
+        "gateway:\n  multiplex_profiles: true\n"
+        "platforms:\n  api_server:\n    extra:\n      port: 8650\n",
+        encoding="utf-8",
+    )
+    (worker_home / "config.yaml").write_text(
+        "platforms:\n  api_server:\n    enabled: false\n    extra:\n      port: 8702\n",
+        encoding="utf-8",
+    )
+    (worker_home / ".env").write_text("API_SERVER_PORT=8701\n", encoding="utf-8")
+    monkeypatch.setenv("HERMES_HOME", str(default_home))
+    monkeypatch.delenv("API_SERVER_PORT", raising=False)
+    monkeypatch.delenv("GATEWAY_MULTIPLEX_PROFILES", raising=False)
+    monkeypatch.setattr(web_server, "_cron_default_profile", lambda: "default")
+
+    url = web_server._gateway_fire_endpoint("worker_alpha", worker_home)
+
+    assert url == "http://127.0.0.1:8650/p/worker_alpha/api/cron/fire"
+    # The GATEWAY_MULTIPLEX_PROFILES env override is still honored (parity
+    # with gateway/config.py): forcing it off restores per-profile routing.
+    monkeypatch.setenv("GATEWAY_MULTIPLEX_PROFILES", "0")
+    assert web_server._gateway_fire_endpoint("worker_alpha", worker_home) == (
+        "http://127.0.0.1:8702/api/cron/fire"
+    )
+
+
 # ── OOF-266: intentional-stop drop + Retry-After on transient 503 ─────────
 
 
diff --git a/tests/hermes_cli/test_cross_profile_kill_refusal.py b/tests/hermes_cli/test_cross_profile_kill_refusal.py
new file mode 100644
index 0000000000..7b05e98d65
--- /dev/null
+++ b/tests/hermes_cli/test_cross_profile_kill_refusal.py
@@ -0,0 +1,217 @@
+"""Cross-profile kill refusal regression tests (#89315).
+
+A poisoned/contaminated ``gateway.pid`` inside one profile's HERMES_HOME can
+truthfully name ANOTHER profile's live gateway (its ``hermes_home`` stamp
+records the real owner).  ``gateway stop`` / the restart force-kill escalation
+/ ``profile delete`` must refuse to signal such a PID instead of starting the
+mutual cross-profile SIGTERM restart loop from the issue report.
+
+These tests exercise the REAL code paths against real PID files, a real
+flock-held gateway lock, and a real dummy child process — no mocks of the
+code under test.
+"""
+
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import pytest
+
+from gateway.status import recorded_gateway_home_conflicts
+
+
+def _spawn_gateway_lookalike(bin_dir: Path, lock_path: Path) -> subprocess.Popen:
+    """Real child process whose argv matches the gateway runtime matcher."""
+    bin_dir.mkdir(parents=True, exist_ok=True)
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    script = bin_dir / "hermes"
+    if sys.platform == "win32":
+        body = "import time\ntime.sleep(120)\n"
+    else:
+        body = (
+            "import fcntl, time\n"
+            f"fh = open({str(lock_path)!r}, 'a+')\n"
+            "fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)\n"
+            "time.sleep(120)\n"
+        )
+    script.write_text(f"#!{sys.executable}\n{body}", encoding="utf-8")
+    if sys.platform != "win32":
+        script.chmod(0o755)
+        cmd = [str(script), "gateway", "run"]
+    else:
+        cmd = [sys.executable, str(script), "gateway", "run"]
+    proc = subprocess.Popen(
+        cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+    )
+    deadline = time.monotonic() + 10.0
+    while time.monotonic() < deadline and not lock_path.exists():
+        if proc.poll() is not None:
+            raise RuntimeError("gateway lookalike died at startup")
+        time.sleep(0.05)
+    return proc
+
+
+def _pid_record(proc: subprocess.Popen, script: Path, owner_home: Path) -> dict:
+    from gateway.status import get_process_start_time
+
+    return {
+        "pid": proc.pid,
+        "kind": "hermes-gateway",
+        "argv": [str(script), "gateway", "run"],
+        "start_time": get_process_start_time(proc.pid),
+        "hermes_home": str(owner_home),
+    }
+
+
+class TestRecordedGatewayHomeConflicts:
+    def test_conflicting_home_detected(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path / "profiles" / "tim"))
+        record = {"pid": 1, "hermes_home": str(tmp_path)}
+        assert recorded_gateway_home_conflicts(record) is True
+
+    def test_same_home_accepted(self, tmp_path, monkeypatch):
+        home = tmp_path / "profiles" / "tim"
+        monkeypatch.setenv("HERMES_HOME", str(home))
+        record = {"pid": 1, "hermes_home": str(home)}
+        assert recorded_gateway_home_conflicts(record) is False
+
+    def test_legacy_record_without_home_proves_nothing(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+        assert recorded_gateway_home_conflicts({"pid": 1}) is False
+        assert recorded_gateway_home_conflicts(None) is False
+        assert recorded_gateway_home_conflicts({"pid": 1, "hermes_home": "  "}) is False
+
+    def test_expected_home_override(self, tmp_path):
+        target = tmp_path / "profiles" / "tim"
+        record = {"pid": 1, "hermes_home": str(tmp_path)}
+        assert (
+            recorded_gateway_home_conflicts(record, expected_home=target) is True
+        )
+        assert (
+            recorded_gateway_home_conflicts(record, expected_home=tmp_path) is False
+        )
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX flock harness")
+class TestCrossProfileStopRefusal:
+    def test_stop_profile_gateway_refuses_other_profiles_pid(
+        self, tmp_path, monkeypatch
+    ):
+        """Profile B's ``gateway stop`` must not SIGTERM profile A's gateway.
+
+        On main this path is already safe upstream of any guard:
+        ``get_running_pid()`` filters a pid record owned by another profile
+        (and unlinks the poisoned pid file) before ``stop_profile_gateway``
+        ever sees a pid — so the contract here is "returns False, other
+        profile's process untouched, poisoned pid file gone", not a printed
+        refusal.
+        """
+        root_home = tmp_path / "root-home"
+        tim_home = tmp_path / "root-home" / "profiles" / "tim"
+        tim_home.mkdir(parents=True)
+        monkeypatch.setenv("HERMES_HOME", str(tim_home))
+
+        proc = _spawn_gateway_lookalike(
+            tmp_path / "bin", tim_home / "gateway.lock"
+        )
+        try:
+            record = _pid_record(proc, tmp_path / "bin" / "hermes", root_home)
+            (tim_home / "gateway.pid").write_text(json.dumps(record))
+
+            from hermes_cli import gateway as gateway_cli
+
+            assert gateway_cli.stop_profile_gateway() is False
+            assert not (tim_home / "gateway.pid").exists(), (
+                "poisoned cross-profile pid file should have been unlinked"
+            )
+            time.sleep(0.5)
+            assert proc.poll() is None, (
+                "cross-profile SIGTERM fired: profile A's gateway was killed"
+            )
+        finally:
+            proc.kill()
+            proc.wait(timeout=10)
+
+    def test_stop_profile_gateway_still_stops_own_gateway(
+        self, tmp_path, monkeypatch
+    ):
+        """Same-home records keep stopping normally (no false refusal)."""
+        tim_home = tmp_path / "profiles" / "tim"
+        tim_home.mkdir(parents=True)
+        monkeypatch.setenv("HERMES_HOME", str(tim_home))
+
+        proc = _spawn_gateway_lookalike(
+            tmp_path / "bin", tim_home / "gateway.lock"
+        )
+        try:
+            record = _pid_record(proc, tmp_path / "bin" / "hermes", tim_home)
+            (tim_home / "gateway.pid").write_text(json.dumps(record))
+
+            from hermes_cli import gateway as gateway_cli
+
+            assert gateway_cli.stop_profile_gateway() is True
+            deadline = time.monotonic() + 15.0
+            while time.monotonic() < deadline and proc.poll() is None:
+                time.sleep(0.1)
+            assert proc.poll() is not None, "own gateway was not stopped"
+        finally:
+            if proc.poll() is None:
+                proc.kill()
+            proc.wait(timeout=10)
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX flock harness")
+class TestProfileDeleteStopRefusal:
+    def test_stop_gateway_process_refuses_other_profiles_pid(
+        self, tmp_path, capsys
+    ):
+        """``profile delete`` must not kill a gateway owned by another home."""
+        root_home = tmp_path / "root-home"
+        tim_home = root_home / "profiles" / "tim"
+        tim_home.mkdir(parents=True)
+
+        proc = _spawn_gateway_lookalike(
+            tmp_path / "bin", tim_home / "gateway.lock"
+        )
+        try:
+            record = _pid_record(proc, tmp_path / "bin" / "hermes", root_home)
+            (tim_home / "gateway.pid").write_text(json.dumps(record))
+
+            from hermes_cli.profiles import _stop_gateway_process
+
+            _stop_gateway_process(tim_home)
+            out = capsys.readouterr().out
+            assert "Refusing to stop" in out
+            time.sleep(0.5)
+            assert proc.poll() is None, (
+                "profile delete killed another profile's gateway"
+            )
+        finally:
+            proc.kill()
+            proc.wait(timeout=10)
+
+    def test_stop_gateway_process_still_stops_own_gateway(self, tmp_path):
+        tim_home = tmp_path / "profiles" / "tim"
+        tim_home.mkdir(parents=True)
+
+        proc = _spawn_gateway_lookalike(
+            tmp_path / "bin", tim_home / "gateway.lock"
+        )
+        try:
+            record = _pid_record(proc, tmp_path / "bin" / "hermes", tim_home)
+            (tim_home / "gateway.pid").write_text(json.dumps(record))
+
+            from hermes_cli.profiles import _stop_gateway_process
+
+            _stop_gateway_process(tim_home)
+            deadline = time.monotonic() + 15.0
+            while time.monotonic() < deadline and proc.poll() is None:
+                time.sleep(0.1)
+            assert proc.poll() is not None, "own gateway was not stopped"
+        finally:
+            if proc.poll() is None:
+                proc.kill()
+            proc.wait(timeout=10)
diff --git a/tests/hermes_cli/test_desktop_exe_integrity.py b/tests/hermes_cli/test_desktop_exe_integrity.py
index 6e9d3dd06e..bdff61e62a 100644
--- a/tests/hermes_cli/test_desktop_exe_integrity.py
+++ b/tests/hermes_cli/test_desktop_exe_integrity.py
@@ -277,8 +277,12 @@ def _ns(**kw):
 @pytest.mark.windows_only
 def test_build_only_fails_when_pack_produces_corrupt_exe(tmp_path, monkeypatch, capsys):
     """The updater chain's contract: a rebuild whose Hermes.exe cannot launch
-    must exit nonzero (so hermes-setup's retry-once kicks in) and must restore
-    the previous working build instead of leaving the corrupt one.
+    must exit nonzero (so hermes-setup's retry-once kicks in) and must leave
+    the previous working build in place instead of installing the corrupt one.
+
+    Stage-and-swap (#86443): the pack lands in a staging dir; the integrity
+    gate runs on the STAGED exe and a failure discards staging without ever
+    touching the live ``win-unpacked`` tree.
 
     ``windows_only``: the whole chain is Windows-gated — ``win-unpacked``
     candidate discovery in ``_desktop_packaged_executable`` and the integrity
@@ -290,12 +294,20 @@ def test_build_only_fails_when_pack_produces_corrupt_exe(tmp_path, monkeypatch,
     (desktop_dir / "package.json").write_text("{}", encoding="utf-8")
     monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
 
-    exe = desktop_dir / "release" / "win-unpacked" / "Hermes.exe"
-    make_pe(exe, PE_AMD64, truncate_to=0x300)  # what the failed pack produced
-    make_pe(desktop_dir / "release" / "win-unpacked.bak" / "Hermes.exe", PE_AMD64)
+    live_exe = desktop_dir / "release" / "win-unpacked" / "Hermes.exe"
+    make_pe(live_exe, PE_AMD64)  # the previous, working app
+    live_bytes = live_exe.read_bytes()
 
     install_ok = subprocess.CompletedProcess(["npm", "ci"], 0)
-    pack_ok = subprocess.CompletedProcess(["npm", "run", "pack"], 0)
+
+    def pack_into_staging(cmd, *args, **kwargs):
+        # electron-builder honours -c.directories.output=<staging>; emulate a
+        # pack that "succeeds" but writes a truncated exe there.
+        out_flag = next((a for a in cmd if str(a).startswith("-c.directories.output=")), None)
+        assert out_flag is not None, "pack must be redirected into a staging dir"
+        staging = Path(str(out_flag).split("=", 1)[1])
+        make_pe(staging / "win-unpacked" / "Hermes.exe", PE_AMD64, truncate_to=0x300)
+        return subprocess.CompletedProcess(list(cmd), 0)
 
     with patch("hermes_cli.main.shutil.which", return_value="/usr/bin/npm"), \
          patch("hermes_cli.main._resolve_node_runtime_npm", return_value="npm.cmd"), \
@@ -306,16 +318,17 @@ def test_build_only_fails_when_pack_produces_corrupt_exe(tmp_path, monkeypatch,
          patch("hermes_cli.main._desktop_stamp_path", return_value=tmp_path / "stamp.json"), \
          patch("hermes_cli.main._write_desktop_build_stamp") as mock_stamp, \
          patch("hermes_cli.main._windows_native_machine", return_value="AMD64"), \
-         patch("hermes_cli.main.subprocess.run", return_value=pack_ok), \
+         patch("hermes_cli.main.subprocess.run", side_effect=pack_into_staging), \
          pytest.raises(SystemExit) as exc:
         cli_main.cmd_gui(_ns())
 
     assert exc.value.code == 1
-    # The previous working exe was restored...
-    assert cli_main._parse_pe_machine(exe) == PE_AMD64
+    # The previous working exe was never touched...
+    assert live_exe.read_bytes() == live_bytes
+    assert cli_main._parse_pe_machine(live_exe) == PE_AMD64
+    # ...the staged corrupt tree was discarded...
+    assert not list((desktop_dir / "release").glob(".staging-*"))
     # ...and the poisoned build was never stamped as good.
     mock_stamp.assert_not_called()
     out = capsys.readouterr().out
     assert "integrity check" in out
-
-
diff --git a/tests/hermes_cli/test_desktop_local_flag.py b/tests/hermes_cli/test_desktop_local_flag.py
new file mode 100644
index 0000000000..c581705ebd
--- /dev/null
+++ b/tests/hermes_cli/test_desktop_local_flag.py
@@ -0,0 +1,39 @@
+"""The desktop subcommand's --local launch flag.
+
+Local models ship on main behind this flag: `hermes desktop --local` (or
+`Hermes.exe --local` directly) shows the local-models GUI surfaces; without
+it the desktop hides them all, even when local models are configured. These
+tests pin the argparse contract; the pass-through to the Electron argv lives
+in cmd_gui's launch paths.
+"""
+
+import argparse
+
+from hermes_cli.subcommands.gui import build_gui_parser
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="hermes")
+    subparsers = parser.add_subparsers(dest="command")
+    build_gui_parser(subparsers, cmd_gui=lambda args: None)
+
+    return parser
+
+
+def test_local_flag_parses():
+    args = _parser().parse_args(["desktop", "--local"])
+
+    assert args.local is True
+
+
+def test_local_flag_defaults_off():
+    args = _parser().parse_args(["desktop"])
+
+    assert args.local is False
+
+
+def test_local_flag_composes_with_build_flags():
+    args = _parser().parse_args(["desktop", "--local", "--force-build"])
+
+    assert args.local is True
+    assert args.force_build is True
diff --git a/tests/hermes_cli/test_doctor.py b/tests/hermes_cli/test_doctor.py
index 9e37dc2cc2..267388f369 100644
--- a/tests/hermes_cli/test_doctor.py
+++ b/tests/hermes_cli/test_doctor.py
@@ -285,18 +285,34 @@ def test_doctor_reports_vercel_backend_diagnostics(monkeypatch, tmp_path):
 class TestDoctorMemoryProviderSection:
     """The ◆ Memory Provider section should respect memory.provider config."""
 
-    def _make_hermes_home(self, tmp_path, provider=""):
+    def _make_hermes_home(self, tmp_path, provider="", memory_config=None):
         """Create a minimal HERMES_HOME with config.yaml."""
         home = tmp_path / ".hermes"
         home.mkdir(parents=True, exist_ok=True)
         import yaml
-        config = {"memory": {"provider": provider}} if provider else {"memory": {}}
+        config = dict(memory_config or {})
+        if provider:
+            config["provider"] = provider
+        config = {"memory": config}
         (home / "config.yaml").write_text(yaml.dump(config))
         return home
 
-    def _run_doctor_and_capture(self, monkeypatch, tmp_path, provider=""):
+    def _run_doctor_and_capture(
+        self,
+        monkeypatch,
+        tmp_path,
+        provider="",
+        *,
+        memory_config=None,
+        stale_builtin_files=False,
+    ):
         """Run doctor and capture stdout."""
-        home = self._make_hermes_home(tmp_path, provider)
+        home = self._make_hermes_home(tmp_path, provider, memory_config)
+        if stale_builtin_files:
+            memories = home / "memories"
+            memories.mkdir()
+            (memories / "MEMORY.md").write_text("stale memory", encoding="utf-8")
+            (memories / "USER.md").write_text("stale user", encoding="utf-8")
         monkeypatch.setattr(doctor_mod, "HERMES_HOME", home)
         monkeypatch.setattr(doctor_mod, "PROJECT_ROOT", tmp_path / "project")
         monkeypatch.setattr(doctor_mod, "_DHH", str(home))
@@ -340,6 +356,26 @@ class TestDoctorMemoryProviderSection:
         assert "Memory Provider" in out
         assert "Built-in memory active" not in out
 
+    @pytest.mark.parametrize("memory_enabled", [False, True])
+    def test_stale_builtin_files_reported_only_when_store_enabled(
+        self, monkeypatch, tmp_path, memory_enabled
+    ):
+        # #100668: disabled built-in stores must not surface stale files as active.
+        out = self._run_doctor_and_capture(
+            monkeypatch,
+            tmp_path,
+            provider="mnemosyne",
+            memory_config={
+                "memory_enabled": memory_enabled,
+                "user_profile_enabled": False,
+            },
+            stale_builtin_files=True,
+        )
+
+        assert ("MEMORY.md exists" in out) is memory_enabled
+        assert "USER.md exists" not in out
+        assert ("Built-in memory files disabled by config" in out) is not memory_enabled
+
 
 def test_run_doctor_termux_treats_docker_and_browser_warnings_as_expected(monkeypatch, tmp_path):
     helper = TestDoctorMemoryProviderSection()
diff --git a/tests/hermes_cli/test_dump_env_visibility.py b/tests/hermes_cli/test_dump_env_visibility.py
index 40feba0cec..ba98cfa3a5 100644
--- a/tests/hermes_cli/test_dump_env_visibility.py
+++ b/tests/hermes_cli/test_dump_env_visibility.py
@@ -47,6 +47,7 @@ def test_dump_leaves_unset_key_untouched(monkeypatch, capsys, tmp_path):
 
     monkeypatch.setattr(dump, "get_project_root", lambda: tmp_path / "noproject")
     monkeypatch.delenv("KEENABLE_API_KEY", raising=False)
+    monkeypatch.delenv("TAVILY_API_KEY", raising=False)
 
     home = get_hermes_home()
     home.mkdir(parents=True, exist_ok=True)
diff --git a/tests/hermes_cli/test_external_process_auth_status.py b/tests/hermes_cli/test_external_process_auth_status.py
new file mode 100644
index 0000000000..221459b10d
--- /dev/null
+++ b/tests/hermes_cli/test_external_process_auth_status.py
@@ -0,0 +1,292 @@
+"""Tests for external-process provider auth status and Accounts-tab wiring.
+
+Covers the copilot-acp fix class:
+  * ``get_auth_status()`` dispatches on ``auth_type == "external_process"``
+    (not a hardcoded slug), so future ACP-style providers inherit the
+    behaviour automatically.
+  * ``auth_verified``/``auth_source`` carry positive credential evidence
+    (env token or on-disk GitHub Copilot credential store) while remaining
+    honest — no evidence means unknown, never "signed out".
+  * The Accounts-tab sign-in ``cli_command`` reflects the executable the
+    user actually configured (``HERMES_COPILOT_ACP_COMMAND`` /
+    ``COPILOT_CLI_PATH``), and its default is a valid Copilot CLI
+    invocation (``copilot login`` — ``copilot /login`` is not a command).
+"""
+
+import os
+
+import pytest
+
+from hermes_cli.auth import (
+    get_auth_status,
+    get_external_process_provider_status,
+)
+
+
+@pytest.fixture()
+def _clean_copilot_env(monkeypatch):
+    """Neutralize host state so tests pin behaviour, not this machine."""
+    for var in (
+        "COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN",
+        "HERMES_COPILOT_ACP_COMMAND", "COPILOT_CLI_PATH",
+        "HERMES_COPILOT_ACP_ARGS", "COPILOT_ACP_BASE_URL",
+    ):
+        monkeypatch.delenv(var, raising=False)
+
+
+# --- get_auth_status dispatches on auth_type, not slug ----------------------
+
+
+def test_get_auth_status_dispatches_external_process_by_auth_type(
+    tmp_path, monkeypatch, _clean_copilot_env
+):
+    fake = tmp_path / ("copilot.exe" if os.name == "nt" else "copilot")
+    fake.write_text("", encoding="utf-8")
+    fake.chmod(0o755)
+    monkeypatch.setenv("HERMES_COPILOT_ACP_COMMAND", str(fake))
+    # Point HOME somewhere empty so on-disk credential stores don't leak in.
+    monkeypatch.setenv("HOME", str(tmp_path))
+
+    status = get_auth_status("copilot-acp")
+
+    # The external_process status shape, not the {"logged_in": False}
+    # fallthrough — proves the dispatcher reached the right branch.
+    assert status.get("provider") == "copilot-acp"
+    assert status.get("configured") is True
+    assert status.get("resolved_command") == str(fake)
+    assert "auth_verified" in status
+
+
+def test_external_process_status_rejects_wrong_auth_type():
+    # A provider that exists but is not external_process must be refused —
+    # the generic dispatcher relies on this guard.
+    assert get_external_process_provider_status("openrouter") == {"configured": False}
+    assert get_external_process_provider_status("no-such-provider") == {"configured": False}
+
+
+# --- auth_verified: positive evidence only ----------------------------------
+
+
+def test_auth_verified_false_without_evidence(tmp_path, monkeypatch, _clean_copilot_env):
+    monkeypatch.setenv("HOME", str(tmp_path))  # no ~/.config/github-copilot
+    status = get_external_process_provider_status("copilot-acp")
+    assert status["auth_verified"] is False
+    assert status["auth_source"] is None
+
+
+def test_auth_verified_from_supported_env_token(tmp_path, monkeypatch, _clean_copilot_env):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("GH_TOKEN", "gho_" + "x" * 36)  # supported OAuth prefix
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is True
+    assert status["auth_source"] == "env: GH_TOKEN"
+
+
+def test_classic_pat_is_not_login_evidence(tmp_path, monkeypatch, _clean_copilot_env):
+    # ghp_* classic PATs are rejected by the Copilot API — presence of one
+    # must not be presented as a working login.
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("GH_TOKEN", "ghp_" + "x" * 36)
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is False
+
+
+def test_auth_verified_from_on_disk_credential_store(tmp_path, monkeypatch, _clean_copilot_env):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    store = tmp_path / ".config" / "github-copilot"
+    store.mkdir(parents=True)
+    (store / "hosts.json").write_text(
+        '{"github.com": {"oauth_token": "gho_test"}}', encoding="utf-8"
+    )
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is True
+    assert status["auth_source"] == "~/.config/github-copilot/hosts.json"
+
+
+def test_empty_credential_store_is_not_evidence(tmp_path, monkeypatch, _clean_copilot_env):
+    monkeypatch.setenv("HOME", str(tmp_path))
+    store = tmp_path / ".config" / "github-copilot"
+    store.mkdir(parents=True)
+    (store / "hosts.json").write_text("{}", encoding="utf-8")  # logged out
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is False
+
+
+def test_auth_verified_from_copilot_cli_plaintext_store(tmp_path, monkeypatch, _clean_copilot_env):
+    # `copilot login` without an OS keychain writes the token into
+    # ~/.copilot/config.json (JSONC, with //-comment header lines).
+    monkeypatch.setenv("HOME", str(tmp_path))
+    cfg_dir = tmp_path / ".copilot"
+    cfg_dir.mkdir()
+    (cfg_dir / "config.json").write_text(
+        "// User settings belong in settings.json.\n"
+        "// This file is managed automatically.\n"
+        "{\n"
+        '  "copilotTokens": {"https://github.com:someuser": "gho_test"},\n'
+        '  "lastLoggedInUser": {"host": "https://github.com", "login": "someuser"}\n'
+        "}\n",
+        encoding="utf-8",
+    )
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is True
+    assert status["auth_source"] == "~/.copilot/config.json"
+
+
+def test_copilot_cli_store_without_tokens_is_not_evidence(tmp_path, monkeypatch, _clean_copilot_env):
+    # A config.json exists after first launch even before any login —
+    # its presence alone must not read as signed-in.
+    monkeypatch.setenv("HOME", str(tmp_path))
+    cfg_dir = tmp_path / ".copilot"
+    cfg_dir.mkdir()
+    (cfg_dir / "config.json").write_text(
+        '// managed\n{"firstLaunchAt": "2026-01-01T00:00:00Z", "copilotTokens": {}}\n',
+        encoding="utf-8",
+    )
+
+    status = get_external_process_provider_status("copilot-acp")
+
+    assert status["auth_verified"] is False
+
+
+# --- desktop picker explicit-only filter ------------------------------------
+
+
+def test_explicit_filter_keeps_signed_in_external_process_row(tmp_path, monkeypatch, _clean_copilot_env):
+    # A verified CLI login leaves no trace in active_provider/config/env —
+    # the explicit-only desktop filter must treat it like the Anthropic OAuth
+    # carve-out and keep the row.
+    from hermes_cli.inventory import _filter_explicit_provider_rows
+
+    monkeypatch.setenv("HOME", str(tmp_path))
+    cfg_dir = tmp_path / ".copilot"
+    cfg_dir.mkdir()
+    (cfg_dir / "config.json").write_text(
+        '{"copilotTokens": {"https://github.com:u": "gho_test"}}', encoding="utf-8"
+    )
+
+    class _Ctx:
+        current_provider = "nous"
+
+    rows = [{"slug": "copilot-acp", "models": ["gpt-5.4"]}]
+    kept = _filter_explicit_provider_rows(rows, _Ctx())
+
+    assert any(r["slug"] == "copilot-acp" for r in kept), \
+        "signed-in copilot-acp must survive the explicit-only picker filter"
+
+
+def test_explicit_filter_drops_unverified_external_process_row(tmp_path, monkeypatch, _clean_copilot_env):
+    # Merely having the executable on PATH is ambient discovery, not an
+    # explicit configuration — the desktop filter keeps its narrower contract.
+    from hermes_cli.inventory import _filter_explicit_provider_rows
+
+    monkeypatch.setenv("HOME", str(tmp_path))  # no credential stores
+
+    class _Ctx:
+        current_provider = "nous"
+
+    rows = [{"slug": "copilot-acp", "models": ["gpt-5.4"]}]
+    kept = _filter_explicit_provider_rows(rows, _Ctx())
+
+    assert all(r["slug"] != "copilot-acp" for r in kept)
+
+
+# --- Accounts-tab cli_command ------------------------------------------------
+
+
+def test_catalog_sign_in_command_is_a_valid_copilot_invocation():
+    from hermes_cli.web_server import _OAUTH_PROVIDER_CATALOG
+
+    entry = next(e for e in _OAUTH_PROVIDER_CATALOG if e["id"] == "copilot-acp")
+    # `copilot /login` is not a valid invocation — slash-commands only exist
+    # inside an interactive session. The catalog must hand users a command
+    # that actually starts a login flow.
+    assert entry["cli_command"] == "copilot login"
+
+
+def test_cli_command_reflects_configured_executable(tmp_path, monkeypatch, _clean_copilot_env):
+    from hermes_cli.web_server import _external_process_cli_command
+
+    fake = tmp_path / ("copilot.exe" if os.name == "nt" else "copilot")
+    fake.write_text("", encoding="utf-8")
+    fake.chmod(0o755)
+    monkeypatch.setenv("HERMES_COPILOT_ACP_COMMAND", str(fake))
+
+    rendered = _external_process_cli_command("copilot-acp", "copilot login")
+
+    assert rendered == f"{fake} login"
+
+
+def test_cli_command_untouched_for_non_external_providers(_clean_copilot_env):
+    from hermes_cli.web_server import _external_process_cli_command
+
+    assert _external_process_cli_command("nous", "hermes auth add nous") == "hermes auth add nous"
+
+
+def test_cli_command_default_when_no_override(monkeypatch, _clean_copilot_env):
+    from hermes_cli.web_server import _external_process_cli_command
+
+    assert _external_process_cli_command("copilot-acp", "copilot login") == "copilot login"
+
+
+# --- live catalog key from the Copilot CLI store -----------------------------
+
+
+def test_catalog_key_resolves_from_copilot_cli_store(tmp_path, monkeypatch, _clean_copilot_env):
+    # A user whose ONLY credential is `copilot login` must still get the live
+    # model catalog — otherwise the picker silently falls back to the stale
+    # curated list (visibly wrong vs. what their subscription serves).
+    from unittest.mock import patch as mock_patch
+
+    from hermes_cli import models as models_mod
+
+    monkeypatch.setenv("HOME", str(tmp_path))
+    cfg_dir = tmp_path / ".copilot"
+    cfg_dir.mkdir()
+    (cfg_dir / "config.json").write_text(
+        "// managed\n"
+        '{"copilotTokens": {"https://github.com:u": "gho_' + "x" * 36 + '"}}\n',
+        encoding="utf-8",
+    )
+
+    with mock_patch.object(
+        models_mod, "_resolve_copilot_catalog_api_key", wraps=models_mod._resolve_copilot_catalog_api_key
+    ), mock_patch(
+        "hermes_cli.copilot_auth.exchange_copilot_token",
+        return_value=("exchanged-api-token", 0.0, None),
+    ), mock_patch(
+        "hermes_cli.auth.resolve_api_key_provider_credentials",
+        side_effect=Exception("no env creds"),
+    ), mock_patch(
+        "hermes_cli.auth.read_credential_pool", return_value=[]
+    ):
+        key = models_mod._resolve_copilot_catalog_api_key()
+
+    assert key == "exchanged-api-token"
+
+
+def test_catalog_key_empty_when_cli_store_absent(tmp_path, monkeypatch, _clean_copilot_env):
+    from unittest.mock import patch as mock_patch
+
+    from hermes_cli import models as models_mod
+
+    monkeypatch.setenv("HOME", str(tmp_path))  # no ~/.copilot at all
+
+    with mock_patch(
+        "hermes_cli.auth.resolve_api_key_provider_credentials",
+        side_effect=Exception("no env creds"),
+    ), mock_patch(
+        "hermes_cli.auth.read_credential_pool", return_value=[]
+    ):
+        key = models_mod._resolve_copilot_catalog_api_key()
+
+    assert key == ""
diff --git a/tests/hermes_cli/test_fast_serve_launch.py b/tests/hermes_cli/test_fast_serve_launch.py
new file mode 100644
index 0000000000..a0f3961596
--- /dev/null
+++ b/tests/hermes_cli/test_fast_serve_launch.py
@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import argparse
+import sys
+
+import hermes_cli.config as config_mod
+import hermes_cli.main as main_mod
+from hermes_cli.subcommands.dashboard import build_dashboard_parser, build_serve_parser
+
+
+def _capture(_args) -> None:
+    return None
+
+
+def test_lean_serve_parser_matches_full_subcommand_parser() -> None:
+    root = argparse.ArgumentParser()
+    subparsers = root.add_subparsers(dest="command")
+    build_dashboard_parser(subparsers, cmd_dashboard=_capture, cmd_dashboard_register=_capture)
+    lean = build_serve_parser(cmd_dashboard=_capture)
+
+    argv = [
+        "--host", "127.0.0.1", "--port", "0", "--no-open",
+        "--ssh-session-token-file", "token.txt", "--ssh-owner-nonce", "0123456789abcdef",
+    ]
+
+    assert vars(lean.parse_args(argv)) == vars(root.parse_args(["serve", *argv]))
+
+
+def test_fast_serve_launch_dispatches_only_unambiguous_serve(monkeypatch) -> None:
+    captured = []
+    monkeypatch.setattr(config_mod, "get_container_exec_info", lambda: None)
+    monkeypatch.setattr(main_mod, "cmd_dashboard", captured.append)
+
+    monkeypatch.setattr(sys, "argv", ["hermes", "serve", "--host", "127.0.0.1", "--port", "0"])
+    assert main_mod._try_fast_serve_launch() is True
+    assert (captured[0].command, captured[0].headless_backend, captured[0].no_open, captured[0].port) == (
+        "serve", True, True, 0,
+    )
+
+    # Every ambiguous shape falls back to the full parser: unknown flags,
+    # help, the opt-out, and container routing.
+    for argv in (["serve", "--future-flag"], ["serve", "--help"], ["chat"]):
+        monkeypatch.setattr(sys, "argv", ["hermes", *argv])
+        assert main_mod._try_fast_serve_launch() is False
+    monkeypatch.setenv("HERMES_DISABLE_FAST_SERVE_LAUNCH", "1")
+    monkeypatch.setattr(sys, "argv", ["hermes", "serve"])
+    assert main_mod._try_fast_serve_launch() is False
+    monkeypatch.delenv("HERMES_DISABLE_FAST_SERVE_LAUNCH")
+    monkeypatch.setattr(config_mod, "get_container_exec_info", lambda: {"name": "managed"})
+    assert main_mod._try_fast_serve_launch() is False
+    assert len(captured) == 1
diff --git a/tests/hermes_cli/test_gateway_job_teardown_live.py b/tests/hermes_cli/test_gateway_job_teardown_live.py
new file mode 100644
index 0000000000..e6245c10c6
--- /dev/null
+++ b/tests/hermes_cli/test_gateway_job_teardown_live.py
@@ -0,0 +1,335 @@
+"""LIVE Windows E2E for #48820 (4th repro): Job-Object teardown vs the
+gateway restart watcher, with real processes on a real windows-latest runner.
+
+Three live proofs (no mocks of the code under test):
+
+1. ``TestJobObjectMechanismLive`` — the mechanism everything rests on:
+   a child spawned with ``windows_detach_flags()`` (CREATE_BREAKAWAY_FROM_JOB)
+   from inside a kill-on-close Job Object SURVIVES the job teardown, while a
+   child spawned with ``windows_detach_flags_without_breakaway()`` is killed
+   by it. This is exactly the reporter's suspected kill path.
+
+2. ``TestWatcherRespawnLive`` — drives the REAL
+   ``hermes_cli.gateway._spawn_gateway_restart_watcher`` end to end with a
+   real stub gateway process, against a temp HERMES_HOME:
+   - the respawned process's stderr must land in ``logs/gateway-stdio.log``
+     (on unfixed main it went to DEVNULL: a job-teardown kill left ZERO trace);
+   - the respawn env must carry ``_HERMES_GATEWAY_BREAKAWAY=1`` (the stamp
+     that makes a later job-teardown death diagnosable in exit-diag).
+
+3. ``TestResumeVerificationLive`` — the user-visible symptom: the updater's
+   ``_resume_windows_gateways_after_update`` must NOT print
+   "✓ Restarting Windows gateway profile(s)" when the relaunched gateway is
+   dead. The relaunch chain runs for real; the "gateway" is a stub that exits
+   immediately (standing in for the job-teardown kill). On unfixed main the ✓
+   is printed anyway; after the fix the resume raises "not verified alive".
+"""
+
+from __future__ import annotations
+
+import ctypes
+import os
+import subprocess
+import sys
+import time
+from ctypes import wintypes
+from pathlib import Path
+
+import pytest
+
+pytestmark = [
+    pytest.mark.windows_only,
+    pytest.mark.skipif(sys.platform != "win32", reason="native Windows only"),
+]
+
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+
+JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000
+JOB_OBJECT_LIMIT_BREAKAWAY_OK = 0x00000800
+JobObjectExtendedLimitInformation = 9
+PROCESS_ALL_ACCESS = 0x001FFFFF
+
+
+class IO_COUNTERS(ctypes.Structure):
+    _fields_ = [
+        ("ReadOperationCount", ctypes.c_ulonglong),
+        ("WriteOperationCount", ctypes.c_ulonglong),
+        ("OtherOperationCount", ctypes.c_ulonglong),
+        ("ReadTransferCount", ctypes.c_ulonglong),
+        ("WriteTransferCount", ctypes.c_ulonglong),
+        ("OtherTransferCount", ctypes.c_ulonglong),
+    ]
+
+
+class JOBOBJECT_BASIC_LIMIT_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("PerProcessUserTimeLimit", ctypes.c_longlong),
+        ("PerJobUserTimeLimit", ctypes.c_longlong),
+        ("LimitFlags", wintypes.DWORD),
+        ("MinimumWorkingSetSize", ctypes.c_size_t),
+        ("MaximumWorkingSetSize", ctypes.c_size_t),
+        ("ActiveProcessLimit", wintypes.DWORD),
+        ("Affinity", ctypes.c_size_t),
+        ("PriorityClass", wintypes.DWORD),
+        ("SchedulingClass", wintypes.DWORD),
+    ]
+
+
+class JOBOBJECT_EXTENDED_LIMIT_INFORMATION(ctypes.Structure):
+    _fields_ = [
+        ("BasicLimitInformation", JOBOBJECT_BASIC_LIMIT_INFORMATION),
+        ("IoInfo", IO_COUNTERS),
+        ("ProcessMemoryLimit", ctypes.c_size_t),
+        ("JobMemoryLimit", ctypes.c_size_t),
+        ("PeakProcessMemoryUsed", ctypes.c_size_t),
+        ("PeakJobMemoryUsed", ctypes.c_size_t),
+    ]
+
+
+def _make_kill_on_close_job(allow_breakaway: bool) -> int:
+    kernel32 = ctypes.windll.kernel32
+    job = kernel32.CreateJobObjectW(None, None)
+    assert job, "CreateJobObjectW failed"
+    info = JOBOBJECT_EXTENDED_LIMIT_INFORMATION()
+    flags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+    if allow_breakaway:
+        flags |= JOB_OBJECT_LIMIT_BREAKAWAY_OK
+    info.BasicLimitInformation.LimitFlags = flags
+    ok = kernel32.SetInformationJobObject(
+        job,
+        JobObjectExtendedLimitInformation,
+        ctypes.byref(info),
+        ctypes.sizeof(info),
+    )
+    assert ok, "SetInformationJobObject failed"
+    return job
+
+
+def _assign_to_job(job: int, proc: subprocess.Popen) -> None:
+    kernel32 = ctypes.windll.kernel32
+    ok = kernel32.AssignProcessToJobObject(job, int(proc._handle))
+    assert ok, f"AssignProcessToJobObject failed (winerror={ctypes.GetLastError()})"
+
+
+def _pid_alive(pid: int) -> bool:
+    kernel32 = ctypes.windll.kernel32
+    PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+    h = kernel32.OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, pid)
+    if not h:
+        return False
+    try:
+        code = wintypes.DWORD()
+        kernel32.GetExitCodeProcess(h, ctypes.byref(code))
+        return code.value == 259  # STILL_ACTIVE
+    finally:
+        kernel32.CloseHandle(h)
+
+
+_SLEEPER = "import time; time.sleep(120)"
+
+
+def _wait_for(predicate, timeout_s: float = 30.0, interval_s: float = 0.25):
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if predicate():
+            return True
+        time.sleep(interval_s)
+    return False
+
+
+class TestJobObjectMechanismLive:
+    """Real Job Objects, real children — the #48820 kill mechanism."""
+
+    def _driver_source(self, flags_helper: str, pid_file: str) -> str:
+        # The driver runs INSIDE the job and spawns a grandchild "gateway"
+        # with the flag bundle under test, then exits — mirroring the
+        # updater/watcher exiting while its job tears down.
+        return (
+            "import subprocess, sys, pathlib\n"
+            "sys.path.insert(0, r'%s')\n"
+            "from hermes_cli._subprocess_compat import (\n"
+            "    windows_detach_flags, windows_detach_flags_without_breakaway)\n"
+            "flags = %s()\n"
+            "p = subprocess.Popen([sys.executable, '-c', %r],\n"
+            "    creationflags=flags, stdin=subprocess.DEVNULL,\n"
+            "    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n"
+            "pathlib.Path(r'%s').write_text(str(p.pid), encoding='utf-8')\n"
+        ) % (str(_REPO_ROOT), flags_helper, _SLEEPER, pid_file)
+
+    def _run_in_job(self, tmp_path: Path, flags_helper: str) -> int:
+        pid_file = tmp_path / f"{flags_helper}.pid"
+        job = _make_kill_on_close_job(allow_breakaway=True)
+        kernel32 = ctypes.windll.kernel32
+        try:
+            driver = subprocess.Popen(
+                [
+                    sys.executable,
+                    "-c",
+                    # Handshake: wait until the test has assigned us to the
+                    # job before spawning the grandchild.
+                    "import pathlib, sys, time\n"
+                    f"go = pathlib.Path(r'{tmp_path / 'go.marker'}')\n"
+                    "deadline = time.monotonic() + 30\n"
+                    "while not go.exists():\n"
+                    "    assert time.monotonic() < deadline, 'no go marker'\n"
+                    "    time.sleep(0.1)\n"
+                    + self._driver_source(flags_helper, str(pid_file)),
+                ],
+                cwd=str(_REPO_ROOT),
+            )
+            _assign_to_job(job, driver)
+            (tmp_path / "go.marker").write_text("go", encoding="utf-8")
+            assert _wait_for(pid_file.exists), "driver never wrote the pid file"
+            gw_pid = int(pid_file.read_text(encoding="utf-8"))
+            assert _wait_for(lambda: driver.poll() is not None), (
+                "driver did not exit"
+            )
+            assert _pid_alive(gw_pid), "grandchild died before job teardown"
+            # THE teardown: closing the last job handle fires
+            # KILL_ON_JOB_CLOSE against every process still in the job.
+            kernel32.CloseHandle(job)
+            job = None
+            time.sleep(2.0)
+            return gw_pid
+        finally:
+            (tmp_path / "go.marker").unlink(missing_ok=True)
+            if job:
+                kernel32.CloseHandle(job)
+
+    def test_breakaway_child_survives_job_teardown(self, tmp_path):
+        pid = self._run_in_job(tmp_path, "windows_detach_flags")
+        try:
+            assert _pid_alive(pid), (
+                "CREATE_BREAKAWAY_FROM_JOB child must survive the parent "
+                "job's kill-on-close teardown"
+            )
+        finally:
+            subprocess.run(
+                ["taskkill", "/PID", str(pid), "/T", "/F"], capture_output=True
+            )
+
+    def test_non_breakaway_child_killed_by_job_teardown(self, tmp_path):
+        """The #48820 kill path, reproduced live: no breakaway → the job's
+        teardown reaps the freshly spawned gateway."""
+        pid = self._run_in_job(tmp_path, "windows_detach_flags_without_breakaway")
+        try:
+            assert not _pid_alive(pid), (
+                "child without breakaway must be killed by kill-on-close "
+                "job teardown — this is the silent gateway death of #48820"
+            )
+        finally:
+            subprocess.run(
+                ["taskkill", "/PID", str(pid), "/T", "/F"], capture_output=True
+            )
+
+
+class TestWatcherRespawnLive:
+    """Drive the real ``_spawn_gateway_restart_watcher`` with real processes."""
+
+    def _run_watcher_cycle(self, tmp_path: Path, monkeypatch) -> tuple[Path, Path]:
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path / "home"))
+        (tmp_path / "home").mkdir(parents=True, exist_ok=True)
+
+        marker = tmp_path / "respawned.marker"
+        # The stub "gateway": records its breakaway stamp env, screams on
+        # stderr (so the stdio sidecar has something to capture), then exits.
+        stub = (
+            "import os, pathlib, sys\n"
+            f"pathlib.Path(r'{marker}').write_text(\n"
+            "    os.environ.get('_HERMES_GATEWAY_BREAKAWAY', 'MISSING'),\n"
+            "    encoding='utf-8')\n"
+            "print('stub-gateway-stderr-trace', file=sys.stderr)\n"
+        )
+
+        # A real old-pid that exits immediately — the watcher's poll loop
+        # sees it die and respawns.
+        old = subprocess.Popen([sys.executable, "-c", "pass"])
+        old.wait(timeout=30)
+
+        import hermes_cli.gateway as gateway
+
+        assert gateway._spawn_gateway_restart_watcher(
+            old.pid, [sys.executable, "-c", stub]
+        ), "watcher spawn returned False"
+
+        assert _wait_for(marker.exists, timeout_s=60), (
+            "watcher never respawned the stub gateway"
+        )
+        stdio_log = tmp_path / "home" / "logs" / "gateway-stdio.log"
+        return marker, stdio_log
+
+    def test_respawn_stamps_breakaway_and_leaves_stdio_trace(
+        self, tmp_path, monkeypatch
+    ):
+        marker, stdio_log = self._run_watcher_cycle(tmp_path, monkeypatch)
+
+        # (a) Breakaway stamp: on unfixed main the respawn env carried no
+        # stamp, so a job-teardown death was undiagnosable.
+        stamp = marker.read_text(encoding="utf-8").strip()
+        assert stamp in {"1", "0"}, (
+            f"respawned gateway must carry the breakaway stamp, got {stamp!r}"
+        )
+
+        # (b) Stdio trace: on unfixed main stderr went to DEVNULL — a dying
+        # gateway left zero trace (#48820 4th repro).
+        assert _wait_for(
+            lambda: stdio_log.exists()
+            and "stub-gateway-stderr-trace"
+            in stdio_log.read_text(encoding="utf-8", errors="replace"),
+            timeout_s=30,
+        ), "respawned gateway stderr must land in logs/gateway-stdio.log"
+
+
+class TestResumeVerificationLive:
+    """The user-visible lie: '✓ Restarting' printed for a dead gateway."""
+
+    def test_dead_relaunch_is_not_reported_as_success(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path / "home"))
+        (tmp_path / "home").mkdir(parents=True, exist_ok=True)
+
+        import hermes_cli.gateway as gateway
+        import hermes_cli.main as hm
+        from hermes_cli.update_cmd import _resume_windows_gateways_after_update
+
+        # Peripheral only: don't regenerate launcher scripts into the temp home.
+        monkeypatch.setattr(hm, "_refresh_windows_gateway_launchers", lambda: None)
+
+        # Real relaunch chain, real watcher, real spawn — but the respawned
+        # "gateway" exits immediately, standing in for the Job-Object
+        # teardown kill. It never registers in the process table as a
+        # gateway, exactly like the dead pid 48452 / 50456 of #48820.
+        def _relaunch(profile, old_pid):
+            dead = subprocess.Popen([sys.executable, "-c", "pass"])
+            dead.wait(timeout=30)
+            return gateway._spawn_gateway_restart_watcher(
+                dead.pid, [sys.executable, "-c", "pass"]
+            )
+
+        monkeypatch.setattr(
+            gateway, "launch_detached_profile_gateway_restart", _relaunch
+        )
+
+        token = {
+            "resume_needed": True,
+            "profiles": {"default": 999999},
+            "unmapped_pids": [],
+            "unmapped": [],
+        }
+
+        printed: list = []
+        real_print = print
+        monkeypatch.setattr(
+            "builtins.print", lambda *a, **k: printed.append(" ".join(map(str, a)))
+        )
+        try:
+            with pytest.raises(RuntimeError, match="not verified alive"):
+                _resume_windows_gateways_after_update(token)
+        finally:
+            monkeypatch.setattr("builtins.print", real_print)
+
+        text = "\n".join(printed)
+        assert "✓ Restarting" not in text, (
+            "the updater must not vouch for a gateway that is not alive "
+            f"(#48820). Printed:\n{text}"
+        )
+        assert "could not be verified" in text
diff --git a/tests/hermes_cli/test_gateway_multiplex_status.py b/tests/hermes_cli/test_gateway_multiplex_status.py
new file mode 100644
index 0000000000..0c516db590
--- /dev/null
+++ b/tests/hermes_cli/test_gateway_multiplex_status.py
@@ -0,0 +1,61 @@
+"""PR #69118: a named profile served by the default multiplexer reports as running.
+
+``hermes gateway status`` / ``gateway list`` / ``profile list`` keyed liveness
+off the profile's own gateway.pid, so a satellite profile served by the default
+multiplexer showed "not running" even though the multiplexer was its live
+inbound process. All three now consult the same
+``named_profile_served_by_running_multiplexer()`` lookup the start guard and
+cron liveness use.
+"""
+
+from __future__ import annotations
+
+import io
+import os
+from contextlib import redirect_stdout
+from types import SimpleNamespace
+
+
+def _fake_multiplexer(monkeypatch, tmp_path, *, multiplex: bool):
+    import hermes_constants
+    import gateway.status as status
+
+    (tmp_path / "profiles" / "beta").mkdir(parents=True)
+    (tmp_path / "config.yaml").write_text(
+        f"gateway:\n  multiplex_profiles: {'true' if multiplex else 'false'}\n"
+    )
+    (tmp_path / "gateway.pid").write_text(str(os.getpid()))
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / "profiles" / "beta"))
+    monkeypatch.setattr(hermes_constants, "_default_hermes_root_memo", None)
+    monkeypatch.setattr(status, "_pid_exists", lambda pid: True)
+
+
+def _run_status():
+    from hermes_cli import gateway as gw
+
+    buf = io.StringIO()
+    with redirect_stdout(buf):
+        gw._gateway_command_inner(
+            SimpleNamespace(gateway_command="status", deep=False, full=False, system=False)
+        )
+    return buf.getvalue().splitlines()[0]
+
+
+def test_served_named_profile_reports_running(monkeypatch, tmp_path):
+    from hermes_cli.profiles import list_profiles
+
+    _fake_multiplexer(monkeypatch, tmp_path, multiplex=True)
+
+    beta = next(p for p in list_profiles() if p.name == "beta")
+    assert beta.gateway_running is True
+    assert _run_status().startswith("✓ Gateway is running via the default-profile multiplexer")
+
+
+def test_unserved_named_profile_still_reports_stopped(monkeypatch, tmp_path):
+    from hermes_cli.profiles import list_profiles
+
+    _fake_multiplexer(monkeypatch, tmp_path, multiplex=False)
+
+    beta = next(p for p in list_profiles() if p.name == "beta")
+    assert beta.gateway_running is False
+    assert _run_status().startswith("✗ Gateway is not running")
diff --git a/tests/hermes_cli/test_goals.py b/tests/hermes_cli/test_goals.py
index 625ccbe111..413a9330ed 100644
--- a/tests/hermes_cli/test_goals.py
+++ b/tests/hermes_cli/test_goals.py
@@ -798,3 +798,38 @@ class TestContractAndBackgroundCompose:
         assert verdict == "wait"
         assert wait_directive and wait_directive.get("pid") == 4242
 
+
+class TestBlockedVerdict:
+    """#100954: a genuinely unachievable goal must be refused, not completed."""
+
+    def test_parse_judge_response_accepts_blocked(self):
+        from hermes_cli.goals import _parse_judge_response
+
+        verdict, reason, parse_failed, _wd = _parse_judge_response(
+            '{"verdict": "blocked", "reason": "the repo was deleted"}'
+        )
+        assert verdict == "blocked"
+        assert reason == "the repo was deleted"
+        assert parse_failed is False
+
+    def test_blocked_verdict_pauses_goal_instead_of_done(self, hermes_home):
+        from unittest.mock import patch
+        from hermes_cli.goals import GoalManager
+
+        mgr = GoalManager(session_id="blocked-sid")
+        mgr.set("delete a repository that does not exist")
+        with patch(
+            "hermes_cli.goals.judge_goal",
+            return_value=("blocked", "the repo does not exist", False, None, False),
+        ):
+            decision = mgr.evaluate_after_turn(
+                "The repo cannot be deleted: it does not exist."
+            )
+
+        assert decision["verdict"] == "blocked"
+        assert decision["status"] == "paused"
+        assert decision["should_continue"] is False
+        assert "unachievable" in decision["message"].lower()
+        assert mgr.state is not None
+        assert mgr.state.status == "paused"
+        assert "unachievable" in (mgr.state.paused_reason or "").lower()
diff --git a/tests/hermes_cli/test_gui_command.py b/tests/hermes_cli/test_gui_command.py
index 85348f9a6e..c9f6e483e2 100644
--- a/tests/hermes_cli/test_gui_command.py
+++ b/tests/hermes_cli/test_gui_command.py
@@ -99,6 +99,41 @@ def _make_packaged_executable(root: Path, monkeypatch) -> Path:
     return exe
 
 
+def _staging_dir_from(cmd) -> Path:
+    """Extract the ``-c.directories.output=<dir>`` electron-builder override
+    ``cmd_gui`` appends to ``npm run pack`` (stage-and-swap, #86443)."""
+    for arg in cmd:
+        if isinstance(arg, str) and arg.startswith("-c.directories.output="):
+            return Path(arg.split("=", 1)[1])
+    raise AssertionError(f"no staging output override in {cmd!r}")
+
+
+def _packaged_exe_rel() -> Path:
+    """Packaged-exe path relative to electron-builder's output dir on THIS host."""
+    if sys.platform == "darwin":
+        return Path("mac-arm64") / "Hermes.app" / "Contents" / "MacOS" / "Hermes"
+    if sys.platform == "win32":
+        return Path("win-unpacked") / "Hermes.exe"
+    return Path("linux-unpacked") / "hermes"
+
+
+def _pack_into_staging(root: Path, content: str = "", returncode: int = 0):
+    """``subprocess.run`` side effect mimicking a real ``npm run pack``: lays
+    the packaged app down inside the STAGING dir named on the command line
+    (never in release/), then returns *returncode*. Non-pack commands (the
+    launch) return success."""
+    def _run(cmd, **kwargs):
+        if len(cmd) >= 3 and cmd[1:3] == ["run", "pack"]:
+            exe = _staging_dir_from(cmd) / _packaged_exe_rel()
+            exe.parent.mkdir(parents=True, exist_ok=True)
+            exe.write_text(content, encoding="utf-8")
+            if sys.platform not in ("darwin", "win32"):
+                (exe.parent / "chrome-sandbox").write_text("", encoding="utf-8")
+            return subprocess.CompletedProcess(cmd, returncode)
+        return subprocess.CompletedProcess(cmd, 0)
+    return _run
+
+
 def test_gui_installs_packages_and_launches_desktop_app(tmp_path, monkeypatch):
     root = _make_desktop_tree(tmp_path)
     desktop_dir = root / "apps" / "desktop"
@@ -116,7 +151,7 @@ def test_gui_installs_packages_and_launches_desktop_app(tmp_path, monkeypatch):
          patch("hermes_cli.main._desktop_macos_relaunchable_fixup"), \
          patch("hermes_cli.main._desktop_linux_sandbox_fixup", return_value=True), \
          patch("hermes_cli.main._register_linux_desktop_entry"), \
-         patch("hermes_cli.main.subprocess.run", side_effect=[pack_ok, launch_ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit) as exc:
         cli_main.cmd_gui(_ns())
 
@@ -128,7 +163,13 @@ def test_gui_installs_packages_and_launches_desktop_app(tmp_path, monkeypatch):
     assert mock_install.call_args.kwargs["capture_output"] is False
     install_env = mock_install.call_args.kwargs["env"]
     assert install_env is not None and "PATH" in install_env
-    assert mock_run.call_args_list[0].args[0] == ["/usr/bin/npm", "run", "pack"]
+    pack_cmd = mock_run.call_args_list[0].args[0]
+    assert pack_cmd[:4] == ["/usr/bin/npm", "run", "pack", "--"]
+    # Stage-and-swap (#86443): the pack targets a staging dir beside release/,
+    # never release/ itself.
+    staging = _staging_dir_from(pack_cmd)
+    assert staging.parent == desktop_dir and staging.name.startswith(".staging-")
+    assert not staging.exists()  # swapped into release/ and cleaned up
     assert mock_run.call_args_list[0].kwargs["cwd"] == desktop_dir
     launched = mock_run.call_args_list[1].args[0]
     if sys.platform.startswith("linux"):
@@ -258,23 +299,29 @@ def test_gui_does_not_retry_after_packaged_executable_exists(tmp_path, monkeypat
     """
     root = _make_desktop_tree(tmp_path)
     monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
-    # Executable EXISTS at failure time → late failure, not a corrupt download.
-    _make_packaged_executable(root, monkeypatch)
+    live_exe = _make_packaged_executable(root, monkeypatch)
+    live_exe.write_text("good build", encoding="utf-8")
     monkeypatch.delenv("ELECTRON_MIRROR", raising=False)
 
     install_ok = subprocess.CompletedProcess(["npm", "ci"], 0)
-    pack_fail = subprocess.CompletedProcess(["npm", "run", "pack"], 1)
+    # Executable EXISTS in the STAGING output at failure time → late failure
+    # (e.g. signing), not a corrupt download. With stage-and-swap (#86443) the
+    # discriminator reads the staging dir, so the fake pack lays it down there.
+    pack_fail = _pack_into_staging(root, content="half-signed", returncode=1)
 
     with patch("hermes_cli.main.shutil.which", return_value="/usr/bin/npm"), \
          patch("hermes_cli.main._run_npm_install_deterministic", return_value=install_ok), \
          patch("hermes_cli.main._desktop_macos_relaunchable_fixup"), \
          patch("hermes_cli.main._purge_electron_build_cache", return_value=[Path("/c/electron.zip")]) as mock_purge, \
          patch("hermes_cli.main._redownload_electron_dist", return_value=True) as mock_dl, \
-         patch("hermes_cli.main.subprocess.run", return_value=pack_fail) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=pack_fail) as mock_run, \
          pytest.raises(SystemExit) as exc:
         cli_main.cmd_gui(_ns())
 
     assert exc.value.code == 1
+    # The live app was never touched by the failed pack (#86443).
+    assert live_exe.read_text(encoding="utf-8") == "good build"
+    assert not list((root / "apps" / "desktop").glob(".staging-*"))
     # Neither destructive recovery runs, and there is exactly ONE pack attempt.
     mock_purge.assert_not_called()
     mock_dl.assert_not_called()
@@ -1062,7 +1109,7 @@ def test_gui_bridges_ozone_hint_to_launch_env(tmp_path, monkeypatch):
          patch("hermes_cli.main._desktop_linux_sandbox_fixup", return_value=True), \
          patch("hermes_cli.config.load_config", return_value=cfg), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
@@ -1078,7 +1125,7 @@ def test_gui_bridges_ozone_hint_to_launch_env(tmp_path, monkeypatch):
          patch("hermes_cli.main._desktop_linux_sandbox_fixup", return_value=True), \
          patch("hermes_cli.config.load_config", return_value=cfg), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run2, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run2, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
@@ -1160,7 +1207,7 @@ def test_gui_linux_packaged_launch_bridges_detected_password_store(tmp_path, mon
          patch("hermes_cli.config.load_config", return_value={}), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
          patch("hermes_cli.main._detect_linux_password_store", return_value="gnome-libsecret"), \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
@@ -1183,7 +1230,7 @@ def test_gui_linux_source_launch_bridges_detected_password_store(tmp_path, monke
          patch("hermes_cli.config.load_config", return_value={}), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
          patch("hermes_cli.main._detect_linux_password_store", return_value="kwallet6"), \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns(source=True))
 
@@ -1211,7 +1258,7 @@ def test_gui_config_password_store_skips_detection(tmp_path, monkeypatch):
          patch("hermes_cli.config.load_config", return_value=cfg), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
          patch("hermes_cli.main._detect_linux_password_store") as mock_detect, \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
@@ -1240,7 +1287,7 @@ def test_gui_explicit_password_store_env_wins_over_config_and_detection(tmp_path
          patch("hermes_cli.config.load_config", return_value=cfg), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
          patch("hermes_cli.main._detect_linux_password_store") as mock_detect, \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
@@ -1266,10 +1313,178 @@ def test_gui_password_store_bridge_is_linux_only(tmp_path, monkeypatch):
          patch("hermes_cli.config.load_config", return_value={}), \
          patch("hermes_cli.linux_desktop_entry.install_desktop_entry", return_value=None), \
          patch("hermes_cli.main._detect_linux_password_store") as mock_detect, \
-         patch("hermes_cli.main.subprocess.run", side_effect=[ok, ok]) as mock_run, \
+         patch("hermes_cli.main.subprocess.run", side_effect=_pack_into_staging(root)) as mock_run, \
          pytest.raises(SystemExit):
         cli_main.cmd_gui(_ns())
 
     mock_detect.assert_not_called()
     launch_env = mock_run.call_args_list[1].kwargs["env"]
     assert "HERMES_DESKTOP_PASSWORD_STORE" not in launch_env
+
+
+# ---------------------------------------------------------------------------
+# #86443: stage-and-swap — a failed Desktop rebuild must never remove the
+# working app. electron-builder packs IN PLACE (before-pack.mjs wipes
+# release/<unpacked> first), so cmd_gui now packs into a staging dir and only
+# renames it over release/ after the staged result verifies.
+# ---------------------------------------------------------------------------
+
+
+def _gui_build_patches(root: Path, run_side_effect):
+    return [
+        patch("hermes_cli.main.shutil.which", return_value="/usr/bin/npm"),
+        patch("hermes_cli.main._run_npm_install_deterministic",
+              return_value=subprocess.CompletedProcess(["npm", "ci"], 0)),
+        patch("hermes_cli.main._desktop_build_needed", return_value=True),
+        patch("hermes_cli.main._write_desktop_build_stamp"),
+        patch("hermes_cli.main._desktop_macos_relaunchable_fixup"),
+        patch("hermes_cli.main._register_linux_desktop_entry"),
+        patch("hermes_cli.main._stop_desktop_processes_locking_build", return_value=[]),
+        patch("hermes_cli.main._purge_electron_build_cache", return_value=[]),
+        patch("hermes_cli.main._redownload_electron_dist", return_value=False),
+        patch("hermes_cli.main.subprocess.run", side_effect=run_side_effect),
+    ]
+
+
+def test_swap_staged_desktop_app_promotes_staged_tree_and_drops_previous(tmp_path):
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    live_exe = desktop_dir / "release" / _packaged_exe_rel()
+    live_exe.parent.mkdir(parents=True)
+    live_exe.write_text("old", encoding="utf-8")
+    staging = cli_main._desktop_staging_dir(desktop_dir)
+    staged_exe = staging / _packaged_exe_rel()
+    staged_exe.parent.mkdir(parents=True)
+    staged_exe.write_text("new", encoding="utf-8")
+
+    promoted = cli_main._swap_staged_desktop_app(desktop_dir, staging)
+
+    assert promoted == live_exe
+    assert live_exe.read_text(encoding="utf-8") == "new"
+    assert not staging.exists()
+    assert sorted(p.name for p in (desktop_dir / "release").iterdir()) == [_packaged_exe_rel().parts[0]]
+
+
+def test_swap_staged_desktop_app_without_staged_exe_keeps_live_app(tmp_path):
+    """Zero-exit pack that produced nothing: live app untouched, staging gone."""
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    live_exe = desktop_dir / "release" / _packaged_exe_rel()
+    live_exe.parent.mkdir(parents=True)
+    live_exe.write_text("old", encoding="utf-8")
+    staging = cli_main._desktop_staging_dir(desktop_dir)
+    (staging / "linux-unpacked" / "resources").mkdir(parents=True)  # partial tree, no exe
+
+    assert cli_main._swap_staged_desktop_app(desktop_dir, staging) is None
+    assert live_exe.read_text(encoding="utf-8") == "old"
+    assert not staging.exists()
+
+
+def test_swap_staged_desktop_app_rolls_back_when_second_rename_fails(tmp_path, monkeypatch):
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    live_exe = desktop_dir / "release" / _packaged_exe_rel()
+    live_exe.parent.mkdir(parents=True)
+    live_exe.write_text("old", encoding="utf-8")
+    staging = cli_main._desktop_staging_dir(desktop_dir)
+    staged_exe = staging / _packaged_exe_rel()
+    staged_exe.parent.mkdir(parents=True)
+    staged_exe.write_text("new", encoding="utf-8")
+
+    real_rename = cli_main.os.rename
+    calls = {"n": 0}
+
+    def flaky_rename(src, dst):
+        calls["n"] += 1
+        if calls["n"] == 2:  # staged → live
+            raise OSError("EXDEV simulated")
+        return real_rename(src, dst)
+
+    monkeypatch.setattr(cli_main.os, "rename", flaky_rename)
+    assert cli_main._swap_staged_desktop_app(desktop_dir, staging) is None
+    assert live_exe.read_text(encoding="utf-8") == "old"
+    assert not (live_exe.parent.parent / (live_exe.parent.name + ".previous")).exists()
+
+
+def test_gui_failed_pack_leaves_previous_app_untouched(tmp_path, monkeypatch, capsys):
+    """Every pack attempt fails → the pre-existing app is exactly as it was,
+    no staging dir remains, exit is non-zero."""
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
+    live_exe = _make_packaged_executable(root, monkeypatch)
+    live_exe.write_text("good build", encoding="utf-8")
+    monkeypatch.setenv("ELECTRON_MIRROR", "https://example.test/electron/")
+
+    def failing_pack(cmd, **kwargs):
+        # Mimic before-pack.mjs wiping appOutDir inside the OUTPUT dir it was
+        # given, then dying (corrupt Electron zip → ENOENT on rename).
+        out = _staging_dir_from(cmd) / _packaged_exe_rel().parts[0]
+        out.mkdir(parents=True, exist_ok=True)
+        (out / "resources").mkdir(exist_ok=True)
+        return subprocess.CompletedProcess(cmd, 1)
+
+    patches = _gui_build_patches(root, failing_pack)
+    for p in patches:
+        p.start()
+    try:
+        with pytest.raises(SystemExit) as exc:
+            cli_main.cmd_gui(_ns(build_only=True))
+    finally:
+        for p in patches:
+            p.stop()
+
+    assert exc.value.code == 1
+    assert live_exe.read_text(encoding="utf-8") == "good build"
+    assert not list(desktop_dir.glob(".staging-*"))
+    assert not list((desktop_dir / "release").glob("*.previous"))
+    out = capsys.readouterr().out
+    assert "previous desktop app was left untouched" in out
+
+
+def test_gui_successful_pack_swaps_new_app_into_release(tmp_path, monkeypatch):
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
+    live_exe = _make_packaged_executable(root, monkeypatch)
+    live_exe.write_text("old build", encoding="utf-8")
+
+    patches = _gui_build_patches(root, _pack_into_staging(root, content="new build"))
+    for p in patches:
+        p.start()
+    try:
+        cli_main.cmd_gui(_ns(build_only=True))
+    finally:
+        for p in patches:
+            p.stop()
+
+    assert live_exe.read_text(encoding="utf-8") == "new build"
+    assert not list(desktop_dir.glob(".staging-*"))
+    assert not list((desktop_dir / "release").glob("*.previous"))
+
+
+def test_gui_zero_exit_pack_without_artifact_keeps_previous_app(tmp_path, monkeypatch, capsys):
+    root = _make_desktop_tree(tmp_path)
+    desktop_dir = root / "apps" / "desktop"
+    monkeypatch.setattr(cli_main, "PROJECT_ROOT", root)
+    live_exe = _make_packaged_executable(root, monkeypatch)
+    live_exe.write_text("good build", encoding="utf-8")
+
+    def empty_pack(cmd, **kwargs):
+        _staging_dir_from(cmd).mkdir(parents=True, exist_ok=True)
+        return subprocess.CompletedProcess(cmd, 0)
+
+    patches = _gui_build_patches(root, empty_pack)
+    for p in patches:
+        p.start()
+    try:
+        with pytest.raises(SystemExit) as exc:
+            cli_main.cmd_gui(_ns(build_only=True))
+    finally:
+        for p in patches:
+            p.stop()
+
+    assert exc.value.code == 1
+    assert live_exe.read_text(encoding="utf-8") == "good build"
+    assert not list(desktop_dir.glob(".staging-*"))
+    assert "produced no launchable app" in capsys.readouterr().out
diff --git a/tests/hermes_cli/test_hf_browse.py b/tests/hermes_cli/test_hf_browse.py
new file mode 100644
index 0000000000..7e7e689a90
--- /dev/null
+++ b/tests/hermes_cli/test_hf_browse.py
@@ -0,0 +1,186 @@
+"""The HF browser: search the firehose, price it roughly, and let any
+GGUF become a normal staged model.
+
+Parsing contracts run against canned HF API shapes (no network); route
+contracts run against the real FastAPI app with the HF client stubbed."""
+
+from __future__ import annotations
+
+import pytest
+from fastapi.testclient import TestClient
+
+from hermes_cli.local_runtime.estimator import HardwareBudget
+from hermes_cli.local_runtime.hf_browse import (
+    HFFileGroup,
+    HFModelHit,
+    repo_files,
+    rough_fit,
+    search_models,
+)
+
+GIB = 1 << 30
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    (tmp_path / ".hermes").mkdir()
+    from hermes_cli import web_server
+
+    test_client = TestClient(web_server.app)
+    test_client.headers[web_server._SESSION_HEADER_NAME] = web_server._SESSION_TOKEN
+    return test_client
+
+
+def _budget(vram_gib, ram_gib=64):
+    return HardwareBudget(usable_vram_bytes=int(vram_gib * GIB),
+                          total_device_bytes=int(vram_gib * GIB),
+                          ram_available_bytes=int(ram_gib * GIB))
+
+
+def test_search_parses_hf_hits(monkeypatch):
+    canned = [
+        {"id": "unsloth/Qwen3.8-27B-GGUF", "downloads": 872724, "likes": 47,
+         "lastModified": "2026-08-18", "gated": False},
+        {"id": "bartowski/whatever-GGUF", "downloads": 5, "likes": 0,
+         "lastModified": "2026-01-01", "gated": "auto"},
+    ]
+    monkeypatch.setattr("hermes_cli.local_runtime.hf_browse._get_json",
+                        lambda url: canned)
+    hits = search_models("qwen")
+    assert hits[0].repo == "unsloth/Qwen3.8-27B-GGUF"
+    assert hits[0].downloads == 872724
+    assert hits[1].gated is True  # HF 'auto'-gated counts as gated
+
+
+def test_repo_files_groups_splits_and_excludes_companions(monkeypatch):
+    canned = [
+        {"path": "Qwen3.8-27B-Q4_K_M.gguf", "size": 17 * GIB},
+        {"path": "mmproj-BF16.gguf", "size": 1 * GIB},
+        {"path": "UD-Q8/model-00001-of-00002.gguf", "size": 30 * GIB},
+        {"path": "UD-Q8/model-00002-of-00002.gguf", "size": 12 * GIB},
+        {"path": "README.md", "size": 1000},
+        {"path": "dspark-draft-Q8_0.gguf", "size": 9 * GIB},
+    ]
+    monkeypatch.setattr("hermes_cli.local_runtime.hf_browse._get_json",
+                        lambda url: canned)
+    groups = repo_files("any/repo")
+    labels = {g.label: g for g in groups}
+    assert "Q4_K_M" in labels and labels["Q4_K_M"].total_bytes == 17 * GIB
+    # Split parts collapse into one group, ordered, summed.
+    split = next(g for g in groups if len(g.paths) == 2)
+    assert split.total_bytes == 42 * GIB
+    assert split.paths[0].endswith("00001-of-00002.gguf")
+    # Companions (mmproj, draft) are not standalone models.
+    assert not any("mmproj" in p or "dspark" in p
+                   for g in groups for p in g.paths)
+    # Largest first.
+    assert groups[0].total_bytes >= groups[-1].total_bytes
+
+
+def test_rough_fit_bands():
+    b = _budget(29.6, ram_gib=64)
+    assert rough_fit(20 * GIB, b) == "fits-gpu"     # + fill-ins under 29.6
+    assert rough_fit(28 * GIB, b) == "needs-ram"    # weights spill
+    assert rough_fit(120 * GIB, b) == "too-big"
+
+
+def test_search_route_requires_query_and_maps_errors(client, monkeypatch):
+    r = client.get("/api/local-models/search", params={"q": "  "})
+    assert r.status_code == 200 and r.json() == {"hits": []}
+
+    def boom(q, limit):
+        raise RuntimeError("HF down")
+
+    monkeypatch.setattr("hermes_cli.local_runtime.hf_browse.search_models", boom)
+    r = client.get("/api/local-models/search", params={"q": "qwen"})
+    assert r.status_code == 502
+
+
+def test_browsed_download_stages_and_bounces(client, tmp_path, monkeypatch):
+    """A browsed download must land in the machine-scoped models dir and
+    bounce the router — the seam that makes it a NORMAL model."""
+    body = b"GGUF" + b"\x00" * 60
+
+    class FakeResponse:
+        headers = {"Content-Length": str(len(body))}
+
+        def __init__(self):
+            self._data = body
+
+        def read(self, n=-1):
+            out, self._data = self._data, b""
+            return out
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr("urllib.request.urlopen",
+                        lambda *a, **k: FakeResponse())
+    bounced = {}
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.refresh_local_runtime",
+        lambda: bounced.setdefault("yes", True))
+
+    r = client.post("/api/local-models/download-browsed",
+                    json={"repo": "someone/Some-GGUF",
+                          "paths": ["Some-Model-Q4_K_M.gguf"]})
+    assert r.status_code == 200
+    job_id = r.json()["job_id"]
+
+    import time as _time
+
+    deadline = _time.time() + 10
+    status = None
+    while _time.time() < deadline:
+        status = client.get(f"/api/local-models/jobs/{job_id}").json()
+        if status["status"] in ("done", "error"):
+            break
+        _time.sleep(0.05)
+    assert status["status"] == "done", status.get("error")
+
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    assert (models_dir() / "Some-Model-Q4_K_M.gguf").exists()
+    assert bounced.get("yes") is True
+
+
+def test_browsed_download_rejects_non_gguf(client):
+    r = client.post("/api/local-models/download-browsed",
+                    json={"repo": "a/b", "paths": ["model.safetensors"]})
+    assert r.status_code == 422
+
+
+def test_sideload_links_and_bounces(client, tmp_path, monkeypatch):
+    src = tmp_path / "My-Local-Model-Q5_K_M.gguf"
+    src.write_bytes(b"GGUF" + b"\x00" * 32)
+    bounced = {}
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.refresh_local_runtime",
+        lambda: bounced.setdefault("yes", True))
+
+    r = client.post("/api/local-models/sideload", json={"path": str(src)})
+    assert r.status_code == 200
+    assert r.json()["model_id"] == "My-Local-Model-Q5_K_M"
+
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    dest = models_dir() / src.name
+    assert dest.exists()
+    assert bounced.get("yes") is True
+    # The original must be untouched.
+    assert src.exists()
+
+    # Idempotent: sideloading again short-circuits.
+    r = client.post("/api/local-models/sideload", json={"path": str(src)})
+    assert r.json().get("already_present") is True
+
+
+def test_sideload_rejects_non_gguf(client, tmp_path):
+    src = tmp_path / "model.bin"
+    src.write_bytes(b"nope")
+    r = client.post("/api/local-models/sideload", json={"path": str(src)})
+    assert r.status_code == 422
diff --git a/tests/hermes_cli/test_kanban_goal_mode.py b/tests/hermes_cli/test_kanban_goal_mode.py
index 61ece645ff..00616bfd7d 100644
--- a/tests/hermes_cli/test_kanban_goal_mode.py
+++ b/tests/hermes_cli/test_kanban_goal_mode.py
@@ -205,3 +205,21 @@ class TestCLIJudgeGate:
         rc, complete_calls = self._run(monkeypatch, goal_mode=False)
         assert rc == 0
         assert complete_calls == ["t1"]
+
+    def test_judge_blocked_verdict_rejects_completion(self, monkeypatch, capsys):
+        """#100954: an unachievable goal must not complete silently.
+
+        The judge's ``blocked`` verdict is a refusal, not a completion —
+        ``complete_task`` must never run and stderr must steer the user
+        toward re-scoping / recording the block.
+        """
+        rc, complete_calls = self._run(
+            monkeypatch,
+            verdict="blocked",
+            reason="the target repository does not exist",
+        )
+        err = capsys.readouterr().err
+        assert rc != 0, "blocked verdict must reject the completion"
+        assert complete_calls == [], "an unachievable goal must never reach complete_task"
+        assert "unachievable" in err.lower()
+        assert "kanban block" in err.lower()
diff --git a/tests/hermes_cli/test_kanban_init_lock_bounded.py b/tests/hermes_cli/test_kanban_init_lock_bounded.py
index d7730712c6..38c5782713 100644
--- a/tests/hermes_cli/test_kanban_init_lock_bounded.py
+++ b/tests/hermes_cli/test_kanban_init_lock_bounded.py
@@ -66,7 +66,7 @@ def test_initialized_path_connect_skips_init_lock(kanban_home):
         start = time.monotonic()
         kb.connect().close()
         elapsed = time.monotonic() - start
-        assert elapsed < 1.0, f"fast-path connect blocked on the init lock ({elapsed:.2f}s)"
+        assert elapsed < 5.0, f"fast-path connect blocked on the init lock ({elapsed:.2f}s)"
     finally:
         release.set()
         t.join(timeout=5)
@@ -85,7 +85,7 @@ def test_first_init_connect_is_bounded_when_lock_held(kanban_home, monkeypatch):
         conn.close()
         elapsed = time.monotonic() - start
         # Proceeded within roughly the timeout window (not unbounded).
-        assert 0.4 <= elapsed < 3.0, f"expected bounded ~0.6s acquire, got {elapsed:.2f}s"
+        assert 0.4 <= elapsed < 8.0, f"expected bounded ~0.6s acquire, got {elapsed:.2f}s"
         assert str(db_path.resolve()) in kb._INITIALIZED_PATHS
     finally:
         release.set()
diff --git a/tests/hermes_cli/test_kanban_notify.py b/tests/hermes_cli/test_kanban_notify.py
index ec01f5a5d3..3eea0a1920 100644
--- a/tests/hermes_cli/test_kanban_notify.py
+++ b/tests/hermes_cli/test_kanban_notify.py
@@ -1113,6 +1113,34 @@ def test_gc_spares_reopened_task_even_when_old(kanban_home):
         conn.close()
 
 
+def _set_task_status(kb, conn, tid, status):
+    """Force a task into ``status`` with a matching status event."""
+    with kb.write_txn(conn):
+        conn.execute("UPDATE tasks SET status = ? WHERE id = ?", (status, tid))
+        kb._append_event(conn, tid, "status", {"status": status})
+
+
+def test_gc_purges_blocked_task_that_never_done(kanban_home):
+    import hermes_cli.kanban_db as kb
+
+    conn = kb.connect()
+    try:
+        tid = kb.create_task(conn, title="stuck blocked", assignee="worker1")
+        kb.add_notify_sub(
+            conn, task_id=tid, platform="telegram", chat_id="c-blocked",
+            notifier_profile="default",
+        )
+        _set_task_status(kb, conn, tid, "blocked")
+        _backdate_task(kb, conn, tid, days=45)
+
+        purged = kb.purge_stale_done_notify_subs(conn, max_age_days=30)
+
+        assert purged == 1
+        assert kb.list_notify_subs(conn, tid) == []
+    finally:
+        conn.close()
+
+
 def test_gc_archived_rows_already_removed_by_unsub(kanban_home):
     import hermes_cli.kanban_db as kb
 
diff --git a/tests/hermes_cli/test_linux_desktop_entry.py b/tests/hermes_cli/test_linux_desktop_entry.py
index 8d8c246af5..acb372b2f8 100644
--- a/tests/hermes_cli/test_linux_desktop_entry.py
+++ b/tests/hermes_cli/test_linux_desktop_entry.py
@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
+import io
 import os
 import stat
+import struct
 import sys
 from pathlib import Path
 
@@ -31,6 +33,26 @@ def _make_project(tmp_path: Path) -> Path:
     return root
 
 
+def _png_ihdr(width: int, height: int) -> bytes:
+    """Minimal PNG prefix whose IHDR the installer can parse (no pixels)."""
+    return (
+        b"\x89PNG\r\n\x1a\n"
+        + b"\x00\x00\x00\r"
+        + b"IHDR"
+        + struct.pack(">II", width, height)
+    )
+
+
+def _stub_install(tmp_path, monkeypatch) -> None:
+    hermes_bin = tmp_path / "bin" / "hermes"
+    hermes_bin.parent.mkdir(exist_ok=True)
+    hermes_bin.write_text("", encoding="utf-8")
+    monkeypatch.setattr(
+        "hermes_cli.relaunch.resolve_hermes_bin", lambda: str(hermes_bin)
+    )
+    monkeypatch.setattr(lde, "refresh_desktop_databases", lambda _dir: [])
+
+
 def _parse(entry_text: str) -> dict:
     values = {}
     for line in entry_text.splitlines():
@@ -94,8 +116,8 @@ def test_install_prefers_themed_icon_from_hicolor(tmp_path, xdg_home, monkeypatc
 
     # And the icon really landed in the hicolor tree: the fixture icon is
     # a fake PNG (no valid IHDR), so the size is unknown and the icon
-    # lands under scalable/.
-    dest = xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    # lands under 256x256/ (indexed; never scalable, which is SVG-only).
+    dest = xdg_home / "icons" / "hicolor" / "256x256" / "apps" / "hermes.png"
     assert dest.is_file()
     assert dest.read_bytes() == lde.icon_path(root).read_bytes()
 
@@ -965,8 +987,8 @@ def test_probe_accepts_shell_launcher_wrapper(tmp_path, xdg_home, monkeypatch):
 
 def test_install_icon_handles_truncated_png_header(tmp_path, xdg_home, monkeypatch):
     """A truncated PNG (valid signature + IHDR tag, <24 bytes) must not
-    raise struct.error out of the fail-safe: it lands in scalable/ like
-    any other unknown-size image."""
+    raise struct.error out of the fail-safe: it lands in 256x256/ like
+    any other unknown-size raster."""
     root = _make_project(tmp_path)
     icon = lde.icon_path(root)
     icon.write_bytes(
@@ -984,5 +1006,96 @@ def test_install_icon_handles_truncated_png_header(tmp_path, xdg_home, monkeypat
 
     values = _parse(entry.read_text(encoding="utf-8"))
     assert values["Icon"] == "hermes"
-    dest = xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    dest = xdg_home / "icons" / "hicolor" / "256x256" / "apps" / "hermes.png"
     assert dest.is_file()
+
+
+def test_hicolor_subdir_puts_rasters_in_indexed_dirs_never_scalable():
+    """Panel lookup uses fixed sizes. scalable/ is SVG-only."""
+    assert lde._hicolor_subdir(None) == "256x256"
+    assert lde._hicolor_subdir((1024, 1024)) == "256x256"
+    assert lde._hicolor_subdir((512, 512)) == "512x512"
+    assert lde._hicolor_subdir((256, 256)) == "256x256"
+    assert lde._hicolor_subdir((48, 48)) == "48x48"
+    assert lde._hicolor_subdir((24, 24)) == "24x24"
+    assert lde._hicolor_subdir((64, 32)) == "256x256"
+
+
+def test_install_places_1024_png_in_256x256_not_scalable(
+    tmp_path, xdg_home, monkeypatch
+):
+    """The shipped desktop asset is 1024×1024. A PNG in scalable/ is what
+    Cinnamon's panel rasterizes as a mangled low-res icon."""
+    root = _make_project(tmp_path)
+    lde.icon_path(root).write_bytes(_png_ihdr(1024, 1024))
+    _stub_install(tmp_path, monkeypatch)
+
+    entry = lde.install_desktop_entry(root)
+    values = _parse(entry.read_text(encoding="utf-8"))
+
+    dest = xdg_home / "icons" / "hicolor" / "256x256" / "apps" / "hermes.png"
+    stale = xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    assert values["Icon"] == "hermes"
+    assert dest.is_file()
+    assert dest.read_bytes() == lde.icon_path(root).read_bytes()
+    assert not stale.exists()
+
+
+def test_install_removes_stale_scalable_png(tmp_path, xdg_home, monkeypatch):
+    """v2026.8.31 wrote the PNG into scalable/. A later hermes desktop
+    must delete that leftover so Cinnamon does not keep using it."""
+    root = _make_project(tmp_path)
+    lde.icon_path(root).write_bytes(_png_ihdr(1024, 1024))
+    _stub_install(tmp_path, monkeypatch)
+
+    stale = xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    stale.parent.mkdir(parents=True)
+    stale.write_bytes(b"old scalable png")
+
+    lde.install_desktop_entry(root)
+
+    dest = xdg_home / "icons" / "hicolor" / "256x256" / "apps" / "hermes.png"
+    assert dest.is_file()
+    assert not stale.exists()
+
+
+def test_install_exact_48_png_uses_48x48_dir(tmp_path, xdg_home, monkeypatch):
+    root = _make_project(tmp_path)
+    lde.icon_path(root).write_bytes(_png_ihdr(48, 48))
+    _stub_install(tmp_path, monkeypatch)
+
+    lde.install_desktop_entry(root)
+
+    dest = xdg_home / "icons" / "hicolor" / "48x48" / "apps" / "hermes.png"
+    assert dest.is_file()
+    assert not (
+        xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    ).exists()
+
+
+def test_install_resizes_decodable_png_to_panel_sizes(
+    tmp_path, xdg_home, monkeypatch
+):
+    """A decodeable PNG is Lanczos-resized so the 24px slot is actually 24px."""
+    from PIL import Image
+
+    root = _make_project(tmp_path)
+    im = Image.new("RGBA", (64, 64), (255, 255, 255, 255))
+    for x in range(16, 48):
+        for y in range(16, 48):
+            im.putpixel((x, y), (0, 0, 0, 255))
+    buf = io.BytesIO()
+    im.save(buf, format="PNG")
+    lde.icon_path(root).write_bytes(buf.getvalue())
+    _stub_install(tmp_path, monkeypatch)
+
+    lde.install_desktop_entry(root)
+
+    dest_24 = xdg_home / "icons" / "hicolor" / "24x24" / "apps" / "hermes.png"
+    dest_256 = xdg_home / "icons" / "hicolor" / "256x256" / "apps" / "hermes.png"
+    stale = xdg_home / "icons" / "hicolor" / "scalable" / "apps" / "hermes.png"
+    assert dest_24.is_file()
+    assert dest_256.is_file()
+    assert not stale.exists()
+    assert struct.unpack(">II", dest_24.read_bytes()[16:24]) == (24, 24)
+    assert struct.unpack(">II", dest_256.read_bytes()[16:24]) == (256, 256)
diff --git a/tests/hermes_cli/test_load_progress.py b/tests/hermes_cli/test_load_progress.py
new file mode 100644
index 0000000000..3da34a8a44
--- /dev/null
+++ b/tests/hermes_cli/test_load_progress.py
@@ -0,0 +1,260 @@
+"""Model-load progress: SSE events -> composite percent -> wait notices.
+
+The 40-second problem: a cold local model streams 16-21 GB of weights
+before the first token, and the chat rendered that as the generic
+"provider may be slow or overloaded" stall warning. llama-server's child
+emits real per-tensor progress which the router relays over /models/sse
+ONLY — these tests pin the consumer that turns that stream into the
+status route's `loading` field and the chat's load notice."""
+
+from __future__ import annotations
+
+import json
+import time
+
+import hermes_cli.local_runtime.load_progress as lp
+
+
+def setup_function(_fn):
+    with lp._lock:
+        lp._snapshot.clear()
+
+
+# ── composite percent ────────────────────────────────────────
+
+
+def test_composite_percent_text_stage_dominates():
+    stages = ["text_model", "spec_model", "mmproj_model"]
+    # Text model owns [0, 85): halfway through it reads ~42%.
+    assert lp._composite_percent(stages, "text_model", 0.5) == 42  # 0.5*85
+    # Extras start where text ends and never regress below it.
+    assert lp._composite_percent(stages, "spec_model", 0.0) == 85
+    assert lp._composite_percent(stages, "mmproj_model", 1.0) == 100
+
+
+def test_composite_percent_monotone_across_stage_walk():
+    """Walking the stages in llama-server's real order never moves the
+    bar backwards — the property that makes the bar trustworthy."""
+    stages = ["text_model", "spec_model", "mmproj_model"]
+    walk = [("text_model", v / 10) for v in range(11)] + \
+           [("spec_model", v / 10) for v in range(11)] + \
+           [("mmproj_model", v / 10) for v in range(11)]
+    seen = [lp._composite_percent(stages, s, v) for s, v in walk]
+    assert seen == sorted(seen)
+    assert seen[0] == 0 and seen[-1] == 100
+
+
+def test_composite_percent_single_stage_is_plain():
+    assert lp._composite_percent(["text_model"], "text_model", 0.4) == 40
+
+
+# ── event application ────────────────────────────────────────
+
+
+def _loading_event(value: float, current: str = "text_model") -> dict:
+    return {"status": "loading",
+            "progress": {"stages": ["text_model", "mmproj_model"],
+                         "current": current, "value": value}}
+
+
+def test_loading_events_build_snapshot_and_terminal_clears():
+    lp._apply_event("m1", "status_change", _loading_event(0.5))
+    snap = lp.get_loading_progress()
+    assert "m1" in snap
+    assert snap["m1"]["percent"] == 42  # 0.5 * 85 within text stage
+    assert snap["m1"]["stage"] == "text_model"
+
+    lp._apply_event("m1", "status_change", {"status": "loaded", "info": {}})
+    assert lp.get_loading_progress() == {}
+
+
+def test_unload_and_failure_clear_too():
+    lp._apply_event("m1", "status_change", _loading_event(0.2))
+    lp._apply_event("m1", "status_change", {"status": "unloaded", "exit_code": 1})
+    assert lp.get_loading_progress() == {}
+
+    lp._apply_event("m2", "status_change", _loading_event(0.9))
+    lp._apply_event("m2", "model_remove", {})
+    assert lp.get_loading_progress() == {}
+
+
+def test_progressless_loading_event_keeps_entry_alive():
+    """The router's first model_status event says just {status: loading} —
+    it must register the load (indeterminate) without inventing a percent."""
+    lp._apply_event("m1", "model_status", {"status": "loading"})
+    snap = lp.get_loading_progress()
+    assert snap["m1"]["percent"] == 0
+
+
+def test_stale_entries_expire():
+    lp._apply_event("m1", "status_change", _loading_event(0.5))
+    with lp._lock:
+        lp._snapshot["m1"]["ts"] -= lp._STALE_ENTRY_TTL_S + 1
+    assert lp.get_loading_progress() == {}
+
+
+# ── chat wait-notice ─────────────────────────────────────────
+
+
+def test_load_notice_for_managed_model(tmp_path, monkeypatch):
+    from agent.chat_completion_helpers import _managed_local_load_notice
+
+    state = tmp_path / "server.json"
+    state.write_text(json.dumps({"base_url": "http://127.0.0.1:18434/v1",
+                                 "api_key": "k"}), encoding="utf-8")
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.state_path",
+                        lambda: state)
+    lp._apply_event("Qwen-Test", "status_change", _loading_event(0.5))
+    monkeypatch.setattr(lp, "_ensure_watcher", lambda: None)
+
+    class _Agent:
+        base_url = "http://127.0.0.1:18434/v1"
+
+    notice = _managed_local_load_notice(_Agent(), {"model": "Qwen-Test"})
+    assert notice is not None
+    assert notice.startswith("⏳ loading Qwen-Test into memory — 42%")
+
+    # Different endpoint (user's own server): never claim its loads.
+    class _Other:
+        base_url = "http://127.0.0.1:9999/v1"
+
+    assert _managed_local_load_notice(_Other(), {"model": "Qwen-Test"}) is None
+    # Managed endpoint but a model that isn't loading: no notice.
+    assert _managed_local_load_notice(_Agent(), {"model": "Elsewhere"}) is None
+
+
+def test_load_notice_matches_desktop_wait_filter():
+    """The notices must pass the desktop's providerWaitText regex and parse
+    under parseModelLoadWait's shapes — pinned here as plain string
+    contracts so the two sides can't drift silently."""
+    import re
+
+    accept = r"^(?:⏳|⚠|↻|⚙)\s*(?:waiting on|loading|processing prompt|no (?:output|response)|model returned)"
+
+    load = "⏳ loading Qwen3.6-35B-A3B-UD-Q4_K_M into memory — 43% (responses start once the model is loaded)"
+    assert re.match(accept, load)
+    m = re.match(r"^⏳\s*loading\s+(.+?)\s+into memory\s+—\s+(\d{1,3})%", load)
+    assert m and m.group(1) == "Qwen3.6-35B-A3B-UD-Q4_K_M" and m.group(2) == "43"
+
+    prefill = "⚙ processing prompt — 31%"
+    assert re.match(accept, prefill)
+    p = re.match(r"^⚙\s*processing prompt(?:\s+—\s+(\d{1,3})%)?", prefill)
+    assert p and p.group(1) == "31"
+
+    bare = "⚙ processing prompt"
+    assert re.match(accept, bare)
+    b = re.match(r"^⚙\s*processing prompt(?:\s+—\s+(\d{1,3})%)?", bare)
+    assert b and b.group(1) is None
+
+
+# ── prefill progress ─────────────────────────────────────────
+
+
+def test_prefill_notice_for_managed_model(tmp_path, monkeypatch):
+    from agent.chat_completion_helpers import _managed_local_load_notice
+
+    state = tmp_path / "server.json"
+    state.write_text(json.dumps({"base_url": "http://127.0.0.1:18434/v1",
+                                 "api_key": "k"}), encoding="utf-8")
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.state_path",
+                        lambda: state)
+    monkeypatch.setattr(lp, "_ensure_watcher", lambda: None)
+    # No load in flight; a prefill counter is live.
+    monkeypatch.setattr(lp, "get_prefill_progress",
+                        lambda model: {"processed": 12288})
+    import agent.chat_completion_helpers as cch
+
+    monkeypatch.setattr(cch, "estimate_request_context_tokens",
+                        lambda kw: 39551)
+
+    class _Agent:
+        base_url = "http://127.0.0.1:18434/v1"
+
+    notice = _managed_local_load_notice(_Agent(), {"model": "Qwen-Test"})
+    assert notice == "⚙ processing prompt — 31%"
+
+    # Counter past the estimate (estimator undercounted): no honest
+    # denominator, so no percent — never >100%.
+    monkeypatch.setattr(cch, "estimate_request_context_tokens", lambda kw: 100)
+    notice = _managed_local_load_notice(_Agent(), {"model": "Qwen-Test"})
+    assert notice == "⚙ processing prompt"
+
+
+def test_load_notice_outranks_prefill(tmp_path, monkeypatch):
+    """While a load entry exists the load notice wins — prefill can't start
+    before the model is resident, so a simultaneous claim means the load
+    snapshot is authoritative."""
+    from agent.chat_completion_helpers import _managed_local_load_notice
+
+    state = tmp_path / "server.json"
+    state.write_text(json.dumps({"base_url": "http://127.0.0.1:18434/v1",
+                                 "api_key": "k"}), encoding="utf-8")
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.state_path",
+                        lambda: state)
+    monkeypatch.setattr(lp, "_ensure_watcher", lambda: None)
+    lp._apply_event("Qwen-Test", "status_change", _loading_event(0.5))
+    monkeypatch.setattr(lp, "get_prefill_progress",
+                        lambda model: {"processed": 999})
+
+    class _Agent:
+        base_url = "http://127.0.0.1:18434/v1"
+
+    notice = _managed_local_load_notice(_Agent(), {"model": "Qwen-Test"})
+    assert notice is not None and notice.startswith("⏳ loading")
+
+
+def test_prefill_progress_reads_busiest_processing_slot(monkeypatch):
+    monkeypatch.setattr(lp, "_endpoint", lambda: ("http://127.0.0.1:1", "k"))
+
+    class _Resp:
+        def __init__(self, payload):
+            self._payload = payload
+
+        def read(self):
+            return json.dumps(self._payload).encode()
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    slots = [
+        {"id": 0, "is_processing": False, "n_prompt_tokens_processed": 500},
+        {"id": 1, "is_processing": True, "n_prompt_tokens_processed": 42},
+        {"id": 2, "is_processing": True, "n_prompt_tokens_processed": 32768},
+    ]
+    monkeypatch.setattr(lp.urllib.request, "urlopen",
+                        lambda req, timeout=0: _Resp(slots))
+    assert lp.get_prefill_progress("m") == {"processed": 32768}
+
+    # Nothing processing -> None (idle slots' counters are leftovers).
+    idle = [{"id": 0, "is_processing": False, "n_prompt_tokens_processed": 500}]
+    monkeypatch.setattr(lp.urllib.request, "urlopen",
+                        lambda req, timeout=0: _Resp(idle))
+    assert lp.get_prefill_progress("m") is None
+
+    # Unreachable server -> None, never an exception.
+    def _boom(req, timeout=0):
+        raise OSError("refused")
+
+    monkeypatch.setattr(lp.urllib.request, "urlopen", _boom)
+    assert lp.get_prefill_progress("m") is None
+
+
+def test_endpoint_respects_ownership_guard(monkeypatch):
+    """The watcher's endpoint MUST come from the ownership-guarded reader.
+    Regression: a raw state-file read attached the SSE watcher to a
+    foreign install's server on the shared stable port (health answers
+    for anyone; only the dead-pid check proves ownership)."""
+    import hermes_cli.local_runtime.load_progress as lp
+
+    # Guard says "not ours": no endpoint, regardless of state on disk.
+    monkeypatch.setattr("hermes_cli.local_runtime.endpoint._state_endpoint",
+                        lambda: None)
+    assert lp._endpoint() is None
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.endpoint._state_endpoint",
+        lambda: {"base_url": "http://127.0.0.1:18434/v1", "api_key": "k"})
+    assert lp._endpoint() == ("http://127.0.0.1:18434", "k")
diff --git a/tests/hermes_cli/test_local_abandoned_requests.py b/tests/hermes_cli/test_local_abandoned_requests.py
new file mode 100644
index 0000000000..0f9d05260f
--- /dev/null
+++ b/tests/hermes_cli/test_local_abandoned_requests.py
@@ -0,0 +1,213 @@
+"""Abandoned-request lifecycle: work sent to the managed local server must
+die when its caller goes away, and teardown must never orphan VRAM.
+
+The incident this guards: auxiliary calls (title generation + retries)
+queued at the router behind a cold model load, their clients timed out
+and hung up, and the router then dispatched them anyway. Non-streamed
+responses write the socket only after the FULL generation, so nothing
+noticed the dead clients — two uncapped decodes ran at full GPU for the
+better part of an hour with nobody listening.
+
+Three contracts, one per failure link:
+1. Auxiliary requests to the managed local endpoint are always streamed
+   (a dead client then cancels decode at the first chunk write).
+2. Explicit caller max_tokens caps reach the managed local endpoint
+   (title generation's 64-token cap must not be silently dropped).
+3. Supervisor teardown terminates the whole process tree, and a router
+   respawn reaps orphaned model children first (each holds GiB of VRAM).
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import types
+
+import pytest
+
+import agent.auxiliary_client as aux
+from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+
+MANAGED_URL = "http://127.0.0.1:18434/v1"
+
+
+@pytest.fixture
+def managed_state(tmp_path, monkeypatch):
+    """A supervisor state file declaring the managed endpoint, cache reset."""
+    state = tmp_path / "server.json"
+    state.write_text(json.dumps({"base_url": MANAGED_URL, "api_key": "k",
+                                 "pid": 4242}), encoding="utf-8")
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.state_path",
+                        lambda: state)
+    monkeypatch.setattr(aux, "_managed_local_cache", (0.0, ""))
+    return state
+
+
+# ── 1. managed endpoint is always streamed ───────────────────
+
+
+def test_managed_endpoint_requires_stream(managed_state):
+    assert aux._provider_requires_stream("custom", MANAGED_URL) is True
+
+
+def test_managed_detection_matches_netloc_not_substring(managed_state):
+    # Same host, different port: a user's own external server — untouched.
+    assert aux._provider_requires_stream("custom", "http://127.0.0.1:8080/v1") is False
+
+
+def test_no_state_file_means_no_managed_endpoint(tmp_path, monkeypatch):
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.state_path",
+                        lambda: tmp_path / "absent.json")
+    monkeypatch.setattr(aux, "_managed_local_cache", (0.0, ""))
+    assert aux._is_managed_local_endpoint(MANAGED_URL) is False
+
+
+def test_remote_providers_unaffected(managed_state):
+    assert aux._provider_requires_stream("nous",
+                                         "https://inference-api.nousresearch.com/v1/") is False
+
+
+# ── 2. explicit caps reach the managed endpoint ──────────────
+
+
+def test_explicit_max_tokens_forwarded_to_managed_local(managed_state, monkeypatch):
+    monkeypatch.setattr(aux, "_current_custom_base_url", lambda: MANAGED_URL)
+    kwargs = aux._build_call_kwargs(
+        "custom", "Qwen-Local", [{"role": "user", "content": "hi"}],
+        max_tokens=64, timeout=30.0, task="title_generation")
+    assert kwargs.get("max_tokens") == 64 or kwargs.get("max_completion_tokens") == 64, (
+        "explicit caller cap dropped on the managed local endpoint — an "
+        "EOS-less generation then runs to the full context window")
+
+
+def test_no_default_cap_policy_unchanged_for_remote(monkeypatch):
+    # A generic remote provider still drops the cap (the forwarding gate
+    # is an allow-list). openrouter no longer qualifies as the example
+    # here: main forwards its caps deliberately (#41035, 402 affordability).
+    monkeypatch.setattr(aux, "_managed_local_cache", (0.0, ""))
+    kwargs = aux._build_call_kwargs(
+        "openai", "some/model", [{"role": "user", "content": "hi"}],
+        max_tokens=64, timeout=30.0)
+    assert "max_tokens" not in kwargs and "max_completion_tokens" not in kwargs
+
+
+# ── 3. teardown kills the tree; respawn reaps orphans ────────
+
+
+class _FakeChild:
+    def __init__(self, pid):
+        self.pid = pid
+        self.terminated = False
+        self.killed = False
+
+    def terminate(self):
+        self.terminated = True
+
+    def is_running(self):
+        return not self.terminated and not self.killed
+
+    def kill(self):
+        self.killed = True
+
+
+def test_terminate_tree_terminates_children_too(monkeypatch):
+    children = [_FakeChild(101), _FakeChild(102)]
+
+    class _FakeParentProc:
+        def __init__(self, pid):
+            self.pid = pid
+
+        def children(self, recursive=False):
+            assert recursive is True
+            return children
+
+    fake_psutil = types.SimpleNamespace(Process=_FakeParentProc)
+    monkeypatch.setitem(__import__("sys").modules, "psutil", fake_psutil)
+
+    class _FakeRouter:
+        pid = 4242
+        terminated = False
+
+        def terminate(self):
+            _FakeRouter.terminated = True
+
+        def wait(self, timeout=None):
+            return 0
+
+        def poll(self):
+            return None
+
+    LlamaServerSupervisor._terminate_tree(_FakeRouter())
+    assert _FakeRouter.terminated
+    assert all(c.terminated for c in children), (
+        "router children orphaned on stop — each holds GiB of VRAM")
+
+
+def test_terminate_tree_survives_missing_psutil(monkeypatch):
+    import builtins
+
+    real_import = builtins.__import__
+
+    def _no_psutil(name, *a, **k):
+        if name == "psutil":
+            raise ImportError("nope")
+        return real_import(name, *a, **k)
+
+    monkeypatch.setattr(builtins, "__import__", _no_psutil)
+
+    class _FakeRouter:
+        pid = 4242
+        terminated = False
+
+        def terminate(self):
+            _FakeRouter.terminated = True
+
+        def wait(self, timeout=None):
+            return 0
+
+    LlamaServerSupervisor._terminate_tree(_FakeRouter())
+    assert _FakeRouter.terminated  # router still stopped without psutil
+
+
+def test_reap_orphans_kills_only_our_parentless_binaries(tmp_path, monkeypatch):
+    exe = tmp_path / "llama-server.exe"
+    exe.write_text("")
+
+    orphan = _FakeChild(300)
+    adopted = _FakeChild(301)     # parent alive -> not an orphan
+    foreign = _FakeChild(302)     # different binary -> never touched
+
+    def _info(pid, exe_path, ppid):
+        p = _FakeChild(pid)
+        p.info = {"exe": exe_path, "ppid": ppid}
+        return p
+
+    procs = [
+        _info(300, str(exe), 9999),          # dead parent -> reap
+        _info(301, str(exe), 1),             # live parent -> keep
+        _info(302, str(tmp_path / "other.exe"), 9999),  # foreign -> keep
+    ]
+    reaped = []
+    for p in procs:
+        p.kill = lambda p=p: reaped.append(p.info and p.pid)
+
+    class _NoSuch(Exception):
+        pass
+
+    fake_psutil = types.SimpleNamespace(
+        process_iter=lambda attrs: procs,
+        pid_exists=lambda pid: pid == 1,
+        NoSuchProcess=_NoSuch,
+        AccessDenied=_NoSuch,
+    )
+    monkeypatch.setitem(__import__("sys").modules, "psutil", fake_psutil)
+    monkeypatch.setattr("hermes_cli.local_runtime.supervisor.server_binary",
+                        lambda install_dir: exe)
+
+    sup = LlamaServerSupervisor.__new__(LlamaServerSupervisor)
+    sup.install_dir = tmp_path
+    sup.proc = None
+    sup._reap_orphaned_children()
+
+    assert reaped == [300], f"reaped {reaped}; wanted only the orphan (300)"
diff --git a/tests/hermes_cli/test_local_context_resolution.py b/tests/hermes_cli/test_local_context_resolution.py
new file mode 100644
index 0000000000..26e3c28e91
--- /dev/null
+++ b/tests/hermes_cli/test_local_context_resolution.py
@@ -0,0 +1,120 @@
+"""Context-length resolution for the managed llama.cpp router.
+
+The incident: the statusbar showed 131K for a local model the server had
+granted 262144 tokens. The router reports ``meta: null`` on /v1/models
+for a model that is not currently LOADED (models autoload on first chat,
+so at session start the model is routinely unloaded), and /v1/models/{id}
+404s — every metadata probe missed, resolution fell through to the
+name-pattern defaults, and the "qwen" family catch-all (131072) shipped
+as the compressor's budget and the statusbar's denominator.
+
+Contract: for a llama.cpp server, /props default_generation_settings.n_ctx
+(the preset-backed RUNTIME window, served even for unloaded models) is
+the authority, probed before the /v1/models fallbacks.
+"""
+
+from __future__ import annotations
+
+import http.server
+import json
+import threading
+
+import pytest
+
+import agent.model_metadata as mm
+
+
+GRANTED = 262144
+
+
+@pytest.fixture
+def router():
+    """Stub of the llama-server router with the model UNLOADED:
+    /v1/models carries meta=null; /props answers from the preset."""
+
+    class _Router(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            if self.path.startswith("/props"):
+                body = {"default_generation_settings": {"n_ctx": GRANTED}}
+            elif self.path == "/v1/models":
+                body = {"data": [{
+                    "id": "Qwen-Test-UD-Q4_K_M",
+                    "owned_by": "llamacpp",
+                    "meta": None,
+                    "status": {"value": "unloaded"},
+                }]}
+            else:  # /v1/models/{id} -> 404, as the real router answers
+                self.send_response(404)
+                self.send_header("Content-Length", "0")
+                self.end_headers()
+                return
+            raw = json.dumps(body).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(raw)))
+            self.end_headers()
+            self.wfile.write(raw)
+
+        def log_message(self, *a):
+            pass
+
+    server = http.server.HTTPServer(("127.0.0.1", 0), _Router)
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    yield f"http://127.0.0.1:{server.server_address[1]}/v1"
+    server.shutdown()
+
+
+def test_unloaded_llamacpp_model_resolves_granted_window(router, monkeypatch):
+    monkeypatch.setattr(mm, "detect_local_server_type", lambda *a, **k: "llamacpp")
+    monkeypatch.setattr(mm, "_endpoint_blackholed", lambda *a, **k: False)
+    ctx = mm._query_local_context_length_uncached("Qwen-Test-UD-Q4_K_M", router)
+    assert ctx == GRANTED, (
+        f"resolved {ctx}; an unloaded model must resolve the preset window "
+        "from /props, not fall through to name-pattern catch-alls")
+
+
+def test_props_beats_meta_when_model_loaded(router, monkeypatch):
+    """/props is probed first even when /v1/models would answer: n_ctx from
+    /props is the same runtime value, and probing it first keeps loaded and
+    unloaded models on one code path."""
+    monkeypatch.setattr(mm, "detect_local_server_type", lambda *a, **k: "llamacpp")
+    monkeypatch.setattr(mm, "_endpoint_blackholed", lambda *a, **k: False)
+    ctx = mm._query_local_context_length_uncached("Qwen-Test-UD-Q4_K_M", router)
+    assert ctx == GRANTED
+
+
+def test_non_llamacpp_servers_skip_props(monkeypatch):
+    """Ollama/LM Studio/vLLM keep their existing probe order — /props is
+    llama.cpp-shaped and must not be consulted for other server types."""
+    calls = []
+
+    class _FakeResp:
+        status_code = 404
+
+        def json(self):
+            return {}
+
+    class _FakeClient:
+        def __init__(self, *a, **k):
+            pass
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+        def get(self, url):
+            calls.append(url)
+            return _FakeResp()
+
+        def post(self, url, **k):
+            calls.append(url)
+            return _FakeResp()
+
+    import httpx
+    monkeypatch.setattr(httpx, "Client", _FakeClient)
+    monkeypatch.setattr(mm, "detect_local_server_type", lambda *a, **k: "vllm")
+    monkeypatch.setattr(mm, "_endpoint_blackholed", lambda *a, **k: False)
+    mm._query_local_context_length_uncached("m", "http://127.0.0.1:9999/v1")
+    assert not any("/props" in u for u in calls)
diff --git a/tests/hermes_cli/test_local_growth.py b/tests/hermes_cli/test_local_growth.py
new file mode 100644
index 0000000000..6367668aee
--- /dev/null
+++ b/tests/hermes_cli/test_local_growth.py
@@ -0,0 +1,280 @@
+"""In-session growth contracts (growth.py + the presets override seam).
+
+The live half of the window ladder: grow before compress, overrides
+persist across boots, physics re-checked every boot, growth state dies
+with the model."""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    return home
+
+
+def test_overrides_roundtrip_and_clear(hermes_home):
+    from hermes_cli.local_runtime.growth import (
+        clear_window_override,
+        load_window_overrides,
+        save_window_override,
+    )
+
+    assert load_window_overrides() == {}
+    save_window_override("model-a", 98304)
+    save_window_override("model-b", 262144)
+    assert load_window_overrides() == {"model-a": 98304, "model-b": 262144}
+    clear_window_override("model-a")
+    assert load_window_overrides() == {"model-b": 262144}
+    # Clearing a missing key is a no-op, not an error.
+    clear_window_override("never-existed")
+
+
+def test_corrupt_overrides_read_as_empty(hermes_home):
+    from hermes_cli.local_runtime.growth import (
+        load_window_overrides,
+        window_overrides_path,
+    )
+
+    path = window_overrides_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("{not json", encoding="utf-8")
+    assert load_window_overrides() == {}
+
+
+def test_growth_declines_foreign_endpoints(hermes_home):
+    """Only the server THIS process supervises grows — a detected external
+    server or another process's endpoint returns None untouched."""
+    from hermes_cli.local_runtime.growth import maybe_grow_window
+
+    grown = maybe_grow_window(
+        "some-model", base_url="http://127.0.0.1:9999/v1",
+        session_tokens=100_000, current_window=65536)
+    assert grown is None
+
+
+def test_occupancy_confirmed_skips_gate_one():
+    """The agent's compression gate IS the occupancy signal: when it fired,
+    growth must not re-derive its own edge and hold. Decision-table check
+    with a synthetic profile."""
+    from hermes_cli.local_runtime.context_policy import growth_decision
+    from hermes_cli.local_runtime.estimator import (
+        HardwareBudget,
+        LayerKind,
+        ModelProfile,
+    )
+
+    gib = 1 << 30
+    profile = ModelProfile(
+        name="m", weights_bytes=2 * gib, embd_table_bytes=0,
+        n_ctx_train=262144,
+        layers=[(LayerKind.FULL, 4096)] * 16 + [(LayerKind.RECURRENT, 0)] * 48)
+    budget = HardwareBudget(usable_vram_bytes=26 * gib,
+                            total_device_bytes=32 * gib,
+                            ram_available_bytes=64 * gib)
+
+    # Hermes' threshold (e.g. 80% of window) can sit BELOW the ladder's 85%
+    # occupancy gate: 78K of a 96K window is 81%.
+    kwargs = dict(current_window=98304, session_tokens=78_000,
+                  measured_decode_tok_s=None, server_idle=True)
+    ungated = growth_decision(profile, budget, **kwargs)
+    assert ungated.action == "hold", "sanity: below the ladder's own gate"
+
+    confirmed = growth_decision(profile, budget, occupancy_confirmed=True, **kwargs)
+    assert confirmed.action == "grow"
+    assert confirmed.next_window and confirmed.next_window > 98304
+
+
+def _stage_fake_gguf(mdir, name):
+    mdir.mkdir(parents=True, exist_ok=True)
+    (mdir / f"{name}.gguf").write_bytes(b"GGUF" + b"\x00" * 64)
+
+
+def _header_stub(sampling: dict | None = None):
+    """A read_gguf_header stand-in for tests that monkeypatch the reader:
+    just enough surface for preset generation (sampling ladder included)."""
+
+    class _Stub:
+        sampling_defaults = dict(sampling or {})
+
+    return _Stub()
+
+
+def _tiny_profile(model_id: str):
+    from hermes_cli.local_runtime.estimator import LayerKind, ModelProfile
+
+    gib = 1 << 30
+    return ModelProfile(
+        name=model_id, weights_bytes=2 * gib, embd_table_bytes=0,
+        n_ctx_train=131072,
+        layers=[(LayerKind.FULL, 512)] * 4)
+
+
+def test_preset_generation_for_catalog_model_with_mmproj(hermes_home, tmp_path, monkeypatch):
+    """generate_presets must survive a model that IS in the catalog and
+    carries a vision projector — this executes the find_entry_for_model +
+    mmproj overhead branch that synthetic test models skip. Regression:
+    the branch once treated the (entry, variant) tuple as the entry and
+    crashed every real boot into the stock-fit fallback."""
+    import hermes_cli.local_runtime.presets as presets_mod
+
+    from hermes_cli.local_runtime.catalog import CATALOG
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    # A real catalog id with an mmproj (the recommended row has one).
+    entry = next(e for e in CATALOG if e.mmproj is not None)
+    variant = entry.variants[-1]
+    mdir = tmp_path / "models"
+    _stage_fake_gguf(mdir, variant.model_id)
+
+    monkeypatch.setattr(presets_mod, "read_gguf_header", lambda p: _header_stub())
+    monkeypatch.setattr(presets_mod, "profile_from_gguf",
+                        lambda h: _tiny_profile(variant.model_id))
+
+    gib = 1 << 30
+    budget = HardwareBudget(usable_vram_bytes=24 * gib,
+                            total_device_bytes=24 * gib,
+                            ram_available_bytes=64 * gib)
+    entries = presets_mod.generate_presets(mdir, budget, tmp_path / "p.ini")
+    assert len(entries) == 1
+    assert entries[0].refusal is None
+    assert entries[0].window > 0
+
+
+def test_preset_restores_grown_window_capped_at_native(hermes_home, tmp_path, monkeypatch):
+    """A persisted override lifts the preset window; an absurd override is
+    capped at native. GGUF parsing is stubbed — the contract under test is
+    the override plumbing, not the reader."""
+    import hermes_cli.local_runtime.presets as presets_mod
+
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+    from hermes_cli.local_runtime.growth import save_window_override
+
+    mdir = tmp_path / "models"
+    _stage_fake_gguf(mdir, "tiny-dense")
+    monkeypatch.setattr(presets_mod, "read_gguf_header", lambda p: _header_stub())
+    monkeypatch.setattr(presets_mod, "profile_from_gguf",
+                        lambda h: _tiny_profile("tiny-dense"))
+
+    gib = 1 << 30
+    budget = HardwareBudget(usable_vram_bytes=24 * gib,
+                            total_device_bytes=24 * gib,
+                            ram_available_bytes=64 * gib)
+    preset = tmp_path / "presets.ini"
+
+    baseline = presets_mod.generate_presets(mdir, budget, preset)[0]
+    assert baseline.window == 131072  # tiny model: native from the start
+
+    # Override above native must cap at native, not exceed it.
+    save_window_override("tiny-dense", 10_000_000)
+    capped = presets_mod.generate_presets(mdir, budget, preset)[0]
+    assert capped.window == 131072
+
+
+def test_preset_ignores_override_below_launch_window(hermes_home, tmp_path, monkeypatch):
+    """Overrides only ever RAISE the window (growth is monotone); a stale
+    smaller override never shrinks a launch decision."""
+    import hermes_cli.local_runtime.presets as presets_mod
+
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+    from hermes_cli.local_runtime.growth import save_window_override
+
+    mdir = tmp_path / "models"
+    _stage_fake_gguf(mdir, "tiny-dense")
+    monkeypatch.setattr(presets_mod, "read_gguf_header", lambda p: _header_stub())
+    monkeypatch.setattr(presets_mod, "profile_from_gguf",
+                        lambda h: _tiny_profile("tiny-dense"))
+    save_window_override("tiny-dense", 65536)
+
+    gib = 1 << 30
+    budget = HardwareBudget(usable_vram_bytes=24 * gib,
+                            total_device_bytes=24 * gib,
+                            ram_available_bytes=64 * gib)
+    entry = presets_mod.generate_presets(mdir, budget, tmp_path / "p.ini")[0]
+    assert entry.window == 131072
+
+
+def test_preset_restores_grown_window_midladder(hermes_home, tmp_path, monkeypatch):
+    """The real growth shape: launch at a lower rung, override to a middle
+    rung -> the preset window follows the override."""
+    import hermes_cli.local_runtime.presets as presets_mod
+
+    from hermes_cli.local_runtime.estimator import HardwareBudget, LayerKind, ModelProfile
+    from hermes_cli.local_runtime.growth import save_window_override
+
+    gib = 1 << 30
+    # Expensive dense KV so the launch decision lands BELOW native on this
+    # budget: 60 layers x 4 KiB/tok f16 -> q8 ~= 120 KiB/tok.
+    profile = ModelProfile(
+        name="big-dense", weights_bytes=20 * gib, embd_table_bytes=0,
+        n_ctx_train=262144,
+        layers=[(LayerKind.FULL, 4096)] * 60)
+    mdir = tmp_path / "models"
+    _stage_fake_gguf(mdir, "big-dense")
+    monkeypatch.setattr(presets_mod, "read_gguf_header", lambda p: _header_stub())
+    monkeypatch.setattr(presets_mod, "profile_from_gguf", lambda h: profile)
+
+    budget = HardwareBudget(usable_vram_bytes=28 * gib,
+                            total_device_bytes=32 * gib,
+                            ram_available_bytes=128 * gib)
+    baseline = presets_mod.generate_presets(mdir, budget, tmp_path / "a.ini")[0]
+    assert baseline.window < 262144, "sanity: launch below native"
+
+    grown = baseline.window * 2
+    save_window_override("big-dense", grown)
+    restored = presets_mod.generate_presets(mdir, budget, tmp_path / "b.ini")[0]
+    assert restored.window >= grown, "override must lift the launch window"
+
+
+def test_sampling_ladder_file_beats_catalog_beats_nothing(hermes_home, tmp_path, monkeypatch):
+    """The sampling deference ladder: the GGUF's own general.sampling.*
+    wins per key, catalog fills only what the file left silent, and a
+    model with neither gets no sampling keys at all (llama.cpp defaults).
+    Policy keys (ctx-size, cache types) must never be displaced."""
+    import configparser
+
+    import hermes_cli.local_runtime.presets as presets_mod
+    from hermes_cli.local_runtime.catalog import CATALOG
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    # A real catalog entry WITH catalog sampling, staged on disk.
+    entry = next(e for e in CATALOG if e.sampling)
+    variant = entry.variants[-1]
+    mdir = tmp_path / "models"
+    _stage_fake_gguf(mdir, variant.model_id)
+    _stage_fake_gguf(mdir, "off-catalog-model")
+
+    gib = 1 << 30
+    budget = HardwareBudget(usable_vram_bytes=64 * gib,
+                            total_device_bytes=64 * gib,
+                            ram_available_bytes=64 * gib)
+    # The catalog model's file carries temp; catalog must fill the rest
+    # but NOT displace the file's value. The off-catalog file carries none.
+    def fake_header(path):
+        if variant.model_id in str(path):
+            return _header_stub({"temp": "0.42"})
+        return _header_stub()
+
+    monkeypatch.setattr(presets_mod, "read_gguf_header", fake_header)
+    monkeypatch.setattr(presets_mod, "profile_from_gguf",
+                        lambda h: _tiny_profile("x"))
+
+    out = tmp_path / "presets.ini"
+    presets_mod.generate_presets(mdir, budget, out)
+    ini = configparser.ConfigParser()
+    ini.read(out)
+
+    sec = ini[variant.model_id]
+    assert sec["temp"] == "0.42", "file's own sampling must win per key"
+    for k, v in entry.sampling.items():
+        if k != "temp":
+            assert sec[k] == v, f"catalog must fill the silent key {k}"
+    assert "ctx-size" in sec, "policy keys survive the ladder"
+
+    off = ini["off-catalog-model"]
+    assert "temp" not in off and "top-p" not in off, (
+        "no file keys + no catalog entry = llama.cpp defaults, not ours")
diff --git a/tests/hermes_cli/test_local_models_routes.py b/tests/hermes_cli/test_local_models_routes.py
new file mode 100644
index 0000000000..6ee98aae1e
--- /dev/null
+++ b/tests/hermes_cli/test_local_models_routes.py
@@ -0,0 +1,293 @@
+"""Contract tests for the local-models dashboard routes (Rollout 4).
+
+Real FastAPI TestClient against the real router; the runtime pieces
+underneath are exercised against temp HERMES_HOME (autouse fixture). Network
+downloads are stubbed at the urllib boundary — never live."""
+
+from __future__ import annotations
+
+import io
+import json
+import time
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli import web_server
+
+    test_client = TestClient(web_server.app)
+    # Same auth pattern as the git-route tests: present the session token.
+    test_client.headers[web_server._SESSION_HEADER_NAME] = web_server._SESSION_TOKEN
+    return test_client
+
+
+def test_local_models_routes_require_auth(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli import web_server
+
+    unauth = TestClient(web_server.app)
+    assert unauth.get("/api/local-models/status").status_code == 401
+
+
+def _write_fake_gguf(path: Path, size: int = 1024) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(b"GGUF" + b"\x00" * size)
+
+
+# ── status ───────────────────────────────────────────────────
+
+
+def test_status_shape_and_defaults(client):
+    r = client.get("/api/local-models/status")
+    assert r.status_code == 200
+    data = r.json()
+    # Contract: every key the pane's first paint needs, present and typed.
+    assert isinstance(data["enabled"], bool)
+    assert isinstance(data["tag"], str) and data["tag"].startswith("b")
+    assert isinstance(data["runtime_installed"], bool)
+    assert isinstance(data["server_running"], bool)
+    assert isinstance(data["models"], list)
+
+
+def test_status_lists_staged_models_with_labels(client, tmp_path):
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    _write_fake_gguf(models_dir() / "Some-Model.gguf", size=2048)
+    data = client.get("/api/local-models/status").json()
+    ids = [m["id"] for m in data["models"]]
+    assert "Some-Model" in ids
+    row = data["models"][ids.index("Some-Model")]
+    assert row["size_bytes"] > 0
+    assert row["size_label"].endswith("GB")
+
+
+# ── hardware ─────────────────────────────────────────────────
+
+
+def test_hardware_plain_facts(client):
+    data = client.get("/api/local-models/hardware").json()
+    assert isinstance(data["uma"], bool)
+    assert data["ram_total_bytes"] > 0
+    assert data["vram_total_bytes"] >= 0
+    # GPU fields are None-able (non-NVIDIA machines) but must exist.
+    assert "gpu_name" in data and "gpu_util_percent" in data and "vram_used_bytes" in data
+
+
+# ── catalog ──────────────────────────────────────────────────
+
+
+def test_catalog_prices_every_entry_for_this_machine(client):
+    data = client.get("/api/local-models/catalog").json()
+    assert len(data["models"]) >= 3
+    for row in data["models"]:
+        # The three user questions, answered on every row:
+        assert row["size_label"].endswith("GB")            # how big
+        assert isinstance(row["fits"], bool)               # will it fit
+        assert row["fit_summary"]                          # what shape
+        if row["fits"]:
+            assert row["start_window"] >= 1
+            assert row["start_window_label"].endswith("K")
+        else:
+            assert "memory" in row["fit_summary"].lower()
+        assert isinstance(row["downloaded"], bool)
+
+
+def test_catalog_never_hides_unaffordable_models(client, monkeypatch):
+    """Unaffordable entries stay visible with a plain reason — hiding them
+    is how users conclude the feature is broken."""
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    tiny = HardwareBudget(usable_vram_bytes=1 << 30, total_device_bytes=1 << 30,
+                          ram_available_bytes=1 << 30)
+    monkeypatch.setattr("hermes_cli.local_runtime.hardware.probe_budget",
+                        lambda **kw: tiny)
+    data = client.get("/api/local-models/catalog").json()
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    assert len(data["models"]) == len(CATALOG)
+    refused = [m for m in data["models"] if not m["fits"]]
+    assert refused, "a 1 GiB machine must refuse the 20 GB models"
+    for row in refused:
+        assert row["fit_detail"] or row["fit_summary"]
+
+
+# ── downloads ────────────────────────────────────────────────
+
+
+def test_download_unknown_model_404s(client):
+    r = client.post("/api/local-models/download", json={"model_id": "nope"})
+    assert r.status_code == 404
+
+
+def test_download_short_of_server_length_errors_and_cleans_up(client, monkeypatch):
+    """Catalog sizes are advisory (upstream re-uploads may make them
+    stale — a mismatch against the CATALOG must not fail a download).
+    The server's own declared length is the only completeness check:
+    fewer bytes than the server promised means a dropped connection, so
+    the job errors and nothing is staged."""
+
+    class FakeResponse(io.BytesIO):
+        # Body is 17 bytes; the server promises 32 — a truncated stream.
+        headers = {"Content-Length": "32"}
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr("urllib.request.urlopen",
+                        lambda *a, **k: FakeResponse(b"not the real body"))
+
+    # Pin a generous budget: variant selection prices against the machine
+    # running the test, and a GPU-less CI runner honestly refuses every
+    # build (409) — this test is about the download path, not selection.
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    budget = HardwareBudget(usable_vram_bytes=64 << 30,
+                            total_device_bytes=64 << 30,
+                            ram_available_bytes=64 << 30)
+    monkeypatch.setattr("hermes_cli.local_runtime.hardware.probe_budget",
+                        lambda **kw: budget)
+
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    entry_id = CATALOG[0].id
+    r = client.post("/api/local-models/download", json={"model_id": entry_id})
+    assert r.status_code == 200
+    job_id = r.json()["job_id"]
+    assert job_id
+
+    deadline = time.time() + 10
+    status = None
+    while time.time() < deadline:
+        status = client.get(f"/api/local-models/jobs/{job_id}").json()
+        if status["status"] in ("done", "error"):
+            break
+        time.sleep(0.05)
+    assert status is not None and status["status"] == "error"
+    assert "bytes" in status["error"].lower()
+
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    assert not (models_dir() / f"{entry_id}.gguf").exists()
+    assert not (models_dir() / f"{entry_id}.part").exists()
+
+
+def test_download_already_downloaded_short_circuits(client, monkeypatch):
+    from hermes_cli.local_runtime.bootstrap import models_dir
+    from hermes_cli.local_runtime.catalog import CATALOG, select_variant
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    # Pin the budget so the selected variant is deterministic in the test.
+    budget = HardwareBudget(usable_vram_bytes=64 << 30, total_device_bytes=64 << 30,
+                            ram_available_bytes=64 << 30)
+    monkeypatch.setattr("hermes_cli.local_runtime.hardware.probe_budget",
+                        lambda **kw: budget)
+    choice = select_variant(CATALOG[0], budget)
+    assert choice is not None
+    _write_fake_gguf(models_dir() / choice.variant.files[0].local_name)
+    r = client.post("/api/local-models/download", json={"model_id": CATALOG[0].id})
+    assert r.status_code == 200
+    assert r.json()["already_downloaded"] is True
+
+
+def test_delete_model(client):
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    _write_fake_gguf(models_dir() / "Doomed.gguf")
+    assert client.delete("/api/local-models/models/Doomed").status_code == 200
+    assert not (models_dir() / "Doomed.gguf").exists()
+    assert client.delete("/api/local-models/models/Doomed").status_code == 404
+
+
+# ── runtime install ──────────────────────────────────────────
+
+
+def test_runtime_install_rejects_impossible_combo(client, monkeypatch):
+    """Impossible platform/backend combos fail the POST itself with the
+    resolver's honest message — not a background job that dies silently.
+    (win-arm64-vulkan; the old cuda case became real upstream at ~b1036x.)"""
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries._host_os_arch", lambda: ("win", "arm64"))
+    r = client.post("/api/local-models/runtime/install", json={"backend": "vulkan"})
+    assert r.status_code == 400
+    assert "arm64" in r.json()["detail"]
+
+
+def test_job_poll_unknown_404s(client):
+    assert client.get("/api/local-models/jobs/deadbeef").status_code == 404
+
+
+def test_eject_without_supervisor_is_not_a_500(client, monkeypatch):
+    """Eject on an ADOPTED server (no in-process supervisor — the shape
+    every backend restart produces, since boot adopts the running server
+    via the state file) must route through the persisted endpoint, not
+    crash. Regression: _state_endpoint was only imported inside the
+    status route, so eject raised NameError -> 500 for every adopted-
+    server session."""
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.get_supervisor", lambda: None)
+    # No running server either: the route must answer 409 (no server),
+    # never a NameError 500.
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models._state_endpoint", lambda: None)
+    r = client.post("/api/local-models/eject", json={"model_id": "anything"})
+    assert r.status_code == 409, (r.status_code, r.text)
+
+
+def test_download_tolerates_stale_catalog_size(client, monkeypatch):
+    """Upstream re-uploads make catalog sizes stale; a download whose
+    delivered bytes are self-consistent with the SERVER's declared length
+    must succeed even when the catalog said something else. (This is the
+    tolerance the sha removal was for — being out of date must not break
+    downloads.)"""
+
+    body = b"x" * 48  # server-consistent: Content-Length == body length
+
+    class FakeResponse(io.BytesIO):
+        headers = {"Content-Length": str(len(body))}
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr("urllib.request.urlopen",
+                        lambda *a, **k: FakeResponse(body))
+
+    from hermes_cli.local_runtime.estimator import HardwareBudget
+
+    budget = HardwareBudget(usable_vram_bytes=64 << 30,
+                            total_device_bytes=64 << 30,
+                            ram_available_bytes=64 << 30)
+    monkeypatch.setattr("hermes_cli.local_runtime.hardware.probe_budget",
+                        lambda **kw: budget)
+    # Keep the post-download server bounce out of this unit.
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.refresh_local_runtime",
+        lambda: False)
+
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    # Catalog size for this entry is in the tens of GB — wildly stale
+    # versus our 48-byte body. The download must still land.
+    entry_id = CATALOG[0].id
+    r = client.post("/api/local-models/download", json={"model_id": entry_id})
+    assert r.status_code == 200
+    job_id = r.json()["job_id"]
+
+    deadline = time.time() + 10
+    status = None
+    while time.time() < deadline:
+        status = client.get(f"/api/local-models/jobs/{job_id}").json()
+        if status["status"] in ("done", "error"):
+            break
+        time.sleep(0.05)
+    assert status is not None and status["status"] == "done", status.get("error")
diff --git a/tests/hermes_cli/test_local_picker_identity.py b/tests/hermes_cli/test_local_picker_identity.py
new file mode 100644
index 0000000000..c83067a7cb
--- /dev/null
+++ b/tests/hermes_cli/test_local_picker_identity.py
@@ -0,0 +1,74 @@
+"""The managed local server owns its picker identity.
+
+A live session on the managed llama-server reports provider "custom"
+(the resolution seam's generic label for a raw base_url). The picker
+payload used to materialize that as a duplicate "Custom endpoint" group
+above the Local row — same staged models listed twice, checkmark on the
+wrong group. Contract: when the current session points at the managed
+endpoint, the Local row is current and no custom-endpoint duplicate
+exists; a user's own external endpoint keeps its row untouched."""
+
+from __future__ import annotations
+
+import dataclasses
+
+import pytest
+
+
+MANAGED = {"base_url": "http://127.0.0.1:18434/v1", "api_key": "k"}
+STAGED = {"Qwen-A-UD-Q4_K_M", "Qwen-B-UD-Q4_K_M"}
+
+
+@pytest.fixture
+def ctx(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    import hermes_cli.inventory as inv
+
+    monkeypatch.setattr("hermes_cli.local_runtime.bootstrap.staged_model_ids",
+                        lambda: set(STAGED))
+    monkeypatch.setattr("hermes_cli.local_runtime.endpoint._state_endpoint",
+                        lambda: dict(MANAGED))
+    context = inv.load_picker_context()
+    return inv, context
+
+
+def _rows(inv, context, **overrides):
+    context = dataclasses.replace(context, **overrides)
+    return inv.build_models_payload(context, explicit_only=True)["providers"]
+
+
+def test_managed_custom_session_shows_only_the_local_row(ctx):
+    inv, context = ctx
+    rows = _rows(inv, context,
+                 current_provider="custom",
+                 current_model="Qwen-A-UD-Q4_K_M",
+                 current_base_url=MANAGED["base_url"])
+    slugs = [r["slug"] for r in rows]
+    assert "llamacpp" in slugs
+    assert "custom" not in slugs, (
+        "managed endpoint leaked a duplicate 'Custom endpoint' group")
+    local = next(r for r in rows if r["slug"] == "llamacpp")
+    assert local["is_current"] is True
+    assert local["name"] == "Local"
+
+
+def test_external_custom_endpoint_keeps_its_row(ctx):
+    inv, context = ctx
+    rows = _rows(inv, context,
+                 current_provider="custom",
+                 current_model="some-model",
+                 current_base_url="http://my-vllm-box:8000/v1")
+    slugs = [r["slug"] for r in rows]
+    assert "custom" in slugs, "a real external endpoint must keep its row"
+    custom = next(r for r in rows if r["slug"] == "custom")
+    assert custom["is_current"] is True
+    local = next(r for r in rows if r["slug"] == "llamacpp")
+    assert local["is_current"] is False
+
+
+def test_remote_provider_session_unaffected(ctx):
+    inv, context = ctx
+    rows = _rows(inv, context)
+    local = next(r for r in rows if r["slug"] == "llamacpp")
+    assert local["is_current"] is False
+    assert "custom" not in [r["slug"] for r in rows if r.get("is_current")]
diff --git a/tests/hermes_cli/test_local_quickstart.py b/tests/hermes_cli/test_local_quickstart.py
new file mode 100644
index 0000000000..f6a8f56193
--- /dev/null
+++ b/tests/hermes_cli/test_local_quickstart.py
@@ -0,0 +1,187 @@
+"""Quickstart route: one POST from nothing to a working local default.
+
+Contract, not implementation: the route must (a) preflight-fail
+synchronously when nothing fits, (b) report which legs the job will run
+(runtime install / model download), skipping legs already satisfied,
+and (c) run install -> download -> activate through the same code paths
+the individual routes use. The slow legs are stubbed at their module
+boundaries; the sequencing and job bookkeeping are real.
+"""
+
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli import web_server
+
+    test_client = TestClient(web_server.app)
+    test_client.headers[web_server._SESSION_HEADER_NAME] = web_server._SESSION_TOKEN
+    return test_client
+
+
+def _wait_job(client, job_id: str, timeout: float = 10.0) -> dict:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        job = client.get(f"/api/local-models/jobs/{job_id}").json()
+        if job["status"] != "running":
+            return job
+        time.sleep(0.05)
+    raise AssertionError(f"job {job_id} still running after {timeout}s")
+
+
+def test_quickstart_unknown_model_404s(client):
+    r = client.post("/api/local-models/quickstart", json={"model_id": "no-such"})
+    assert r.status_code == 404
+
+
+def test_quickstart_refuses_when_nothing_fits(client, monkeypatch):
+    """Preflight is synchronous: a machine no catalog entry fits gets a 409
+    with guidance, not a doomed background job."""
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.catalog.select_variant", lambda *a, **k: None)
+    r = client.post("/api/local-models/quickstart", json={})
+    assert r.status_code == 409
+    assert "Local Models" in r.json()["detail"]
+
+
+def test_quickstart_runs_all_three_legs(client, monkeypatch, tmp_path):
+    """Fresh machine: install runtime -> download recommended -> activate.
+    Each leg is asserted by its observable call, in order."""
+    calls: list[str] = []
+
+    # Leg 1: no runtime installed yet; install is the stubbed binaries call.
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.installed_tags", lambda: [])
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed",
+        lambda tag, backend, progress=None: calls.append("install"))
+
+    # Leg 2: nothing staged; the download writes the files the plan names.
+    def _fake_download(url, dest, job, *, base_done=0, keep_totals=False):
+        Path(dest).parent.mkdir(parents=True, exist_ok=True)
+        Path(dest).write_bytes(b"GGUF\x00")
+        calls.append("download")
+
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models.download_file", _fake_download)
+
+    # Leg 3: activation — stub the server start and the model assignment.
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.ensure_local_runtime",
+        lambda config, force=False: calls.append("server") or None)
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models._state_endpoint",
+        lambda: {"base_url": "http://127.0.0.1:1/v1", "api_key": "k"})
+    from hermes_cli import web_deps
+
+    monkeypatch.setattr(
+        web_deps, "late",
+        lambda name: (lambda *a, **k: calls.append("assign")))
+
+    r = client.post("/api/local-models/quickstart", json={})
+    assert r.status_code == 200
+    body = r.json()
+    assert body["needs_runtime"] is True
+    assert body["needs_download"] is True
+    assert body["download_bytes"] > 0
+
+    job = _wait_job(client, body["job_id"])
+    assert job["status"] == "done", job["error"]
+    assert job["kind"] == "quickstart"
+    # Order is the contract: engine, weights, server, default.
+    assert calls[0] == "install"
+    assert "download" in calls
+    assert calls.index("install") < calls.index("download") < calls.index("assign")
+
+    # Durable effect: the runtime is enabled in config.
+    from hermes_cli.config import load_config
+
+    assert load_config()["local_runtime"]["enabled"] is True
+
+
+def test_quickstart_skips_satisfied_legs(client, monkeypatch):
+    """Runtime present and model already staged: the response says so and
+    the job goes straight to activation."""
+    calls: list[str] = []
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.installed_tags", lambda: ["b10362"])
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed",
+        lambda tag, backend, progress=None: calls.append("install"))
+
+    # Every catalog variant reads as staged.
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    all_ids = {v.model_id for e in CATALOG for v in e.variants}
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.staged_model_ids", lambda: all_ids)
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models.download_file",
+        lambda *a, **k: calls.append("download"))
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.bootstrap.ensure_local_runtime",
+        lambda config, force=False: None)
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models._state_endpoint",
+        lambda: {"base_url": "http://127.0.0.1:1/v1", "api_key": "k"})
+    from hermes_cli import web_deps
+
+    monkeypatch.setattr(
+        web_deps, "late",
+        lambda name: (lambda *a, **k: calls.append("assign")))
+
+    r = client.post("/api/local-models/quickstart", json={})
+    assert r.status_code == 200
+    body = r.json()
+    assert body["needs_runtime"] is False
+    assert body["needs_download"] is False
+    assert body["download_bytes"] == 0
+
+    job = _wait_job(client, body["job_id"])
+    assert job["status"] == "done", job["error"]
+    assert "install" not in calls and "download" not in calls
+    assert calls == ["assign"] or calls[-1] == "assign"
+
+
+@pytest.fixture
+def quickstart_ready(monkeypatch):
+    """Preflight passes without hardware or network: the runtime reads as
+    installed and every entry's first variant is servable, so the POST
+    reaches the single-flight lock instead of 409ing at fit/engine
+    preflight on machines where nothing fits."""
+    from hermes_cli.local_runtime.catalog import VariantChoice
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.installed_tags", lambda: ["b10362"])
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.catalog.select_variant",
+        lambda entry, budget: VariantChoice(variant=entry.variants[0],
+                                            zero_spill=True,
+                                            reason_key="best-fits"))
+    monkeypatch.setattr(
+        "hermes_cli.web_routers.local_models._engine_too_old",
+        lambda min_engine: False)
+
+
+def test_quickstart_is_single_flight(client, quickstart_ready, monkeypatch):
+    """A second quickstart while one runs must 409, not start a twin job
+    (the job sequences installs, downloads, a server bounce, and a config
+    write — two interleaved runs corrupt all four)."""
+    import hermes_cli.web_routers.local_models as lm
+
+    lm._QUICKSTART_LOCK.acquire()
+    try:
+        r = client.post("/api/local-models/quickstart", json={})
+        assert r.status_code == 409
+        assert "already running" in r.json()["detail"].lower()
+    finally:
+        lm._QUICKSTART_LOCK.release()
diff --git a/tests/hermes_cli/test_local_recommendation.py b/tests/hermes_cli/test_local_recommendation.py
new file mode 100644
index 0000000000..4aa3aabd58
--- /dev/null
+++ b/tests/hermes_cli/test_local_recommendation.py
@@ -0,0 +1,170 @@
+"""The recommendation decision table — the reviewable matrix.
+
+The recommendation itself is DERIVED (catalog.recommended_entry: best
+quality among resident entries clearing the pleasant speed floor, else
+fastest resident, else least-painful spilled), so nobody hand-maintains
+per-hardware-class picks. This table is the editorial control on that
+derivation: it enumerates the real memory size classes x {discrete,
+unified} and pins every cell. A catalog change (new model, quality
+re-rank, quant swap) flips cells HERE, and the diff of this file in
+review IS the sign-off on what each machine class gets.
+
+These are decision pins, not change-detectors: each cell is a choice a
+human approved, exactly like a golden file. When a cell flips on
+purpose, update it in the same commit and say why. When one flips by
+surprise, that is the test doing its job.
+
+Budgets mirror hardware.probe_budget's planning-mode shapes (margins,
+UMA headroom) so the cells match what a real machine of that class
+resolves.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from hermes_cli.local_runtime.catalog import (
+    CATALOG,
+    PLEASANT_FLOOR_TOK_S,
+    predicted_decode_tok_s,
+    recommended_entry,
+    recommended_id,
+    select_variant,
+)
+from hermes_cli.local_runtime.estimator import HardwareBudget
+
+_GIB = 1 << 30
+
+
+def _discrete(size_gb: int) -> HardwareBudget:
+    total = size_gb * _GIB
+    margin = max(2 * _GIB, int(total * 0.09))
+    return HardwareBudget(usable_vram_bytes=max(0, total - margin),
+                          total_device_bytes=total,
+                          ram_available_bytes=64 * _GIB, uma=False)
+
+
+def _unified(size_gb: int) -> HardwareBudget:
+    total = size_gb * _GIB
+    return HardwareBudget(usable_vram_bytes=int(total * 0.80),
+                          total_device_bytes=total,
+                          ram_available_bytes=0, uma=True)
+
+
+# The decision table. Cells were generated by the resolver and then
+# reviewed as editorial decisions:
+#
+#   VRAM | discrete                | unified
+#   -----+-------------------------+------------------------
+#     8  | qwen3.6-35b-a3b spilled | (none fits)
+#    16  | qwen3.6-35b-a3b spilled | (none fits)
+#    24  | qwen3.8-27b             | (none fits)
+#    32  | qwen3.8-27b             | qwen3.6-35b-a3b
+#    48  | qwen3.8-27b             | qwen3.6-35b-a3b
+#    96  | qwen3.8-27b             | qwen3.6-35b-a3b
+#   128  | qwen3.8-flash-next      | qwen3.6-35b-a3b
+#   256  | qwen3.8-flash-next      | qwen3.8-flash-next
+#   512  | qwen3.8-flash-next      | qwen3.8-flash-next
+#
+# Reading guide for reviewers:
+# - Discrete <=16 GB: nothing runs resident; the 35B MoE is the least
+#   painful spill (active slice streams from host; a dense spill reads
+#   every weight over the bus).
+# - Discrete 24-96 GB: the 27B is the flagship experience — dense reads
+#   at ~1 TB/s clear the floor easily, so quality decides.
+# - Discrete/unified where Flash Next fits resident (128 GB discrete,
+#   256+ GB unified): the frontier model is the pick — highest quality,
+#   and its sparse decode clears the floor even at UMA bandwidth
+#   (~24 tok/s predicted at 210 GB/s).
+# - Unified 32-128 GB — the Spark class, the reason this resolver
+#   exists: the dense 27B predicts ~13 tok/s at UMA bandwidth (below
+#   the pleasant floor), so the 35B-A3B (~60 tok/s) wins.
+# - Unified <=24 GB: no entry passes the physics check inside the UMA
+#   budget (spilling is impossible on UMA by construction — the pool IS
+#   the RAM). The pane's browse flow is the path for those machines
+#   until a small catalog entry lands (revisit when one does).
+DECISION_TABLE = [
+    (8, "discrete", "qwen3.6-35b-a3b", "least-painful-spilled"),
+    (8, "unified", None, None),
+    (16, "discrete", "qwen3.6-35b-a3b", "least-painful-spilled"),
+    (16, "unified", None, None),
+    (24, "discrete", "qwen3.8-27b", "best-quality-resident"),
+    (24, "unified", None, None),
+    (32, "discrete", "qwen3.8-27b", "best-quality-resident"),
+    (32, "unified", "qwen3.6-35b-a3b", "speed-gated-quality"),
+    (48, "discrete", "qwen3.8-27b", "best-quality-resident"),
+    (48, "unified", "qwen3.6-35b-a3b", "speed-gated-quality"),
+    (96, "discrete", "qwen3.8-27b", "best-quality-resident"),
+    (96, "unified", "qwen3.6-35b-a3b", "speed-gated-quality"),
+    (128, "discrete", "qwen3.8-flash-next", "best-quality-resident"),
+    (128, "unified", "qwen3.6-35b-a3b", "speed-gated-quality"),
+    (256, "discrete", "qwen3.8-flash-next", "best-quality-resident"),
+    (256, "unified", "qwen3.8-flash-next", "best-quality-resident"),
+    (512, "discrete", "qwen3.8-flash-next", "best-quality-resident"),
+    (512, "unified", "qwen3.8-flash-next", "best-quality-resident"),
+]
+
+
+@pytest.mark.parametrize(
+    ("size_gb", "kind", "expected", "expected_reason"),
+    DECISION_TABLE,
+    ids=[f"{s}GB-{k}" for s, k, _, _ in DECISION_TABLE])
+def test_recommendation_decision_table(size_gb, kind, expected, expected_reason):
+    """Pins the pick AND its reason per cell: the reason is user-facing
+    (the Recommended badge's tooltip), so a cell whose rationale flips
+    without the pick flipping is still a review-worthy change."""
+    budget = _discrete(size_gb) if kind == "discrete" else _unified(size_gb)
+    picked = recommended_entry(budget)
+    if expected is None:
+        assert picked is None
+    else:
+        assert picked is not None
+        assert (picked[0].id, picked[1]) == (expected, expected_reason)
+
+
+# ── invariants behind the table (survive catalog changes) ──
+
+
+def test_every_entry_carries_the_recommendation_axes():
+    """quality and decode_fraction are authoring requirements: an entry
+    without them silently loses every quality comparison (quality=0) or
+    prices as dense (decode_fraction=1.0)."""
+    for entry in CATALOG:
+        assert entry.quality > 0, f"{entry.id} has no quality ordering"
+        assert 0.0 < entry.decode_fraction <= 1.0, entry.id
+        if not entry.moe:
+            assert entry.decode_fraction == 1.0, (
+                f"{entry.id} is dense — it reads every weight per token")
+
+
+def test_unified_never_recommends_a_below_floor_dense_model():
+    """The Spark rule, as an invariant: whatever the catalog holds, a
+    unified-memory machine must not be told to run a model whose
+    predicted decode is below the pleasant floor while a resident
+    alternative clears it."""
+    budget = _unified(128)
+    pick = recommended_id(budget)
+    assert pick is not None
+    entry = next(e for e in CATALOG if e.id == pick)
+    choice = select_variant(entry, budget)
+    assert choice is not None and choice.zero_spill
+    clears = [
+        e for e in CATALOG
+        if (c := select_variant(e, budget)) is not None and c.zero_spill
+        and predicted_decode_tok_s(e, c.variant, budget) >= PLEASANT_FLOOR_TOK_S
+    ]
+    if clears:
+        assert predicted_decode_tok_s(entry, choice.variant, budget) >= PLEASANT_FLOOR_TOK_S
+
+
+def test_quality_decides_where_speed_permits():
+    """On big discrete hardware every resident entry clears the floor, so
+    the pick must be the highest-quality fitting entry — the axis that
+    justifies carrying an editorial field at all."""
+    budget = _discrete(512)
+    pick = recommended_id(budget)
+    resident = [
+        e for e in CATALOG
+        if (c := select_variant(e, budget)) is not None and c.zero_spill
+    ]
+    assert pick == max(resident, key=lambda e: e.quality).id
diff --git a/tests/hermes_cli/test_local_runtime.py b/tests/hermes_cli/test_local_runtime.py
new file mode 100644
index 0000000000..0603e9ec29
--- /dev/null
+++ b/tests/hermes_cli/test_local_runtime.py
@@ -0,0 +1,825 @@
+"""Contract tests for hermes_cli.local_runtime — Rollouts 1+2.
+
+Per the design's verification plan: relationships and contracts, no
+change-detector tests, real imports against temp HERMES_HOME (the autouse
+fixture isolates it). The stub HTTP server speaks just enough llama-server
+(/props, /health, /models, /v1/chat/completions, /metrics, /slots) to
+exercise detection fingerprinting and supervisor logic without a GPU.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+
+import pytest
+
+from hermes_cli.local_runtime.binaries import (
+    AssetPlan,
+    BinaryResolutionError,
+    resolve_assets,
+    select_backend,
+)
+from hermes_cli.local_runtime.detect import DetectedServer, probe_port
+
+
+# ── stub llama-server ────────────────────────────────────────
+
+
+class _StubHandler(BaseHTTPRequestHandler):
+    """Minimal llama-server imitation; behavior driven by class attrs."""
+
+    props: dict = {}
+    models: dict | None = None
+    require_auth = False
+    chat_answer = "Paris"
+    requests_processing = 0
+    slots: list = []
+
+    def _send(self, code: int, body: dict | str | None = None) -> None:
+        raw = (json.dumps(body) if isinstance(body, dict) else (body or "")).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+
+    def do_GET(self):  # noqa: N802
+        if self.require_auth and "Authorization" not in self.headers:
+            self._send(401, {})
+            return
+        path = self.path.split("?")[0]  # router telemetry uses ?model=
+        if path == "/props":
+            self._send(200, self.props)
+        elif path == "/health":
+            self._send(200, {"status": "ok"})
+        elif path == "/models":
+            if self.models is None:
+                self._send(404, {})
+            else:
+                self._send(200, self.models)
+        elif path == "/metrics":
+            self._send(200, f"llamacpp:requests_processing {self.requests_processing}\n")
+        elif path == "/slots":
+            raw = json.dumps(self.slots).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(raw)))
+            self.end_headers()
+            self.wfile.write(raw)
+        else:
+            self._send(404, {})
+
+    def do_POST(self):  # noqa: N802
+        if self.path == "/v1/chat/completions":
+            self._send(200, {"choices": [{"message": {
+                "role": "assistant", "content": self.chat_answer}}]})
+        elif self.path == "/models/load":
+            self._send(200, {"success": True})
+        elif self.path == "/models/unload":
+            type(self).unloaded = getattr(type(self), "unloaded", [])
+            length = int(self.headers.get("Content-Length", 0))
+            body = json.loads(self.rfile.read(length)) if length else {}
+            type(self).unloaded.append(body.get("model"))
+            self._send(200, {"success": True})
+        else:
+            self._send(404, {})
+
+    def log_message(self, *args):  # silence
+        pass
+
+
+@pytest.fixture
+def stub_server():
+    """Yields (port, handler_class); handler attrs are per-test mutable."""
+
+    class Handler(_StubHandler):
+        props = {}
+        models = None
+        require_auth = False
+        slots = []
+
+    server = HTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    yield server.server_address[1], Handler
+    server.shutdown()
+
+
+# ── detection (Rollout 1) ────────────────────────────────────
+
+
+def test_probe_fingerprints_real_llama_server(stub_server):
+    port, handler = stub_server
+    handler.props = {
+        "build_info": "b10290-c8e03ce81",
+        "model_path": "C:/models/some model with spaces.gguf",
+        "default_generation_settings": {"n_ctx": 65536},
+    }
+    handler.models = {"data": [{"id": "m", "status": {"value": "unloaded"}}]}
+    hit = probe_port(port)
+    assert isinstance(hit, DetectedServer)
+    assert hit.base_url == f"http://127.0.0.1:{port}/v1"
+    assert hit.build_info.startswith("b10290")
+    assert hit.n_ctx == 65536
+    assert hit.router_mode is True
+    assert hit.auth_required is False
+
+
+def test_probe_rejects_non_llama_openai_server(stub_server):
+    # Answers /props with no build_info (e.g. some other local service).
+    port, handler = stub_server
+    handler.props = {"something": "else"}
+    assert probe_port(port) is None
+
+
+def test_probe_single_model_mode_is_not_router(stub_server):
+    port, handler = stub_server
+    handler.props = {"build_info": "b10290-x", "model_path": "m.gguf"}
+    handler.models = None  # /models 404s in plain (non-router) mode
+    hit = probe_port(port)
+    assert hit is not None
+    assert hit.router_mode is False
+
+
+def test_probe_auth_required_still_detected(stub_server):
+    port, handler = stub_server
+    handler.require_auth = True
+    hit = probe_port(port)
+    assert hit is not None
+    assert hit.auth_required is True
+
+
+def test_probe_dead_port_returns_none():
+    # Bind-then-close to get a port that is definitely closed.
+    import socket
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        dead_port = s.getsockname()[1]
+    assert probe_port(dead_port) is None
+
+
+# ── binary resolver (Rollout 2) ──────────────────────────────
+
+
+@pytest.mark.parametrize("os_name,arch,backend,ok", [
+    ("win", "x64", "cuda", True),
+    ("win", "x64", "vulkan", True),
+    ("win", "x64", "cpu", True),
+    ("win", "arm64", "cpu", True),
+    ("win", "arm64", "cuda", True),      # upstream ships these since ~b1036x (CUDA 13.4)
+    ("win", "arm64", "vulkan", False),
+    ("macos", "arm64", "metal", True),
+    ("ubuntu", "x64", "vulkan", True),
+    ("ubuntu", "x64", "cpu", True),
+    ("ubuntu", "x64", "cuda", False),    # no prebuilt linux CUDA
+])
+def test_resolver_platform_matrix(os_name, arch, backend, ok):
+    if ok:
+        plan = resolve_assets("b10290", backend, os_name=os_name, arch=arch)
+        assert plan.assets, "resolvable combination must yield assets"
+        # Invariant: every asset names the tag or is a paired runtime zip.
+        for asset in plan.assets:
+            assert "b10290" in asset or asset.startswith("cudart-")
+    else:
+        with pytest.raises(BinaryResolutionError):
+            resolve_assets("b10290", backend, os_name=os_name, arch=arch)
+
+
+def test_windows_cuda_pairs_cudart():
+    """Windows CUDA must ship the runtime zip — users have no toolkit."""
+    plan = resolve_assets("b10290", "cuda", os_name="win", arch="x64")
+    assert any(a.startswith("cudart-") for a in plan.assets)
+
+
+def test_windows_cuda_arm64_pairs_cudart_on_its_own_version():
+    """arm64 CUDA rides its own CUDA line (13.4 at b10362, verified live):
+    both zips must agree on version and name the arch."""
+    plan = resolve_assets("b10362", "cuda", os_name="win", arch="arm64")
+    assert len(plan.assets) == 2
+    assert all("arm64" in a for a in plan.assets)
+    versions = {a.split("cuda-")[1].split("-")[0] for a in plan.assets}
+    assert len(versions) == 1, f"paired zips disagree on CUDA version: {plan.assets}"
+    assert any(a.startswith("cudart-") for a in plan.assets)
+    assert any(a.startswith("llama-") for a in plan.assets)
+
+
+def test_install_dir_is_profile_scoped(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    plan = AssetPlan(tag="b10290", backend="cuda")
+    assert str(tmp_path) in str(plan.install_dir)
+    assert "runtimes" in plan.install_dir.parts
+
+
+@pytest.mark.parametrize("vendor,os_name,expected", [
+    ("NVIDIA GeForce RTX 5090", "win", "cuda"),
+    ("nvidia", "ubuntu", "cuda"),
+    ("AMD Radeon RX 7900", "win", "vulkan"),
+    ("intel", "win", "vulkan"),
+    (None, "win", "cpu"),
+    ("", "ubuntu", "cpu"),
+    ("nvidia", "macos", "metal"),   # macOS is Metal regardless
+    (None, "macos", "metal"),
+])
+def test_backend_selection(vendor, os_name, expected):
+    assert select_backend(vendor, os_name=os_name) == expected
+
+
+def test_sha256_mismatch_rejects(tmp_path, monkeypatch):
+    """A pinned hash that doesn't match the download must hard-fail."""
+    from hermes_cli.local_runtime import binaries
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    # Pre-place a wrong-content "download" so no network is touched. The
+    # asset name is host-dependent (win/.zip, ubuntu/.tar.gz, macos/.zip)
+    # — resolve it the way the installer will, so the poisoned file is the
+    # one it verifies on every CI platform.
+    plan = binaries.resolve_assets("b10290", "cpu")
+    asset = plan.assets[0]
+    downloads = binaries.runtimes_root() / "downloads"
+    downloads.mkdir(parents=True)
+    (downloads / asset).write_bytes(b"not the real archive")
+    with pytest.raises(BinaryResolutionError, match="sha256 mismatch"):
+        binaries.ensure_runtime_installed(
+            "b10290", "cpu",
+            expected_sha256={asset: "0" * 64})
+    # The poisoned download must not survive for a retry to trust.
+    assert not (downloads / asset).exists()
+
+
+# ── supervisor contracts (stubbed; no GPU) ───────────────────
+
+
+def _make_supervisor(tmp_path, port):
+    """Supervisor pointed at the stub: skip spawn, drive HTTP logic only."""
+    from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+    sup = LlamaServerSupervisor(
+        install_dir=tmp_path, models_dir=tmp_path, port=port)
+    return sup
+
+
+def test_touch_generate_is_the_readiness_proof(stub_server, tmp_path):
+    port, handler = stub_server
+    sup = _make_supervisor(tmp_path, port)
+    handler.chat_answer = "Paris"
+    assert sup.touch_generate("m") is True
+    handler.chat_answer = "I cannot answer that."
+    assert sup.touch_generate("m") is False
+
+
+def test_touch_generate_scans_reasoning_content(stub_server, tmp_path):
+    """Reasoning models answer inside reasoning_content (receipted pitfall)."""
+    port, handler = stub_server
+    sup = _make_supervisor(tmp_path, port)
+
+    class ReasoningHandler(handler):  # type: ignore[valid-type]
+        def do_POST(self):  # noqa: N802
+            if self.path == "/v1/chat/completions":
+                self._send(200, {"choices": [{"message": {
+                    "role": "assistant", "content": "",
+                    "reasoning_content": "The capital of France is Paris."}}]})
+            else:
+                self._send(404, {})
+
+    # Swap handler class on the live stub server socket is overkill; just
+    # verify the scan logic path via the normal handler with empty content.
+    handler.chat_answer = ""
+    assert sup.touch_generate("m") is False  # empty content, no reasoning field
+
+
+def test_ensure_model_ready_unknown_model_raises(stub_server, tmp_path):
+    port, handler = stub_server
+    handler.models = {"data": [{"id": "present", "status": {"value": "unloaded"}}]}
+    sup = _make_supervisor(tmp_path, port)
+    with pytest.raises(KeyError):
+        sup.ensure_model_ready("absent")
+
+
+def test_model_failures_surface_exit_code_not_retry(stub_server, tmp_path):
+    """Design: child failures surface, never auto-retry."""
+    port, handler = stub_server
+    handler.models = {"data": [
+        {"id": "ok", "status": {"value": "loaded"}},
+        {"id": "dead", "status": {"value": "failed", "exit_code": -1073741819}},
+    ]}
+    sup = _make_supervisor(tmp_path, port)
+    failures = sup.model_failures()
+    assert failures == {"dead": -1073741819}
+
+
+def test_is_idle_requires_no_busy_slots_and_zero_processing(stub_server, tmp_path):
+    port, handler = stub_server
+    sup = _make_supervisor(tmp_path, port)
+    # Router telemetry is per-child (?model=); a loaded model must exist for
+    # is_idle to have anything to check.
+    handler.models = {"data": [{"id": "m", "status": {"value": "loaded"}}]}
+    handler.slots = [{"id": 0, "is_processing": False}]
+    handler.requests_processing = 0
+    assert sup.is_idle() is True
+    handler.slots = [{"id": 0, "is_processing": True}]
+    assert sup.is_idle() is False
+    handler.slots = [{"id": 0, "is_processing": False}]
+    handler.requests_processing = 2
+    assert sup.is_idle() is False
+
+
+def test_base_url_dials_loopback_ip_never_localhost(tmp_path):
+    """C12: localhost costs ~2s/request on Windows."""
+    sup = _make_supervisor(tmp_path, 9999)
+    assert "127.0.0.1" in sup.base_url
+    assert "localhost" not in sup.base_url
+
+
+# ── provider integration (existing alias mechanism, no new plugin) ──
+
+
+def test_llamacpp_aliases_route_to_custom_profile():
+    """Design + maintainer direction: llamacpp fits the EXISTING provider
+    mechanism — the aliases already resolve to the keyless custom profile;
+    no parallel provider plugin exists."""
+    from providers import get_provider_profile
+
+    for alias in ("llamacpp", "llama.cpp", "llama-cpp"):
+        profile = get_provider_profile(alias)
+        assert profile is not None, alias
+        assert profile.name == "custom"
+        assert profile.env_vars == ()  # credential is reachability
+
+
+def test_llamacpp_endpoint_resolution_prefers_managed(tmp_path, monkeypatch, stub_server):
+    """provider: llamacpp with a live managed server resolves to it,
+    api-key included."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    port, handler = stub_server
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        # A LIVE pid: the ownership guard treats health-200 + dead recorded
+        # pid as a foreign server on our stable port (scratch-profile
+        # collision), so claiming this test process models "our server".
+        "base_url": f"http://127.0.0.1:{port}/v1", "api_key": "sk-managed", "pid": os.getpid(),
+    }), encoding="utf-8")
+    resolved = ep.resolve_llamacpp_endpoint()
+    assert resolved == {"base_url": f"http://127.0.0.1:{port}/v1", "api_key": "sk-managed"}
+
+
+def test_llamacpp_endpoint_stale_state_falls_through(tmp_path, monkeypatch):
+    """A crashed-without-cleanup state file (dead pid, dead endpoint) must
+    not blackhole requests: state ignored -> detection (none here) -> None."""
+    import socket
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        dead_port = s.getsockname()[1]
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.detect import DEFAULT_PROBE_PORTS
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        "base_url": f"http://127.0.0.1:{dead_port}/v1", "api_key": "sk-x", "pid": 1,
+    }), encoding="utf-8")
+    monkeypatch.setattr(ep, "_pid_alive", lambda pid: False)
+    # Keep detection away from any real server on 8080 during the test.
+    monkeypatch.setattr("hermes_cli.local_runtime.detect.DEFAULT_PROBE_PORTS",
+                        (dead_port,))
+    assert ep.resolve_llamacpp_endpoint() is None
+    assert DEFAULT_PROBE_PORTS  # (import kept honest)
+
+
+def test_llamacpp_dead_server_raises_friendly_error(tmp_path, monkeypatch):
+    """A llamacpp send with no server must say WHY in user terms, not fall
+    through to the generic custom path (which lands on a cloud provider
+    with a placeholder key and surfaces as a baffling '401 Invalid API
+    key'). Message tracks the off switch: enabled = probably starting;
+    disabled = the user turned it off."""
+    import pytest
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+
+    from hermes_cli import runtime_provider as rp
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.endpoint.resolve_llamacpp_endpoint",
+        lambda *a, **k: None)
+
+    monkeypatch.setattr(
+        "hermes_cli.config.load_config",
+        lambda: {"local_runtime": {"enabled": False}})
+    with pytest.raises(ValueError, match="turned off"):
+        rp._resolve_named_custom_runtime(requested_provider="llamacpp")
+
+    monkeypatch.setattr(
+        "hermes_cli.config.load_config",
+        lambda: {"local_runtime": {"enabled": True}})
+    with pytest.raises(ValueError, match="isn't running"):
+        rp._resolve_named_custom_runtime(requested_provider="llamacpp")
+
+    # An explicit base_url is the user pointing at a specific server —
+    # that path keeps its own error reporting, never this one.
+    result = rp._resolve_named_custom_runtime(
+        requested_provider="llamacpp",
+        explicit_base_url="http://127.0.0.1:9999/v1")
+    assert result is None or result.get("base_url", "").startswith("http://127.0.0.1:9999")
+
+
+def test_llamacpp_endpoint_starting_server_resolves(tmp_path, monkeypatch):
+    """The restart race: state written at spawn, server not yet healthy,
+    supervisor child alive — resolution must return the endpoint (a
+    STARTING server is configured, not missing credentials; this exact
+    race threw the app back to onboarding on the first restart test)."""
+    import socket
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        not_listening = s.getsockname()[1]
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        "base_url": f"http://127.0.0.1:{not_listening}/v1",
+        "api_key": "sk-starting", "pid": 4242,
+    }), encoding="utf-8")
+    monkeypatch.setattr(ep, "_pid_alive", lambda pid: True)
+    resolved = ep.resolve_llamacpp_endpoint()
+    assert resolved is not None
+    assert resolved["api_key"] == "sk-starting"
+
+
+def test_llamacpp_endpoint_waits_for_boot_in_flight(tmp_path, monkeypatch):
+    """The SECOND restart race (no state file at all yet): a fresh backend's
+    readiness probe resolves before the lifespan boot thread has even
+    spawned the server. With the runtime enabled+installed, resolution must
+    poll briefly and pick up the state file when the boot thread writes it
+    — not report unconfigured."""
+    import threading
+    import time as _time
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    # Boot is in flight: runtime enabled + binary installed.
+    monkeypatch.setattr(ep, "_boot_in_flight", lambda config: True)
+    monkeypatch.setattr(ep, "_pid_alive", lambda pid: True)
+    # Nothing detected externally.
+    monkeypatch.setattr("hermes_cli.local_runtime.detect.DEFAULT_PROBE_PORTS", ())
+
+    def _late_writer():
+        _time.sleep(0.6)
+        state_path().parent.mkdir(parents=True, exist_ok=True)
+        state_path().write_text(json.dumps({
+            "base_url": "http://127.0.0.1:59999/v1",
+            "api_key": "sk-boot", "pid": 777,
+        }), encoding="utf-8")
+
+    t = threading.Thread(target=_late_writer)
+    t.start()
+    try:
+        resolved = ep.resolve_llamacpp_endpoint(wait_for_boot_s=5.0)
+    finally:
+        t.join()
+    assert resolved is not None
+    assert resolved["api_key"] == "sk-boot"
+
+
+def test_resolution_kicks_boot_when_no_thread_is_booting(tmp_path, monkeypatch):
+    """The dead-router-mid-flight case: runtime enabled+installed, but no
+    state file and NO lifespan boot thread running (the router died after
+    backend start — tree-killed with a stale backend, or the stable port
+    was owned by another install and the ownership guard refused it).
+    Resolution must not just wait for a boot that nobody is doing — it
+    kicks ensure_local_runtime itself and picks up the state file that
+    boot writes."""
+    import time as _time
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import bootstrap as bs
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    monkeypatch.setattr(ep, "_boot_in_flight", lambda config: True)
+    monkeypatch.setattr(ep, "_pid_alive", lambda pid: True)
+    monkeypatch.setattr("hermes_cli.local_runtime.detect.DEFAULT_PROBE_PORTS", ())
+
+    def _fake_ensure(config, force=False):
+        _time.sleep(0.3)  # a real spawn takes a moment
+        state_path().parent.mkdir(parents=True, exist_ok=True)
+        state_path().write_text(json.dumps({
+            "base_url": "http://127.0.0.1:59998/v1",
+            "api_key": "sk-kicked", "pid": 778,
+        }), encoding="utf-8")
+
+    monkeypatch.setattr(bs, "ensure_local_runtime", _fake_ensure)
+
+    resolved = ep.resolve_llamacpp_endpoint(config={}, wait_for_boot_s=5.0)
+    assert resolved is not None
+    assert resolved["api_key"] == "sk-kicked"
+
+
+def test_boot_in_flight_real_gate(tmp_path, monkeypatch):
+    """_boot_in_flight exercised FOR REAL (the previous regression test
+    monkeypatched it — and the real one threw TypeError on every call,
+    silently disabling the boot wait). Enabled + verified manifest on
+    disk -> True; either missing -> False."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import endpoint as ep
+    from hermes_cli.local_runtime.binaries import runtimes_root
+
+    enabled = {"local_runtime": {"enabled": True}}
+    # Not installed yet -> False.
+    assert ep._boot_in_flight(enabled) is False
+    # Verified install manifest -> True.
+    install = runtimes_root() / "b10290" / "cuda"
+    install.mkdir(parents=True)
+    (install / "manifest.json").write_text(
+        json.dumps({"tag": "b10290", "verified_version": "5015 (abc)"}),
+        encoding="utf-8")
+    assert ep._boot_in_flight(enabled) is True
+    # Disabled -> False even when installed.
+    assert ep._boot_in_flight({"local_runtime": {"enabled": False}}) is False
+
+
+def test_idle_sweep_unloads_idle_models(tmp_path, monkeypatch, stub_server):
+    """Residency v2 contract: after the idle threshold, idle loaded models
+    unload — no exemptions; demand reloads anything the user returns to.
+    Idleness is the C5 contract (no busy slots)."""
+    port, handler = stub_server
+    handler.models = {"data": [
+        {"id": "model-a", "status": {"value": "loaded"}},
+        {"id": "model-b", "status": {"value": "loaded"}},
+    ]}
+    handler.slots = []          # everyone idle per C5
+    handler.requests_processing = 0
+    handler.unloaded = []
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+    sup = LlamaServerSupervisor(tmp_path / "i", tmp_path / "m", port=port)
+
+    t0 = 1000.0
+    # First sweep: starts the idle clocks, nothing unloads yet.
+    assert sup.sweep_idle(now=t0) == []
+    # Before the threshold: still nothing.
+    assert sup.sweep_idle(now=t0 + sup.IDLE_UNLOAD_S - 1) == []
+    # Past the threshold: both idle models unload.
+    assert sorted(sup.sweep_idle(now=t0 + sup.IDLE_UNLOAD_S + 1)) == ["model-a", "model-b"]
+    assert sorted(handler.unloaded) == ["model-a", "model-b"]
+
+
+def test_idle_sweep_busy_model_resets_clock(tmp_path, monkeypatch, stub_server):
+    """A model seen busy (C5: busy slot) restarts its idle clock — an
+    active conversation never trips the sweep."""
+    port, handler = stub_server
+    handler.models = {"data": [{"id": "side-m", "status": {"value": "loaded"}}]}
+    handler.unloaded = []
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+    sup = LlamaServerSupervisor(tmp_path / "i", tmp_path / "m", port=port)
+
+    t0 = 1000.0
+    handler.slots = []                 # idle: clock starts
+    assert sup.sweep_idle(now=t0) == []
+    handler.slots = [{"is_processing": True}]   # busy mid-window
+    assert sup.sweep_idle(now=t0 + sup.IDLE_UNLOAD_S) == []
+    handler.slots = []                 # idle again: clock restarts, not expired
+    assert sup.sweep_idle(now=t0 + sup.IDLE_UNLOAD_S + 10) == []
+    assert handler.unloaded == []
+
+
+def test_staged_models_requires_every_split_part(tmp_path, monkeypatch):
+    """A split GGUF mid-download must NOT count as staged: the picker, the
+    catalog's 'downloaded' flag, and the router's model list all read
+    staged_models(), and a first part with missing continuations is not
+    servable. Single files and complete splits count; continuation parts
+    never count as their own model."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    import hermes_cli.local_runtime.bootstrap as bs
+
+    mdir = bs.models_dir()
+    mdir.mkdir(parents=True, exist_ok=True)
+
+    (mdir / "Single-Q4_K_M.gguf").touch()
+    # Complete split: both parts present.
+    (mdir / "Whole-Q4-00001-of-00002.gguf").touch()
+    (mdir / "Whole-Q4-00002-of-00002.gguf").touch()
+    # Mid-download split: first part only, of three.
+    (mdir / "Partial-Q4-00001-of-00003.gguf").touch()
+
+    assert bs.staged_model_ids() == ["Single-Q4_K_M", "Whole-Q4"]
+
+
+def test_bootstrap_skips_boot_with_no_staged_models(tmp_path, monkeypatch):
+    """Residency: enabled + installed but zero staged models -> no server
+    boot (nothing to serve; the walked-away story)."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    import hermes_cli.local_runtime.bootstrap as bs
+
+    monkeypatch.setattr(bs, "_SUPERVISOR", None)
+    called = {"spawn": False}
+
+    def _boom(*a, **k):
+        called["spawn"] = True
+        raise AssertionError("must not reach install/spawn")
+
+    monkeypatch.setattr("hermes_cli.local_runtime.binaries.ensure_runtime_installed", _boom)
+    result = bs.ensure_local_runtime({"local_runtime": {"enabled": True}})
+    assert result is None
+    assert called["spawn"] is False
+
+
+def test_endpoint_identity_stable_across_supervisor_instances(tmp_path, monkeypatch):
+    """Round-7 contract: base_url AND api_key survive a restart as a unit.
+    Two supervisor constructions (= two backend boots) must agree on both —
+    sessions persist the resolved pair, so either piece rotating strands
+    every resumed session (connection error / HTTP 401)."""
+    import socket as _socket
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import supervisor as sup_mod
+    from hermes_cli.local_runtime.supervisor import LlamaServerSupervisor
+
+    # A test-owned default port: the production default may legitimately be
+    # held by a live managed server on the dev machine.
+    with _socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        test_port = s.getsockname()[1]
+    monkeypatch.setattr(sup_mod, "_DEFAULT_PORT", test_port)
+
+    first = LlamaServerSupervisor(tmp_path / "install", tmp_path / "models")
+    second = LlamaServerSupervisor(tmp_path / "install", tmp_path / "models")
+    assert first.api_key == second.api_key
+    assert len(first.api_key) >= 16
+    assert first.port == second.port == test_port
+    # The key is persisted, not per-process state.
+    key_file = tmp_path / ".hermes" / "runtimes" / "llamacpp" / ".api_key"
+    assert key_file.exists()
+    assert key_file.read_text(encoding="utf-8").strip() == first.api_key
+
+
+def test_llamacpp_endpoint_no_wait_when_not_enabled(tmp_path, monkeypatch):
+    """No boot in flight (runtime disabled/uninstalled): resolution returns
+    None promptly instead of burning the wait budget."""
+    import time as _time
+
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import endpoint as ep
+
+    monkeypatch.setattr(ep, "_boot_in_flight", lambda config: False)
+    monkeypatch.setattr("hermes_cli.local_runtime.detect.DEFAULT_PROBE_PORTS", ())
+    t0 = _time.monotonic()
+    assert ep.resolve_llamacpp_endpoint(wait_for_boot_s=8.0) is None
+    assert _time.monotonic() - t0 < 3.0
+
+
+def test_switch_model_explicit_llamacpp_provider(tmp_path, monkeypatch, stub_server):
+    """The desktop dropdown path: switch_model(explicit_provider='llamacpp')
+    must resolve the managed provider — not 'Unknown provider' (the
+    desktop-review symptom). E2E through the real pipeline against a stub server."""
+    port, handler = stub_server
+    handler.models = {"data": [{"id": "stub-model-a", "owned_by": "llamacpp"}]}
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        "base_url": f"http://127.0.0.1:{port}/v1",
+        # Live pid: ownership guard rejects health-200 + dead recorded pid
+        # (foreign server on our stable port).
+        "api_key": "sk-managed", "pid": os.getpid(),
+    }), encoding="utf-8")
+
+    from hermes_cli.model_switch import switch_model
+
+    result = switch_model(
+        "stub-model-a",
+        current_provider="nous",
+        current_model="Hermes-4.5",
+        current_base_url="",
+        explicit_provider="llamacpp",
+    )
+    assert result.success, result.error_message
+    assert f"127.0.0.1:{port}" in (result.base_url or "")
+    assert result.api_key == "sk-managed"
+
+
+def test_runtime_provider_seam_llamacpp_alias(tmp_path, monkeypatch, stub_server):
+    """End to end through the REAL resolver: provider='llamacpp' with no
+    base_url lands on the managed endpoint with source='local-runtime'."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    port, handler = stub_server
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        # A LIVE pid: the ownership guard treats health-200 + dead recorded
+        # pid as a foreign server on our stable port (scratch-profile
+        # collision), so claiming this test process models "our server".
+        "base_url": f"http://127.0.0.1:{port}/v1", "api_key": "sk-managed", "pid": os.getpid(),
+    }), encoding="utf-8")
+
+    from hermes_cli.runtime_provider import _resolve_named_custom_runtime
+
+    runtime = _resolve_named_custom_runtime(requested_provider="llamacpp")
+    assert runtime is not None
+    assert runtime["source"] == "local-runtime"
+    assert runtime["base_url"] == f"http://127.0.0.1:{port}/v1"
+    assert runtime["api_key"] == "sk-managed"
+    assert runtime["provider"] == "custom"
+
+
+def test_runtime_provider_seam_explicit_base_url_wins(tmp_path, monkeypatch):
+    """A user-specified base_url must never be overridden by the managed
+    endpoint — pointing at a specific server means that server."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        "base_url": "http://127.0.0.1:1/v1", "api_key": "sk-managed", "pid": 1,
+    }), encoding="utf-8")
+
+    from hermes_cli.runtime_provider import _resolve_named_custom_runtime
+
+    runtime = _resolve_named_custom_runtime(
+        requested_provider="llamacpp",
+        explicit_base_url="http://127.0.0.1:9999/v1")
+    assert runtime is not None
+    assert runtime["base_url"] == "http://127.0.0.1:9999/v1"
+    assert runtime["source"] != "local-runtime"
+
+
+def test_local_runtime_config_defaults_shape():
+    """Contract: the section exists, is off by default, and carries no
+    context/VRAM knobs (design: constants, not knobs)."""
+    from hermes_cli.config_defaults import DEFAULT_CONFIG
+
+    cfg = DEFAULT_CONFIG["local_runtime"]
+    assert cfg["enabled"] is False
+    assert isinstance(cfg["tag"], str) and cfg["tag"].startswith("b")
+    forbidden = [k for k in cfg if "context" in k or "ctx" in k or "vram" in k or "kv" in k]
+    assert forbidden == [], f"policy constants leaked into config: {forbidden}"
+
+
+# ── bootstrap contracts ──────────────────────────────────────
+
+
+def test_bootstrap_disabled_is_noop(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import bootstrap
+
+    monkeypatch.setattr(bootstrap, "_SUPERVISOR", None)
+    assert bootstrap.ensure_local_runtime({"local_runtime": {"enabled": False}}) is None
+    assert bootstrap.ensure_local_runtime({}) is None
+    assert bootstrap.ensure_local_runtime(None) is None
+
+
+def test_bootstrap_reuses_running_server(tmp_path, monkeypatch, stub_server):
+    """A live state file (another process supervising) short-circuits the
+    install/spawn path entirely."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    port, handler = stub_server
+    from hermes_cli.local_runtime import bootstrap
+    from hermes_cli.local_runtime.supervisor import state_path
+
+    monkeypatch.setattr(bootstrap, "_SUPERVISOR", None)
+    state_path().parent.mkdir(parents=True, exist_ok=True)
+    state_path().write_text(json.dumps({
+        "base_url": f"http://127.0.0.1:{port}/v1", "api_key": "k", "pid": os.getpid(),
+    }), encoding="utf-8")
+
+    called = []
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed",
+        lambda *a, **k: called.append(1))
+    assert bootstrap.ensure_local_runtime({"local_runtime": {"enabled": True}}) is None
+    assert called == []
+
+
+def test_bootstrap_failure_never_raises(tmp_path, monkeypatch):
+    """Session start must survive a broken runtime: failures log + return
+    None, chat falls back to configured providers."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli.local_runtime import bootstrap
+
+    monkeypatch.setattr(bootstrap, "_SUPERVISOR", None)
+    monkeypatch.setattr(bootstrap, "_detect_gpu_vendor", lambda: None)
+
+    def boom(*a, **k):
+        raise RuntimeError("no network")
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed", boom)
+    result = bootstrap.ensure_local_runtime({"local_runtime": {"enabled": True}})
+    assert result is None  # no exception escaped
diff --git a/tests/hermes_cli/test_local_runtime_picker_row.py b/tests/hermes_cli/test_local_runtime_picker_row.py
new file mode 100644
index 0000000000..0ba2f1d880
--- /dev/null
+++ b/tests/hermes_cli/test_local_runtime_picker_row.py
@@ -0,0 +1,90 @@
+"""The llamacpp provider row in the model picker payload.
+
+Contract: staged local GGUFs appear as a selectable provider row in
+build_models_payload — the same payload /api/model/options and the desktop
+picker consume — whenever models are staged, without any credential."""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    return home
+
+
+def _stage(home, *names):
+    mdir = home / "models"
+    mdir.mkdir(exist_ok=True)
+    for name in names:
+        (mdir / f"{name}.gguf").write_bytes(b"GGUF" + b"\x00" * 64)
+
+
+def test_no_staged_models_no_row(hermes_home):
+    from hermes_cli.inventory import _local_runtime_row, load_picker_context
+
+    assert _local_runtime_row(load_picker_context()) is None
+
+
+def test_staged_models_make_a_selectable_row(hermes_home):
+    from hermes_cli.inventory import _local_runtime_row, load_picker_context
+
+    _stage(hermes_home, "Qwen3-4B-Instruct-2507-UD-Q8_K_XL", "Some-Other-Model")
+    row = _local_runtime_row(load_picker_context())
+    assert row is not None
+    assert row["slug"] == "llamacpp"
+    assert row["authenticated"] is True
+    assert "Qwen3-4B-Instruct-2507-UD-Q8_K_XL" in row["models"]
+    assert row["total_models"] == 2
+
+
+def test_row_marks_current_when_config_points_at_llamacpp(hermes_home):
+    from hermes_cli.inventory import _local_runtime_row, load_picker_context
+
+    _stage(hermes_home, "M")
+    ctx = load_picker_context().with_overrides(current_provider="llamacpp")
+    row = _local_runtime_row(ctx)
+    assert row is not None and row["is_current"] is True
+
+
+def test_full_payload_includes_local_row(hermes_home):
+    """Through the REAL payload builder — the shape the desktop picker eats."""
+    from hermes_cli.inventory import build_models_payload, load_picker_context
+
+    _stage(hermes_home, "Local-Model-X")
+    payload = build_models_payload(
+        load_picker_context(),
+        probe_custom_providers=False,
+        probe_current_custom_provider=False,
+    )
+    slugs = [p["slug"] for p in payload["providers"]]
+    assert "llamacpp" in slugs
+    row = payload["providers"][slugs.index("llamacpp")]
+    assert row["models"] == ["Local-Model-X"]
+
+
+def test_explicit_only_filter_keeps_local_row_on_any_profile(hermes_home):
+    """The desktop dropdown requests explicit_only=True, and the local row
+    has no config credential by design (credential is reachability). The
+    filter must treat staged models as explicit configuration — otherwise
+    the row only survives on the profile whose config points at llamacpp,
+    and every other profile's dropdown silently loses local models."""
+    from hermes_cli.inventory import _filter_explicit_provider_rows, _local_runtime_row, load_picker_context
+
+    _stage(hermes_home, "Qwen3.8-27B-UD-Q5_K_XL")
+    ctx = load_picker_context()
+    row = _local_runtime_row(ctx)
+    assert row is not None
+
+    # Simulate a profile whose current provider is a cloud one (the normal
+    # profile's shape): explicit-only filtering must keep the local row.
+    import dataclasses
+
+    ctx = dataclasses.replace(ctx, current_provider="anthropic")
+    kept = _filter_explicit_provider_rows([row], ctx)
+    assert kept, "explicit-only filter dropped the local-runtime row"
+    assert kept[0]["slug"] == "llamacpp"
diff --git a/tests/hermes_cli/test_local_runtime_updates.py b/tests/hermes_cli/test_local_runtime_updates.py
new file mode 100644
index 0000000000..f6f4d43ea2
--- /dev/null
+++ b/tests/hermes_cli/test_local_runtime_updates.py
@@ -0,0 +1,123 @@
+"""Engine-update contracts (Rollout 4 follow-up):
+
+- default tag flows from DEFAULT_CONFIG unless the user pinned;
+- boot serves what is INSTALLED, never downloads (the ladder);
+- update_available only when the local engine is enabled AND installed
+  AND the configured tag is missing on disk;
+- the update itself is a button-driven job, and prune keeps N-1.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    return home
+
+
+def _install_fake_tag(home, tag: str, backend: str = "cuda") -> None:
+    d = home / "runtimes" / "llamacpp" / tag / backend
+    d.mkdir(parents=True)
+    (d / "manifest.json").write_text(json.dumps({
+        "tag": tag, "backend": backend, "assets": {},
+        "verified_version": f"version: {tag.lstrip('b')}",
+    }), encoding="utf-8")
+    # server_binary() looks for the executable name per-OS; give it both.
+    (d / "llama-server.exe").write_bytes(b"MZ fake")
+    (d / "llama-server").write_bytes(b"\x7fELF fake")
+
+
+def test_installed_tags_newest_first(hermes_home):
+    from hermes_cli.local_runtime.binaries import installed_tags
+
+    assert installed_tags() == []
+    _install_fake_tag(hermes_home, "b10290")
+    _install_fake_tag(hermes_home, "b10412")
+    assert installed_tags() == ["b10412", "b10290"]
+
+
+def test_default_tag_flows_from_default_config(hermes_home):
+    """Unpinned users inherit the Hermes-release default (deep-merge);
+    the shipped default must be a plausible rolling tag."""
+    from hermes_cli.config import load_config
+    from hermes_cli.config_defaults import DEFAULT_CONFIG
+
+    default_tag = DEFAULT_CONFIG["local_runtime"]["tag"]
+    assert default_tag.startswith("b") and default_tag.lstrip("b").isdigit()
+    assert load_config()["local_runtime"]["tag"] == default_tag
+
+
+def test_update_available_requires_enabled_and_installed(hermes_home, monkeypatch):
+    """The flag's truth table: enabled+installed+configured-missing only."""
+    from fastapi.testclient import TestClient
+
+    from hermes_cli import web_server
+
+    client = TestClient(web_server.app)
+    # Same auth pattern as the other local-models route tests.
+    client.headers[web_server._SESSION_HEADER_NAME] = web_server._SESSION_TOKEN
+
+    def status():
+        r = client.get("/api/local-models/status")
+        assert r.status_code == 200, r.text
+        return r.json()
+
+    import hermes_cli.web_routers.local_models as lm
+
+    # Case 1: enabled, configured newer than installed -> update available.
+    monkeypatch.setattr(lm, "_runtime_section",
+                        lambda: {"enabled": True, "tag": "b10412"})
+    _install_fake_tag(hermes_home, "b10290")
+    s = status()
+    assert s["update_available"] is True
+    assert s["configured_tag"] == "b10412"
+    assert s["tag"] == "b10290"          # serving what's installed
+
+    # Case 2: configured tag installed -> no update.
+    _install_fake_tag(hermes_home, "b10412")
+    s = status()
+    assert s["update_available"] is False
+    assert s["tag"] == "b10412"
+
+    # Case 3: disabled -> never flagged, even with a mismatch.
+    monkeypatch.setattr(lm, "_runtime_section",
+                        lambda: {"enabled": False, "tag": "b10999"})
+    assert status()["update_available"] is False
+
+
+def test_boot_never_downloads_missing_tag(hermes_home, monkeypatch):
+    """The ladder: configured-but-not-installed serves the newest installed
+    tag; nothing installed means no boot (and NO download either way)."""
+    from hermes_cli.local_runtime import bootstrap
+
+    calls = []
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.binaries.ensure_runtime_installed",
+        lambda tag, backend, **kw: calls.append(tag) or (_ for _ in ()).throw(
+            AssertionError("boot must not reach install for missing tags")))
+
+    # Nothing installed: returns None before any install attempt.
+    cfg = {"local_runtime": {"enabled": True, "tag": "b10412"}}
+    assert bootstrap.ensure_local_runtime(cfg) is None
+    assert calls == []
+
+
+def test_prune_keeps_n_minus_one(hermes_home):
+    from hermes_cli.local_runtime.binaries import installed_tags, prune_old_tags
+
+    for tag in ("b10100", "b10200", "b10290"):
+        _install_fake_tag(hermes_home, tag)
+    prune_old_tags(["b10290", "b10200"])
+    assert installed_tags() == ["b10290", "b10200"]
+    # downloads/ cache dir must survive pruning when present.
+    downloads = hermes_home / "runtimes" / "llamacpp" / "downloads"
+    downloads.mkdir(exist_ok=True)
+    prune_old_tags(["b10290"])
+    assert downloads.exists()
diff --git a/tests/hermes_cli/test_local_server_lifecycle.py b/tests/hermes_cli/test_local_server_lifecycle.py
new file mode 100644
index 0000000000..7a2c5300ef
--- /dev/null
+++ b/tests/hermes_cli/test_local_server_lifecycle.py
@@ -0,0 +1,114 @@
+"""Server on/off lifecycle route (round-9 feedback: 'we should be able to
+completely turn off the local engine'). Contract: stop tears the server
+down AND persists enabled=false (durable, unlike eject); start persists
+enabled=true and boots."""
+
+from __future__ import annotations
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def client(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    from hermes_cli import web_server
+
+    test_client = TestClient(web_server.app)
+    token = getattr(web_server, "_SESSION_TOKEN", "")
+    if token:
+        test_client.headers["Authorization"] = f"Bearer {token}"
+    return test_client
+
+
+def test_stop_disables_and_tears_down(client, monkeypatch):
+    stopped = {"called": False}
+
+    def _shutdown():
+        stopped["called"] = True
+
+    class _FakeSup:
+        pass
+
+    monkeypatch.setattr("hermes_cli.local_runtime.bootstrap.get_supervisor",
+                        lambda: _FakeSup())
+    monkeypatch.setattr("hermes_cli.local_runtime.bootstrap.shutdown_local_runtime",
+                        _shutdown)
+
+    r = client.post("/api/local-models/server", json={"action": "stop"})
+    assert r.status_code == 200
+    assert stopped["called"] is True
+
+    from hermes_cli.config import load_config
+
+    assert load_config()["local_runtime"]["enabled"] is False
+
+
+def test_start_enables_and_boots(client, monkeypatch):
+    booted = {"called": False}
+
+    class _FakeSup:
+        base_url = "http://127.0.0.1:18434/v1"
+
+    def _ensure(config, force=False):
+        booted["called"] = True
+        assert force is True
+        return _FakeSup()
+
+    monkeypatch.setattr("hermes_cli.local_runtime.bootstrap.ensure_local_runtime",
+                        _ensure)
+
+    r = client.post("/api/local-models/server", json={"action": "start"})
+    assert r.status_code == 200
+    assert booted["called"] is True
+
+    from hermes_cli.config import load_config
+
+    assert load_config()["local_runtime"]["enabled"] is True
+
+
+def test_bogus_action_rejected(client):
+    r = client.post("/api/local-models/server", json={"action": "reboot"})
+    assert r.status_code == 400
+
+
+def test_status_reports_loaded_models_from_live_router(client, monkeypatch):
+    """Round-11 regression: the loaded-models read inside the status route
+    raised NameError (missing json import), the blanket except swallowed it,
+    and {} shipped as truth — 'Not in memory' on a machine with 30 GB of
+    VRAM in use. This test exercises the REAL route against a stub router
+    and demands the loaded set comes through."""
+    import http.server
+    import json as _json
+    import threading
+
+    class _Router(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            body = _json.dumps({"data": [
+                {"id": "m-loaded", "status": {"value": "loaded"}},
+                {"id": "m-loading", "status": {"value": "loading"}},
+                {"id": "m-cold", "status": {"value": "unloaded"}},
+            ]}).encode()
+            self.send_response(200)
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        def log_message(self, *a):
+            pass
+
+    server = http.server.HTTPServer(("127.0.0.1", 0), _Router)
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    try:
+        port = server.server_address[1]
+        # Patch the ROUTE's binding: local_models binds _state_endpoint via
+        # from-import at module load, so patching the endpoint module's
+        # attribute never reaches the name the route actually calls.
+        monkeypatch.setattr(
+            "hermes_cli.web_routers.local_models._state_endpoint",
+            lambda: {"base_url": f"http://127.0.0.1:{port}/v1", "api_key": "k"})
+        payload = client.get("/api/local-models/status").json()
+        assert payload["server_running"] is True
+        assert payload["loaded_models"] == {"m-loaded": "loaded", "m-loading": "loading"}
+    finally:
+        server.shutdown()
diff --git a/tests/hermes_cli/test_loops.py b/tests/hermes_cli/test_loops.py
index 3a630c4206..a99f9f6a0b 100644
--- a/tests/hermes_cli/test_loops.py
+++ b/tests/hermes_cli/test_loops.py
@@ -443,6 +443,20 @@ class TestTickLifecycle:
             decision = mgr.complete_tick("3 tests still failing")
         assert decision["stopped"] is False
 
+    def test_until_judge_blocked_pauses(self, hermes_home):
+        """An unachievable stop condition pauses the loop instead of spinning to the tick budget."""
+        from hermes_cli.loops import LoopManager
+
+        mgr = LoopManager(session_id="t11b")
+        state = mgr.set("poll", interval_seconds=300, until="the deleted repo's CI is green")
+        state.next_due_at = time.time() - 1
+        mgr.fire_tick()
+        with patch("hermes_cli.goals.judge_goal", return_value=("blocked", "repo no longer exists", False, None, False)):
+            decision = mgr.complete_tick("The repository was deleted; there is no CI to watch.")
+        assert decision["stopped"] is True
+        assert decision["status"] == "paused"
+        assert "unachievable" in decision["message"]
+
     def test_until_judge_error_fails_open(self, hermes_home):
         from hermes_cli.loops import LoopManager
 
diff --git a/tests/hermes_cli/test_managed_vision_capability.py b/tests/hermes_cli/test_managed_vision_capability.py
new file mode 100644
index 0000000000..661976b88d
--- /dev/null
+++ b/tests/hermes_cli/test_managed_vision_capability.py
@@ -0,0 +1,185 @@
+"""Vision capability for managed local models answers from ground truth.
+
+Cloud capability catalogs have never heard of a local GGUF, so without a
+managed-runtime answer every local model reads as text-only: pasted images
+detour to a cloud auxiliary (a screenshot leaving a local-first machine)
+or fail outright. The lookup chain must consult the managed runtime
+between the user's config override and the cloud catalog."""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def hermes_home(tmp_path, monkeypatch):
+    home = tmp_path / ".hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    import importlib
+
+    import hermes_constants
+
+    importlib.reload(hermes_constants)
+    yield home
+    importlib.reload(hermes_constants)
+
+
+def _stage(home_root, name):
+    # Machine-scoped models dir (the shared root — tmp HERMES_HOME IS the root here).
+    from hermes_cli.local_runtime.bootstrap import models_dir
+
+    mdir = models_dir()
+    mdir.mkdir(parents=True, exist_ok=True)
+    (mdir / f"{name}.gguf").write_bytes(b"GGUF" + b"\x00" * 32)
+
+
+def test_not_ours_returns_none(hermes_home):
+    from hermes_cli.local_runtime.capabilities import managed_model_supports_vision
+
+    assert managed_model_supports_vision("gpt-4o") is None
+
+
+def test_catalog_vision_model_with_projector_on_disk(hermes_home):
+    """Staged catalog model with an mmproj present: True (server down —
+    the catalog + on-disk projector answer)."""
+    from hermes_cli.local_runtime.bootstrap import assets_dir
+    from hermes_cli.local_runtime.capabilities import managed_model_supports_vision
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    entry = next(e for e in CATALOG if e.mmproj is not None)
+    variant = entry.variants[-1]
+    _stage(hermes_home, variant.model_id)
+    adir = assets_dir()
+    adir.mkdir(parents=True, exist_ok=True)
+    (adir / entry.mmproj.local_name).write_bytes(b"GGUF mmproj")
+
+    assert managed_model_supports_vision(variant.model_id) is True
+
+
+def test_catalog_vision_model_missing_projector_is_blind(hermes_home):
+    """Same model, projector NOT on disk: False — it genuinely cannot see,
+    and claiming otherwise sends an image to a model that errors on it."""
+    from hermes_cli.local_runtime.capabilities import managed_model_supports_vision
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    entry = next(e for e in CATALOG if e.mmproj is not None)
+    variant = entry.variants[-1]
+    _stage(hermes_home, variant.model_id)
+
+    assert managed_model_supports_vision(variant.model_id) is False
+
+
+def test_live_props_beats_catalog(hermes_home, monkeypatch):
+    """A running child's modalities report wins over the catalog: the
+    server that will receive the image is the authority."""
+    import hermes_cli.local_runtime.capabilities as caps
+
+    from hermes_cli.local_runtime.catalog import CATALOG
+
+    entry = next(e for e in CATALOG if e.mmproj is not None)
+    variant = entry.variants[-1]
+    _stage(hermes_home, variant.model_id)
+    # Catalog would say False (no projector staged) — live props says True.
+    monkeypatch.setattr(caps, "_props_modalities", lambda mid: True)
+    assert caps.managed_model_supports_vision(variant.model_id) is True
+
+
+def test_lookup_chain_consults_managed_runtime(hermes_home, monkeypatch):
+    """_lookup_supports_vision: user override wins, then the managed
+    answer, and the cloud catalog is never reached for a managed model."""
+    import agent.image_routing as ir
+
+    monkeypatch.setattr(
+        "hermes_cli.local_runtime.capabilities.managed_model_supports_vision",
+        lambda mid: True)
+
+    def catalog_must_not_run(*a, **k):
+        raise AssertionError("cloud catalog consulted for a managed model")
+
+    monkeypatch.setattr("agent.models_dev.get_model_capabilities",
+                        catalog_must_not_run)
+
+    got = ir._lookup_supports_vision("llamacpp", "Some-Local-Model", {})
+    assert got is True
+
+    # Explicit user override still outranks the managed answer.
+    cfg = {"model": {"provider": "llamacpp", "name": "Some-Local-Model",
+                     "supports_vision": False}}
+    got = ir._lookup_supports_vision("llamacpp", "Some-Local-Model", cfg)
+    assert got is False
+
+
+def test_webp_transcodes_to_png_for_managed_provider(hermes_home, monkeypatch, tmp_path):
+    """A .webp attachment bound for the managed server must arrive as PNG:
+    llama.cpp's stb_image decoder has no WebP support and drops the part
+    SILENTLY — the model confabulates a description of an image it never
+    saw. Measured live: the same red square answered 'Red' as PNG and
+    'Unseen' as WebP."""
+    pytest.importorskip("PIL")
+    import io
+
+    from PIL import Image
+
+    import agent.image_routing as ir
+
+    webp_path = tmp_path / "shot.webp"
+    img = Image.new("RGB", (32, 32), (255, 0, 0))
+    img.save(webp_path, format="WEBP")
+
+    monkeypatch.setattr("agent.auxiliary_client._runtime_main_value",
+                        lambda k: {"provider": "llamacpp",
+                                   "base_url": ""}.get(k, ""))
+
+    data_url = ir._file_to_data_url(webp_path)
+    assert data_url is not None
+    assert data_url.startswith("data:image/png;base64,"), (
+        "webp must transcode to png for the managed server")
+
+
+def test_webp_passes_through_for_cloud_providers(hermes_home, monkeypatch, tmp_path):
+    """Cloud providers accept WebP natively — no transcode tax for them."""
+    pytest.importorskip("PIL")
+    from PIL import Image
+
+    import agent.image_routing as ir
+
+    webp_path = tmp_path / "shot.webp"
+    Image.new("RGB", (32, 32), (255, 0, 0)).save(webp_path, format="WEBP")
+
+    monkeypatch.setattr("agent.auxiliary_client._runtime_main_value",
+                        lambda k: {"provider": "anthropic",
+                                   "base_url": ""}.get(k, ""))
+
+    data_url = ir._file_to_data_url(webp_path)
+    assert data_url is not None
+    assert data_url.startswith("data:image/webp;base64,")
+
+
+def test_vision_analyze_normalization_narrows_for_managed(hermes_home, monkeypatch, tmp_path):
+    """vision_analyze's native fast path embeds the image into conversation
+    history via _normalize_to_supported_image — for the managed server a
+    WebP must convert to PNG THERE too, or the tool path re-introduces the
+    silent-drop confabulation the attachment path just fixed."""
+    pytest.importorskip("PIL")
+    from PIL import Image
+
+    import tools.vision_tools as vt
+
+    webp_path = tmp_path / "img.webp"
+    Image.new("RGB", (32, 32), (255, 0, 0)).save(webp_path, format="WEBP")
+
+    monkeypatch.setattr("agent.auxiliary_client._runtime_main_value",
+                        lambda k: {"provider": "llamacpp",
+                                   "base_url": ""}.get(k, ""))
+    out_path, mime, err = vt._normalize_to_supported_image(webp_path, "image/webp")
+    assert err is None
+    assert mime == "image/png", "managed server: webp must normalize to png"
+
+    # Cloud providers keep webp untouched.
+    monkeypatch.setattr("agent.auxiliary_client._runtime_main_value",
+                        lambda k: {"provider": "anthropic",
+                                   "base_url": ""}.get(k, ""))
+    out_path, mime, err = vt._normalize_to_supported_image(webp_path, "image/webp")
+    assert err is None
+    assert mime == "image/webp"
diff --git a/tests/hermes_cli/test_model_catalog.py b/tests/hermes_cli/test_model_catalog.py
index b4d8e8a40a..3e9c1844ff 100644
--- a/tests/hermes_cli/test_model_catalog.py
+++ b/tests/hermes_cli/test_model_catalog.py
@@ -307,6 +307,30 @@ class TestProviderOverride:
         assert result == [("override/model", "custom")]
 
 
+class TestRefreshCadence:
+    def test_default_ttl_is_twenty_minutes_and_legacy_hours_honoured(self):
+        from hermes_cli import model_catalog
+
+        with patch("hermes_cli.config.load_config", return_value={"model_catalog": {"ttl_minutes": 20}}):
+            assert model_catalog.refresh_interval_seconds() == 20 * 60
+        # A user-set legacy ttl_hours still wins while ttl_minutes sits at its default.
+        with patch("hermes_cli.config.load_config", return_value={"model_catalog": {"ttl_minutes": 20, "ttl_hours": 3}}):
+            assert model_catalog.refresh_interval_seconds() == 3 * 3600
+
+    def test_refresh_catalogs_forces_every_source(self):
+        from hermes_cli import model_catalog
+
+        with patch.object(model_catalog, "_load_catalog_config", return_value={
+            "enabled": True, "url": "http://master", "ttl_hours": 1.0, "providers": {},
+        }), patch.object(model_catalog, "get_catalog", return_value=_valid_manifest()) as gc, \
+             patch("hermes_cli.models.fetch_openrouter_models") as orm, \
+             patch("hermes_cli.models.fetch_nous_recommended_models") as nous:
+            assert model_catalog.refresh_catalogs() is True
+        gc.assert_called_once_with(force_refresh=True)
+        orm.assert_called_once_with(force_refresh=True)
+        nous.assert_called_once_with(force_refresh=True)
+
+
 class TestIntegrationWithModelsModule:
     """Exercise the fallback paths via the real callers in hermes_cli.models."""
 
diff --git a/tests/hermes_cli/test_model_prefix_routing_87189.py b/tests/hermes_cli/test_model_prefix_routing_87189.py
new file mode 100644
index 0000000000..c4802d1910
--- /dev/null
+++ b/tests/hermes_cli/test_model_prefix_routing_87189.py
@@ -0,0 +1,148 @@
+"""Regression tests for vendor-prefix model routing and dict model.aliases (#87189).
+
+``--model nous/deepseek-v4-pro`` / ``--model ollama/qwen3.5:4b`` used to fall
+through provider auto-detection and be sent to the configured default provider
+(api.anthropic.com) with the prefixed name intact, producing HTTP 404. Dict
+entries under ``model.aliases`` (``localqwen: {model: ..., provider: ...}``)
+were silently dropped because only string values were parsed.
+"""
+
+import hermes_cli.models as models
+import hermes_cli.model_switch as model_switch
+
+
+class TestVendorPrefixRouting:
+    """detect_provider_for_model honors a ``vendor/model`` prefix for
+    providers the user actually configured in their ``providers:`` block."""
+
+    def test_configured_provider_prefix_routes_to_provider(self, monkeypatch):
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"nous"})
+        detected = models.detect_provider_for_model("nous/deepseek-v4-pro", "anthropic")
+        assert detected == ("nous", "deepseek-v4-pro")
+
+    def test_local_provider_prefix_routes_to_provider(self, monkeypatch):
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"ollama"})
+        detected = models.detect_provider_for_model("ollama/qwen3.5:4b", "anthropic")
+        assert detected == ("ollama", "qwen3.5:4b")
+
+    def test_unconfigured_builtin_vendor_prefix_not_rerouted(self, monkeypatch):
+        """Built-in vendor slugs keep catalog/default routing.
+
+        ``google/gemini-2.5-flash`` is aggregator-native: the web config
+        field expects it to switch to OpenRouter, not to the Gemini provider
+        (``TestDenormalizeProviderSwitch`` in test_web_server.py). With no
+        user-configured provider for the vendor, prefix routing must stay
+        out of the way even when the models.dev catalog is unavailable.
+        """
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: set())
+        detected = models.detect_provider_for_model(
+            "google/gemini-2.5-flash", "ollama-local"
+        )
+        assert detected is None
+
+    def test_configured_provider_wins_over_alias_canonicalization(self, monkeypatch):
+        """A user-named ``ollama`` block must not be rewritten to ``custom``."""
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"ollama"})
+        assert models._PROVIDER_ALIASES.get("ollama") == "custom"  # precondition
+        detected = models.detect_provider_for_model("ollama/qwen3.5:4b", "anthropic")
+        assert detected == ("ollama", "qwen3.5:4b")
+
+    def test_provider_alias_prefix_canonicalized_when_configured(self, monkeypatch):
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"zai"})
+        detected = models.detect_provider_for_model("glm/glm-4.7", "anthropic")
+        assert detected == ("zai", "glm-4.7")
+
+    def test_unknown_vendor_prefix_still_unmatched(self, monkeypatch):
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"ollama"})
+        assert models.detect_provider_for_model("notaprovider/foo-model", "anthropic") is None
+
+    def test_openrouter_slug_still_wins_over_prefix_routing(self, monkeypatch):
+        """Aggregator-native slugs keep their existing OpenRouter routing."""
+        monkeypatch.setattr(
+            models, "_find_openrouter_slug", lambda _name: "deepseek/deepseek-chat"
+        )
+        monkeypatch.setattr(models, "_configured_provider_ids", lambda: {"deepseek"})
+        detected = models.detect_provider_for_model("deepseek/deepseek-chat", "anthropic")
+        assert detected == ("openrouter", "deepseek/deepseek-chat")
+
+    def test_bare_model_detection_unchanged(self, monkeypatch):
+        monkeypatch.setattr(models, "_find_openrouter_slug", lambda _name: None)
+        detected = models.detect_provider_for_model("deepseek-chat", "anthropic")
+        assert detected == ("deepseek", "deepseek-chat")
+
+
+class TestDictModelAliases:
+    """``model.aliases`` accepts dict entries with an explicit provider."""
+
+    def _load_with(self, monkeypatch, cfg):
+        monkeypatch.setattr("hermes_cli.config.load_config", lambda: cfg)
+        return model_switch._load_direct_aliases()
+
+    def test_dict_entry_with_explicit_provider(self, monkeypatch):
+        cfg = {
+            "model": {
+                "aliases": {
+                    "localqwen": {"model": "qwen3.5:4b", "provider": "custom"},
+                },
+            },
+        }
+        aliases = self._load_with(monkeypatch, cfg)
+        da = aliases["localqwen"]
+        assert (da.model, da.provider) == ("qwen3.5:4b", "custom")
+
+    def test_dict_entry_with_base_url(self, monkeypatch):
+        cfg = {
+            "model": {
+                "aliases": {
+                    "qwen": {
+                        "model": "qwen3.5:4b",
+                        "provider": "ollama",
+                        "base_url": "http://localhost:11434/v1",
+                    },
+                },
+            },
+        }
+        aliases = self._load_with(monkeypatch, cfg)
+        da = aliases["qwen"]
+        assert (da.model, da.provider, da.base_url) == (
+            "qwen3.5:4b", "ollama", "http://localhost:11434/v1",
+        )
+
+    def test_dict_entry_without_provider_uses_model_provider(self, monkeypatch):
+        cfg = {
+            "model": {
+                "provider": "openrouter",
+                "aliases": {"bare": {"model": "some-model"}},
+            },
+        }
+        aliases = self._load_with(monkeypatch, cfg)
+        da = aliases["bare"]
+        assert (da.model, da.provider) == ("some-model", "openrouter")
+
+    def test_string_entries_still_parse(self, monkeypatch):
+        cfg = {
+            "model": {
+                "aliases": {"ds-flash": "deepseek/deepseek-v4-flash"},
+            },
+        }
+        aliases = self._load_with(monkeypatch, cfg)
+        da = aliases["ds-flash"]
+        assert (da.model, da.provider) == ("deepseek-v4-flash", "deepseek")
+
+    def test_model_aliases_block_keeps_priority_over_model_aliases(self, monkeypatch):
+        cfg = {
+            "model_aliases": {
+                "shared": {"model": "from-top-block", "provider": "custom"},
+            },
+            "model": {
+                "aliases": {"shared": {"model": "from-nested", "provider": "ollama"}},
+            },
+        }
+        aliases = self._load_with(monkeypatch, cfg)
+        assert aliases["shared"].model == "from-top-block"
diff --git a/tests/hermes_cli/test_model_switch_persist_default.py b/tests/hermes_cli/test_model_switch_persist_default.py
index 11394c4222..b53c8913e1 100644
--- a/tests/hermes_cli/test_model_switch_persist_default.py
+++ b/tests/hermes_cli/test_model_switch_persist_default.py
@@ -52,6 +52,24 @@ class TestResolvePersistBehavior:
         with _config({"model": {"persist_switch_by_default": True}}):
             assert resolve_persist_behavior(False, False, explicit_provider="") is True
 
+    def test_first_pick_persists_then_session_only(self):
+        # #90235 / #86414: the ONE policy every surface (CLI, gateway, Desktop
+        # picker) defers to. With no default ever configured, the first pick
+        # persists (even with --provider, which is how the Desktop picker
+        # always sends it) so resolve_provider never falls through to a stray
+        # env key on restart. Once a default exists, a plain pick is
+        # session-only unless --global / persist_switch_by_default.
+        with _config({"model": {}}):
+            assert resolve_persist_behavior(False, False, explicit_provider="anthropic") is True
+        with _config({"model": ""}):
+            assert resolve_persist_behavior(False, False) is True
+        with _config({"model": {"default": "gpt-5.6", "provider": "openai-codex"}}):
+            assert resolve_persist_behavior(False, False, explicit_provider="openai-api") is False
+            assert resolve_persist_behavior(False, False) is False
+            assert resolve_persist_behavior(True, False, explicit_provider="openai-api") is True
+        with _config({"model": "gpt-5.6"}):
+            assert resolve_persist_behavior(False, False) is False
+
 
 # ---------------------------------------------------------------------------
 # helper
diff --git a/tests/hermes_cli/test_nous_policy_filter.py b/tests/hermes_cli/test_nous_policy_filter.py
new file mode 100644
index 0000000000..948885603f
--- /dev/null
+++ b/tests/hermes_cli/test_nous_policy_filter.py
@@ -0,0 +1,246 @@
+"""Narrowing the Nous model lists to an org's policy.
+
+The gateway omits policy-blocked rows from an authenticated ``GET /v1/models``,
+so that response's keys are the reachable set.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+
+import pytest
+
+import hermes_cli.models as models_mod
+import hermes_cli.nous_account as account_mod
+from hermes_cli.models import (
+    _NOUS_POLICY_APPEND_MAX,
+    nous_policy_allowed_ids,
+    restrict_to_nous_policy,
+)
+from hermes_cli.nous_account import nous_policy_present
+
+
+def _jwt(claims: dict) -> str:
+    def seg(obj):
+        raw = json.dumps(obj).encode()
+        return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+    return f"{seg({'alg': 'RS256'})}.{seg(claims)}.sig"
+
+
+class TestRestrictToNousPolicy:
+    def test_none_leaves_the_list_untouched(self):
+        ids = ["a/one", "b/two"]
+        assert restrict_to_nous_policy(ids, None) == ids
+
+    def test_empty_set_leaves_the_list_untouched(self):
+        """Empty is a failed read, not an org that may reach nothing."""
+        ids = ["a/one", "b/two"]
+        assert restrict_to_nous_policy(ids, set()) == ids
+
+    def test_drops_ids_outside_the_policy(self):
+        assert restrict_to_nous_policy(
+            ["a/one", "b/two", "c/three"], {"a/one", "c/three"}
+        ) == ["a/one", "c/three"]
+
+    def test_preserves_curated_order(self):
+        curated = ["z/last", "a/first", "m/middle"]
+        allowed = {"a/first", "m/middle", "z/last"}
+        assert restrict_to_nous_policy(curated, allowed) == curated
+
+    def test_keeps_a_free_sibling_when_its_base_is_reachable(self):
+        """Portal free recommendations are ``:free`` ids."""
+        assert restrict_to_nous_policy(["vendor/model:free"], {"vendor/model"}) == [
+            "vendor/model:free"
+        ]
+
+    def test_keeps_a_free_id_listed_in_its_own_right(self):
+        assert restrict_to_nous_policy(
+            ["vendor/model:free"], {"vendor/model:free"}
+        ) == ["vendor/model:free"]
+
+    def test_drops_a_free_sibling_whose_base_is_blocked(self):
+        assert restrict_to_nous_policy(["vendor/model:free"], {"other/model"}) == []
+
+
+class TestNousPolicyAllowedIds:
+    @pytest.fixture(autouse=True)
+    def _clear_cache(self):
+        models_mod._pricing_cache.clear()
+        models_mod._pricing_cache_retry_after.clear()
+        yield
+        models_mod._pricing_cache.clear()
+        models_mod._pricing_cache_retry_after.clear()
+
+    def _patch(self, monkeypatch, *, policy_present, api_key="sk-test", pricing=None):
+        calls = []
+        monkeypatch.setattr(
+            account_mod, "nous_policy_present", lambda: policy_present
+        )
+        monkeypatch.setattr(
+            models_mod,
+            "_resolve_nous_pricing_credentials",
+            lambda: (api_key, "https://inference.example.com"),
+        )
+
+        def _fake_fetch(**kwargs):
+            calls.append(kwargs)
+            return pricing if pricing is not None else {}
+
+        monkeypatch.setattr(models_mod, "fetch_models_with_pricing", _fake_fetch)
+        return calls
+
+    def test_returns_the_authenticated_catalog_keys(self, monkeypatch):
+        calls = self._patch(
+            monkeypatch,
+            policy_present=True,
+            pricing={"a/one": {}, "b/two": {}},
+        )
+        assert nous_policy_allowed_ids() == {"a/one", "b/two"}
+        assert len(calls) == 1
+        assert calls[0]["api_key"] == "sk-test"
+
+    def test_declines_to_filter_an_unrestricted_org(self, monkeypatch):
+        calls = self._patch(monkeypatch, policy_present=False, pricing={"a/one": {}})
+        assert nous_policy_allowed_ids() is None
+        assert calls == [], "an unrestricted org should not pay for the read"
+
+    def test_declines_to_filter_when_the_claim_is_unknown(self, monkeypatch):
+        """Absent is an older mint, not an unrestricted org."""
+        calls = self._patch(monkeypatch, policy_present=None, pricing={"a/one": {}})
+        assert nous_policy_allowed_ids() is None
+        assert calls == []
+
+    def test_declines_to_filter_on_an_anonymous_read(self, monkeypatch):
+        """An anonymous read returns the full, unfiltered catalog."""
+        self._patch(monkeypatch, policy_present=True, api_key="", pricing={"a/one": {}})
+        assert nous_policy_allowed_ids() is None
+
+    def test_declines_to_filter_on_an_empty_read(self, monkeypatch):
+        """A failed fetch must not read as an org that may reach nothing."""
+        self._patch(monkeypatch, policy_present=True, pricing={})
+        assert nous_policy_allowed_ids() is None
+
+
+class TestNousPolicyPresent:
+    def _patch_token(self, monkeypatch, token):
+        import hermes_cli.auth as auth_mod
+
+        monkeypatch.setattr(
+            auth_mod,
+            "get_provider_auth_state",
+            lambda _p: {"access_token": token} if token is not None else {},
+        )
+
+    @pytest.mark.parametrize("claim,expected", [(True, True), (False, False)])
+    def test_reads_the_claim(self, monkeypatch, claim, expected):
+        self._patch_token(monkeypatch, _jwt({"policy_present": claim}))
+        assert nous_policy_present() is expected
+
+    def test_absent_claim_is_unknown_not_false(self, monkeypatch):
+        self._patch_token(monkeypatch, _jwt({"org_id": "org_1"}))
+        assert nous_policy_present() is None
+
+    def test_non_boolean_claim_is_unknown(self, monkeypatch):
+        self._patch_token(monkeypatch, _jwt({"policy_present": "yes"}))
+        assert nous_policy_present() is None
+
+    def test_no_token_is_unknown(self, monkeypatch):
+        self._patch_token(monkeypatch, None)
+        assert nous_policy_present() is None
+
+    def test_undecodable_token_is_unknown(self, monkeypatch):
+        self._patch_token(monkeypatch, "not-a-jwt")
+        assert nous_policy_present() is None
+
+
+class TestNousPolicyNotice:
+
+    def _patch(self, monkeypatch, present):
+        monkeypatch.setattr(account_mod, "nous_policy_present", lambda: present)
+
+    def test_shows_a_line_for_a_governed_org(self, monkeypatch):
+        self._patch(monkeypatch, True)
+        assert "restricts which models" in account_mod.nous_policy_notice(removed=True)
+
+    @pytest.mark.parametrize("present", [False, None])
+    def test_silent_otherwise(self, monkeypatch, present):
+        """Absent is an older mint, not an unrestricted org."""
+        self._patch(monkeypatch, present)
+        assert account_mod.nous_policy_notice(removed=True) == ""
+
+    def test_silent_when_the_filter_removed_nothing(self, monkeypatch):
+        """The catalog read fails open, so a governed org can still end up with
+        a full list — saying it was filtered would be false."""
+        self._patch(monkeypatch, True)
+        assert account_mod.nous_policy_notice(removed=False) == ""
+
+    def test_names_no_models(self, monkeypatch):
+        """The blocked set is most of the catalog under an allowlist."""
+        self._patch(monkeypatch, True)
+        notice = account_mod.nous_policy_notice(removed=True)
+        assert "/" not in notice, f"looks like it names a model: {notice}"
+        assert len(notice.splitlines()) == 1
+
+
+class TestAllowlistOutsideTheCuratedList:
+    """An allowlist can name only models the curated manifest lacks, which
+    intersecting alone turns into an empty picker."""
+
+    def test_surfaces_an_allowed_model_the_curated_list_lacks(self):
+        assert restrict_to_nous_policy(
+            ["vendor/a", "vendor/b"], {"amazon/nova-2-lite-v1"}, rescue_empty=True
+        ) == ["amazon/nova-2-lite-v1"]
+
+    def test_does_not_append_when_the_curated_overlap_is_non_empty(self):
+        kept = restrict_to_nous_policy(
+            ["z/curated", "a/curated"],
+            {"z/curated", "a/curated", "new/model"},
+            rescue_empty=True,
+        )
+        assert kept == ["z/curated", "a/curated"]
+
+    def test_does_not_rescue_a_catalog_sized_allowed_set(self):
+        """Past the cap the set reads as a whole catalog, and dumping it would
+        bury the curated order the pickers show on purpose."""
+        oversized = {f"cn/model-{i}" for i in range(_NOUS_POLICY_APPEND_MAX + 1)}
+        assert restrict_to_nous_policy(["vendor/one"], oversized, rescue_empty=True) == []
+
+
+class TestRescueIsOptIn:
+    """The rescue is meaningful only for the list a user picks from."""
+
+    def test_rescue_only_when_asked(self):
+        assert restrict_to_nous_policy([], {"a/one"}, rescue_empty=True) == ["a/one"]
+
+    def test_an_already_empty_unavailable_list_is_never_filled(self):
+        """A paid tier has no gated models, so this list is legitimately
+        empty — not a filter result to rescue."""
+        reachable = {f"cn/model-{i}" for i in range(42)}
+        assert restrict_to_nous_policy([], reachable) == []
+
+
+class TestPolicyRunsBeforeTierSplit:
+    """A rescued id must still pass the free/paid predicate.
+
+    Rescuing after the tier split put paid models back into a free-tier user's
+    selectable list, and the same id into both lists at once.
+    """
+
+    def test_a_rescued_paid_model_stays_unavailable_for_a_free_tier_user(self):
+        from hermes_cli.models import partition_nous_models_by_tier
+
+        pricing = {
+            "vendor/free": {"prompt": "0", "completion": "0"},
+            "vendor/paid": {"prompt": "0.000002", "completion": "0.00001"},
+        }
+        narrowed = restrict_to_nous_policy(
+            list(pricing), {"vendor/paid"}, rescue_empty=True
+        )
+        selectable, unavailable = partition_nous_models_by_tier(
+            narrowed, pricing, free_tier=True
+        )
+
+        assert selectable == []
+        assert unavailable == ["vendor/paid"]
diff --git a/tests/hermes_cli/test_nous_policy_surfaces.py b/tests/hermes_cli/test_nous_policy_surfaces.py
new file mode 100644
index 0000000000..04146a617f
--- /dev/null
+++ b/tests/hermes_cli/test_nous_policy_surfaces.py
@@ -0,0 +1,309 @@
+"""Every Nous model list is narrowed to the org's policy before it is shown.
+
+Four surfaces build their list from the curated manifest unioned with the
+Portal's ``recommended-models`` endpoint; neither source is authenticated.
+"""
+
+from __future__ import annotations
+
+import argparse
+
+import pytest
+
+import hermes_cli.models as models_mod
+
+CURATED = ["vendor/allowed", "vendor/blocked"]
+ALLOWED = {"vendor/allowed"}
+
+
+@pytest.fixture
+def policy(monkeypatch):
+    """An org whose policy admits only ``vendor/allowed``."""
+    monkeypatch.setattr(models_mod, "nous_policy_allowed_ids", lambda **_k: ALLOWED)
+    return ALLOWED
+
+
+@pytest.fixture
+def no_policy(monkeypatch):
+    """An unrestricted org — lists must come through untouched."""
+    monkeypatch.setattr(models_mod, "nous_policy_allowed_ids", lambda **_k: None)
+
+
+class TestLoginNous:
+
+    def _run(self, monkeypatch, tmp_path):
+        import hermes_cli.auth as auth_mod
+        import hermes_cli.nous_subscription as ns
+
+        seen: dict = {}
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+        monkeypatch.setattr(
+            auth_mod,
+            "_nous_device_code_login",
+            lambda **_k: {
+                "access_token": "tok",
+                "agent_key": "key",
+                "inference_base_url": "https://inference.example.com",
+                "portal_base_url": "https://portal.example.com",
+                "refresh_token": "r",
+                "token_expires_at": 9999999999,
+            },
+        )
+        monkeypatch.setattr(models_mod, "get_curated_nous_model_ids", lambda: list(CURATED))
+        monkeypatch.setattr(models_mod, "get_pricing_for_provider", lambda _p: {})
+        monkeypatch.setattr(models_mod, "check_nous_free_tier", lambda **_k: None)
+        monkeypatch.setattr(
+            models_mod,
+            "union_with_portal_paid_recommendations",
+            lambda ids, pricing, _portal: (list(ids), pricing),
+        )
+        monkeypatch.setattr(ns, "prompt_enable_tool_gateway", lambda _c: None)
+
+        def _capture(model_ids, **kwargs):
+            seen["model_ids"] = list(model_ids)
+            return None
+
+        monkeypatch.setattr(auth_mod, "_prompt_model_selection", _capture)
+
+        args = argparse.Namespace(
+            portal_url=None, inference_url=None, client_id=None, scope=None,
+            no_browser=True, timeout=15.0, ca_bundle=None, insecure=False,
+        )
+        auth_mod._login_nous(args, auth_mod.PROVIDER_REGISTRY["nous"])
+        return seen
+
+    def test_hidden_model_is_not_offered(self, monkeypatch, tmp_path, policy):
+        assert self._run(monkeypatch, tmp_path).get("model_ids") == ["vendor/allowed"]
+
+    def test_unrestricted_org_sees_the_full_curated_list(
+        self, monkeypatch, tmp_path, no_policy
+    ):
+        assert self._run(monkeypatch, tmp_path).get("model_ids") == CURATED
+
+
+class TestModelSwitchPicker:
+    """The ``/model`` picker's nous branch (``list_authenticated_providers``)."""
+
+    def _rows(self, monkeypatch):
+        import hermes_cli.auth as auth_mod
+        import hermes_cli.model_switch as ms
+
+        monkeypatch.setattr(
+            auth_mod,
+            "_load_auth_store",
+            lambda *a, **k: {"providers": {"nous": {"access_token": "tok"}}},
+        )
+        monkeypatch.setattr(models_mod, "get_curated_nous_model_ids", lambda: list(CURATED))
+        monkeypatch.setattr(models_mod, "get_pricing_for_provider", lambda _p: {})
+        monkeypatch.setattr(models_mod, "check_nous_free_tier", lambda **_k: None)
+        monkeypatch.setattr(
+            models_mod,
+            "union_with_portal_paid_recommendations",
+            lambda ids, pricing, _portal: (list(ids), pricing),
+        )
+        rows = ms.list_authenticated_providers(max_models=10)
+        return next((r for r in rows if r["slug"] == "nous"), None)
+
+    def test_hidden_model_is_filtered(self, monkeypatch, policy):
+        row = self._rows(monkeypatch)
+        assert row is not None, "nous row should be listed"
+        assert "vendor/blocked" not in row["models"]
+        assert "vendor/allowed" in row["models"]
+
+    def test_unrestricted_org_keeps_both(self, monkeypatch, no_policy):
+        row = self._rows(monkeypatch)
+        assert row is not None
+        assert set(CURATED) <= set(row["models"])
+
+    def test_filter_survives_a_failed_recommendation_fetch(self, monkeypatch, policy):
+        """The filter sits outside the try wrapping the Portal union."""
+
+        def _boom(_p):
+            raise RuntimeError("portal down")
+
+        monkeypatch.setattr(models_mod, "get_pricing_for_provider", _boom)
+        row = self._rows(monkeypatch)
+        assert row is not None
+        assert "vendor/blocked" not in row["models"]
+
+
+class TestRecommendedDefaultEndpoint:
+    """This endpoint picks a model the user never sees chosen."""
+
+    def _call(self, monkeypatch):
+        import hermes_cli.auth as auth_mod
+        from hermes_cli.web_server import get_recommended_default_model
+
+        # Blocked first, so an unfiltered list would make it the silent
+        # default — otherwise this passes whether or not the filter runs.
+        monkeypatch.setattr(
+            models_mod, "get_curated_nous_model_ids",
+            lambda: ["vendor/blocked", "vendor/allowed"],
+        )
+        monkeypatch.setattr(models_mod, "get_pricing_for_provider", lambda _p: {})
+        monkeypatch.setattr(models_mod, "check_nous_free_tier", lambda **_k: None)
+        monkeypatch.setattr(
+            models_mod,
+            "union_with_portal_paid_recommendations",
+            lambda ids, pricing, _portal: (list(ids), pricing),
+        )
+        monkeypatch.setattr(auth_mod, "get_provider_auth_state", lambda _p: {})
+        return get_recommended_default_model(provider="nous")
+
+    def test_hidden_model_is_never_the_silent_default(self, monkeypatch, policy):
+        assert self._call(monkeypatch)["model"] == "vendor/allowed"
+
+    def test_unrestricted_org_is_unaffected(self, monkeypatch, no_policy):
+        assert self._call(monkeypatch)["model"] == "vendor/blocked"
+
+
+class TestAuxiliaryFastModel:
+    """``_fast_model_from_catalog`` uses the catalog's keys as a source of ids."""
+
+    def _pick(self, monkeypatch, *, catalog):
+        import agent.auxiliary_client as aux
+
+        seen: dict = {}
+
+        def _fake_fetch(*, api_key=None, base_url="", timeout=8.0, **_k):
+            seen["api_key"] = api_key
+            return {mid: {} for mid in catalog}
+
+        monkeypatch.setattr(
+            models_mod, "_resolve_nous_pricing_credentials",
+            lambda: ("sk-nous", "https://inference.example.com"),
+        )
+        monkeypatch.setattr(models_mod, "fetch_models_with_pricing", _fake_fetch)
+        picked = aux._fast_model_from_catalog("nous")
+        return picked, seen
+
+    def test_reads_the_catalog_with_nous_oauth_credentials(self, monkeypatch, no_policy):
+        """The api-key resolver raises for OAuth providers."""
+        _, seen = self._pick(monkeypatch, catalog=["vendor/haiku-fast"])
+        assert seen["api_key"] == "sk-nous"
+
+    def test_hidden_model_is_not_selected(self, monkeypatch, policy):
+        import agent.auxiliary_client as aux
+
+        monkeypatch.setattr(
+            models_mod, "nous_policy_allowed_ids", lambda **_k: {"vendor/allowed"}
+        )
+        monkeypatch.setattr(aux, "_FAST_MODEL_FAMILIES", ("vendor/",))
+        monkeypatch.setattr(aux, "_FAST_MODEL_EXCLUDE", ())
+        picked, _ = self._pick(
+            monkeypatch, catalog=["vendor/blocked", "vendor/allowed"]
+        )
+        assert picked == "vendor/allowed"
+
+
+class TestNousPrefetch:
+    """The nous disk-cache entry is write-only, so prefetching it is a round
+    trip for nothing."""
+
+    def test_nous_is_not_collected_for_prefetch(self, monkeypatch):
+        import hermes_cli.auth as auth_mod
+        import hermes_cli.model_switch as ms
+
+        monkeypatch.setattr(
+            auth_mod, "_load_auth_store",
+            lambda *a, **k: {"providers": {"nous": {"access_token": "tok"}}},
+        )
+        slugs = ms._collect_authed_provider_slugs({}, {"nous": list(CURATED)}, [])
+        assert "nous" not in slugs
+
+
+class TestPolicyNoticeIsShown:
+
+    def test_login_prints_it(self, monkeypatch, tmp_path, policy, capsys):
+        import hermes_cli.nous_account as account_mod
+
+        monkeypatch.setattr(account_mod, "nous_policy_present", lambda: True)
+        TestLoginNous()._run(monkeypatch, tmp_path)
+        assert "restricts which models" in capsys.readouterr().out
+
+    def test_login_silent_for_an_ungoverned_org(
+        self, monkeypatch, tmp_path, no_policy, capsys
+    ):
+        import hermes_cli.nous_account as account_mod
+
+        monkeypatch.setattr(account_mod, "nous_policy_present", lambda: False)
+        TestLoginNous()._run(monkeypatch, tmp_path)
+        assert "restricts which models" not in capsys.readouterr().out
+
+
+class TestAuxFallbackRespectsPolicy:
+    """Steps 2-4 of the aux ladder are policy-blind: `resolve_aux_model` queries
+    a public recommendation and the rest are hardcoded."""
+
+    def _patch(self, monkeypatch, *, allowed, recommended):
+        import agent.auxiliary_client as aux
+        import providers
+
+        monkeypatch.setattr(models_mod, "nous_policy_allowed_ids", lambda **_k: allowed)
+        monkeypatch.setattr(
+            models_mod, "_resolve_nous_pricing_credentials",
+            lambda: ("sk", "https://inference.example.com"),
+        )
+        # No fast-family match, so the catalog step yields nothing.
+        monkeypatch.setattr(
+            models_mod, "fetch_models_with_pricing",
+            lambda **_k: {"vendor/allowed-large": {}},
+        )
+
+        class _Profile:
+            default_aux_model = ""
+
+            def resolve_aux_model(self, **_k):
+                return recommended
+
+        monkeypatch.setattr(providers, "get_provider_profile", lambda _p: _Profile())
+        return aux
+
+    def test_blocked_recommendation_is_not_used(self, monkeypatch):
+        aux = self._patch(
+            monkeypatch, allowed={"vendor/allowed-large"},
+            recommended="vendor/blocked-haiku",
+        )
+        assert aux._get_aux_model_for_provider("nous", prefer_fast=True) == ""
+
+    def test_allowed_recommendation_still_used(self, monkeypatch):
+        aux = self._patch(
+            monkeypatch, allowed={"vendor/allowed-large", "vendor/ok-haiku"},
+            recommended="vendor/ok-haiku",
+        )
+        assert (
+            aux._get_aux_model_for_provider("nous", prefer_fast=True)
+            == "vendor/ok-haiku"
+        )
+
+    def test_ungoverned_org_is_unaffected(self, monkeypatch):
+        aux = self._patch(
+            monkeypatch, allowed=None, recommended="vendor/anything"
+        )
+        assert (
+            aux._get_aux_model_for_provider("nous", prefer_fast=True)
+            == "vendor/anything"
+        )
+
+
+def test_titling_seeds_the_shared_catalog_entry_like_the_pickers(monkeypatch):
+    """The aux catalog read shares the pickers' cache entry, so seeding it
+    without the Nous-only arguments costs the picker its sale chrome and leaves
+    the policy catalog with no expiry."""
+    import agent.auxiliary_client as aux
+
+    monkeypatch.setattr(
+        models_mod, "_resolve_nous_pricing_credentials",
+        lambda: ("tok", "https://inference.example.com"),
+    )
+    seen: dict = {}
+
+    def _fake_fetch(**kwargs):
+        seen.update(kwargs)
+        return {"vendor/haiku": {}}
+
+    monkeypatch.setattr(models_mod, "fetch_models_with_pricing", _fake_fetch)
+    aux._fast_model_from_catalog("nous")
+
+    assert seen.get("include_sale_original") is True
+    assert seen.get("cache_ttl_seconds") == models_mod._NOUS_CATALOG_TTL_SECONDS
diff --git a/tests/hermes_cli/test_nous_subscription.py b/tests/hermes_cli/test_nous_subscription.py
index d9f71a9af1..c9ffaa931a 100644
--- a/tests/hermes_cli/test_nous_subscription.py
+++ b/tests/hermes_cli/test_nous_subscription.py
@@ -58,6 +58,52 @@ def test_get_nous_subscription_features_recognizes_direct_exa_backend(monkeypatc
     assert features.web.current_provider == "exa"
 
 
+def test_get_nous_subscription_features_recognizes_keyless_tavily_backend(monkeypatch):
+    """Selecting Tavily in setup/tools counts as available with no API key.
+
+    Mirrors tools.web_tools._is_backend_available('tavily'): keyless is
+    opt-in via web.backend / search_backend / extract_backend, not a
+    silent empty-install default. The setup summary previously required
+    TAVILY_API_KEY and printed a false 'missing' after a skipped key prompt.
+    """
+    monkeypatch.setattr(ns, "get_env_value", lambda name: "")
+    monkeypatch.setattr(
+        ns, "get_nous_portal_account_info", lambda: _account(logged_in=False)
+    )
+    monkeypatch.setattr(ns, "_toolset_enabled", lambda config, key: key == "web")
+    monkeypatch.setattr(ns, "_has_agent_browser", lambda: False)
+    monkeypatch.setattr(ns, "resolve_openai_audio_api_key", lambda: "")
+    monkeypatch.setattr(ns, "has_direct_modal_credentials", lambda: False)
+
+    features = ns.get_nous_subscription_features({"web": {"backend": "tavily"}})
+
+    assert features.web.available is True
+    assert features.web.active is True
+    assert features.web.managed_by_nous is False
+    assert features.web.direct_override is True
+    assert features.web.current_provider == "tavily"
+    assert features.web.explicit_configured is True
+
+
+def test_keyless_tavily_search_backend_without_shared_backend(monkeypatch):
+    monkeypatch.setattr(ns, "get_env_value", lambda name: "")
+    monkeypatch.setattr(
+        ns, "get_nous_portal_account_info", lambda: _account(logged_in=False)
+    )
+    monkeypatch.setattr(ns, "_toolset_enabled", lambda config, key: key == "web")
+    monkeypatch.setattr(ns, "_has_agent_browser", lambda: False)
+    monkeypatch.setattr(ns, "resolve_openai_audio_api_key", lambda: "")
+    monkeypatch.setattr(ns, "has_direct_modal_credentials", lambda: False)
+
+    features = ns.get_nous_subscription_features(
+        {"web": {"search_backend": "tavily"}}
+    )
+
+    assert features.web.available is True
+    assert features.web.active is True
+    assert features.web.current_provider == "tavily"
+
+
 def test_unconfigured_web_without_keys_is_unavailable(monkeypatch):
     monkeypatch.setattr(ns, "get_env_value", lambda name: "")
     monkeypatch.setattr(
diff --git a/tests/hermes_cli/test_platform_actions.py b/tests/hermes_cli/test_platform_actions.py
index c32bdad9cd..8a7d66e05a 100644
--- a/tests/hermes_cli/test_platform_actions.py
+++ b/tests/hermes_cli/test_platform_actions.py
@@ -39,6 +39,17 @@ def _runner_with(adapters: dict):
     return patch("gateway.run._gateway_runner_ref", lambda: runner)
 
 
+def _multiplex_runner_with(*, default: dict, profiles: dict, active_profile: str = "default"):
+    """A runner using the REAL GatewayAuthorizationMixin resolution ladder."""
+    from gateway.authz_mixin import GatewayAuthorizationMixin
+
+    runner = GatewayAuthorizationMixin.__new__(GatewayAuthorizationMixin)
+    runner.adapters = default
+    runner._profile_adapters = profiles
+    runner._active_profile_name = lambda: active_profile
+    return patch("gateway.run._gateway_runner_ref", lambda: runner)
+
+
 def _telegram_adapter(connected=True):
     a = MagicMock()
     a.platform = Platform.TELEGRAM
@@ -264,6 +275,49 @@ class TestVerbRouting:
         assert result["error"] == "invalid_argument"
 
 
+class TestMultiplexProfileRouting:
+    """A plugin acting during a secondary profile's turn must act through THAT
+    profile's adapter, never the default profile's — the fail-closed contract
+    of GatewayAuthorizationMixin._authorization_adapter (#85245)."""
+
+    def test_secondary_profile_routes_to_its_own_adapter_not_default(self):
+        actions = PlatformActions("p")
+        default_adapter = _telegram_adapter()
+        team_b_adapter = _telegram_adapter()
+        with (
+            _grant(True),
+            _multiplex_runner_with(
+                default={Platform.TELEGRAM: default_adapter},
+                profiles={"team-b": {Platform.TELEGRAM: team_b_adapter}},
+            ),
+            patch("hermes_cli.profiles.get_active_profile_name", return_value="team-b"),
+        ):
+            result = asyncio.run(actions.add_reaction("telegram", "1", "2", "x"))
+        assert result["ok"] is True
+        team_b_adapter._set_reaction.assert_awaited_once()
+        default_adapter._set_reaction.assert_not_awaited()
+
+    @pytest.mark.parametrize(
+        "resolver",
+        [
+            {"return_value": "team-b"},              # stamped profile, no registry entry
+            {"side_effect": RuntimeError("boom")},  # profile resolution itself fails
+        ],
+        ids=["no-registry-entry", "resolution-error"],
+    )
+    def test_unresolvable_profile_fails_closed_never_default_bot(self, resolver):
+        actions = PlatformActions("p")
+        default_adapter = _telegram_adapter()
+        with (
+            _grant(True),
+            _multiplex_runner_with(default={Platform.TELEGRAM: default_adapter}, profiles={}),
+            patch("hermes_cli.profiles.get_active_profile_name", **resolver),
+        ):
+            result = asyncio.run(actions.add_reaction("telegram", "1", "2", "x"))
+        assert result["error"] == "adapter_not_registered"
+        default_adapter._set_reaction.assert_not_awaited()
+
+
 class TestPluginContextWiring:
     def test_ctx_platform_actions_bound_to_plugin_id(self):
         from hermes_cli.plugins import PluginContext, PluginManager, PluginManifest
diff --git a/tests/hermes_cli/test_plugins.py b/tests/hermes_cli/test_plugins.py
index 4f4f67be0c..d44abafb4f 100644
--- a/tests/hermes_cli/test_plugins.py
+++ b/tests/hermes_cli/test_plugins.py
@@ -933,6 +933,13 @@ class TestDeliveryParity:
 class TestForceReloadSymmetry:
     """Force rediscovery restores non-plugin state it wiped (#64178)."""
 
+    @pytest.fixture(autouse=True)
+    def _cleanup_shell_hook_registry(self):
+        yield
+        import agent.shell_hooks as shell_hooks_mod
+
+        shell_hooks_mod.reset_for_tests()
+
     def test_force_reload_re_registers_shell_hooks(self, monkeypatch):
         """config.yaml shell hooks are re-wired after force=True (#60036)."""
         calls = []
@@ -992,6 +999,7 @@ class TestForceReloadSymmetry:
 
     def test_re_register_config_hooks_clears_idempotence_set(self, monkeypatch):
         import agent.shell_hooks as shell_hooks_mod
+        from hermes_constants import get_hermes_home
 
         recorded = {}
         monkeypatch.setattr(
@@ -1002,8 +1010,9 @@ class TestForceReloadSymmetry:
         monkeypatch.setattr(
             "hermes_cli.config.load_config", lambda: {"hooks": {}}
         )
+        home_key = str(get_hermes_home().expanduser().resolve())
         with shell_hooks_mod._registered_lock:
-            shell_hooks_mod._registered.add(("post_llm_call", None, "echo hi"))
+            shell_hooks_mod._registered.add((home_key, "post_llm_call", None, "echo hi"))
 
         shell_hooks_mod.re_register_config_hooks()
 
@@ -1048,7 +1057,7 @@ class TestForceReloadSymmetry:
 
         assert started.wait(timeout=1.0)
         assert results == [{"ok": True}]
-        assert elapsed < 1.0, f"caller blocked for {elapsed:.2f}s after timeout"
+        assert elapsed < 5.0, f"caller blocked for {elapsed:.2f}s after timeout"
         hold.set()
 
     def test_hook_callback_within_timeout_returns_value(self, monkeypatch):
@@ -1132,7 +1141,7 @@ class TestForceReloadSymmetry:
         elapsed = time.monotonic() - t0
 
         assert len(starts) == 1
-        assert elapsed < 1.0
+        assert elapsed < 5.0
         hold.set()
 
     def test_pre_tool_call_timeout_fail_closed(self, monkeypatch):
@@ -1166,7 +1175,7 @@ class TestForceReloadSymmetry:
         elapsed = time.monotonic() - t0
 
         assert msg == _PRE_TOOL_CALL_TIMEOUT_BLOCK_MESSAGE
-        assert elapsed < 1.0
+        assert elapsed < 5.0
 
         # Still-running / suppression window must also fail closed.
         msg2 = resolve_pre_tool_block("web_search", {"query": "y"})
@@ -1219,6 +1228,50 @@ class TestForceReloadSymmetry:
         assert _PRE_TOOL_CALL_TIMEOUT_BLOCK_MESSAGE in result
         hold.set()
 
+    def test_force_reload_of_one_profile_does_not_orphan_another(self, monkeypatch):
+        """Real two-manager regression: force-reloading profile A's plugin
+        manager must leave profile B's shell hook registered exactly once —
+        not duplicated, not dropped (#92682 review).
+        """
+        import hermes_cli.plugins as plugins_mod
+        import agent.shell_hooks as shell_hooks_mod
+
+        cfg = {"hooks": {"on_session_start": [{"command": "/bin/true"}]}}
+        monkeypatch.setenv("HERMES_ACCEPT_HOOKS", "1")
+        monkeypatch.setattr("hermes_cli.config.load_config", lambda: cfg)
+        monkeypatch.setattr(
+            PluginManager, "_discover_and_load_inner", lambda self_inner: None,
+        )
+
+        monkeypatch.setenv("HERMES_HOME", "/tmp/profile-a")
+        mgr_a = PluginManager()
+        plugins_mod._plugin_manager = mgr_a
+        shell_hooks_mod.register_from_config(cfg, accept_hooks=True)
+
+        monkeypatch.setenv("HERMES_HOME", "/tmp/profile-b")
+        mgr_b = PluginManager()
+        plugins_mod._plugin_manager = mgr_b
+        shell_hooks_mod.register_from_config(cfg, accept_hooks=True)
+
+        assert len(mgr_a._hooks.get("on_session_start", [])) == 1
+        assert len(mgr_b._hooks.get("on_session_start", [])) == 1
+
+        # Force-reload A. Its own manager's hook is wiped and restored;
+        # B's manager (and idempotence key) must be untouched.
+        mgr_a.discover_and_load(force=True)
+
+        assert len(mgr_a._hooks.get("on_session_start", [])) == 1
+        assert len(mgr_b._hooks.get("on_session_start", [])) == 1
+
+        # B's later adapter reconnect re-runs register_from_config(); its
+        # idempotence key must still be intact, so this must be a no-op
+        # rather than appending a second callback to B's live manager.
+        monkeypatch.setenv("HERMES_HOME", "/tmp/profile-b")
+        second = shell_hooks_mod.register_from_config(cfg, accept_hooks=True)
+
+        assert second == []
+        assert len(mgr_b._hooks.get("on_session_start", [])) == 1
+
 
 class TestPreToolCallBlocking:
     """Tests for the pre_tool_call block directive helper."""
diff --git a/tests/hermes_cli/test_pricing_cache_auth_key.py b/tests/hermes_cli/test_pricing_cache_auth_key.py
new file mode 100644
index 0000000000..d9846097fd
--- /dev/null
+++ b/tests/hermes_cli/test_pricing_cache_auth_key.py
@@ -0,0 +1,210 @@
+"""``_pricing_cache`` keys on the credential, not just the base URL.
+
+Nous ``/v1/models`` answers each caller with the catalog their org may reach,
+so an anonymous read, and two different tokens, must not share a cache entry.
+"""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import MagicMock
+
+import pytest
+
+import hermes_cli.models as models_mod
+from hermes_cli.models import fetch_models_with_pricing, peek_cached_pricing
+
+BASE = "https://inference-api.example.com"
+
+# What the endpoint serves anonymously vs. to a policy-restricted caller.
+_FULL = ["vendor/allowed", "vendor/blocked"]
+_FILTERED = ["vendor/allowed"]
+
+
+@pytest.fixture(autouse=True)
+def _clear_pricing_cache():
+    models_mod._pricing_cache.clear()
+    models_mod._pricing_cache_retry_after.clear()
+    yield
+    models_mod._pricing_cache.clear()
+    models_mod._pricing_cache_retry_after.clear()
+
+
+@pytest.fixture
+def catalog(monkeypatch):
+    """Serve the filtered catalog to an authenticated read, the full one to an
+    anonymous read, and record every request."""
+    requests: list[str | None] = []
+
+    def _fake_urlopen(req, timeout=8.0):
+        auth = req.get_header("Authorization")
+        requests.append(auth)
+        ids = _FILTERED if auth else _FULL
+        payload = {
+            "data": [
+                {"id": mid, "pricing": {"prompt": "0.000002", "completion": "0.00001"}}
+                for mid in ids
+            ]
+        }
+        resp = MagicMock()
+        resp.read.return_value = json.dumps(payload).encode()
+        resp.__enter__ = lambda self: self
+        resp.__exit__ = lambda *a: False
+        return resp
+
+    monkeypatch.setattr(models_mod, "_urlopen_model_catalog_request", _fake_urlopen)
+    return requests
+
+
+@pytest.fixture
+def per_org_catalog(monkeypatch):
+    """Serve each token the catalog its own org may reach."""
+    requests: list[str | None] = []
+
+    def _fake_urlopen(req, timeout=8.0):
+        auth = req.get_header("Authorization")
+        requests.append(auth)
+        org = "a" if auth == "Bearer tok-a" else "b"
+        payload = {
+            "data": [
+                {
+                    "id": f"org-{org}/only",
+                    "pricing": {"prompt": "0.000002", "completion": "0.00001"},
+                }
+            ]
+        }
+        resp = MagicMock()
+        resp.read.return_value = json.dumps(payload).encode()
+        resp.__enter__ = lambda self: self
+        resp.__exit__ = lambda *a: False
+        return resp
+
+    monkeypatch.setattr(models_mod, "_urlopen_model_catalog_request", _fake_urlopen)
+    return requests
+
+
+def test_one_token_does_not_receive_another_tokens_catalog(per_org_catalog):
+    """Two orgs in one process — a long-lived gateway or desktop backend after
+    a profile switch or re-login."""
+    a = fetch_models_with_pricing(api_key="tok-a", base_url=BASE)
+    b = fetch_models_with_pricing(api_key="tok-b", base_url=BASE)
+
+    assert list(a) == ["org-a/only"]
+    assert list(b) == ["org-b/only"], "token B was handed token A's catalog"
+    assert len(per_org_catalog) == 2, "token B must reach the network"
+
+
+def test_credential_value_does_not_appear_in_the_cache_key():
+    """Guards against keying on the raw token."""
+    assert "sk-super-secret" not in models_mod._pricing_auth_fingerprint("sk-super-secret")
+
+
+def test_anonymous_and_authenticated_reads_are_separate(catalog):
+    """Also pins the header: anonymous must send none."""
+    anon = fetch_models_with_pricing(api_key="", base_url=BASE)
+    authed = fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+
+    assert sorted(anon) == sorted(_FULL)
+    assert sorted(authed) == sorted(_FILTERED)
+    assert catalog == [None, "Bearer sk-test"]
+
+
+@pytest.mark.parametrize("api_key", ["sk-test", ""])
+def test_repeated_read_still_hits_the_cache(catalog, api_key):
+    """Widening the key must not cost the caching it was there for."""
+    first = fetch_models_with_pricing(api_key=api_key, base_url=BASE)
+    second = fetch_models_with_pricing(api_key=api_key, base_url=BASE)
+
+    assert first == second
+    assert len(catalog) == 1, "second read should be served from cache"
+
+
+def test_force_refresh_replaces_only_its_own_entry(catalog):
+    """A forced authenticated re-read must leave the anonymous entry intact."""
+    fetch_models_with_pricing(api_key="", base_url=BASE)
+    fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+    fetch_models_with_pricing(api_key="sk-test", base_url=BASE, force_refresh=True)
+
+    assert len(catalog) == 3
+    anon = fetch_models_with_pricing(api_key="", base_url=BASE)
+    assert sorted(anon) == sorted(_FULL)
+    assert len(catalog) == 3, "the anonymous entry should have survived"
+
+
+class TestPeekCachedPricing:
+    def test_returns_empty_when_nothing_cached(self):
+        assert peek_cached_pricing(BASE) == {}
+
+    def test_accepts_a_v1_suffixed_url(self, catalog):
+        """The agent holds a /v1-suffixed base URL; fetchers key on the root."""
+        fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+        assert sorted(peek_cached_pricing(BASE + "/v1")) == sorted(_FILTERED)
+
+    def test_prefers_the_authenticated_catalog(self, catalog):
+        fetch_models_with_pricing(api_key="", base_url=BASE)
+        fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+        assert sorted(peek_cached_pricing(BASE)) == sorted(_FILTERED)
+
+    def test_falls_back_to_the_anonymous_catalog(self, catalog):
+        fetch_models_with_pricing(api_key="", base_url=BASE)
+        assert sorted(peek_cached_pricing(BASE)) == sorted(_FULL)
+
+    def test_never_fetches(self, catalog):
+        peek_cached_pricing(BASE)
+        assert catalog == []
+
+
+class TestNousCatalogExpiry:
+    """A Nous catalog reflects the org's policy, which an admin can change while
+    a long-lived process holds the entry."""
+
+    def test_entry_expires_so_a_policy_change_is_picked_up(self, catalog, monkeypatch):
+        from hermes_cli.models import _NOUS_CATALOG_TTL_SECONDS
+
+        fetch_models_with_pricing(
+            api_key="sk-test", base_url=BASE,
+            cache_ttl_seconds=_NOUS_CATALOG_TTL_SECONDS,
+        )
+        assert len(catalog) == 1
+
+        now = models_mod.time.monotonic()
+        monkeypatch.setattr(
+            models_mod.time, "monotonic",
+            lambda: now + _NOUS_CATALOG_TTL_SECONDS + 1,
+        )
+        fetch_models_with_pricing(
+            api_key="sk-test", base_url=BASE,
+            cache_ttl_seconds=_NOUS_CATALOG_TTL_SECONDS,
+        )
+        assert len(catalog) == 2, "expired entry should be re-read"
+
+    def test_no_ttl_keeps_the_entry_indefinitely(self, catalog, monkeypatch):
+        """Other providers' catalogs carry no policy and must not start
+        re-fetching."""
+        fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+        now = models_mod.time.monotonic()
+        monkeypatch.setattr(models_mod.time, "monotonic", lambda: now + 86_400)
+        fetch_models_with_pricing(api_key="sk-test", base_url=BASE)
+        assert len(catalog) == 1
+
+    def test_peek_prefers_the_newest_credential(self, per_org_catalog):
+        """After a rotation the older entry is still resident and, being
+        insertion-ordered, comes first."""
+        fetch_models_with_pricing(api_key="tok-a", base_url=BASE, cache_ttl_seconds=300)
+        fetch_models_with_pricing(api_key="tok-b", base_url=BASE, cache_ttl_seconds=300)
+        assert list(peek_cached_pricing(BASE)) == ["org-b/only"]
+
+    def test_peek_skips_an_expired_entry(self, catalog, monkeypatch):
+        """Reading _pricing_cache directly walked straight past the TTL."""
+        from hermes_cli.models import _NOUS_CATALOG_TTL_SECONDS
+
+        fetch_models_with_pricing(
+            api_key="sk-test", base_url=BASE,
+            cache_ttl_seconds=_NOUS_CATALOG_TTL_SECONDS,
+        )
+        now = models_mod.time.monotonic()
+        monkeypatch.setattr(
+            models_mod.time, "monotonic",
+            lambda: now + _NOUS_CATALOG_TTL_SECONDS + 1,
+        )
+        assert peek_cached_pricing(BASE) == {}
diff --git a/tests/hermes_cli/test_profiles_sidebar_cache.py b/tests/hermes_cli/test_profiles_sidebar_cache.py
index 5bb113a028..ead0c6b08b 100644
--- a/tests/hermes_cli/test_profiles_sidebar_cache.py
+++ b/tests/hermes_cli/test_profiles_sidebar_cache.py
@@ -128,6 +128,30 @@ class SidebarCacheTests(unittest.TestCase):
         self.assertEqual(scan(), {"ok": True})
         self.assertEqual(calls, 2)
 
+    def test_does_not_cache_payloads_that_carry_profile_errors(self):
+        # A 200 with a non-empty errors[] is how a failed profile scan is
+        # reported. Caching it for the TTL keeps the empty recents page in
+        # front of a store that has already recovered.
+        calls = 0
+
+        @profiles._sidebar_singleflight_cache
+        def scan():
+            nonlocal calls
+            calls += 1
+            if calls == 1:
+                return {
+                    "errors": [{"profile": "default", "error": "disk I/O error"}],
+                    "recents": {"sessions": []},
+                }
+            return {"errors": [], "recents": {"sessions": [{"id": "yesterday"}]}}
+
+        first = scan()
+        second = scan()
+
+        self.assertEqual(first["errors"][0]["error"], "disk I/O error")
+        self.assertEqual(second["recents"]["sessions"], [{"id": "yesterday"}])
+        self.assertEqual(calls, 2)
+
     def test_can_be_disabled(self):
         calls = 0
 
diff --git a/tests/hermes_cli/test_restart_plan_reconciliation.py b/tests/hermes_cli/test_restart_plan_reconciliation.py
index eebe427728..b87cc98f7a 100644
--- a/tests/hermes_cli/test_restart_plan_reconciliation.py
+++ b/tests/hermes_cli/test_restart_plan_reconciliation.py
@@ -159,6 +159,124 @@ def test_external_supervisor_counts_as_restarted():
     assert outcomes[0]["outcome"] == "restarted"
 
 
+def test_unmanaged_serve_runtime_under_default_profile_is_unaccounted():
+    """#100479: an sshd-spawned `serve --isolated` has no systemd unit and
+    shares the default profile with the gateway. A gateway-only restart
+    must not be read as covering it — it must trip the tripwire instead."""
+    serve_runtime = RuntimeRecord(
+        kind="serve",
+        profile="default",
+        pid=900,
+        supervisor="manual-serve",
+        restart_via=_restart_mechanism("manual-serve", "default"),
+    )
+    outcomes = match_runtime_outcomes(
+        _plan(_rt("default", 100, supervisor="systemd"), serve_runtime),
+        restarted_services=["hermes-gateway"], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids=set(), failed_units=[],
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid[100] == "restarted"
+    assert by_pid[900] == "unaccounted"
+    assert report_unaccounted_runtimes(outcomes) is True
+
+
+def _serve(profile: str, pid: int, kind: str = "serve") -> RuntimeRecord:
+    return RuntimeRecord(
+        kind=kind,
+        profile=profile,
+        pid=pid,
+        supervisor="manual-serve",
+        restart_via=_restart_mechanism("manual-serve", profile),
+    )
+
+
+def test_serve_never_borrows_relaunched_or_external_gateway_profile():
+    """Sibling site of #100479: the relaunched_profiles / external-supervisor
+    bookkeeping is gateway vocabulary too. A manual gateway relaunch under
+    ``default`` (or a named profile) says nothing about a serve that shares
+    the profile name."""
+    outcomes = match_runtime_outcomes(
+        _plan(_rt("default", 100), _serve("default", 900),
+              _rt("work", 101), _serve("work", 901, kind="dashboard")),
+        restarted_services=[], relaunched_profiles=["default"],
+        externally_supervised_profiles=["work"], killed_pids=set(), failed_units=[],
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid == {
+        100: "restarted", 900: "unaccounted", 101: "restarted", 901: "unaccounted"
+    }
+
+
+def test_named_profile_serve_does_not_match_gateway_profile_unit():
+    """``hermes-gateway-work.service`` restarted must not credit the ``work``
+    serve — the old substring match (``"work" in unit``) did exactly that."""
+    outcomes = match_runtime_outcomes(
+        _plan(_rt("work", 101, supervisor="systemd"), _serve("work", 901)),
+        restarted_services=["hermes-gateway-work.service"], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids=set(), failed_units=[],
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid == {101: "restarted", 901: "unaccounted"}
+
+
+def test_serve_reconciles_against_its_own_unit_vocabulary():
+    """A serve IS covered when a ``hermes-serve*`` unit for its profile was
+    restarted (or failed) — scope-qualified identities included."""
+    outcomes = match_runtime_outcomes(
+        _plan(_serve("default", 900), _serve("work", 901),
+              _serve("ops", 902, kind="dashboard"), _serve("qa", 903)),
+        restarted_services=["hermes-gateway", "user/hermes-serve",
+                            "hermes-serve-work.service", "hermes-dashboard-ops"],
+        relaunched_profiles=[], externally_supervised_profiles=[],
+        killed_pids=set(), failed_units=["hermes-serve-qa.service"],
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid == {900: "restarted", 901: "restarted", 902: "restarted", 903: "failed"}
+    # exact names: ``work`` must not claim ``hermes-serve-workbench``
+    outcomes = match_runtime_outcomes(
+        _plan(_serve("work", 901)),
+        restarted_services=["hermes-serve-workbench.service"], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids=set(), failed_units=[],
+    )
+    assert outcomes[0]["outcome"] == "unaccounted"
+
+
+def test_serve_outcome_follows_incarnation_probe_when_provided():
+    """With the (pid, create_time) survivor probe result, liveness decides:
+    a pre-update serve that is gone was replaced (restarted); one still
+    alive is unaccounted — even when a hermes-serve unit was restarted."""
+    plan = _plan(_serve("default", 900), _serve("default", 901, kind="dashboard"))
+    outcomes = match_runtime_outcomes(
+        plan, restarted_services=["hermes-serve.service"], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids=set(), failed_units=[],
+        stale_serve_pids={900},
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid == {900: "unaccounted", 901: "restarted"}
+    # killed pid still wins as "stopped"; probe None => fail closed
+    outcomes = match_runtime_outcomes(
+        plan, restarted_services=[], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids={901}, failed_units=[],
+        stale_serve_pids=None,
+    )
+    by_pid = {o["pid"]: o["outcome"] for o in outcomes}
+    assert by_pid == {900: "unaccounted", 901: "stopped"}
+
+
+def test_unaccounted_serve_report_names_serve_remedy_not_gateway_restart(capsys):
+    outcomes = match_runtime_outcomes(
+        _plan(_serve("default", 900)),
+        restarted_services=["hermes-gateway"], relaunched_profiles=[],
+        externally_supervised_profiles=[], killed_pids=set(), failed_units=[],
+    )
+    assert report_unaccounted_runtimes(outcomes) is True
+    out = capsys.readouterr().out
+    assert "serve [default] pid 900" in out
+    assert "hermes-serve.service" in out
+    assert "hermes gateway restart" not in out
+
+
 def test_mixed_fleet_only_the_missed_one_escalates(capsys):
     outcomes = match_runtime_outcomes(
         _plan(
diff --git a/tests/hermes_cli/test_runtime_install_progress.py b/tests/hermes_cli/test_runtime_install_progress.py
new file mode 100644
index 0000000000..1ca5636f93
--- /dev/null
+++ b/tests/hermes_cli/test_runtime_install_progress.py
@@ -0,0 +1,166 @@
+"""Runtime install progress: the slow legs must tick, never hang silently.
+
+The incident: 'Installing runtime…' sat frozen for minutes on a slow
+line — ensure_runtime_installed downloaded and extracted with no
+progress stream, so both the quickstart hero and the pane's install row
+showed a dead bar. Contract: _download and _extract tick per chunk /
+per member, ensure_runtime_installed forwards a staged stream, and the
+router's hook translates it into live job fields."""
+
+from __future__ import annotations
+
+import io
+import zipfile
+from pathlib import Path
+
+import hermes_cli.local_runtime.binaries as binaries
+from hermes_cli.web_routers.local_models import _job, _runtime_progress_hook
+
+
+def _make_zip(path: Path, names_sizes: dict[str, int]) -> None:
+    with zipfile.ZipFile(path, "w") as z:
+        for name, size in names_sizes.items():
+            z.writestr(name, b"x" * size)
+
+
+def test_extract_ticks_per_member(tmp_path):
+    archive = tmp_path / "runtime.zip"
+    _make_zip(archive, {"a.bin": 1000, "b.bin": 3000, "c.bin": 500})
+    ticks: list[tuple[int, int]] = []
+    binaries._extract(archive, tmp_path / "out",
+                      progress=lambda d, t: ticks.append((d, t)))
+    assert len(ticks) == 3
+    total = 4500
+    assert all(t == total for _, t in ticks)
+    assert [d for d, _ in ticks] == sorted(d for d, _ in ticks)
+    assert ticks[-1][0] == total
+    assert (tmp_path / "out" / "b.bin").stat().st_size == 3000
+
+
+def test_download_ticks_with_content_length(tmp_path, monkeypatch):
+    payload = b"y" * (3 << 20)  # 3 MiB -> several 1 MiB chunks
+
+    class _Resp(io.BytesIO):
+        headers = {"Content-Length": str(len(payload))}
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr(binaries.urllib.request, "urlopen",
+                        lambda url, timeout=0: _Resp(payload))
+    ticks: list[tuple[int, int]] = []
+    dest = tmp_path / "asset.zip"
+    binaries._download("http://x/asset.zip", dest,
+                       progress=lambda d, t: ticks.append((d, t)))
+    assert dest.read_bytes() == payload
+    assert len(ticks) >= 3
+    assert ticks[-1] == (len(payload), len(payload))
+
+
+def test_ensure_runtime_installed_forwards_staged_progress(tmp_path, monkeypatch):
+    """The full install path emits download -> verify -> extract stages
+    (per asset) and a final verify, all through one callback."""
+    monkeypatch.setattr(binaries, "runtimes_root", lambda: tmp_path)
+
+    class _Plan:
+        assets = ["a.zip", "b.zip"]
+        backend = "cuda"
+        install_dir = tmp_path / "b1" / "cuda"
+
+    monkeypatch.setattr(binaries, "resolve_assets", lambda tag, backend: _Plan())
+    monkeypatch.setattr(binaries, "verify_install", lambda d, t: "ok")
+
+    def _fake_download(url, dest, progress=None):
+        _make_zip(dest, {"f.bin": 2048})
+        if progress is not None:
+            progress(1024, 2048)
+            progress(2048, 2048)
+
+    monkeypatch.setattr(binaries, "_download", _fake_download)
+
+    events: list[tuple[str, str]] = []
+    binaries.ensure_runtime_installed(
+        "b1", "cuda",
+        progress=lambda stage, d, t, label: events.append((stage, label)))
+
+    stages = [s for s, _ in events]
+    assert "download" in stages and "extract" in stages and "verify" in stages
+    # Two assets -> per-asset labels on the slow stages.
+    assert ("download", "1/2") in events and ("download", "2/2") in events
+    assert ("extract", "1/2") in events and ("extract", "2/2") in events
+    # Stage order per asset: download before extract.
+    assert stages.index("download") < stages.index("extract")
+
+
+def test_progress_hook_translates_stages_to_job_fields():
+    job = _job("quickstart", "Test Model")
+    hook = _runtime_progress_hook(job)
+
+    hook("download", 5 << 20, 100 << 20, "1/2")
+    assert job["phase"] == "downloading-runtime"
+    assert "1/2" in job["detail"]
+    assert job["done_bytes"] == 5 << 20
+    assert job["total_bytes"] == 100 << 20
+
+    # Rapid second tick inside the throttle window is dropped...
+    hook("download", 6 << 20, 100 << 20, "1/2")
+    assert job["done_bytes"] == 5 << 20
+    # ...but a terminal tick (done == total) always lands.
+    hook("download", 100 << 20, 100 << 20, "1/2")
+    assert job["done_bytes"] == 100 << 20
+
+    hook("extract", 10, 100, "")
+    assert job["phase"] in ("downloading-runtime", "unpacking-runtime")
+
+    job2 = _job("runtime-install", "x")
+    hook2 = _runtime_progress_hook(job2)
+    hook2("extract", 100, 100, "")
+    assert job2["phase"] == "unpacking-runtime"
+    hook2("verify", 0, 0, "")
+    assert job2["phase"] == "verifying-runtime"
+    assert job2["total_bytes"] is None  # indeterminate bar, not a stuck 0%
+
+
+def test_progress_hook_accumulates_across_assets(monkeypatch):
+    """A two-asset engine reads as ONE growing download: the second asset's
+    bytes stack on the first's instead of restarting the bar at zero, and
+    unpack/verify leave the finished download's counters standing."""
+    # Drive the throttle's clock so every tick lands (the real hook drops
+    # sub-250ms non-terminal ticks; this test is about arithmetic, not
+    # pacing — pacing has its own assertions above).
+    from hermes_cli.web_routers import local_models as lm
+
+    clock = {"now": 0.0}
+
+    def fake_monotonic():
+        clock["now"] += 1.0
+        return clock["now"]
+
+    monkeypatch.setattr(lm.time, "monotonic", fake_monotonic)
+
+    job = _job("runtime-install", "engine")
+    hook = _runtime_progress_hook(job)
+
+    hook("download", 40 << 20, 40 << 20, "1/2")
+    assert job["done_bytes"] == 40 << 20
+    assert job["total_bytes"] == 40 << 20
+
+    # Second asset starts: counters continue from the first asset's total.
+    hook("download", 0, 60 << 20, "2/2")
+    assert job["done_bytes"] == 40 << 20
+    assert job["total_bytes"] == 100 << 20
+
+    hook("download", 60 << 20, 60 << 20, "2/2")
+    assert job["done_bytes"] == 100 << 20
+    assert job["total_bytes"] == 100 << 20
+
+    # Unpack and verify narrate without rewinding the finished bar.
+    hook("extract", 1, 100, "2/2")
+    assert job["phase"] == "unpacking-runtime"
+    assert job["done_bytes"] == 100 << 20
+    hook("verify", 0, 0, "")
+    assert job["phase"] == "verifying-runtime"
+    assert job["done_bytes"] == 100 << 20
diff --git a/tests/hermes_cli/test_runtime_machine_scope.py b/tests/hermes_cli/test_runtime_machine_scope.py
new file mode 100644
index 0000000000..d58edebaec
--- /dev/null
+++ b/tests/hermes_cli/test_runtime_machine_scope.py
@@ -0,0 +1,82 @@
+"""The managed runtime is machine-scoped, not profile-scoped.
+
+Engine binaries, models, presets, and server state are machine assets: a
+second profile must reuse them, never re-download 20 GB of GGUFs or fight
+the running server for its port. Profile-scoped decisions (default model,
+enabled flag) stay in each profile's config.yaml."""
+
+from __future__ import annotations
+
+import importlib
+
+import pytest
+
+
+@pytest.fixture
+def profile_home(tmp_path, monkeypatch):
+    """A NAMED-profile HERMES_HOME under <root>/profiles/<name>."""
+    root = tmp_path / ".hermes"
+    profile = root / "profiles" / "coder"
+    profile.mkdir(parents=True)
+    monkeypatch.setenv("HERMES_HOME", str(profile))
+    # hermes_constants memoizes root resolution per (native, env) pair;
+    # reload to make the new env authoritative for this test.
+    import hermes_constants
+
+    importlib.reload(hermes_constants)
+    yield root, profile
+    importlib.reload(hermes_constants)
+
+
+def test_models_and_runtimes_resolve_to_the_shared_root(profile_home):
+    root, profile = profile_home
+    import hermes_cli.local_runtime.binaries as binaries
+    import hermes_cli.local_runtime.bootstrap as bootstrap
+
+    models = bootstrap.models_dir()
+    runtimes = binaries.runtimes_root()
+
+    assert models == root / "models", (
+        f"models dir leaked into the profile: {models}")
+    assert runtimes == root / "runtimes" / "llamacpp", (
+        f"runtimes dir leaked into the profile: {runtimes}")
+    assert "profiles" not in models.parts
+    assert "profiles" not in runtimes.parts
+
+
+def test_all_runtime_state_follows_runtimes_root(profile_home):
+    """Presets, window overrides, server state, and the api key all live
+    under runtimes_root() — one resolver, so profile-scoping bugs cannot
+    come back one file at a time."""
+    root, profile = profile_home
+    from hermes_cli.local_runtime.growth import window_overrides_path
+    from hermes_cli.local_runtime.presets import read_preset_decisions
+    import hermes_cli.local_runtime.binaries as binaries
+
+    shared = root / "runtimes" / "llamacpp"
+    assert window_overrides_path() == shared / "window_overrides.json"
+    # read_preset_decisions' default path must be the shared INI: write a
+    # section there and read it back through the default-path branch.
+    shared.mkdir(parents=True, exist_ok=True)
+    (shared / "presets.ini").write_text("[m1]\nctx-size = 65536\n",
+                                        encoding="utf-8")
+    assert "m1" in read_preset_decisions()
+
+
+def test_default_profile_paths_unchanged(tmp_path, monkeypatch):
+    """HERMES_HOME at the root itself (default profile) resolves exactly
+    as before the scoping change — no migration for existing installs."""
+    root = tmp_path / ".hermes"
+    root.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(root))
+    import hermes_constants
+
+    importlib.reload(hermes_constants)
+    try:
+        import hermes_cli.local_runtime.binaries as binaries
+        import hermes_cli.local_runtime.bootstrap as bootstrap
+
+        assert bootstrap.models_dir() == root / "models"
+        assert binaries.runtimes_root() == root / "runtimes" / "llamacpp"
+    finally:
+        importlib.reload(hermes_constants)
diff --git a/tests/hermes_cli/test_serve_mcp_discovery_after_bind.py b/tests/hermes_cli/test_serve_mcp_discovery_after_bind.py
new file mode 100644
index 0000000000..0ae23f019e
--- /dev/null
+++ b/tests/hermes_cli/test_serve_mcp_discovery_after_bind.py
@@ -0,0 +1,70 @@
+"""Desktop `serve` starts background MCP discovery only after the socket binds.
+
+The MCP SDK import (~350ms) used to run on a thread started BEFORE
+web_server was imported, holding the GIL against the main thread's own
+import path and delaying the READY sentinel the Desktop waits on.
+"""
+
+from __future__ import annotations
+
+import logging
+import threading
+
+import hermes_cli.mcp_startup as mcp_startup
+import hermes_cli.web_server as web_server
+from tests.hermes_cli.test_dashboard_auth_gate import _stub_uvicorn_run
+
+
+def _reset_discovery_state(monkeypatch):
+    monkeypatch.setattr(mcp_startup, "_mcp_discovery_started", False)
+    monkeypatch.setattr(mcp_startup, "_mcp_discovery_thread", None)
+    monkeypatch.setattr(mcp_startup, "_mcp_discovery_deferred", None)
+
+
+def test_desktop_serve_arms_mcp_discovery_only_after_ready_sentinel(monkeypatch):
+    _reset_discovery_state(monkeypatch)
+    order: list[str] = []
+    monkeypatch.setattr(
+        mcp_startup,
+        "start_background_mcp_discovery",
+        lambda *, logger, thread_name: order.append("discovery:" + thread_name),
+    )
+    monkeypatch.setattr(web_server, "_write_machine_sentinel_line", lambda line: order.append("sentinel"))
+    _stub_uvicorn_run(monkeypatch)
+
+    web_server.start_server(
+        host="127.0.0.1", port=0, open_browser=False, headless=True,
+        start_mcp_discovery_after_bind=True,
+    )
+    timer = mcp_startup._mcp_discovery_deferred
+    assert order == ["sentinel"] and isinstance(timer, threading.Timer)
+    timer.cancel()
+    # An agent build inside the delay window pulls discovery forward itself.
+    mcp_startup.wait_for_mcp_discovery(timeout=0)
+    assert order == ["sentinel", "discovery:dashboard-mcp-discovery"]
+    assert mcp_startup._mcp_discovery_deferred is None
+
+    # Without the flag (dashboard / non-Desktop serve) start_server does not
+    # start discovery itself — cmd_dashboard's pre-import path still owns it.
+    order.clear()
+    _reset_discovery_state(monkeypatch)
+    web_server.start_server(host="127.0.0.1", port=0, open_browser=False, headless=True)
+    assert order == ["sentinel"] and mcp_startup._mcp_discovery_deferred is None
+
+
+def test_deferred_discovery_fires_once_and_is_idempotent(monkeypatch):
+    _reset_discovery_state(monkeypatch)
+    calls: list[str] = []
+    monkeypatch.setattr(
+        mcp_startup,
+        "start_background_mcp_discovery",
+        lambda *, logger, thread_name: calls.append(thread_name),
+    )
+    log = logging.getLogger("test")
+    mcp_startup.defer_background_mcp_discovery(logger=log, thread_name="t", delay=60)
+    mcp_startup.defer_background_mcp_discovery(logger=log, thread_name="t", delay=60)  # second arm is a no-op
+    first = mcp_startup._mcp_discovery_deferred
+    mcp_startup._start_deferred_mcp_discovery_now()
+    mcp_startup._start_deferred_mcp_discovery_now()
+    assert calls == ["t"]
+    assert first is not None and mcp_startup._mcp_discovery_deferred is None
diff --git a/tests/hermes_cli/test_session_list_reader_disposable.py b/tests/hermes_cli/test_session_list_reader_disposable.py
new file mode 100644
index 0000000000..1109c1b5d8
--- /dev/null
+++ b/tests/hermes_cli/test_session_list_reader_disposable.py
@@ -0,0 +1,96 @@
+"""Read-only session-list opens must stay disposable.
+
+Two properties that a "keep the read-only handle for the process lifetime"
+optimisation silently destroys. Both are asserted against the real
+``_open_session_db_at_path`` read path the sidebar poll uses, because both
+failures are invisible in a unit test that mocks the store.
+
+1. **The store on disk is the truth.** Recovering a corrupt ``state.db``
+   is a file swap (``mv state.db state.db.corrupt-…; cp -a recovered.db
+   state.db``) performed while the backend is stopped, but a poll can also
+   race a restore. A reader pinned to the old inode keeps serving
+   pre-recovery rows forever, so the user "recovers" and still sees the
+   broken list.
+
+2. **Forensic backup must stay reachable.** ``offline_file_access`` refuses
+   raw byte access while ANY tracked connection is registered for the path,
+   because a raw ``close()`` would cancel this process's POSIX advisory locks
+   (howtocorrupt §2.2). ``_backup_db_file`` (the copy taken BEFORE a malformed
+   store is repaired) and ``_db_fingerprint`` (the repair-attempt ledger key)
+   both go through it. A never-closed list reader makes both fail for the rest
+   of the process, so a repair runs without its forensic backup and the
+   ledger degrades to a size-only key.
+"""
+
+from __future__ import annotations
+
+import shutil
+
+from hermes_cli.sqlite_safe_read import LiveConnectionError, offline_file_access
+from hermes_cli.web_server import _open_session_db_at_path
+from hermes_state import SessionDB, _db_fingerprint
+
+
+def _ids(db) -> list:
+    return [row["id"] for row in db.list_sessions_rich(limit=10, compact_rows=True)]
+
+
+def test_poll_observes_a_replaced_state_db(tmp_path):
+    db_path = tmp_path / "state.db"
+    old = SessionDB(db_path=db_path)
+    old.create_session("before-recovery", source="cli")
+    old.close()
+
+    first = _open_session_db_at_path(db_path, read_only=True)
+    try:
+        assert _ids(first) == ["before-recovery"]
+    finally:
+        first.close()
+
+    # `hermes sessions recover` writes a clean database, which the operator
+    # then installs over the corrupt one.
+    recovered = tmp_path / "recovered-state.db"
+    rebuilt = SessionDB(db_path=recovered)
+    rebuilt.create_session("after-recovery", source="cli")
+    rebuilt.close()
+
+    for suffix in ("-wal", "-shm"):
+        sidecar = db_path.with_name(db_path.name + suffix)
+        if sidecar.exists():
+            sidecar.unlink()
+    db_path.unlink()
+    shutil.copy2(recovered, db_path)
+
+    second = _open_session_db_at_path(db_path, read_only=True)
+    try:
+        assert _ids(second) == ["after-recovery"]
+    finally:
+        second.close()
+
+
+def test_poll_leaves_forensic_backup_reachable(tmp_path):
+    db_path = tmp_path / "state.db"
+    writer = SessionDB(db_path=db_path)
+    writer.create_session("s1", source="cli")
+    writer.close()
+
+    baseline = _db_fingerprint(db_path)
+    assert baseline is not None
+
+    poll = _open_session_db_at_path(db_path, read_only=True)
+    try:
+        assert _ids(poll) == ["s1"]
+    finally:
+        poll.close()
+
+    # The raw-copy path a malformed-store repair takes before it touches
+    # anything must still be permitted after the poll.
+    try:
+        with offline_file_access(db_path, what="forensic-backup"):
+            pass
+    except LiveConnectionError as exc:  # pragma: no cover - failure detail
+        raise AssertionError(
+            f"a session-list poll left a tracked connection open: {exc}"
+        ) from exc
+
+    assert _db_fingerprint(db_path) == baseline
diff --git a/tests/hermes_cli/test_session_recovery.py b/tests/hermes_cli/test_session_recovery.py
index 3cabe5a750..42b5db314b 100644
--- a/tests/hermes_cli/test_session_recovery.py
+++ b/tests/hermes_cli/test_session_recovery.py
@@ -648,4 +648,188 @@ def test_partial_recovery_clears_only_unreadable_system_prompt_refs(
         conn.close()
 
 
+def _insert_delivery_obligations(path: Path, rows: list[tuple[object, ...]]) -> None:
+    from gateway.delivery_ledger import _initialize_schema
 
+    conn = sqlite3.connect(str(path), isolation_level=None)
+    try:
+        _initialize_schema(conn)
+        conn.executemany(
+            """INSERT INTO delivery_obligations (
+                obligation_id, session_key, platform, chat_id, thread_id,
+                content, state, attempts, created_at, updated_at,
+                owner_pid, owner_started_at, last_error, adapter_profile
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            rows,
+        )
+    finally:
+        conn.close()
+
+
+def test_recovery_copies_delivery_obligations(tmp_path: Path) -> None:
+    """Owed replies must survive salvage — #100313 lost 6 obligation rows."""
+
+    source = tmp_path / "state.db"
+    output = tmp_path / "recovered.db"
+    _make_source(source)
+    now = 1_720_000_000.0
+    _insert_delivery_obligations(
+        source,
+        [
+            (
+                "ob-pending",
+                "telegram:1:chat-1",
+                "telegram",
+                "chat-1",
+                None,
+                "owed reply",
+                "pending",
+                0,
+                now,
+                now,
+                4242,
+                99,
+                None,
+                "default",
+            ),
+            (
+                "ob-delivered",
+                "telegram:1:chat-1",
+                "telegram",
+                "chat-1",
+                None,
+                "already sent",
+                "delivered",
+                1,
+                now,
+                now + 1,
+                None,
+                None,
+                None,
+                "default",
+            ),
+        ],
+    )
+
+    inspection = inspect_session_database(source, work_dir=tmp_path)
+    assert inspection["tables"]["delivery_obligations"]["available"] is True
+    assert inspection["tables"]["delivery_obligations"]["rows"] == 2
+
+    report = recover_session_database(source, output, work_dir=tmp_path)
+    copied = report["copy"]["delivery_obligations"]
+    assert copied["status"] == "complete"
+    assert copied["copied_rows"] == 2
+    assert report["verification"]["table_counts"]["delivery_obligations"] == 2
+    assert report["complete"] is True
+    assert report["verified"] is True
+    assert report["installed"] is False
+
+    conn = sqlite3.connect(str(output))
+    try:
+        recovered = conn.execute(
+            """SELECT obligation_id, state, content, owner_pid, adapter_profile
+               FROM delivery_obligations ORDER BY obligation_id"""
+        ).fetchall()
+    finally:
+        conn.close()
+    assert recovered == [
+        ("ob-delivered", "delivered", "already sent", None, "default"),
+        ("ob-pending", "pending", "owed reply", 4242, "default"),
+    ]
+
+
+def test_recovery_without_delivery_ledger_is_not_lossy(tmp_path: Path) -> None:
+    """CLI-only stores never created the lazy table; that is not data loss."""
+
+    source = tmp_path / "state.db"
+    output = tmp_path / "recovered.db"
+    _make_source(source)
+
+    report = recover_session_database(source, output, work_dir=tmp_path)
+    assert report["copy"]["delivery_obligations"]["status"] == "missing"
+    assert "delivery_obligations" not in report["verification"]["table_counts"]
+    assert report["complete"] is True
+    assert report["verified"] is True
+
+
+
+
+
+def test_recovery_flags_delivery_obligation_count_mismatch_as_loss(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A source-vs-destination ledger count mismatch must not verify as complete.
+
+    The destination table is created through the registered initializer; a
+    real SQL trigger that silently drops one row stands in for the "rows went
+    missing on the way over" failure the verifier has to catch.
+    """
+
+    from hermes_cli import session_recovery
+
+    source = tmp_path / "state.db"
+    output = tmp_path / "recovered.db"
+    _make_source(source)
+    now = 1_720_000_000.0
+    _insert_delivery_obligations(
+        source,
+        [
+            ("ob-a", "k", "telegram", "chat-1", None, "a", "pending", 0, now, now, None, None, None, "default"),
+            ("ob-b", "k", "telegram", "chat-1", None, "b", "pending", 0, now, now, None, None, None, "default"),
+        ],
+    )
+
+    real_init = session_recovery._AUXILIARY_TABLE_SCHEMAS["delivery_obligations"]
+
+    def lossy_init(conn: sqlite3.Connection) -> None:
+        real_init(conn)
+        conn.execute(
+            """CREATE TRIGGER drop_ob_b BEFORE INSERT ON delivery_obligations
+               WHEN NEW.obligation_id = 'ob-b' BEGIN SELECT RAISE(IGNORE); END"""
+        )
+
+    monkeypatch.setitem(
+        session_recovery._AUXILIARY_TABLE_SCHEMAS, "delivery_obligations", lossy_init
+    )
+
+    report = recover_session_database(source, output, work_dir=tmp_path)
+    assert report["verification"]["table_counts"]["delivery_obligations"] == 1
+    assert report["complete"] is False
+    assert any(
+        "delivery_obligations count is 1, expected 2" in error
+        for error in report["verification"]["errors"]
+    )
+
+
+def test_lost_and_found_direct_copy_creates_lazy_delivery_ledger(tmp_path: Path) -> None:
+    """The .recover lane copies the ledger even though SessionDB never made it."""
+
+    from hermes_cli.session_lost_and_found import _copy_direct_tables
+
+    recovered_source = tmp_path / "lost_and_found.db"
+    now = 1_720_000_000.0
+    _insert_delivery_obligations(
+        recovered_source,
+        [
+            ("ob-1", "k", "telegram", "chat-1", None, "one", "pending", 0, now, now, None, None, None, "default"),
+            ("ob-2", "k", "telegram", "chat-1", None, "two", "failed", 3, now, now, None, None, "boom", "default"),
+        ],
+    )
+    output = tmp_path / "rebuilt.db"
+    SessionDB(db_path=output).close()
+
+    lf_conn = sqlite3.connect(str(recovered_source), isolation_level=None)
+    dest = sqlite3.connect(str(output), isolation_level=None)
+    try:
+        assert not dest.execute(
+            "SELECT 1 FROM sqlite_master WHERE type='table' AND name='delivery_obligations'"
+        ).fetchall()
+        copied = _copy_direct_tables(lf_conn, dest)
+        assert copied["delivery_obligations"] == 2
+        rows = dest.execute(
+            "SELECT obligation_id, state, last_error FROM delivery_obligations ORDER BY obligation_id"
+        ).fetchall()
+    finally:
+        lf_conn.close()
+        dest.close()
+    assert rows == [("ob-1", "pending", None), ("ob-2", "failed", "boom")]
diff --git a/tests/hermes_cli/test_set_config_value.py b/tests/hermes_cli/test_set_config_value.py
index e4c5f8ca15..d83a2af3ca 100644
--- a/tests/hermes_cli/test_set_config_value.py
+++ b/tests/hermes_cli/test_set_config_value.py
@@ -53,6 +53,7 @@ class TestExplicitAllowlist:
         "DISCORD_BOT_TOKEN",
         "SLACK_BOT_TOKEN",
         "SLACK_APP_TOKEN",
+        "API_SERVER_KEY",
     ])
     def test_explicit_key_routes_to_env(self, key, _isolated_hermes_home):
         set_config_value(key, "test-value-123")
diff --git a/tests/hermes_cli/test_setup_blank_slate.py b/tests/hermes_cli/test_setup_blank_slate.py
index b401a2069e..e08d67c8e3 100644
--- a/tests/hermes_cli/test_setup_blank_slate.py
+++ b/tests/hermes_cli/test_setup_blank_slate.py
@@ -53,6 +53,14 @@ class TestBlankSlateMinimalToolsets:
         from tools.registry import registry as _tool_registry
         _entry = _tool_registry.get_entry("vision_analyze")
         monkeypatch.setattr(_entry, "check_fn", lambda: True)
+        # This test pins disabled_toolsets SUBTRACTION, not deferral policy —
+        # assemble with the legacy everything-eager override so the expected
+        # list stays deferral-independent (#97979 defers process_manage by
+        # default, which would swap it for the three bridge tools here).
+        from tools.tool_search import ToolSearchConfig
+        _legacy = ToolSearchConfig.from_raw({"enabled": "on", "defer": []})
+        monkeypatch.setattr("tools.tool_search.load_config", lambda: _legacy)
+        monkeypatch.setattr("tools.tool_search.load_config_readonly", lambda: _legacy)
         from hermes_cli.tools_config import _get_platform_tools
         cfg = {}
         _blank_slate_minimal_toolsets(cfg)
@@ -67,7 +75,7 @@ class TestBlankSlateMinimalToolsets:
         names = sorted(
             {(d.get("function") or {}).get("name") or d.get("name") for d in defs}
         )
-        assert names == ["patch", "process", "read_file", "search_files",
+        assert names == ["patch", "process_manage", "read_file", "search_files",
                          "skill_manage", "skill_view", "skills_list",
                          "terminal", "vision_analyze", "write_file"]
 
diff --git a/tests/hermes_cli/test_setup_telemetry.py b/tests/hermes_cli/test_setup_telemetry.py
index e6ebcb428c..2397524343 100644
--- a/tests/hermes_cli/test_setup_telemetry.py
+++ b/tests/hermes_cli/test_setup_telemetry.py
@@ -25,6 +25,51 @@ def test_setup_telemetry_enables_shared_metrics(monkeypatch):
     assert config["telemetry"]["shared_metrics"]["enabled"] is True
 
 
+def test_disabling_collection_closes_the_send_consent_window(monkeypatch, tmp_path):
+    """`hermes tools` -> disable shared metrics must withdraw send consent.
+
+    The not-enabled branch returned early without recording anything, so the
+    consent window stayed open and re-enabling later would release every
+    package collected in between.
+    """
+    from hermes_cli.observability.shared_metrics import SharedMetricsStore
+    from hermes_cli.observability.shared_metrics_sender import (
+        reconcile_send_consent,
+    )
+    from hermes_cli.sqlite_util import write_txn
+
+    store = SharedMetricsStore(
+        database_path=tmp_path / "m.db", outbox_directory=tmp_path / "o"
+    )
+    monkeypatch.setattr(
+        "hermes_cli.observability.shared_metrics.SharedMetricsStore",
+        lambda *a, **k: store,
+    )
+
+    # The user had consented; now they turn collection off entirely.
+    monkeypatch.setattr(
+        "hermes_cli.setup.prompt_yes_no", lambda _question, default: False
+    )
+    config = {"telemetry": {"shared_metrics": {"enabled": True, "send": True}}}
+    # Consent was granted earlier, so a window is open — that is precisely
+    # the state whose closure must be recorded.
+    with store._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(connection, True)
+
+    setup_telemetry(config)
+
+    assert config["telemetry"]["shared_metrics"]["enabled"] is False
+    assert config["telemetry"]["shared_metrics"]["send"] is False
+    with store._connection() as connection:
+        open_windows = connection.execute(
+            "SELECT COUNT(*) FROM send_consent_windows WHERE closed_at IS NULL"
+        ).fetchone()[0]
+    assert open_windows == 0, (
+        "disabling collection left the send consent window open"
+    )
+
+
 def test_setup_parser_accepts_telemetry_section():
     parser = argparse.ArgumentParser()
     subparsers = parser.add_subparsers(dest="command")
diff --git a/tests/hermes_cli/test_shared_metrics_consent_windows.py b/tests/hermes_cli/test_shared_metrics_consent_windows.py
new file mode 100644
index 0000000000..66b58d5dd3
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_consent_windows.py
@@ -0,0 +1,310 @@
+"""Property tests for the consent-interval model.
+
+Ported from the /tmp validation harness that gated the redesign: every
+scenario here is a defect that actually occurred (rounds 3-5) or a clock
+adversary the day-stamp model could not survive. The v1 and v2 drafts of the
+redesign each FAILED scenarios in this file before shipping — that is the
+harness working, and why these run against the real store and the real
+reconciler rather than a model of them.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from hermes_cli.observability.shared_metrics import SharedMetricsStore
+from hermes_cli.observability.shared_metrics_sender import (
+    CONSENT_GATE_SQL,
+    reconcile_send_consent,
+)
+from hermes_cli.sqlite_util import write_txn
+
+T0 = datetime(2026, 8, 1, tzinfo=timezone.utc)
+
+
+def ts(days=0, hours=0):
+    return (T0 + timedelta(days=days, hours=hours)).isoformat().replace(
+        "+00:00", "Z"
+    )
+
+
+def dt(days=0, hours=0):
+    return T0 + timedelta(days=days, hours=hours)
+
+
+@pytest.fixture
+def store(tmp_path):
+    return SharedMetricsStore(
+        database_path=tmp_path / "m.db", outbox_directory=tmp_path / "o"
+    )
+
+
+def _add(store, pid, start, end):
+    """Store a package the way the generator does: at period end."""
+    with store._connection() as connection:
+        with write_txn(connection):
+            connection.execute(
+                "INSERT INTO package_outbox(package_id, period_start, period_end,"
+                " payload_json, created_at, exported_at) VALUES (?, ?, ?, ?, ?, ?)",
+                (pid, start, end, json.dumps({"package_id": pid}), end, end),
+            )
+            connection.execute(
+                """INSERT INTO consent_marks(name, stamp) VALUES ('data', ?)
+                   ON CONFLICT(name) DO UPDATE SET stamp = MAX(stamp, excluded.stamp)""",
+                (end,),
+            )
+
+
+def _observe(store, send_enabled, when):
+    with store._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(connection, send_enabled, now=when)
+
+
+def _eligible(store):
+    with store._connection() as connection:
+        return sorted(
+            row[0]
+            for row in connection.execute(
+                f"SELECT package_id FROM package_outbox WHERE {CONSENT_GATE_SQL}"
+            )
+        )
+
+
+def _windows(store):
+    with store._connection() as connection:
+        return [
+            tuple(row)
+            for row in connection.execute(
+                "SELECT opened_at, last_confirmed_at, closed_at"
+                " FROM send_consent_windows ORDER BY opened_at"
+            )
+        ]
+
+
+class TestRefusedWindowIsNeverReleased:
+    def test_on_off_on_with_realistic_interleaving(self, store):
+        """Rounds 3 and 5: the refused middle must never transmit, and
+        neither consented era may be lost."""
+        _observe(store, True, dt(0))
+        for n in range(5):
+            _add(store, f"d{n:02d}", ts(days=n), ts(days=n + 1))
+            _observe(store, True, dt(days=n + 1))
+        _observe(store, False, dt(5))
+        for n in range(5, 10):
+            _add(store, f"d{n:02d}", ts(days=n), ts(days=n + 1))
+        _observe(store, True, dt(10))
+        for n in range(10, 15):
+            _add(store, f"d{n:02d}", ts(days=n), ts(days=n + 1))
+            _observe(store, True, dt(days=n + 1))
+
+        eligible = _eligible(store)
+        assert not [p for p in eligible if 5 <= int(p[1:]) < 10], eligible
+        assert [f"d{n:02d}" for n in range(5)] == eligible[:5], (
+            "pre-revocation consented backlog was destroyed"
+        )
+        assert [f"d{n:02d}" for n in range(10, 15)] == eligible[5:], eligible
+
+    def test_hand_edit_with_a_90_day_silent_gap(self, store):
+        """Round 5 D1, strongest form: NOTHING observes the off window.
+
+        The close back-dates to the last confirmed moment, so the unobserved
+        gap is outside every window and fails closed.
+        """
+        _observe(store, True, dt(0))
+        _add(store, "consented", ts(0, 1), ts(0, 2))
+        _observe(store, True, dt(0, 6))
+        for n in range(1, 90, 10):
+            _add(store, f"REFUSED-d{n}", ts(days=n), ts(days=n, hours=1))
+        _observe(store, False, dt(90))   # first observation: boot on day 90
+        _observe(store, True, dt(91))
+        _observe(store, True, dt(92))
+
+        eligible = _eligible(store)
+        assert not [p for p in eligible if p.startswith("REFUSED")], eligible
+        assert "consented" in eligible, (
+            "the confirmed-morning package must survive the reconciliation"
+        )
+
+
+class TestClockAdversaries:
+    def test_forward_poison_then_revoke_releases_nothing(self, store):
+        """Round 6 D1: one glitched-forward sample must not defeat a close.
+
+        Unfixed, the poisoned obs mark dragged last_confirmed_at to 2099, a
+        later revoke stamped closed_at = 2099, and the closed window then
+        CONTAINED every refused period that followed — all 8 refused
+        packages became eligible. The close now clamps to the closing
+        observation's own raw stamp, so an honest clock at revoke time pulls
+        the window back to the true revoke moment.
+        """
+        _observe(store, True, dt(0))
+        _observe(store, True, datetime(2099, 1, 1, tzinfo=timezone.utc))
+        _observe(store, False, dt(1))            # honest clock at revoke
+        for n in range(2, 10):
+            _add(store, f"REFUSED-{n}", ts(days=n), ts(days=n, hours=2))
+
+        leaked = [p for p in _eligible(store) if p.startswith("REFUSED")]
+        assert not leaked, f"poisoned horizon released refused data: {leaked}"
+
+    def test_forward_poison_cannot_wedge_consent_forever(self, store):
+        """The obs-advance cap bounds the damage of one insane sample.
+
+        Uncapped, a 2099 sample would clamp every future window open at
+        2099, suppressing consented data for decades (fail-closed but
+        permanent). Capped, the mark moves at most MAX_OBS_ADVANCE_SECONDS
+        past its previous value, so honest time overtakes it.
+        """
+        from hermes_cli.observability.shared_metrics_sender import (
+            MAX_OBS_ADVANCE_SECONDS,
+        )
+
+        _observe(store, True, dt(0))
+        _observe(store, True, datetime(2099, 1, 1, tzinfo=timezone.utc))
+        with store._connection() as connection:
+            stamp = connection.execute(
+                "SELECT stamp FROM consent_marks WHERE name = 'obs'"
+            ).fetchone()[0]
+        ceiling = ts(days=MAX_OBS_ADVANCE_SECONDS // 86_400)
+        assert stamp <= ceiling, (
+            f"one glitched sample advanced the mark unboundedly: {stamp}"
+        )
+
+        # Consented data from shortly after the cap horizon still flows once
+        # honest observations catch the marks up.
+        horizon_days = MAX_OBS_ADVANCE_SECONDS // 86_400
+        _add(
+            store,
+            "post-glitch",
+            ts(days=horizon_days + 1),
+            ts(days=horizon_days + 1, hours=4),
+        )
+        _observe(store, True, dt(days=horizon_days + 2))
+        assert "post-glitch" in _eligible(store), (
+            "consent wedged after a forward glitch"
+        )
+
+    def test_rollback_at_re_enable_releases_nothing(self, store):
+        """Round 5 D2: the data mark clamps opens above existing packages."""
+        _observe(store, True, dt(0))
+        _observe(store, True, dt(5))
+        _observe(store, False, dt(5))
+        for n in range(1, 4):
+            _add(store, f"REFUSED-{n}", ts(days=5, hours=n), ts(days=5, hours=n + 1))
+        _observe(store, True, dt(-12))   # 12-day rollback at re-enable
+        _observe(store, True, dt(-11))
+
+        during = [p for p in _eligible(store) if p.startswith("REFUSED")]
+        assert not during, f"rollback released refused packages: {during}"
+
+        _observe(store, True, dt(20))    # clock recovers
+        _observe(store, True, dt(21))
+        after = [p for p in _eligible(store) if p.startswith("REFUSED")]
+        assert not after, f"recovery released refused packages: {after}"
+
+    def test_recovery_does_not_wedge_future_sending(self, store):
+        _observe(store, True, dt(0))
+        _observe(store, False, dt(5))
+        _observe(store, True, dt(-12))
+        _observe(store, True, dt(20))
+        _add(store, "post-recovery", ts(21), ts(21, 4))
+        _observe(store, True, dt(22))
+        assert "post-recovery" in _eligible(store)
+
+
+class TestSubDayGranularity:
+    def test_intra_day_refusal_holds_back_the_whole_day_package(self, store):
+        """Round 5 D3: a day package spanning a refused stretch must wait."""
+        _observe(store, True, dt(0))
+        _observe(store, True, dt(10, 9))
+        _observe(store, False, dt(10, 9))
+        _observe(store, True, dt(10, 18))
+        _observe(store, True, dt(11, 2))
+        _add(store, "halfday", ts(10), ts(11))
+        assert "halfday" not in _eligible(store)
+
+
+class TestReconcilerProperties:
+    def test_idempotent_under_replay(self, store):
+        for _ in range(4):
+            _observe(store, True, dt(0))
+        _observe(store, False, dt(2))
+        for _ in range(5):
+            _observe(store, False, dt(3))
+        _observe(store, True, dt(4))
+        for _ in range(3):
+            _observe(store, True, dt(5))
+        assert len(_windows(store)) == 2
+
+    def test_the_observation_mark_is_monotonic(self, store):
+        """A rolled-back clock must never lower the observation high-water.
+
+        Every downstream guarantee leans on this: closes clamp to it via
+        last_confirmed_at, and opens clamp to max(obs, data). Found as a
+        surviving mutant (obs upsert rewritten from MAX to overwrite) —
+        the leak scenarios happen to be covered by the data mark whenever a
+        leakable package exists, but the property itself must hold on its
+        own, not by coincidence of the sibling mark.
+        """
+        _observe(store, True, dt(5))
+        _observe(store, True, dt(0))   # rollback
+        with store._connection() as connection:
+            stamp = connection.execute(
+                "SELECT stamp FROM consent_marks WHERE name = 'obs'"
+            ).fetchone()[0]
+        assert stamp == ts(5), f"obs mark moved backwards: {stamp}"
+
+    def test_the_real_package_writer_advances_the_data_mark(self, store):
+        """Round 6 D2: the harness's _add re-implements the data-mark insert,
+        so deleting the advance from the REAL writer survived 314 tests.
+        This drives the production exporter instead.
+        """
+        from datetime import date, timedelta as _td
+
+        yesterday = (date.today() - _td(days=1)).isoformat()
+        with store._connection() as connection:
+            with write_txn(connection):
+                connection.execute(
+                    "INSERT INTO counter_aggregates("
+                    " period_start, metric_name, hermes_version, os_family,"
+                    " architecture, install_method, dimensions_json, value,"
+                    " packaged_value"
+                    ") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+                    (
+                        yesterday, "hermes.client.active", "0.0.0-test",
+                        "macos", "arm64", "git", "{}", 1, 0,
+                    ),
+                )
+
+        exported = store.create_and_export_package_if_due()
+        assert exported, "the generator was expected to export yesterday's period"
+
+        with store._connection() as connection:
+            row = connection.execute(
+                "SELECT stamp FROM consent_marks WHERE name = 'data'"
+            ).fetchone()
+        assert row is not None and row[0] >= yesterday, (
+            "the production package writer did not advance the data mark"
+        )
+
+    def test_the_gate_is_read_only(self, store):
+        _observe(store, True, dt(0))
+        before = _windows(store)
+        for _ in range(10):
+            _eligible(store)
+        assert _windows(store) == before
+
+    def test_no_window_fails_closed(self, store):
+        _add(store, "orphan", ts(0), ts(1))
+        assert _eligible(store) == []
+
+    def test_fresh_package_waits_one_heartbeat_then_releases(self, store):
+        """The documented latency cost of confirmation-based windows."""
+        _observe(store, True, dt(0))
+        _add(store, "fresh", ts(0, 1), ts(0, 2))
+        assert _eligible(store) == []
+        _observe(store, True, dt(0, 3))
+        assert _eligible(store) == ["fresh"]
diff --git a/tests/hermes_cli/test_shared_metrics_send_config.py b/tests/hermes_cli/test_shared_metrics_send_config.py
new file mode 100644
index 0000000000..2af8958a2b
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_send_config.py
@@ -0,0 +1,165 @@
+"""Tests for shared-metrics send configuration resolution."""
+
+from __future__ import annotations
+
+import logging
+
+import pytest
+
+from hermes_cli.config import DEFAULT_CONFIG
+from hermes_cli.observability.shared_metrics_send_config import (
+    DEFAULT_ENDPOINT,
+    resolve_send_config,
+    reset_warning_latch_for_tests,
+)
+
+
+@pytest.fixture(autouse=True)
+def _reset_latch():
+    reset_warning_latch_for_tests()
+    yield
+    reset_warning_latch_for_tests()
+
+
+def _config(**shared):
+    return {"telemetry": {"shared_metrics": shared}}
+
+
+class TestDefaults:
+    def test_send_is_registered_disabled_by_default(self):
+        shared = DEFAULT_CONFIG["telemetry"]["shared_metrics"]
+        assert shared["enabled"] is False
+        assert shared["send"] is False
+
+    def test_default_endpoint_is_production(self):
+        shared = DEFAULT_CONFIG["telemetry"]["shared_metrics"]
+        assert shared["endpoint"] == DEFAULT_ENDPOINT
+        assert DEFAULT_ENDPOINT.startswith("https://")
+
+    def test_empty_config_sends_nothing(self):
+        resolved = resolve_send_config({})
+        assert resolved.enabled is False
+        assert resolved.send is False
+
+    def test_none_config_is_tolerated(self):
+        assert resolve_send_config(None).send is False
+
+
+class TestSendRequiresCollection:
+    def test_collection_alone_does_not_send(self):
+        resolved = resolve_send_config(_config(enabled=True))
+        assert resolved.enabled is True
+        assert resolved.send is False
+
+    def test_send_with_collection_sends(self):
+        resolved = resolve_send_config(_config(enabled=True, send=True))
+        assert resolved.send is True
+
+    def test_send_without_collection_is_refused(self):
+        resolved = resolve_send_config(_config(enabled=False, send=True))
+        assert resolved.send is False
+        # send must never imply enabled
+        assert resolved.enabled is False
+
+    def test_send_without_collection_logs_an_error(self, caplog):
+        with caplog.at_level(logging.ERROR):
+            resolve_send_config(_config(enabled=False, send=True))
+        errors = [r for r in caplog.records if r.levelno >= logging.ERROR]
+        assert len(errors) == 1
+        assert "enabled is false" in errors[0].getMessage()
+
+    def test_the_error_is_logged_once_per_process(self, caplog):
+        with caplog.at_level(logging.ERROR):
+            for _ in range(5):
+                resolve_send_config(_config(enabled=False, send=True))
+        errors = [r for r in caplog.records if r.levelno >= logging.ERROR]
+        assert len(errors) == 1, "misconfiguration must not spam every hook fire"
+
+
+class TestEndpointPrecedence:
+    def test_config_endpoint_overrides_default(self):
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint="https://example.test/v1")
+        )
+        assert resolved.endpoint == "https://example.test/v1"
+
+    def test_no_environment_variable_can_redirect_telemetry(self, monkeypatch):
+        """A consent hazard: an inherited env var must not silently retarget.
+
+        AGENTS.md also reserves HERMES_* for secrets, not behaviour.
+        """
+        for name in (
+            "HERMES_TELEMETRY_ENDPOINT",
+            "TELEMETRY_ENDPOINT",
+            "HERMES_SHARED_METRICS_ENDPOINT",
+        ):
+            monkeypatch.setenv(name, "https://attacker.test/v1")
+        resolved = resolve_send_config(_config(enabled=True, send=True))
+        assert resolved.endpoint == DEFAULT_ENDPOINT
+
+    def test_blank_endpoint_falls_back_to_production(self):
+        resolved = resolve_send_config(_config(enabled=True, send=True, endpoint="   "))
+        assert resolved.endpoint == DEFAULT_ENDPOINT
+
+    def test_endpoint_is_stripped(self):
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint="  https://staging.test/v1  ")
+        )
+        assert resolved.endpoint == "https://staging.test/v1"
+
+
+class TestTransportSafety:
+    def test_plaintext_endpoint_is_refused(self, caplog):
+        with caplog.at_level(logging.ERROR):
+            resolved = resolve_send_config(
+                _config(enabled=True, send=True, endpoint="http://example.test/v1")
+            )
+        assert resolved.send is False, "telemetry must not go out in clear text"
+        assert any("https" in r.getMessage() for r in caplog.records)
+
+    @pytest.mark.parametrize(
+        "endpoint",
+        [
+            "http://localhost:8099/v1/telemetry",
+            "http://127.0.0.1:8099/v1/telemetry",
+        ],
+    )
+    def test_loopback_http_is_allowed_for_testing(self, endpoint):
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint=endpoint)
+        )
+        assert resolved.send is True
+
+    def test_nonsense_scheme_is_refused(self):
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint="ftp://example.test/v1")
+        )
+        assert resolved.send is False
+
+    @pytest.mark.parametrize(
+        "endpoint",
+        [
+            "ftp://localhost/v1/telemetry",
+            "gopher://localhost/v1/telemetry",
+            "ws://127.0.0.1/v1/telemetry",
+        ],
+    )
+    def test_a_non_http_scheme_on_loopback_is_still_refused(self, endpoint):
+        """The scheme is allowlisted, not merely checked for plaintext http.
+
+        Gap found by mutation testing: replacing the `http` scheme test with
+        `if True` survived the whole suite, because every non-http scheme case
+        pointed at a REMOTE host, where the loopback branch rejects it anyway.
+        Only a non-http scheme aimed at loopback distinguishes an allowlist
+        from a plaintext-only check.
+        """
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint=endpoint)
+        )
+        assert resolved.send is False
+
+    def test_unsafe_endpoint_does_not_block_collection(self):
+        resolved = resolve_send_config(
+            _config(enabled=True, send=True, endpoint="http://example.test/v1")
+        )
+        assert resolved.enabled is True
diff --git a/tests/hermes_cli/test_shared_metrics_send_migration.py b/tests/hermes_cli/test_shared_metrics_send_migration.py
new file mode 100644
index 0000000000..54518c644a
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_send_migration.py
@@ -0,0 +1,224 @@
+"""Tests for the additive send-state migration on ``package_outbox``.
+
+The store schema version must NOT move when these columns are added: the
+existing loader raises on any version it does not recognise, so bumping it
+would hard-fail an older Hermes (a second profile on an older build, or a
+rollback) against the same database file.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+
+import pytest
+
+from hermes_cli.observability.shared_metrics import SharedMetricsStore
+
+SEND_COLUMNS = {
+    "sent_at",
+    "send_state",
+    "send_attempts",
+    "next_attempt_at",
+    "last_error",
+    "sent_install_id",
+}
+
+
+def _columns(db_path):
+    connection = sqlite3.connect(db_path)
+    try:
+        return {row[1] for row in connection.execute("PRAGMA table_info(package_outbox)")}
+    finally:
+        connection.close()
+
+
+def _schema_version(db_path):
+    connection = sqlite3.connect(db_path)
+    try:
+        row = connection.execute(
+            "SELECT value FROM telemetry_state WHERE key = 'schema_version'"
+        ).fetchone()
+        return row[0] if row else None
+    finally:
+        connection.close()
+
+
+@pytest.fixture
+def store(tmp_path):
+    return SharedMetricsStore(
+        database_path=tmp_path / "metrics.sqlite3",
+        outbox_directory=tmp_path / "outbox",
+    )
+
+
+class TestFreshDatabase:
+    def test_send_columns_exist(self, store):
+        assert SEND_COLUMNS <= _columns(store.database_path)
+
+    def test_original_columns_survive(self, store):
+        assert {
+            "package_id",
+            "period_start",
+            "period_end",
+            "payload_json",
+            "created_at",
+            "exported_at",
+        } <= _columns(store.database_path)
+
+    def test_send_attempts_defaults_to_zero(self, store):
+        connection = sqlite3.connect(store.database_path)
+        try:
+            connection.execute(
+                """
+                INSERT INTO package_outbox(
+                    package_id, period_start, period_end, payload_json, created_at
+                ) VALUES ('p', '2026-01-01', '2026-01-02', '{}', '2026-01-01T00:00:00Z')
+                """
+            )
+            connection.commit()
+            row = connection.execute(
+                "SELECT send_attempts, send_state, sent_install_id FROM package_outbox"
+            ).fetchone()
+        finally:
+            connection.close()
+        assert row[0] == 0
+        assert row[1] is None
+        assert row[2] is None
+
+
+class TestUpgradeFromPreSendDatabase:
+    """The real-world case: a database written before this feature existed."""
+
+    @pytest.fixture
+    def legacy_db(self, tmp_path):
+        path = tmp_path / "metrics.sqlite3"
+        connection = sqlite3.connect(path)
+        try:
+            connection.execute(
+                """
+                CREATE TABLE telemetry_state (
+                    key TEXT PRIMARY KEY,
+                    value TEXT NOT NULL
+                )
+                """
+            )
+            connection.execute(
+                "INSERT INTO telemetry_state(key, value) VALUES ('schema_version', '2')"
+            )
+            connection.execute(
+                """
+                CREATE TABLE package_outbox (
+                    package_id TEXT PRIMARY KEY,
+                    period_start TEXT NOT NULL,
+                    period_end TEXT NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    exported_at TEXT
+                )
+                """
+            )
+            connection.execute(
+                """
+                CREATE TABLE counter_aggregates (
+                    period_start TEXT NOT NULL,
+                    metric_name TEXT NOT NULL,
+                    hermes_version TEXT NOT NULL,
+                    os_family TEXT NOT NULL,
+                    architecture TEXT NOT NULL,
+                    install_method TEXT NOT NULL,
+                    dimensions_json TEXT NOT NULL,
+                    value INTEGER NOT NULL,
+                    packaged_value INTEGER NOT NULL,
+                    PRIMARY KEY (
+                        period_start, metric_name, hermes_version, os_family,
+                        architecture, install_method, dimensions_json
+                    )
+                )
+                """
+            )
+            for i in range(3):
+                connection.execute(
+                    """
+                    INSERT INTO package_outbox(
+                        package_id, period_start, period_end, payload_json,
+                        created_at, exported_at
+                    ) VALUES (?, ?, ?, ?, ?, ?)
+                    """,
+                    (
+                        f"pkg-{i}",
+                        "2026-08-2%d" % i,
+                        "2026-08-2%d" % (i + 1),
+                        json.dumps({"package_id": f"pkg-{i}"}),
+                        "2026-08-2%dT00:00:00Z" % i,
+                        "2026-08-2%dT01:00:00Z" % i,
+                    ),
+                )
+            connection.commit()
+        finally:
+            connection.close()
+        return path
+
+    def test_upgrade_preserves_every_row(self, legacy_db, tmp_path):
+        SharedMetricsStore(
+            database_path=legacy_db, outbox_directory=tmp_path / "outbox"
+        )
+        connection = sqlite3.connect(legacy_db)
+        try:
+            count = connection.execute("SELECT COUNT(*) FROM package_outbox").fetchone()[0]
+            payloads = connection.execute(
+                "SELECT package_id, payload_json FROM package_outbox ORDER BY package_id"
+            ).fetchall()
+        finally:
+            connection.close()
+        assert count == 3
+        assert payloads == [
+            ("pkg-0", '{"package_id": "pkg-0"}'),
+            ("pkg-1", '{"package_id": "pkg-1"}'),
+            ("pkg-2", '{"package_id": "pkg-2"}'),
+        ]
+
+    def test_upgrade_adds_the_send_columns(self, legacy_db, tmp_path):
+        SharedMetricsStore(
+            database_path=legacy_db, outbox_directory=tmp_path / "outbox"
+        )
+        assert SEND_COLUMNS <= _columns(legacy_db)
+
+    def test_upgrade_does_not_move_the_schema_version(self, legacy_db, tmp_path):
+        """Bumping would make older builds refuse the same file."""
+        SharedMetricsStore(
+            database_path=legacy_db, outbox_directory=tmp_path / "outbox"
+        )
+        assert _schema_version(legacy_db) == "2"
+
+    def test_migration_is_idempotent(self, legacy_db, tmp_path):
+        for _ in range(3):
+            SharedMetricsStore(
+                database_path=legacy_db, outbox_directory=tmp_path / "outbox"
+            )
+        columns = [
+            row[1]
+            for row in sqlite3.connect(legacy_db).execute(
+                "PRAGMA table_info(package_outbox)"
+            )
+        ]
+        assert len(columns) == len(set(columns)), "columns were added more than once"
+
+    def test_queries_written_before_this_change_still_work(self, legacy_db, tmp_path):
+        """The shipped export query selects named columns; it must be unaffected."""
+        SharedMetricsStore(
+            database_path=legacy_db, outbox_directory=tmp_path / "outbox"
+        )
+        connection = sqlite3.connect(legacy_db)
+        try:
+            rows = connection.execute(
+                """
+                SELECT package_id, payload_json
+                FROM package_outbox
+                WHERE exported_at IS NULL
+                ORDER BY created_at, package_id
+                """
+            ).fetchall()
+        finally:
+            connection.close()
+        assert rows == []
diff --git a/tests/hermes_cli/test_shared_metrics_send_wiring.py b/tests/hermes_cli/test_shared_metrics_send_wiring.py
new file mode 100644
index 0000000000..29f572c697
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_send_wiring.py
@@ -0,0 +1,446 @@
+"""Tests for wiring the sender into the shared-metrics export hook.
+
+The properties that matter here are negative ones: the interactive path must
+not block, and nothing must leave the machine unless the user opted in.
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+
+import pytest
+
+from hermes_cli.observability import relay_shared_metrics as mod
+
+
+class FakeStore:
+    def __init__(self):
+        self.exported = 0
+
+    def create_and_export_package_if_due(self):
+        self.exported += 1
+        return []
+
+
+class RealBackedStore:
+    """A store with a genuine SQLite connection, for consent-state tests.
+
+    The consent edge detector writes to telemetry_state, and it is wrapped in
+    a broad except. Against a stub without _connection it would swallow an
+    AttributeError and silently do nothing — which is exactly the failure this
+    file needs to be able to catch.
+    """
+
+    def __init__(self, tmp_path):
+        from hermes_cli.observability.shared_metrics import SharedMetricsStore
+
+        self._real = SharedMetricsStore(
+            database_path=tmp_path / "m.db", outbox_directory=tmp_path / "o"
+        )
+        self.exported = 0
+
+    def _connection(self):
+        return self._real._connection()
+
+    def create_and_export_package_if_due(self):
+        self.exported += 1
+        return []
+
+
+class FakeSubscriber:
+    def __init__(self):
+        self.store = FakeStore()
+
+
+class Runtime(mod._Runtime):
+    """A _Runtime with the relay host stubbed out."""
+
+    def __init__(self):
+        self._sessions_lock = threading.RLock()
+        self._sessions = {}
+        self._task_creation_lock = threading.RLock()
+        self._task_sessions_lock = threading.RLock()
+        self._send_lock = threading.RLock()
+        self._send_thread = None
+        self._task_sessions = {}
+        self._turn_sessions = {}
+        self.subscriber = FakeSubscriber()
+
+
+@pytest.fixture
+def runtime():
+    return Runtime()
+
+
+def _config(**shared):
+    return {"telemetry": {"shared_metrics": shared}}
+
+
+@pytest.fixture
+def capture_sender(monkeypatch):
+    """Replace the sender with a recorder and return the record."""
+    record = {"passes": [], "endpoints": []}
+
+    class FakeSender:
+        def __init__(self, store, endpoint, **kwargs):
+            record["endpoints"].append(endpoint)
+
+        def send_pending(self):
+            record["passes"].append(time.time())
+
+    monkeypatch.setattr(
+        "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+        FakeSender,
+    )
+    return record
+
+
+def _set_config(monkeypatch, config):
+    monkeypatch.setattr(
+        "hermes_cli.config.read_raw_config_readonly", lambda: config, raising=False
+    )
+
+
+class TestOptIn:
+    def test_no_send_when_nothing_is_configured(self, runtime, monkeypatch, capture_sender):
+        _set_config(monkeypatch, {})
+        runtime._export()
+        runtime._join_send_thread(timeout=1)
+        assert capture_sender["passes"] == []
+
+    def test_no_send_when_only_collection_is_on(self, runtime, monkeypatch, capture_sender):
+        _set_config(monkeypatch, _config(enabled=True))
+        runtime._export()
+        runtime._join_send_thread(timeout=1)
+        assert capture_sender["passes"] == []
+
+    def test_no_send_when_send_is_on_without_collection(
+        self, runtime, monkeypatch, capture_sender
+    ):
+        _set_config(monkeypatch, _config(enabled=False, send=True))
+        runtime._export()
+        runtime._join_send_thread(timeout=1)
+        assert capture_sender["passes"] == []
+
+    def test_sends_when_both_are_on(self, runtime, monkeypatch, capture_sender):
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._export()
+        runtime._join_send_thread(timeout=2)
+        assert len(capture_sender["passes"]) == 1
+
+    def test_uses_the_resolved_endpoint(self, runtime, monkeypatch, capture_sender):
+        _set_config(
+            monkeypatch,
+            _config(enabled=True, send=True, endpoint="https://staging.test/v1"),
+        )
+        runtime._export()
+        runtime._join_send_thread(timeout=2)
+        assert capture_sender["endpoints"] == ["https://staging.test/v1"]
+
+    def test_export_still_runs_when_sending_is_off(self, runtime, monkeypatch, capture_sender):
+        _set_config(monkeypatch, _config(enabled=True))
+        runtime._export()
+        assert runtime.subscriber.store.exported == 1
+
+
+class TestInteractivePathIsNotBlocked:
+    def test_export_returns_before_the_send_finishes(
+        self, runtime, monkeypatch
+    ):
+        started = threading.Event()
+        release = threading.Event()
+
+        class SlowSender:
+            def __init__(self, store, endpoint, **kwargs):
+                pass
+
+            def send_pending(self):
+                started.set()
+                release.wait(5)
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+            SlowSender,
+        )
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+
+        began = time.monotonic()
+        runtime._export()
+        elapsed = time.monotonic() - began
+
+        assert started.wait(2), "the send should have started"
+        assert elapsed < 1.0, "finish_task must not wait on the network"
+        release.set()
+        runtime._join_send_thread(timeout=5)
+
+    def test_the_send_thread_is_a_daemon(self, runtime, monkeypatch, capture_sender):
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._export()
+        with runtime._send_lock:
+            thread = runtime._send_thread
+        assert thread is not None
+        assert thread.daemon, "an unfinished send must not hold the process open"
+        runtime._join_send_thread(timeout=2)
+
+    def test_only_one_pass_runs_at_a_time(self, runtime, monkeypatch):
+        release = threading.Event()
+        starts = []
+
+        class SlowSender:
+            def __init__(self, store, endpoint, **kwargs):
+                pass
+
+            def send_pending(self):
+                starts.append(1)
+                release.wait(5)
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+            SlowSender,
+        )
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+
+        for _ in range(5):
+            runtime._export()
+        time.sleep(0.2)
+        assert len(starts) == 1, "hook fires must not pile up send passes"
+        release.set()
+        runtime._join_send_thread(timeout=5)
+
+
+class TestConsentWindows:
+    """Consent reconciliation must work from the relay, in any order.
+
+    Round 4's edge detector missed the idle-revocation path; round 5 found it
+    was also dead code whenever collection was off (handles_hook gated it).
+    These tests drive the relay entry points against the single reconciler
+    and assert on the interval table — the only consent state that exists.
+    """
+
+    def _runtime(self, tmp_path):
+        runtime = Runtime()
+        runtime.subscriber.store = RealBackedStore(tmp_path)
+        return runtime
+
+    def _windows(self, runtime):
+        with runtime.subscriber.store._connection() as connection:
+            return [
+                tuple(row)
+                for row in connection.execute(
+                    "SELECT opened_at, last_confirmed_at, closed_at"
+                    " FROM send_consent_windows ORDER BY opened_at"
+                )
+            ]
+
+    def test_revoking_while_idle_closes_the_window(
+        self, monkeypatch, tmp_path, capture_sender
+    ):
+        runtime = self._runtime(tmp_path)
+
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._send_exported_packages()
+
+        # User edits config.yaml: send: false. Hooks keep firing normally.
+        _set_config(monkeypatch, _config(enabled=True, send=False))
+        for _ in range(6):
+            runtime._send_exported_packages()
+
+        windows = self._windows(runtime)
+        assert windows and all(w[2] is not None for w in windows), (
+            f"revoking while idle left a window open: {windows}"
+        )
+
+    def test_replayed_observations_create_no_junk_windows(
+        self, monkeypatch, tmp_path, capture_sender
+    ):
+        """Reconciliation is idempotent — there is no edge to double-count."""
+        runtime = self._runtime(tmp_path)
+
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        for _ in range(4):
+            runtime._send_exported_packages()
+        _set_config(monkeypatch, _config(enabled=True, send=False))
+        for _ in range(4):
+            runtime._send_exported_packages()
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        for _ in range(4):
+            runtime._send_exported_packages()
+
+        assert len(self._windows(runtime)) == 2
+
+    def test_a_never_consented_user_gets_no_window(
+        self, monkeypatch, tmp_path, capture_sender
+    ):
+        runtime = self._runtime(tmp_path)
+        _set_config(monkeypatch, _config(enabled=True, send=False))
+        for _ in range(5):
+            runtime._send_exported_packages()
+
+        assert self._windows(runtime) == []
+
+    def test_re_enabling_opens_a_new_window_after_the_refusal(
+        self, monkeypatch, tmp_path, capture_sender
+    ):
+        """The refused gap must fall BETWEEN the two windows."""
+        runtime = self._runtime(tmp_path)
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._send_exported_packages()
+        _set_config(monkeypatch, _config(enabled=True, send=False))
+        runtime._send_exported_packages()
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._send_exported_packages()
+
+        windows = self._windows(runtime)
+        assert len(windows) == 2
+        first, second = windows
+        assert first[2] is not None, "first window must be closed"
+        assert second[2] is None, "second window must be open"
+        assert second[0] >= first[2], (
+            f"new window may not overlap the refused gap: {windows}"
+        )
+
+    def test_reconcile_runs_even_when_collection_is_disabled(
+        self, monkeypatch, tmp_path
+    ):
+        """Round-5 D1: enabled:false must not make consent handling dead code.
+
+        The module-level once-per-process reconciler must close the window
+        regardless of handles_hook(). Drives the real observe_lifecycle gate
+        path: handles_hook is False throughout.
+        """
+        from hermes_cli.observability.shared_metrics import SharedMetricsStore
+        from hermes_cli.observability.shared_metrics_sender import (
+            reconcile_send_consent,
+        )
+        from hermes_cli.sqlite_util import write_txn
+
+        # Lay the store out exactly as production does, under a redirected
+        # HERMES_HOME: the boot reconciler probes the default path (without
+        # constructing the store — the constructor creates directories), so
+        # the probe and the store must agree the way they do in production.
+        home = tmp_path / "home"
+        monkeypatch.setattr(
+            "hermes_constants.get_hermes_home", lambda: home
+        )
+        root = home / "telemetry" / "shared_metrics"
+        store = SharedMetricsStore(
+            database_path=root / "metrics.sqlite3",
+            outbox_directory=root / "outbox",
+        )
+        # A consent window is open from an earlier consented era.
+        with store._connection() as connection:
+            with write_txn(connection):
+                reconcile_send_consent(connection, True)
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics.SharedMetricsStore",
+            lambda *a, **k: store,
+        )
+        _set_config(monkeypatch, _config(enabled=False, send=False))
+        monkeypatch.setattr(mod, "_consent_reconcile_done", False)
+
+        # The full lifecycle entry point, with collection OFF.
+        mod.observe_lifecycle("finish_task")
+
+        with store._connection() as connection:
+            open_windows = connection.execute(
+                "SELECT COUNT(*) FROM send_consent_windows WHERE closed_at IS NULL"
+            ).fetchone()[0]
+        assert open_windows == 0, (
+            "enabled:false made the consent reconciler unreachable (D1)"
+        )
+
+
+
+class TestFailureIsolation:
+    def test_a_sender_crash_does_not_propagate(self, runtime, monkeypatch):
+        class Exploding:
+            def __init__(self, store, endpoint, **kwargs):
+                pass
+
+            def send_pending(self):
+                raise RuntimeError("boom")
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+            Exploding,
+        )
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+        runtime._export()  # must not raise
+        runtime._join_send_thread(timeout=2)
+
+    def test_an_unreadable_config_does_not_break_export(self, runtime, monkeypatch, capture_sender):
+        def explode():
+            raise OSError("config unreadable")
+
+        monkeypatch.setattr(
+            "hermes_cli.config.read_raw_config_readonly", explode, raising=False
+        )
+        runtime._export()
+        assert runtime.subscriber.store.exported == 1
+        assert capture_sender["passes"] == []
+
+    def test_join_is_safe_with_no_thread(self, runtime):
+        runtime._join_send_thread(timeout=0.1)
+
+    def test_join_waits_for_an_in_flight_send(self, runtime, monkeypatch):
+        """shutdown() must give a started send a chance to finish.
+
+        A short-lived CLI exits straight after its final export; without the
+        join the daemon thread is killed mid-request, and the hook path is the
+        only delivery cadence this feature has.
+        """
+        finished = []
+        release = threading.Event()
+
+        class SlowSender:
+            def __init__(self, store, endpoint, **kwargs):
+                pass
+
+            def send_pending(self):
+                release.wait(3)
+                finished.append(True)
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+            SlowSender,
+        )
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+
+        runtime._export()
+        release.set()
+        runtime._join_send_thread(timeout=3)
+        assert finished == [True]
+
+    def test_shutdown_joins_the_send_thread(self, monkeypatch):
+        """shutdown() must actually wait, not merely mention the join.
+
+        Behavioural, not a source grep: an earlier version of this test
+        inspected getsource for a method name, which AGENTS.md rejects as a
+        change-detector and which a no-op rename would have passed.
+        """
+        runtime = Runtime()
+        released = threading.Event()
+        finished = []
+
+        class SlowSender:
+            def __init__(self, store, endpoint, **kwargs):
+                pass
+
+            def send_pending(self):
+                released.wait(3)
+                finished.append(True)
+
+        monkeypatch.setattr(
+            "hermes_cli.observability.shared_metrics_sender.SharedMetricsSender",
+            SlowSender,
+        )
+        _set_config(monkeypatch, _config(enabled=True, send=True))
+
+        # Stand in for the parts of shutdown() that need a live relay.
+        runtime._export()
+        assert runtime._send_thread is not None
+        released.set()
+        runtime._join_send_thread()
+        assert finished == [True], "shutdown returned while a send was in flight"
diff --git a/tests/hermes_cli/test_shared_metrics_sender.py b/tests/hermes_cli/test_shared_metrics_sender.py
new file mode 100644
index 0000000000..cbaff4c9ea
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_sender.py
@@ -0,0 +1,1029 @@
+"""Tests for the shared-metrics sender.
+
+Covers the four contract responses, the period-based consent gate, frozen
+identity across rotation, transactional claiming, and the invariant that
+matters most: a package file is never deleted, because the outbox is the
+user's local history rather than a send queue.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from hermes_cli.observability.shared_metrics import SharedMetricsStore
+from hermes_cli.observability.shared_metrics_sender import (
+    MAX_ATTEMPTS,
+    MAX_PACKAGES_PER_PASS,
+    MAX_SEND_ATTEMPTS,
+    REQUEST_TIMEOUT_SECONDS,
+    SharedMetricsSender,
+    reconcile_send_consent,
+)
+from hermes_cli.sqlite_util import write_txn
+
+INSTALL_ID = "12a73e97-4de9-4766-830d-9ca1192c0420"
+NOW = datetime(2026, 8, 26, 12, 0, tzinfo=timezone.utc)
+ENDPOINT = "https://telemetry.test/v1/telemetry"
+
+
+class FakeResponse:
+    def __init__(self, status, retry_after=None, body=""):
+        self.status = status
+        self.retry_after = retry_after
+        self.body = body
+
+
+class FakeTransport:
+    """Records every POST and replays a scripted sequence of responses."""
+
+    def __init__(self, *responses):
+        self._responses = list(responses)
+        self.calls = []
+
+    def __call__(self, endpoint, payload, *, timeout):
+        self.calls.append({"endpoint": endpoint, "payload": payload, "timeout": timeout})
+        if not self._responses:
+            return FakeResponse(202)
+        item = self._responses.pop(0)
+        if isinstance(item, Exception):
+            raise item
+        return item
+
+    @property
+    def bodies(self):
+        return [json.loads(c["payload"].decode("utf-8")) for c in self.calls]
+
+
+@pytest.fixture
+def store(tmp_path):
+    """A store with a broad consent window already open.
+
+    Most tests exercise claiming/retry/transport, not the consent gate, and
+    the interval gate fails closed with no window. One window opened before
+    every test package and confirmed well past NOW keeps those tests about
+    what they are about. Gate tests clear it via _clear_consent.
+    """
+    built = SharedMetricsStore(
+        database_path=tmp_path / "metrics.sqlite3",
+        outbox_directory=tmp_path / "outbox",
+    )
+    _grant_consent(built)
+    return built
+
+
+def _grant_consent(
+    store,
+    opened=datetime(2026, 8, 20, tzinfo=timezone.utc),
+    confirmed_through=datetime(2026, 10, 1, tzinfo=timezone.utc),
+):
+    """Open a consent window and heartbeat it forward, via the real writer."""
+    with store._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(connection, True, now=opened)
+            reconcile_send_consent(connection, True, now=confirmed_through)
+
+
+def _revoke_consent(store, at):
+    with store._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(connection, False, now=at)
+
+
+def _clear_consent(store):
+    """Remove all consent state, for tests of the fail-closed default."""
+    with store._connection() as connection:
+        with write_txn(connection):
+            connection.execute("DELETE FROM send_consent_windows")
+            connection.execute("DELETE FROM consent_marks")
+
+
+def _add_package(store, package_id, period_day, *, exported=True, install_id=INSTALL_ID):
+    payload = {
+        "schema_version": "hermes.shared_metrics.v2",
+        "package_id": package_id,
+        "install_id": install_id,
+        "period_start": f"{period_day}T00:00:00Z",
+        "period_end": f"{period_day}T23:59:59Z",
+        "metrics": [{"name": "hermes.client.active", "type": "counter", "value": 1}],
+    }
+    with store._connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO package_outbox(
+                package_id, period_start, period_end, payload_json,
+                created_at, exported_at
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            """,
+            (
+                package_id,
+                f"{period_day}T00:00:00Z",
+                f"{period_day}T23:59:59Z",
+                json.dumps(payload),
+                f"{period_day}T01:00:00Z",
+                f"{period_day}T01:00:01Z" if exported else None,
+            ),
+        )
+    path = store.outbox_directory / f"{package_id}.json"
+    path.write_text(json.dumps(payload, indent=2, sort_keys=True))
+    return path
+
+
+def _row(store, package_id):
+    with store._connection() as connection:
+        row = connection.execute(
+            """
+            SELECT send_state, sent_at, send_attempts, next_attempt_at,
+                   last_error, sent_install_id
+            FROM package_outbox WHERE package_id = ?
+            """,
+            (package_id,),
+        ).fetchone()
+    return dict(
+        send_state=row[0],
+        sent_at=row[1],
+        send_attempts=row[2],
+        next_attempt_at=row[3],
+        last_error=row[4],
+        sent_install_id=row[5],
+    )
+
+
+def _iso(moment):
+    return moment.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _sender(store, transport, **kwargs):
+    return SharedMetricsSender(
+        store,
+        ENDPOINT,
+        post=transport,
+        sleep=lambda _s: None,
+        now=lambda: NOW,
+        **kwargs,
+    )
+
+
+class TestContractResponses:
+    def test_202_marks_sent(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(202))
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.sent == 1
+        row = _row(store, "pkg-1")
+        assert row["send_state"] == "sent"
+        assert row["sent_at"] is not None
+
+    def test_400_is_permanent_and_never_retried(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(400, body='{"error":"invalid_envelope"}'))
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.rejected == 1
+        assert len(transport.calls) == 1, "a 400 must not be retried"
+        assert _row(store, "pkg-1")["send_state"] == "rejected"
+
+        # A later pass must not pick it up again.
+        transport2 = FakeTransport(FakeResponse(202))
+        _sender(store, transport2).send_pending()
+        assert transport2.calls == []
+
+    @pytest.mark.parametrize("status", [401, 403, 404, 422, 500, 503])
+    def test_unspecified_statuses_are_retried_not_discarded(self, store, status):
+        """403 is the ingest origin guard; a bad edge config must not lose data."""
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(*[FakeResponse(status)] * 3)
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.deferred == 1
+        assert _row(store, "pkg-1")["send_state"] == "pending"
+
+    def test_413_is_permanent(self, store):
+        """A package over the 1 MiB cap cannot shrink by being retried."""
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(413))
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.rejected == 1
+        assert len(transport.calls) == 1
+
+    def test_429_defers_using_retry_after(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(429, retry_after="120"))
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.deferred == 1
+        assert len(transport.calls) == 1, "429 waits rather than burning attempts"
+        row = _row(store, "pkg-1")
+        assert row["send_state"] == "pending"
+        assert row["next_attempt_at"] == "2026-08-26T12:02:00Z"
+
+    def test_429_without_retry_after_still_defers(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(429))
+        _sender(store, transport).send_pending()
+        assert _row(store, "pkg-1")["next_attempt_at"] > "2026-08-26T12:00:00Z"
+
+    def test_absurd_retry_after_is_clamped(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(429, retry_after="99999999"))
+        _sender(store, transport).send_pending()
+        # clamped to 24h, not years
+        assert _row(store, "pkg-1")["next_attempt_at"] <= "2026-08-27T12:00:00Z"
+
+    def test_5xx_retries_then_defers(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(
+            FakeResponse(503), FakeResponse(503), FakeResponse(503)
+        )
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.deferred == 1
+        assert len(transport.calls) == 3, "three in-process attempts"
+        assert _row(store, "pkg-1")["send_state"] == "pending"
+
+    def test_5xx_then_success_within_the_same_pass(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(503), FakeResponse(202))
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.sent == 1
+        assert len(transport.calls) == 2
+
+    def test_transport_failure_is_retryable(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(
+            OSError("offline"), OSError("offline"), FakeResponse(202)
+        )
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.sent == 1
+
+    def test_persistent_offline_defers_without_raising(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(*[OSError("offline")] * 3)
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.deferred == 1
+        assert "OSError" in _row(store, "pkg-1")["last_error"]
+
+
+class TestConsentGate:
+    def test_packages_from_before_opt_in_are_never_sent(self, store):
+        # Consent opens on Aug 24; the "old" package's period predates it.
+        _clear_consent(store)
+        _grant_consent(store, opened=datetime(2026, 8, 24, tzinfo=timezone.utc))
+        _add_package(store, "old", "2026-08-20")
+        _add_package(store, "new", "2026-08-26")
+        transport = FakeTransport(FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert [b["package_id"] for b in transport.bodies] == ["new"]
+
+    def test_a_period_straddling_opt_in_day_is_sent_whole(self, store):
+        """The head/tail bug: both packages for the opt-in period must go."""
+        _add_package(store, "head", "2026-08-26")
+        _add_package(store, "tail", "2026-08-26")  # created later, same period
+        transport = FakeTransport(FakeResponse(202), FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert sorted(b["package_id"] for b in transport.bodies) == ["head", "tail"]
+
+    def test_opt_in_is_immortalised_as_a_window_not_a_day(self, store):
+        """The window survives replayed observations without moving."""
+        with store._connection() as connection:
+            rows = connection.execute(
+                "SELECT opened_at, closed_at FROM send_consent_windows"
+            ).fetchall()
+        assert len(rows) == 1 and rows[0][1] is None
+        _grant_consent(store)  # replay: must not create a second window
+        with store._connection() as connection:
+            count = connection.execute(
+                "SELECT COUNT(*) FROM send_consent_windows"
+            ).fetchone()[0]
+        assert count == 1
+
+    def test_no_consent_window_means_nothing_is_sent(self, store):
+        """The gate fails closed: absence of a window is absence of consent."""
+        _clear_consent(store)
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert transport.calls == []
+
+    def test_unexported_packages_are_skipped(self, store):
+        _add_package(store, "pending-export", "2026-08-26", exported=False)
+        transport = FakeTransport(FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert transport.calls == []
+
+    def test_revoking_then_re_enabling_never_releases_the_off_window(self, store):
+        """The R3/R5 leak: re-opt-in must not release the refused interval.
+
+        Under the interval model the refused days fall BETWEEN two windows;
+        no later observation can place them inside one, so the property holds
+        for any number of on/off cycles — not just the single cycle the old
+        moving day-stamp was patched to survive.
+        """
+        _clear_consent(store)
+        _grant_consent(store, opened=NOW - timedelta(days=2), confirmed_through=NOW)
+        _add_package(store, "consented", "2026-08-25")
+
+        # User turns sending off; packages keep being collected for 3 days.
+        _revoke_consent(store, at=NOW)
+        for day in ("2026-08-27", "2026-08-28", "2026-08-29"):
+            _add_package(store, f"refused-{day}", day)
+
+        # User re-enables 5 days later; heartbeat confirms past the horizon.
+        later = NOW + timedelta(days=5)
+        with store._connection() as connection:
+            with write_txn(connection):
+                reconcile_send_consent(connection, True, now=later)
+                reconcile_send_consent(
+                    connection, True, now=later + timedelta(days=30)
+                )
+
+        transport = FakeTransport(*[FakeResponse(202)] * 10)
+        SharedMetricsSender(
+            store, ENDPOINT, post=transport, sleep=lambda _s: None, now=lambda: later
+        ).send_pending()
+
+        sent = [json.loads(c["payload"])["package_id"] for c in transport.calls]
+        assert not any("refused" in pid for pid in sent), (
+            f"transmitted packages collected while sending was off: {sent}"
+        )
+        # And the interval model's improvement over the day-stamp: the
+        # pre-revocation consented package is NOT collateral damage.
+        assert "consented" in sent, (
+            "the consented backlog was destroyed by the revoke/re-enable cycle"
+        )
+
+    def test_a_package_from_after_re_enabling_is_sent(self, store):
+        """The revocation handling must not wedge sending off permanently."""
+        _clear_consent(store)
+        _grant_consent(store, opened=NOW - timedelta(days=2), confirmed_through=NOW)
+        _revoke_consent(store, at=NOW)
+
+        later = NOW + timedelta(days=5)
+        with store._connection() as connection:
+            with write_txn(connection):
+                reconcile_send_consent(connection, True, now=later)
+                reconcile_send_consent(
+                    connection, True, now=later + timedelta(days=10)
+                )
+        _add_package(store, "after-re-optin", (later + timedelta(days=1)).date().isoformat())
+        transport = FakeTransport(FakeResponse(202))
+        SharedMetricsSender(
+            store, ENDPOINT, post=transport, sleep=lambda _s: None,
+            now=lambda: later + timedelta(days=2),
+        ).send_pending()
+        assert len(transport.calls) == 1
+
+
+class TestIdentity:
+    def test_the_stable_install_id_is_transmitted_as_is(self, store):
+        """Product decision 2026-08-27: no pseudonymization.
+
+        The wire body carries the profile-scoped install_id verbatim. This
+        test is the deliberate inversion of the pre-decision assertion that
+        the raw id never crossed the wire.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert transport.bodies[0]["install_id"] == INSTALL_ID
+
+    def test_transmitted_id_is_frozen_on_the_row(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(503), FakeResponse(202))
+        _sender(store, transport).send_pending()
+        assert _row(store, "pkg-1")["sent_install_id"] == transport.bodies[0]["install_id"]
+
+    def test_retries_send_identical_bytes(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(503), FakeResponse(503), FakeResponse(202))
+        _sender(store, transport).send_pending()
+        payloads = {c["payload"] for c in transport.calls}
+        assert len(payloads) == 1, "a resend must be byte-identical per the contract"
+
+    def test_only_install_id_differs_from_the_stored_package(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        transport = FakeTransport(FakeResponse(202))
+        _sender(store, transport).send_pending()
+        sent = transport.bodies[0]
+        with store._connection() as connection:
+            stored = json.loads(
+                connection.execute(
+                    "SELECT payload_json FROM package_outbox WHERE package_id = 'pkg-1'"
+                ).fetchone()[0]
+            )
+        assert set(sent) == set(stored)
+        for key in stored:
+            if key != "install_id":
+                assert sent[key] == stored[key]
+
+
+class TestOutboxIsNotAQueue:
+    def test_a_sent_package_file_is_not_deleted(self, store):
+        path = _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(202))).send_pending()
+        assert path.exists(), "the outbox is the user's history, not a send queue"
+
+    def test_a_rejected_package_file_is_not_deleted(self, store):
+        path = _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(400))).send_pending()
+        assert path.exists()
+
+    def test_the_package_row_survives_sending(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(202))).send_pending()
+        with store._connection() as connection:
+            assert connection.execute(
+                "SELECT COUNT(*) FROM package_outbox WHERE package_id = 'pkg-1'"
+            ).fetchone()[0] == 1
+
+
+class TestClaimingAndBounds:
+    def test_a_sent_package_is_not_resent(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(202))).send_pending()
+        second = FakeTransport(FakeResponse(202))
+        _sender(store, second).send_pending()
+        assert second.calls == []
+
+    def test_a_deferred_package_is_skipped_until_due(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(429, retry_after="600"))).send_pending()
+        second = FakeTransport(FakeResponse(202))
+        _sender(store, second).send_pending()
+        assert second.calls == [], "backoff must survive within the same process"
+
+    def test_a_deferred_package_is_retried_once_due(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(429, retry_after="60"))).send_pending()
+
+        later = SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=(transport := FakeTransport(FakeResponse(202))),
+            sleep=lambda _s: None,
+            now=lambda: NOW + timedelta(minutes=5),
+        )
+        later.send_pending()
+        assert len(transport.calls) == 1
+
+    def test_attempts_are_counted(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(429))).send_pending()
+        assert _row(store, "pkg-1")["send_attempts"] == 1
+
+    def test_a_pass_is_bounded(self, store):
+        for i in range(MAX_PACKAGES_PER_PASS + 5):
+            _add_package(store, f"pkg-{i:02d}", "2026-08-26")
+        transport = FakeTransport(*[FakeResponse(202)] * 40)
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.sent == MAX_PACKAGES_PER_PASS
+
+    def test_two_concurrent_passes_do_not_double_send(self, store):
+        """Claiming is what stops two Hermes processes duplicating work.
+
+        The second pass must RECORD what it saw rather than raise: _send_one
+        catches every exception as a retryable transport failure, so an
+        assertion thrown inside a transport would be swallowed and this test
+        would pass no matter what the claim did.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+
+        first_calls = []
+        second_calls = []
+
+        def second_transport(endpoint, payload, *, timeout):
+            second_calls.append(payload)
+            return FakeResponse(202)
+
+        def transport(endpoint, payload, *, timeout):
+            first_calls.append(payload)
+            # A second sender runs while the first is mid-flight.
+            SharedMetricsSender(
+                store,
+                ENDPOINT,
+                post=second_transport,
+                sleep=lambda _s: None,
+                now=lambda: NOW,
+            ).send_pending()
+            return FakeResponse(202)
+
+        _sender(store, transport).send_pending()
+        assert len(first_calls) == 1
+        assert second_calls == [], (
+            "a concurrent pass claimed a package already in flight"
+        )
+
+    def test_a_claim_leases_the_row_long_enough_to_cover_a_worst_case_send(
+        self, store
+    ):
+        """The lease must outlast one package's worst legal duration.
+
+        Asserting merely "in the future" passed for a 1-second lease, which is
+        useless: a package can legally take three 30s timeouts plus backoff.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+        claimed = _sender(store, FakeTransport())._claim_next(NOW, set())
+        assert claimed is not None
+
+        worst_case = REQUEST_TIMEOUT_SECONDS * MAX_ATTEMPTS + 1 + 5 + 25
+        deadline = NOW + timedelta(seconds=worst_case)
+        assert _row(store, "pkg-1")["next_attempt_at"] >= _iso(deadline), (
+            "lease expires before a single package can legally finish"
+        )
+
+    def test_a_slow_multi_package_pass_does_not_lose_its_lease(self, store):
+        """Regression: a batch-wide lease expired while later rows were sent.
+
+        One package can legally take ~96s (three 30s timeouts plus backoff).
+        With 20 rows claimed under one shared lease, the later rows' leases
+        expired mid-pass and a second process re-sent them. Packages are now
+        claimed one at a time, immediately before transmission.
+        """
+        for i in range(3):
+            _add_package(store, f"pkg-{i}", "2026-08-26")
+
+        clock = {"t": NOW}
+        first_posts, second_posts = [], []
+
+
+        def transport(endpoint, payload, *, timeout):
+            pid = json.loads(payload)["package_id"]
+            first_posts.append(pid)
+            # Burn the worst-case time budget for a single package.
+            clock["t"] += timedelta(seconds=96)
+            # A concurrent process probes for work while this package is still
+            # in flight. It must not be able to claim the package we hold.
+            # Restricted to that package so the probe cannot legitimately pick
+            # up the OTHER pending rows and make the assertion ambiguous.
+            held = _row(store, pid)
+            if held["next_attempt_at"] is not None:
+                eligible = held["next_attempt_at"] <= _iso(clock["t"])
+                if eligible and held["send_state"] != "sent":
+                    second_posts.append(pid)
+            return FakeResponse(202)
+
+        SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=transport,
+            sleep=lambda _s: None,
+            now=lambda: clock["t"],
+        ).send_pending()
+
+        assert sorted(first_posts) == ["pkg-0", "pkg-1", "pkg-2"]
+        assert second_posts == [], (
+            f"a concurrent pass re-sent {second_posts} after a lease expired"
+        )
+
+    def test_a_re_eligible_head_row_does_not_starve_the_tail(self, store):
+        """Regression: `seen` terminated the pass instead of skipping a row.
+
+        The claim query is LIMIT 1. When the oldest row was already handled
+        this pass but had become eligible again (short Retry-After, or a pass
+        outliving the 15-minute failure backoff), _claim_next returned None
+        and send_pending read that as "queue empty", abandoning every healthy
+        package behind it. Measured: 10 of 19 delivered.
+        """
+        _add_package(store, "aaa-head", "2026-08-26")
+        for i in range(5):
+            _add_package(store, f"zzz-{i}", "2026-08-26")
+        # Order by created_at puts the head first.
+        with store._connection() as connection:
+            connection.execute(
+                "UPDATE package_outbox SET created_at = '2026-08-26T00:00:00Z'"
+                " WHERE package_id = 'aaa-head'"
+            )
+
+        posts = []
+
+        def transport(endpoint, payload, *, timeout):
+            pid = json.loads(payload)["package_id"]
+            posts.append(pid)
+            if pid == "aaa-head":
+                # Well-behaved service: retry in one second, so the head is
+                # eligible again immediately.
+                return FakeResponse(429, retry_after="1")
+            return FakeResponse(202)
+
+        clock = {"t": NOW}
+        SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=transport,
+            sleep=lambda _s: None,
+            now=lambda: clock["t"] + timedelta(seconds=30 * len(posts)),
+        ).send_pending()
+
+        delivered = {p for p in posts if p.startswith("zzz")}
+        assert delivered == {f"zzz-{i}" for i in range(5)}, (
+            f"tail starved by a re-eligible head row; delivered {delivered}"
+        )
+
+    def test_a_poisoned_package_is_abandoned_eventually(self, store):
+        """Without a ceiling a doomed row is retried ~160 times over 30 days.
+
+        Drives the real loop rather than pre-setting a counter: a row seeded
+        at exactly the limit is also excluded by other predicates, so that
+        version of this test passed even with the ceiling removed.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+
+        clock = {"t": NOW}
+        attempts = []
+
+        def transport(endpoint, payload, *, timeout):
+            attempts.append(1)
+            return FakeResponse(503)
+
+        # Run many passes, always well past any backoff, as a month of hook
+        # fires against a permanently failing package would.
+        for i in range(60):
+            SharedMetricsSender(
+                store,
+                ENDPOINT,
+                post=transport,
+                sleep=lambda _s: None,
+                now=lambda: clock["t"] + timedelta(hours=i),
+            ).send_pending()
+
+        row = _row(store, "pkg-1")
+        assert row["send_attempts"] <= MAX_SEND_ATTEMPTS, (
+            f"package retried {row['send_attempts']} times with no ceiling"
+        )
+        assert len(attempts) < 100, (
+            f"{len(attempts)} requests burned on one doomed package"
+        )
+
+    def test_a_lapsed_claimant_yields_even_before_anyone_reclaims(self, store):
+        """Seventh review: the check-to-POST expiry race.
+
+        A claims, sleeps past its own lease, and wakes BEFORE any other
+        process reclaims. Its token is still in the row, so a read-only
+        ownership check passes — and then B reclaims while A's POST is in
+        flight: both send. The pre-POST renewal must instead REJECT a
+        claimant whose lease already expired, whether or not anyone has
+        reclaimed yet, because expiry alone means another process may claim
+        at any moment.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+
+        posts = []
+        sender_a = SharedMetricsSender(
+            store, ENDPOINT,
+            post=lambda e, p, *, timeout: (posts.append("A"), FakeResponse(202))[1],
+            sleep=lambda _s: None,
+            now=lambda: clock["t"],
+        )
+        clock = {"t": NOW}
+        claimed = sender_a._claim_next(NOW, set())
+        assert claimed is not None and not claimed["skip"]
+
+        # Suspended past the 300s lease; wakes with the row NOT yet reclaimed.
+        clock["t"] = NOW + timedelta(seconds=400)
+        result = sender_a._send_one(claimed)
+
+        assert posts == [], (
+            "a claimant with an expired lease transmitted before renewal"
+        )
+        assert result == "deferred"
+        # The row must remain claimable by the next process.
+        row = _row(store, "pkg-1")
+        assert row["send_state"] == "pending"
+
+    def test_renewal_extends_the_lease_across_the_post(self, store):
+        """A healthy in-lease claimant renews and its POST is covered.
+
+        Round-8 review: the original assertion was `>=` under a frozen
+        clock, which a renewal that matches the row but never extends the
+        lease also satisfies — the exact mutant that double-POSTs (the
+        un-extended lease expires mid-POST and a second process reclaims).
+        The renewal must move the deadline STRICTLY forward to now + lease,
+        so renew from a later clock and require the exact new deadline.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+        clock = {"t": NOW}
+        sender = SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=lambda e, p, *, timeout: FakeResponse(202),
+            sleep=lambda _s: None,
+            now=lambda: clock["t"],
+        )
+        claimed = sender._claim_next(NOW, set())
+        assert claimed is not None
+        lease_before = _row(store, "pkg-1")["next_attempt_at"]
+
+        # 100s into the (300s) lease: still healthy, renews mid-flight.
+        clock["t"] = NOW + timedelta(seconds=100)
+        assert sender._renew_claim("pkg-1", claimed["claim_token"]) is True
+        lease_after = _row(store, "pkg-1")["next_attempt_at"]
+        assert lease_after > lease_before, (
+            "renewal granted authority without extending the lease"
+        )
+        # And not just 'later': the full fresh lease from the renewal clock.
+        expected = (NOW + timedelta(seconds=100 + 300)).strftime(
+            "%Y-%m-%dT%H:%M:%SZ"
+        )
+        assert lease_after == expected
+
+    def test_a_lapsed_claimant_resuming_after_reclaim_cannot_double_post(
+        self, store
+    ):
+        """PR-review P1: expiry -> reclaim -> old claimant resumes.
+
+        A claims, then is suspended (laptop lid) BEFORE its POST. The lease
+        expires; B reclaims and POSTs; A wakes and proceeds. The pre-POST
+        ownership check must make A yield without transmitting.
+
+        Scope note: the check closes the claim->POST gap. A suspension that
+        lands mid-POST (bytes already leaving) is not client-fixable — that
+        residual needs server-side dedupe and is documented on _send_one.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+
+        posts = []
+
+        def post_a(endpoint, payload, *, timeout):
+            posts.append("A")
+            return FakeResponse(202)
+
+        def post_b(endpoint, payload, *, timeout):
+            posts.append("B")
+            return FakeResponse(202)
+
+        sender_a = SharedMetricsSender(
+            store, ENDPOINT, post=post_a, sleep=lambda _s: None, now=lambda: NOW
+        )
+        # A claims, then the process is suspended before _send_one runs.
+        claimed_a = sender_a._claim_next(NOW, set())
+        assert claimed_a is not None and not claimed_a["skip"]
+
+        # 400s later (past the 300s lease) B claims and completes the send.
+        later = NOW + timedelta(seconds=400)
+        sender_b = SharedMetricsSender(
+            store, ENDPOINT, post=post_b, sleep=lambda _s: None, now=lambda: later
+        )
+        outcome_b = sender_b.send_pending()
+        assert outcome_b.sent == 1
+
+        # A resumes exactly where it left off.
+        result_a = sender_a._send_one(claimed_a)
+
+        row = _row(store, "pkg-1")
+        assert posts == ["B"], (
+            f"a lapsed claimant transmitted after reclaim: {posts}"
+        )
+        assert result_a == "deferred"
+        assert row["send_state"] == "sent", "B's settlement must stand"
+
+    def test_a_lapsed_claimants_backoff_cannot_clobber_the_new_claim(self, store):
+        """The token must fence DEFERS too, not just the 202 settlement.
+
+        A's transport fails after B has reclaimed; A's backoff write must
+        not move next_attempt_at under B's live lease.
+        """
+        _add_package(store, "pkg-1", "2026-08-26")
+        sender_a = SharedMetricsSender(
+            store, ENDPOINT,
+            post=FakeTransport(OSError("net"), OSError("net"), OSError("net")),
+            sleep=lambda _s: None, now=lambda: NOW,
+        )
+        claimed_a = sender_a._claim_next(NOW, set())
+        assert claimed_a is not None and not claimed_a["skip"]
+
+        later = NOW + timedelta(seconds=400)
+        sender_b = SharedMetricsSender(
+            store, ENDPOINT, post=FakeTransport(),
+            sleep=lambda _s: None, now=lambda: later,
+        )
+        claimed_b = sender_b._claim_next(later, set())
+        assert claimed_b is not None and not claimed_b["skip"]
+        lease_b = _row(store, "pkg-1")["next_attempt_at"]
+
+        # A's exhausted retries try to write a 15-minute backoff.
+        result = sender_a._send_one(claimed_a)
+        assert result == "deferred"
+        assert _row(store, "pkg-1")["next_attempt_at"] == lease_b, (
+            "a lapsed claimant's backoff overwrote the live claim's lease"
+        )
+
+    def test_an_expired_lease_is_reclaimed(self, store):
+        """A process killed mid-pass must not strand its packages."""
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(OSError("killed"), OSError(""), OSError(""))).send_pending()
+
+        later = SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=(transport := FakeTransport(FakeResponse(202))),
+            sleep=lambda _s: None,
+            now=lambda: NOW + timedelta(hours=2),
+        )
+        later.send_pending()
+        assert len(transport.calls) == 1
+
+    def test_a_lapsed_sender_cannot_resurrect_a_sent_package(self, store):
+        """Terminal state must win over a straggler's write."""
+        _add_package(store, "pkg-1", "2026-08-26")
+        _sender(store, FakeTransport(FakeResponse(202))).send_pending()
+        assert _row(store, "pkg-1")["send_state"] == "sent"
+
+        # A straggler from an earlier pass tries to defer the same row.
+        _sender(store, FakeTransport())._defer("pkg-1", 600, "stale")
+        assert _row(store, "pkg-1")["send_state"] == "sent", (
+            "a lapsed pass overwrote a completed send"
+        )
+
+
+class TestResilience:
+    def test_a_corrupt_row_does_not_stop_the_pass(self, store):
+        _add_package(store, "good", "2026-08-26")
+        with store._connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO package_outbox(
+                    package_id, period_start, period_end, payload_json,
+                    created_at, exported_at
+                ) VALUES ('bad', '2026-08-26T00:00:00Z', '2026-08-26T23:59:59Z',
+                          'not json', '2026-08-26T00:00:00Z', '2026-08-26T01:00:00Z')
+                """
+            )
+        transport = FakeTransport(*[FakeResponse(202)] * 5)
+        outcome = _sender(store, transport).send_pending()
+        assert outcome.sent >= 1
+
+    @pytest.mark.parametrize(
+        "payload_json",
+        [
+            '["a", "list"]',
+            "null",
+            '"a string"',
+            "42",
+            '{"no_install_id": true}',
+            '{"install_id": ""}',
+            '{"install_id": null}',
+        ],
+    )
+    def test_valid_json_that_is_not_a_usable_package_is_skipped(
+        self, store, payload_json
+    ):
+        """Regression: a top-level array parsed fine, then .get() raised.
+
+        The AttributeError escaped the claim transaction and blocked every
+        healthy package behind it.
+        """
+        with store._connection() as connection:
+            connection.execute(
+                """
+                INSERT INTO package_outbox(
+                    package_id, period_start, period_end, payload_json,
+                    created_at, exported_at
+                ) VALUES ('bad', '2026-08-26T00:00:00Z', '2026-08-26T23:59:59Z',
+                          ?, '2026-08-26T00:00:00Z', '2026-08-26T01:00:00Z')
+                """,
+                (payload_json,),
+            )
+        _add_package(store, "good", "2026-08-26")
+
+        transport = FakeTransport(*[FakeResponse(202)] * 5)
+        outcome = _sender(store, transport).send_pending()
+
+        assert outcome.sent == 1, "the healthy package must still go out"
+        assert [json.loads(c["payload"])["package_id"] for c in transport.calls] == [
+            "good"
+        ]
+        assert _row(store, "bad")["send_state"] == "rejected"
+
+    def test_send_pending_never_raises_on_a_broken_database(self, store, tmp_path):
+        store.database_path.write_text("this is not a database")
+        outcome = _sender(store, FakeTransport(FakeResponse(202))).send_pending()
+        assert outcome.sent == 0
+
+
+class TestConsentRevocation:
+    """`send: false` must stop an in-flight pass, not just the next one."""
+
+    def test_revoking_consent_mid_pass_stops_further_sends(self, store):
+        for i in range(4):
+            _add_package(store, f"pkg-{i}", "2026-08-26")
+
+        consented = {"value": True}
+        posts = []
+
+        def transport(endpoint, payload, *, timeout):
+            posts.append(json.loads(payload)["package_id"])
+            consented["value"] = False  # user flips send off during the pass
+            return FakeResponse(202)
+
+        outcome = SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=transport,
+            sleep=lambda _s: None,
+            now=lambda: NOW,
+            consent_check=lambda: consented["value"],
+        ).send_pending()
+
+        assert len(posts) == 1, f"kept sending after consent was revoked: {posts}"
+        assert outcome.sent == 1
+
+    def test_no_send_at_all_when_consent_is_already_false(self, store):
+        _add_package(store, "pkg-1", "2026-08-26")
+        posts = []
+        SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=lambda *a, **k: posts.append(1) or FakeResponse(202),
+            sleep=lambda _s: None,
+            now=lambda: NOW,
+            consent_check=lambda: False,
+        ).send_pending()
+        assert posts == []
+
+    def test_an_unreadable_consent_check_fails_closed(self, store):
+        """If consent cannot be established, do not transmit."""
+        _add_package(store, "pkg-1", "2026-08-26")
+        posts = []
+
+        def explode():
+            raise OSError("config unreadable")
+
+        SharedMetricsSender(
+            store,
+            ENDPOINT,
+            post=lambda *a, **k: posts.append(1) or FakeResponse(202),
+            sleep=lambda _s: None,
+            now=lambda: NOW,
+            consent_check=explode,
+        ).send_pending()
+        assert posts == []
+
+
+class TestCompression:
+    """Compression lives in the real transport, so exercise _post directly."""
+
+    def _captured_request(self, payload: bytes):
+        import urllib.request
+
+        from hermes_cli.observability import shared_metrics_sender as mod
+
+        captured = {}
+
+        class FakeConn:
+            status = 202
+            headers = {}
+
+            def read(self, _n=None):
+                return b"{}"
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *a):
+                return False
+
+        def fake_urlopen(request, timeout=None):
+            captured["data"] = request.data
+            captured["headers"] = {k.lower(): v for k, v in request.headers.items()}
+            return FakeConn()
+
+        original = urllib.request.urlopen
+        urllib.request.urlopen = fake_urlopen
+        try:
+            mod._post(ENDPOINT, payload, timeout=5)
+        finally:
+            urllib.request.urlopen = original
+        return captured
+
+    def test_large_payloads_are_gzipped(self):
+        payload = json.dumps({"filler": "x" * 20000}).encode("utf-8")
+        captured = self._captured_request(payload)
+        assert captured["data"][:2] == b"\x1f\x8b", "gzip magic bytes"
+        assert captured["headers"].get("Content-encoding".lower()) == "gzip"
+
+    def test_gzip_actually_shrinks_the_body(self):
+        payload = json.dumps({"filler": "x" * 20000}).encode("utf-8")
+        captured = self._captured_request(payload)
+        assert len(captured["data"]) < len(payload)
+
+    def test_gzip_is_deterministic_across_time(self):
+        """Kills the mtime footgun: gzip embeds a timestamp by default.
+
+        The in-pass retry test cannot catch this — both attempts compress
+        within the same second. Compressing the same bytes at two different
+        wall-clock seconds is what actually exercises mtime=0.
+        """
+        import time as _time
+
+        payload = json.dumps({"filler": "x" * 20000}).encode("utf-8")
+        first = self._captured_request(payload)["data"]
+        _time.sleep(1.1)
+        second = self._captured_request(payload)["data"]
+        assert first == second, (
+            "gzip output changed between seconds — mtime is being embedded"
+        )
+
+    def test_small_payloads_are_sent_plain(self):
+        payload = b'{"small": true}'
+        captured = self._captured_request(payload)
+        assert captured["data"] == payload
+        assert "content-encoding" not in captured["headers"]
diff --git a/tests/hermes_cli/test_shared_metrics_sender_e2e.py b/tests/hermes_cli/test_shared_metrics_sender_e2e.py
new file mode 100644
index 0000000000..85be9b2388
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_sender_e2e.py
@@ -0,0 +1,282 @@
+"""End-to-end test: the real sender against a real HTTP server.
+
+Everything else stubs the transport. This exercises the actual code path —
+urllib, gzip, headers, socket — against a live server on loopback, so a
+transport-level mistake that a fake would hide fails here instead.
+"""
+
+from __future__ import annotations
+
+import gzip
+import json
+import sqlite3
+import threading
+from datetime import datetime, timezone
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+import pytest
+
+from hermes_cli.observability.shared_metrics import SharedMetricsStore
+from hermes_cli.observability.shared_metrics_sender import SharedMetricsSender
+
+INSTALL_ID = "12a73e97-4de9-4766-830d-9ca1192c0420"
+NOW = datetime(2026, 8, 26, 12, 0, tzinfo=timezone.utc)
+
+
+class Ingest(BaseHTTPRequestHandler):
+    """A stand-in for the ingest service that records what it receives."""
+
+    received: list = []
+    script: list = []
+
+    def do_POST(self):  # noqa: N802 - stdlib naming
+        length = int(self.headers.get("Content-Length") or 0)
+        raw = self.rfile.read(length)
+        if self.headers.get("Content-Encoding") == "gzip":
+            body = gzip.decompress(raw)
+        else:
+            body = raw
+        type(self).received.append(
+            {
+                "headers": {k.lower(): v for k, v in self.headers.items()},
+                "body": json.loads(body.decode("utf-8")),
+                # Keep the RAW request bytes: comparing only the parsed body
+                # would not notice a non-deterministic transport encoding.
+                "raw": raw,
+                "raw_len": len(raw),
+                "decoded_len": len(body),
+            }
+        )
+        status, payload, extra = (
+            type(self).script.pop(0) if type(self).script else (202, {}, {})
+        )
+        encoded = json.dumps(payload).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        for key, value in extra.items():
+            self.send_header(key, value)
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, format, *args):  # noqa: A002 - stdlib signature
+        pass
+
+
+@pytest.fixture
+def server():
+    Ingest.received = []
+    Ingest.script = []
+    httpd = HTTPServer(("127.0.0.1", 0), Ingest)
+    thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+    thread.start()
+    yield httpd
+    httpd.shutdown()
+    httpd.server_close()
+
+
+@pytest.fixture
+def store(tmp_path):
+    built = SharedMetricsStore(
+        database_path=tmp_path / "metrics.sqlite3",
+        outbox_directory=tmp_path / "outbox",
+    )
+    # Open a consent window covering the fixture packages; the interval gate
+    # fails closed without one, and this file tests transport, not consent.
+    from datetime import datetime, timezone
+
+    from hermes_cli.observability.shared_metrics_sender import (
+        reconcile_send_consent,
+    )
+    from hermes_cli.sqlite_util import write_txn
+
+    with built._connection() as connection:
+        with write_txn(connection):
+            reconcile_send_consent(
+                connection, True, now=datetime(2026, 8, 20, tzinfo=timezone.utc)
+            )
+            reconcile_send_consent(
+                connection, True, now=datetime(2026, 10, 1, tzinfo=timezone.utc)
+            )
+    return built
+
+
+def _endpoint(server):
+    host, port = server.server_address
+    return f"http://{host}:{port}/v1/telemetry"
+
+
+def _add(store, package_id, day="2026-08-26", metrics=1):
+    payload = {
+        "schema_version": "hermes.shared_metrics.v2",
+        "package_id": package_id,
+        "install_id": INSTALL_ID,
+        "generated_at": f"{day}T01:00:00Z",
+        "period_start": f"{day}T00:00:00Z",
+        "period_end": f"{day}T23:59:59Z",
+        "resource": {
+            "hermes_version": "0.20.5",
+            "os_family": "macos",
+            "architecture": "arm64",
+            "install_method": "git",
+        },
+        "metrics": [
+            {
+                "name": f"hermes.metric.{i}",
+                "type": "counter",
+                "dimensions": {"outcome": "ok"},
+                "value": i,
+            }
+            for i in range(metrics)
+        ],
+    }
+    with store._connection() as connection:
+        connection.execute(
+            """
+            INSERT INTO package_outbox(
+                package_id, period_start, period_end, payload_json,
+                created_at, exported_at
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            """,
+            (
+                package_id,
+                f"{day}T00:00:00Z",
+                f"{day}T23:59:59Z",
+                json.dumps(payload),
+                f"{day}T01:00:00Z",
+                f"{day}T01:00:01Z",
+            ),
+        )
+    return payload
+
+
+def _sender(store, server):
+    return SharedMetricsSender(
+        store, _endpoint(server), sleep=lambda _s: None, now=lambda: NOW
+    )
+
+
+class TestRealTransport:
+    def test_a_package_is_delivered_and_marked_sent(self, store, server):
+        _add(store, "pkg-1")
+        outcome = _sender(store, server).send_pending()
+
+        assert outcome.sent == 1
+        assert len(Ingest.received) == 1
+        assert Ingest.received[0]["body"]["package_id"] == "pkg-1"
+
+        with store._connection() as connection:
+            state = connection.execute(
+                "SELECT send_state FROM package_outbox WHERE package_id = 'pkg-1'"
+            ).fetchone()[0]
+        assert state == "sent"
+
+    def test_the_stable_install_id_crosses_the_wire_as_is(self, store, server):
+        """Product decision 2026-08-27: the raw install_id is transmitted."""
+        _add(store, "pkg-1", metrics=40)
+        _sender(store, server).send_pending()
+        assert Ingest.received[0]["body"]["install_id"] == INSTALL_ID
+
+    def test_content_type_is_json(self, store, server):
+        _add(store, "pkg-1")
+        _sender(store, server).send_pending()
+        assert Ingest.received[0]["headers"]["content-type"] == "application/json"
+
+    def test_a_realistic_package_is_gzipped_over_the_wire(self, store, server):
+        # ~40 metrics matches the real outbox's larger packages.
+        _add(store, "pkg-1", metrics=120)
+        _sender(store, server).send_pending()
+        record = Ingest.received[0]
+        assert record["headers"].get("content-encoding") == "gzip"
+        assert record["raw_len"] < record["decoded_len"]
+
+    def test_the_server_can_parse_what_we_send(self, store, server):
+        """Proves the bytes are valid JSON after transport and decompression."""
+        original = _add(store, "pkg-1", metrics=120)
+        _sender(store, server).send_pending()
+        received = Ingest.received[0]["body"]
+        assert received["metrics"] == original["metrics"]
+        assert received["resource"] == original["resource"]
+
+    def test_400_is_permanent(self, store, server):
+        _add(store, "pkg-1")
+        Ingest.script = [(400, {"error": "invalid_envelope"}, {})]
+        outcome = _sender(store, server).send_pending()
+        assert outcome.rejected == 1
+        assert len(Ingest.received) == 1
+
+    def test_429_is_honoured(self, store, server):
+        _add(store, "pkg-1")
+        Ingest.script = [(429, {"error": "rate_limited"}, {"Retry-After": "90"})]
+        outcome = _sender(store, server).send_pending()
+        assert outcome.deferred == 1
+        with store._connection() as connection:
+            retry_at = connection.execute(
+                "SELECT next_attempt_at FROM package_outbox WHERE package_id = 'pkg-1'"
+            ).fetchone()[0]
+        assert retry_at == "2026-08-26T12:01:30Z"
+
+    def test_5xx_retries_then_succeeds(self, store, server):
+        _add(store, "pkg-1")
+        Ingest.script = [
+            (503, {"error": "storage_unavailable"}, {}),
+            (202, {"package_id": "pkg-1"}, {}),
+        ]
+        outcome = _sender(store, server).send_pending()
+        assert outcome.sent == 1
+        assert len(Ingest.received) == 2
+
+    def test_a_retry_sends_identical_bytes(self, store, server):
+        _add(store, "pkg-1", metrics=5)
+        Ingest.script = [(503, {}, {}), (202, {}, {})]
+        _sender(store, server).send_pending()
+        first, second = Ingest.received
+        assert first["body"] == second["body"]
+        assert first["raw"] == second["raw"], (
+            "the raw request bytes must match, not just the parsed body"
+        )
+
+    def test_a_gzipped_retry_is_byte_identical_on_the_wire(self, store, server):
+        """gzip embeds an mtime by default, which would break this."""
+        _add(store, "pkg-1", metrics=200)
+        Ingest.script = [(503, {}, {}), (202, {}, {})]
+        _sender(store, server).send_pending()
+        first, second = Ingest.received
+        assert first["headers"].get("content-encoding") == "gzip"
+        assert first["raw"] == second["raw"]
+
+    def test_several_packages_in_one_pass(self, store, server):
+        for i in range(5):
+            _add(store, f"pkg-{i}")
+        outcome = _sender(store, server).send_pending()
+        assert outcome.sent == 5
+        assert len(Ingest.received) == 5
+
+    def test_the_outbox_directory_is_untouched(self, store, server, tmp_path):
+        _add(store, "pkg-1")
+        marker = store.outbox_directory / "pkg-1.json"
+        marker.write_text('{"kept": true}')
+        _sender(store, server).send_pending()
+        assert marker.exists()
+        assert json.loads(marker.read_text()) == {"kept": True}
+
+    def test_a_dead_server_defers_without_raising(self, store, server):
+        _add(store, "pkg-1")
+        host, port = server.server_address
+        server.shutdown()
+        server.server_close()
+        sender = SharedMetricsSender(
+            store,
+            f"http://{host}:{port}/v1/telemetry",
+            sleep=lambda _s: None,
+            now=lambda: NOW,
+        )
+        outcome = sender.send_pending()
+        assert outcome.deferred == 1
+        with store._connection() as connection:
+            state, error = connection.execute(
+                "SELECT send_state, last_error FROM package_outbox"
+                " WHERE package_id = 'pkg-1'"
+            ).fetchone()
+        assert state == "pending"
+        assert error
diff --git a/tests/hermes_cli/test_shared_metrics_tools_toggle.py b/tests/hermes_cli/test_shared_metrics_tools_toggle.py
new file mode 100644
index 0000000000..462bfcbd90
--- /dev/null
+++ b/tests/hermes_cli/test_shared_metrics_tools_toggle.py
@@ -0,0 +1,89 @@
+"""Tests for the `hermes tools` shared-metrics consent toggle.
+
+AGENTS.md requires outbound telemetry to be reachable from a config gate, the
+setup prompt, AND `hermes tools`. These cover the third surface.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from hermes_cli.tools_config import (
+    _configure_shared_metrics_interactive,
+    _shared_metrics_menu_label,
+    _shared_metrics_state,
+)
+
+
+def _config(**shared):
+    return {"telemetry": {"shared_metrics": shared}}
+
+
+class TestState:
+    def test_missing_telemetry_section_is_off(self):
+        assert _shared_metrics_state({}) == (False, False)
+
+    def test_malformed_section_does_not_raise(self):
+        assert _shared_metrics_state({"telemetry": "nonsense"}) == (False, False)
+
+    def test_reads_both_flags(self):
+        assert _shared_metrics_state(_config(enabled=True, send=True)) == (True, True)
+
+
+class TestMenuLabel:
+    def test_off_state(self):
+        assert "off" in _shared_metrics_menu_label({})
+
+    def test_local_only_state(self):
+        label = _shared_metrics_menu_label(_config(enabled=True))
+        assert "collecting locally" in label
+        assert "Nous" not in label
+
+    def test_sending_state_names_the_destination(self):
+        label = _shared_metrics_menu_label(_config(enabled=True, send=True))
+        assert "sending to Nous" in label
+
+
+class TestToggle:
+    def test_enabling_send_persists(self, monkeypatch):
+        config = _config(enabled=True)
+        saved = {}
+        monkeypatch.setattr(
+            "hermes_cli.setup.prompt_yes_no", lambda *_a, **_k: True
+        )
+        monkeypatch.setattr(
+            "hermes_cli.setup._record_send_consent_change", lambda **_k: None
+        )
+        monkeypatch.setattr(
+            "hermes_cli.tools_config.save_config",
+            lambda cfg: saved.update({"cfg": cfg}),
+        )
+        _configure_shared_metrics_interactive(config)
+        assert config["telemetry"]["shared_metrics"]["send"] is True
+        assert saved, "a consent change must be written to disk"
+
+    def test_no_write_when_nothing_changed(self, monkeypatch):
+        config = _config(enabled=False, send=False)
+        saved = []
+        monkeypatch.setattr(
+            "hermes_cli.setup.prompt_yes_no", lambda *_a, **_k: False
+        )
+        monkeypatch.setattr(
+            "hermes_cli.tools_config.save_config", lambda cfg: saved.append(cfg)
+        )
+        _configure_shared_metrics_interactive(config)
+        assert saved == []
+
+    def test_disabling_collection_also_disables_sending(self, monkeypatch):
+        """The toggle must not leave send=true with nothing to send."""
+        config = _config(enabled=True, send=True)
+        monkeypatch.setattr(
+            "hermes_cli.setup.prompt_yes_no", lambda *_a, **_k: False
+        )
+        monkeypatch.setattr(
+            "hermes_cli.tools_config.save_config", lambda cfg: None
+        )
+        _configure_shared_metrics_interactive(config)
+        shared = config["telemetry"]["shared_metrics"]
+        assert shared["enabled"] is False
+        assert shared["send"] is False
diff --git a/tests/hermes_cli/test_startup_model_routing_87189.py b/tests/hermes_cli/test_startup_model_routing_87189.py
new file mode 100644
index 0000000000..ffa3b902a9
--- /dev/null
+++ b/tests/hermes_cli/test_startup_model_routing_87189.py
@@ -0,0 +1,151 @@
+"""Regression tests for startup model/provider routing (#87189)."""
+
+from hermes_cli import model_switch
+
+
+def test_startup_route_uses_configured_nous_provider(monkeypatch):
+    monkeypatch.setattr(model_switch, "DIRECT_ALIASES", {})
+    route = model_switch.resolve_startup_model_route(
+        "nous/deepseek-v4-pro",
+        user_providers={"nous": {"base_url": "https://inference.example/v1"}},
+    )
+    assert route == model_switch.StartupModelRoute("deepseek-v4-pro", "nous", "")
+
+
+def test_startup_route_keeps_configured_custom_provider_name(monkeypatch):
+    monkeypatch.setattr(model_switch, "DIRECT_ALIASES", {})
+    route = model_switch.resolve_startup_model_route(
+        "ollama/qwen3.5:4b",
+        user_providers={"ollama": {"base_url": "http://localhost:11434/v1"}},
+    )
+    assert route == model_switch.StartupModelRoute("qwen3.5:4b", "ollama", "")
+
+
+def test_startup_route_does_not_consume_aggregator_namespace(monkeypatch):
+    monkeypatch.setattr(model_switch, "DIRECT_ALIASES", {})
+    route = model_switch.resolve_startup_model_route(
+        "openrouter/anthropic/claude-sonnet",
+        user_providers={"openrouter": {"base_url": "https://openrouter.ai/api/v1"}},
+    )
+    assert route is None
+
+
+def test_startup_route_aggregator_native_slug_stays_on_aggregator(monkeypatch):
+    """On OpenRouter, ``anthropic/claude-...`` is an aggregator-native slug.
+
+    A ``providers.anthropic`` block in the same config must NOT steal the
+    route — bare vendor slugs resolve WITHIN the aggregator first
+    (aggregator-aware resolution contract).
+    """
+    monkeypatch.setattr(model_switch, "DIRECT_ALIASES", {})
+    monkeypatch.setattr(
+        "hermes_cli.models._find_openrouter_slug",
+        lambda name: "anthropic/claude-opus-4.6",
+    )
+    route = model_switch.resolve_startup_model_route(
+        "anthropic/claude-opus-4.6",
+        current_provider="openrouter",
+        user_providers={"anthropic": {"apiKey": "sk-test"}},
+    )
+    assert route is None
+
+
+def test_startup_route_non_aggregator_current_provider_still_routes(monkeypatch):
+    monkeypatch.setattr(model_switch, "DIRECT_ALIASES", {})
+    route = model_switch.resolve_startup_model_route(
+        "nous/deepseek-v4-pro",
+        current_provider="anthropic",
+        user_providers={"nous": {"base_url": "https://inference.example/v1"}},
+    )
+    assert route == model_switch.StartupModelRoute("deepseek-v4-pro", "nous", "")
+
+
+def test_startup_route_resolves_dict_alias_and_preserves_endpoint(monkeypatch):
+    monkeypatch.setattr(
+        model_switch,
+        "DIRECT_ALIASES",
+        {
+            "localqwen": model_switch.DirectAlias(
+                "qwen3.5:4b", "custom", "http://localhost:11434/v1"
+            )
+        },
+    )
+    route = model_switch.resolve_startup_model_route("localqwen")
+    assert route == model_switch.StartupModelRoute(
+        "qwen3.5:4b", "custom", "http://localhost:11434/v1"
+    )
+
+
+def test_startup_route_url_alias_never_keeps_foreign_provider_label(monkeypatch):
+    """A URL-bearing alias labelled ``anthropic`` must resolve as ``custom``.
+
+    Keeping the label would let the alias reach the anthropic
+    explicit-runtime branch with a foreign base_url and put the live vendor
+    token on the alias host's wire (#28660 / #83612).
+    """
+    monkeypatch.setattr(
+        model_switch,
+        "DIRECT_ALIASES",
+        {
+            "urlalias": model_switch.DirectAlias(
+                "qwen3.5:4b", "anthropic", "http://localhost:11434/v1"
+            )
+        },
+    )
+    route = model_switch.resolve_startup_model_route("urlalias")
+    assert route is not None
+    assert route.provider == "custom"
+    assert route.base_url == "http://localhost:11434/v1"
+
+
+def test_startup_route_alias_carries_own_api_key(monkeypatch):
+    monkeypatch.setattr(
+        model_switch,
+        "DIRECT_ALIASES",
+        {
+            "keyed": model_switch.DirectAlias(
+                "some-model",
+                "custom",
+                "https://proxy.example/v1",
+                api_key="sk-alias-key",
+            )
+        },
+    )
+    route = model_switch.resolve_startup_model_route("keyed")
+    assert route is not None
+    assert route.api_key == "sk-alias-key"
+
+
+def test_startup_route_explicit_provider_wins_over_alias_label(monkeypatch):
+    monkeypatch.setattr(
+        model_switch,
+        "DIRECT_ALIASES",
+        {"ds": model_switch.DirectAlias("deepseek-chat", "deepseek", "")},
+    )
+    route = model_switch.resolve_startup_model_route(
+        "ds", explicit_provider="openrouter"
+    )
+    assert route is not None
+    assert route.provider == "openrouter"
+    assert route.model == "deepseek-chat"
+
+
+def test_model_aliases_dict_entries_are_loaded(monkeypatch):
+    monkeypatch.setattr(
+        "hermes_cli.config.load_config",
+        lambda: {
+            "model": {
+                "aliases": {
+                    "localqwen": {
+                        "model": "qwen3.5:4b",
+                        "provider": "custom",
+                        "base_url": "http://localhost:11434/v1",
+                    }
+                }
+            }
+        },
+    )
+    aliases = model_switch._load_direct_aliases()
+    assert aliases["localqwen"] == model_switch.DirectAlias(
+        "qwen3.5:4b", "custom", "http://localhost:11434/v1"
+    )
diff --git a/tests/hermes_cli/test_status.py b/tests/hermes_cli/test_status.py
index 4a5746b94d..37d0c0bb24 100644
--- a/tests/hermes_cli/test_status.py
+++ b/tests/hermes_cli/test_status.py
@@ -15,6 +15,18 @@ def test_show_status_all_does_not_print_keenable_key_value(monkeypatch, capsys,
     assert sentinel not in output
 
 
+def test_show_status_all_does_not_print_tavily_key_value(monkeypatch, capsys, tmp_path):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    sentinel = "NONSECRET_SENTINEL_VALUE_DO_NOT_PRINT_TAVILY_123456"
+    monkeypatch.setenv("TAVILY_API_KEY", sentinel)
+
+    show_status(SimpleNamespace(all=True, deep=False))
+
+    output = capsys.readouterr().out
+    assert "Tavily" in output
+    assert sentinel not in output
+
+
 def test_show_status_termux_gateway_section_skips_systemctl(monkeypatch, capsys, tmp_path):
     from hermes_cli import status as status_mod
     import hermes_cli.auth as auth_mod
diff --git a/tests/hermes_cli/test_terminal_notify.py b/tests/hermes_cli/test_terminal_notify.py
new file mode 100644
index 0000000000..fce8b90d5e
--- /dev/null
+++ b/tests/hermes_cli/test_terminal_notify.py
@@ -0,0 +1,50 @@
+"""display.bell_on_prompt / bell_on_complete also drive OSC 9 + Warp OSC 777 via _ring_bell."""
+
+import json
+
+from cli import HermesCLI
+from hermes_cli import terminal_notify
+
+_WARP_OK = {
+    "TERM_PROGRAM": "WarpTerminal",
+    "WARP_CLI_AGENT_PROTOCOL_VERSION": "1",
+    "WARP_CLIENT_VERSION": "v0.2026.08.01.00.00.stable_01",
+}
+
+
+def _ring(monkeypatch, *, flag_on, env, **kwargs):
+    for key in _WARP_OK:
+        monkeypatch.delenv(key, raising=False)
+    for key, value in env.items():
+        monkeypatch.setenv(key, value)
+    written = []
+    monkeypatch.setattr(terminal_notify, "_write_tty", written.append)
+    cli = HermesCLI.__new__(HermesCLI)
+    cli.bell_on_prompt = flag_on
+    cli.session_id = "sess-1"
+    cli._ring_bell(prompt=True, **kwargs)
+    return "".join(written)
+
+
+def test_osc9_body_emitted_and_sanitized_only_when_flag_on(monkeypatch):
+    out = _ring(monkeypatch, flag_on=True, env={}, context="approval\x1b\x07\x00\x7f!")
+    assert out == "\x1b]9;Hermes: approval!\x07"
+    assert _ring(monkeypatch, flag_on=False, env={}, context="approval") == ""
+
+
+def test_warp_osc777_only_under_supported_warp_build(monkeypatch):
+    out = _ring(monkeypatch, flag_on=True, env=_WARP_OK, context="approval", detail="rm -rf build")
+    prefix = "\x1b]777;notify;warp://cli-agent;"
+    assert out.count(prefix) == 1
+    payload = json.loads(out.split(prefix, 1)[1].rstrip("\x07"))
+    assert payload["agent"] == "hermes"
+    assert payload["event"] == "permission_request"
+    assert payload["summary"] == "rm -rf build"
+    assert payload["session_id"] == "sess-1"
+    assert payload["v"] == 1
+    # Broken build (advertises the protocol var but can't render) → OSC 9 only.
+    broken = dict(_WARP_OK, WARP_CLIENT_VERSION="v0.2026.03.25.08.24.stable_05")
+    assert prefix not in _ring(monkeypatch, flag_on=True, env=broken, context="approval")
+    # Not Warp at all → OSC 9 only.
+    not_warp = dict(_WARP_OK, TERM_PROGRAM="ghostty")
+    assert prefix not in _ring(monkeypatch, flag_on=True, env=not_warp, context="approval")
diff --git a/tests/hermes_cli/test_tools_config.py b/tests/hermes_cli/test_tools_config.py
index 8523bf3f94..ce19955cc8 100644
--- a/tests/hermes_cli/test_tools_config.py
+++ b/tests/hermes_cli/test_tools_config.py
@@ -245,6 +245,7 @@ def test_first_install_nous_auto_configures_video_gen(monkeypatch):
         "FIRECRAWL_API_KEY",
         "FIRECRAWL_API_URL",
         "KEENABLE_API_KEY",
+        "TAVILY_API_KEY",
         "PARALLEL_API_KEY",
         "BROWSERBASE_API_KEY",
         "BROWSERBASE_PROJECT_ID",
diff --git a/tests/hermes_cli/test_unified_pool_quirk.py b/tests/hermes_cli/test_unified_pool_quirk.py
new file mode 100644
index 0000000000..39c7c23ed7
--- /dev/null
+++ b/tests/hermes_cli/test_unified_pool_quirk.py
@@ -0,0 +1,233 @@
+"""The unified-pool vendor quirk must never misclassify a discrete card.
+
+On unified-memory NVIDIA devices under Windows, nvidia-smi answers from
+a WDDM carve-out while the CUDA allocator addresses the whole pool at
+full bandwidth. Budgeting from smi there produces false "larger than
+your GPU memory" rows and -ot CPU pinning that measures far slower than
+letting the allocator place everything.
+
+The other direction is the regression this file guards: a workstation
+card must never be budgeted as UMA. The driver's INTEGRATED attribute
+decides when readable (both directions); the attribute-less engine
+fallback needs two independent numeric gates, each alone unmeetable by
+any discrete card."""
+
+from __future__ import annotations
+
+import hermes_cli.local_runtime.hardware as hw
+
+GIB = 1 << 30
+
+# Representative unified-memory device shape: a 48 GiB box whose smi
+# reports only the 16 GiB carve-out while the allocator sees the pool.
+UMA_SMI_TOTAL = 16320 << 20
+UMA_POOL = 46464 << 20
+UMA_RAM = 48 * GIB
+
+
+def _no_cache(monkeypatch):
+    monkeypatch.setattr(hw, "_pool_probe_cache", None)
+
+
+# ── _unified_pool_bytes: the classification gate ─────────────
+
+
+def test_integrated_attribute_wins_positive(monkeypatch):
+    """Driver says integrated=True -> unified, no numeric gates needed."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (UMA_POOL, True))
+    assert hw._unified_pool_bytes(UMA_SMI_TOTAL, UMA_RAM) == UMA_POOL
+
+
+def test_integrated_attribute_wins_negative(monkeypatch):
+    """Driver says integrated=False -> discrete, even when the numbers
+    would pass both fallback gates (attribute outranks arithmetic)."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (UMA_POOL, False))
+    assert hw._unified_pool_bytes(UMA_SMI_TOTAL, UMA_RAM) is None
+
+
+def test_engine_fallback_uma_shape_passes(monkeypatch):
+    """Attribute unreadable (engine fallback): the carve-out shape passes
+    both gates — pool several times the smi report, pool ~= RAM."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (UMA_POOL, None))
+    assert hw._unified_pool_bytes(UMA_SMI_TOTAL, UMA_RAM) == UMA_POOL
+
+
+def test_discrete_card_agreeing_within_rounding_stays_discrete(monkeypatch):
+    """A healthy discrete card: allocator and smi agree within rounding.
+    Fails the disagreement gate regardless of box RAM."""
+    smi = 24 * GIB
+    monkeypatch.setattr(hw, "_device_pool_view",
+                        lambda: (smi + (200 << 20), None))
+    assert hw._unified_pool_bytes(smi, 24 * GIB) is None
+    assert hw._unified_pool_bytes(smi, 256 * GIB) is None
+
+
+def test_ram_matched_workstation_card_stays_discrete(monkeypatch):
+    """The nastiest lookalike: a 48 GB card in a 48 GB box. smi and the
+    allocator AGREE (both say 48), so the disagreement gate fails even
+    though pool == RAM would pass the size gate."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (48 * GIB, None))
+    assert hw._unified_pool_bytes(48 * GIB, 48 * GIB) is None
+
+
+def test_pool_smaller_than_ram_fraction_stays_discrete(monkeypatch):
+    """Disagreement without the RAM-sized-pool signature stays discrete:
+    a hypothetical card whose allocator over-reports 2x in a huge-RAM box
+    is a driver bug to distrust, not a unified pool."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (32 * GIB, None))
+    assert hw._unified_pool_bytes(16 * GIB, 128 * GIB) is None
+
+
+def test_no_probe_available_stays_discrete(monkeypatch):
+    """No driver API, no engine binary -> exactly today's behavior."""
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: None)
+    assert hw._unified_pool_bytes(UMA_SMI_TOTAL, UMA_RAM) is None
+
+
+# ── probe_budget wiring ──────────────────────────────────────
+
+
+def _uma_machine(monkeypatch, *, view):
+    _no_cache(monkeypatch)
+    monkeypatch.setattr(hw, "_nvidia_vram",
+                        lambda: (UMA_SMI_TOTAL, 14848 << 20))
+    monkeypatch.setattr(hw, "_ram_bytes",
+                        lambda: (UMA_RAM, 32 * GIB))
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: view)
+
+
+def test_budget_unified_pool_planning(monkeypatch):
+    """Planning budget on unified memory: the allocator pool itself minus
+    headroom, uma=True, ram_available=0 — host memory must not
+    double-count as spill room. NO OS-RAM clamp: carved-out memory is
+    invisible to GlobalMemoryStatusEx (a larger carve shrinks reported
+    OS RAM while the pool stays constant), so clamping to OS RAM would
+    throw away exactly the carved capacity."""
+    _uma_machine(monkeypatch, view=(UMA_POOL, True))
+    b = hw.probe_budget(planning=True)
+    assert b.uma is True
+    assert b.ram_available_bytes == 0
+    assert b.total_device_bytes == UMA_POOL
+    assert b.usable_vram_bytes == int(UMA_POOL * (1 - hw._UMA_HEADROOM_FRACTION))
+    # The whole point: the budget must dwarf the carve-out.
+    assert b.usable_vram_bytes > 2 * UMA_SMI_TOTAL
+
+
+def test_budget_unified_pool_live_counts_dedicated_free_plus_os_available(monkeypatch):
+    """Live budget = smi-free + OS-available (each side alone under-counts:
+    smi free saturates at the carve-out, OS-available can't see it)."""
+    _uma_machine(monkeypatch, view=(UMA_POOL, True))
+    b = hw.probe_budget(planning=False)
+    assert b.uma is True
+    live = (14848 << 20) + 32 * GIB
+    assert b.usable_vram_bytes == int(min(UMA_POOL, live)
+                                      * (1 - hw._UMA_HEADROOM_FRACTION))
+
+
+def test_budget_unified_no_smi_still_classifies(monkeypatch):
+    """nvidia-smi off PATH must not change the verdict: the driver API
+    (system loader, PATH-independent) still classifies unified, planning
+    still budgets the full pool, and live falls back to OS-available."""
+    _no_cache(monkeypatch)
+    monkeypatch.setattr(hw, "_nvidia_vram", lambda: None)
+    monkeypatch.setattr(hw, "_ram_bytes", lambda: (UMA_RAM, 32 * GIB))
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (UMA_POOL, True))
+    planning = hw.probe_budget(planning=True)
+    assert planning.uma is True
+    assert planning.total_device_bytes == UMA_POOL
+    assert planning.usable_vram_bytes == int(
+        UMA_POOL * (1 - hw._UMA_HEADROOM_FRACTION))
+    live = hw.probe_budget(planning=False)
+    assert live.usable_vram_bytes == int(32 * GIB * (1 - hw._UMA_HEADROOM_FRACTION))
+
+
+def test_budget_discrete_unchanged_when_probe_says_discrete(monkeypatch):
+    """integrated=False keeps the existing discrete path bit-for-bit."""
+    _uma_machine(monkeypatch, view=(UMA_POOL, False))
+    b = hw.probe_budget(planning=True)
+    assert b.uma is False
+    assert b.total_device_bytes == UMA_SMI_TOTAL
+    margin = max(hw._MARGIN_FLOOR, int(UMA_SMI_TOTAL * hw._MARGIN_FRACTION))
+    assert b.usable_vram_bytes == UMA_SMI_TOTAL - margin
+    assert b.ram_available_bytes == UMA_RAM
+
+
+def test_budget_discrete_unchanged_when_probe_unavailable(monkeypatch):
+    _uma_machine(monkeypatch, view=None)
+    b = hw.probe_budget(planning=True)
+    assert b.uma is False
+    assert b.ram_available_bytes == UMA_RAM
+
+
+def test_engine_fallback_without_smi_stays_conservative(monkeypatch):
+    """Engine-fallback view (no INTEGRATED verdict) + no smi numbers: the
+    disagreement gate has nothing to compare against, so the quirk stays
+    off and budgeting falls to the conservative RAM-as-UMA path — an
+    attribute-less pool claim alone must never flip the verdict."""
+    _no_cache(monkeypatch)
+    monkeypatch.setattr(hw, "_nvidia_vram", lambda: None)
+    monkeypatch.setattr(hw, "_ram_bytes", lambda: (UMA_RAM, 32 * GIB))
+    monkeypatch.setattr(hw, "_device_pool_view", lambda: (UMA_POOL, None))
+    b = hw.probe_budget(planning=True)
+    assert b.uma is True
+    assert b.total_device_bytes == UMA_RAM  # RAM path, not the pool
+
+
+def test_smi_resolver_caches_and_survives_empty_path(monkeypatch):
+    """The resolver consults PATH first, and a resolution (hit or miss) is
+    cached for the process."""
+    calls = []
+    monkeypatch.setattr(hw, "_smi_path_cache", None)
+    monkeypatch.setattr(hw.shutil, "which",
+                        lambda name: calls.append(name) or "/usr/bin/nvidia-smi")
+    assert hw._nvidia_smi_path() == "/usr/bin/nvidia-smi"
+    assert hw._nvidia_smi_path() == "/usr/bin/nvidia-smi"
+    assert len(calls) == 1
+
+
+# ── probe cache ──────────────────────────────────────────────
+
+
+def test_pool_probe_hit_is_cached_for_process(monkeypatch):
+    _no_cache(monkeypatch)
+    calls = []
+
+    def probe():
+        calls.append(1)
+        return (UMA_POOL, True)
+
+    monkeypatch.setattr(hw, "_cuda_driver_pool", probe)
+    monkeypatch.setattr(hw, "_engine_device_pool", lambda: None)
+    assert hw._device_pool_view() == (UMA_POOL, True)
+    assert hw._device_pool_view() == (UMA_POOL, True)
+    assert len(calls) == 1
+
+
+def test_pool_probe_miss_retries_after_ttl(monkeypatch):
+    """A miss must not be permanent: the engine binary can appear
+    mid-session via the pane's runtime install."""
+    _no_cache(monkeypatch)
+    monkeypatch.setattr(hw, "_cuda_driver_pool", lambda: None)
+    answers = [None, (UMA_POOL, None)]
+    monkeypatch.setattr(hw, "_engine_device_pool", lambda: answers.pop(0))
+
+    now = [1000.0]
+    monkeypatch.setattr(hw.time, "monotonic", lambda: now[0])
+    assert hw._device_pool_view() is None
+    now[0] += 1.0          # inside TTL: cached miss, no re-probe
+    assert hw._device_pool_view() is None
+    now[0] += hw._POOL_NEGATIVE_TTL_S + 1.0
+    assert hw._device_pool_view() == (UMA_POOL, None)
+    assert not answers
+
+
+# ── device-line parsing (engine fallback) ────────────────────
+
+
+def test_device_line_regex_handles_parenthesized_names():
+    """Device names may contain their own parentheses — the LAST
+    parenthesized group must win."""
+    line = ("  CUDA0: NVIDIA Example Device (1234-core Example GPU) "
+            "(46464 MiB, 46284 MiB free)")
+    m = hw._DEVICE_LINE_RE.search(line)
+    assert m and int(m.group(1)) == 46464
diff --git a/tests/hermes_cli/test_update_autostash_orphan_warning.py b/tests/hermes_cli/test_update_autostash_orphan_warning.py
new file mode 100644
index 0000000000..99b932560b
--- /dev/null
+++ b/tests/hermes_cli/test_update_autostash_orphan_warning.py
@@ -0,0 +1,104 @@
+"""Orphaned update-autostash surfacing (#63717 problem 6).
+
+``hermes update`` can legitimately leave an autostash behind (--keep-stash
+parks it; a conflicted restore preserves it), but nothing ever mentioned those
+entries again — they persisted invisibly for weeks. ``hermes update`` now
+warns about ``hermes-update-autostash-*`` entries older than the threshold.
+Behavioral tests use real git repos; no production mocking of the code under
+test.
+"""
+
+import subprocess
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from hermes_cli import update_cmd
+
+
+def _git(cwd, *args, check=True):
+    return subprocess.run(
+        ["git", *args], cwd=cwd, capture_output=True, text=True, check=check
+    )
+
+
+def _make_repo_with_autostash(tmp_path, age_days: float):
+    """Real repo with one hermes-update-autostash entry aged ``age_days``."""
+    import shutil
+
+    if shutil.which("git") is None:
+        pytest.skip("git not available")
+    _git(tmp_path, "init", "-q", "-b", "main")
+    _git(tmp_path, "config", "user.email", "t@example.com")
+    _git(tmp_path, "config", "user.name", "t")
+    (tmp_path / "tracked.txt").write_text("v1\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-qm", "init")
+
+    (tmp_path / "tracked.txt").write_text("local change\n")
+    stamp = (
+        datetime.now(timezone.utc) - timedelta(days=age_days)
+    ).strftime("%Y%m%d-%H%M%S")
+    name = f"hermes-update-autostash-{stamp}"
+    _git(tmp_path, "stash", "push", "--include-untracked", "-m", name)
+    return name
+
+
+def test_old_autostash_is_surfaced(tmp_path, capsys):
+    name = _make_repo_with_autostash(tmp_path, age_days=9)
+    count = update_cmd._warn_orphaned_update_autostashes(["git"], tmp_path)
+    out = capsys.readouterr().out
+    assert count == 1
+    assert "leftover update autostash" in out
+    assert name in out
+    assert "git stash apply" in out
+    # Never a GC: the entry must still exist.
+    listed = _git(tmp_path, "stash", "list").stdout
+    assert name in listed
+
+
+def test_fresh_autostash_is_not_flagged(tmp_path, capsys):
+    _make_repo_with_autostash(tmp_path, age_days=1)
+    count = update_cmd._warn_orphaned_update_autostashes(["git"], tmp_path)
+    assert count == 0
+    assert "leftover update autostash" not in capsys.readouterr().out
+
+
+def test_non_hermes_stash_is_ignored(tmp_path, capsys):
+    import shutil
+
+    if shutil.which("git") is None:
+        pytest.skip("git not available")
+    _git(tmp_path, "init", "-q", "-b", "main")
+    _git(tmp_path, "config", "user.email", "t@example.com")
+    _git(tmp_path, "config", "user.name", "t")
+    (tmp_path / "tracked.txt").write_text("v1\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-qm", "init")
+    (tmp_path / "tracked.txt").write_text("user's own WIP\n")
+    _git(tmp_path, "stash", "push", "-m", "my own stash from 20200101-000000")
+    count = update_cmd._warn_orphaned_update_autostashes(["git"], tmp_path)
+    assert count == 0
+    assert "leftover update autostash" not in capsys.readouterr().out
+
+
+def test_unparseable_autostash_timestamp_left_alone(tmp_path, capsys):
+    import shutil
+
+    if shutil.which("git") is None:
+        pytest.skip("git not available")
+    _git(tmp_path, "init", "-q", "-b", "main")
+    _git(tmp_path, "config", "user.email", "t@example.com")
+    _git(tmp_path, "config", "user.name", "t")
+    (tmp_path / "tracked.txt").write_text("v1\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-qm", "init")
+    (tmp_path / "tracked.txt").write_text("change\n")
+    _git(tmp_path, "stash", "push", "-m", "hermes-update-autostash-notadate")
+    count = update_cmd._warn_orphaned_update_autostashes(["git"], tmp_path)
+    assert count == 0
+
+
+def test_git_failure_is_nonfatal(tmp_path):
+    # Not a git repo at all — must return 0, not raise.
+    assert update_cmd._warn_orphaned_update_autostashes(["git"], tmp_path) == 0
diff --git a/tests/hermes_cli/test_update_fleet_restart_pending.py b/tests/hermes_cli/test_update_fleet_restart_pending.py
index f8390047a2..d5da6456e9 100644
--- a/tests/hermes_cli/test_update_fleet_restart_pending.py
+++ b/tests/hermes_cli/test_update_fleet_restart_pending.py
@@ -102,16 +102,21 @@ def _patch_update_deps(monkeypatch, tmp_path, run_side_effect):
     monkeypatch.setattr(
         hermes_main, "_finish_dashboard_update_cleanup", lambda *a, **k: None
     )
+    monkeypatch.setattr(
+        update_cmd, "_finish_dashboard_update_cleanup", lambda *a, **k: None
+    )
     monkeypatch.setattr(hermes_main, "_build_web_ui", lambda *a, **k: None)
     monkeypatch.setattr(
         update_cmd, "_venv_core_imports_healthy", lambda: (True, "")
     )
     monkeypatch.setattr(update_cmd, "_update_node_dependencies", lambda: [])
+    monkeypatch.setattr(update_cmd, "_purge_stale_hermes_modules", lambda: None)
+    monkeypatch.setattr(hermes_main, "_purge_stale_hermes_modules", lambda: None)
 
     import hermes_cli.gateway as hermes_gateway
 
     monkeypatch.setattr(
-        hermes_gateway, "find_gateway_pids", lambda all_profiles=False: []
+        hermes_gateway, "find_gateway_pids", lambda **_kwargs: []
     )
     monkeypatch.setattr(hermes_gateway, "supports_systemd_services", lambda: False)
     monkeypatch.setattr(
@@ -302,6 +307,97 @@ def test_marker_written_after_pull_cleared_after_successful_restart(
     assert "✓ Code updated!" in out
 
 
+def test_clean_update_warns_about_surviving_pre_update_serve_runtime(
+    monkeypatch, tmp_path, capsys
+):
+    """The successful update path must surface an inventoried stale serve."""
+    args = _update_args()
+    _patch_update_deps(monkeypatch, tmp_path, _make_head_moved_side_effect())
+    monkeypatch.setattr(
+        update_cmd,
+        "_surviving_pre_update_serve_runtimes",
+        lambda _plan: [
+            {
+                "pid": 5555,
+                "kind": "serve",
+                "profile": "default",
+                "supervisor": "manual-serve",
+            }
+        ],
+    )
+
+    hermes_main.cmd_update(args)
+
+    out = capsys.readouterr().out
+    assert "pid 5555" in out
+    assert "serve" in out
+    assert "pre-update code" in out
+
+
+def test_clean_update_escalates_surviving_serve_as_unaccounted(
+    monkeypatch, tmp_path, capsys
+):
+    """#100479 end to end: the plan inventoried a gateway (restarted through
+    ``hermes-gateway.service``) and an unmanaged ``serve`` on the same
+    default profile. The serve survives the update as the SAME process, so
+    the update must (1) warn, (2) reconcile it as ``unaccounted`` instead of
+    borrowing the gateway's restart, and (3) exit 1 with a ``partial``
+    receipt — not print a clean success."""
+    from hermes_cli.update_inventory import (
+        RuntimeRecord, UpdatePlan, _restart_mechanism,
+    )
+    import hermes_cli.update_inventory as ui
+
+    args = _update_args()
+    _patch_update_deps(monkeypatch, tmp_path, _make_head_moved_side_effect())
+
+    plan = UpdatePlan()
+    plan.runtimes = [
+        RuntimeRecord(kind="gateway", profile="default", pid=4444,
+                      supervisor="systemd",
+                      restart_via=_restart_mechanism("systemd", "default")),
+        RuntimeRecord(kind="serve", profile="default", pid=5555,
+                      supervisor="manual-serve",
+                      restart_via=_restart_mechanism("manual-serve", "default"),
+                      detail={"create_time": 1000.0}),
+    ]
+    monkeypatch.setattr(ui, "collect_runtime_inventory", lambda: plan)
+    # The restart phase's own bookkeeping says the gateway unit restarted
+    # (systemd branch is stubbed off in _patch_update_deps, so feed it here).
+    real_match = ui.match_runtime_outcomes
+
+    def _match(p, **kw):
+        kw["restarted_services"] = list(kw.get("restarted_services") or []) + [
+            "hermes-gateway.service"
+        ]
+        return real_match(p, **kw)
+
+    monkeypatch.setattr(ui, "match_runtime_outcomes", _match)
+    # Real survivor probe semantics against a fake ledger: pid 5555 is still
+    # the same incarnation the plan recorded.
+    import hermes_cli.process_identity as pi
+
+    monkeypatch.setattr(
+        pi, "ledger_entries",
+        lambda **_k: [{"pid": 5555, "purpose": "serve", "create_time": 1000.0}],
+    )
+
+    with pytest.raises(SystemExit) as excinfo:
+        hermes_main.cmd_update(args)
+    assert excinfo.value.code == 1
+
+    out = capsys.readouterr().out
+    assert "pid 5555" in out and "pre-update code" in out
+    assert "Planned runtimes the restart phase never touched" in out
+    assert "serve [default] pid 5555" in out
+
+    latest = get_hermes_home() / "logs" / "update_receipts" / "latest.json"
+    receipt = json.loads(latest.read_text(encoding="utf-8"))
+    assert receipt["outcome"] == "partial"
+    by_pid = {o["pid"]: o["outcome"] for o in receipt["runtime_outcomes"]}
+    assert by_pid == {4444: "restarted", 5555: "unaccounted"}
+
+
 def test_interrupt_between_pull_and_restart_leaves_marker(
     monkeypatch, tmp_path
 ):
diff --git a/tests/hermes_cli/test_update_state_autorestore.py b/tests/hermes_cli/test_update_state_autorestore.py
index 75ab2c3552..7b54340835 100644
--- a/tests/hermes_cli/test_update_state_autorestore.py
+++ b/tests/hermes_cli/test_update_state_autorestore.py
@@ -211,3 +211,116 @@ def test_restore_helper_propagates_copy_errors(tmp_path):
 
     with pytest.raises(OSError):
         _restore_state_db_from_snapshot(state_path, tmp_path / "does-not-exist.db")
+
+
+# ── Multi-profile coverage (#97994) ─────────────────────────────────────
+
+
+def _make_valid_db(path: Path, rows: int) -> None:
+    conn = sqlite3.connect(path)
+    conn.execute("CREATE TABLE sessions (id INTEGER PRIMARY KEY, name TEXT)")
+    conn.executemany(
+        "INSERT INTO sessions (name) VALUES (?)",
+        [(str(i),) for i in range(rows)],
+    )
+    conn.commit()
+    conn.close()
+
+
+def _make_valid_snapshot(home: Path, snap_id: str, rows: int) -> None:
+    snap_dir = home / "state-snapshots" / snap_id
+    snap_dir.mkdir(parents=True)
+    _make_valid_db(snap_dir / "state.db", rows)
+
+
+def test_post_update_guard_covers_sibling_profiles(tmp_path, monkeypatch, capsys):
+    """#97994: the guard must verify + auto-restore EVERY profile's state.db,
+    not just the root home's. Pre-update snapshots already cover siblings
+    (#66140); the guard was the missing half."""
+    from hermes_cli import update_cmd
+    from hermes_cli.backup import _sibling_profile_homes
+
+    root_home = tmp_path / "default-home"
+    root_home.mkdir()
+    sibling_home = tmp_path / "profiles" / "work"
+    sibling_home.mkdir(parents=True)
+
+    # Root DB: valid, with its own snapshot — must be left untouched.
+    _make_valid_db(root_home / "state.db", 10)
+    root_before = (root_home / "state.db").read_bytes()
+
+    # Sibling: live DB corrupted post-update (the #68474 zeroed signature),
+    # with its own VALID pre-update snapshot under its own snapshots dir.
+    _make_valid_snapshot(sibling_home, "20260901-pre-update", 25)
+    (sibling_home / "state.db").write_bytes(b"\x00" * 4096)
+
+    monkeypatch.setattr(update_cmd, "get_hermes_home", lambda: root_home)
+    monkeypatch.setattr(
+        "hermes_cli.backup._sibling_profile_homes",
+        lambda invoking_home: [("work", sibling_home)],
+    )
+
+    update_cmd._verify_and_restore_state_dbs_post_update()
+
+    # Sibling restored from ITS snapshot (snap rows, not zeroed bytes).
+    assert _row_count(sibling_home / "state.db") == 25
+    # Root DB byte-identical — untouched.
+    assert (root_home / "state.db").read_bytes() == root_before
+    # Operator-visible restore message mentions the profile.
+    out = capsys.readouterr().out
+    assert "profile work" in out
+
+
+def test_post_update_guard_leaves_valid_sibling_dbs_alone(tmp_path, monkeypatch, capsys):
+    """A healthy sibling profile must not be touched — the guard only acts
+    on corruption."""
+    from hermes_cli import update_cmd
+
+    root_home = tmp_path / "default-home"
+    root_home.mkdir()
+    sibling_home = tmp_path / "profiles" / "work"
+    sibling_home.mkdir(parents=True)
+
+    _make_valid_db(root_home / "state.db", 10)
+    _make_valid_db(sibling_home / "state.db", 7)
+    sibling_before = (sibling_home / "state.db").read_bytes()
+
+    monkeypatch.setattr(update_cmd, "get_hermes_home", lambda: root_home)
+    monkeypatch.setattr(
+        "hermes_cli.backup._sibling_profile_homes",
+        lambda invoking_home: [("work", sibling_home)],
+    )
+
+    update_cmd._verify_and_restore_state_dbs_post_update()
+
+    assert (sibling_home / "state.db").read_bytes() == sibling_before
+    out = capsys.readouterr().out
+    assert "corrupted" not in out
+
+
+def test_post_update_guard_survives_missing_sibling_snapshot(tmp_path, monkeypatch, capsys):
+    """Corrupt sibling with NO snapshot: guard must report and continue,
+    never raise into the update tail."""
+    from hermes_cli import update_cmd
+
+    root_home = tmp_path / "default-home"
+    root_home.mkdir()
+    sibling_home = tmp_path / "profiles" / "work"
+    sibling_home.mkdir(parents=True)
+
+    _make_valid_db(root_home / "state.db", 10)
+    (sibling_home / "state.db").write_bytes(b"\x00" * 4096)
+
+    monkeypatch.setattr(update_cmd, "get_hermes_home", lambda: root_home)
+    monkeypatch.setattr(
+        "hermes_cli.backup._sibling_profile_homes",
+        lambda invoking_home: [("work", sibling_home)],
+    )
+
+    # Must not raise even though no snapshot exists to restore from.
+    update_cmd._verify_and_restore_state_dbs_post_update()
+
+    out = capsys.readouterr().out
+    assert "corrupted" in out
+    # Still corrupt (no snapshot) — but the guard completed cleanly.
+    assert (sibling_home / "state.db").read_bytes() == b"\x00" * 4096
diff --git a/tests/hermes_cli/test_update_wedged_gateway.py b/tests/hermes_cli/test_update_wedged_gateway.py
index 71349e3e7a..ece8ec3a66 100644
--- a/tests/hermes_cli/test_update_wedged_gateway.py
+++ b/tests/hermes_cli/test_update_wedged_gateway.py
@@ -14,6 +14,7 @@ import json
 import os
 import shutil
 import socket
+import sys
 import tempfile
 import threading
 import time
@@ -30,6 +31,19 @@ from gateway.shutdown_watchdog import (
     write_loop_heartbeat,
 )
 
+# Native Windows exposes neither ``socket.AF_UNIX`` nor an asyncio UNIX
+# server, so the witness cases that create real socket nodes
+# (``_silent_socket_node``) or run the real producer
+# (``loop_heartbeat_forever``) cannot execute there. Only those cases are
+# skipped: the witness-absent contracts (mocked probes, file-only
+# heartbeats) are platform-independent and keep running on Windows, per
+# the Windows behavior pinned alongside the product-side guarantee.
+_NEEDS_UNIX_SOCKETS = pytest.mark.skipif(
+    sys.platform == "win32",
+    reason="requires real UNIX-domain sockets "
+    "(socket.AF_UNIX / asyncio.start_unix_server), unavailable on native Windows",
+)
+
 
 @pytest.fixture()
 def tmp_path():
@@ -482,6 +496,7 @@ class TestLoopTickWitness:
     witnesses agree the loop stopped scheduling.
     """
 
+    @_NEEDS_UNIX_SOCKETS
     def test_stalled_heartbeat_write_never_escalates_a_running_loop(
         self, tmp_path, monkeypatch
     ):
@@ -631,6 +646,7 @@ class TestLoopTickWitness:
             thread.join(timeout=5.0)
             assert not errors, errors
 
+    @_NEEDS_UNIX_SOCKETS
     def test_off_loop_completion_cannot_manufacture_fresh_liveness(self, tmp_path):
         """A write landing after the loop froze must not look alive.
 
@@ -650,6 +666,7 @@ class TestLoopTickWitness:
             == gateway_cli.GATEWAY_LOOP_UNKNOWN
         )
 
+    @_NEEDS_UNIX_SOCKETS
     def test_true_wedge_requires_sustained_witness_silence(self, tmp_path):
         """Stale file + armed socket silent across the whole window: WEDGED.
 
@@ -808,10 +825,16 @@ class TestLoopTickWitness:
             gateway_cli.probe_gateway_loop_liveness(pid, home=tmp_path)
             == gateway_cli.GATEWAY_LOOP_WEDGED
         )
-        # And a fresh legacy file stays safe even if a dead-listener node
-        # exists for the PID (leftover from a newer process): the silent
-        # socket denies ALIVE, and UNKNOWN never escalates — the drain path
-        # keeps the full budget either way.
+
+    @_NEEDS_UNIX_SOCKETS
+    def test_legacy_fresh_file_with_dead_node_is_unknown(self, tmp_path):
+        """A fresh legacy file stays safe under a dead-listener node.
+
+        A dead-listener node for the PID (leftover from a newer process):
+        the silent socket denies ALIVE, and UNKNOWN never escalates — the
+        drain path keeps the full budget either way.
+        """
+        pid = 4242
         _write_heartbeat(tmp_path, pid, age_s=5.0)
         _silent_socket_node(get_loop_tick_socket_path(tmp_path, pid))
         assert (
@@ -821,6 +844,7 @@ class TestLoopTickWitness:
             == gateway_cli.GATEWAY_LOOP_UNKNOWN
         )
 
+    @_NEEDS_UNIX_SOCKETS
     @pytest.mark.asyncio
     async def test_producer_rebinds_over_stale_socket_node(self, tmp_path):
         """A leftover node from a dead process must not disarm the witness.
@@ -862,6 +886,7 @@ class TestLoopTickWitness:
             except asyncio.CancelledError:
                 pass
 
+    @_NEEDS_UNIX_SOCKETS
     def test_transient_stall_below_wedge_budget_never_escalates(
         self, tmp_path, monkeypatch
     ):
@@ -914,6 +939,7 @@ class TestLoopTickWitness:
             state["thread"].join(timeout=5.0)
             assert not errors, errors
 
+    @_NEEDS_UNIX_SOCKETS
     def test_sustained_stop_above_wedge_budget_still_escalates(
         self, tmp_path
     ):
@@ -960,6 +986,113 @@ class TestLoopTickWitness:
             assert not errors, errors
 
 
+class TestLoopTickTcpWitness:
+    """Non-POSIX arm: the producer publishes ``loop_tick_tcp_port`` and the
+    consumer probes 127.0.0.1:<port> instead of the AF_UNIX node. The
+    two-witness contract must hold identically over TCP."""
+
+    @staticmethod
+    def _tcp_answerer():
+        """A loopback listener that answers b"1" — the armed, dispatching loop."""
+        srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        srv.bind(("127.0.0.1", 0))
+        srv.listen(8)
+        stop = threading.Event()
+
+        def serve():
+            srv.settimeout(0.1)
+            while not stop.is_set():
+                try:
+                    conn, _ = srv.accept()
+                except socket.timeout:
+                    continue
+                try:
+                    conn.sendall(b"1")
+                finally:
+                    conn.close()
+
+        thread = threading.Thread(target=serve, daemon=True)
+        thread.start()
+        return srv.getsockname()[1], stop, srv
+
+    @staticmethod
+    def _write_tcp_heartbeat(home, pid, port, age_s=0.0):
+        write_loop_heartbeat(
+            pid=pid,
+            home=home,
+            extra={"loop_tick_socket": True, "loop_tick_tcp_port": port},
+        )
+        if age_s:
+            path = get_loop_heartbeat_path(home)
+            stamp = time.time() - age_s
+            os.utime(path, (stamp, stamp))
+
+    def test_stale_file_with_answering_tcp_witness_is_alive(self, tmp_path):
+        """#90502 shape over TCP: a stalled write must not kill a live loop."""
+        port, stop, srv = self._tcp_answerer()
+        try:
+            self._write_tcp_heartbeat(tmp_path, 4343, port, age_s=600.0)
+            assert (
+                gateway_cli.probe_gateway_loop_liveness(4343, home=tmp_path)
+                == gateway_cli.GATEWAY_LOOP_ALIVE
+            )
+        finally:
+            stop.set()
+            srv.close()
+
+    def test_stale_file_with_silent_tcp_witness_is_wedged(self, tmp_path):
+        """Armed TCP witness that never answers across the window: WEDGED."""
+        silent = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        silent.bind(("127.0.0.1", 0))
+        silent.listen(1)  # accepts but never sends
+        try:
+            port = silent.getsockname()[1]
+            self._write_tcp_heartbeat(tmp_path, 4344, port, age_s=600.0)
+            assert (
+                gateway_cli.probe_gateway_loop_liveness(
+                    4344, home=tmp_path, tick_timeout=0.2, tick_gap_s=0.05
+                )
+                == gateway_cli.GATEWAY_LOOP_WEDGED
+            )
+        finally:
+            silent.close()
+
+    def test_fresh_file_with_silent_tcp_witness_is_unknown(self, tmp_path):
+        """Fresh file + silent TCP witness: an off-loop write landed after a
+        freeze — not proof of liveness, never destructive authority."""
+        silent = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        silent.bind(("127.0.0.1", 0))
+        silent.listen(1)
+        try:
+            port = silent.getsockname()[1]
+            self._write_tcp_heartbeat(tmp_path, 4345, port)
+            assert (
+                gateway_cli.probe_gateway_loop_liveness(
+                    4345, home=tmp_path, tick_timeout=0.2
+                )
+                == gateway_cli.GATEWAY_LOOP_UNKNOWN
+            )
+        finally:
+            silent.close()
+
+    def test_garbage_tcp_port_falls_back_to_socket_contract(self, tmp_path):
+        """A non-numeric port must not be treated as an armed witness."""
+        write_loop_heartbeat(
+            pid=4346,
+            home=tmp_path,
+            extra={"loop_tick_socket": False, "loop_tick_tcp_port": "nope"},
+        )
+        path = get_loop_heartbeat_path(tmp_path)
+        stamp = time.time() - 600.0
+        os.utime(path, (stamp, stamp))
+        # loop_tick_socket=False + no usable TCP port: witness could not be
+        # armed, staleness is not proof -> UNKNOWN, never WEDGED.
+        assert (
+            gateway_cli.probe_gateway_loop_liveness(4346, home=tmp_path)
+            == gateway_cli.GATEWAY_LOOP_UNKNOWN
+        )
+
+
 def test_default_probe_budget_stays_inside_query_tier():
     """The module doc pins the worst-case wedge-suspected probe at ~3.4s,
     'far inside the 10s query tier'. Assert the strike-count math so
diff --git a/tests/hermes_cli/test_web_server.py b/tests/hermes_cli/test_web_server.py
index e00fbd4031..9f7a6d810a 100644
--- a/tests/hermes_cli/test_web_server.py
+++ b/tests/hermes_cli/test_web_server.py
@@ -319,6 +319,29 @@ class TestWebServerEndpoints:
                 monitor.close()
             writer.close()
 
+    def test_get_sessions_transient_ioerr_is_503(self, monkeypatch):
+        """Busy store, not a gone store: the desktop keeps the list it has."""
+        import sqlite3
+
+        from hermes_cli import web_server
+
+        def boom(*_args, **_kwargs):
+            raise sqlite3.OperationalError("disk I/O error")
+
+        monkeypatch.setattr(web_server, "_open_session_db_for_profile", boom)
+        assert self.client.get("/api/sessions?limit=1&offset=0").status_code == 503
+
+    def test_get_sessions_non_transient_operational_error_is_500(self, monkeypatch):
+        import sqlite3
+
+        from hermes_cli import web_server
+
+        def boom(*_args, **_kwargs):
+            raise sqlite3.OperationalError("no such table: sessions")
+
+        monkeypatch.setattr(web_server, "_open_session_db_for_profile", boom)
+        assert self.client.get("/api/sessions?limit=1&offset=0").status_code == 500
+
     def test_get_status_loads_gateway_config_off_event_loop(self, monkeypatch):
         """Cold gateway config loading must not block the WebSocket loop.
 
diff --git a/tests/hermes_cli/test_web_server_profile_unification.py b/tests/hermes_cli/test_web_server_profile_unification.py
index f715af1f69..75a3f368f2 100644
--- a/tests/hermes_cli/test_web_server_profile_unification.py
+++ b/tests/hermes_cli/test_web_server_profile_unification.py
@@ -7,6 +7,7 @@ reads/writes land in the REQUESTED profile, the dashboard's own profile
 stays untouched, and the chat PTY env is scoped via HERMES_HOME.
 """
 import json
+from contextlib import contextmanager
 
 import pytest
 import yaml
@@ -353,6 +354,47 @@ class TestProfileScopedModel:
 
 
 
+    def test_model_options_uses_config_only_scope_for_selected_profile(
+        self, client, monkeypatch
+    ):
+        """Regression (#58576): _profile_scope holds _SKILLS_PROFILE_LOCK
+        across its body, and the payload build can block up to 15s on a
+        models.dev cache miss — a cold request would starve concurrent
+        /api/config on the same lock. The handler must scope the worker
+        through _config_profile_scope (contextvar only, no lock) for the
+        selected profile."""
+        import hermes_cli.web_server as web_server
+
+        scopes = []
+
+        @contextmanager
+        def _recording_config_scope(profile):
+            scopes.append(("config", profile))
+            yield object()
+
+        @contextmanager
+        def _recording_profile_scope(profile):
+            scopes.append(("full", profile))
+            yield object()
+
+        monkeypatch.setattr(
+            web_server, "_config_profile_scope", _recording_config_scope
+        )
+        monkeypatch.setattr(web_server, "_profile_scope", _recording_profile_scope)
+        monkeypatch.setattr(
+            "hermes_cli.inventory.load_picker_context", lambda: object()
+        )
+        monkeypatch.setattr(
+            "hermes_cli.inventory.build_model_options_payload",
+            lambda _ctx, **kwargs: {"providers": [], "model": "", "provider": ""},
+        )
+
+        resp = client.get("/api/model/options", params={"profile": "worker_beta"})
+        assert resp.status_code == 200
+        # Only the config-only scope may wrap the payload build; entering
+        # _profile_scope would hold _SKILLS_PROFILE_LOCK across it (#58576).
+        assert scopes == [("config", "worker_beta")]
+
     def test_model_info_unknown_profile_404(self, client, isolated_profiles):
         """Regression: the broad except used to convert the 404 into a 200
         with empty model info ("no model set" — silently wrong)."""
diff --git a/tests/hermes_cli/test_web_server_tts_lease.py b/tests/hermes_cli/test_web_server_tts_lease.py
new file mode 100644
index 0000000000..be32621997
--- /dev/null
+++ b/tests/hermes_cli/test_web_server_tts_lease.py
@@ -0,0 +1,157 @@
+"""``POST /api/audio/tts-lease`` — desktop speech toggles as TTS warm-up/release.
+
+The desktop's "Read replies aloud" and voice-conversation toggles call this so
+the backend can pre-load the configured TTS engine when speech is about to be
+needed and unload resident local models once no surface holds a lease.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def isolated_profiles(tmp_path, monkeypatch, _isolate_hermes_home):
+    from hermes_constants import get_hermes_home
+    from hermes_cli import profiles
+
+    default_home = get_hermes_home()
+    profiles_root = default_home / "profiles"
+    worker_home = profiles_root / "worker_beta"
+    for home in (default_home, worker_home):
+        home.mkdir(parents=True, exist_ok=True)
+        (home / "config.yaml").write_text("{}\n", encoding="utf-8")
+    (worker_home / ".env").write_text("", encoding="utf-8")
+
+    monkeypatch.setattr(profiles, "_get_default_hermes_home", lambda: default_home)
+    monkeypatch.setattr(profiles, "_get_profiles_root", lambda: profiles_root)
+    return {"default": default_home, "worker_beta": worker_home}
+
+
+@pytest.fixture
+def client(monkeypatch, isolated_profiles):
+    try:
+        from starlette.testclient import TestClient
+    except ImportError:
+        pytest.skip("fastapi/starlette not installed")
+
+    import hermes_state
+    from hermes_constants import get_hermes_home
+    from hermes_cli.web_server import app, _SESSION_HEADER_NAME, _SESSION_TOKEN
+
+    monkeypatch.setattr(hermes_state, "DEFAULT_DB_PATH", get_hermes_home() / "state.db")
+    c = TestClient(app)
+    c.headers[_SESSION_HEADER_NAME] = _SESSION_TOKEN
+    return c
+
+
+@pytest.fixture(autouse=True)
+def _clean_leases():
+    from tools import tts_tool
+
+    tts_tool._reset_tts_leases_for_tests()
+    for cache in tts_tool._LOCAL_TTS_MODEL_CACHES.values():
+        cache.clear()
+    yield
+    tts_tool._reset_tts_leases_for_tests()
+    for cache in tts_tool._LOCAL_TTS_MODEL_CACHES.values():
+        cache.clear()
+
+
+def test_active_acquires_and_warms(client, monkeypatch):
+    from tools import tts_tool
+
+    warmed = []
+    monkeypatch.setattr(
+        tts_tool,
+        "warm_tts_provider",
+        lambda cfg=None, provider=None: warmed.append(1) or {"provider": "piper", "warmed": True, "action": "loaded"},
+    )
+
+    resp = client.post("/api/audio/tts-lease", json={"lease": "desktop:read-aloud", "active": True})
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["ok"] is True
+    assert body["lease"] == "desktop:read-aloud"
+    assert body["active"] is True
+    assert body["leases"] == 1
+    assert body["action"] == "loaded"
+    assert warmed == [1]
+    assert tts_tool.tts_lease_holders() == ["desktop:read-aloud"]
+
+
+def test_inactive_releases_and_unloads_when_last(client, monkeypatch):
+    from tools import tts_tool
+
+    monkeypatch.setattr(tts_tool, "warm_tts_provider", lambda cfg=None, provider=None: {"action": "noop", "warmed": False, "provider": "piper"})
+    client.post("/api/audio/tts-lease", json={"lease": "desktop:read-aloud", "active": True})
+    client.post("/api/audio/tts-lease", json={"lease": "desktop:conversation:abc", "active": True})
+    tts_tool._piper_voice_cache["voice"] = object()
+
+    first = client.post("/api/audio/tts-lease", json={"lease": "desktop:read-aloud", "active": False}).json()
+    assert first["leases"] == 1
+    assert first["released"] == 0
+    assert len(tts_tool._piper_voice_cache) == 1
+
+    last = client.post("/api/audio/tts-lease", json={"lease": "desktop:conversation:abc", "active": False}).json()
+    assert last["leases"] == 0
+    assert last["released"] == 1
+    assert tts_tool._piper_voice_cache == {}
+
+
+def test_warm_failure_is_reported_not_an_http_error(client, monkeypatch):
+    from tools import tts_tool
+
+    def _boom(cfg=None, provider=None):
+        raise RuntimeError("engine exploded")
+
+    monkeypatch.setattr(tts_tool, "warm_tts_provider", _boom)
+    resp = client.post("/api/audio/tts-lease", json={"lease": "desktop:read-aloud", "active": True})
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["ok"] is True
+    assert body["action"] == "error"
+    assert "engine exploded" in body["error"]
+
+
+def test_blank_lease_rejected(client):
+    resp = client.post("/api/audio/tts-lease", json={"lease": "   ", "active": True})
+    assert resp.status_code == 400
+
+
+def test_active_default_true(client, monkeypatch):
+    from tools import tts_tool
+
+    monkeypatch.setattr(tts_tool, "warm_tts_provider", lambda cfg=None, provider=None: {"action": "noop", "warmed": False, "provider": "x"})
+    resp = client.post("/api/audio/tts-lease", json={"lease": "tui:x"})
+    assert resp.json()["active"] is True
+    assert tts_tool.tts_lease_holders() == ["tui:x"]
+
+
+def test_acquire_resolves_provider_inside_target_profile(client, isolated_profiles, monkeypatch):
+    """Warm-up must read the REQUESTING profile's tts config, like /api/audio/speak."""
+    import yaml
+    from tools import tts_tool
+
+    (isolated_profiles["worker_beta"] / "config.yaml").write_text(
+        yaml.safe_dump({"tts": {"provider": "kittentts"}}), encoding="utf-8"
+    )
+    seen = {}
+
+    def _fake_warm(cfg=None, provider=None):
+        from hermes_constants import get_hermes_home
+
+        seen["home"] = str(get_hermes_home())
+        seen["provider"] = tts_tool._get_provider(tts_tool._load_tts_config())
+        return {"action": "noop", "warmed": False, "provider": seen["provider"]}
+
+    monkeypatch.setattr(tts_tool, "warm_tts_provider", _fake_warm)
+    resp = client.post("/api/audio/tts-lease?profile=worker_beta", json={"lease": "desktop:read-aloud", "active": True})
+    assert resp.status_code == 200
+    assert seen["home"] == str(isolated_profiles["worker_beta"])
+    assert seen["provider"] == "kittentts"
+
+
+def test_unknown_profile_404(client):
+    resp = client.post("/api/audio/tts-lease?profile=ghost", json={"lease": "desktop:read-aloud", "active": True})
+    assert resp.status_code == 404
diff --git a/tests/hermes_cli/test_windows_gateway_job_teardown_48820.py b/tests/hermes_cli/test_windows_gateway_job_teardown_48820.py
new file mode 100644
index 0000000000..285f0b1b6c
--- /dev/null
+++ b/tests/hermes_cli/test_windows_gateway_job_teardown_48820.py
@@ -0,0 +1,189 @@
+"""Regression tests for #48820 (4th repro): job-object teardown killed the
+post-update respawned gateway silently, and the updater printed
+"✓ Restarting Windows gateway profile(s)" anyway.
+
+Two fixes under test:
+
+1. ``_spawn_gateway_restart_watcher``'s inlined watcher source must
+   (a) route the respawned gateway's stray stdout/stderr to
+       ``logs/gateway-stdio.log`` (it was ``DEVNULL`` — a gateway killed by
+       parent Job Object teardown left ZERO trace anywhere), and
+   (b) stamp ``_HERMES_GATEWAY_BREAKAWAY`` =1/0 on the respawn env exactly
+       like the canonical ``gateway_windows._spawn_detached``, so the
+       lifecycle/exit-diag records show whether the gateway escaped the
+       parent's Job Object.
+
+2. ``_resume_windows_gateways_after_update`` must verify a stable gateway
+   process actually exists (via ``gateway_windows._wait_for_gateway_ready``)
+   before printing the ✓ — a truthy launch return only proves the watcher
+   process was created, not that the respawned gateway survived the
+   updater's Job Object teardown.
+"""
+
+from unittest.mock import patch
+
+import pytest
+
+import hermes_cli.gateway as gateway
+import hermes_cli.gateway_windows as gateway_windows
+import hermes_cli.main as hm
+from hermes_cli._subprocess_compat import _WINDOWS_GATEWAY_BREAKAWAY_ENV
+from hermes_cli.update_cmd import _resume_windows_gateways_after_update
+
+
+# ---------------------------------------------------------------------------
+# 1. Watcher template contract
+# ---------------------------------------------------------------------------
+
+
+def _captured_watcher_source(monkeypatch) -> str:
+    """Spawn the watcher with a mocked Popen and return the inlined -c source."""
+    captured = {}
+
+    def fake_popen(argv, **kwargs):
+        captured["argv"] = argv
+        captured["kwargs"] = kwargs
+
+        class _P:
+            pid = 12345
+
+        return _P()
+
+    monkeypatch.setattr(gateway.subprocess, "Popen", fake_popen)
+    assert gateway._spawn_gateway_restart_watcher(
+        999999, ["python", "-m", "hermes_cli.main", "gateway", "run"]
+    )
+    argv = captured["argv"]
+    assert argv[1] == "-c"
+    return argv[2]
+
+
+class TestWatcherRespawnTemplate:
+    def test_respawn_stdio_routed_to_sidecar_log_not_devnull(self, monkeypatch):
+        """DEVNULL swallowed the dying gateway's last words (#48820 4th
+        repro: 'Zero trace anywhere ... because the watcher respawns with
+        stdout=DEVNULL, stderr=DEVNULL')."""
+        src = _captured_watcher_source(monkeypatch)
+        assert "gateway-stdio.log" in src, (
+            "watcher respawn must route stray stdout/stderr to the same "
+            "sidecar log _spawn_detached uses, so a gateway killed moments "
+            "after respawn leaves a trace"
+        )
+        # DEVNULL remains only as the fallback when the log dir is
+        # unavailable — the popen kwargs must not be hardwired to it.
+        assert '"stdout": _stdio_target' in src
+        assert '"stderr": _stdio_target' in src
+
+    def test_respawn_stamps_breakaway_state_like_spawn_detached(
+        self, monkeypatch
+    ):
+        """The respawned gateway must carry _HERMES_GATEWAY_BREAKAWAY=1 on
+        the primary (breakaway) spawn and =0 on the no-breakaway fallback,
+        mirroring gateway_windows._spawn_detached — without the stamp, a
+        job-teardown kill is indistinguishable from any other silent death
+        in the exit diagnostics."""
+        src = _captured_watcher_source(monkeypatch)
+        assert "_WINDOWS_GATEWAY_BREAKAWAY_ENV" in src
+        assert _WINDOWS_GATEWAY_BREAKAWAY_ENV == "_HERMES_GATEWAY_BREAKAWAY"
+        # Primary stamps "1", the OSError fallback stamps "0".
+        assert '_WINDOWS_GATEWAY_BREAKAWAY_ENV: "1"' in src
+        assert '_WINDOWS_GATEWAY_BREAKAWAY_ENV: "0"' in src
+
+    def test_respawn_source_compiles(self, monkeypatch):
+        """The inlined -c template is built via str.format over a
+        dedented literal — guard against brace/indentation regressions."""
+        src = _captured_watcher_source(monkeypatch)
+        compile(src, "<watcher>", "exec")
+
+    def test_watcher_fallback_retry_preserved(self, monkeypatch):
+        """The ERROR_ACCESS_DENIED retry without breakaway must survive."""
+        src = _captured_watcher_source(monkeypatch)
+        assert "windows_detach_flags_without_breakaway" in src
+
+
+# ---------------------------------------------------------------------------
+# 2. Post-update resume liveness gate
+# ---------------------------------------------------------------------------
+
+
+def _token(profiles: dict) -> dict:
+    return {
+        "resume_needed": True,
+        "profiles": profiles,
+        "unmapped_pids": [],
+        "unmapped": [],
+    }
+
+
+class TestResumeLivenessGate:
+    @pytest.fixture(autouse=True)
+    def _windows(self, monkeypatch):
+        monkeypatch.setattr(hm, "_is_windows", lambda: True)
+        monkeypatch.setattr(hm, "_refresh_windows_gateway_launchers", lambda: None)
+        monkeypatch.setattr(
+            gateway, "launch_detached_profile_gateway_restart", lambda *_a: True
+        )
+        monkeypatch.setattr(
+            gateway, "launch_detached_gateway_restart_by_cmdline", lambda *_a: True
+        )
+
+    def test_dead_respawn_fails_the_resume_instead_of_printing_check(
+        self, monkeypatch
+    ):
+        """No stable gateway after the relaunch → the resume raises (update
+        marked incomplete) instead of printing '✓ Restarting'. This is the
+        exact #48820 3rd/4th-repro hole: spawn succeeded, gateway died
+        within seconds, success was reported, platforms were offline for
+        12.5 hours."""
+        monkeypatch.setattr(
+            gateway_windows, "_wait_for_gateway_ready", lambda **_kw: []
+        )
+        token = _token({"default": 1111})
+        printed = []
+        with patch("builtins.print", side_effect=lambda *a, **k: printed.append(a)):
+            with pytest.raises(RuntimeError, match="not verified alive"):
+                _resume_windows_gateways_after_update(token)
+
+        text = " ".join(str(a) for a in printed)
+        assert "✓ Restarting" not in text
+        assert "could not be verified" in text
+        # The profile stays on the token so retry/reporting still sees it.
+        assert token["profiles"] == {"default": 1111}
+        assert token["resume_needed"] is True
+
+    def test_live_respawn_prints_check_and_writes_attestation(self, monkeypatch):
+        monkeypatch.setattr(
+            gateway_windows, "_wait_for_gateway_ready", lambda **_kw: [777]
+        )
+        attested = {}
+        monkeypatch.setattr(
+            gateway_windows,
+            "_write_start_attestation",
+            lambda pids, via: attested.update(pids=pids, via=via),
+        )
+        token = _token({"default": 1111})
+        printed = []
+        with patch("builtins.print", side_effect=lambda *a, **k: printed.append(a)):
+            _resume_windows_gateways_after_update(token)
+
+        text = " ".join(str(a) for a in printed)
+        assert "✓ Restarting" in text
+        assert attested == {"pids": [777], "via": "post-update relaunch"}
+        assert token["resume_needed"] is False
+
+    def test_liveness_poll_scans_all_profiles(self, monkeypatch):
+        """The resume relaunches the whole fleet; the verification must not
+        be scoped to the active profile."""
+        seen = {}
+
+        def fake_wait(**kwargs):
+            seen.update(kwargs)
+            return [777]
+
+        monkeypatch.setattr(gateway_windows, "_wait_for_gateway_ready", fake_wait)
+        monkeypatch.setattr(
+            gateway_windows, "_write_start_attestation", lambda *_a, **_kw: None
+        )
+        with patch("builtins.print"):
+            _resume_windows_gateways_after_update(_token({"work": 2222}))
+        assert seen.get("all_profiles") is True
diff --git a/tests/hermes_cli/test_windows_update_restart_reconciliation.py b/tests/hermes_cli/test_windows_update_restart_reconciliation.py
index 0de2d6bbd9..4b3279ab56 100644
--- a/tests/hermes_cli/test_windows_update_restart_reconciliation.py
+++ b/tests/hermes_cli/test_windows_update_restart_reconciliation.py
@@ -24,6 +24,7 @@ from unittest.mock import patch
 import pytest
 
 import hermes_cli.gateway as gateway
+import hermes_cli.gateway_windows as gateway_windows
 import hermes_cli.main as hm
 from hermes_cli.update_cmd import _resume_windows_gateways_after_update
 from hermes_cli.update_inventory import (
@@ -43,6 +44,21 @@ def _token(profiles: dict) -> dict:
     }
 
 
+@pytest.fixture(autouse=True)
+def _stub_post_relaunch_liveness(monkeypatch):
+    """The resume path now verifies a stable gateway process actually exists
+    before vouching for the relaunch (#48820 3rd/4th repro — a parent Job
+    Object killing the respawned gateway made '✓ Restarting' a lie). These
+    reconciliation tests exercise the token bookkeeping, not the liveness
+    poll, so stub it as 'gateway came up'."""
+    monkeypatch.setattr(
+        gateway_windows, "_wait_for_gateway_ready", lambda **_kw: [4242]
+    )
+    monkeypatch.setattr(
+        gateway_windows, "_write_start_attestation", lambda *_a, **_kw: None
+    )
+
+
 def test_resume_records_successfully_relaunched_profiles_on_the_token(monkeypatch):
     monkeypatch.setattr(hm, "_is_windows", lambda: True)
     monkeypatch.setattr(hm, "_refresh_windows_gateway_launchers", lambda: None)
diff --git a/tests/hermes_state/test_canonical_title_guard.py b/tests/hermes_state/test_canonical_title_guard.py
index b315ff785d..784825c25e 100644
--- a/tests/hermes_state/test_canonical_title_guard.py
+++ b/tests/hermes_state/test_canonical_title_guard.py
@@ -69,3 +69,43 @@ def test_auto_titler_still_cannot_touch_the_canonical_row(db):
     assert not db.set_auto_title(sid, "Chat about groceries", source=SessionDB.TITLE_SOURCE_LLM)
     row = db.get_session_by_title(SessionDB.CANONICAL_BOT_CHAT_TITLE)
     assert row and row["id"] == sid
+
+
+def test_auto_titler_cannot_rename_derived_canonical_bot_chat(db):
+    # #99517: the guard must be provenance-blind. A derived (rank 0) canonical
+    # title loses to an llm (rank 1) auto-title on precedence alone, so the
+    # identity check — not precedence — has to stop the write.
+    db.create_session("derived", source="desktop")
+    assert db._set_session_title(
+        "derived",
+        SessionDB.CANONICAL_BOT_CHAT_TITLE,
+        source=SessionDB.TITLE_SOURCE_DERIVED,
+    )
+    assert db.set_session_hidden("derived", True)
+
+    assert not db.set_auto_title(
+        "derived",
+        "Renamed by titler",
+        source=SessionDB.TITLE_SOURCE_LLM,
+    )
+    row = db.get_session("derived")
+    assert row["title"] == SessionDB.CANONICAL_BOT_CHAT_TITLE
+    assert row["title_source"] == SessionDB.TITLE_SOURCE_DERIVED
+
+
+def test_auto_titler_can_rename_visible_derived_bot_chat(db):
+    # Control: hidden is still the discriminator — a visible session that
+    # merely carries the text "Bot Chat" upgrades derived -> llm as usual.
+    db.create_session("visible", source="desktop")
+    assert db._set_session_title(
+        "visible",
+        SessionDB.CANONICAL_BOT_CHAT_TITLE,
+        source=SessionDB.TITLE_SOURCE_DERIVED,
+    )
+
+    assert db.set_auto_title(
+        "visible",
+        "Renamed by titler",
+        source=SessionDB.TITLE_SOURCE_LLM,
+    )
+    assert db.get_session("visible")["title"] == "Renamed by titler"
diff --git a/tests/hermes_state/test_deleted_wal_generation_guard.py b/tests/hermes_state/test_deleted_wal_generation_guard.py
new file mode 100644
index 0000000000..cdbd201220
--- /dev/null
+++ b/tests/hermes_state/test_deleted_wal_generation_guard.py
@@ -0,0 +1,198 @@
+"""Refuse SessionDB open/write when a deleted WAL generation is still held.
+
+A live writer that keeps the unlinked ``state.db-wal`` inode while a second
+opener would mint a fresh WAL is the split-brain that produces intermittent
+``database disk image is malformed`` / ``disk I/O error``. The store must
+fail closed on both the open and write paths instead of creating the second
+generation.
+"""
+
+import os
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+
+import hermes_state
+from hermes_state import (
+    DeletedWalGenerationError,
+    SessionDB,
+    classify_persistence_error,
+    iter_deleted_sqlite_sidecar_holders,
+    refuse_deleted_wal_generation,
+)
+
+
+@pytest.fixture
+def force_wal(monkeypatch):
+    """Pin WAL so this host's vulnerable SQLite still matches production topology."""
+    monkeypatch.setattr(
+        hermes_state, "is_sqlite_wal_reset_vulnerable", lambda version_info=None: False
+    )
+    monkeypatch.setattr(hermes_state, "resolve_journal_mode", lambda: "wal")
+
+
+def _make_db(path: Path, session_id: str, content: str) -> SessionDB:
+    db = SessionDB(db_path=path)
+    db.create_session(session_id, "cli")
+    db.append_message(session_id, role="user", content=content)
+    return db
+
+
+def _require_wal(db: SessionDB) -> Path:
+    if not db._wal_active:
+        db.close()
+        pytest.skip("WAL not active on this filesystem")
+    wal = Path(os.fspath(db.db_path) + "-wal")
+    if not wal.exists():
+        db.close()
+        pytest.skip("WAL sidecar missing after first write")
+    return wal
+
+
+def _unlink_sidecars(db_path: Path) -> None:
+    for suffix in ("-wal", "-shm"):
+        sidecar = Path(os.fspath(db_path) + suffix)
+        if sidecar.exists():
+            os.unlink(sidecar)
+
+
+def test_classify_deleted_wal_is_replaced_not_disk():
+    err = DeletedWalGenerationError(
+        "FATAL: a live process holds a deleted state.db-wal or state.db-shm "
+        "inode while the path names a different (or missing) generation."
+    )
+    assert classify_persistence_error(err) == "replaced"
+    assert classify_persistence_error(str(err)) == "replaced"
+
+
+def test_iter_holders_empty_on_non_linux(monkeypatch, tmp_path):
+    monkeypatch.setattr(hermes_state.sys, "platform", "win32")
+    assert iter_deleted_sqlite_sidecar_holders(tmp_path / "state.db") == []
+
+
+def test_clean_open_and_second_open_still_work(tmp_path, force_wal):
+    path = tmp_path / "state.db"
+    db = _make_db(path, "s1", "hello")
+    _require_wal(db)
+    db.close()
+    reopened = SessionDB(db_path=path)
+    try:
+        reopened.append_message("s1", role="user", content="second-open")
+        rows = reopened.get_messages("s1")
+        assert any(m["content"] == "second-open" for m in rows)
+    finally:
+        reopened.close()
+
+
+def test_delete_journal_two_writers_still_work(tmp_path, monkeypatch):
+    monkeypatch.setattr(hermes_state, "resolve_journal_mode", lambda: "delete")
+    monkeypatch.setattr(
+        hermes_state, "is_sqlite_wal_reset_vulnerable", lambda version_info=None: False
+    )
+    path = tmp_path / "state.db"
+    a = _make_db(path, "s", "from-a")
+    try:
+        assert not Path(os.fspath(path) + "-wal").exists()
+        b = SessionDB(db_path=path)
+        try:
+            b.append_message("s", role="user", content="from-b")
+            contents = [m["content"] for m in b.get_messages("s")]
+            assert "from-a" in contents
+            assert "from-b" in contents
+        finally:
+            b.close()
+    finally:
+        a.close()
+
+
+@pytest.mark.skipif(
+    not sys.platform.startswith("linux"),
+    reason="deleted-WAL /proc scan is Linux-only",
+)
+def test_iter_finds_self_after_wal_unlink(tmp_path, force_wal):
+    path = tmp_path / "state.db"
+    db = _make_db(path, "s", "held")
+    wal = _require_wal(db)
+    inode_before = wal.stat().st_ino
+    _unlink_sidecars(path)
+    holders = iter_deleted_sqlite_sidecar_holders(path)
+    try:
+        assert holders, "expected this process to still hold the deleted WAL inode"
+        assert any("(deleted)" in target for _pid, target in holders)
+        assert any(
+            target.removesuffix(" (deleted)").endswith(("-wal", "-shm"))
+            for _pid, target in holders
+        )
+        assert not wal.exists() or wal.stat().st_ino != inode_before
+    finally:
+        db.close()
+
+
+@pytest.mark.skipif(
+    not sys.platform.startswith("linux"),
+    reason="deleted-WAL /proc scan is Linux-only",
+)
+def test_second_sessiondb_open_refuses_and_does_not_mint_wal(tmp_path, force_wal):
+    path = tmp_path / "state.db"
+    writer = _make_db(path, "s", "before-unlink")
+    wal = _require_wal(writer)
+    inode_before = wal.stat().st_ino
+    _unlink_sidecars(path)
+    assert not wal.exists()
+
+    with pytest.raises(DeletedWalGenerationError, match="deleted state.db-wal"):
+        SessionDB(db_path=path)
+
+    assert not wal.exists(), "open must refuse before sqlite3.connect mints a WAL"
+    # If a WAL somehow reappeared it must not be a new generation.
+    if wal.exists():
+        assert wal.stat().st_ino == inode_before
+    writer.close()
+
+
+@pytest.mark.skipif(
+    not sys.platform.startswith("linux"),
+    reason="deleted-WAL write halt uses Linux unlink semantics",
+)
+def test_writer_halts_after_own_wal_unlinked(tmp_path, force_wal):
+    path = tmp_path / "state.db"
+    db = _make_db(path, "s", "before")
+    _require_wal(db)
+    recorded = db._db_sidecar_identity.get("-wal")
+    assert recorded is not None
+    _unlink_sidecars(path)
+
+    with pytest.raises(DeletedWalGenerationError, match="deleted state.db-wal"):
+        db.append_message("s", role="user", content="after-unlink")
+    assert db._db_wal_generation_lost is True
+
+    with pytest.raises(DeletedWalGenerationError):
+        db.append_message("s", role="user", content="second-after-halt")
+    db.close()
+
+
+@pytest.mark.skipif(
+    not sys.platform.startswith("linux"),
+    reason="deleted-WAL /proc scan is Linux-only",
+)
+def test_refuse_helper_raises_while_deleted_wal_held(tmp_path, force_wal):
+    path = tmp_path / "state.db"
+    raw = sqlite3.connect(str(path))
+    try:
+        raw.execute("PRAGMA journal_mode=WAL")
+        raw.execute("CREATE TABLE t (id INTEGER PRIMARY KEY, v TEXT)")
+        raw.execute("INSERT INTO t VALUES (1, 'held')")
+        raw.commit()
+        wal = Path(str(path) + "-wal")
+        assert wal.exists()
+        os.unlink(wal)
+        shm = Path(str(path) + "-shm")
+        if shm.exists():
+            os.unlink(shm)
+        with pytest.raises(DeletedWalGenerationError):
+            refuse_deleted_wal_generation(path)
+        assert not wal.exists()
+    finally:
+        raw.close()
diff --git a/tests/hermes_state/test_shared_session_db_registry.py b/tests/hermes_state/test_shared_session_db_registry.py
index ea279c9647..58d4837625 100644
--- a/tests/hermes_state/test_shared_session_db_registry.py
+++ b/tests/hermes_state/test_shared_session_db_registry.py
@@ -35,10 +35,12 @@ def _clean_registry():
     registry.close_all()
     registry._generations.clear()
     registry._retired.clear()
+    registry._opening.clear()
     yield
     registry.close_all()
     registry._generations.clear()
     registry._retired.clear()
+    registry._opening.clear()
 
 
 def _replace_file_preserving_schema(src: Path, dst: Path) -> None:
@@ -178,6 +180,127 @@ def stats_live_for(path: Path):
 
 
 class TestTeardownOutsideLock:
+    def test_concurrent_cold_acquire_opens_one_writer(self, tmp_path, monkeypatch):
+        """Concurrent first callers must not construct redundant writers.
+
+        Returning one winning object is not enough: every losing constructor
+        has already opened its own writable SQLite connection by then.  Hold
+        the first construction so peer callers overlap deterministically and
+        assert the registry single-flights the open itself.
+        """
+        db_path = tmp_path / "state.db"
+        callers = 6
+        ready = threading.Barrier(callers + 1)
+        release_open = threading.Event()
+        count_lock = threading.Lock()
+        open_calls = 0
+        results = []
+        errors = []
+
+        class _FakeDB:
+            def __init__(self, path):
+                self.db_path = path
+                self._shared_registry_owned = False
+                self.closed = False
+
+            def close(self):
+                self.closed = True
+
+        def _blocked_open(path):
+            nonlocal open_calls
+            with count_lock:
+                open_calls += 1
+            assert release_open.wait(5.0)
+            return _FakeDB(path)
+
+        monkeypatch.setattr(registry, "_open_session_db", _blocked_open)
+
+        def _acquire():
+            try:
+                ready.wait()
+                results.append(registry.acquire(db_path))
+            except BaseException as exc:  # pragma: no cover - failure path
+                errors.append(exc)
+
+        threads = [threading.Thread(target=_acquire) for _ in range(callers)]
+        for thread in threads:
+            thread.start()
+        ready.wait()
+        time.sleep(0.1)
+        release_open.set()
+        for thread in threads:
+            thread.join(10.0)
+            assert not thread.is_alive(), "concurrent acquire deadlocked"
+
+        assert errors == []
+        assert open_calls == 1
+        assert len({id(db) for db in results}) == 1
+        for db in results:
+            assert registry.release(db) is True
+
+    def test_waiter_retries_after_cold_open_failure(self, tmp_path, monkeypatch):
+        """A failed elected opener must wake a peer to retry the path."""
+        db_path = tmp_path / "state.db"
+        first_entered = threading.Event()
+        release_failure = threading.Event()
+        open_calls = 0
+        results = []
+        errors = []
+
+        class _FakeDB:
+            def __init__(self, path):
+                self.db_path = path
+                self._shared_registry_owned = False
+
+            def close(self):
+                pass
+
+        def _fail_then_open(path):
+            nonlocal open_calls
+            open_calls += 1
+            if open_calls == 1:
+                first_entered.set()
+                assert release_failure.wait(5.0)
+                raise OSError("transient open failure")
+            return _FakeDB(path)
+
+        monkeypatch.setattr(registry, "_open_session_db", _fail_then_open)
+
+        def _acquire():
+            try:
+                results.append(registry.acquire(db_path))
+            except BaseException as exc:
+                errors.append(exc)
+
+        first = threading.Thread(target=_acquire)
+        second = threading.Thread(target=_acquire)
+        first.start()
+        assert first_entered.wait(5.0)
+        second.start()
+        time.sleep(0.1)
+        release_failure.set()
+        first.join(10.0)
+        second.join(10.0)
+
+        assert not first.is_alive()
+        assert not second.is_alive()
+        assert open_calls == 2
+        assert len(errors) == 1
+        assert isinstance(errors[0], OSError)
+        assert len(results) == 1
+        assert registry.release(results[0]) is True
+
+    def test_equivalent_path_spellings_share_generation(self, tmp_path):
+        """Registry identity is the resolved file, not caller spelling."""
+        db_path = tmp_path / "nested" / "state.db"
+        equivalent = tmp_path / "nested" / ".." / "nested" / "state.db"
+
+        first = registry.acquire(db_path)
+        second = registry.acquire(equivalent)
+        assert first is second
+        assert registry.release(first) is True
+        assert registry.release(second) is True
+
     def test_final_release_does_not_hold_registry_lock_during_close(self, tmp_path, monkeypatch):
         """A final release's teardown (token-writer stop, WAL checkpoint,
         read-pool drain) must run OUTSIDE the registry lock — otherwise
@@ -231,10 +354,16 @@ class TestTeardownOutsideLock:
 
         def _worker(n):
             try:
-                for _ in range(20):
+                for index in range(20):
                     db = registry.acquire(db_path)
                     try:
-                        db.get_session("nonexistent")
+                        db.create_session(
+                            session_id=f"worker-{n}-{index}",
+                            source="test",
+                            model="test-model",
+                            model_config={},
+                            system_prompt=None,
+                        )
                     finally:
                         registry.release(db)
             except Exception as exc:  # pragma: no cover - failure path
@@ -248,6 +377,12 @@ class TestTeardownOutsideLock:
             assert not t.is_alive(), "worker deadlocked"
 
         assert errors == []
+        verifier = registry.acquire(db_path)
+        try:
+            with verifier._lock:
+                assert verifier._conn.execute("PRAGMA integrity_check").fetchone()[0] == "ok"
+        finally:
+            registry.release(verifier)
         stats = registry.stats()
         assert stats["live_generations"] == 0
         assert stats["retired_generations"] == 0
diff --git a/tests/hermes_state/test_state_db_corrupt_quarantine.py b/tests/hermes_state/test_state_db_corrupt_quarantine.py
new file mode 100644
index 0000000000..2acac22939
--- /dev/null
+++ b/tests/hermes_state/test_state_db_corrupt_quarantine.py
@@ -0,0 +1,236 @@
+"""Quarantine of a live SessionDB handle after structural (non-FTS) corruption.
+
+Field evidence (the #90837 lost/reordered-page-write class): a gateway kept
+retrying writes for ~50 minutes after ``gateway_routing`` reported
+``database disk image is malformed``; on SIGTERM the close-time
+``PRAGMA wal_checkpoint(PASSIVE)`` then wrote 15 pages to the wrong page
+numbers (page 1 received a ``messages_fts_trigram_data`` leaf) and the file
+stopped opening at all. Once structural corruption is observed on a handle
+the only safe policy is to stop touching the file.
+"""
+
+import sqlite3
+
+import pytest
+
+from hermes_state import SessionDB, StateDbCorruptError
+
+
+class _MalformedConn:
+    """Connection proxy whose every execute reports bare SQLITE_CORRUPT."""
+
+    def __init__(self, real_conn):
+        self._real = real_conn
+
+    def execute(self, *args, **kwargs):
+        raise sqlite3.DatabaseError("database disk image is malformed")
+
+    def __getattr__(self, name):
+        return getattr(self._real, name)
+
+
+class TestQuarantineAfterStructuralCorruption:
+    def test_structural_corruption_sets_sticky_flag_and_raises_typed(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        real_conn = db._conn
+        try:
+            db.create_session(session_id="s1", source="cli", model="test")
+            db._conn = _MalformedConn(real_conn)
+            with pytest.raises(StateDbCorruptError, match="malformed") as excinfo:
+                db.create_session(session_id="s2", source="cli", model="test")
+            assert isinstance(excinfo.value.__cause__, sqlite3.DatabaseError)
+            assert db._db_corrupt is True
+            # Structural damage must never be mistaken for FTS-scoped damage.
+            assert db._fts_stale is False
+        finally:
+            db._conn = real_conn
+            db.close()
+
+
+class _RecordingConn:
+    """Connection proxy that records every SQL text and delegates."""
+
+    def __init__(self, real_conn):
+        self._real = real_conn
+        self.recorded = []
+
+    def execute(self, sql, *args, **kwargs):
+        self.recorded.append(str(sql))
+        return self._real.execute(sql, *args, **kwargs)
+
+    def __getattr__(self, name):
+        return getattr(self._real, name)
+
+
+def _quarantined_db(tmp_path):
+    """A SessionDB whose first corrupt write already tripped the quarantine."""
+    db = SessionDB(db_path=tmp_path / "state.db")
+    real_conn = db._conn
+    db.create_session(session_id="s1", source="cli", model="test")
+    db._conn = _MalformedConn(real_conn)
+    with pytest.raises(StateDbCorruptError):
+        db.create_session(session_id="s2", source="cli", model="test")
+    db._conn = real_conn
+    assert db._db_corrupt is True
+    return db, real_conn
+
+
+class TestQuarantinedHandleStopsTouchingTheFile:
+    def test_subsequent_writes_fail_fast_without_touching_connection(self, tmp_path):
+        db, real_conn = _quarantined_db(tmp_path)
+        recorder = _RecordingConn(real_conn)
+        db._conn = recorder
+        try:
+            with pytest.raises(StateDbCorruptError):
+                db.create_session(session_id="s3", source="cli", model="test")
+            assert recorder.recorded == []
+        finally:
+            db._conn = real_conn
+            db.close()
+
+    def test_close_skips_wal_checkpoint_when_quarantined(self, tmp_path, caplog):
+        db, real_conn = _quarantined_db(tmp_path)
+        recorder = _RecordingConn(real_conn)
+        db._conn = recorder
+        with caplog.at_level("WARNING", logger="hermes_state"):
+            db.close()
+        assert not any("wal_checkpoint" in sql for sql in recorder.recorded)
+        assert db._conn is None
+        assert any(
+            "Skipping the close-time WAL checkpoint" in rec.getMessage()
+            and "hermes sessions recover" in rec.getMessage()
+            for rec in caplog.records
+        )
+
+    def test_close_disables_sqlite_internal_checkpoint_on_py312(self, tmp_path):
+        """Quarantine must also stop SQLite's own last-connection checkpoint.
+
+        Skipping the explicit PRAGMA is not enough: sqlite3.Connection.close()
+        runs an internal PASSIVE checkpoint and unlinks -wal/-shm unless
+        SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE is set (Connection.setconfig,
+        Python 3.12+). On 3.11 the switch is unavailable — skip there.
+        """
+        flag = getattr(sqlite3, "SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE", None)
+        db = SessionDB(db_path=tmp_path / "state.db")
+        if flag is None or not hasattr(db._conn, "setconfig"):
+            db.close()
+            pytest.skip("SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE needs Python 3.12+")
+        real_conn = db._conn
+        db.create_session(session_id="s1", source="cli", model="test")
+        assert real_conn.getconfig(flag) is False
+        db._conn = _MalformedConn(real_conn)
+        with pytest.raises(StateDbCorruptError):
+            db.create_session(session_id="s2", source="cli", model="test")
+        db._conn = real_conn
+        # _halt_db_corrupt armed the no-checkpoint-on-close switch.
+        assert real_conn.getconfig(flag) is True
+        db.close()
+
+    def test_reopen_after_close_refused_when_quarantined(self, tmp_path, monkeypatch):
+        from unittest.mock import MagicMock
+
+        db, real_conn = _quarantined_db(tmp_path)
+        db.close()
+        reopen = MagicMock()
+        monkeypatch.setattr("hermes_state._connect_tracked_db", reopen)
+        with pytest.raises(StateDbCorruptError, match="structural corruption"):
+            db.create_session(session_id="s4", source="cli", model="test")
+        reopen.assert_not_called()
+        # The read fallback after close() goes through the same reopen path.
+        with pytest.raises(StateDbCorruptError, match="refusing to reopen"):
+            db.get_session("s1")
+        reopen.assert_not_called()
+
+
+class TestQuarantineScope:
+    def test_fts_scoped_corruption_does_not_trip_flag(self, tmp_path):
+        """Corrupt FTS shadow tables keep the existing fail-open detach path."""
+        path = tmp_path / "state.db"
+        db = SessionDB(db_path=path)
+        db.create_session(session_id="s1", source="cli", model="test")
+        db.append_message("s1", role="user", content="hello world")
+        raw = sqlite3.connect(str(path))
+        raw.execute(
+            "UPDATE messages_fts_data SET block = X'DEADBEEFDEADBEEFDEADBEEFDEADBEEF'"
+        )
+        raw.commit()
+        raw.close()
+        try:
+            db.append_message("s1", role="user", content="healed append")
+            assert db._db_corrupt is False
+            assert db._fts_stale is True
+            assert db._fts_enabled is False
+        finally:
+            db.close()
+
+    def test_replaced_file_takes_precedence_over_corrupt(self, tmp_path):
+        import os
+
+        from hermes_state import StateDbReplacedError
+
+        live = tmp_path / "state.db"
+        other = tmp_path / "other.db"
+        db = SessionDB(db_path=live)
+        real_conn = db._conn
+        try:
+            db.create_session(session_id="s1", source="cli", model="test")
+            if db._db_file_identity is None:
+                pytest.skip("filesystem does not expose st_dev/st_ino")
+            alt = SessionDB(db_path=other)
+            alt.create_session("other", "cli")
+            alt.close()
+            os.replace(other, live)
+            db._conn = _MalformedConn(real_conn)
+            with pytest.raises(StateDbReplacedError):
+                db.create_session(session_id="s2", source="cli", model="test")
+            assert db._db_replaced is True
+            assert db._db_corrupt is False
+        finally:
+            db._conn = real_conn
+            db.close()
+
+    def test_classify_persistence_error_maps_quarantine_to_corrupt(self):
+        from hermes_state import _STATE_DB_CORRUPT_MSG, classify_persistence_error
+
+        assert classify_persistence_error(StateDbCorruptError("x")) == "corrupt"
+        # The stringified form (RPC boundaries) must classify the same way.
+        assert classify_persistence_error(_STATE_DB_CORRUPT_MSG) == "corrupt"
+
+
+@pytest.fixture
+def _clean_registry():
+    import hermes_state_registry as registry
+
+    registry.close_all()
+    registry._generations.clear()
+    registry._retired.clear()
+    yield registry
+    registry.close_all()
+    registry._generations.clear()
+    registry._retired.clear()
+
+
+class TestSharedRegistry:
+    def test_holders_share_quarantine_and_close_all_skips_checkpoint(
+        self, tmp_path, _clean_registry
+    ):
+        registry = _clean_registry
+        path = tmp_path / "state.db"
+        holder_a = registry.acquire(path)
+        holder_b = registry.acquire(path)
+        assert holder_a is holder_b
+        real_conn = holder_a._conn
+        holder_a.create_session(session_id="s1", source="cli", model="test")
+
+        holder_a._conn = _MalformedConn(real_conn)
+        with pytest.raises(StateDbCorruptError):
+            holder_a.create_session(session_id="s2", source="cli", model="test")
+        recorder = _RecordingConn(real_conn)
+        holder_b._conn = recorder
+
+        with pytest.raises(StateDbCorruptError):
+            holder_b.create_session(session_id="s3", source="cli", model="test")
+
+        registry.close_all()
+        assert not any("wal_checkpoint" in sql for sql in recorder.recorded)
+        assert holder_a._conn is None
diff --git a/tests/hermes_state/test_state_db_file_identity.py b/tests/hermes_state/test_state_db_file_identity.py
index 1877cf857a..3cc1ca1272 100644
--- a/tests/hermes_state/test_state_db_file_identity.py
+++ b/tests/hermes_state/test_state_db_file_identity.py
@@ -190,3 +190,110 @@ def test_divert_session_transcript_jsonl_appends(tmp_path, monkeypatch):
 def _stat_changed(path: Path, recorded) -> bool:
     st = os.stat(path)
     return (st.st_dev, st.st_ino) != recorded
+
+
+# ---------------------------------------------------------------------------
+# Lock safety of the identity probe itself (#100368 / howtocorrupt §2.2).
+#
+# _read_sqlite_application_id runs on EVERY write against the LIVE state.db.
+# Before the _pread_db_header fix it did open("rb")/read/close, and that
+# close() cancelled every POSIX advisory lock this process held on the file
+# — including the WAL-mode DMS shared lock of the writer connection.  These
+# tests measure the actual kernel lock table (/proc/locks), so they are
+# Linux-only; the hazard itself is POSIX-only.
+# ---------------------------------------------------------------------------
+
+def _posix_locks_on(paths):
+    """Set of (inode, type, mode, start, end) locks held by this pid."""
+    import sys as _sys
+    if not _sys.platform.startswith("linux"):
+        pytest.skip("lock-table probe requires /proc/locks (Linux)")
+    inodes = {}
+    for p in paths:
+        try:
+            inodes[os.stat(p).st_ino] = str(p)
+        except OSError:
+            continue
+    pid = os.getpid()
+    held = set()
+    for line in Path("/proc/locks").read_text().splitlines():
+        parts = line.split()
+        try:
+            lpid = int(parts[4])
+            ino = int(parts[5].split(":")[2])
+        except (IndexError, ValueError):
+            continue
+        if lpid == pid and ino in inodes:
+            held.add((ino, parts[1], parts[3], parts[6], parts[7]))
+    return held
+
+
+def test_identity_probe_does_not_cancel_live_posix_locks(tmp_path):
+    """The on-write header probe must not drop the writer's DMS lock."""
+    from hermes_state import _read_sqlite_application_id
+
+    live = tmp_path / "state.db"
+    db = _make_db(live, "probe-sess", "seed")
+    try:
+        sidecars = [live, Path(str(live) + "-shm")]
+        # Hold an open write transaction: that is when the connection holds
+        # POSIX range locks on the main db file, and exactly the state a
+        # concurrent _raise_if_db_replaced probe (another thread, same
+        # process) can destroy.
+        db._conn.execute("BEGIN IMMEDIATE")
+        db._conn.execute(
+            "UPDATE sessions SET source = source WHERE id = 'probe-sess'"
+        )
+        before = _posix_locks_on(sidecars)
+        assert before, "expected in-transaction WAL connection to hold POSIX locks"
+
+        for _ in range(3):
+            _read_sqlite_application_id(live)
+
+        after = _posix_locks_on(sidecars)
+        db._conn.rollback()
+        lost = before - after
+        assert not lost, (
+            "identity probe cancelled POSIX locks held by the live "
+            f"connection (howtocorrupt §2.2): {lost}"
+        )
+        # The decisive check: the WAL DMS shared lock on the MAIN db file
+        # must survive.  With the pre-fix open/read/close probe the close()
+        # cancels it (it is already gone by the time the connection has run
+        # its first identity check in __init__), leaving other processes
+        # free to treat this writer as dead and rerun WAL-index recovery
+        # underneath it.
+        db_ino = os.stat(live).st_ino
+        main_db_locks = {lk for lk in after if lk[0] == db_ino}
+        assert main_db_locks, (
+            "live writer connection holds no POSIX lock on state.db itself — "
+            "the WAL DMS lock was cancelled by a raw open/close probe "
+            "(howtocorrupt §2.2)"
+        )
+        # The connection must still be able to commit.
+        db.append_message("probe-sess", role="user", content="post-probe")
+    finally:
+        db.close()
+
+
+def test_identity_probe_still_detects_replacement_after_fd_cache(tmp_path):
+    """The cached-fd probe rebinds when the path names a new inode."""
+    from hermes_state import _read_sqlite_application_id
+
+    live = tmp_path / "state.db"
+    other = tmp_path / "other.db"
+    db = _make_db(live, "live-sess", "original")
+    _require_identity(db)
+    first = _read_sqlite_application_id(live)  # populates the fd cache
+    db.close()
+
+    alt = _make_db(other, "other-sess", "replacement")
+    alt.close()
+    os.replace(other, live)
+
+    second = _read_sqlite_application_id(live)
+    assert second is not None
+    assert second != first, (
+        "probe kept reading the retired inode instead of rebinding to the "
+        "replacement file"
+    )
diff --git a/tests/hermes_state/test_sweep_orphaned_sessions.py b/tests/hermes_state/test_sweep_orphaned_sessions.py
index 4554513f2f..8d56985d61 100644
--- a/tests/hermes_state/test_sweep_orphaned_sessions.py
+++ b/tests/hermes_state/test_sweep_orphaned_sessions.py
@@ -16,6 +16,7 @@ to be older than the cutoff:
   actively producing messages.
 """
 
+import threading
 import time
 
 import pytest
@@ -44,6 +45,15 @@ def _set_message_timestamps(db: SessionDB, session_id: str, ts: float) -> None:
     db._conn.commit()
 
 
+def _set_last_activity(db: SessionDB, session_id: str, ts: float) -> None:
+    conn = db._conn
+    assert conn is not None
+    conn.execute(
+        "UPDATE sessions SET last_activity_at = ? WHERE id = ?", (ts, session_id)
+    )
+    conn.commit()
+
+
 def _make_session(
     db: SessionDB,
     session_id: str,
@@ -99,6 +109,17 @@ class TestSweepOrphanedSessions:
         assert db.sweep_orphaned_sessions(max_idle_seconds=IDLE_S) == []
         assert db.get_session("active")["ended_at"] is None
 
+    def test_recent_heartbeat_spares_old_session(self, db):
+        """A turn heartbeat is activity even before its next message lands."""
+        stale = time.time() - 48 * 3600
+        _make_session(
+            db, "active-heartbeat", source="tui", started_at=stale, message_at=stale
+        )
+        _set_last_activity(db, "active-heartbeat", time.time())
+
+        assert db.sweep_orphaned_sessions(max_idle_seconds=IDLE_S) == []
+        assert db.get_session("active-heartbeat")["ended_at"] is None
+
     def test_fresh_session_with_old_copied_messages_spared(self, db):
         """Compression/branch children copy history — old message timestamps
         on a just-created row must not get it swept."""
@@ -163,9 +184,398 @@ class TestSweepOrphanedSessions:
         assert db.get_session("stale-cli")["end_reason"] == "startup_orphan_reap"
         assert db.get_session("stale-tui")["ended_at"] is None
 
+    def test_explicit_source_scope_spares_gateway_sessions(self, db):
+        stale = time.time() - 8 * 3600
+        _make_session(
+            db, "stale-cron", source="cron", started_at=stale, message_at=stale
+        )
+        for sid, session_key in (
+            ("keyed-telegram", "telegram:chat:1"),
+            ("unkeyed-telegram", None),
+        ):
+            db.create_session(sid, source="telegram", session_key=session_key)
+            db.append_message(sid, role="user", content="hello")
+            _set_message_timestamps(db, sid, stale)
+            _backdate_session(db, sid, stale)
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S, sources=("cron",)
+        ) == ["stale-cron"]
+        assert db.get_session("stale-cron")["end_reason"] == "startup_orphan_reap"
+        assert db.get_session("keyed-telegram")["ended_at"] is None
+        assert db.get_session("unkeyed-telegram")["ended_at"] is None
+
+    def test_automatic_source_scope_spares_pinned_session(self, db):
+        stale = time.time() - 8 * 3600
+        _make_session(
+            db, "pinned", source="cli", started_at=stale, message_at=stale
+        )
+        db.set_session_pinned("pinned", True)
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S,
+            sources=("cli",),
+            exclude_pinned=True,
+        ) == []
+        assert db.get_session("pinned")["ended_at"] is None
+
+    def test_live_turn_lease_on_compression_lineage_spares_session(self, db):
+        stale = time.time() - 8 * 3600
+        _make_session(db, "root", source="cli", started_at=stale, message_at=stale)
+        db.end_session("root", "compression")
+        db.create_session("tip", source="cli", parent_session_id="root")
+        db.append_message("tip", role="user", content="continued")
+        _set_message_timestamps(db, "tip", stale)
+        _backdate_session(db, "tip", stale)
+        assert db.try_acquire_session_turn_lease(
+            "tip", "external-turn", ttl_seconds=300
+        )
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S, sources=("cli",)
+        ) == []
+        assert db.get_session("tip")["ended_at"] is None
+
+    def test_active_compression_lock_spares_and_expiry_fences_owner(self, db):
+        stale = time.time() - 8 * 3600
+        _make_session(
+            db, "compressing", source="cli", started_at=stale, message_at=stale
+        )
+        assert db.try_acquire_compression_lock(
+            "compressing", "compressor", ttl_seconds=300
+        )
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S, sources=("cli",)
+        ) == []
+
+        conn = db._conn
+        assert conn is not None
+        conn.execute(
+            "UPDATE compression_locks SET expires_at = ? WHERE session_id = ?",
+            (time.time() - 1, "compressing"),
+        )
+        conn.commit()
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S, sources=("cli",)
+        ) == ["compressing"]
+        assert db.get_compression_lock_holder("compressing") is None
+        assert db.refresh_compression_lock("compressing", "compressor") is False
+
+    def test_expired_turn_lease_does_not_block_sweep(self, db):
+        stale = time.time() - 8 * 3600
+        _make_session(
+            db, "expired", source="cli", started_at=stale, message_at=stale
+        )
+        assert db.try_acquire_session_turn_lease(
+            "expired", "expired-turn", ttl_seconds=300
+        )
+        db._conn.execute(
+            "UPDATE session_turn_leases SET expires_at = ? WHERE conversation_id = ?",
+            (time.time() - 1, "expired"),
+        )
+        db._conn.commit()
+
+        assert db.sweep_orphaned_sessions(
+            max_idle_seconds=IDLE_S, sources=("cli",)
+        ) == ["expired"]
+        assert db.get_session("expired")["end_reason"] == "startup_orphan_reap"
+        assert db.refresh_session_turn_lease("expired", "expired-turn") is False
+
+    def test_auto_prune_closes_stale_state_owned_rows_but_spares_live_turns(self, db):
+        stale = time.time() - 100 * 86400
+        recent = time.time() - 86400
+        for sid, source in (
+            ("orphan", "cli"),
+            ("live-turn", "cli"),
+            ("stale-cron", "cron"),
+            ("runtime-owned-ui", "tui"),
+        ):
+            _make_session(db, sid, source=source, started_at=stale, message_at=stale)
+            _set_last_activity(db, sid, stale)
+        _make_session(
+            db,
+            "recent-orphan",
+            source="cli",
+            started_at=recent,
+            message_at=recent,
+        )
+        _set_last_activity(db, "recent-orphan", recent)
+        db.create_session(
+            "keyed", source="telegram", session_key="telegram:chat:1"
+        )
+        _backdate_session(db, "keyed", stale)
+        db.create_session("unkeyed-gateway", source="telegram")
+        _backdate_session(db, "unkeyed-gateway", stale)
+        _set_last_activity(db, "unkeyed-gateway", stale)
+        assert db.try_acquire_session_turn_lease(
+            "live-turn", "external-turn", ttl_seconds=300
+        )
+        db.register_backend_heartbeat(
+            backend_id="unrelated-dashboard",
+            pid=12345,
+            started_at=time.time(),
+            last_heartbeat=time.time(),
+        )
+
+        first = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert first["pruned"] == 0
+        assert db.get_session("orphan")["end_reason"] == "startup_orphan_reap"
+        assert db.get_session("stale-cron")["end_reason"] == "startup_orphan_reap"
+        assert db.get_session("live-turn")["ended_at"] is None
+        assert db.get_session("recent-orphan")["ended_at"] is None
+        assert db.get_session("runtime-owned-ui")["ended_at"] is None
+        assert db.get_session("keyed")["ended_at"] is None
+        assert db.get_session("unkeyed-gateway")["ended_at"] is None
+
+        second = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert second["pruned"] == 0
+        assert db.get_session("orphan") is not None
+        assert db.get_session("stale-cron") is not None
+
+        db._conn.execute(
+            "UPDATE sessions SET ended_at = ? WHERE id IN (?, ?)",
+            (stale, "orphan", "stale-cron"),
+        )
+        db._conn.commit()
+        third = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert third["pruned"] == 2
+        assert db.get_session("orphan") is None
+        assert db.get_session("stale-cron") is None
+
+    def test_failed_maintenance_marker_keeps_newly_swept_row_recoverable(
+        self, db, monkeypatch
+    ):
+        stale = time.time() - 100 * 86400
+        _make_session(
+            db,
+            "recoverable",
+            source="cli",
+            started_at=stale,
+            message_at=stale,
+        )
+        _set_last_activity(db, "recoverable", stale)
+        set_meta = db.set_meta
+        fail_once = True
+
+        def flaky_set_meta(key, value):
+            nonlocal fail_once
+            if key == "last_auto_prune" and fail_once:
+                fail_once = False
+                raise RuntimeError("injected marker failure")
+            return set_meta(key, value)
+
+        monkeypatch.setattr(db, "set_meta", flaky_set_meta)
+
+        first = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+        retry = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert first["error"] == "injected marker failure"
+        assert retry["pruned"] == 0
+        assert db.get_session("recoverable")["end_reason"] == "startup_orphan_reap"
+
+    def test_concurrent_auto_maintenance_preserves_the_recovery_window(
+        self, db, monkeypatch
+    ):
+        stale = time.time() - 100 * 86400
+        _make_session(db, "concurrent", source="cli", started_at=stale, message_at=stale)
+        _set_last_activity(db, "concurrent", stale)
+        peer = SessionDB(db.db_path)
+        read_barrier = threading.Barrier(2)
+        second_done = threading.Event()
+        release_first_prune = threading.Event()
+        errors = []
+        results = {}
+
+        for instance in (db, peer):
+            get_meta = instance.get_meta
+
+            def synchronized_get_meta(key, *, _get_meta=get_meta):
+                value = _get_meta(key)
+                if key == "last_auto_prune":
+                    try:
+                        read_barrier.wait(timeout=1)
+                    except threading.BrokenBarrierError:
+                        pass
+                return value
+
+            monkeypatch.setattr(instance, "get_meta", synchronized_get_meta)
+
+        prune_sessions = db.prune_sessions
+
+        def delayed_prune(*args, **kwargs):
+            assert release_first_prune.wait(timeout=5)
+            return prune_sessions(*args, **kwargs)
+
+        monkeypatch.setattr(db, "prune_sessions", delayed_prune)
+
+        def run(name, instance, *, done=None):
+            try:
+                results[name] = instance.maybe_auto_prune_and_vacuum(
+                    retention_days=90,
+                    min_interval_hours=24,
+                    vacuum=False,
+                )
+            except BaseException as exc:  # pragma: no cover - asserted below
+                errors.append(exc)
+            finally:
+                if done is not None:
+                    done.set()
+
+        first = threading.Thread(target=run, args=("first", db))
+        second = threading.Thread(
+            target=run, args=("second", peer), kwargs={"done": second_done}
+        )
+        try:
+            first.start()
+            second.start()
+            assert second_done.wait(timeout=5)
+            release_first_prune.set()
+        finally:
+            release_first_prune.set()
+            first.join(timeout=5)
+            second.join(timeout=5)
+            peer.close()
+
+        assert not first.is_alive()
+        assert not second.is_alive()
+        assert errors == []
+        assert sum(bool(result["skipped"]) for result in results.values()) == 1
+        assert sum(int(result["pruned"]) for result in results.values()) == 0
+        assert db.get_session("concurrent")["end_reason"] == "startup_orphan_reap"
+
+    def test_auto_prune_spares_compression_root_of_live_turn(self, db):
+        stale = time.time() - 100 * 86400
+        _make_session(db, "root", source="cli", started_at=stale, message_at=stale)
+        db.end_session("root", "compression")
+        db.create_session("tip", source="cli", parent_session_id="root")
+        db.append_message("tip", role="user", content="continued")
+        _set_message_timestamps(db, "tip", stale)
+        _backdate_session(db, "tip", stale)
+        _set_last_activity(db, "tip", stale)
+        assert db.try_acquire_session_turn_lease(
+            "tip", "external-turn", ttl_seconds=300
+        )
+
+        result = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert result["pruned"] == 0
+        assert db.get_session("root") is not None
+        assert db.get_session("tip")["ended_at"] is None
+
+    def test_auto_prune_spares_prior_sweep_row_with_new_turn_lease(self, db):
+        stale = time.time() - 100 * 86400
+        _make_session(db, "racy", source="cli", started_at=stale, message_at=stale)
+        _set_last_activity(db, "racy", stale)
+        db.end_session("racy", "startup_orphan_reap")
+        assert db.try_acquire_session_turn_lease(
+            "racy", "arriving-turn", ttl_seconds=300
+        )
+
+        result = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert result["pruned"] == 0
+        assert db.get_session("racy") is not None
+
+    def test_auto_prune_spares_prior_sweep_row_with_new_compression_lock(self, db):
+        stale = time.time() - 100 * 86400
+        _make_session(
+            db,
+            "racy-compression",
+            source="cli",
+            started_at=stale,
+            message_at=stale,
+        )
+        _set_last_activity(db, "racy-compression", stale)
+        db.end_session("racy-compression", "startup_orphan_reap")
+        assert db.try_acquire_compression_lock(
+            "racy-compression", "arriving-compressor", ttl_seconds=300
+        )
+
+        result = db.maybe_auto_prune_and_vacuum(
+            retention_days=90,
+            min_interval_hours=0,
+            vacuum=False,
+        )
+
+        assert result["pruned"] == 0
+        assert db.get_session("racy-compression") is not None
+
     def test_returns_empty_on_empty_db(self, db):
         assert db.sweep_orphaned_sessions(max_idle_seconds=IDLE_S) == []
 
+    def test_auto_prune_reports_closed_count_and_deletes_after_second_window(
+        self, db
+    ):
+        """#54189 end-to-end: leaky producers (cron/kanban/subagent) never set
+        ``ended_at``; pass 1 closes them (reported via ``closed``), pass 2 —
+        after a further retention window — deletes them, and a messaging row
+        is never touched by either pass."""
+        stale = time.time() - 200 * 86400
+        for sid, source in (
+            ("cron-0", "cron"),
+            ("kanban-1", "kanban"),
+            ("subagent-2", "subagent"),
+            ("telegram-3", "telegram"),
+        ):
+            _make_session(db, sid, source=source, started_at=stale, message_at=stale)
+            _set_last_activity(db, sid, stale)
+
+        first = db.maybe_auto_prune_and_vacuum(
+            retention_days=90, min_interval_hours=0, vacuum=False
+        )
+        assert first["closed"] == 3
+        assert first["pruned"] == 0
+        for sid in ("cron-0", "kanban-1", "subagent-2"):
+            assert db.get_session(sid)["end_reason"] == "startup_orphan_reap"
+        assert db.get_session("telegram-3")["ended_at"] is None
+
+        # Simulate the next maintenance pass after another retention window.
+        db._conn.execute(
+            "UPDATE sessions SET ended_at = ended_at - 91 * 86400 "
+            "WHERE end_reason = 'startup_orphan_reap'"
+        )
+        db._conn.commit()
+        second = db.maybe_auto_prune_and_vacuum(
+            retention_days=90, min_interval_hours=0, vacuum=False
+        )
+        assert second["closed"] == 0
+        assert second["pruned"] == 3
+        remaining = [r["id"] for r in db._conn.execute("SELECT id FROM sessions")]
+        assert remaining == ["telegram-3"]
+
     def test_zero_ttl_is_noop(self, db):
         stale = time.time() - 8 * 3600
         _make_session(db, "stale-tui", source="tui", started_at=stale, message_at=stale)
diff --git a/tests/plugins/dashboard_auth/test_opaque_bearer_not_unreachable.py b/tests/plugins/dashboard_auth/test_opaque_bearer_not_unreachable.py
new file mode 100644
index 0000000000..8b62421484
--- /dev/null
+++ b/tests/plugins/dashboard_auth/test_opaque_bearer_not_unreachable.py
@@ -0,0 +1,156 @@
+"""#94558 — a non-JWT bearer must not be reported as "Auth provider unreachable".
+
+Hosted agents answered every opaque/peer bearer on the gated API with a fast
+HTTP 503 ``{"detail": "Auth provider 'nous' unreachable"}`` while Portal was
+perfectly healthy: ``NousDashboardAuthProvider._verify_jwt`` folded *every*
+``PyJWKClient`` failure — including ``DecodeError('Not enough segments')`` for
+a token that is not a JWT at all — into ``ProviderError``. Only a transport
+failure fetching the JWKS is "unreachable"; anything else means "not my
+token" (``verify_session`` -> None -> 401 / next provider).
+
+Real ``NousDashboardAuthProvider`` + real ``SelfHostedOIDCProvider`` JWKS path,
+a real local HTTP JWKS server (reachable case) or a closed port (unreachable),
+and the real gated web_server app for the HTTP-level assertion.
+"""
+from __future__ import annotations
+
+import json
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+import jwt
+import pytest
+from starlette.testclient import TestClient
+
+from hermes_cli import web_server
+from hermes_cli.dashboard_auth import (
+    InvalidCodeError,
+    ProviderError,
+    classify_jwks_lookup_error,
+    clear_providers,
+    register_provider,
+)
+from hermes_cli.dashboard_auth.cookies import SESSION_AT_COOKIE
+import plugins.dashboard_auth.nous as nous_plugin
+
+OPAQUE_PEER_KEY = "hk_live_opaque_peer_key_0123456789abcdef"
+# Well-formed RS256 JWT header with an unknown kid, bogus payload/signature.
+FOREIGN_KID_JWT = "eyJhbGciOiJSUzI1NiIsImtpZCI6Inp6eiJ9.e30.sig"
+
+
+@pytest.fixture(scope="module")
+def empty_jwks_server():
+    """A reachable JWKS endpoint that knows no keys."""
+
+    class _H(BaseHTTPRequestHandler):
+        def do_GET(self):  # noqa: N802
+            self.send_response(200)
+            self.send_header("content-type", "application/json")
+            self.end_headers()
+            self.wfile.write(json.dumps({"keys": []}).encode())
+
+        def log_message(self, *a):  # silence
+            pass
+
+    srv = HTTPServer(("127.0.0.1", 0), _H)
+    t = threading.Thread(target=srv.serve_forever, daemon=True)
+    t.start()
+    yield f"http://127.0.0.1:{srv.server_address[1]}"
+    srv.shutdown()
+
+
+def _nous(portal_url: str) -> nous_plugin.NousDashboardAuthProvider:
+    return nous_plugin.NousDashboardAuthProvider(client_id="agent:test-instance", portal_url=portal_url)
+
+
+# ── classifier ────────────────────────────────────────────────────────────
+
+def test_classifier_maps_transport_failure_to_provider_error():
+    exc = jwt.PyJWKClientConnectionError("Fail to fetch data from the url")
+    assert isinstance(classify_jwks_lookup_error(exc), ProviderError)
+
+
+@pytest.mark.parametrize(
+    "exc",
+    [
+        jwt.DecodeError("Not enough segments"),
+        jwt.PyJWKSetError("The JWK Set did not contain any keys"),
+        jwt.InvalidTokenError("bad"),
+    ],
+)
+def test_classifier_maps_unverifiable_token_to_invalid_code(exc):
+    assert isinstance(classify_jwks_lookup_error(exc), InvalidCodeError)
+
+
+def test_classifier_keeps_bare_jwk_client_error_as_provider_fault():
+    assert isinstance(classify_jwks_lookup_error(jwt.PyJWKClientError("weird JWKS shape")), ProviderError)
+
+
+# ── Nous provider ─────────────────────────────────────────────────────────
+
+def test_opaque_bearer_with_healthy_portal_is_not_unreachable(empty_jwks_server):
+    provider = _nous(empty_jwks_server)
+    assert provider.verify_session(access_token=OPAQUE_PEER_KEY) is None
+
+
+def test_foreign_kid_jwt_with_healthy_portal_is_not_unreachable(empty_jwks_server):
+    provider = _nous(empty_jwks_server)
+    assert provider.verify_session(access_token=FOREIGN_KID_JWT) is None
+
+
+def test_real_jwt_with_unreachable_portal_still_raises_provider_error():
+    provider = _nous("http://127.0.0.1:9")  # discard port: connection refused
+    with pytest.raises(ProviderError):
+        provider.verify_session(access_token=FOREIGN_KID_JWT)
+
+
+def test_opaque_bearer_with_unreachable_portal_is_still_just_not_ours():
+    """No network call is even needed to know an opaque string is not our JWT."""
+    provider = _nous("http://127.0.0.1:9")
+    assert provider.verify_session(access_token=OPAQUE_PEER_KEY) is None
+
+
+# ── self-hosted OIDC provider (sibling site of the same hunk) ──────────────
+
+def test_self_hosted_provider_shares_the_classification(empty_jwks_server, monkeypatch):
+    import plugins.dashboard_auth.self_hosted as sh
+
+    provider = object.__new__(sh.SelfHostedOIDCProvider)
+    provider._jwks_client = None
+    provider._client_id = "hermes"
+    monkeypatch.setattr(
+        provider, "_get_discovery",
+        lambda: {"jwks_uri": f"{empty_jwks_server}/jwks", "issuer": empty_jwks_server},
+    )
+    with pytest.raises(InvalidCodeError):
+        provider._verify_id_token(OPAQUE_PEER_KEY)
+
+
+# ── HTTP level: the gated API answers 401, not 503 ────────────────────────
+
+@pytest.fixture
+def _gated_nous(empty_jwks_server):
+    clear_providers()
+    prev = {k: getattr(web_server.app.state, k, None) for k in ("bound_host", "bound_port", "auth_required")}
+    web_server.app.state.bound_host = "agent.example.test"
+    web_server.app.state.bound_port = 443
+    web_server.app.state.auth_required = True
+    register_provider(_nous(empty_jwks_server))
+    yield TestClient(web_server.app, base_url="https://agent.example.test")
+    clear_providers()
+    for k, v in prev.items():
+        setattr(web_server.app.state, k, v)
+
+
+def test_gated_api_rejects_opaque_bearer_with_401_not_503(_gated_nous):
+    r = _gated_nous.get("/api/auth/me", headers={"Authorization": f"Bearer {OPAQUE_PEER_KEY}"})
+    assert r.status_code != 503, r.text
+    assert r.status_code == 401
+    assert "unreachable" not in r.text.lower()
+
+
+def test_gated_api_rejects_opaque_cookie_with_401_not_503(_gated_nous):
+    _gated_nous.cookies.set(SESSION_AT_COOKIE, OPAQUE_PEER_KEY)
+    r = _gated_nous.get("/api/auth/me")
+    assert r.status_code != 503, r.text
+    assert "unreachable" not in r.text.lower()
diff --git a/tests/plugins/image_gen/test_meta_ai_provider.py b/tests/plugins/image_gen/test_meta_ai_provider.py
new file mode 100644
index 0000000000..3ff129a539
--- /dev/null
+++ b/tests/plugins/image_gen/test_meta_ai_provider.py
@@ -0,0 +1,316 @@
+"""Tests for the bundled Meta Model API image_gen plugin (muse-image)."""
+
+from __future__ import annotations
+
+import importlib
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+# The plugin directory uses a hyphen, which is not a valid Python identifier
+# for the dotted-import form. Load it via importlib so tests don't need to
+# touch sys.path or rename the directory.
+meta_plugin = importlib.import_module("plugins.image_gen.meta-ai")
+
+
+# 1×1 transparent PNG — valid bytes for save_b64_image()
+_PNG_HEX = (
+    "89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c4"
+    "890000000d49444154789c6300010000000500010d0a2db40000000049454e44"
+    "ae426082"
+)
+
+
+def _b64_png() -> str:
+    import base64
+
+    return base64.b64encode(bytes.fromhex(_PNG_HEX)).decode()
+
+
+def _fake_response(*, b64=None, url=None, revised_prompt=None):
+    item = SimpleNamespace(b64_json=b64, url=url, revised_prompt=revised_prompt)
+    return SimpleNamespace(data=[item])
+
+
+@pytest.fixture(autouse=True)
+def _tmp_hermes_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    # Clear every auth + override env var so tests start from a clean slate.
+    for env in (
+        "MODEL_API_KEY",
+        "META_API_KEY",
+        "META_MODEL_API_KEY",
+        "META_BASE_URL",
+        "META_IMAGE_MODEL",
+    ):
+        monkeypatch.delenv(env, raising=False)
+    yield tmp_path
+
+
+@pytest.fixture
+def provider(monkeypatch):
+    monkeypatch.setenv("META_MODEL_API_KEY", "test-key")
+    return meta_plugin.MetaImageGenProvider()
+
+
+def _patched_openai(fake_client: MagicMock):
+    fake_openai = MagicMock()
+    fake_openai.OpenAI.return_value = fake_client
+    return patch.dict("sys.modules", {"openai": fake_openai})
+
+
+# ── Metadata ────────────────────────────────────────────────────────────────
+
+
+class TestMetadata:
+    def test_name(self, provider):
+        assert provider.name == "meta-ai"
+
+    def test_display_name(self, provider):
+        assert provider.display_name == "Meta Model API"
+
+    def test_default_model(self, provider):
+        assert provider.default_model() == "muse-image-1.0"
+
+    def test_list_models(self, provider):
+        ids = [m["id"] for m in provider.list_models()]
+        assert ids == ["muse-image-1.0"]
+
+    def test_catalog_entries_have_display_speed_strengths_price(self, provider):
+        for entry in provider.list_models():
+            assert entry["display"]
+            assert entry["speed"]
+            assert entry["strengths"]
+            assert entry["price"]
+
+    def test_text_only_capabilities(self, provider):
+        caps = provider.capabilities()
+        assert caps["modalities"] == ["text"]
+        assert caps["max_reference_images"] == 0
+
+
+# ── Availability ────────────────────────────────────────────────────────────
+
+
+class TestAvailability:
+    def test_no_api_key_unavailable(self):
+        assert meta_plugin.MetaImageGenProvider().is_available() is False
+
+    @pytest.mark.parametrize(
+        "env", ["MODEL_API_KEY", "META_API_KEY", "META_MODEL_API_KEY"]
+    )
+    def test_each_auth_alias_makes_available(self, monkeypatch, env):
+        monkeypatch.setenv(env, "test")
+        assert meta_plugin.MetaImageGenProvider().is_available() is True
+
+
+# ── Auth / base-url resolution ────────────────────────────────────────────────
+
+
+class TestResolution:
+    def test_api_key_priority_order(self, monkeypatch):
+        # MODEL_API_KEY wins over the aliases.
+        monkeypatch.setenv("META_MODEL_API_KEY", "third")
+        monkeypatch.setenv("META_API_KEY", "second")
+        monkeypatch.setenv("MODEL_API_KEY", "first")
+        assert meta_plugin._resolve_api_key() == "first"
+
+    def test_default_base_url(self):
+        assert meta_plugin._resolve_base_url() == "https://api.meta.ai/v1"
+
+    def test_base_url_override(self, monkeypatch):
+        monkeypatch.setenv("META_BASE_URL", "https://proxy.internal/v1")
+        assert meta_plugin._resolve_base_url() == "https://proxy.internal/v1"
+
+
+# ── Model resolution ──────────────────────────────────────────────────────────
+
+
+class TestModelResolution:
+    def test_default(self):
+        model_id, _meta = meta_plugin._resolve_model()
+        assert model_id == "muse-image-1.0"
+
+    def test_env_var_override_ignores_unknown(self, monkeypatch):
+        monkeypatch.setenv("META_IMAGE_MODEL", "not-a-real-model")
+        model_id, _meta = meta_plugin._resolve_model()
+        # Unknown id is ignored; falls through to the default.
+        assert model_id == "muse-image-1.0"
+
+    def test_caller_model_kwarg_wins(self, monkeypatch):
+        # The dispatcher forwards top-level image_gen.model as the `model`
+        # kwarg; it must beat the env override (#55893 bug class).
+        monkeypatch.setitem(
+            meta_plugin._MODELS,
+            "muse-image-test",
+            dict(meta_plugin._MODELS["muse-image-1.0"]),
+        )
+        monkeypatch.setenv("META_IMAGE_MODEL", "muse-image-1.0")
+        model_id, _meta = meta_plugin._resolve_model("muse-image-test")
+        assert model_id == "muse-image-test"
+
+    def test_caller_model_unknown_falls_through(self):
+        model_id, _meta = meta_plugin._resolve_model("not-a-real-model")
+        assert model_id == "muse-image-1.0"
+
+
+# ── Generate ──────────────────────────────────────────────────────────────────
+
+
+class TestGenerate:
+    def test_model_kwarg_reaches_payload(self, provider, monkeypatch):
+        monkeypatch.setitem(
+            meta_plugin._MODELS,
+            "muse-image-test",
+            dict(meta_plugin._MODELS["muse-image-1.0"]),
+        )
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+        with _patched_openai(fake_client):
+            result = provider.generate("a cat", model="muse-image-test")
+        assert result["success"] is True
+        assert (
+            fake_client.images.generate.call_args.kwargs["model"] == "muse-image-test"
+        )
+
+    def test_badge_is_standard_paid(self, provider):
+        assert provider.get_setup_schema()["badge"] == "paid"
+
+    def test_empty_prompt_rejected(self, provider):
+        result = provider.generate("", aspect_ratio="square")
+        assert result["success"] is False
+        assert result["error_type"] == "invalid_argument"
+        assert result["provider"] == "meta-ai"
+
+    def test_missing_api_key(self):
+        result = meta_plugin.MetaImageGenProvider().generate("a cat")
+        assert result["success"] is False
+        assert result["error_type"] == "auth_required"
+
+    def test_b64_saves_to_cache(self, provider, tmp_path):
+        png_bytes = bytes.fromhex(_PNG_HEX)
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+
+        with _patched_openai(fake_client):
+            result = provider.generate("a cat", aspect_ratio="landscape")
+
+        assert result["success"] is True
+        assert result["model"] == "muse-image-1.0"
+        assert result["aspect_ratio"] == "landscape"
+        assert result["provider"] == "meta-ai"
+        assert result["modality"] == "text"
+
+        saved = Path(result["image"])
+        assert saved.exists()
+        assert saved.parent == tmp_path / "cache" / "images"
+        assert saved.read_bytes() == png_bytes
+
+        call_kwargs = fake_client.images.generate.call_args.kwargs
+        assert call_kwargs["model"] == "muse-image-1.0"
+        assert call_kwargs["size"] == "1536x1024"
+        assert call_kwargs["n"] == 1
+
+    def test_client_uses_meta_base_url(self, provider):
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+        fake_openai = MagicMock()
+        fake_openai.OpenAI.return_value = fake_client
+
+        with patch.dict("sys.modules", {"openai": fake_openai}):
+            provider.generate("a cat")
+
+        assert (
+            fake_openai.OpenAI.call_args.kwargs["base_url"] == "https://api.meta.ai/v1"
+        )
+
+    def test_base_url_override_reaches_client(self, provider, monkeypatch):
+        monkeypatch.setenv("META_BASE_URL", "https://proxy.internal/v1")
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+        fake_openai = MagicMock()
+        fake_openai.OpenAI.return_value = fake_client
+
+        with patch.dict("sys.modules", {"openai": fake_openai}):
+            provider.generate("a cat")
+
+        assert (
+            fake_openai.OpenAI.call_args.kwargs["base_url"]
+            == "https://proxy.internal/v1"
+        )
+
+    @pytest.mark.parametrize(
+        "aspect,expected_size",
+        [
+            ("landscape", "1536x1024"),
+            ("square", "1024x1024"),
+            ("portrait", "1024x1536"),
+        ],
+    )
+    def test_aspect_ratio_mapping(self, provider, aspect, expected_size):
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+
+        with _patched_openai(fake_client):
+            provider.generate("a cat", aspect_ratio=aspect)
+
+        assert fake_client.images.generate.call_args.kwargs["size"] == expected_size
+
+    def test_revised_prompt_passed_through(self, provider):
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(
+            b64=_b64_png(),
+            revised_prompt="A photo of a cat",
+        )
+
+        with _patched_openai(fake_client):
+            result = provider.generate("a cat")
+
+        assert result["revised_prompt"] == "A photo of a cat"
+
+    def test_url_response_is_cached_locally(self, provider):
+        """A URL response is materialized locally (symmetric to the openai/xai
+        providers) so ephemeral signed URLs can't expire mid-flight."""
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(
+            b64=None,
+            url="https://example.com/img.webp",
+        )
+
+        with (
+            _patched_openai(fake_client),
+            patch.object(
+                meta_plugin,
+                "save_url_image",
+                return_value=Path("/tmp/meta_20260524_000000_deadbeef.webp"),
+            ) as mock_save_url,
+        ):
+            result = provider.generate("a cat")
+
+        assert result["success"] is True
+        assert result["image"].startswith("/")
+        assert "example.com" not in result["image"]
+        mock_save_url.assert_called_once()
+
+    def test_empty_response_errors(self, provider):
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=None, url=None)
+
+        with _patched_openai(fake_client):
+            result = provider.generate("a cat")
+
+        assert result["success"] is False
+        assert result["error_type"] == "empty_response"
+
+    def test_api_error_surfaced(self, provider):
+        fake_client = MagicMock()
+        fake_client.images.generate.side_effect = RuntimeError("boom")
+
+        with _patched_openai(fake_client):
+            result = provider.generate("a cat")
+
+        assert result["success"] is False
+        assert result["error_type"] == "api_error"
+        assert "boom" in result["error"]
diff --git a/tests/plugins/memory/test_hindsight_provider.py b/tests/plugins/memory/test_hindsight_provider.py
index 475e3adb37..b48e2eb383 100644
--- a/tests/plugins/memory/test_hindsight_provider.py
+++ b/tests/plugins/memory/test_hindsight_provider.py
@@ -10,6 +10,7 @@ import os
 import re
 import stat
 import sys
+import threading
 import time
 from datetime import datetime
 from pathlib import Path
@@ -32,6 +33,7 @@ from plugins.memory.hindsight import (
     _normalize_retain_tags,
     _resolve_bank_id_template,
     _sanitize_bank_segment,
+    _WRITER_SENTINEL,
 )
 
 
@@ -1643,3 +1645,68 @@ class TestClientAutoUpgradeRoutesThroughLazyDeps:
         assert len(calls) == 1  # attempted exactly once, init still completed
         assert any("runtime installs are disabled" in r.getMessage()
                    for r in caplog.records)
+
+
+
+class TestMultiplexBackgroundScope:
+    """Under multiplex_profiles get_secret fails closed on an unscoped thread;
+    the writer / daemon-start threads are spawned from a scoped context and
+    must carry it along (#92608, #94933)."""
+
+    @pytest.fixture()
+    def scoped_embedded(self, tmp_path, monkeypatch):
+        from agent.secret_scope import (
+            build_profile_secret_scope, reset_secret_scope, set_multiplex_active, set_secret_scope,
+        )
+        from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+        created = []
+
+        class FakeHindsightEmbedded:
+            def __init__(self, **kwargs):
+                created.append(kwargs["llm_api_key"])
+                self._manager = SimpleNamespace(is_running=lambda profile: False, stop=lambda profile: None)
+                self._ensure_started = lambda: None
+
+        dem = SimpleNamespace(console=None)
+        monkeypatch.setitem(sys.modules, "hindsight", SimpleNamespace(HindsightEmbedded=FakeHindsightEmbedded))
+        monkeypatch.setitem(sys.modules, "hindsight_embed", SimpleNamespace(daemon_embed_manager=dem))
+        monkeypatch.setitem(sys.modules, "hindsight_embed.daemon_embed_manager", dem)
+        monkeypatch.setattr("plugins.memory.hindsight._check_local_runtime", lambda: (True, ""))
+
+        home = tmp_path / "profiles" / "p1"
+        (home / "hindsight").mkdir(parents=True)
+        (home / ".env").write_text("HINDSIGHT_LLM_API_KEY=p1-secret\n")
+        (home / "hindsight" / "config.json").write_text(json.dumps(
+            {"mode": "local_embedded", "llm_provider": "openai", "llm_model": "m", "memory_mode": "hybrid"}
+        ))
+        # Enter the profile scope the way gateway _profile_runtime_scope does.
+        set_multiplex_active(True)
+        monkeypatch.setattr("plugins.memory.hindsight.get_hermes_home", lambda: home)
+        home_tok = set_hermes_home_override(str(home))
+        scope_tok = set_secret_scope(build_profile_secret_scope(home))
+        yield created, home
+        set_multiplex_active(False)
+        reset_secret_scope(scope_tok)
+        reset_hermes_home_override(home_tok)
+
+    def test_writer_thread_resolves_profile_secret(self, scoped_embedded):
+        created, home = scoped_embedded
+        p = HindsightMemoryProvider()
+        p._mode = "local_embedded"
+        p._config = {"profile": "hermes", "llm_provider": "openai", "llm_model": "m"}
+        p._ensure_writer()
+        p._retain_queue.put(p._get_client)   # real body: get_secret(HINDSIGHT_LLM_API_KEY)
+        p._retain_queue.put(_WRITER_SENTINEL)
+        p._writer_thread.join(timeout=5)
+        assert created == ["p1-secret"]
+
+    def test_daemon_start_thread_resolves_profile_secret(self, scoped_embedded):
+        created, home = scoped_embedded
+        p = HindsightMemoryProvider()
+        p.initialize(session_id="s1", hermes_home=str(home), platform="cli")
+        for t in threading.enumerate():
+            if t.name == "hindsight-daemon-start":
+                t.join(timeout=5)
+        assert created == ["p1-secret"]
+        assert "Daemon started successfully" in (home / "logs" / "hindsight-embed.log").read_text()
diff --git a/tests/plugins/platforms/photon/test_multiplex_profile_scope.py b/tests/plugins/platforms/photon/test_multiplex_profile_scope.py
new file mode 100644
index 0000000000..5b32327b1e
--- /dev/null
+++ b/tests/plugins/platforms/photon/test_multiplex_profile_scope.py
@@ -0,0 +1,122 @@
+"""Multiplex secondary-profile scope tests for the Photon adapter + auth module.
+
+__init__'s project_id, check_requirements'/validate_config's node_bin/
+project_id, _env_enablement's home_channel, _reactions_enabled's
+PHOTON_REACTIONS, __init__'s require_mention, and _standalone_send's
+sidecar_port, plus auth.py's load_project_credentials/
+load_dashboard_project_id, all previously read raw os.getenv
+unconditionally (only PHOTON_PROJECT_SECRET/PHOTON_SIDECAR_TOKEN were
+already scoped via _get_scoped_secret). Under gateway.multiplex_profiles,
+os.environ holds the DEFAULT profile's YAML-to-env bridge output -- a
+secondary profile with its own (different or absent) Photon config could
+silently authenticate against the default profile's Spectrum project, or
+have its mention-gating/reaction behavior driven by the default profile's
+settings.
+
+Notably project_id was a stronger variant of the bug (like the IRC fix in
+this series): __init__'s original
+`os.getenv("PHOTON_PROJECT_ID") or extra.get("project_id") or stored_id`
+ordering let a raw env read override even an explicitly configured
+config.yaml extra.
+
+Mirrors the LINE/DingTalk/IRC/Mattermost fix for #98738.
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+import pytest
+
+from gateway.config import PlatformConfig
+from plugins.platforms.photon import auth as photon_auth
+from plugins.platforms.photon.adapter import PhotonAdapter
+
+_PHOTON_ENV = (
+    "PHOTON_PROJECT_ID",
+    "PHOTON_PROJECT_SECRET",
+    "PHOTON_DASHBOARD_PROJECT_ID",
+    "PHOTON_REQUIRE_MENTION",
+    "PHOTON_REACTIONS",
+    "PHOTON_HOME_CHANNEL",
+    "PHOTON_HOME_CHANNEL_NAME",
+    "PHOTON_SIDECAR_PORT",
+)
+
+
+@pytest.fixture
+def tmp_hermes_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+    """Isolate from the real ~/.hermes/auth.json fallback in load_project_credentials()."""
+    home = tmp_path / "hermes"
+    home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    for key in _PHOTON_ENV:
+        monkeypatch.delenv(key, raising=False)
+    yield home
+    for key in _PHOTON_ENV:
+        os.environ.pop(key, None)
+
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("PHOTON_PROJECT_ID", "default-project-id")
+    monkeypatch.setenv("PHOTON_PROJECT_SECRET", "default-project-secret")
+    monkeypatch.setenv("PHOTON_REQUIRE_MENTION", "true")
+    monkeypatch.setenv("PHOTON_REACTIONS", "true")
+
+
+class TestAuthMultiplexProfileScope:
+    """load_project_credentials / load_dashboard_project_id (auth.py)."""
+
+    def test_scoped_miss_does_not_leak_default_project_id(
+        self, tmp_hermes_home, multiplex_scope, default_profile_env
+    ):
+        multiplex_scope({"SOMETHING_ELSE": "x"})
+        sid, secret = photon_auth.load_project_credentials()
+        assert sid is None
+        assert secret is None
+        adapter = PhotonAdapter(PlatformConfig(enabled=True, extra={}))
+        assert adapter._project_id == ""
+        assert adapter.require_mention is False
+        assert adapter._reactions_enabled() is False
+
+class TestAdapterMultiplexProfileScope:
+    """PhotonAdapter.__init__ / _env_enablement / _reactions_enabled (adapter.py)."""
+
+    def test_secondary_extra_wins_over_default_profile_env(
+        self, tmp_hermes_home, multiplex_scope, default_profile_env
+    ):
+        """A secondary profile's own config.yaml extra project_id must be
+        authoritative -- not the default profile's bridged env value. The
+        pre-fix ordering (raw os.getenv checked BEFORE extra) meant even an
+        explicit extra config was silently overridden."""
+        multiplex_scope({"PHOTON_PROJECT_SECRET": "profile-secret"})
+        cfg = PlatformConfig(
+            enabled=True,
+            extra={"project_id": "profile-project-id"},
+        )
+        adapter = PhotonAdapter(cfg)
+        assert adapter._project_id == "profile-project-id"
+
diff --git a/tests/plugins/test_a2a_plugin.py b/tests/plugins/test_a2a_plugin.py
index 346284b277..e5d2668884 100644
--- a/tests/plugins/test_a2a_plugin.py
+++ b/tests/plugins/test_a2a_plugin.py
@@ -910,7 +910,9 @@ def _make_live_adapter(monkeypatch, reply_fn=None):
     port = _free_port()
     monkeypatch.setenv("A2A_PORT", str(port))
 
-    adapter = A2AAdapter(PlatformConfig(enabled=True))
+    # A scoped secondary profile ignores the process env (#100382); pass the
+    # port through config.extra so both construction paths bind the same port.
+    adapter = A2AAdapter(PlatformConfig(enabled=True, extra={"port": port}))
 
     async def fake_handle_message(event):
         if reply_fn is None:
@@ -1223,6 +1225,54 @@ class TestInboundRoundTrip:
 
         asyncio.run(run())
 
+    def test_multiplex_adapter_keeps_profile_scoped_peer_tokens(self, monkeypatch):
+        """A secondary listener must not authenticate with the default profile's tokens."""
+        from agent.secret_scope import (
+            reset_secret_scope,
+            set_multiplex_active,
+            set_secret_scope,
+        )
+
+        monkeypatch.setenv("A2A_PEER_TOKENS", "default:default-token")
+        monkeypatch.delenv("A2A_BEARER_TOKEN", raising=False)
+        monkeypatch.setenv("A2A_HOST", "127.0.0.1")
+
+        set_multiplex_active(True)
+        scope_token = set_secret_scope(
+            {"A2A_PEER_TOKENS": "secondary:secondary-token"}
+        )
+        try:
+            adapter, base = _make_live_adapter(monkeypatch)
+        finally:
+            reset_secret_scope(scope_token)
+
+        async def run():
+            try:
+                assert await adapter.connect() is True
+                response = await asyncio.to_thread(
+                    _post_json,
+                    base + "/",
+                    _send_body("profile-scoped auth"),
+                    {"Authorization": "Bearer secondary-token"},
+                )
+                assert response["result"]["status"]["state"] == "TASK_STATE_COMPLETED"
+
+                with pytest.raises(urllib.error.HTTPError) as exc_info:
+                    await asyncio.to_thread(
+                        _post_json,
+                        base + "/",
+                        _send_body("wrong profile"),
+                        {"Authorization": "Bearer default-token"},
+                    )
+                assert exc_info.value.code == 401
+            finally:
+                await adapter.disconnect()
+
+        try:
+            asyncio.run(run())
+        finally:
+            set_multiplex_active(False)
+
 
 # --------------------------------------------------------------------------
 # Push notifications end-to-end (inline config in message/send)
@@ -1618,3 +1668,101 @@ print('fake reply')
         title = con.execute("SELECT title FROM sessions WHERE id='sess-1'").fetchone()[0]
         con.close()
         assert title == "a2a-dev-ctx-unsafe-value"
+
+
+# --------------------------------------------------------------------------
+# Multiplex secondary-profile scope (construction-time config leak)
+# --------------------------------------------------------------------------
+#
+# __init__'s port/advertised-toolsets reads and _load_served_agents's
+# description default all previously read raw A2A_* env vars unconditionally.
+# Under a multiplexed secondary profile, os.environ holds the DEFAULT
+# profile's YAML-to-env bridge output — a secondary profile with its own
+# (different, or absent) A2A config would silently borrow the default
+# profile's port, toolset advertisement, agent name, or Agent Card
+# description. Mirrors the Buzz/SimpleX fix for #98738.
+
+_A2A_ENV_VARS = (
+    "A2A_PORT",
+    "A2A_AGENT_NAME",
+    "A2A_ADVERTISED_TOOLSETS",
+    "A2A_AGENT_DESCRIPTION",
+)
+
+
+@pytest.fixture(autouse=True)
+def _clean_a2a_construction_env(monkeypatch):
+    """Keep the new multiplex tests hermetic regardless of ambient env."""
+    for var in _A2A_ENV_VARS:
+        monkeypatch.delenv(var, raising=False)
+    yield
+
+
+@pytest.fixture
+def multiplex_scope():
+    """Install multiplex + a secondary-profile secret scope; restore after."""
+    tokens = []
+
+    def install(scope=None):
+        from agent.secret_scope import set_multiplex_active, set_secret_scope
+
+        set_multiplex_active(True)
+        tokens.append(set_secret_scope(scope or {}))
+        return tokens[-1]
+
+    yield install
+
+    from agent.secret_scope import reset_secret_scope, set_multiplex_active
+
+    for token in reversed(tokens):
+        reset_secret_scope(token)
+    set_multiplex_active(False)
+
+
+@pytest.fixture
+def default_profile_env(monkeypatch):
+    """The default profile's YAML-to-env bridge output in os.environ."""
+    monkeypatch.setenv("A2A_PORT", "9111")
+    monkeypatch.setenv("A2A_AGENT_NAME", "default-profile-agent")
+    monkeypatch.setenv("A2A_ADVERTISED_TOOLSETS", "default-only-toolset")
+    monkeypatch.setenv("A2A_AGENT_DESCRIPTION", "Default profile's own agent.")
+
+
+class TestMultiplexConstructionScope:
+
+    def test_secondary_profile_never_borrows_default_profile_env(
+        self, multiplex_scope, default_profile_env
+    ):
+        """The secondary profile's own config is authoritative; keys absent
+        from it fall to the module defaults, never to the default profile's
+        bridged A2A_* env values."""
+        from plugins.platforms.a2a.adapter import A2AAdapter, _DEFAULT_PORT
+        from gateway.config import PlatformConfig
+
+        multiplex_scope()
+        assert A2AAdapter(PlatformConfig(enabled=True, extra={"port": 9222})).port == 9222
+
+        adapter = A2AAdapter(PlatformConfig(enabled=True, extra={}))
+        assert adapter.port == _DEFAULT_PORT
+        assert adapter.agent_name != "default-profile-agent"
+        assert adapter._agents[""]["description"] == (
+            "Hermes Agent — a general-purpose agent reachable over A2A."
+        )
+
+    def test_default_profile_unscoped_keeps_env_precedence(
+        self, monkeypatch, default_profile_env
+    ):
+        """Multiplex ON but no scope (the DEFAULT profile constructs
+        unscoped): env is its own bridge output and still wins."""
+        from agent.secret_scope import set_multiplex_active
+        from plugins.platforms.a2a.adapter import A2AAdapter
+        from gateway.config import PlatformConfig
+
+        set_multiplex_active(True)
+        try:
+            adapter = A2AAdapter(PlatformConfig(enabled=True, extra={}))
+        finally:
+            set_multiplex_active(False)
+        assert adapter.port == 9111
+        assert adapter.agent_name == "default-profile-agent"
+        assert adapter._agents[""]["description"] == "Default profile's own agent."
diff --git a/tests/plugins/test_a2a_schema_registration.py b/tests/plugins/test_a2a_schema_registration.py
index 6068b62fc7..76f9a3819d 100644
--- a/tests/plugins/test_a2a_schema_registration.py
+++ b/tests/plugins/test_a2a_schema_registration.py
@@ -35,7 +35,8 @@ def test_a2a_call_schema_round_trips_through_tool_describe(monkeypatch):
     monkeypatch.setattr(
         tool_search,
         "is_deferrable_tool_name",
-        lambda name: name == "a2a_call",
+        # #97979 added the defer_tools positional (curated-set override).
+        lambda name, defer_tools=None: name == "a2a_call",
     )
 
     described = json.loads(
diff --git a/tests/plugins/web/test_web_search_provider_plugins.py b/tests/plugins/web/test_web_search_provider_plugins.py
index 117733e045..9a0f253147 100644
--- a/tests/plugins/web/test_web_search_provider_plugins.py
+++ b/tests/plugins/web/test_web_search_provider_plugins.py
@@ -3,7 +3,7 @@
 Covers:
 
 - All bundled plugins (brave-free, ddgs, searxng, exa, parallel,
-  firecrawl, keenable, xai) instantiate and self-report the expected
+  tavily, firecrawl, keenable, xai) instantiate and self-report the expected
   capabilities + ABC-derived defaults.
 - Each plugin's ``is_available()`` correctly reflects env-var presence.
 - The web_search_registry resolves an active provider in the documented
@@ -35,6 +35,8 @@ def _clear_web_env(monkeypatch: pytest.MonkeyPatch) -> None:
         "BRAVE_SEARCH_API_KEY",
         "SEARXNG_URL",
         "KEENABLE_API_KEY",
+        "TAVILY_API_KEY",
+        "TAVILY_BASE_URL",
         "EXA_API_KEY",
         "PARALLEL_API_KEY",
         "PARALLEL_SEARCH_MODE",
@@ -82,6 +84,7 @@ class TestBundledPluginsRegister:
             "keenable",
             "parallel",
             "searxng",
+            "tavily",
             "xai",
         ]
 
@@ -94,6 +97,7 @@ class TestBundledPluginsRegister:
             ("exa", True, True),
             ("parallel", True, True),
             ("keenable", True, True),
+            ("tavily", True, True),
             ("firecrawl", True, True),
             # xai: search-only via Grok's agentic web_search tool.
             ("xai", True, False),
@@ -115,7 +119,7 @@ class TestBundledPluginsRegister:
 
     @pytest.mark.parametrize(
         "plugin_name",
-        ["brave-free", "ddgs", "searxng", "exa", "parallel", "firecrawl", "keenable", "xai"],
+        ["brave-free", "ddgs", "searxng", "exa", "parallel", "tavily", "firecrawl", "keenable", "xai"],
     )
     def test_each_plugin_has_name_and_display_name(self, plugin_name: str) -> None:
         _ensure_plugins_loaded()
@@ -165,6 +169,16 @@ class TestIsAvailable:
         monkeypatch.setenv("KEENABLE_API_KEY", "real")
         assert p.is_available() is True
 
+    def test_tavily_requires_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        _ensure_plugins_loaded()
+        from agent.web_search_registry import get_provider
+
+        p = get_provider("tavily")
+        assert p is not None
+        assert p.is_available() is False
+        monkeypatch.setenv("TAVILY_API_KEY", "real")
+        assert p.is_available() is True
+
     def test_exa_requires_api_key(self, monkeypatch: pytest.MonkeyPatch) -> None:
         _ensure_plugins_loaded()
         from agent.web_search_registry import get_provider
diff --git a/tests/run_agent/test_413_compression.py b/tests/run_agent/test_413_compression.py
index a91a585823..2c99ff03a0 100644
--- a/tests/run_agent/test_413_compression.py
+++ b/tests/run_agent/test_413_compression.py
@@ -979,6 +979,156 @@ class TestPreflightCompression:
         assert result["final_response"] == "Recovered after overflow"
         assert mock_compress.call_count == 2
 
+    def test_provider_overflow_rechecks_complete_request_before_retry(self, agent):
+        """Provider-proven overflow bypasses post-compaction estimate deferral.
+
+        The first recovery pass drops message rows but rebuilds a larger
+        request. The compressor then awaits real usage, so the old path sent
+        that oversized request back to llama.cpp, which may silently truncate
+        instead of returning another overflow error. Recovery must run another
+        bounded preflight pass first.
+        """
+        agent.compression_enabled = True
+        agent.max_compression_attempts = 2
+        agent.context_compressor.context_length = 65_536
+        agent.context_compressor.threshold_tokens = 34_078
+
+        overflow = Exception(
+            "request (70000 tokens) exceeds the available context size "
+            "(65536 tokens)"
+        )
+        overflow.status_code = 400
+        agent.client.chat.completions.create.side_effect = [overflow]
+
+        history = [
+            {"role": "user", "content": "earlier question"},
+            {"role": "assistant", "content": "earlier answer"},
+        ]
+        compress_calls = 0
+
+        def _request_pressure(*_args, **_kwargs):
+            if agent.client.chat.completions.create.call_count == 0:
+                return 30_000
+            return 70_000
+
+        def _compress(_messages, *_args, **_kwargs):
+            nonlocal compress_calls
+            compress_calls += 1
+            return (
+                [
+                    {"role": "user", "content": f"summary {compress_calls}"},
+                    {"role": "assistant", "content": "summary acknowledged"},
+                ],
+                "rebuilt prompt remains oversized",
+            )
+
+        with (
+            patch(
+                "agent.turn_context.estimate_request_tokens_rough",
+                return_value=30_000,
+            ),
+            patch(
+                "agent.conversation_loop._midturn_request_pressure_tokens",
+                side_effect=_request_pressure,
+            ),
+            patch.object(
+                agent.context_compressor,
+                "should_defer_preflight_to_real_usage",
+                return_value=True,
+            ),
+            patch.object(agent, "_compress_context", side_effect=_compress) as mock_compress,
+            patch.object(agent, "_persist_session"),
+            patch.object(agent, "_save_trajectory"),
+            patch.object(agent, "_cleanup_task_resources"),
+        ):
+            result = agent.run_conversation(
+                "continue",
+                conversation_history=history,
+            )
+
+        assert result["completed"] is False
+        assert result["compression_exhausted"] is True
+        assert mock_compress.call_count == 2
+        assert agent.client.chat.completions.create.call_count == 1
+
+    def test_long_context_tier_recovery_rechecks_complete_request_before_retry(self, agent):
+        """The Anthropic long-context 429 handler is the same recovery class.
+
+        It compacts and restarts on row count alone, exactly like the generic
+        overflow handler. The rebuilt request must be measured against the
+        (now-reduced) window before the provider is retried, so a compaction
+        that drops rows but stays oversized fails closed instead of being
+        sent again.
+        """
+        agent.compression_enabled = True
+        agent.max_compression_attempts = 2
+        agent.context_compressor.context_length = 1_000_000
+        agent.context_compressor.threshold_tokens = 500_000
+
+        tier_error = Exception(
+            "Extra usage is required for long context requests."
+        )
+        tier_error.status_code = 429
+        agent.client.chat.completions.create.side_effect = [tier_error]
+
+        history = [
+            {"role": "user", "content": "earlier question"},
+            {"role": "assistant", "content": "earlier answer"},
+        ]
+        compress_calls = 0
+
+        def _request_pressure(*_args, **_kwargs):
+            if agent.client.chat.completions.create.call_count == 0:
+                return 30_000
+            return 250_000
+
+        def _compress(_messages, *_args, **_kwargs):
+            nonlocal compress_calls
+            compress_calls += 1
+            return (
+                [
+                    {"role": "user", "content": f"summary {compress_calls}"},
+                    {"role": "assistant", "content": "summary acknowledged"},
+                ],
+                "rebuilt prompt remains oversized",
+            )
+
+        def _update_model(*, context_length, **_kwargs):
+            agent.context_compressor.context_length = context_length
+            agent.context_compressor.threshold_tokens = context_length // 2
+
+        with (
+            patch(
+                "agent.turn_context.estimate_request_tokens_rough",
+                return_value=30_000,
+            ),
+            patch(
+                "agent.conversation_loop._midturn_request_pressure_tokens",
+                side_effect=_request_pressure,
+            ),
+            patch.object(
+                agent.context_compressor,
+                "should_defer_preflight_to_real_usage",
+                return_value=True,
+            ),
+            patch.object(
+                agent.context_compressor, "update_model", side_effect=_update_model
+            ),
+            patch.object(agent, "_compress_context", side_effect=_compress) as mock_compress,
+            patch.object(agent, "_persist_session"),
+            patch.object(agent, "_save_trajectory"),
+            patch.object(agent, "_cleanup_task_resources"),
+        ):
+            result = agent.run_conversation(
+                "continue",
+                conversation_history=history,
+            )
+
+        assert result["completed"] is False
+        assert result["compression_exhausted"] is True
+        assert mock_compress.call_count == 2
+        assert agent.client.chat.completions.create.call_count == 1
+
 
     def test_interrupt_before_first_provider_call_restores_preflight_display_seed(self, agent):
         """Interrupted turns must not keep a speculative preflight display seed.
diff --git a/tests/run_agent/test_background_review.py b/tests/run_agent/test_background_review.py
index ca2ebea949..7a10ef16e3 100644
--- a/tests/run_agent/test_background_review.py
+++ b/tests/run_agent/test_background_review.py
@@ -461,6 +461,27 @@ def test_background_review_registers_before_start_runs_and_cleans_up(monkeypatch
     assert agent._active_children == []
 
 
+def test_background_review_snapshot_isolated_from_live_nested_messages():
+    """A review must not mutate the persisted/live transcript through aliases."""
+    original = [{
+        "role": "assistant",
+        "content": [{"type": "text", "text": "answer"}],
+        "tool_calls": [{
+            "id": "call-1",
+            "function": {"name": "read_file", "arguments": '{"path":"x"}'},
+        }],
+    }]
+
+    from agent.turn_finalizer import _clone_background_review_messages
+
+    snapshot = _clone_background_review_messages(original)
+    snapshot[0]["content"][0]["text"] = "review mutation"
+    snapshot[0]["tool_calls"][0]["function"]["arguments"] = "{}"
+
+    assert original[0]["content"][0]["text"] == "answer"
+    assert original[0]["tool_calls"][0]["function"]["arguments"] == '{"path":"x"}'
+
+
 def test_live_turn_waits_for_review_exit_before_relay_and_turn_context(monkeypatch):
     """The outer production wrapper waits before same-session instrumentation."""
     review_entered = threading.Event()
diff --git a/tests/run_agent/test_direct_contexts_stream_inline.py b/tests/run_agent/test_direct_contexts_stream_inline.py
new file mode 100644
index 0000000000..22720f09f0
--- /dev/null
+++ b/tests/run_agent/test_direct_contexts_stream_inline.py
@@ -0,0 +1,243 @@
+"""Delegated children and cron turns stream on the wire (#90202, #100260).
+
+``should_use_direct_api_call`` contexts (gateway cron turns, delegate_task
+children) must not spawn the interrupt worker — it wedges inside their nested
+thread pools (#62151, #60203). The original fix short-circuited them onto the
+NON-streaming wire, which silently dropped every liveness property streaming
+provides: edge proxies killed the silent POST (z.ai HTTP 524, #90202), and the
+non-stream stale watchdog could not tell a reasoning model's thinking phase
+from a hung provider (#100260 — children died at exactly ``stale_timeout``).
+
+These tests pin the replacement contract: those contexts stay on the streaming
+path, issue ``stream=True`` on the calling thread (no worker), and keep the
+stale detector + cross-thread interrupt abort working from the monitor thread.
+"""
+
+import json
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from types import SimpleNamespace
+
+import pytest
+
+import run_agent
+from agent import chat_completion_helpers as helpers
+from agent.chat_completion_helpers import (
+    interruptible_streaming_api_call,
+    should_use_direct_api_call,
+)
+
+
+# ---------------------------------------------------------------------------
+# Real OpenAI-wire SSE server: records the wire ``stream`` flag per request.
+# ---------------------------------------------------------------------------
+
+
+class _Wire:
+    def __init__(self, *, stall_after_first_chunk: bool = False):
+        self.requests: list[dict] = []
+        self.stall = stall_after_first_chunk
+        self.hits = threading.Semaphore(0)
+        wire = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def log_message(self, *_a):
+                pass
+
+            def do_POST(self):
+                n = int(self.headers.get("content-length", 0))
+                body = json.loads(self.rfile.read(n) or b"{}")
+                if not self.path.endswith("/chat/completions"):
+                    # Local-endpoint capability probes (/api/show etc.) —
+                    # answer fast so agent construction never waits on the
+                    # stalling stream below.
+                    self.send_response(404)
+                    self.end_headers()
+                    return
+                wire.requests.append(body)
+                wire.hits.release()
+                self.send_response(200)
+                self.send_header("content-type", "text/event-stream")
+                self.end_headers()
+                first = {
+                    "id": "c1", "object": "chat.completion.chunk", "created": 1, "model": "m",
+                    "choices": [{"index": 0, "delta": {"role": "assistant", "content": "hello"},
+                                 "finish_reason": None}],
+                }
+                self.wfile.write(f"data: {json.dumps(first)}\n\n".encode())
+                self.wfile.flush()
+                if wire.stall:
+                    try:
+                        for _ in range(400):
+                            time.sleep(0.05)
+                            self.wfile.write(b": keepalive\n\n")
+                            self.wfile.flush()
+                    except Exception:
+                        pass
+                    return
+                second = {
+                    "id": "c1", "object": "chat.completion.chunk", "created": 1, "model": "m",
+                    "choices": [{"index": 0, "delta": {"content": " world"}, "finish_reason": None}],
+                }
+                fin = {
+                    "id": "c1", "object": "chat.completion.chunk", "created": 1, "model": "m",
+                    "choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}],
+                    "usage": {"prompt_tokens": 3, "completion_tokens": 2, "total_tokens": 5},
+                }
+                for c in (second, fin):
+                    self.wfile.write(f"data: {json.dumps(c)}\n\n".encode())
+                self.wfile.write(b"data: [DONE]\n\n")
+                self.wfile.flush()
+
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.base_url = f"http://127.0.0.1:{self.server.server_address[1]}/v1"
+
+    def close(self):
+        self.server.shutdown()
+        self.server.server_close()
+
+
+@pytest.fixture
+def wire():
+    w = _Wire()
+    yield w
+    w.close()
+
+
+@pytest.fixture
+def stalling_wire():
+    w = _Wire(stall_after_first_chunk=True)
+    yield w
+    w.close()
+
+
+def _make_agent(base_url: str, *, platform: str):
+    return run_agent.AIAgent(
+        api_key="test-key",
+        base_url=base_url,
+        model="m",
+        provider="custom",
+        platform=platform,
+        quiet_mode=True,
+        skip_context_files=True,
+        skip_memory=True,
+        enabled_toolsets=[],
+        max_iterations=1,
+    )
+
+
+_KW = {"model": "m", "messages": [{"role": "user", "content": "hi"}]}
+
+
+@pytest.mark.parametrize("platform", ["subagent", "cron"])
+def test_direct_contexts_stream_on_the_wire_and_on_the_calling_thread(wire, platform):
+    agent = _make_agent(wire.base_url, platform=platform)
+    assert should_use_direct_api_call(agent) is True
+
+    issued_on = {}
+    real_create = agent._create_request_openai_client
+
+    def spy(*a, **k):
+        issued_on["tid"] = threading.get_ident()
+        return real_create(*a, **k)
+
+    agent._create_request_openai_client = spy
+
+    response = interruptible_streaming_api_call(agent, dict(_KW))
+
+    completions = [r for r in wire.requests if "messages" in r]
+    assert completions, "no chat completion reached the wire"
+    assert completions[-1].get("stream") is True, (
+        f"{platform} turn went out non-streaming: stream={completions[-1].get('stream')!r}"
+    )
+    # No interrupt worker: the request was dispatched from the caller's thread
+    # (the #62151 / #60203 deadlock class needs the request on a spawned worker).
+    assert issued_on["tid"] == threading.get_ident()
+    assert response.choices[0].message.content == "hello world"
+    assert response.choices[0].finish_reason == "stop"
+
+
+def test_interactive_platform_still_uses_the_worker_thread(wire):
+    """Regression guard for the refactor: non-direct contexts keep the
+    interrupt worker (interactive /stop responsiveness relies on it)."""
+    agent = _make_agent(wire.base_url, platform="cli")
+    assert should_use_direct_api_call(agent) is False
+
+    issued_on = {}
+    real_create = agent._create_request_openai_client
+
+    def spy(*a, **k):
+        issued_on["tid"] = threading.get_ident()
+        return real_create(*a, **k)
+
+    agent._create_request_openai_client = spy
+    response = interruptible_streaming_api_call(agent, dict(_KW))
+
+    assert issued_on["tid"] != threading.get_ident()
+    assert response.choices[0].message.content == "hello world"
+
+
+def test_inline_stream_stale_detector_still_fires_from_monitor_thread(
+    stalling_wire, monkeypatch
+):
+    """The stale-stream detector moved onto a monitor thread for inline
+    mode; a stream that sends one chunk then only keep-alives must still be
+    killed at the stale budget instead of hanging until the socket dies."""
+    monkeypatch.setenv("HERMES_STREAM_STALE_TIMEOUT", "1.0")
+    monkeypatch.setenv("HERMES_STREAM_RETRIES", "0")
+    agent = _make_agent(stalling_wire.base_url, platform="subagent")
+
+    started = time.time()
+    response = interruptible_streaming_api_call(agent, dict(_KW))
+    elapsed = time.time() - started
+
+    assert elapsed < 6.0, f"inline stream was not bounded by the stale detector ({elapsed:.1f}s)"
+    # A partial delta was delivered → the loop gets the length-truncated
+    # partial-stream stub (same contract as the worker path).
+    assert getattr(response, "id", None) == helpers.PARTIAL_STREAM_STUB_ID
+    assert response.choices[0].finish_reason == helpers.FINISH_REASON_LENGTH
+
+
+def test_inline_stream_cross_thread_interrupt_aborts_promptly(stalling_wire, monkeypatch):
+    """``AIAgent.interrupt()`` from another thread (cron watchdog, delegation
+    stall monitor) must abort the inline stream and surface InterruptedError
+    — the property the direct_api_call path guaranteed via
+    ``_active_request_abort``."""
+    monkeypatch.setenv("HERMES_STREAM_STALE_TIMEOUT", "60")
+    monkeypatch.setenv("HERMES_STREAM_RETRIES", "0")
+    agent = _make_agent(stalling_wire.base_url, platform="cron")
+    box: dict = {}
+
+    def _run():
+        t0 = time.time()
+        try:
+            interruptible_streaming_api_call(agent, dict(_KW))
+            box["outcome"] = "returned"
+        except BaseException as exc:  # noqa: BLE001 — record whatever surfaces
+            box["outcome"] = type(exc).__name__
+        box["elapsed"] = time.time() - t0
+
+    worker = threading.Thread(target=_run, daemon=True)
+    worker.start()
+    assert stalling_wire.hits.acquire(timeout=5.0), "request never reached the wire"
+    time.sleep(0.3)  # let the first chunk land
+    agent.interrupt("test interrupt")
+    worker.join(timeout=10.0)
+
+    assert not worker.is_alive(), "inline stream did not unwind after interrupt"
+    assert box["outcome"] == "InterruptedError"
+    assert box["elapsed"] < 5.0
+
+
+def test_should_use_direct_api_call_gate_is_unchanged():
+    """The routing predicate itself is untouched — only what it routes to."""
+    def mk(platform, api_mode="chat_completions", provider="openrouter"):
+        return SimpleNamespace(platform=platform, api_mode=api_mode, provider=provider)
+
+    assert should_use_direct_api_call(mk("cron")) is True
+    assert should_use_direct_api_call(mk("subagent")) is True
+    assert should_use_direct_api_call(mk("cli")) is False
+    assert should_use_direct_api_call(mk("cron", api_mode="anthropic_messages")) is False
+    assert should_use_direct_api_call(mk("cron", provider="moa")) is False
diff --git a/tests/run_agent/test_flush_diverts_on_corrupt_state_db.py b/tests/run_agent/test_flush_diverts_on_corrupt_state_db.py
new file mode 100644
index 0000000000..26e941c495
--- /dev/null
+++ b/tests/run_agent/test_flush_diverts_on_corrupt_state_db.py
@@ -0,0 +1,70 @@
+"""Agent flush path: a quarantined (structurally corrupt) SessionDB diverts to JSONL.
+
+Mirrors the replaced-file contract: the batch that SQLite will never take
+again is kept on disk under ``sessions/<id>.jsonl`` instead of only in RAM,
+the flush fails closed (no retry loop), and the turn-end explanation gets the
+``corrupt`` cause.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+
+from hermes_state import SessionDB, StateDbCorruptError
+from run_agent import AIAgent
+
+
+def _flush_agent(db, session_id):
+    agent = SimpleNamespace(
+        _session_db=db,
+        _session_db_created=True,
+        _persist_disabled=False,
+        session_id=session_id,
+        _session_persist_lock=None,
+        _flushed_db_message_ids=set(),
+        _flushed_db_message_session_id=None,
+        _last_flushed_db_idx=0,
+        _db_flush_scan_prefix=None,
+        _persist_user_message_idx=None,
+        _persist_user_message_override=None,
+        _persist_user_message_timestamp=None,
+        _pending_cli_user_message=None,
+        _active_session_turn_lease_holder=None,
+        _last_persistence_error_cause=None,
+        _compression_adoption_failed=False,
+    )
+    agent._ensure_db_session = lambda: None
+    agent._flush_messages_to_session_db = (
+        AIAgent._flush_messages_to_session_db.__get__(agent, AIAgent)
+    )
+    agent._flush_messages_to_session_db_unlocked = (
+        AIAgent._flush_messages_to_session_db_unlocked.__get__(agent, AIAgent)
+    )
+    return agent
+
+
+def test_flush_diverts_batch_to_jsonl_when_handle_is_quarantined(
+    tmp_path: Path, monkeypatch
+) -> None:
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    db = SessionDB(db_path=tmp_path / "state.db")
+    try:
+        db.create_session("live", source="cli")
+        agent = _flush_agent(db, "live")
+
+        def _quarantined(self, *, session_id, messages, **kwargs):
+            raise StateDbCorruptError("database disk image is malformed (quarantined)")
+
+        monkeypatch.setattr(SessionDB, "append_messages_batch", _quarantined)
+
+        messages = [{"role": "user", "content": "kept-on-disk-after-corruption"}]
+        result = agent._flush_messages_to_session_db(messages, [])
+
+        assert result is False
+        assert agent._last_persistence_error_cause == "corrupt"
+        jsonl = tmp_path / "sessions" / "live.jsonl"
+        assert jsonl.is_file()
+        assert "kept-on-disk-after-corruption" in jsonl.read_text(encoding="utf-8")
+    finally:
+        db.close()
diff --git a/tests/run_agent/test_length_continuation_thinking_exhaustion.py b/tests/run_agent/test_length_continuation_thinking_exhaustion.py
new file mode 100644
index 0000000000..a70e71fdf7
--- /dev/null
+++ b/tests/run_agent/test_length_continuation_thinking_exhaustion.py
@@ -0,0 +1,311 @@
+"""Regression tests for thinking-only length truncations.
+
+GLM-5.3-flash on ollama-cloud with reasoning_effort=high can burn the ENTIRE
+output cap on reasoning delivered in a separate field and return
+finish_reason="length" with NO visible content (verified live: max_tokens=4096
+→ completion_tokens=4096, reasoning ~18.5KB, content empty).
+
+The old continuation flow handled this badly:
+  1. the empty response was appended as an interim assistant fragment,
+     poisoning the transcript until the pre-call sanitizer "healed" it
+     (observed 3+ healings per turn);
+  2. every continuation re-ran with thinking ON, re-deriving — and re-burning
+     — the whole thinking budget against a growing context, so 4 attempts
+     still produced nothing and the turn died with
+     "Response remained truncated after 4 continuation attempts".
+
+The fix: skip empty interim fragments, and issue the continuation with a
+one-shot reasoning-off override so the budget goes to writing the answer.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from hermes_constants import FINISH_REASON_LENGTH
+
+
+class _AgentStandIn:
+    """Minimal agent surface _reasoning_config_for_wire needs."""
+
+    def __init__(self, reasoning_config):
+        self.reasoning_config = reasoning_config
+
+
+class TestReasoningOffOneShotOverride:
+    def test_flag_consumed_exactly_once(self):
+        from agent.chat_completion_helpers import _reasoning_config_for_wire
+
+        agent = _AgentStandIn({"enabled": True, "effort": "high"})
+        # Without the flag the reasoning config passes through untouched.
+        assert _reasoning_config_for_wire(agent) == {
+            "enabled": True,
+            "effort": "high",
+        }
+
+        agent._ephemeral_reasoning_off = True
+        cfg = _reasoning_config_for_wire(agent)
+        assert cfg["enabled"] is False
+        assert cfg["effort"] == "none"
+        assert agent._ephemeral_reasoning_off is False, (
+            "The one-shot override must be consumed by the first call."
+        )
+
+        # Subsequent calls keep the user's own reasoning config.
+        assert _reasoning_config_for_wire(agent) == {
+            "enabled": True,
+            "effort": "high",
+        }
+
+    def test_flag_with_no_user_reasoning_config(self):
+        from agent.chat_completion_helpers import _reasoning_config_for_wire
+
+        agent = _AgentStandIn(None)
+        agent._ephemeral_reasoning_off = True
+        cfg = _reasoning_config_for_wire(agent)
+        assert cfg == {"enabled": False, "effort": "none"}
+
+
+@pytest.fixture()
+def loop_agent():
+    from run_agent import AIAgent
+
+    with (
+        patch("run_agent.get_tool_definitions", return_value=[]),
+        patch("run_agent.check_toolset_requirements", return_value={}),
+        patch("run_agent.OpenAI"),
+    ):
+        a = AIAgent(
+            api_key="test-key-1234567890",
+            base_url="https://openrouter.ai/api/v1",
+            quiet_mode=True,
+            skip_context_files=True,
+            skip_memory=True,
+        )
+        a.client = MagicMock()
+        a._cached_system_prompt = "You are helpful."
+        a._use_prompt_caching = False
+        a.compression_enabled = False
+        a.save_trajectories = False
+        return a
+
+
+def _thinking_only_length_response():
+    """finish_reason='length' with reasoning but zero visible content — the
+    live GLM-5.3-flash-on-ollama-cloud shape (normal response id, NOT the
+    partial-stream stub)."""
+    from tests.run_agent.test_run_agent import _mock_assistant_msg
+
+    return SimpleNamespace(
+        id="chatcmpl-thinking-exhausted",
+        model="test/model",
+        choices=[SimpleNamespace(
+            index=0,
+            message=_mock_assistant_msg(content=""),
+            finish_reason=FINISH_REASON_LENGTH,
+        )],
+        usage=None,
+    )
+
+
+def _full_response(content):
+    from tests.run_agent.test_run_agent import _mock_response
+
+    return _mock_response(content=content, finish_reason="stop")
+
+
+def _truncated_text_response(content):
+    from tests.run_agent.test_run_agent import _mock_response
+
+    return _mock_response(content=content, finish_reason=FINISH_REASON_LENGTH)
+
+
+def _run(agent, message, history=None):
+    with (
+        patch.object(agent, "_persist_session"),
+        patch.object(agent, "_save_trajectory"),
+        patch.object(agent, "_cleanup_task_resources"),
+    ):
+        return agent.run_conversation(message, conversation_history=history)
+
+
+def _no_empty_assistant_rows(messages):
+    return [
+        m for m in messages
+        if m.get("role") == "assistant"
+        and not (m.get("content") or "").strip()
+        and not m.get("tool_calls")
+    ]
+
+
+class TestThinkingOnlyTruncation:
+    def test_retry_after_thinking_only_truncation_completes(self, loop_agent):
+        """One thinking-only truncation, then a normal answer: the retry must
+        drop thinking (one-shot), boost the output cap, and finish the turn."""
+        loop_agent.client.chat.completions.create.side_effect = [
+            _thinking_only_length_response(),
+            _full_response("Here is the full answer."),
+        ]
+        result = _run(loop_agent, "write me a long report")
+
+        assert result["completed"] is True
+        assert "full answer" in (result["final_response"] or "")
+        assert _no_empty_assistant_rows(result["messages"]) == [], (
+            "An empty (thinking-only) truncated response must never be "
+            "appended to the transcript."
+        )
+
+        calls = loop_agent.client.chat.completions.create.call_args_list
+        assert len(calls) == 2
+        # Continuation retry boosts the output cap (2^1 × 4096 base floor).
+        assert calls[1].kwargs.get("max_tokens") == 8192, (
+            "The continuation retry must request a larger output budget than "
+            "the request that truncated."
+        )
+        assert loop_agent._ephemeral_reasoning_off is False, (
+            "The one-shot reasoning-off override must be consumed by the "
+            "continuation call."
+        )
+
+    def test_thinking_only_truncation_sets_reasoning_off(self, loop_agent):
+        from tests.run_agent.test_run_agent import _mock_response
+
+        loop_agent.client.chat.completions.create.side_effect = [
+            _thinking_only_length_response(),
+            _mock_response(
+                content="done", finish_reason=FINISH_REASON_LENGTH
+            ),
+            _full_response("finally complete."),
+        ]
+        _run(loop_agent, "write me a long report")
+
+        calls = loop_agent.client.chat.completions.create.call_args_list
+        assert len(calls) == 3
+        # The thinking-only fragment set the flag; it was consumed by the
+        # next call, and the SECOND truncated fragment (which had visible
+        # text) does not set it again — so the third call sees thinking ON.
+        assert loop_agent._ephemeral_reasoning_off is False
+
+    def test_full_ceiling_with_empty_fragments_still_settles(self, loop_agent):
+        """All four attempts thinking-only: the turn must exit through the
+        ceiling with an actionable final_response, no poisoned transcript,
+        and no leaked reasoning-off flag."""
+        loop_agent.client.chat.completions.create.side_effect = [
+            _thinking_only_length_response() for _ in range(4)
+        ]
+        result = _run(loop_agent, "write me a long report")
+
+        assert result["completed"] is False
+        assert result["partial"] is True
+        assert "truncated after 4 continuation attempts" in (result.get("error") or "")
+        assert result["final_response"], (
+            "An all-empty ceiling exit must still surface a user-facing "
+            "message instead of an invisible None."
+        )
+        assert "reasoning" in (result["final_response"] or "").lower()
+        assert _no_empty_assistant_rows(result["messages"]) == []
+        assert loop_agent._ephemeral_reasoning_off is False, (
+            "The ceiling exit must clear the pending one-shot override so the "
+            "next turn does not silently lose thinking."
+        )
+
+    def test_mixed_fragments_keep_visible_text(self, loop_agent):
+        """A visible fragment followed by a thinking-only one: the visible
+        text must be stitched, the empty one skipped."""
+        loop_agent.client.chat.completions.create.side_effect = [
+            _truncated_text_response("visible part one. "),
+            _thinking_only_length_response(),
+            _full_response("and the ending."),
+        ]
+        result = _run(loop_agent, "write me a long report")
+
+        assert result["completed"] is True
+        assert "visible part one." in (result["final_response"] or "")
+        assert "and the ending." in (result["final_response"] or "")
+        assert _no_empty_assistant_rows(result["messages"]) == []
+
+class TestReasoningOffReachesTheWire:
+    def test_continuation_request_carries_reasoning_off_on_the_wire(self, loop_agent):
+        """The flag is only useful if the continuation REQUEST goes out with
+        thinking disabled — assert the OpenRouter extra_body, not the flag."""
+        loop_agent.reasoning_config = {"enabled": True, "effort": "high"}
+        loop_agent._supports_reasoning_extra_body = lambda: True
+        loop_agent.client.chat.completions.create.side_effect = [
+            _thinking_only_length_response(),
+            _full_response("Here is the full answer."),
+        ]
+        result = _run(loop_agent, "write me a long report")
+        assert result["completed"] is True
+
+        calls = loop_agent.client.chat.completions.create.call_args_list
+        assert len(calls) == 2
+        first = (calls[0].kwargs.get("extra_body") or {}).get("reasoning")
+        second = (calls[1].kwargs.get("extra_body") or {}).get("reasoning")
+        assert first == {"enabled": True, "effort": "high"}, first
+        assert second is not None and second.get("enabled") is False, (
+            f"continuation must be sent with thinking off, got {second!r}"
+        )
+
+    def test_reasoning_off_is_exactly_one_request_and_prefix_stays_stable(self, loop_agent):
+        """Prompt-cache invariant for the override.
+
+        The reasoning parameter is part of the provider's cache key on
+        config-sensitive providers (Anthropic renders thinking/effort into
+        the prompt; OpenAI lists reasoning.effort as a prefix-affecting
+        setting), so the reasoning-off request is a deliberate one-request
+        cache miss.  It must stay exactly one request: the request AFTER it
+        (a second, visible-text continuation) must go out with the
+        configured reasoning again, and the system prompt must be
+        byte-identical on every request so the miss never compounds into a
+        rebuilt prefix.
+        """
+        loop_agent.reasoning_config = {"enabled": True, "effort": "high"}
+        loop_agent._supports_reasoning_extra_body = lambda: True
+        loop_agent.client.chat.completions.create.side_effect = [
+            _thinking_only_length_response(),
+            _truncated_text_response("PART ONE of the answer"),
+            _full_response(" and PART TWO, done."),
+        ]
+        result = _run(loop_agent, "write me a long report")
+        assert result["completed"] is True
+        assert "PART ONE" in result["final_response"]
+        assert "PART TWO" in result["final_response"]
+
+        calls = loop_agent.client.chat.completions.create.call_args_list
+        assert len(calls) == 3
+        wire = [
+            (c.kwargs.get("extra_body") or {}).get("reasoning") for c in calls
+        ]
+        assert wire[0] == {"enabled": True, "effort": "high"}, wire
+        assert wire[1] == {"enabled": False, "effort": "none"}, wire
+        assert wire[2] == {"enabled": True, "effort": "high"}, (
+            f"reasoning must be restored on the very next request; got {wire!r}"
+        )
+        system_prompts = {
+            c.kwargs["messages"][0]["content"] for c in calls
+            if c.kwargs["messages"][0].get("role") == "system"
+        }
+        assert len(system_prompts) == 1, (
+            "system prompt must be byte-identical across the retry sequence "
+            "(the override may only change request parameters, never the prefix)"
+        )
+        assert loop_agent._ephemeral_reasoning_off is False
+
+    def test_stale_flag_does_not_leak_into_next_turn(self, loop_agent):
+        """A flag armed by a previous turn that never reached build_api_kwargs
+        (interrupt/error between arm and consume) must not silently strip
+        thinking from the next turn's first request."""
+        loop_agent.reasoning_config = {"enabled": True, "effort": "high"}
+        loop_agent._supports_reasoning_extra_body = lambda: True
+        loop_agent._ephemeral_reasoning_off = True  # stale from a prior turn
+        loop_agent.client.chat.completions.create.side_effect = [
+            _full_response("fresh turn answer."),
+        ]
+        result = _run(loop_agent, "hello")
+        assert result["completed"] is True
+        calls = loop_agent.client.chat.completions.create.call_args_list
+        first = (calls[0].kwargs.get("extra_body") or {}).get("reasoning")
+        assert first == {"enabled": True, "effort": "high"}, first
diff --git a/tests/run_agent/test_model_streaming_config.py b/tests/run_agent/test_model_streaming_config.py
new file mode 100644
index 0000000000..1ed5073f12
--- /dev/null
+++ b/tests/run_agent/test_model_streaming_config.py
@@ -0,0 +1,151 @@
+"""``model.streaming`` config seeds the session's streaming decision (#72901).
+
+The conversation loop prefers ``stream=True`` for every turn — subagents
+included — for liveness health-checking (#3120). Self-hosted OpenAI-compatible
+backends with broken streaming tool-call paths (e.g. vLLM
+``--tool-call-parser qwen3_xml`` + reasoning parser) can leak tool-call markup
+into plain text and return zero ``tool_calls``, silently no-oping delegated
+tasks. ``model.streaming: false`` must seed ``_disable_streaming`` at agent
+init so the whole session (parent and subagents) uses the non-streaming path.
+"""
+import os
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from run_agent import AIAgent
+
+_BASE = {
+    "model": {
+        "default": "test/model",
+        "provider": "custom",
+        "base_url": "http://127.0.0.1:9999/v1",
+        "api_key": "x",
+    }
+}
+
+
+def _build_agent(config):
+    with patch("hermes_cli.config.load_config_readonly", return_value=config):
+        return AIAgent(
+            api_key="x",
+            base_url="http://127.0.0.1:9999/v1",
+            model="test/model",
+            provider="custom",
+            quiet_mode=True,
+            skip_context_files=True,
+            skip_memory=True,
+        )
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_false_seeds_disable_streaming(mock_openai):
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": {**_BASE["model"], "streaming": False}})
+
+    assert agent._disable_streaming is True
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_absent_keeps_streaming_enabled(mock_openai):
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent(_BASE)
+
+    assert agent._disable_streaming is False
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_true_keeps_streaming_enabled(mock_openai):
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": {**_BASE["model"], "streaming": True}})
+
+    assert agent._disable_streaming is False
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_string_false_seeds_disable_streaming(mock_openai):
+    """String falsy values ('false', '0') must also disable streaming —
+    YAML users commonly quote booleans."""
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": {**_BASE["model"], "streaming": "false"}})
+
+    assert agent._disable_streaming is True
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_zero_seeds_disable_streaming(mock_openai):
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": {**_BASE["model"], "streaming": 0}})
+
+    assert agent._disable_streaming is True
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_invalid_value_keeps_streaming_enabled(mock_openai):
+    """Unrecognized values warn and keep the safe default (streaming on),
+    rather than silently disabling or crashing init."""
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": {**_BASE["model"], "streaming": "flase"}})
+
+    assert agent._disable_streaming is False
+
+
+@patch("run_agent.OpenAI")
+def test_missing_model_section_keeps_streaming_enabled(mock_openai):
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({})
+
+    assert agent._disable_streaming is False
+
+
+@patch("run_agent.OpenAI")
+def test_legacy_string_model_section_does_not_crash(mock_openai):
+    """The top-level ``model`` key is a legacy string; init must not crash."""
+    mock_openai.return_value = MagicMock()
+    agent = _build_agent({"model": "test/model"})
+
+    assert agent._disable_streaming is False
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_false_applies_to_every_agent_built_from_config(mock_openai):
+    """Delegate children are constructed through the same init, so any agent
+    (parent or subagent) built under this config gets the escape hatch —
+    covering the reported failure surface."""
+    mock_openai.return_value = MagicMock()
+    cfg = {"model": {**_BASE["model"], "streaming": False}}
+
+    first = _build_agent(cfg)
+    second = _build_agent(cfg)
+
+    assert first._disable_streaming is True
+    assert second._disable_streaming is True
+
+
+@patch("run_agent.OpenAI")
+def test_streaming_false_read_from_real_config_file(mock_openai):
+    """End-to-end: a real config.yaml in HERMES_HOME (sandboxed per-test by
+    conftest) with ``model.streaming: false`` must seed the flag through the
+    actual config loader — not just the patched function."""
+    mock_openai.return_value = MagicMock()
+    home = Path(os.environ["HERMES_HOME"])
+    (home / "config.yaml").write_text(
+        "model:\n"
+        "  default: \"test/model\"\n"
+        "  provider: \"custom\"\n"
+        "  base_url: \"http://127.0.0.1:9999/v1\"\n"
+        "  api_key: \"x\"\n"
+        "  streaming: false\n",
+        encoding="utf-8",
+    )
+
+    agent = AIAgent(
+        api_key="x",
+        base_url="http://127.0.0.1:9999/v1",
+        model="test/model",
+        provider="custom",
+        quiet_mode=True,
+        skip_context_files=True,
+        skip_memory=True,
+    )
+
+    assert agent._disable_streaming is True
diff --git a/tests/run_agent/test_partial_stream_finish_reason.py b/tests/run_agent/test_partial_stream_finish_reason.py
index 2fd563a5f0..975cfacc54 100644
--- a/tests/run_agent/test_partial_stream_finish_reason.py
+++ b/tests/run_agent/test_partial_stream_finish_reason.py
@@ -91,6 +91,95 @@ class TestPartialStreamStubFinishReason:
         assert response.choices[0].message.tool_calls is None
 
 
+class TestTerminalChunkFenceException:
+    """A superseded writer must still accept the provider's terminal
+    finish_reason chunk. Fending that chunk leaves finish_reason None
+    after real text was delivered, which the drop-guard mislabels as a
+    mid-stream drop even though the provider completed the stream.
+    """
+
+    @patch("run_agent.AIAgent._create_request_openai_client")
+    @patch("run_agent.AIAgent._close_request_openai_client")
+    def test_superseded_writer_accepts_finish_reason_chunk(
+        self, _mock_close, mock_create, monkeypatch,
+    ):
+        monkeypatch.setenv("HERMES_STREAM_RETRIES", "0")
+        agent_box = {}
+
+        class SupersedeBeforeFinish:
+            response = SimpleNamespace(headers={})
+
+            def __iter__(self):
+                yield _make_stream_chunk(content="Long prose that is complete.")
+                agent_box["agent"]._claim_stream_writer()
+                # Marker-only terminal chunk (empty delta), as vLLM emits.
+                yield _make_stream_chunk(finish_reason="stop")
+
+        mock_client = MagicMock()
+        mock_client.chat.completions.create.return_value = SupersedeBeforeFinish()
+        mock_create.return_value = mock_client
+
+        agent = _make_agent()
+        agent_box["agent"] = agent
+        response = agent._interruptible_streaming_api_call({})
+
+        assert response.id != PARTIAL_STREAM_STUB_ID
+        assert response.choices[0].finish_reason == "stop"
+        assert response.choices[0].message.content == "Long prose that is complete."
+
+    @patch("run_agent.AIAgent._create_request_openai_client")
+    @patch("run_agent.AIAgent._close_request_openai_client")
+    def test_superseded_writer_still_fences_further_content(
+        self, _mock_close, mock_create, monkeypatch,
+    ):
+        monkeypatch.setenv("HERMES_STREAM_RETRIES", "0")
+        agent_box = {}
+
+        class SupersedeBeforeMoreText:
+            response = SimpleNamespace(headers={})
+
+            def __iter__(self):
+                yield _make_stream_chunk(content="kept ")
+                agent_box["agent"]._claim_stream_writer()
+                # A False accept_chunk ends consumption; this text must
+                # never reach the accumulator, and the later finish chunk
+                # is never seen (the fence still stops *further* content).
+                yield _make_stream_chunk(content="must-not-append")
+                yield _make_stream_chunk(finish_reason="stop")
+
+        mock_client = MagicMock()
+        mock_client.chat.completions.create.return_value = SupersedeBeforeMoreText()
+        mock_create.return_value = mock_client
+
+        agent = _make_agent()
+        agent_box["agent"] = agent
+        response = agent._interruptible_streaming_api_call({})
+
+        content = response.choices[0].message.content or ""
+        assert "must-not-append" not in content
+        assert "kept" in content
+        assert response.id == PARTIAL_STREAM_STUB_ID
+
+    @patch("run_agent.AIAgent._create_request_openai_client")
+    @patch("run_agent.AIAgent._close_request_openai_client")
+    def test_genuine_truncation_without_finish_still_drops(
+        self, _mock_close, mock_create, monkeypatch,
+    ):
+        monkeypatch.setenv("HERMES_STREAM_RETRIES", "0")
+
+        def _truncated():
+            yield _make_stream_chunk(content="cut off with no terminal chunk")
+
+        mock_client = MagicMock()
+        mock_client.chat.completions.create.side_effect = lambda *a, **kw: _truncated()
+        mock_create.return_value = mock_client
+
+        agent = _make_agent()
+        response = agent._interruptible_streaming_api_call({})
+
+        assert response.id == PARTIAL_STREAM_STUB_ID
+        assert response.choices[0].finish_reason == FINISH_REASON_LENGTH
+
 
 # ── Clean stream-end mid-tool-call (no exception, no finish_reason) ─────────
 
diff --git a/tests/run_agent/test_run_agent.py b/tests/run_agent/test_run_agent.py
index 5a8f067a28..05af3b8d1d 100644
--- a/tests/run_agent/test_run_agent.py
+++ b/tests/run_agent/test_run_agent.py
@@ -2253,7 +2253,7 @@ class TestConcurrentToolExecution:
     def test_invoke_tool_handles_agent_level_tools(self, agent):
         """_invoke_tool should handle todo tool directly."""
         with patch("tools.todo_tool.todo_tool", return_value='{"ok":true}') as mock_todo:
-            result = agent._invoke_tool("todo", {"todos": []}, "task-1")
+            result = agent._invoke_tool("todo_list", {"todos": []}, "task-1")
             mock_todo.assert_called_once()
         assert "ok" in result
 
@@ -2345,7 +2345,7 @@ class TestConcurrentToolExecution:
         """Sequential and concurrent agent-level paths share post-hook ownership."""
         from agent.agent_runtime_helpers import agent_runtime_owns_post_tool_hook
 
-        for tool_name in ("todo", "session_search", "memory", "clarify", "delegate_task"):
+        for tool_name in ("todo_list", "session_search", "memory", "clarify", "delegate_task"):
             assert agent_runtime_owns_post_tool_hook(agent, tool_name) is True
 
         agent._context_engine_tool_names = {"context_query"}
@@ -2491,7 +2491,7 @@ class TestAgentRuntimePostHookOwnershipSync:
     """Exercise post-hook ownership through both agent-runtime tool paths."""
 
     _CASES = (
-        ("todo", {"todos": []}),
+        ("todo_list", {"todos": []}),
         ("session_search", {"query": "needle"}),
         ("memory", {"action": "view", "target": "memory"}),
         ("clarify", {"question": "Continue?"}),
@@ -2501,7 +2501,7 @@ class TestAgentRuntimePostHookOwnershipSync:
         ("annotate_preview", {"action": "clear"}),
         ("read_window_below", {}),
         ("setup_mcp", {"server": "linear", "action": "install"}),
-        ("tour", {"action": "stop"}),
+        ("gui_tour", {"action": "stop"}),
         ("delegate_task", {"goal": "Check the child path"}),
     )
 
@@ -4340,11 +4340,11 @@ class TestRunConversation:
         assert requested_caps == [65536, 65536]
 
     def test_ollama_glm_stop_after_tools_without_terminal_boundary_requests_continuation(self, agent):
-        """Ollama-hosted GLM responses can misreport truncated output as stop."""
+        """Local Ollama-hosted GLM (no :cloud suffix) misreports truncated output as stop."""
         self._setup_agent(agent)
         agent.base_url = "http://localhost:11434/v1"
         agent._base_url_lower = agent.base_url.lower()
-        agent.model = "glm-5.1:cloud"
+        agent.model = "glm-4-9b"  # local GLM — no :cloud suffix
 
         tool_turn = _mock_response(
             content="",
@@ -4384,11 +4384,18 @@ class TestRunConversation:
         assert third_call_messages[-1]["role"] == "user"
         assert "truncated by the output length limit" in third_call_messages[-1]["content"]
 
-
-
-
-
-
+    @pytest.mark.parametrize("base_url, model", [
+        ("https://ollama.com/v1", "glm-5.3-flash"),      # Ollama Cloud host (#72316)
+        ("http://localhost:11434/v1", "glm-5.1:cloud"),  # :cloud via local proxy (#98406)
+    ])
+    def test_ollama_cloud_glm_stop_is_never_rewritten(self, agent, base_url, model):
+        """Ollama Cloud reports finish_reason faithfully — an unpunctuated stop stays stop."""
+        self._setup_agent(agent)
+        agent.base_url = base_url
+        agent._base_url_lower = base_url.lower()
+        agent.model = model
+        unpunctuated = SimpleNamespace(content="Based on the results the best next step is to update the config", tool_calls=None)
+        assert agent._should_treat_stop_as_truncated("stop", unpunctuated, [{"role": "tool", "content": "r"}]) is False
 
     def test_length_thinking_exhausted_skips_continuation(self, agent):
         """When finish_reason='length' but content is only thinking, skip retries."""
@@ -4414,7 +4421,7 @@ class TestRunConversation:
         # Should have a user-friendly response (not None)
         assert result["final_response"] is not None
         assert "Thinking Budget Exhausted" in result["final_response"]
-        assert "/thinkon" in result["final_response"]
+        assert "/reasoning" in result["final_response"]
 
 
     def test_length_with_tool_calls_returns_partial_without_executing_tools(self, agent):
diff --git a/tests/run_agent/test_run_agent_codex_responses.py b/tests/run_agent/test_run_agent_codex_responses.py
index 9c0165e066..26228f0b21 100644
--- a/tests/run_agent/test_run_agent_codex_responses.py
+++ b/tests/run_agent/test_run_agent_codex_responses.py
@@ -2502,3 +2502,126 @@ def test_codex_first_compaction_continuation_is_still_a_bare_retry(monkeypatch):
         if m.get("role") == "user"
         and m.get("content") == _CODEX_INCOMPLETE_NUDGE
     ]
+
+
+class _LazyCreateStream:
+    """Lazy iterable fake — events are produced during consumption, not upfront.
+
+    ``_FakeCreateStream`` materializes its events with ``list(events)`` in
+    __init__, which would run any side effect a generator encodes (such as
+    retiring the request token) before consumption starts. Retirement tests
+    need the side effect to land *between* two consumed frames.
+    """
+
+    def __init__(self, event_factory):
+        self._event_factory = event_factory
+        self.closed = False
+
+    def __iter__(self):
+        return iter(self._event_factory())
+
+    def close(self):
+        self.closed = True
+
+
+def _retiring_stream(agent, deltas, *, retire_after):
+    """Yield ``deltas`` lazily, clearing the request token mid-stream.
+
+    The token is cleared just before yielding delta index ``retire_after``,
+    mimicking a watchdog (TTFB / stream-idle / stale-call) retiring the
+    in-flight request while the worker thread is still draining SSE frames.
+    """
+
+    def _events():
+        yield SimpleNamespace(type="response.created")
+        for index, delta in enumerate(deltas):
+            if index == retire_after:
+                agent._active_codex_stream_request_token = None
+            yield SimpleNamespace(type="response.output_text.delta", delta=delta)
+        # A retired stream never reaches a terminal frame on the wire; the
+        # connection is force-closed under it.
+
+    return _LazyCreateStream(_events)
+
+
+def test_run_codex_stream_retired_request_raises_instead_of_partial_final(monkeypatch):
+    """A retired request must not be normalized into a completed response.
+
+    ``_consume_codex_event_stream`` returns ``status=terminal_status`` which
+    defaults to ``"completed"``, and its only guard is
+    ``if not saw_terminal and not output``. A watchdog kill mid-stream leaves
+    ``saw_terminal=False`` but ``output``/text non-empty, so the partial text
+    used to come back as a ``finish_reason=stop`` response and get persisted as
+    a complete assistant turn (a long reply would just stop mid-sentence).
+
+    Retirement must surface as a retryable ``TimeoutError`` instead.
+    """
+    agent = _build_agent(monkeypatch)
+    token = object()
+    agent._active_codex_stream_request_token = token
+
+    def _fake_create(**kwargs):
+        assert kwargs.get("stream") is True
+        return _retiring_stream(
+            agent, ["1. Create ", "(6/6)", " [END-BILLING"], retire_after=2
+        )
+
+    agent.client = SimpleNamespace(responses=SimpleNamespace(create=_fake_create))
+
+    with pytest.raises(TimeoutError, match="retired"):
+        agent._run_codex_stream(_codex_request_kwargs())
+
+
+def test_run_codex_stream_without_token_keeps_partial_tolerance(monkeypatch):
+    """No token installed (non-watchdog callers) keeps the existing behavior.
+
+    ``_active_codex_stream_request_token`` is only set by
+    ``interruptible_api_call``. Auxiliary callers (compression summaries,
+    title generation) drive ``_run_codex_stream`` directly with no token and
+    must keep tolerating a stream that ends without a terminal frame.
+    """
+    agent = _build_agent(monkeypatch)
+    agent._active_codex_stream_request_token = None
+    output_item = SimpleNamespace(
+        type="message",
+        status="completed",
+        content=[SimpleNamespace(type="output_text", text="no terminal frame")],
+    )
+
+    def _fake_create(**kwargs):
+        return _FakeCreateStream([
+            SimpleNamespace(type="response.created"),
+            SimpleNamespace(type="response.output_item.done", item=output_item),
+        ])
+
+    agent.client = SimpleNamespace(responses=SimpleNamespace(create=_fake_create))
+
+    response = agent._run_codex_stream(_codex_request_kwargs())
+    assert response.status == "completed"
+    assert response.output == [output_item]
+
+
+def test_run_codex_stream_retired_request_stops_firing_callbacks(monkeypatch):
+    """Deltas that arrive after retirement must not reach the UI callbacks.
+
+    The gateway caches AIAgent instances per session, so a retired worker that
+    keeps draining frames would otherwise stream tokens from an abandoned
+    attempt into the live turn's bubble alongside the retry's output.
+    """
+    agent = _build_agent(monkeypatch)
+    token = object()
+    agent._active_codex_stream_request_token = token
+
+    streamed: list[str] = []
+    monkeypatch.setattr(agent, "_fire_stream_delta", streamed.append)
+
+    def _fake_create(**kwargs):
+        return _retiring_stream(agent, ["keep", "DROPPED"], retire_after=1)
+
+    agent.client = SimpleNamespace(responses=SimpleNamespace(create=_fake_create))
+
+    with pytest.raises(TimeoutError):
+        agent._run_codex_stream(_codex_request_kwargs())
+
+    assert streamed == ["keep"]
+    assert "DROPPED" not in streamed
diff --git a/tests/run_agent/test_tool_arg_coercion.py b/tests/run_agent/test_tool_arg_coercion.py
index 4390c3e9a1..00dcb289b0 100644
--- a/tests/run_agent/test_tool_arg_coercion.py
+++ b/tests/run_agent/test_tool_arg_coercion.py
@@ -244,5 +244,5 @@ class TestCoerceToolArgsNested:
         """Against the real todo schema from the registry."""
         import json as _json
         args = {"todos": [_json.dumps({"id": "1", "content": "x", "status": "pending"})]}
-        result = coerce_tool_args("todo", args)
+        result = coerce_tool_args("todo_list", args)
         assert result["todos"][0] == {"id": "1", "content": "x", "status": "pending"}
diff --git a/tests/run_agent/test_tool_call_guardrail_runtime.py b/tests/run_agent/test_tool_call_guardrail_runtime.py
index ca6e80aac4..fbc0a51460 100644
--- a/tests/run_agent/test_tool_call_guardrail_runtime.py
+++ b/tests/run_agent/test_tool_call_guardrail_runtime.py
@@ -5,6 +5,8 @@ import uuid
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from run_agent import AIAgent
 
 
@@ -36,7 +38,12 @@ def _mock_response(content="Hello", finish_reason="stop", tool_calls=None):
     return SimpleNamespace(choices=[choice], model="test/model", usage=None)
 
 
-def _make_agent(*tool_names: str, max_iterations: int = 10, config: dict | None = None) -> AIAgent:
+def _make_agent(
+    *tool_names: str,
+    max_iterations: int = 10,
+    config: dict | None = None,
+    platform: str | None = None,
+) -> AIAgent:
     with (
         patch("run_agent.get_tool_definitions", return_value=_make_tool_defs(*tool_names)),
         patch("run_agent.check_toolset_requirements", return_value={}),
@@ -51,6 +58,7 @@ def _make_agent(*tool_names: str, max_iterations: int = 10, config: dict | None
             quiet_mode=True,
             skip_context_files=True,
             skip_memory=True,
+            platform=platform or "cli",
         )
     agent.client = MagicMock()
     agent._cached_system_prompt = "You are helpful."
@@ -86,6 +94,29 @@ def _hard_stop_config(**overrides) -> dict:
     return cfg
 
 
+def test_gateway_platform_uses_hard_stop_default_without_cli_opt_in():
+    agent = _make_agent("web_search", platform="telegram")
+    args = {"query": "same"}
+
+    _seed_exact_failures(agent, "web_search", args, count=5)
+
+    decision = getattr(agent, "_tool_guardrails").before_call("web_search", args)
+    assert decision.action == "block"
+    assert decision.code == "repeated_exact_failure_block"
+
+
+@pytest.mark.parametrize("platform", ["desktop", "acp"])
+def test_interactive_platforms_keep_warning_only_default(platform):
+    agent = _make_agent("web_search", platform=platform)
+    args = {"query": "same"}
+
+    _seed_exact_failures(agent, "web_search", args, count=5)
+
+    decision = getattr(agent, "_tool_guardrails").before_call("web_search", args)
+    assert decision.action == "allow"
+    assert decision.code == "allow"
+
+
 def test_default_sequential_path_warns_repeated_exact_failure_without_blocking_execution():
     agent = _make_agent("web_search")
     args = {"query": "same"}
diff --git a/tests/run_agent/test_turn_completion_explainer.py b/tests/run_agent/test_turn_completion_explainer.py
index 99b052c7f9..3a7f6b62e0 100644
--- a/tests/run_agent/test_turn_completion_explainer.py
+++ b/tests/run_agent/test_turn_completion_explainer.py
@@ -438,3 +438,8 @@ def test_run_conversation_partial_stream_recovery_surfaces_explanation():
     assert result["response_previewed"] is False
 
 
+def test_classify_persistence_error_quarantined_handle_is_corrupt() -> None:
+    """A quarantined SessionDB raises the typed error; it stays in the corrupt bucket."""
+    from hermes_state import StateDbCorruptError, classify_persistence_error
+
+    assert classify_persistence_error(StateDbCorruptError("quarantined")) == "corrupt"
diff --git a/tests/scripts/test_case_collision_check.py b/tests/scripts/test_case_collision_check.py
new file mode 100644
index 0000000000..4546919b9e
--- /dev/null
+++ b/tests/scripts/test_case_collision_check.py
@@ -0,0 +1,118 @@
+"""Wrappers for scripts/check-case-collisions.py.
+
+Same pattern as tests/scripts/test_windows_footguns_full_repo_scan.py: run
+the real checker and assert its outcomes, so a normal pytest run catches a
+regression — someone committing a case-colliding pair — without anyone
+having to remember to run the script by hand.
+
+The collision cases are built with ``git update-index --cacheinfo`` (index
+only, never touching the working tree), so they exercise the same index the
+checker reads and work even on a case-insensitive filesystem, where the two
+spellings cannot coexist on disk.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import subprocess
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = REPO_ROOT / "scripts" / "check-case-collisions.py"
+
+
+def _git_blob_sha(data: bytes) -> str:
+    """The git object hash for a blob with ``data`` as its content."""
+    header = f"blob {len(data)}\0".encode("ascii")
+    return hashlib.sha1(header + data).hexdigest()
+
+
+def _run_check(*args, root=None):
+    cmd = [sys.executable, str(SCRIPT)] + list(args)
+    if root is not None:
+        cmd.append(str(root))
+    return subprocess.run(
+        cmd,
+        capture_output=True,
+        text=True,
+        timeout=60,
+        stdin=subprocess.DEVNULL,
+        cwd=REPO_ROOT,
+    )
+
+
+def _git_init(tmp_path) -> Path:
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    return repo
+
+
+def test_full_repo_has_no_case_colliding_paths():
+    """The real checker against the whole tracked tree must exit clean."""
+    result = _run_check()
+    assert result.returncode == 0, (
+        f"Case-collision check failed:\n{result.stdout}\n{result.stderr}"
+    )
+
+
+def test_detects_case_colliding_paths(tmp_path):
+    """Same-directory Foo.txt + foo.txt must fail, naming both paths."""
+    repo = _git_init(tmp_path)
+    subprocess.run(
+        [
+            "git", "update-index", "--add", "--cacheinfo",
+            f"100644,{_git_blob_sha(b'a')},Foo.txt",
+        ],
+        cwd=repo, check=True,
+    )
+    subprocess.run(
+        [
+            "git", "update-index", "--add", "--cacheinfo",
+            f"100644,{_git_blob_sha(b'b')},foo.txt",
+        ],
+        cwd=repo, check=True,
+    )
+
+    result = _run_check(root=repo)
+    assert result.returncode == 1, f"expected failure, got:\n{result.stdout}"
+    assert "Foo.txt" in result.stdout
+    assert "foo.txt" in result.stdout
+
+
+def test_detects_directory_case_collisions(tmp_path):
+    """The comparison is on the FULL path — dir/Foo.txt vs DIR/foo.txt too."""
+    repo = _git_init(tmp_path)
+    subprocess.run(
+        [
+            "git", "update-index", "--add", "--cacheinfo",
+            f"100644,{_git_blob_sha(b'a')},src/Helper.py",
+        ],
+        cwd=repo, check=True,
+    )
+    subprocess.run(
+        [
+            "git", "update-index", "--add", "--cacheinfo",
+            f"100644,{_git_blob_sha(b'b')},SRC/helper.py",
+        ],
+        cwd=repo, check=True,
+    )
+
+    result = _run_check(root=repo)
+    assert result.returncode == 1, f"expected failure, got:\n{result.stdout}"
+    assert "src/Helper.py" in result.stdout
+    assert "SRC/helper.py" in result.stdout
+
+
+def test_same_name_in_different_dirs_is_not_a_collision(tmp_path):
+    """a/Readme.txt and b/readme.txt share a basename but not a path."""
+    repo = _git_init(tmp_path)
+    (repo / "a").mkdir()
+    (repo / "b").mkdir()
+    (repo / "a" / "Readme.txt").write_text("a", encoding="utf-8")
+    (repo / "b" / "readme.txt").write_text("b", encoding="utf-8")
+    subprocess.run(["git", "add", "-A"], cwd=repo, check=True)
+
+    result = _run_check(root=repo)
+    assert result.returncode == 0, f"expected clean, got:\n{result.stdout}"
diff --git a/tests/scripts/test_contributor_map.py b/tests/scripts/test_contributor_map.py
index 40fd3567a2..b6082ccfe5 100644
--- a/tests/scripts/test_contributor_map.py
+++ b/tests/scripts/test_contributor_map.py
@@ -116,3 +116,66 @@ def test_cli_entrypoint_end_to_end(tmp_path):
     assert proc.returncode == 0, proc.stderr
     out = (tmp_path / "contributors" / "emails" / "cli@example.com").read_text(encoding="utf-8")
     assert out.splitlines()[0] == "cliperson"
+
+
+# ── case-insensitive filename collisions ──────────────────────────────
+#
+# The mapping key IS the filename, so two emails differing only in case are the
+# same file on Windows and on default macOS. When both exist, git writes one and
+# then reports the other as modified in a FRESH clone, permanently: the repo can
+# never be checked out clean on those platforms.
+#
+# The historical agent@Agents-Mac-mini.local / agent@agents-Mac-mini.local pair
+# was removed from the tree (fcdae2cf0b), so there is no allowlist: any pair
+# is a regression. scripts/check-case-collisions.py enforces the same
+# invariant repo-wide in CI; this test keeps it visible next to the writer.
+EMAILS_DIR = REPO_ROOT / "contributors" / "emails"
+
+
+def test_no_case_insensitive_mapping_collisions():
+    groups: dict[str, set[str]] = {}
+    for entry in EMAILS_DIR.iterdir():
+        if entry.is_file():
+            groups.setdefault(entry.name.casefold(), set()).add(entry.name)
+
+    collisions = {frozenset(names) for names in groups.values() if len(names) > 1}
+
+    assert not collisions, (
+        "contributor mappings differing only in case cannot coexist on "
+        "case-insensitive filesystems (Windows, default macOS) — a fresh clone "
+        f"there is permanently dirty: {sorted(sorted(c) for c in collisions)}"
+    )
+
+
+def test_add_contributor_refuses_a_case_collision(tmp_path, monkeypatch):
+    d = tmp_path / "emails"
+    d.mkdir()
+    (d / "agent@Example-Host.local").write_text("someone\n")
+
+    import add_contributor as mod
+
+    monkeypatch.setattr(mod, "EMAILS_DIR", d)
+
+    assert mod.add_contributor("agent@example-host.local", "otherperson") == 1
+    assert not (d / "agent@example-host.local").exists()
+
+
+def test_add_contributor_refuses_case_collision_even_for_same_login(emails_dir, capsys):
+    # Same login, different spelling: still refused — the problem is the
+    # filename pair, not the login. The exact spelling is what's "present".
+    emails_dir.mkdir(parents=True)
+    (emails_dir / "Foo@Example.com").write_text("foouser\n")
+
+    assert add_contributor("foo@example.com", "foouser") == 1
+    assert "Foo@Example.com" in capsys.readouterr().err
+    assert sorted(p.name for p in emails_dir.iterdir()) == ["Foo@Example.com"]
+    # Exact-case re-add is the ordinary idempotent path.
+    assert add_contributor("Foo@Example.com", "foouser") == 0
+
+
+def test_case_collision_uses_casefold(emails_dir):
+    # casefold, not lower: matches how macOS/Windows fold non-ASCII (ß ~ ss).
+    emails_dir.mkdir(parents=True)
+    (emails_dir / "strasse@example.com").write_text("someone\n")
+    assert add_contributor("STRASSE@example.com", "someone") == 1
+    assert add_contributor("straße@example.com", "someone") == 1
diff --git a/tests/state/test_fts_rebuild_admission.py b/tests/state/test_fts_rebuild_admission.py
index b6baf087a0..ac923c6a6c 100644
--- a/tests/state/test_fts_rebuild_admission.py
+++ b/tests/state/test_fts_rebuild_admission.py
@@ -17,9 +17,11 @@ prove nothing.
 """
 
 import contextlib
+import errno
 import subprocess
 import sqlite3
 import sys
+import time
 from pathlib import Path
 
 import pytest
@@ -224,3 +226,399 @@ class TestSchemaPathAdmission:
         # Recovered: breadcrumb cleared, triggers restored.
         assert _meta_value(db_path, FTS_STALE_KEY) is None
         assert _base_fts_triggers(db_path) == set(_FTS_TRIGGERS)
+
+
+# ---------------------------------------------------------------------------
+# Orphaned-fd staleness break (issue #100108).
+#
+# flock belongs to the open file DESCRIPTION, which fork() duplicates into
+# children. A holder that forks (multiprocessing worker, daemonized helper)
+# and then crashes leaves the flock held by the child forever — the kernel's
+# holder-death release never fires, and every contender deferred forever
+# ("FTS rebuild lock ... held by another process for more than 120s").
+# The fix records the acquirer's pid + start time under the lock; a contender
+# that times out breaks the lock ONLY when that recorded holder is provably
+# dead, and fails closed on any indeterminate state.
+# ---------------------------------------------------------------------------
+
+_ORPHANING_HOLDER_SCRIPT = """
+import os, sys, time
+sys.path.insert(0, {repo!r})
+import hermes_state_common
+
+admission = hermes_state_common.fts_rebuild_admission({db!r})
+admitted = admission.__enter__()
+assert admitted is True
+pid = os.fork()
+if pid == 0:
+    # Forked child: shares the lock fd's open file description. Sleep far
+    # beyond the test, never releasing.
+    time.sleep(600)
+    os._exit(0)
+print("child", pid, flush=True)
+# Crash WITHOUT releasing (no __exit__): simulates the production holder
+# dying mid-rebuild after having forked.
+os._exit(1)
+"""
+
+
+@contextlib.contextmanager
+def _orphaned_fork_holder(db_path: Path):
+    """Real #100108 shape: acquirer records itself, forks, dies."""
+    import os
+    import signal
+
+    script = _ORPHANING_HOLDER_SCRIPT.format(
+        repo=str(Path(hermes_state_common.__file__).parent), db=str(db_path)
+    )
+    proc = subprocess.Popen(
+        [sys.executable, "-c", script], stdout=subprocess.PIPE, text=True
+    )
+    line = proc.stdout.readline().strip()
+    assert line.startswith("child ")
+    grandchild = int(line.split()[1])
+    proc.wait(timeout=10)  # the acquirer is now dead; grandchild holds the fd
+    try:
+        yield grandchild
+    finally:
+        with contextlib.suppress(OSError):
+            os.kill(grandchild, signal.SIGKILL)
+
+
+class TestOrphanedHolderStalenessBreak:
+    @pytest.mark.live_system_guard_bypass
+    def test_rebuild_breaks_lock_of_dead_forker(self, db, fast_timeout):
+        """The #100108 repro: recorded holder dead, forked child holds the
+        flock. The contender must break the orphaned lock and rebuild."""
+        with _orphaned_fork_holder(db.db_path):
+            assert db.rebuild_fts() >= 1
+
+    def test_admission_still_fails_closed_for_live_unrecorded_holder(
+        self, db, fast_timeout
+    ):
+        """A live holder that wrote no record (pre-fix build, non-Hermes
+        tool) is indeterminate — must defer, never break."""
+        with _rebuild_lock_held_by_other_process(db.db_path):
+            assert db.rebuild_fts() == 0
+
+    def test_admission_fails_closed_for_live_recorded_holder(
+        self, db, fast_timeout, monkeypatch
+    ):
+        """A record naming a live pid must defer even after timeout."""
+        import json
+        import os
+
+        lock = _lock_file(db.db_path)
+        with _rebuild_lock_held_by_other_process(db.db_path) as proc:
+            record = {
+                "pid": proc.pid,
+                "start_ticks": hermes_state_common._proc_start_ticks(proc.pid),
+                "acquired_at": 0,
+            }
+            lock.write_bytes(json.dumps(record).encode())
+            assert db.rebuild_fts() == 0
+
+    def test_holder_record_cleared_on_normal_release(self, tmp_path):
+        lock = tmp_path / "x.db.fts_rebuild.lock"
+        with hermes_state_common.fts_rebuild_admission(tmp_path / "x.db") as ok:
+            assert ok is True
+            assert b"pid" in lock.read_bytes()
+        assert lock.read_bytes() == b""
+
+    @pytest.mark.live_system_guard_bypass
+    def test_repair_lock_breaks_orphaned_holder(self, tmp_path, monkeypatch):
+        """_cross_process_repair_lock shares the same staleness break."""
+        import hermes_state
+
+        monkeypatch.setattr(hermes_state, "_REPAIR_LOCK_TIMEOUT_SECONDS", 0.5)
+        db_path = tmp_path / "state.db"
+        db_path.touch()
+
+        script = """
+import os, sys, time
+sys.path.insert(0, {repo!r})
+from pathlib import Path
+import hermes_state
+
+lock_cm = hermes_state._cross_process_repair_lock(Path({db!r}))
+assert lock_cm.__enter__() is True
+pid = os.fork()
+if pid == 0:
+    time.sleep(600)
+    os._exit(0)
+print("child", pid, flush=True)
+os._exit(1)
+""".format(repo=str(Path(hermes_state_common.__file__).parent), db=str(db_path))
+        import os
+        import signal
+
+        proc = subprocess.Popen(
+            [sys.executable, "-c", script], stdout=subprocess.PIPE, text=True
+        )
+        grandchild = int(proc.stdout.readline().strip().split()[1])
+        proc.wait(timeout=10)
+        try:
+            import hermes_state as hs
+
+            with hs._cross_process_repair_lock(db_path) as holding:
+                assert holding is True
+        finally:
+            with contextlib.suppress(OSError):
+                os.kill(grandchild, signal.SIGKILL)
+
+
+class TestNonContentionErrnoFailsFast:
+    def test_non_contention_oserror_does_not_wait_out_timeout(
+        self, tmp_path, monkeypatch
+    ):
+        import fcntl
+
+        monkeypatch.setattr(
+            hermes_state_common, "_FTS_REBUILD_LOCK_TIMEOUT_SECONDS", 30.0
+        )
+
+        def _flock(*_args, **_kwargs):
+            raise OSError(getattr(errno, "ESTALE", errno.EIO), "stale handle")
+
+        monkeypatch.setattr(fcntl, "flock", _flock)
+        db_path = tmp_path / "state.db"
+        t0 = time.monotonic()
+        with hermes_state_common.fts_rebuild_admission(db_path) as admitted:
+            assert admitted is False
+        assert time.monotonic() - t0 < 2.0
+
+    def test_retry_deferred_fts_recovery_rebuilds_same_instance(
+        self, tmp_path, monkeypatch
+    ):
+        """Gateway-shaped: same SessionDB stays open and retries after deferral."""
+        import hermes_state_schema
+
+        monkeypatch.setattr(hermes_state_schema, "_FTS_STALE_RETRY_SECONDS", 0.0)
+        db_path = tmp_path / "state.db"
+        d = SessionDB(db_path=db_path)
+        if not d._fts_enabled:
+            d.close()
+            pytest.skip("FTS5 unavailable in this build")
+        d.create_session("s1", source="test")
+        d.append_message("s1", "user", "hello recovery path")
+        d.close()
+
+        raw = sqlite3.connect(str(db_path))
+        raw.execute(
+            "INSERT OR REPLACE INTO state_meta(key, value) VALUES (?, '1')",
+            (FTS_STALE_KEY,),
+        )
+        for trig in _FTS_TRIGGERS:
+            raw.execute(f"DROP TRIGGER IF EXISTS {trig}")
+        raw.commit()
+        raw.close()
+
+        holders = [(4242, str(db_path))]
+        monkeypatch.setattr(
+            SessionDB, "_foreign_state_db_holders", lambda self: list(holders)
+        )
+        d2 = SessionDB(db_path=db_path)
+        try:
+            assert d2._fts_stale is True
+            d2._fts_stale_retry_after = 0.0
+            assert d2.retry_deferred_fts_recovery() is False
+            holders.clear()
+            d2._fts_stale_retry_after = 0.0
+            assert d2.retry_deferred_fts_recovery() is True
+            assert d2._fts_stale is False
+        finally:
+            d2.close()
+        assert _meta_value(db_path, FTS_STALE_KEY) is None
+        assert _base_fts_triggers(db_path) == set(_FTS_TRIGGERS)
+
+    def test_non_contention_errno_skips_holder_warning(
+        self, tmp_path, monkeypatch, caplog
+    ):
+        """The fast-fail must not ALSO log the misleading 'held by another
+        process for more than Ns' line — there is no holder."""
+        import fcntl
+        import logging
+
+        monkeypatch.setattr(
+            hermes_state_common, "_FTS_REBUILD_LOCK_TIMEOUT_SECONDS", 30.0
+        )
+
+        def _flock(*_args, **_kwargs):
+            raise OSError(errno.ENOTSUP, "no locks on this fs")
+
+        monkeypatch.setattr(fcntl, "flock", _flock)
+        with caplog.at_level(logging.INFO, logger="hermes_state"):
+            with hermes_state_common.fts_rebuild_admission(
+                tmp_path / "state.db"
+            ) as admitted:
+                assert admitted is False
+        messages = [r.getMessage() for r in caplog.records]
+        assert any("non-contention error" in m for m in messages)
+        assert not any("held by another process" in m for m in messages)
+
+    def test_repair_lock_non_contention_errno_fails_fast(
+        self, tmp_path, monkeypatch
+    ):
+        """Sibling site: the state.db repair lock shares the errno filter."""
+        import fcntl
+
+        import hermes_state
+
+        monkeypatch.setattr(hermes_state, "_REPAIR_LOCK_TIMEOUT_SECONDS", 30.0)
+
+        def _flock(*_args, **_kwargs):
+            raise OSError(errno.EIO, "i/o error")
+
+        monkeypatch.setattr(fcntl, "flock", _flock)
+        t0 = time.monotonic()
+        with hermes_state._cross_process_repair_lock(tmp_path / "state.db") as ok:
+            assert ok is False
+        assert time.monotonic() - t0 < 2.0
+
+    @pytest.mark.parametrize(
+        "exc, expected",
+        [
+            (BlockingIOError(errno.EAGAIN, "x"), True),
+            (OSError(errno.EWOULDBLOCK, "x"), True),
+            (OSError(errno.EACCES, "x"), True),
+            (OSError(errno.ESTALE, "x"), False),
+            (OSError(errno.ENOTSUP, "x"), False),
+            (OSError(errno.ENOLCK, "x"), False),
+            (OSError(errno.EIO, "x"), False),
+            (ValueError("not an oserror"), False),
+        ],
+    )
+    def test_is_advisory_lock_contention_table(self, exc, expected):
+        assert hermes_state_common.is_advisory_lock_contention(exc) is expected
+
+
+class TestDeferredFtsRetryInProcess:
+    """Gateway shape (#100108): one SessionDB stays open for days. A deferral
+    at open must be recoverable from an in-process periodic tick, with the
+    REAL rebuild lock held by a REAL child process at open time."""
+
+    @staticmethod
+    def _mark_stale(db_path: Path) -> None:
+        raw = sqlite3.connect(str(db_path))
+        raw.execute(
+            "INSERT OR REPLACE INTO state_meta(key, value) VALUES (?, '1')",
+            (FTS_STALE_KEY,),
+        )
+        for trig in _FTS_TRIGGERS:
+            raw.execute(f"DROP TRIGGER IF EXISTS {trig}")
+        raw.commit()
+        raw.close()
+
+    def test_retry_is_non_blocking_while_live_holder_and_backs_off(
+        self, tmp_path, fast_timeout, monkeypatch
+    ):
+        import hermes_state_schema
+
+        db_path = tmp_path / "state.db"
+        d = SessionDB(db_path=db_path)
+        if not d._fts_enabled:
+            d.close()
+            pytest.skip("FTS5 unavailable in this build")
+        d.create_session("s1", source="test")
+        d.append_message("s1", "user", "hello gateway retry")
+        d.close()
+        self._mark_stale(db_path)
+
+        with _rebuild_lock_held_by_other_process(db_path):
+            gw = SessionDB(db_path=db_path)  # long-lived "gateway" open
+            try:
+                assert gw._fts_stale is True
+                # Live holder: the retry must return quickly (timeout=0),
+                # not wait out any admission budget.
+                monkeypatch.setattr(
+                    hermes_state_common, "_FTS_REBUILD_LOCK_TIMEOUT_SECONDS", 30.0
+                )
+                t0 = time.monotonic()
+                assert gw.retry_deferred_fts_recovery() is False
+                assert time.monotonic() - t0 < 2.0
+                assert gw._fts_stale is True
+                # Rate limit engaged: an immediate second call is a no-op.
+                assert gw.retry_deferred_fts_recovery() is False
+                # Backoff doubled (60s -> 120s) but capped at the max.
+                assert gw._fts_stale_retry_interval == min(
+                    2 * hermes_state_schema._FTS_STALE_RETRY_SECONDS,
+                    hermes_state_schema._FTS_STALE_RETRY_MAX_SECONDS,
+                )
+                assert gw._fts_stale_retry_after > time.monotonic()
+            except BaseException:
+                gw.close()
+                raise
+        # Holder gone. Same instance recovers on the next eligible tick.
+        try:
+            gw._fts_stale_retry_after = 0.0
+            assert gw.retry_deferred_fts_recovery() is True
+            assert gw._fts_stale is False
+            assert gw._fts_enabled is True
+            # Search actually works again on this very instance.
+            gw.append_message("s1", "user", "needle-after-holder-gone")
+            assert gw.retry_deferred_fts_recovery() is False  # nothing stale
+        finally:
+            gw.close()
+        assert _meta_value(db_path, FTS_STALE_KEY) is None
+        assert _base_fts_triggers(db_path) == set(_FTS_TRIGGERS)
+
+    def test_gateway_housekeeping_tick_drives_the_retry(
+        self, tmp_path, fast_timeout, monkeypatch
+    ):
+        """The retry hangs off the EXISTING housekeeping loop (no new thread)
+        and reaches shared-registry instances."""
+        import threading
+
+        import hermes_state_registry
+        import hermes_state_schema
+        import gateway.run as grun
+
+        monkeypatch.setattr(hermes_state_schema, "_FTS_STALE_RETRY_SECONDS", 0.0)
+        db_path = tmp_path / "state.db"
+        d = SessionDB(db_path=db_path)
+        if not d._fts_enabled:
+            d.close()
+            pytest.skip("FTS5 unavailable in this build")
+        d.create_session("s1", source="test")
+        d.append_message("s1", "user", "hello housekeeping")
+        d.close()
+        self._mark_stale(db_path)
+
+        with _rebuild_lock_held_by_other_process(db_path):
+            gw = hermes_state_registry.acquire(db_path)
+        try:
+            assert gw._fts_stale is True
+            assert gw in hermes_state_registry.live_shared_session_dbs()
+            stop = threading.Event()
+            th = threading.Thread(
+                target=grun._start_gateway_housekeeping,
+                args=(stop,),
+                kwargs={"interval": 0.05},
+                daemon=True,
+            )
+            th.start()
+            deadline = time.monotonic() + 10.0
+            while gw._fts_stale and time.monotonic() < deadline:
+                time.sleep(0.05)
+            stop.set()
+            th.join(timeout=5)
+            assert gw._fts_stale is False
+            assert gw._fts_enabled is True
+        finally:
+            hermes_state_registry.release_or_close(gw)
+        assert _meta_value(db_path, FTS_STALE_KEY) is None
+
+    def test_retry_noop_when_not_stale_or_read_only(self, tmp_path):
+        db_path = tmp_path / "state.db"
+        d = SessionDB(db_path=db_path)
+        try:
+            assert d._fts_stale is False
+            assert d.retry_deferred_fts_recovery() is False
+        finally:
+            d.close()
+        ro = SessionDB(db_path=db_path, read_only=True)
+        try:
+            ro._fts_stale = True
+            assert ro.retry_deferred_fts_recovery() is False
+        finally:
+            ro.close()
diff --git a/tests/state/test_fts_runtime_rebuild.py b/tests/state/test_fts_runtime_rebuild.py
index 8779186e72..ac030f4cb6 100644
--- a/tests/state/test_fts_runtime_rebuild.py
+++ b/tests/state/test_fts_runtime_rebuild.py
@@ -332,7 +332,15 @@ class TestRuntimeFtsRebuild:
         with pytest.raises(sqlite3.DatabaseError) as caught:
             db._execute_write(lambda _conn: (_ for _ in ()).throw(structural))
 
-        assert caught.value is structural
+        # Structural corruption quarantines the handle: the typed error wraps
+        # the original (cause preserved, SQLite result code copied) and the
+        # sticky flag is set, so later writes fail fast.
+        from hermes_state import StateDbCorruptError
+
+        assert isinstance(caught.value, StateDbCorruptError)
+        assert caught.value.__cause__ is structural
+        assert caught.value.sqlite_errorcode == sqlite3.SQLITE_CORRUPT
+        assert db._db_corrupt is True
         assert rebuild_called is False
         assert db._fts_stale is False
         assert _meta_value(tmp_path / "state.db", FTS_STALE_KEY) is None
@@ -831,6 +839,19 @@ class TestPhysicalCorruptionAcceptance:
             # The misdiagnosis message from the field incident must be gone.
             assert "canonical message rows are preserved" not in caplog.text
             assert "attempting one-shot in-place FTS rebuild" not in caplog.text
+            # Structural damage quarantines the handle: typed error, sticky
+            # flag, later writes fail fast, and close() must not checkpoint
+            # the WAL over a damaged page image (the #90950 page-1 clobber).
+            from hermes_state import StateDbCorruptError
+
+            assert isinstance(caught.value, StateDbCorruptError)
+            assert db._db_corrupt is True
+            with pytest.raises(StateDbCorruptError):
+                db.append_message("s1", "user", "second write after corruption")
+            caplog.clear()
+            with caplog.at_level("WARNING", logger="hermes_state"):
+                db.close()
+            assert "Skipping the close-time WAL checkpoint" in caplog.text
         finally:
             db.close()
 
diff --git a/tests/state/test_session_git_metadata_generation.py b/tests/state/test_session_git_metadata_generation.py
index 2e1cb30988..b97727725c 100644
--- a/tests/state/test_session_git_metadata_generation.py
+++ b/tests/state/test_session_git_metadata_generation.py
@@ -237,7 +237,7 @@ def test_legacy_sessions_table_reconciles_generation_column(tmp_path):
         assert "git_metadata_generation" in columns
         assert reopened._conn.execute(
             "SELECT version FROM schema_version"
-        ).fetchone()[0] == SCHEMA_VERSION == 26
+        ).fetchone()[0] == SCHEMA_VERSION
         reopened.create_session("session", "desktop", cwd="/repo")
         assert reopened.update_session_cwd("session", "/repo") == 1
     finally:
diff --git a/tests/state/test_state_db_lock_fail_closed.py b/tests/state/test_state_db_lock_fail_closed.py
new file mode 100644
index 0000000000..a98a23f7cf
--- /dev/null
+++ b/tests/state/test_state_db_lock_fail_closed.py
@@ -0,0 +1,160 @@
+"""Unopenable admission lock files must fail CLOSED (#100368).
+
+`state.db` has two cross-process admission authorities that gate destructive
+work on a file several Hermes processes share (gateway service, the Desktop
+app's `hermes serve` backend, CLI sessions, the TUI slash worker):
+
+* `hermes_state_common.fts_rebuild_admission` — full structural FTS rebuilds
+* `hermes_state._cross_process_repair_lock`   — writable_schema surgery / VACUUM
+
+Both document themselves as fail-closed, and both honoured that only for a
+*timed-out* acquire. When the lock file could not be `open()`ed at all they
+yielded True and proceeded "with in-process serialisation only" — which is no
+cross-process authority whatsoever.
+
+That inversion is reachable exactly when it does the most damage. Creating the
+lock file needs a directory entry and an inode, so on a full disk `open()`
+raises ENOSPC — while a sibling process that opened ITS handle before the disk
+filled is still mid-rebuild or mid-surgery. Every process then ran concurrent
+destructive work on the same live DB, i.e. the precise interleaving PR #93200
+added these locks to prevent. #100368 reports that shape: a disk-full trigger,
+then a fresh corruption on every boot with other writers alive, and no
+re-corruption on a boot with zero other writers.
+
+These tests drive a real unopenable lock path (a directory where the code
+expects a file, so `open()` raises a genuine OSError from the kernel) rather
+than monkeypatching the helpers, and assert the deferral is honoured at both
+the primitive and the behavior level.
+"""
+
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+
+import hermes_state
+import hermes_state_common
+from hermes_state import SessionDB, repair_state_db_schema
+
+
+def _make_unopenable(lock_path: Path) -> None:
+    """Make ``open(lock_path, "a+b")`` raise a real OSError.
+
+    A directory standing where the code expects a regular file yields
+    IsADirectoryError on POSIX and PermissionError on Windows — both OSError,
+    both raised by the kernel. This stands in for the ENOSPC/EMFILE the field
+    reports hit, without needing to fill a real disk.
+    """
+    lock_path.unlink(missing_ok=True)
+    lock_path.mkdir(parents=True, exist_ok=True)
+    with pytest.raises(OSError):
+        open(lock_path, "a+b").close()
+
+
+# ── FTS rebuild authority ───────────────────────────────────────────────────
+
+
+def test_fts_admission_fails_closed_when_lock_file_is_unopenable(tmp_path):
+    """The primitive must refuse admission, not fall back to no authority."""
+    db_path = tmp_path / "state.db"
+    _make_unopenable(db_path.with_name(db_path.name + ".fts_rebuild.lock"))
+
+    with hermes_state_common.fts_rebuild_admission(db_path) as admitted:
+        assert admitted is False
+
+
+def test_fts_admission_still_admits_a_pathless_db(tmp_path):
+    """Guardrail: an in-memory store has no cross-process surface at all.
+
+    The fix must not turn the legitimate no-op case into a permanent deferral.
+    """
+    with hermes_state_common.fts_rebuild_admission(None) as admitted:
+        assert admitted is True
+
+
+def test_rebuild_fts_defers_when_lock_file_is_unopenable(tmp_path):
+    """Behavior: the rebuild entry point reports no progress and rebuilds nothing."""
+    db = SessionDB(db_path=tmp_path / "state.db")
+    if not db._fts_enabled:
+        db.close()
+        pytest.skip("FTS5 unavailable in this build")
+    try:
+        db.create_session("s1", source="test")
+        db.append_message("s1", "user", "hello world")
+
+        # Sanity: with an openable lock the rebuild really runs, so a 0 below
+        # is the deferral and not an unrelated no-op.
+        assert db.rebuild_fts() >= 1
+
+        _make_unopenable(
+            db.db_path.with_name(db.db_path.name + ".fts_rebuild.lock")
+        )
+        assert db.rebuild_fts() == 0
+    finally:
+        try:
+            db.close()
+        except Exception:
+            pass
+
+
+# ── Schema-surgery authority ────────────────────────────────────────────────
+
+
+def _build_healthy_db(db_path: Path) -> None:
+    db = SessionDB(db_path=db_path)
+    db.create_session("s1", source="test")
+    db.append_message("s1", "user", "hello world")
+    db.close()
+
+
+def _corrupt_duplicate_fts(db_path: Path) -> None:
+    """Inject a duplicate messages_fts row into sqlite_master.
+
+    Reproduces 'malformed database schema (messages_fts) - table
+    messages_fts already exists'.
+    """
+    conn = sqlite3.connect(str(db_path))
+    conn.execute("PRAGMA writable_schema=ON")
+    conn.execute(
+        "INSERT INTO sqlite_master (type, name, tbl_name, rootpage, sql) "
+        "SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master "
+        "WHERE name='messages_fts'"
+    )
+    conn.commit()
+    conn.close()
+
+
+def test_repair_lock_fails_closed_when_lock_file_is_unopenable(tmp_path):
+    """The primitive must refuse the repair authority."""
+    db_path = tmp_path / "state.db"
+    _make_unopenable(db_path.with_name(db_path.name + ".repair.lock"))
+
+    with hermes_state._cross_process_repair_lock(db_path) as holding:
+        assert holding is False
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="writable_schema corruption harness")
+def test_repair_skips_surgery_when_lock_file_is_unopenable(tmp_path):
+    """Behavior: no writable_schema surgery, no forensic backup, DB untouched.
+
+    A full disk is the worst possible moment to start an unsynchronised
+    VACUUM on a live shared DB, and it is exactly when the lock file cannot
+    be created.
+    """
+    db_path = tmp_path / "state.db"
+    _build_healthy_db(db_path)
+    _corrupt_duplicate_fts(db_path)
+    assert hermes_state._db_opens_cleanly(db_path) is not None
+    before = db_path.read_bytes()
+
+    _make_unopenable(db_path.with_name(db_path.name + ".repair.lock"))
+
+    report = repair_state_db_schema(db_path)
+
+    assert report["repaired"] is False
+    assert "repair lock" in (report["error"] or "")
+    assert report["backup_path"] is None
+    assert not list(tmp_path.glob("state.db.malformed-backup-*"))
+    # The damaged image is left byte-identical for the next (authorised) pass.
+    assert db_path.read_bytes() == before
diff --git a/tests/test_desktop_update_windows_progress.py b/tests/test_desktop_update_windows_progress.py
index 031971570e..70708d754b 100644
--- a/tests/test_desktop_update_windows_progress.py
+++ b/tests/test_desktop_update_windows_progress.py
@@ -35,17 +35,24 @@ def _read_progress(url: str, deadline: float) -> dict[str, object]:
     ``urlopen(timeout=5)`` propagating TimeoutError was exactly the Aug 2026
     flake (run 32440286339). Only a listener that stays unresponsive until
     the deadline fails the test.
+
+    Per-attempt timeout is 1s, not 5s: a connection the kernel accepted into
+    the backlog before the runspace was serving never gets answered, and a 5s
+    wait on it burned half the readiness budget per attempt (two stale
+    attempts = red, run 33591547099). The script's own readiness handshake
+    now keeps that gap from reaching us, but the probe should not be able to
+    lose the whole budget to one dead socket either way.
     """
     last_exc: Exception | None = None
     attempted = False
     while not attempted or time.monotonic() < deadline:
         attempted = True
         try:
-            with urlopen(f"{url}progress", timeout=5) as response:
+            with urlopen(f"{url}progress", timeout=1) as response:
                 return json.loads(response.read().decode("utf-8"))
         except (TimeoutError, OSError) as exc:  # transient stall — retry
             last_exc = exc
-            time.sleep(0.2)
+            time.sleep(0.1)
     raise AssertionError(
         f"/progress unresponsive until deadline (last error: {last_exc!r})"
     )
diff --git a/tests/test_env_loader_secret_sources.py b/tests/test_env_loader_secret_sources.py
index 303ed92268..c2959144c9 100644
--- a/tests/test_env_loader_secret_sources.py
+++ b/tests/test_env_loader_secret_sources.py
@@ -174,6 +174,85 @@ def test_cold_profile_bitwarden_uses_profile_bootstrap_without_global_env(
     assert os.environ.get("ANTHROPIC_API_KEY") is None
 
 
+def test_single_profile_scoped_load_keeps_override_behavior(tmp_path, monkeypatch):
+    """Without multiplex, a scoped load keeps its historical override behaviour.
+
+    Ported from #77970 (@DonShelly): the guard must key on the multiplex flag,
+    not on the home override alone -- single-profile ``-p`` runs still load.
+    """
+    from agent import secret_scope
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+    monkeypatch.delenv("HERMES_TEST_SHARED_ADAPTER_CONFIG", raising=False)
+    other_home = tmp_path / "other"
+    other_home.mkdir()
+    (other_home / ".env").write_text("HERMES_TEST_SHARED_ADAPTER_CONFIG=second\n")
+
+    was_active = secret_scope.is_multiplex_active()
+    secret_scope.set_multiplex_active(False)
+    home_token = set_hermes_home_override(other_home)
+    try:
+        loaded = env_loader.load_hermes_dotenv(hermes_home=other_home)
+    finally:
+        secret_scope.set_multiplex_active(was_active)
+        reset_hermes_home_override(home_token)
+
+    try:
+        assert os.environ.get("HERMES_TEST_SHARED_ADAPTER_CONFIG") == "second"
+        assert (other_home / ".env") in loaded
+    finally:
+        os.environ.pop("HERMES_TEST_SHARED_ADAPTER_CONFIG", None)
+
+
+def test_multiplex_dotenv_load_hydrates_sources_without_global_env(
+    tmp_path, monkeypatch
+):
+    """The safe multiplex path must still refresh profile secret sources."""
+    from agent import secret_scope
+    import agent.secret_sources.bitwarden as bw_module
+    from agent.secret_sources import registry as reg_module
+    from hermes_constants import (
+        reset_hermes_home_override,
+        set_hermes_home_override,
+    )
+
+    monkeypatch.delenv("BWS_ACCESS_TOKEN", raising=False)
+    monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+    (tmp_path / ".env").write_text(
+        "BWS_ACCESS_TOKEN=profile-bootstrap\n", encoding="utf-8"
+    )
+    (tmp_path / "config.yaml").write_text(
+        "secrets:\n"
+        "  bitwarden:\n"
+        "    enabled: true\n"
+        "    project_id: test-project\n"
+        "    access_token_env: BWS_ACCESS_TOKEN\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(bw_module, "find_bws", lambda **_kw: Path("/fake/bws"))
+    monkeypatch.setattr(
+        bw_module,
+        "fetch_bitwarden_secrets",
+        lambda **_kw: ({"ANTHROPIC_API_KEY": "profile-provider-key"}, []),
+    )
+    reg_module._reset_registry_for_tests()
+
+    was_active = secret_scope.is_multiplex_active()
+    home_token = set_hermes_home_override(tmp_path)
+    secret_scope.set_multiplex_active(True)
+    try:
+        assert env_loader.load_hermes_dotenv(hermes_home=tmp_path) == []
+    finally:
+        secret_scope.set_multiplex_active(was_active)
+        reset_hermes_home_override(home_token)
+
+    assert env_loader.get_secret_source_values(tmp_path) == {
+        "ANTHROPIC_API_KEY": "profile-provider-key"
+    }
+    assert os.environ.get("BWS_ACCESS_TOKEN") is None
+    assert os.environ.get("ANTHROPIC_API_KEY") is None
+
+
 def test_cold_profile_hydration_seeds_op_env_bootstrap(tmp_path, monkeypatch):
     """The .op.env bootstrap file must feed cold-profile hydration.
 
diff --git a/tests/test_hermes_state.py b/tests/test_hermes_state.py
index 28480c1d15..a52a90aa65 100644
--- a/tests/test_hermes_state.py
+++ b/tests/test_hermes_state.py
@@ -281,6 +281,83 @@ class TestConnectionLifecycle:
         healed.close()
         assert list(tmp_path.glob("*malformed-backup*"))
 
+    def test_read_only_open_retries_transient_wal_ioerr(self, tmp_path, monkeypatch):
+        """A transient SQLITE_IOERR on a read-only open must retry, not raise.
+
+        A ``mode=ro`` connection cannot perform WAL recovery (recovery would
+        need to write the -shm index, which read-only mode refuses), so a
+        concurrent checkpoint / WAL reset / frame-flush on the writer side can
+        surface "disk I/O error" to a reader on a perfectly healthy database
+        (#100436). The transition window is millisecond-scale; a bounded retry
+        must let the open succeed instead of 500-ing the /api/sessions poll
+        and every other read-only opener.
+        """
+        import sqlite3
+
+        from hermes_cli.sqlite_safe_read import has_live_connection
+
+        db_path = tmp_path / "state.db"
+        writable = SessionDB(db_path=db_path)
+        writable.create_session("wal-race", source="cli")
+        writable.close()
+
+        real_connect = hermes_state._connect_tracked_db
+        attempts = []
+
+        def flaky_connect(*args, **kwargs):
+            attempts.append(kwargs.get("uri"))
+            if len(attempts) == 1:
+                # First open lands inside the writer's WAL transition window.
+                raise sqlite3.OperationalError("disk I/O error")
+            return real_connect(*args, **kwargs)
+
+        monkeypatch.setattr(hermes_state, "_connect_tracked_db", flaky_connect)
+        # Keep the test fast: one backoff tick is enough; the retry budget
+        # itself is exercised by the attempt count below.
+        monkeypatch.setattr(hermes_state, "_READ_ONLY_IOERR_RETRY_BACKOFF_S", 0.0)
+
+        read_only = SessionDB(db_path=db_path, read_only=True)
+        try:
+            assert read_only._fts_enabled is True
+            matches = read_only.search_messages("wal-race")
+        finally:
+            read_only.close()
+
+        assert len(attempts) >= 2, "the transient IOERR must be retried"
+        assert has_live_connection(db_path) is False  # no leaked connections
+
+    def test_read_only_open_exhausts_retry_budget_for_persistent_ioerr(
+        self, tmp_path, monkeypatch
+    ):
+        """A persistent SQLITE_IOERR must exhaust the budget and raise.
+
+        The retry exists to ride out a millisecond WAL transition — a
+        storage layer that keeps failing after the full budget is genuinely
+        broken and must surface the error (and not loop forever).
+        """
+        import sqlite3
+
+        db_path = tmp_path / "state.db"
+        writable = SessionDB(db_path=db_path)
+        writable.create_session("broken-disk", source="cli")
+        writable.close()
+
+        attempts = []
+
+        def bad_connect(*args, **kwargs):
+            attempts.append(1)
+            raise sqlite3.OperationalError("disk I/O error")
+
+        monkeypatch.setattr(hermes_state, "_connect_tracked_db", bad_connect)
+        monkeypatch.setattr(hermes_state, "_READ_ONLY_IOERR_RETRY_BACKOFF_S", 0.0)
+        budget = hermes_state._READ_ONLY_IOERR_RETRY_ATTEMPTS
+
+        with pytest.raises(sqlite3.OperationalError, match="disk I/O error"):
+            SessionDB(db_path=db_path, read_only=True)
+
+        # budget + 1 = the initial attempt plus `budget` retries.
+        assert len(attempts) == budget + 1
+
 
 # =========================================================================
 # Session lifecycle
@@ -1698,7 +1775,7 @@ class TestSchemaInit:
         assert binding["user_id"] == "208214988"
         assert binding["session_key"] == "telegram:dm:208214988:thread:17585"
         assert binding["session_id"] == "topic-session"
-        assert db.get_meta("telegram_dm_topic_schema_version") == "2"
+        assert db.get_meta("telegram_dm_topic_schema_version") == "3"
         db.close()
 
 
@@ -2675,6 +2752,24 @@ class TestCompressionChainProjection:
         assert db.get_compression_tip("mid1") == "tip1"
         assert db.get_compression_tip("tip1") == "tip1"
 
+    def test_list_serves_full_lineage_ids_for_projected_rows(self, db):
+        """The projected tip row must carry every chain id. Root and tip
+        alone are not enough client-side: a persisted tile or route can hold
+        a MIDDLE segment's id (it was the tip when opened), and without the
+        intermediates that surface cannot prove it names this conversation —
+        which is how one chat ends up open twice after a compaction."""
+        import time as _time
+        self._build_compression_chain(db, _time.time() - 3600)
+        db.create_session("solo", "cli")
+        db.append_message("solo", "user", "standalone")
+        db._conn.commit()
+
+        sessions = db.list_sessions_rich(source="cli", limit=20)
+        tip_row = next(s for s in sessions if s["id"] == "tip1")
+        assert tip_row["_lineage_ids"] == ["root1", "mid1", "tip1"]
+        solo_row = next(s for s in sessions if s["id"] == "solo")
+        assert solo_row.get("_lineage_ids") is None
+
 
 
     def test_list_surfaces_tip_for_compressed_root(self, db):
@@ -2912,6 +3007,7 @@ class TestVacuum:
 
     def test_auto_maintenance_records_successful_vacuum(self, db, monkeypatch):
         monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 3)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.5)  # ratio gate open
         vacuum_calls = []
         monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
 
@@ -2923,6 +3019,7 @@ class TestVacuum:
 
     def test_auto_maintenance_skips_recent_vacuum(self, db, monkeypatch):
         monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 3)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.5)  # ratio gate open
         db.set_meta("last_vacuum", str(time.time()))
         vacuum_calls = []
         monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
@@ -2937,6 +3034,7 @@ class TestVacuum:
 
     def test_auto_maintenance_retries_after_vacuum_interval(self, db, monkeypatch):
         monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 3)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.5)  # ratio gate open
         db.set_meta("last_vacuum", str(time.time() - 31 * 86400))
         vacuum_calls = []
         monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
@@ -2951,6 +3049,7 @@ class TestVacuum:
 
     def test_auto_maintenance_retries_after_failed_vacuum(self, db, monkeypatch):
         monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 3)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.5)  # ratio gate open
         vacuum_calls = []
 
         def fail_first_vacuum():
@@ -2971,6 +3070,97 @@ class TestVacuum:
         assert vacuum_calls == [True, True]
         assert db.get_meta("last_vacuum") is not None
 
+    # ── freelist-ratio gate (#54189) ─────────────────────────────────────
+    def test_auto_maintenance_skips_vacuum_below_freelist_ratio(self, db, monkeypatch):
+        """A prune that frees few pages on a dense DB must NOT trigger VACUUM."""
+        monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 1)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.05)
+        vacuum_calls = []
+        monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
+
+        result = db.maybe_auto_prune_and_vacuum(min_interval_hours=0)
+
+        assert result["pruned"] == 1
+        assert result["vacuumed"] is False
+        assert result["freelist_ratio"] == 0.05
+        assert vacuum_calls == []
+        assert db.get_meta("last_vacuum") is None
+        # The prune itself still counts as a maintenance run.
+        assert db.get_meta("last_auto_prune") is not None
+
+    def test_auto_maintenance_vacuums_above_freelist_ratio(self, db, monkeypatch):
+        monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 1)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.40)
+        vacuum_calls = []
+        monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
+
+        result = db.maybe_auto_prune_and_vacuum(min_interval_hours=0)
+
+        assert result["vacuumed"] is True
+        assert result["freelist_ratio"] == 0.40
+        assert vacuum_calls == [True]
+
+    def test_auto_maintenance_freelist_ratio_exactly_at_threshold_skips(self, db, monkeypatch):
+        """Gate is strictly greater-than: 25.0% reclaimable does not VACUUM."""
+        from hermes_state import AUTO_VACUUM_MIN_FREELIST_RATIO
+
+        monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 1)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: AUTO_VACUUM_MIN_FREELIST_RATIO)
+        vacuum_calls = []
+        monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
+
+        result = db.maybe_auto_prune_and_vacuum(min_interval_hours=0)
+
+        assert result["vacuumed"] is False
+        assert vacuum_calls == []
+
+    def test_auto_maintenance_unknown_freelist_ratio_falls_back_to_time_throttle(self, db, monkeypatch):
+        """If the pragmas cannot be read, don't silently disable VACUUM forever."""
+        monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 1)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: None)
+        vacuum_calls = []
+        monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
+
+        result = db.maybe_auto_prune_and_vacuum(min_interval_hours=0)
+
+        assert result["vacuumed"] is True
+        assert result["freelist_ratio"] is None
+        assert vacuum_calls == [True]
+
+    def test_auto_maintenance_ratio_gate_threshold_is_overridable(self, db, monkeypatch):
+        monkeypatch.setattr(db, "prune_sessions", lambda **_kwargs: 1)
+        monkeypatch.setattr(db, "_freelist_ratio", lambda: 0.10)
+        vacuum_calls = []
+        monkeypatch.setattr(db, "vacuum", lambda: vacuum_calls.append(True))
+
+        result = db.maybe_auto_prune_and_vacuum(
+            min_interval_hours=0, min_vacuum_freelist_ratio=0.05
+        )
+
+        assert result["vacuumed"] is True
+        assert vacuum_calls == [True]
+
+    def test_freelist_ratio_reads_real_pragmas(self, db):
+        """Real-DB check: freeing most of the file pushes the ratio past the gate."""
+        from hermes_state import AUTO_VACUUM_MIN_FREELIST_RATIO
+
+        db.create_session(session_id="keep", source="cli")
+        db.append_message(session_id="keep", role="user", content="hi")
+        for i in range(6):
+            sid = f"bulk{i}"
+            db.create_session(session_id=sid, source="cli")
+            for _ in range(20):
+                db.append_message(session_id=sid, role="assistant", content="z" * 4000)
+        db._conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+        dense = db._freelist_ratio()
+        assert dense is not None and dense < AUTO_VACUUM_MIN_FREELIST_RATIO
+
+        for i in range(6):
+            db.delete_session(f"bulk{i}")
+        db._conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+        sparse = db._freelist_ratio()
+        assert sparse is not None and sparse > AUTO_VACUUM_MIN_FREELIST_RATIO
+
     def test_wal_size_limit_is_bounded(self, db):
         """journal_size_limit must be a finite bound, not SQLite's -1 default.
 
@@ -3101,7 +3291,8 @@ class TestAutoMaintenance:
         )
         db._conn.commit()
 
-    def test_first_run_prunes_and_vacuums(self, db):
+    def test_first_run_prunes_and_skips_vacuum_when_little_reclaimable(self, db):
+        """Pruning two empty sessions frees almost nothing → prune yes, VACUUM no."""
         self._make_old_ended(db, "old1", days_old=100)
         self._make_old_ended(db, "old2", days_old=100)
         db.create_session(session_id="new", source="cli")  # active, must survive
@@ -3109,12 +3300,40 @@ class TestAutoMaintenance:
         result = db.maybe_auto_prune_and_vacuum(retention_days=90)
         assert result["skipped"] is False
         assert result["pruned"] == 2
-        assert result["vacuumed"] is True
+        assert result["vacuumed"] is False  # freelist ratio gate (#54189)
+        assert result["freelist_ratio"] is not None
+        assert result["freelist_ratio"] <= 0.25
         assert result.get("error") is None
         assert db.get_session("old1") is None
         assert db.get_session("old2") is None
         assert db.get_session("new") is not None
 
+    def test_first_run_prunes_and_vacuums_when_mostly_reclaimable(self, db):
+        """Pruning the bulk of the file's pages crosses the 25% gate → VACUUM runs."""
+        db.create_session(session_id="new", source="cli")  # active, must survive
+        db.append_message(session_id="new", role="user", content="hi")
+        for i in range(6):
+            sid = f"old{i}"
+            self._make_old_ended(db, sid, days_old=100)
+            for _ in range(20):
+                db.append_message(session_id=sid, role="assistant", content="z" * 4000)
+            # Keep the row aged: append_message bumps activity, prune ages by
+            # latest message, so push the message timestamps back too.
+            db._conn.execute(
+                "UPDATE messages SET timestamp = ? WHERE session_id = ?",
+                (time.time() - 100 * 86400, sid),
+            )
+        db._conn.commit()
+
+        result = db.maybe_auto_prune_and_vacuum(retention_days=90)
+        assert result["skipped"] is False
+        assert result["pruned"] == 6
+        assert result["freelist_ratio"] > 0.25
+        assert result["vacuumed"] is True
+        assert result.get("error") is None
+        assert db.get_session("new") is not None
+        assert db.get_meta("last_vacuum") is not None
+
     def test_second_call_within_interval_skips(self, db):
         self._make_old_ended(db, "old", days_old=100)
         first = db.maybe_auto_prune_and_vacuum(
@@ -4260,6 +4479,63 @@ def test_gateway_session_recovery_does_not_cross_newer_reset_boundary(
     ) is None
 
 
+def test_peer_fallback_never_adopts_a_sibling_profiles_row(tmp_path, monkeypatch):
+    """#74285: the peer-tuple fallback is fenced by the store's own profile.
+
+    A Telegram DM peer tuple (chat_id == user_id, no thread) is identical for
+    every bot, so a legacy sibling-profile row sitting in this store — written
+    before the per-profile partition — must lose to the older own row, and
+    with no own row recovery must return nothing rather than the sibling's.
+    """
+    import hermes_state
+
+    root = tmp_path / "hermes"
+    root.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(root))
+    monkeypatch.setattr(hermes_state, "DEFAULT_DB_PATH", hermes_state._IMPORT_DEFAULT_DB_PATH)
+    store = SessionDB(db_path=root / "state.db")  # owner: default
+    try:
+        peer = {"user_id": "42", "chat_id": "42", "chat_type": "dm"}
+        store.create_session("sibling", "telegram", session_key="agent:bot2:telegram:dm:42",
+                             profile_name="bot2", **peer)
+        store.append_message("sibling", "user", "bot2's conversation")
+
+        def recover():
+            return store.find_latest_gateway_session_for_peer(
+                source="telegram", session_key="agent:main:telegram:dm:42", **peer
+            )
+
+        assert recover() is None  # only the sibling exists: fail closed
+
+        store.create_session("own", "telegram", session_key="agent:main:telegram:dm:42:old", **peer)
+        store.append_message("own", "user", "default's conversation")
+        store._execute_write(
+            lambda c: c.execute("UPDATE sessions SET last_activity_at = 1 WHERE id = 'own'")
+        )
+        assert recover()["id"] == "own"  # older own row beats newer sibling row
+    finally:
+        store.close()
+
+
+def test_child_inherits_parent_profile_only_within_its_key_namespace(db):
+    """#88381: parent→child ``profile_name`` COALESCE is fenced by ``agent:<ns>:``.
+
+    A default child (``agent:main:``) forked from a sibling profile's row must
+    not be durably mislabelled as that profile's; same-namespace and keyless
+    (CLI/subagent) children keep inheriting.
+    """
+    db.create_session("parent", "telegram", session_key="agent:bot2:telegram:dm:42",
+                      profile_name="bot2")
+    db.create_session("cross", "telegram", parent_session_id="parent",
+                      session_key="agent:main:telegram:dm:42")
+    db.create_session("same", "telegram", parent_session_id="parent",
+                      session_key="agent:bot2:telegram:dm:42:r2")
+    db.create_session("keyless", "cli", parent_session_id="parent")
+    assert db.get_session("cross")["profile_name"] is None
+    assert db.get_session("same")["profile_name"] == "bot2"
+    assert db.get_session("keyless")["profile_name"] == "bot2"
+
+
 
 
 
@@ -4574,6 +4850,66 @@ class TestGetMessagesPagination:
         assert exc_info.value.message_count == 5
         assert exc_info.value.limit == 4
 
+    def test_resume_safety_tip_only_counts_the_tip_segment(self, db):
+        """A deep compression lineage behind a small tip resumes tip-only.
+
+        The Desktop Bot Chat shape: many compaction segments (~29k rows of
+        lineage) and a small live tip. Callers that never materialize the
+        ancestors (deferred / omit_messages / lazy resume, tip-only model
+        restore) must be bounded by the tip alone, and the message must name
+        the scope it counted.
+        """
+        prev = None
+        for i in range(6):
+            sid = f"seg-{i}"
+            kwargs = {"parent_session_id": prev} if prev else {}
+            db.create_session(session_id=sid, source="tui", **kwargs)
+            db.append_messages_batch(
+                sid,
+                [{"role": "user", "content": f"{sid}-{j}"} for j in range(4)],
+            )
+            if i < 5:
+                db.end_session(sid, "compression")
+            prev = sid
+
+        assert db.get_resume_message_count("seg-5") == 24
+        assert db.get_resume_message_count("seg-5", tip_only=True) == 4
+        with pytest.raises(hermes_state.SessionResumeTooLargeError) as full:
+            db.assert_resume_safe("seg-5", max_messages=10)
+        assert "across its lineage" in str(full.value)
+        assert db.assert_resume_safe("seg-5", max_messages=10, tip_only=True) == 4
+        with pytest.raises(hermes_state.SessionResumeTooLargeError) as tip:
+            db.assert_resume_safe("seg-5", max_messages=3, tip_only=True)
+        assert tip.value.message_count == 4
+        assert "in its tip segment" in str(tip.value)
+
+    def test_resume_guard_counts_exactly_what_a_branch_resume_loads(self, db):
+        """An explicit /branch copy owns its transcript: the guard and the
+        resume readers must agree that its lineage is itself alone."""
+        db.create_session(session_id="parent", source="tui")
+        db.append_messages_batch(
+            "parent",
+            [{"role": "user", "content": f"parent-{i}"} for i in range(6)],
+        )
+        db.create_session(
+            session_id="branch",
+            source="tui",
+            parent_session_id="parent",
+            model_config={"_branched_from": "parent"},
+        )
+        db.append_messages_batch(
+            "branch",
+            [{"role": "user", "content": f"branch-{i}"} for i in range(2)],
+        )
+
+        _, display = db.get_resume_conversations("branch")
+        assert len(display) == 2
+        assert db.get_ancestor_display_prefix("branch") == []
+        # Before: the guard walked parent_session_id and counted 8, so a branch
+        # could be refused for rows a resume would never load.
+        assert db.get_resume_message_count("branch") == 2
+        assert db.assert_resume_safe("branch", max_messages=5) == 2
+
     def test_export_safety_is_bounded_to_the_requested_active_segment(self, db):
         db.create_session(session_id="root", source="cli")
         db.append_messages_batch(
diff --git a/tests/test_install_sh_termux_python_bounds.py b/tests/test_install_sh_termux_python_bounds.py
new file mode 100644
index 0000000000..443873bf64
--- /dev/null
+++ b/tests/test_install_sh_termux_python_bounds.py
@@ -0,0 +1,220 @@
+"""Behavioral regression tests for Termux Python selection."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+import subprocess
+import sys
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+INSTALL_SH = REPO_ROOT / "scripts" / "install.sh"
+SETUP_HERMES_SH = REPO_ROOT / "setup-hermes.sh"
+
+
+def _write_executable(path: Path, content: str) -> Path:
+    path.write_text(content)
+    path.chmod(path.stat().st_mode | stat.S_IXUSR)
+    return path
+
+
+def _write_fake_python(bin_dir: Path, name: str, version: str) -> Path:
+    return _write_executable(
+        bin_dir / name,
+        f"""#!{sys.executable}
+import os
+import sys
+
+VERSION = {version!r}
+VERSION_INFO = tuple(int(part) for part in VERSION.split('.')[:3]) + ('final', 0)
+
+if len(sys.argv) >= 2 and sys.argv[1] == '--version':
+    print(f'Python {{VERSION}}')
+    raise SystemExit(0)
+
+if len(sys.argv) >= 3 and sys.argv[1] == '-c':
+    sys.version = f'{{VERSION}} (fake)'
+    sys.version_info = VERSION_INFO
+    exec(sys.argv[2], {{'__name__': '__main__'}})
+    raise SystemExit(0)
+
+if len(sys.argv) >= 3 and sys.argv[1:3] == ['-m', 'venv']:
+    target = sys.argv[3] if len(sys.argv) >= 4 else 'venv'
+    bin_path = os.path.join(target, 'bin')
+    os.makedirs(bin_path, exist_ok=True)
+    python_path = os.path.join(bin_path, 'python')
+    with open(python_path, 'w', encoding='utf-8') as handle:
+        handle.write('''#!/bin/sh\nif [ "${{1:-}}" = '-m' ] && [ "${{2:-}}" = 'pip' ]; then\n    exit 0\nfi\nexit 0\n''')
+    os.chmod(python_path, 0o755)
+    raise SystemExit(0)
+
+raise SystemExit(0)
+""",
+    )
+
+
+def _write_unsupported_explicit_pythons(bin_dir: Path, *except_names: str) -> None:
+    for name in ("python3.11", "python3.12", "python3.13"):
+        if name not in except_names and not (bin_dir / name).exists():
+            _write_fake_python(bin_dir, name, "3.14.6")
+
+
+def _write_termux_command_stubs(bin_dir: Path) -> None:
+    _write_executable(
+        bin_dir / "uname",
+        "#!/bin/sh\n[ \"${1:-}\" = '-s' ] && echo Linux || echo Linux\n",
+    )
+    if not (bin_dir / "pkg").exists():
+        _write_executable(bin_dir / "pkg", "#!/bin/sh\nexit 0\n")
+    _write_executable(bin_dir / "git", "#!/bin/sh\necho 'git version 2.50.0'\n")
+    _write_executable(bin_dir / "node", "#!/bin/sh\necho 'v22.12.0'\n")
+    _write_executable(bin_dir / "npm", "#!/bin/sh\nexit 0\n")
+    _write_executable(bin_dir / "curl", "#!/bin/sh\nexit 0\n")
+    _write_executable(bin_dir / "rg", "#!/bin/sh\nexit 0\n")
+
+
+def _termux_env(tmp_path: Path, bin_dir: Path) -> dict[str, str]:
+    prefix = tmp_path / "com.termux" / "files" / "usr"
+    (prefix / "bin").mkdir(parents=True)
+    env = os.environ.copy()
+    env.update({
+        "ANDROID_API_LEVEL": "35",
+        "HOME": str(tmp_path / "home"),
+        "HERMES_HOME": str(tmp_path / "home" / ".hermes"),
+        "PATH": f"{bin_dir}{os.pathsep}{env.get('PATH', os.defpath)}",
+        "PREFIX": str(prefix),
+        "TERMUX_VERSION": "0.118.0",
+    })
+    return env
+
+
+def _run_install_prerequisites(tmp_path: Path) -> subprocess.CompletedProcess[str]:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir(exist_ok=True)
+    _write_termux_command_stubs(bin_dir)
+    env = _termux_env(tmp_path, bin_dir)
+    bash = shutil.which("bash") or "/bin/bash"
+    return subprocess.run(
+        [bash, str(INSTALL_SH), "--stage", "prerequisites", "--non-interactive"],
+        env=env,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        check=False,
+    )
+
+
+def _copy_setup_checkout(tmp_path: Path) -> Path:
+    checkout = tmp_path / "checkout"
+    checkout.mkdir()
+    shutil.copy2(SETUP_HERMES_SH, checkout / "setup-hermes.sh")
+    return checkout
+
+
+def _run_setup(tmp_path: Path) -> subprocess.CompletedProcess[str]:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir(exist_ok=True)
+    _write_termux_command_stubs(bin_dir)
+    env = _termux_env(tmp_path, bin_dir)
+    checkout = _copy_setup_checkout(tmp_path)
+    bash = shutil.which("bash") or "/bin/bash"
+    return subprocess.run(
+        [bash, str(checkout / "setup-hermes.sh")],
+        env=env,
+        input="n\n",
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        check=False,
+    )
+
+
+def test_install_stage_prefers_compatible_minor_over_unsupported_default(
+    tmp_path: Path,
+) -> None:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    _write_fake_python(bin_dir, "python3.11", "3.11.15")
+    _write_fake_python(bin_dir, "python", "3.14.6")
+
+    result = _run_install_prerequisites(tmp_path)
+
+    assert result.returncode == 0, result.stdout
+    assert "Python found: Python 3.11.15" in result.stdout
+
+
+def test_install_stage_rejects_post_install_unsupported_default(tmp_path: Path) -> None:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    _write_fake_python(bin_dir, "python", "3.14.6")
+    _write_unsupported_explicit_pythons(bin_dir)
+
+    result = _run_install_prerequisites(tmp_path)
+
+    assert result.returncode == 1
+    assert "Termux Python Python 3.14.6 is not supported" in result.stdout
+    assert "Hermes requires Python >=3.11,<3.14" in result.stdout
+    assert "pkg install tur-repo && pkg install python3.13" in result.stdout
+
+
+def test_install_stage_provisions_supported_python_from_tur(tmp_path: Path) -> None:
+    """When the default Termux python is too new, the installer falls back to
+    the Termux User Repository (TUR) and picks up a supported interpreter that
+    `pkg install python3.13` provides."""
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    _write_fake_python(bin_dir, "python", "3.14.6")
+    # Shadow any host python3.11/3.12/3.13 so the candidate scan can't find a
+    # supported interpreter before the TUR fallback runs.
+    _write_unsupported_explicit_pythons(bin_dir)
+
+    # Stateful pkg stub: `pkg install -y python3.13` drops a supported fake
+    # interpreter into PATH, mimicking a successful TUR package install.
+    staged = tmp_path / "staged"
+    staged.mkdir()
+    _write_fake_python(staged, "python3.13", "3.13.7")
+    _write_executable(
+        bin_dir / "pkg",
+        "#!/bin/sh\n"
+        "for arg in \"$@\"; do\n"
+        f"    if [ \"$arg\" = 'python3.13' ]; then cp {staged}/python3.13 {bin_dir}/python3.13; fi\n"
+        "done\n"
+        "exit 0\n",
+    )
+
+    result = _run_install_prerequisites(tmp_path)
+
+    assert result.returncode == 0, result.stdout
+    assert "Python installed from TUR: Python 3.13.7" in result.stdout
+
+
+def test_setup_script_prefers_compatible_minor_over_unsupported_default(
+    tmp_path: Path,
+) -> None:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    _write_fake_python(bin_dir, "python3.11", "3.14.6")
+    _write_fake_python(bin_dir, "python3.12", "3.12.11")
+    _write_fake_python(bin_dir, "python", "3.14.6")
+
+    result = _run_setup(tmp_path)
+
+    assert result.returncode == 0, result.stdout
+    assert "Python 3.12.11 found" in result.stdout
+    assert (tmp_path / "checkout" / "venv" / "bin" / "python").exists()
+
+
+def test_setup_script_rejects_unsupported_default(tmp_path: Path) -> None:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    _write_fake_python(bin_dir, "python", "3.14.6")
+    _write_unsupported_explicit_pythons(bin_dir)
+
+    result = _run_setup(tmp_path)
+
+    assert result.returncode == 1
+    assert "Termux Python Python 3.14.6 is not supported" in result.stdout
+    assert "Hermes requires Python >=3.11,<3.14" in result.stdout
diff --git a/tests/test_managed_runtime_resolution.py b/tests/test_managed_runtime_resolution.py
index e52a4ddcfb..e3943e351a 100644
--- a/tests/test_managed_runtime_resolution.py
+++ b/tests/test_managed_runtime_resolution.py
@@ -27,6 +27,7 @@ from __future__ import annotations
 
 import ast
 import functools
+import os
 from pathlib import Path
 
 import pytest
@@ -122,21 +123,23 @@ def _iter_which_calls(tree: ast.AST):
 
 def _source_files() -> list[Path]:
     files: list[Path] = []
-    for path in REPO_ROOT.rglob("*.py"):
-        rel = path.relative_to(REPO_ROOT)
-        if rel.parts and rel.parts[0] in _EXEMPT_DIRS:
-            continue
-        # Skip packaging copies of the source tree (sdist extractions like
-        # hermes_agent-0.20.5/, build/ and *.egg-info dirs). CI jobs that
-        # build the wheel leave one in the workspace; scanning it re-finds
-        # every already-exempted call site under a versioned path prefix
-        # that can never match an _ALLOWED key, failing the guard on code
-        # that was never touched. A dir is a packaging copy iff its top
-        # level carries PKG-INFO (sdist/egg metadata) or it is a build/
-        # dist output directory.
-        if rel.parts and _is_packaging_copy(rel.parts[0]):
-            continue
-        files.append(path)
+    # os.walk instead of Path.rglob: rglob raises FileNotFoundError when a
+    # directory vanishes mid-scan — a sibling CI job's sdist extraction
+    # (hermes_agent-<version>/) gets created and deleted concurrently, and
+    # that TOCTOU failed this guard on runs 33531869442/33455779041-era
+    # workspaces. os.walk tolerates vanishing dirs (onerror=None), and
+    # pruning exempt/packaging dirs at the top level also skips their
+    # subtrees entirely.
+    for dirpath, dirnames, filenames in os.walk(REPO_ROOT):
+        rel_dir = Path(dirpath).relative_to(REPO_ROOT)
+        if rel_dir == Path("."):
+            dirnames[:] = [
+                d for d in dirnames
+                if d not in _EXEMPT_DIRS and not _is_packaging_copy(d)
+            ]
+        for fname in filenames:
+            if fname.endswith(".py"):
+                files.append(Path(dirpath) / fname)
     return files
 
 
diff --git a/tests/test_model_tools.py b/tests/test_model_tools.py
index a967f61575..9e1fa9886e 100644
--- a/tests/test_model_tools.py
+++ b/tests/test_model_tools.py
@@ -227,7 +227,7 @@ class TestHandleFunctionCall:
 
 class TestAgentLoopTools:
     def test_expected_tools_in_set(self):
-        assert "todo" in _AGENT_LOOP_TOOLS
+        assert "todo_list" in _AGENT_LOOP_TOOLS
         assert "memory" in _AGENT_LOOP_TOOLS
         assert "session_search" in _AGENT_LOOP_TOOLS
         assert "delegate_task" in _AGENT_LOOP_TOOLS
diff --git a/tests/test_session_vacuum_config.py b/tests/test_session_vacuum_config.py
index d231996b59..43adfdacba 100644
--- a/tests/test_session_vacuum_config.py
+++ b/tests/test_session_vacuum_config.py
@@ -8,6 +8,87 @@ def test_default_config_exposes_vacuum_interval():
     assert DEFAULT_CONFIG["sessions"]["min_vacuum_interval_days"] == 30
 
 
+def test_default_config_auto_prune_on_with_90_day_retention():
+    """#54189: state.db retention is ON by default (ended sessions, 90 days)."""
+    from hermes_cli.config import DEFAULT_CONFIG
+
+    sessions = DEFAULT_CONFIG["sessions"]
+    assert sessions["auto_prune"] is True
+    assert sessions["retention_days"] == 90
+    assert sessions["vacuum_after_prune"] is True
+
+
+def test_fresh_config_runs_auto_prune_at_startup(monkeypatch, tmp_path: Path):
+    """A config.yaml with NO ``sessions:`` keys must reach the prune call with the
+    new defaults (the loader deep-merges DEFAULT_CONFIG)."""
+    import cli
+    import hermes_cli.config
+    import hermes_constants
+    from hermes_cli.config import DEFAULT_CONFIG
+
+    session_db = MagicMock()
+    session_db.get_meta.return_value = "already-done"
+    # Simulate load_config() on a fresh home: only defaults for the section.
+    monkeypatch.setattr(
+        hermes_cli.config,
+        "load_config",
+        lambda: {"sessions": dict(DEFAULT_CONFIG["sessions"])},
+    )
+    monkeypatch.setattr(hermes_constants, "get_hermes_home", lambda: tmp_path)
+
+    cli._run_state_db_auto_maintenance(session_db)
+
+    session_db.maybe_auto_prune_and_vacuum.assert_called_once_with(
+        retention_days=90,
+        min_interval_hours=24,
+        min_vacuum_interval_days=30,
+        vacuum=True,
+        sessions_dir=tmp_path / "sessions",
+    )
+
+
+def test_explicit_auto_prune_false_is_respected(monkeypatch, tmp_path: Path):
+    """Migration guard: an install that explicitly opted out keeps its choice."""
+    import cli
+    import hermes_cli.config
+    import hermes_constants
+
+    session_db = MagicMock()
+    session_db.get_meta.return_value = "already-done"
+    monkeypatch.setattr(
+        hermes_cli.config,
+        "load_config",
+        lambda: {"sessions": {"auto_prune": False, "retention_days": 90}},
+    )
+    monkeypatch.setattr(hermes_constants, "get_hermes_home", lambda: tmp_path)
+
+    cli._run_state_db_auto_maintenance(session_db)
+
+    session_db.maybe_auto_prune_and_vacuum.assert_not_called()
+
+
+def test_shipped_template_does_not_pin_sessions_keys():
+    """Installers copy cli-config.yaml.example verbatim into config.yaml, so any
+    uncommented ``sessions:`` value there becomes an EXPLICIT user setting that
+    would freeze the retention defaults. The template must leave them commented
+    so code defaults (and future flips) apply."""
+    import yaml
+
+    template = Path(__file__).resolve().parents[1] / "cli-config.yaml.example"
+    data = yaml.safe_load(template.read_text(encoding="utf-8")) or {}
+    assert "sessions" not in data
+
+
+def test_loader_yields_new_defaults_for_fresh_home(monkeypatch, tmp_path: Path):
+    """Real load_config() against an empty HERMES_HOME → auto_prune on, 90 days."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    from hermes_cli.config import load_config
+
+    sessions = load_config().get("sessions") or {}
+    assert sessions.get("auto_prune") is True
+    assert sessions.get("retention_days") == 90
+
+
 def test_cli_auto_maintenance_forwards_vacuum_interval(monkeypatch, tmp_path: Path):
     import cli
     import hermes_cli.config
diff --git a/tests/test_sqlite_wal_reset_gate.py b/tests/test_sqlite_wal_reset_gate.py
index a717b6bb5e..1dafce8115 100644
--- a/tests/test_sqlite_wal_reset_gate.py
+++ b/tests/test_sqlite_wal_reset_gate.py
@@ -69,6 +69,7 @@ class TestApplyWalWalResetGate:
         assert mode == "delete"
         assert conn.execute("PRAGMA journal_mode").fetchone()[0].lower() == "delete"
         assert any("instead of enabling WAL" in r.getMessage() for r in caplog.records)
+        assert any(sys.executable in r.getMessage() for r in caplog.records)
         conn.close()
 
     def test_existing_wal_left_alone_when_vulnerable(
diff --git a/tests/test_state_db_notadb_fail_closed.py b/tests/test_state_db_notadb_fail_closed.py
index fbdf376fef..9fce19e3e1 100644
--- a/tests/test_state_db_notadb_fail_closed.py
+++ b/tests/test_state_db_notadb_fail_closed.py
@@ -1,9 +1,10 @@
 """Tests for fail-closed state.db NOTADB handling and journal-mode EIO retries.
 
-Covers the two independently-valuable pieces salvaged from the state.db
-hardening rollup:
+Covers:
 
 * fail closed when a live write connection reports ``file is not a database``;
+* the write-path SQLITE_IOERR retry boundary: admitted only when the callback
+  has provably not run, never by closing and replaying;
 * transient ``disk i/o error`` retry in ``_on_disk_journal_mode`` so a
   one-shot EIO doesn't push callers onto the fail-closed unknown-mode branch.
 """
@@ -13,7 +14,7 @@ from unittest.mock import MagicMock
 
 import pytest
 
-from hermes_state import SessionDB, _on_disk_journal_mode
+from hermes_state import SessionDB, StateDbCorruptError, _on_disk_journal_mode
 
 
 class _NotADbOnce:
@@ -41,14 +42,100 @@ class TestFailClosedAfterNotADb:
             reopen = MagicMock()
             monkeypatch.setattr("hermes_state._connect_tracked_db", reopen)
             db._conn = _NotADbOnce(real_conn)
-            with pytest.raises(sqlite3.DatabaseError, match="not a database"):
+            with pytest.raises(sqlite3.DatabaseError, match="not a database") as excinfo:
                 db.create_session(session_id="s2", source="cli", model="test")
             reopen.assert_not_called()
+            # NOTADB on a live write is structural: the handle is quarantined.
+            assert isinstance(excinfo.value, StateDbCorruptError)
+            assert db._db_corrupt is True
         finally:
             db._conn = real_conn
             db.close()
 
 
+class TestWriteIoerrRetryBoundary:
+    """IOERR retry is admitted by EFFECT POSITION, not error spelling.
+
+    ``_execute_write`` owns non-idempotent transcript/counter mutations, so
+    replaying its callback is only safe when the first attempt provably did
+    nothing. SQLite does not define ``SQLITE_IOERR`` as pre-effect-only (an
+    IOERR at fsync/commit may or may not have landed), so the admission gate
+    is "did the callback start", not "does the message say disk I/O".
+    """
+
+    def test_ioerr_on_begin_retries_because_the_callback_never_ran(self, tmp_path):
+        db = SessionDB(db_path=tmp_path / "state.db")
+        real_conn = db._conn
+        try:
+
+            class _BeginIoerrOnce:
+                def __init__(self, conn):
+                    self._real = conn
+                    self.begins = 0
+
+                def execute(self, sql, *args, **kwargs):
+                    if str(sql).strip().upper().startswith("BEGIN") and self.begins == 0:
+                        self.begins += 1
+                        raise sqlite3.OperationalError("disk I/O error")
+                    return self._real.execute(sql, *args, **kwargs)
+
+                def __getattr__(self, name):
+                    return getattr(self._real, name)
+
+            proxy = _BeginIoerrOnce(real_conn)
+            db._conn = proxy
+            db.create_session(session_id="s1", source="cli", model="test")
+            assert proxy.begins == 1
+        finally:
+            db._conn = real_conn
+
+        rows = db.list_sessions_rich(limit=10, compact_rows=True)
+        assert [row["id"] for row in rows] == ["s1"]
+        db.close()
+
+    def test_ioerr_after_the_callback_mutates_does_not_replay(self, tmp_path):
+        """Settlement is unknown once the callback has run — surface, don't rerun."""
+        db = SessionDB(db_path=tmp_path / "state.db")
+        try:
+            calls = []
+
+            def mutate_then_fail(conn):
+                calls.append(1)
+                conn.execute(
+                    "INSERT INTO sessions (id, started_at, source) VALUES (?, ?, ?)",
+                    (f"row-{len(calls)}", 1.0, "cli"),
+                )
+                raise sqlite3.OperationalError("disk I/O error")
+
+            with pytest.raises(sqlite3.OperationalError, match="disk I/O error"):
+                db._execute_write(mutate_then_fail)
+
+            assert calls == [1], "a started write must not be replayed"
+            assert db.list_sessions_rich(limit=10, compact_rows=True) == []
+        finally:
+            db.close()
+
+    def test_write_ioerr_never_closes_the_connection(self, tmp_path, monkeypatch):
+        """close() cancels this process's POSIX locks for every sibling fd."""
+        db = SessionDB(db_path=tmp_path / "state.db")
+        try:
+            closed = []
+            monkeypatch.setattr(
+                type(db._conn), "close", lambda self: closed.append(1), raising=False
+            )
+
+            def always_ioerr(conn):
+                raise sqlite3.OperationalError("disk I/O error")
+
+            with pytest.raises(sqlite3.OperationalError):
+                db._execute_write(always_ioerr)
+
+            assert closed == []
+            assert db._conn is not None
+        finally:
+            db.close()
+
+
 class TestOnDiskJournalModeEioRetry:
     def _conn_raising_then(self, failures, result_rows):
         conn = MagicMock()
diff --git a/tests/test_toolsets.py b/tests/test_toolsets.py
index 73ce7a9eab..8499335d6a 100644
--- a/tests/test_toolsets.py
+++ b/tests/test_toolsets.py
@@ -265,7 +265,7 @@ class TestResolveToolsetIncludeRegistry:
         finally:
             registry.deregister("__probe_registry_only_tool__")
 
-        assert static == {"terminal", "process"}, static
+        assert static == {"terminal", "process_manage"}, static
         # Registered into 'terminal' but not part of the static definition — it
         # must only appear in the merged view.
         assert "__probe_registry_only_tool__" in merged
@@ -275,7 +275,7 @@ class TestResolveToolsetIncludeRegistry:
     def test_static_view_threads_through_includes(self):
         # 'debugging' has direct tools [terminal, process] and includes [web, file]
         static = set(resolve_toolset("debugging", include_registry=False))
-        assert {"terminal", "process"} <= static
+        assert {"terminal", "process_manage"} <= static
         assert "web_search" in static
         assert "read_file" in static
 
diff --git a/tests/test_tui_gateway_server.py b/tests/test_tui_gateway_server.py
index 08ecdcfd6e..b5ea0fccdc 100644
--- a/tests/test_tui_gateway_server.py
+++ b/tests/test_tui_gateway_server.py
@@ -633,7 +633,7 @@ def test_slash_exec_compress_flag_on_applies_host_control_mirror(monkeypatch):
         def __init__(self):
             self.controls = []
 
-        def control(self, sid, *, route_name, payload=None, wait=True, timeout=30.0):
+        def control(self, sid, *, route_name, payload=None, wait=True, timeout=30.0, on_late_ack=None):
             self.controls.append((sid, route_name, dict(payload or {}), wait))
             return {
                 "type": "control.ack",
@@ -5534,7 +5534,7 @@ def test_superseded_runtime_finalized_without_reclaimed_broadcast(monkeypatch):
         # mark it finalized-for-lookup via a different stored key is wrong —
         # instead simulate the mint race by removing it from lookup).
         old["_finalized"] = False
-        monkeypatch.setattr(server, "_find_live_session_by_key", lambda _k: None)
+        monkeypatch.setattr(server, "_find_live_session_by_key", lambda _k, *_a: None)
 
         result = server._claim_or_reuse_live("new-sid", "stored-super", fresh, None)
 
@@ -5765,6 +5765,147 @@ def test_ws_orphan_reap_disabled_when_grace_zero(monkeypatch):
     assert fired["timer"] is False
 
 
+def test_ws_orphan_reap_defers_running_turn_with_fresh_activity(monkeypatch):
+    """#98028/#100325: a client-absent turn whose activity clock is fresh is
+    NOT interrupted — it keeps running detached and the reaper re-polls at the
+    grace interval. Once the clock goes stale the wedged-turn interrupt fires,
+    and after the turn settles the session is reaped as before."""
+    callbacks = []
+    delays = []
+    interrupted = []
+    torn_down = []
+
+    class _Timer:
+        def __init__(self, delay, callback):
+            delays.append(delay)
+            callbacks.append(callback)
+            self.daemon = False
+
+        def start(self):
+            return None
+
+    activity = {"seconds_since_activity": 1.0}
+    agent = types.SimpleNamespace(
+        get_activity_summary=lambda: dict(activity),
+        interrupt=lambda message=None: interrupted.append("interrupted"),
+    )
+
+    class _DeadThread:
+        def is_alive(self):
+            return False
+
+    session = _session(
+        agent=agent,
+        transport=server._detached_ws_transport,
+        running=True,
+        _run_thread=_DeadThread(),
+    )
+    server._sessions["fresh-sid"] = session
+    monkeypatch.setattr(server, "_WS_ORPHAN_REAP_GRACE_S", 0.01)
+    monkeypatch.setattr(server, "_WS_ORPHAN_ACTIVITY_STALE_S", 300.0)
+    monkeypatch.setattr(server.threading, "Timer", _Timer)
+    monkeypatch.setattr(server, "_load_cfg", lambda: {})
+    monkeypatch.setattr(
+        server,
+        "_teardown_popped_session",
+        lambda claimed, *, end_reason: torn_down.append((claimed, end_reason)) or True,
+    )
+
+    try:
+        server._schedule_ws_orphan_reap("fresh-sid")
+
+        # Two grace cycles with fresh activity: no interrupt, reschedule at
+        # the GRACE interval (not the 1s interrupt-settle poll).
+        for _ in range(2):
+            callbacks.pop(0)()
+            assert interrupted == []
+            assert not session.get("_client_gone_interrupt_requested")
+            assert delays[-1] == server._WS_ORPHAN_REAP_GRACE_S
+            assert "fresh-sid" in server._sessions
+
+        # Activity goes stale (turn wedged) -> interrupt fires on next poll.
+        activity["seconds_since_activity"] = 301.0
+        callbacks.pop(0)()
+        assert interrupted == ["interrupted"]
+        assert session["_client_gone_interrupt_requested"] is True
+
+        # Turn settles -> reap proceeds exactly as today.
+        session["running"] = False
+        callbacks.pop(0)()
+        assert "fresh-sid" not in server._sessions
+        assert torn_down == [(session, "ws_orphan_reap")]
+    finally:
+        server._sessions.pop("fresh-sid", None)
+
+
+def test_ws_orphan_activity_gate_zero_restores_interrupt_at_grace(monkeypatch):
+    """ws_orphan_activity_stale_s=0 opts out: fresh activity no longer defers
+    the client-gone interrupt (pre-#98028 behaviour)."""
+    callbacks = []
+    interrupted = []
+
+    class _Timer:
+        def __init__(self, _delay, callback):
+            callbacks.append(callback)
+            self.daemon = False
+
+        def start(self):
+            return None
+
+    class _LiveThread:
+        def is_alive(self):
+            return True
+
+    agent = types.SimpleNamespace(
+        get_activity_summary=lambda: {"seconds_since_activity": 0.5},
+        interrupt=lambda message=None: interrupted.append("interrupted"),
+    )
+    session = _session(
+        agent=agent,
+        transport=server._detached_ws_transport,
+        running=True,
+        _run_thread=_LiveThread(),
+    )
+    server._sessions["optout-sid"] = session
+    monkeypatch.setattr(server, "_WS_ORPHAN_REAP_GRACE_S", 0.01)
+    monkeypatch.setattr(server, "_WS_ORPHAN_ACTIVITY_STALE_S", 0.0)
+    monkeypatch.setattr(server.threading, "Timer", _Timer)
+    monkeypatch.setattr(server, "_load_cfg", lambda: {})
+
+    try:
+        server._schedule_ws_orphan_reap("optout-sid")
+        callbacks.pop(0)()
+        assert interrupted == ["interrupted"]
+        assert session["_client_gone_interrupt_requested"] is True
+    finally:
+        server._sessions.pop("optout-sid", None)
+
+
+def test_ws_orphan_activity_gate_unreadable_summary_stays_eligible(monkeypatch):
+    """A broken/opaque activity summary must fail CLOSED (not fresh): the
+    wedged-turn interrupt-at-grace safety net is preserved."""
+
+    def _boom():
+        raise RuntimeError("summary unavailable")
+
+    agent = types.SimpleNamespace(get_activity_summary=_boom)
+    monkeypatch.setattr(server, "_WS_ORPHAN_ACTIVITY_STALE_S", 300.0)
+    assert server._ws_orphan_turn_activity_is_fresh({"agent": agent}) is False
+    # No agent / no summary method: same conservative answer.
+    assert server._ws_orphan_turn_activity_is_fresh({"agent": None}) is False
+    assert (
+        server._ws_orphan_turn_activity_is_fresh(
+            {"agent": types.SimpleNamespace()}
+        )
+        is False
+    )
+    # Never-stamped clock (None) is not fresh either.
+    agent2 = types.SimpleNamespace(
+        get_activity_summary=lambda: {"seconds_since_activity": None}
+    )
+    assert server._ws_orphan_turn_activity_is_fresh({"agent": agent2}) is False
+
+
 def test_init_session_fires_reset_hook(monkeypatch):
     hooks = []
 
@@ -8363,7 +8504,7 @@ def test_config_set_fast_updates_live_agent_session_scoped(monkeypatch):
     monkeypatch.setattr(server, "_emit", lambda *args: emits.append(args))
     monkeypatch.setattr(
         "hermes_cli.models.resolve_fast_mode_overrides",
-        lambda _model_id: {"service_tier": "priority"},
+        lambda _model_id, **_route: {"service_tier": "priority"},
     )
 
     try:
@@ -8442,7 +8583,7 @@ def test_config_set_fast_rejects_unsupported_model(monkeypatch):
     )
     monkeypatch.setattr(
         "hermes_cli.models.resolve_fast_mode_overrides",
-        lambda _model_id: None,
+        lambda _model_id, **_route: None,
     )
 
     try:
@@ -8762,7 +8903,7 @@ def test_enable_gateway_prompts_sets_gateway_env(monkeypatch):
 
 
 def test_setup_status_reports_provider_config(monkeypatch):
-    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda: False)
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: False)
 
     resp = server.handle_request({"id": "1", "method": "setup.status", "params": {}})
 
@@ -8784,7 +8925,7 @@ def test_probe_credentials_allows_keyless_custom_runtime():
 
 
 def test_setup_runtime_check_rejects_empty_runtime_key(monkeypatch):
-    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda: True)
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: True)
     monkeypatch.setattr(
         "hermes_cli.runtime_provider.resolve_runtime_provider",
         lambda requested=None: {
@@ -8806,7 +8947,7 @@ def test_setup_runtime_check_rejects_empty_runtime_key(monkeypatch):
 
 
 def test_setup_runtime_check_allows_no_key_custom_runtime(monkeypatch):
-    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda: True)
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: True)
     monkeypatch.setattr(
         "hermes_cli.runtime_provider.resolve_runtime_provider",
         lambda requested=None: {
@@ -8823,7 +8964,7 @@ def test_setup_runtime_check_allows_no_key_custom_runtime(monkeypatch):
 
 
 def test_setup_runtime_check_rejects_implicit_bedrock_when_unconfigured(monkeypatch):
-    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda: False)
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: False)
     monkeypatch.setattr(
         "hermes_cli.runtime_provider.resolve_runtime_provider",
         lambda requested=None: {
@@ -8841,7 +8982,7 @@ def test_setup_runtime_check_rejects_implicit_bedrock_when_unconfigured(monkeypa
 
 def test_setup_runtime_check_honors_requested_provider(monkeypatch):
     """Onboarding must be able to validate the provider the user just connected."""
-    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda: True)
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: True)
 
     def fake_resolve(requested=None, **kwargs):
         if requested == "nous":
@@ -8872,6 +9013,67 @@ def test_setup_runtime_check_honors_requested_provider(monkeypatch):
     assert default["result"]["provider"] == "anthropic"
 
 
+def test_setup_readiness_scopes_to_requested_profile(monkeypatch, tmp_path):
+    """#94071: the Desktop preflights a freshly created bot on its target
+    backend. ``profile`` binds THAT profile's home + .env — launch-process
+    credentials must not make an unconfigured bot look ready, and the bot's
+    own .env must be what the strict check sees."""
+    from agent import secret_scope
+    from hermes_constants import get_hermes_home
+
+    bot_home = tmp_path / "profiles" / "bot"
+    bot_home.mkdir(parents=True)
+    monkeypatch.setenv("OPENROUTER_API_KEY", "sk-or-launch-profile-secret-0000")
+    monkeypatch.setattr("hermes_cli.profiles.profile_exists", lambda name: name == "bot")
+    monkeypatch.setattr(server, "_profile_home", lambda profile: bot_home if profile == "bot" else None)
+    seen = {}
+
+    def fake_resolve(requested=None, **kwargs):
+        seen["home"] = Path(str(get_hermes_home())).resolve()
+        seen["secret"] = secret_scope.get_secret("OPENROUTER_API_KEY")
+        return {"provider": "openrouter", "api_key": seen["secret"] or "", "source": "env"}
+
+    monkeypatch.setattr("hermes_cli.runtime_provider.resolve_runtime_provider", fake_resolve)
+
+    secret_scope.set_multiplex_active(True)
+    try:
+        status = server.handle_request(
+            {"id": "1", "method": "setup.status", "params": {"profile": "bot"}}
+        )
+        assert status["result"] == {"provider_configured": False, "profile": "bot"}
+
+        (bot_home / ".env").write_text("OPENROUTER_API_KEY=sk-or-bot-profile-secret-00001\n")
+        status = server.handle_request(
+            {"id": "2", "method": "setup.status", "params": {"profile": "bot"}}
+        )
+        runtime = server.handle_request(
+            {"id": "3", "method": "setup.runtime_check", "params": {"profile": "bot"}}
+        )
+    finally:
+        secret_scope.set_multiplex_active(False)
+
+    assert status["result"] == {"provider_configured": True, "profile": "bot"}
+    assert runtime["result"]["ok"] is True
+    assert runtime["result"]["profile"] == "bot"
+    assert seen == {"home": bot_home.resolve(), "secret": "sk-or-bot-profile-secret-00001"}
+    assert Path(str(get_hermes_home())).resolve() != bot_home.resolve()
+
+
+def test_setup_readiness_unknown_profile_never_answers_for_launch_profile(monkeypatch):
+    monkeypatch.setattr("hermes_cli.main._has_any_provider_configured", lambda **_kw: True)
+    monkeypatch.setattr(
+        "hermes_cli.runtime_provider.resolve_runtime_provider",
+        lambda requested=None, **kw: {"provider": "openrouter", "api_key": "sk-or-launch-0000000000", "source": "env"},
+    )
+    monkeypatch.setattr("hermes_cli.profiles.profile_exists", lambda name: False)
+
+    for method in ("setup.status", "setup.runtime_check"):
+        resp = server.handle_request({"id": "1", "method": method, "params": {"profile": "ghost"}})
+        assert resp["result"]["ok"] is False
+        assert resp["result"]["profile"] == "ghost"
+        assert "does not exist" in resp["result"]["error"]
+
+
 def test_complete_slash_drops_removed_provider_alias():
     # `/provider` was folded into a single `/model` command, so autocomplete
     # must no longer offer the dead alias...
@@ -10359,7 +10561,7 @@ def test_session_compress_returns_compute_host_history(monkeypatch):
     }
 
 
-def test_session_compress_forwards_120_second_budget_to_compute_host(monkeypatch):
+def test_session_compress_forwards_config_ceiling_budget_to_compute_host(monkeypatch):
     session = _session(agent=None, _compute_host_active=True)
     server._sessions["sid"] = session
     calls = []
@@ -10378,6 +10580,9 @@ def test_session_compress_forwards_120_second_budget_to_compute_host(monkeypatch
 
     monkeypatch.setattr(server, "_session_uses_compute_host", lambda _session: True)
     monkeypatch.setattr(server, "_send_compute_host_control", send_control)
+    monkeypatch.setattr(
+        server, "_load_cfg", lambda: {"compression": {"context_total_ceiling_seconds": 300}}
+    )
 
     try:
         resp = server.handle_request(
@@ -10387,17 +10592,17 @@ def test_session_compress_forwards_120_second_budget_to_compute_host(monkeypatch
         server._sessions.pop("sid", None)
 
     assert resp["result"]["status"] == "compressed"
-    assert calls == [
-        (
-            ("sid",),
-            {
-                "route_name": "session.compress",
-                "command": "/compress",
-                "wait": True,
-                "timeout": 120.0,
-            },
-        )
-    ]
+    assert len(calls) == 1
+    (sid_arg,), kwargs = calls[0]
+    assert sid_arg == "sid"
+    assert kwargs["route_name"] == "session.compress"
+    assert kwargs["command"] == "/compress"
+    assert kwargs["wait"] is True
+    # #97948: the waiter follows compression.context_total_ceiling_seconds
+    # (+30s slack) instead of a hard-coded 120s, and registers a late-ack
+    # handler so a compress that outlives it is still adopted.
+    assert kwargs["timeout"] == 330.0
+    assert callable(kwargs["on_late_ack"])
 
 
 def test_session_compress_preserves_compute_host_aborted_summary(monkeypatch):
@@ -13547,7 +13752,13 @@ def test_slow_agent_build_emits_keyed_progress_notice(monkeypatch):
 def test_agent_build_failure_surfaces_error_and_drops_turn(monkeypatch):
     """When the build itself FAILS (agent_error set when ready fires), the
     prompt must not run and the failure must reach the client as a visible
-    error event — never a silent drop."""
+    error event — never a silent drop.
+
+    prompt.submit retries a completed failed build once (fresh provider
+    resolution un-wedges sessions whose failure cause was fixed), so the
+    build stub here is a faithful failing build: it sets agent_error and
+    fires the session's CURRENT ready event (the retry installs a new one).
+    A no-op stub would leave that event unset and hang the patient wait."""
     threads = []
     emitted = []
     calls = {"run_prompt": 0}
@@ -13570,12 +13781,16 @@ def test_agent_build_failure_surfaces_error_and_drops_turn(monkeypatch):
     session["agent_error"] = "No LLM provider configured"  # ...but failed
     server._sessions["sid"] = session
 
+    def _failing_build(sid, session):
+        session["agent_error"] = "No LLM provider configured"
+        session["agent_ready"].set()
+
     try:
         monkeypatch.setattr(server.threading, "Thread", _FakeThread)
         monkeypatch.setattr(server, "_emit", lambda *args, **kwargs: emitted.append(args))
         monkeypatch.setattr(server, "_ensure_session_db_row", lambda session: None)
         monkeypatch.setattr(server, "_persist_branch_seed", lambda session: None)
-        monkeypatch.setattr(server, "_start_agent_build", lambda sid, session: None)
+        monkeypatch.setattr(server, "_start_agent_build", _failing_build)
         monkeypatch.setattr(
             server,
             "_run_prompt_submit",
@@ -14835,6 +15050,73 @@ def test_session_most_recent_honors_params_profile(monkeypatch, tmp_path):
     assert resp["result"]["session_id"] == "ml-tip"
 
 
+def test_handoff_request_uses_session_profile_home(monkeypatch, tmp_path):
+    """Handoff validation must read the owning session's gateway config."""
+    import contextlib
+
+    from gateway.config import GatewayConfig, HomeChannel, Platform, PlatformConfig
+    from hermes_cli.config import get_hermes_home
+    from tui_gateway import methods_session
+
+    methods_session.register(server)
+    profile_home = tmp_path / "profiles" / "coder"
+    profile_home.mkdir(parents=True)
+    seen_homes = []
+
+    def load_config():
+        home = get_hermes_home()
+        seen_homes.append(home)
+        config = GatewayConfig()
+        if home == profile_home:
+            config.platforms[Platform.DISCORD] = PlatformConfig(
+                enabled=True,
+                home_channel=HomeChannel(
+                    platform=Platform.DISCORD,
+                    chat_id="discord-home",
+                    name="Hermes / #chat-coding",
+                ),
+            )
+        return config
+
+    class ProfileDB:
+        def get_session(self, _key):
+            return {"id": _key}
+
+        def request_handoff(self, _key, platform):
+            return platform == "discord"
+
+    @contextlib.contextmanager
+    def profile_db(_session):
+        yield ProfileDB()
+
+    monkeypatch.setattr("gateway.config.load_gateway_config", load_config)
+    monkeypatch.setattr(server, "_ensure_session_db_row", lambda _session: None)
+    monkeypatch.setattr(server, "_session_db", profile_db)
+    server._sessions["handoff-profile"] = {
+        "running": False,
+        "session_key": "desktop-coder-session",
+        "profile_home": str(profile_home),
+    }
+    try:
+        resp = server.handle_request(
+            {
+                "id": "1",
+                "method": "handoff.request",
+                "params": {
+                    "session_id": "handoff-profile",
+                    "platform": "discord",
+                },
+            }
+        )
+    finally:
+        server._sessions.pop("handoff-profile", None)
+
+    assert "result" in resp, resp
+    assert resp["result"]["queued"] is True
+    assert seen_homes == [profile_home]
+    assert get_hermes_home() != profile_home
+
+
 def test_session_create_reports_requested_profile_name(monkeypatch, tmp_path):
     """Issue #62503: session.create info.profile_name must not always be launch."""
     profile_home = tmp_path / "profiles" / "mlperf"
@@ -15272,6 +15554,312 @@ def test_session_branch_writes_to_parent_profile_db(monkeypatch, tmp_path):
             server._sessions.pop(k, None)
 
 
+def test_session_create_persists_seeded_branch_child(monkeypatch):
+    """A desktop branch (session.create with parent_session_id + seeded
+    messages) must persist its row + transcript immediately (#93959).
+
+    The renderer re-fetches the fresh child via REST and defer_history
+    hydration right after create; both read the DB. An unpersisted child
+    404s/hydrates empty, the client fail-latch refuses to bind it, and the
+    user gets an infinite spinner whose optimistic row vanishes on restart.
+    """
+
+    class _FakeAgent:
+        def __init__(self):
+            self.model = "test-model"
+
+    seen: dict = {}
+
+    class _FakeDB:
+        def get_session_title(self, key):
+            seen["parent_title"] = key
+            return "My Parent Session"
+
+        def get_next_title_in_lineage(self, current):
+            return f"{current} #2"
+
+        def create_session(self, key, **kwargs):
+            seen["created"] = key
+            seen["parent"] = kwargs.get("parent_session_id")
+            seen["branched_from"] = (kwargs.get("model_config") or {}).get("_branched_from")
+
+        def append_messages_batch(self, session_id, messages, **kwargs):
+            seen["messages"] = list(messages)
+
+        def set_session_title(self, key, title):
+            seen["title"] = title
+            return True
+
+    monkeypatch.setattr(server, "_get_db", lambda: _FakeDB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_db=None, **_kw: _FakeAgent())
+    monkeypatch.setattr(server, "_SlashWorker", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_session_info", lambda _a, *a2: {"model": "x"})
+    monkeypatch.setattr(server, "_probe_credentials", lambda _a: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda _sid: None)
+    monkeypatch.setattr(server, "_emit", lambda *a, **kw: None)
+
+    import tools.approval as _approval
+
+    monkeypatch.setattr(_approval, "register_gateway_notify", lambda key, cb: None)
+    monkeypatch.setattr(_approval, "load_permanent_allowlist", lambda: None)
+
+    seeded = [
+        {"role": "user", "content": "hello from parent"},
+        {"role": "assistant", "content": "parent reply"},
+    ]
+
+    resp = server.handle_request(
+        {
+            "id": "1",
+            "method": "session.create",
+            "params": {
+                "cols": 96,
+                "source": "desktop",
+                "parent_session_id": "20260823_084113_6de211",
+                "messages": seeded,
+            },
+        }
+    )
+
+    assert "result" in resp, resp
+    key = resp["result"]["stored_session_id"]
+
+    # Row persisted up front with lineage linkage and a lineage title —
+    # not deferred to the first prompt.
+    assert seen.get("created") == key
+    assert seen.get("parent") == "20260823_084113_6de211"
+    assert seen.get("branched_from") == "20260823_084113_6de211"
+    assert seen.get("title") == "My Parent Session #2"
+
+    # Seeded transcript copied into the durable row so REST prefetch and
+    # defer_history hydration both find it immediately.
+    assert len(seen.get("messages") or []) == 2
+    assert seen["messages"][0]["content"] == "hello from parent"
+
+    # The live record no longer queues the title — the DB already holds it.
+    runtime_sid = resp["result"]["session_id"]
+    assert server._sessions[runtime_sid]["pending_title"] is None
+
+    server._sessions.pop(runtime_sid, None)
+
+
+def test_session_create_branch_seed_failure_does_not_break_create(monkeypatch):
+    """Best-effort persistence: a broken DB must not fail session.create."""
+
+    class _FakeAgent:
+        def __init__(self):
+            self.model = "test-model"
+
+    class _BrokenDB:
+        def get_session_title(self, key):
+            raise RuntimeError("db down")
+
+    monkeypatch.setattr(server, "_get_db", lambda: _BrokenDB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_db=None, **_kw: _FakeAgent())
+    monkeypatch.setattr(server, "_SlashWorker", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_session_info", lambda _a, *a2: {"model": "x"})
+    monkeypatch.setattr(server, "_probe_credentials", lambda _a: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda _sid: None)
+    monkeypatch.setattr(server, "_emit", lambda *a, **kw: None)
+
+    import tools.approval as _approval
+
+    monkeypatch.setattr(_approval, "register_gateway_notify", lambda key, cb: None)
+    monkeypatch.setattr(_approval, "load_permanent_allowlist", lambda: None)
+
+    resp = server.handle_request(
+        {
+            "id": "1",
+            "method": "session.create",
+            "params": {
+                "source": "desktop",
+                "parent_session_id": "parent-1",
+                "messages": [{"role": "user", "content": "seed"}],
+            },
+        }
+    )
+
+    # Create itself still succeeds — the lazy first-prompt path remains as
+    # the fallback for the seed.
+    assert "result" in resp
+
+    server._sessions.pop(resp["result"]["stored_session_id"], None)
+
+
+def test_session_create_seed_failure_after_row_compensates(monkeypatch):
+    """Partial-failure compensation (#93959 review): if the row commits but
+    the transcript copy fails, the just-created child is DELETED so the lazy
+    first-prompt fallback can retry cleanly. Without this, a durable empty
+    row defeats _ensure_session_db_row's INSERT OR IGNORE and the renderer
+    fail-latches on a transcript-less session again."""
+
+    class _FakeAgent:
+        def __init__(self):
+            self.model = "test-model"
+
+    seen: dict = {}
+
+    class _FakeDB:
+        def get_session_title(self, key):
+            return "Parent"
+
+        def get_next_title_in_lineage(self, current):
+            return f"{current} #2"
+
+        def create_session(self, key, **kwargs):
+            seen["created"] = key
+
+        def append_messages_batch(self, session_id, messages, **kwargs):
+            raise RuntimeError("transcript write failed")
+
+        def delete_session(self, session_id):
+            seen["deleted"] = session_id
+            return True
+
+    monkeypatch.setattr(server, "_get_db", lambda: _FakeDB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_db=None, **_kw: _FakeAgent())
+    monkeypatch.setattr(server, "_SlashWorker", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_session_info", lambda _a, *a2: {"model": "x"})
+    monkeypatch.setattr(server, "_probe_credentials", lambda _a: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda _sid: None)
+    monkeypatch.setattr(server, "_emit", lambda *a, **kw: None)
+
+    import tools.approval as _approval
+
+    monkeypatch.setattr(_approval, "register_gateway_notify", lambda key, cb: None)
+    monkeypatch.setattr(_approval, "load_permanent_allowlist", lambda: None)
+
+    resp = server.handle_request(
+        {
+            "id": "1",
+            "method": "session.create",
+            "params": {
+                "source": "desktop",
+                "parent_session_id": "parent-1",
+                "title": "My Branch",
+                "messages": [{"role": "user", "content": "seed"}],
+            },
+        }
+    )
+
+    assert "result" in resp
+    key = resp["result"]["stored_session_id"]
+    # The half-written child was rolled back — no durable empty row left to
+    # shadow the lazy seed path.
+    assert seen.get("deleted") == key
+    # pending_title survived: it still lands via the lazy post-turn apply.
+    runtime_sid = resp["result"]["session_id"]
+    assert server._sessions[runtime_sid]["pending_title"] == "My Branch"
+
+    server._sessions.pop(runtime_sid, None)
+
+
+def test_session_create_seed_disk_full_keeps_row_for_retry(monkeypatch):
+    """Disk-full is NOT compensated: the row stays (deleting data on a full
+    disk can make things worse), create still succeeds, and the failure is
+    observable at warning level (#93959 review)."""
+
+    import logging as _logging
+
+    class _FakeAgent:
+        def __init__(self):
+            self.model = "test-model"
+
+    class _FakeDB:
+        def get_session_title(self, key):
+            return "Parent"
+
+        def get_next_title_in_lineage(self, current):
+            return f"{current} #2"
+
+        def create_session(self, key, **kwargs):
+            pass
+
+        def append_messages_batch(self, session_id, messages, **kwargs):
+            raise OSError(28, "No space left on device")
+
+    monkeypatch.setattr(server, "_get_db", lambda: _FakeDB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_db=None, **_kw: _FakeAgent())
+    monkeypatch.setattr(server, "_SlashWorker", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_session_info", lambda _a, *a2: {"model": "x"})
+    monkeypatch.setattr(server, "_probe_credentials", lambda _a: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda _sid: None)
+    monkeypatch.setattr(server, "_emit", lambda *a, **kw: None)
+
+    import tools.approval as _approval
+
+    monkeypatch.setattr(_approval, "register_gateway_notify", lambda key, cb: None)
+    monkeypatch.setattr(_approval, "load_permanent_allowlist", lambda: None)
+
+    records: list = []
+
+    class _Capture(_logging.Handler):
+        def emit(self, record):
+            records.append(record)
+
+    handler = _Capture(level=_logging.WARNING)
+    root = _logging.getLogger()
+    root.addHandler(handler)
+    try:
+        resp = server.handle_request(
+            {
+                "id": "1",
+                "method": "session.create",
+                "params": {
+                    "source": "desktop",
+                    "parent_session_id": "parent-1",
+                    "messages": [{"role": "user", "content": "seed"}],
+                },
+            }
+        )
+    finally:
+        root.removeHandler(handler)
+
+    assert "result" in resp
+    # The failure surfaced at WARNING (observable), not buried at debug.
+    warnings = [r for r in records if r.levelno >= _logging.WARNING]
+    assert any("seeded-branch persistence failed" in r.getMessage() for r in warnings)
+
+    server._sessions.pop(resp["result"]["stored_session_id"], None)
+
+
+def test_session_create_without_parent_still_defers_row(monkeypatch):
+    """Plain drafts keep the lazy-row contract: no parent + no explicit branch
+    intent means no eager persistence (the original draft-hygiene invariant)."""
+
+    class _FakeAgent:
+        def __init__(self):
+            self.model = "test-model"
+
+    calls: dict = {"create": 0}
+
+    class _FakeDB:
+        def create_session(self, *a, **k):
+            calls["create"] += 1
+
+    monkeypatch.setattr(server, "_get_db", lambda: _FakeDB())
+    monkeypatch.setattr(server, "_make_agent", lambda sid, key, session_db=None, **_kw: _FakeAgent())
+    monkeypatch.setattr(server, "_SlashWorker", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_session_info", lambda _a, *a2: {"model": "x"})
+    monkeypatch.setattr(server, "_probe_credentials", lambda _a: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda _sid: None)
+    monkeypatch.setattr(server, "_emit", lambda *a, **kw: None)
+
+    import tools.approval as _approval
+
+    monkeypatch.setattr(_approval, "register_gateway_notify", lambda key, cb: None)
+    monkeypatch.setattr(_approval, "load_permanent_allowlist", lambda: None)
+
+    resp = server.handle_request(
+        {"id": "1", "method": "session.create", "params": {"cols": 80}}
+    )
+    sid = resp["result"]["session_id"]
+    server._sessions[sid]["agent_ready"].wait(timeout=2.0)
+
+    assert calls["create"] == 0, "plain drafts must not persist eagerly"
+
+    server._sessions.pop(sid, None)
+
 def test_session_branch_installs_parent_profile_secret_scope(monkeypatch, tmp_path):
     """The branched agent must be built under the parent profile's secrets.
 
diff --git a/tests/tools/conftest.py b/tests/tools/conftest.py
index cefe4584dc..e8fec5cf5c 100644
--- a/tests/tools/conftest.py
+++ b/tests/tools/conftest.py
@@ -83,6 +83,7 @@ def register_all_web_providers():
     from plugins.web.firecrawl.provider import FirecrawlWebSearchProvider
     from plugins.web.parallel.provider import ParallelWebSearchProvider
     from plugins.web.keenable.provider import KeenableWebSearchProvider
+    from plugins.web.tavily.provider import TavilyWebSearchProvider
     from plugins.web.searxng.provider import SearXNGWebSearchProvider
     from plugins.web.xai.provider import XAIWebSearchProvider
 
@@ -94,6 +95,7 @@ def register_all_web_providers():
         FirecrawlWebSearchProvider,
         ParallelWebSearchProvider,
         KeenableWebSearchProvider,
+        TavilyWebSearchProvider,
         SearXNGWebSearchProvider,
         XAIWebSearchProvider,
     ):
diff --git a/tests/tools/test_94248_timeout_transport_drain.py b/tests/tools/test_94248_timeout_transport_drain.py
new file mode 100644
index 0000000000..2347ad2915
--- /dev/null
+++ b/tests/tools/test_94248_timeout_transport_drain.py
@@ -0,0 +1,197 @@
+"""#94248 (native half): delegation timeout must drain transports FD-safely.
+
+A timed-out child's daemon worker is typically parked inside an in-flight
+OpenSSL read. The timeout thread must (1) never hard-close the child while the
+worker future is running (deferred close, #90889), and (2) drain the child's
+transports with socket ``shutdown()`` only — never ``client.close()`` — so the
+blocked read settles with EOF/EPIPE and the worker can unwind (bounded drain).
+Cross-thread FD release under a live SSL BIO is the #29507/#67142/#70773
+native-corruption family.
+"""
+from __future__ import annotations
+
+import threading
+import time
+from types import SimpleNamespace
+
+from tools import delegate_tool
+
+
+class _SslBlockedChild:
+    """Worker blocks (modelling an in-flight SSL read) until drained."""
+
+    def __init__(self) -> None:
+        self.tool_progress_callback = None
+        self._credential_pool = None
+        self._delegate_saved_tool_names = []
+        self._delegate_role = "leaf"
+        self._delegate_depth = 1
+        self._subagent_id = None
+        self.model = "test-model"
+        self.session_prompt_tokens = 0
+        self.session_completion_tokens = 0
+        self.session_estimated_cost_usd = 0.0
+        self.session_cost_status = "unknown"
+        self.read_settled = threading.Event()   # drain "EOF" signal
+        self.unwound = threading.Event()
+        self.closed = threading.Event()
+        self.close_while_blocked = False
+        self.drain_calls: list[str] = []
+        self.drain_threads: list[str] = []
+
+    def run_conversation(self, **_kwargs):
+        # Models the worker blocked in ssl.read: only the FD-safe drain
+        # (socket shutdown -> EOF) settles it; interrupts alone do not.
+        assert self.read_settled.wait(timeout=10), "drain never settled the read"
+        time.sleep(0.05)  # post-read unwind work (turn-finally flush)
+        self.unwound.set()
+        return {
+            "final_response": "",
+            "completed": False,
+            "interrupted": True,
+            "api_calls": 1,
+            "messages": [],
+        }
+
+    def hard_interrupt(self, *_a, **_k):
+        # Cooperative interrupt cannot unblock a thread inside OpenSSL read.
+        pass
+
+    def get_activity_summary(self):
+        return {"api_call_count": 1}
+
+    def _drain_transports_after_abandonment(self, *, reason: str) -> int:
+        self.drain_calls.append(reason)
+        self.drain_threads.append(threading.current_thread().name)
+        self.read_settled.set()
+        return 1
+
+    def close(self):
+        if not self.unwound.is_set():
+            self.close_while_blocked = True
+        self.closed.set()
+
+
+def _run(child, monkeypatch, timeout=0.4):
+    parent = SimpleNamespace(
+        session_id="parent-94248-drain",
+        _current_task_id=None,
+        _active_children=[child],
+        _active_children_lock=threading.Lock(),
+    )
+    monkeypatch.setattr(delegate_tool, "_get_child_timeout", lambda: timeout)
+    if hasattr(delegate_tool, "_get_worktree_isolation"):
+        monkeypatch.setattr(delegate_tool, "_get_worktree_isolation", lambda: False)
+    return delegate_tool._run_single_child(
+        task_index=0,
+        goal="exercise timeout transport drain",
+        child=child,
+        parent_agent=parent,
+    )
+
+
+def test_timeout_drains_transports_so_blocked_worker_can_unwind(monkeypatch):
+    child = _SslBlockedChild()
+
+    result = _run(child, monkeypatch)
+
+    assert result["status"] == "timeout"
+    # The drain ran from the timeout path (immediate sweep) and settled the
+    # blocked read; without it the worker would still be parked in ssl.read.
+    assert any(r.startswith("delegate_timeout") for r in child.drain_calls), (
+        "timeout path never drained the abandoned child's transports"
+    )
+    assert child.unwound.wait(timeout=5), (
+        "worker never unwound — the drain did not settle its blocked read"
+    )
+    assert child.closed.wait(timeout=5)
+    assert not child.close_while_blocked, (
+        "child.close() ran while the worker was still inside its blocked read"
+    )
+
+
+def test_timeout_drain_failure_does_not_break_timeout_result(monkeypatch):
+    child = _SslBlockedChild()
+
+    def _raising_drain(*, reason: str) -> int:
+        child.drain_calls.append(reason)
+        raise RuntimeError("transport sweep exploded")
+
+    child._drain_transports_after_abandonment = _raising_drain
+
+    result = _run(child, monkeypatch)
+
+    assert result["status"] == "timeout"
+    assert child.drain_calls, "drain hook was never attempted"
+    # Unblock the worker manually so the deferred close can run.
+    child.read_settled.set()
+    assert child.unwound.wait(timeout=5)
+    assert child.closed.wait(timeout=5)
+
+
+def test_timeout_without_drain_hook_still_defers_close(monkeypatch):
+    """Children lacking the hook (test doubles, third-party agents) keep the
+    plain deferred-close behavior."""
+    child = _SslBlockedChild()
+    # Shadow the hook with a non-callable: the timeout path must skip it.
+    child.__dict__["_drain_transports_after_abandonment"] = None
+
+    result = _run(child, monkeypatch)
+
+    assert result["status"] == "timeout"
+    assert not child.closed.is_set(), (
+        "close must stay deferred while the worker future is running"
+    )
+    child.read_settled.set()
+    assert child.unwound.wait(timeout=5)
+    assert child.closed.wait(timeout=5)
+    assert not child.close_while_blocked
+
+
+class _FakeSocket:
+    def __init__(self):
+        self.shutdown_calls = 0
+        self.closed = False
+
+    def settimeout(self, _v):
+        pass
+
+    def shutdown(self, _how):
+        self.shutdown_calls += 1
+
+    def close(self):
+        self.closed = True
+
+
+def test_agent_drain_shuts_sockets_down_without_fd_release(monkeypatch):
+    """AIAgent._drain_transports_after_abandonment must shutdown(), not close()."""
+    import threading as _threading
+    from unittest.mock import patch
+
+    with patch("run_agent.AIAgent.__init__", return_value=None):
+        from run_agent import AIAgent
+
+        agent = AIAgent.__new__(AIAgent)
+
+    sock = _FakeSocket()
+    close_calls = {"n": 0}
+
+    class _FakeClient:
+        def close(self):
+            close_calls["n"] += 1
+
+    agent.client = _FakeClient()
+    agent._client_lock = _threading.RLock()
+    agent._codex_session = None
+    agent._active_request_abort = None
+
+    import agent.agent_runtime_helpers as arh
+
+    monkeypatch.setattr(arh, "_iter_pool_sockets", lambda _c: iter([sock]))
+
+    drained = agent._drain_transports_after_abandonment(reason="delegate_timeout_test")
+
+    assert drained == 1
+    assert sock.shutdown_calls == 1
+    assert not sock.closed, "drain must never release socket FDs"
+    assert close_calls["n"] == 0, "drain must never call client.close()"
diff --git a/tests/tools/test_bot_mode_dm.py b/tests/tools/test_bot_mode_dm.py
index e83ec30ae0..ed0936f4c9 100644
--- a/tests/tools/test_bot_mode_dm.py
+++ b/tests/tools/test_bot_mode_dm.py
@@ -422,6 +422,29 @@ def test_delivery_runner_preserves_child_failure_and_unlinks(tmp_path):
     assert not dm_file.exists()
 
 
+def test_delivery_runner_surfaces_live_owner_refusal(tmp_path, capsys):
+    """#100523: the CLI's single-owner lease refusal is a delivery FAILURE the
+    sender can read, not a raw exit-1 with the payload silently gone."""
+    dm_file = tmp_path / "message.txt"
+    dm_file.write_text("hi", encoding="utf-8")
+    child = tmp_path / "owned.py"
+    child.write_text(
+        "import sys\n"
+        "print('Session abc already has a live owner (desktop, pid 1).', file=sys.stderr)\n"
+        "raise SystemExit(1)\n",
+        encoding="utf-8",
+    )
+
+    returncode = bot_mode_dm._run_delivery(
+        [sys.executable, str(child), "-p", "ops"], str(dm_file), stdin_file=False
+    )
+
+    assert returncode == 1
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["reason"] == "target_busy"
+    assert "NOT delivered" in payload["error"]
+
+
 def test_query_file_delivery_closes_stdin_for_initial_attempt_and_retry(
     tmp_path, monkeypatch
 ):
diff --git a/tests/tools/test_bot_relay.py b/tests/tools/test_bot_relay.py
index b7b9f4a37f..7b9fb528f1 100644
--- a/tests/tools/test_bot_relay.py
+++ b/tests/tools/test_bot_relay.py
@@ -151,6 +151,31 @@ def test_waiter_command_quotes_and_targets_reply_file(root):
     assert "rm -rf" not in cmd  # sanity: single quoted -c payload
 
 
+def test_waiter_picks_up_reply_within_a_sub_second_cadence(root):
+    """The reply file is written once; the waiter must notice it fast, not
+    on a multi-second sleep (dead air the sender's completion notification
+    inherits on every cross-machine reply)."""
+    import shlex
+    import subprocess
+    import threading
+    import time
+
+    env = {"id": "c" * 32, "target_handle": "researcher", "target_connection": "ssh-vps"}
+    reply_path = bot_relay.relay_root(root) / bot_relay.REPLIES_DIR / f"{env['id']}.json"
+    reply_path.parent.mkdir(parents=True, exist_ok=True)
+
+    def write_reply():
+        time.sleep(0.3)
+        reply_path.write_text(json.dumps({"reply": "pong"}), encoding="utf-8")
+
+    threading.Thread(target=write_reply, daemon=True).start()
+    started = time.monotonic()
+    proc = subprocess.run(shlex.split(bot_relay.waiter_command(root, env)), capture_output=True, text=True, timeout=10)
+    elapsed = time.monotonic() - started
+    assert proc.returncode == 0 and "pong" in proc.stdout
+    assert elapsed < 1.5, f"waiter took {elapsed:.2f}s to notice a reply written at 0.3s"
+
+
 def test_roster_rejects_connection_id_outside_handle_charset(root):
     bad = [
         {"profile": "researcher", "handle": "researcher", "connection_id": "vps'); print(1)"},
diff --git a/tests/tools/test_browser_cleanup.py b/tests/tools/test_browser_cleanup.py
index 6c929da628..b1f89b3c84 100644
--- a/tests/tools/test_browser_cleanup.py
+++ b/tests/tools/test_browser_cleanup.py
@@ -83,3 +83,106 @@ class TestBrowserCleanup:
         assert browser_tool._session_last_activity == {}
         assert browser_tool._recording_sessions == set()
         assert browser_tool._cleanup_done is True
+
+
+class TestInactivityJanitorMultiplex:
+    """#86402 / #100738: the process-global janitor thread has no profile scope."""
+
+    def setup_method(self):
+        from agent import secret_scope
+        from tools import browser_tool
+
+        self.bt = browser_tool
+        self.saved = {
+            name: getattr(browser_tool, name).copy()
+            for name in (
+                "_active_sessions", "_session_last_activity",
+                "_session_owner_homes", "_cleanup_failures", "_recording_sessions",
+            )
+        }
+        self.orig_timeout = browser_tool.BROWSER_SESSION_INACTIVITY_TIMEOUT
+        browser_tool.BROWSER_SESSION_INACTIVITY_TIMEOUT = 0
+        for name in self.saved:
+            getattr(browser_tool, name).clear()
+        secret_scope.set_multiplex_active(True)
+
+    def teardown_method(self):
+        from agent import secret_scope
+
+        secret_scope.set_multiplex_active(False)
+        self.bt.BROWSER_SESSION_INACTIVITY_TIMEOUT = self.orig_timeout
+        for name, saved in self.saved.items():
+            live = getattr(self.bt, name)
+            live.clear()
+            live.update(saved)
+
+    def test_janitor_tears_down_under_owner_profile_scope(self, tmp_path, monkeypatch):
+        from agent import secret_scope
+        from hermes_constants import (
+            get_hermes_home, reset_hermes_home_override, set_hermes_home_override,
+        )
+
+        monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+        monkeypatch.delenv("CAMOFOX_URL", raising=False)
+        monkeypatch.delenv("BROWSER_CDP_URL", raising=False)
+        p1 = tmp_path / "profiles" / "p1"
+        p1.mkdir(parents=True)
+        (p1 / ".env").write_text("CAMOFOX_URL=http://127.0.0.1:1\n")
+
+        # Profile p1's turn opens the session; the janitor later runs unscoped.
+        home_tok = set_hermes_home_override(str(p1))
+        scope_tok = secret_scope.set_secret_scope(secret_scope.build_profile_secret_scope(p1))
+        try:
+            self.bt._update_session_activity("t1")
+            self.bt._active_sessions["t1"] = {"session_name": "s1", "bb_session_id": None}
+        finally:
+            secret_scope.reset_secret_scope(scope_tok)
+            reset_hermes_home_override(home_tok)
+        self.bt._session_last_activity["t1"] -= 10
+
+        seen = {}
+
+        def fake_close(task_id, cmd, args, timeout=None):
+            seen["home"] = str(get_hermes_home())
+            seen["url"] = secret_scope.get_secret("CAMOFOX_URL")
+            return {"success": True}
+
+        with (
+            patch("tools.browser_tool._run_browser_command", side_effect=fake_close),
+            patch("tools.browser_camofox._delete", return_value={}),
+            patch("tools.browser_tool.os.path.exists", return_value=False),
+        ):
+            self.bt._cleanup_inactive_browser_sessions()
+
+        assert seen == {"home": str(p1), "url": "http://127.0.0.1:1"}
+        assert "t1" not in self.bt._session_last_activity
+        assert "t1" not in self.bt._active_sessions
+        assert "t1" not in self.bt._session_owner_homes
+
+    def test_repeated_failures_force_reap_and_close_cloud_session(self):
+        from unittest.mock import MagicMock
+
+        self.bt._active_sessions["t1"] = {"session_name": "s1", "bb_session_id": "bb-1"}
+        self.bt._session_last_activity["t1"] = 1.0
+        provider = MagicMock()
+
+        with (
+            patch("tools.browser_tool.cleanup_browser", side_effect=RuntimeError("boom")),
+            patch("tools.browser_tool._get_cloud_provider", return_value=provider),
+            patch("tools.browser_tool.os.path.exists", return_value=False),
+        ):
+            for _ in range(self.bt.MAX_INACTIVITY_CLEANUP_FAILURES - 1):
+                self.bt._cleanup_inactive_browser_sessions()
+            # An activity touch must NOT reset the failure budget.
+            self.bt._update_session_activity("t1")
+            self.bt._session_last_activity["t1"] = 1.0
+            assert self.bt._cleanup_failures["t1"] == self.bt.MAX_INACTIVITY_CLEANUP_FAILURES - 1
+            assert "t1" in self.bt._active_sessions
+            provider.close_session.assert_not_called()
+
+            self.bt._cleanup_inactive_browser_sessions()
+
+        provider.close_session.assert_called_once_with("bb-1")
+        assert "t1" not in self.bt._active_sessions
+        assert "t1" not in self.bt._session_last_activity
+        assert "t1" not in self.bt._cleanup_failures
diff --git a/tests/tools/test_cronjob_run_delivery_notice.py b/tests/tools/test_cronjob_run_delivery_notice.py
new file mode 100644
index 0000000000..e82b2ad090
--- /dev/null
+++ b/tests/tools/test_cronjob_run_delivery_notice.py
@@ -0,0 +1,274 @@
+"""Honesty of the manual-run delivery notice (issue #83993).
+
+A manual ``cronjob(action='run')`` finishes with a completion summary line
+
+    Delivery target: <target> (output was delivered there by the job itself)
+
+that was appended UNCONDITIONALLY for non-local targets — even when
+``run_one_job`` had just written ``last_delivery_error`` onto the refreshed
+job record because the post-run delivery (telegram/discord/…) failed. The
+calling agent then relayed "all good" over a failed delivery.
+
+The note must follow the refreshed job record: a set ``last_delivery_error``
+means delivery FAILED with the error text surfaced; an empty/missing error
+keeps the legacy wording byte-for-byte (zero regression), and local jobs
+always say saved-locally.
+"""
+
+import contextlib
+import time
+from unittest.mock import patch
+
+import pytest
+
+from tools.cronjob_tools import _manual_run_delivery_note
+
+
+@pytest.fixture(autouse=True)
+def _clean_state():
+    """Reset the shared async-delegation world around each test.
+
+    The dispatch tests below submit real workers onto the process-wide
+    daemon executor in ``tools.async_delegation``. A finished worker parks
+    idle holding an ``_idle_semaphore`` token, so the NEXT dispatch in this
+    process REUSES that thread instead of spawning a fresh one — and only
+    the fresh-spawn path keeps upstream's dispatch-and-return test winning
+    its patch-visibility race: ``Thread.start()`` blocks the dispatching
+    thread until the worker has bootstrapped, so the worker performs
+    ``_run_claimed_job``'s lazy ``from cron.scheduler import run_one_job``
+    while the test's patches are still active. On the idle-reuse path
+    ``submit`` returns with the GIL still held, the patch block unwinds
+    first, and the worker binds the REAL ``run_one_job`` — which then runs
+    the fake job for real ("no model configured") and the mock never fires.
+    Without this reset, test_cronjob_run_background.py's
+    ``test_dispatches_and_returns_handle_immediately`` fails
+    deterministically whenever this file runs before it. Mirrors
+    ``tests/tools/test_async_delegation.py::_clean_state``.
+    """
+    from tools import async_delegation as ad
+    from tools.process_registry import process_registry
+
+    ad._reset_for_tests()
+    while not process_registry.completion_queue.empty():
+        process_registry.completion_queue.get_nowait()
+    yield
+    # Give just-drained workers a beat to finalize BEFORE resetting, so
+    # their completion events land now instead of leaking into the next
+    # test's queue (mirrors test_async_delegation.py).
+    deadline = time.monotonic() + 2.0
+    while ad.active_count() and time.monotonic() < deadline:
+        time.sleep(0.02)
+    ad._reset_for_tests()
+    while not process_registry.completion_queue.empty():
+        process_registry.completion_queue.get_nowait()
+
+
+def _job(job_id, deliver):
+    """Per-test job dict with a UNIQUE id.
+
+    Background workers outlive their test (daemon executor) and hold the id
+    in the scheduler's shared running set until the run finishes; reusing an
+    id across tests trips the in-flight dedupe guard on a straggler.
+    """
+    return {
+        "id": job_id,
+        "name": f"dn run {job_id}",
+        "prompt": "hi",
+        "schedule": {"kind": "cron", "expr": "0 9 * * *"},
+        "deliver": deliver,
+    }
+
+
+@contextlib.contextmanager
+def _bound_session_key(key):
+    """Bind the approval session key contextvar (background dispatch gate)."""
+    from tools.approval import _approval_session_key
+
+    token = _approval_session_key.set(key)
+    try:
+        yield
+    finally:
+        _approval_session_key.reset(token)
+
+
+def _dispatch_diag(res) -> str:
+    """Failure renderer for the wiring tests' dispatch asserts: the result
+    dict plus the scheduler running set, so a broken assert names the return
+    path that was actually taken instead of a bare KeyError."""
+    try:
+        from cron.scheduler import get_running_job_ids
+
+        running = sorted(get_running_job_ids())
+    except Exception as e:  # pragma: no cover - diagnostic only
+        running = f"<unavailable: {e}>"
+    return f"dispatch result: {res!r}; running: {running}"
+
+
+def _drain_completion_event(delegation_id):
+    """Wait (bounded) for this delegation's completion event; requeue others.
+
+    The runner executes on a daemon thread, so this must be called while the
+    test's patches are still active.
+    """
+    from tools.process_registry import process_registry
+
+    for _ in range(100):
+        try:
+            evt = process_registry.completion_queue.get_nowait()
+        except Exception:
+            time.sleep(0.05)
+            continue
+        if evt.get("delegation_id") == delegation_id:
+            return evt
+        process_registry.completion_queue.put(evt)
+        time.sleep(0.05)
+    return None
+
+
+class TestDeliveryNote:
+    """``_manual_run_delivery_note`` — the summary-line wording contract."""
+
+    def test_local_always_saved_locally_only(self):
+        expected = " (output saved locally only)"
+        assert _manual_run_delivery_note("local", {}) == expected
+        # Local jobs never deliver — a stale delivery error must not leak in.
+        assert (
+            _manual_run_delivery_note("local", {"last_delivery_error": "telegram 400"})
+            == expected
+        )
+
+    def test_remote_without_error_keeps_legacy_wording(self):
+        expected = " (output was delivered there by the job itself)"
+        assert _manual_run_delivery_note("telegram", {}) == expected
+        assert (
+            _manual_run_delivery_note("telegram", {"last_delivery_error": None})
+            == expected
+        )
+        assert (
+            _manual_run_delivery_note("discord:#ops", {"last_delivery_error": "   "})
+            == expected
+        )
+
+    def test_empty_or_missing_deliver_reads_saved_locally(self):
+        """Falsy deliver = no target, and the fire-time path treats it as
+        "local" (no delivery, no delivery error) — the note must not claim
+        "delivered there" for a target that doesn't exist (#83993 class)."""
+        expected = " (output saved locally only)"
+        assert _manual_run_delivery_note("", {}) == expected
+        assert _manual_run_delivery_note(None, {}) == expected
+        # Falsy deliver never attempts delivery — a stale error (e.g. from an
+        # earlier deliver config) must not flip the wording either.
+        assert _manual_run_delivery_note("", {"last_delivery_error": "old"}) == expected
+
+    def test_whitespace_deliver_defers_to_error_record(self):
+        """Whitespace-only deliver is NOT folded into local: fire time lets it
+        through as a target that fails to resolve, so the recorded error must
+        stay visible rather than being masked by a saved-locally wording."""
+        note = _manual_run_delivery_note(" ", {"last_delivery_error": "no target"})
+        assert "delivery FAILED" in note
+        assert "no target" in note
+
+    def test_remote_with_error_says_delivery_failed(self):
+        note = _manual_run_delivery_note(
+            "telegram", {"last_delivery_error": "send failed: 400 Bad Request"}
+        )
+        assert "delivery FAILED" in note
+        assert "send failed: 400 Bad Request" in note
+
+    def test_remote_error_text_truncated_to_200_chars(self):
+        note = _manual_run_delivery_note("telegram", {"last_delivery_error": "E" * 500})
+        assert "E" * 200 in note
+        assert "E" * 201 not in note
+
+
+class TestRunnerSummaryWiring:
+    """The completion event the calling agent actually sees must follow the
+    refreshed job record — both directions of issue #83993."""
+
+    def test_delivery_failure_surfaces_in_completion_summary(self):
+        from tools.cronjob_tools import _try_dispatch_background_run
+
+        job = _job("job-dn-01", "telegram")
+        with _bound_session_key("agent:main:telegram:dm:83993"):
+            with (
+                patch(
+                    "tools.cronjob_tools.claim_job_for_fire",
+                    return_value=job,  # claimed snapshot (return_job=True API)
+                ),
+                patch("cron.scheduler.run_one_job", return_value=True),
+                patch(
+                    "tools.cronjob_tools.get_job",
+                    return_value={
+                        # Post-#83993 record shape: mark_job_run writes
+                        # delivery_failed (not ok) when only delivery failed.
+                        "last_status": "delivery_failed",
+                        "last_error": None,
+                        "last_delivery_error": "telegram send failed: 400",
+                    },
+                ),
+            ):
+                res = _try_dispatch_background_run(job)
+                assert res.get("dispatched") is True, _dispatch_diag(res)
+                evt = _drain_completion_event(res["delegation_id"])
+        assert evt is not None, "completion event never reached the queue"
+        summary = evt.get("summary") or ""
+        assert "Delivery target: telegram" in summary
+        assert "delivery FAILED" in summary
+        assert "telegram send failed: 400" in summary
+        assert "delivered there by the job itself" not in summary
+        # The headline must not read "Result: ok" over an undelivered run.
+        assert "Result: FAILED" in summary
+        assert "Result: ok" not in summary
+
+    def test_empty_deliver_summary_states_local_not_phantom_target(self):
+        """End-to-end: an empty stored deliver must render as the local target
+        it behaves as at fire time — never a bare "Delivery target: " followed
+        by a delivered-there claim."""
+        from tools.cronjob_tools import _try_dispatch_background_run
+
+        job = _job("job-dn-03", "")
+        with _bound_session_key("agent:main:telegram:dm:86622"):
+            with (
+                patch(
+                    "tools.cronjob_tools.claim_job_for_fire",
+                    return_value=job,  # claimed snapshot (return_job=True API)
+                ),
+                patch("cron.scheduler.run_one_job", return_value=True),
+                patch(
+                    "tools.cronjob_tools.get_job",
+                    return_value={"last_status": "ok", "last_error": None},
+                ),
+            ):
+                res = _try_dispatch_background_run(job)
+                assert res.get("dispatched") is True, _dispatch_diag(res)
+                evt = _drain_completion_event(res["delegation_id"])
+        assert evt is not None, "completion event never reached the queue"
+        summary = evt.get("summary") or ""
+        assert "Delivery target: local (output saved locally only)" in summary
+        assert "delivered there by the job itself" not in summary
+
+    def test_delivery_success_wording_unchanged_in_completion_summary(self):
+        from tools.cronjob_tools import _try_dispatch_background_run
+
+        job = _job("job-dn-02", "telegram")
+        with _bound_session_key("agent:main:telegram:dm:83994"):
+            with (
+                patch(
+                    "tools.cronjob_tools.claim_job_for_fire",
+                    return_value=job,  # claimed snapshot (return_job=True API)
+                ),
+                patch("cron.scheduler.run_one_job", return_value=True),
+                patch(
+                    "tools.cronjob_tools.get_job",
+                    return_value={"last_status": "ok", "last_error": None},
+                ),
+            ):
+                res = _try_dispatch_background_run(job)
+                assert res.get("dispatched") is True, _dispatch_diag(res)
+                evt = _drain_completion_event(res["delegation_id"])
+        assert evt is not None, "completion event never reached the queue"
+        summary = evt.get("summary") or ""
+        assert (
+            "Delivery target: telegram (output was delivered there by the job itself)"
+        ) in summary
+        assert "delivery FAILED" not in summary
diff --git a/tests/tools/test_cronjob_run_immediate.py b/tests/tools/test_cronjob_run_immediate.py
index beb8c098c3..aa0eb8b97f 100644
--- a/tests/tools/test_cronjob_run_immediate.py
+++ b/tests/tools/test_cronjob_run_immediate.py
@@ -291,3 +291,37 @@ class TestCronjobRunExecutesImmediately:
             assert len(calls) >= 2, calls
         finally:
             set_activity_callback(None)
+
+
+class TestManualRunReportsDeliveryFailure:
+    """#83993: a manual run whose agent succeeded but whose delivery failed
+    must not come back as success=True with no error — the calling agent
+    relays that result to the user."""
+
+    def test_delivery_failed_status_is_not_success_and_surfaces_reason(self):
+        refreshed = {
+            "id": "job-run-1",
+            "last_status": "delivery_failed",
+            "last_error": None,
+            "last_delivery_error": "live adapter send failed: 502 (target telegram:123)",
+        }
+        with patch("tools.cronjob_tools.claim_job_for_fire",
+                   return_value={**_JOB, "fire_claim": {"by": "manual-owner"}}), \
+             patch("cron.scheduler.run_one_job", return_value=True), \
+             patch("tools.cronjob_tools.get_job", return_value=refreshed):
+            res = _execute_job_now(dict(_JOB))
+
+        assert res["claimed"] is True
+        assert res["success"] is False
+        assert "502" in res["error"]
+
+    def test_plain_ok_is_still_success_with_no_error(self):
+        with patch("tools.cronjob_tools.claim_job_for_fire",
+                   return_value={**_JOB, "fire_claim": {"by": "manual-owner"}}), \
+             patch("cron.scheduler.run_one_job", return_value=True), \
+             patch("tools.cronjob_tools.get_job",
+                   return_value={"id": "job-run-1", "last_status": "ok", "last_error": None,
+                                 "last_delivery_error": None}):
+            res = _execute_job_now(dict(_JOB))
+        assert res["success"] is True
+        assert res["error"] is None
diff --git a/tests/tools/test_cronjob_tools.py b/tests/tools/test_cronjob_tools.py
index 0fbf0364a9..12aa49c80a 100644
--- a/tests/tools/test_cronjob_tools.py
+++ b/tests/tools/test_cronjob_tools.py
@@ -465,7 +465,7 @@ class TestAgentCannotSetModelPin:
 
         updated = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "update",
                     "job_id": job_id,
@@ -499,7 +499,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
 
         created = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "create",
                     "name": "Continuable cron canary",
@@ -516,7 +516,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
         stored = get_job(created["job_id"])
         assert stored is not None
         assert stored.get("attach_to_session") is True
-        listing = json.loads(registry.dispatch("cronjob", {"action": "list"}))
+        listing = json.loads(registry.dispatch("cronjob_manage", {"action": "list"}))
         listed = next(j for j in listing["jobs"] if j["job_id"] == created["job_id"])
         assert listed.get("attach_to_session") is True
 
@@ -526,7 +526,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
 
         created = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "create",
                     "name": "plain",
@@ -540,7 +540,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
 
         updated = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "update",
                     "job_id": created["job_id"],
@@ -556,7 +556,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
 
         disabled = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "update",
                     "job_id": created["job_id"],
@@ -569,7 +569,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
         stored = get_job(created["job_id"])
         assert stored is not None
         assert stored.get("attach_to_session") is False
-        listing = json.loads(registry.dispatch("cronjob", {"action": "list"}))
+        listing = json.loads(registry.dispatch("cronjob_manage", {"action": "list"}))
         listed = next(j for j in listing["jobs"] if j["job_id"] == created["job_id"])
         assert listed.get("attach_to_session") is False
 
@@ -579,7 +579,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
 
         created = json.loads(
             registry.dispatch(
-                "cronjob",
+                "cronjob_manage",
                 {
                     "action": "create",
                     "schedule": "1h",
@@ -592,7 +592,7 @@ class TestRegisteredHandlerForwardsAttachToSession:
         assert stored is not None
         assert "attach_to_session" not in stored
         # And the formatted list output must not invent the field either.
-        listed = json.loads(registry.dispatch("cronjob", {"action": "list"}))
+        listed = json.loads(registry.dispatch("cronjob_manage", {"action": "list"}))
         formatted = next(
             j for j in listed["jobs"] if j["job_id"] == created["job_id"]
         )
diff --git a/tests/tools/test_daemon_pool.py b/tests/tools/test_daemon_pool.py
index 250cc86e59..9370afb46f 100644
--- a/tests/tools/test_daemon_pool.py
+++ b/tests/tools/test_daemon_pool.py
@@ -69,6 +69,30 @@ def test_wedged_worker_does_not_block_interpreter_exit():
     assert "main-done" in proc.stdout
 
 
+def test_submit_propagates_caller_contextvars():
+    """Pool workers inherit contextvars set in the submitting context.
+
+    Stdlib ThreadPoolExecutor snapshots the caller's context with
+    ``copy_context()``; some bundled CPython runtime builds strip that, so
+    the daemon pool restores it explicitly.  Without the fix this returns
+    the default because the worker runs in a bare context.
+    """
+    from contextvars import ContextVar
+
+    var = ContextVar("daemon_pool_test_var", default="unset")
+
+    pool = DaemonThreadPoolExecutor(max_workers=1)
+    try:
+        token = var.set("hello")
+        try:
+            seen = pool.submit(var.get).result(timeout=10)
+        finally:
+            var.reset(token)
+        assert seen == "hello"
+    finally:
+        pool.shutdown(wait=True)
+
+
 def _repo_root():
     import pathlib
 
diff --git a/tests/tools/test_delegate_batch_tag.py b/tests/tools/test_delegate_batch_tag.py
new file mode 100644
index 0000000000..f47404c7c1
--- /dev/null
+++ b/tests/tools/test_delegate_batch_tag.py
@@ -0,0 +1,116 @@
+"""Batch tag on delegation progress lines (#p1-campaign feedback, Sep 2026).
+
+When a parent fans out N subagents and a child fans out its own M, both
+batches print ``[n/N]`` completion lines to the same console. Without a
+batch tag ``✓ [3/3]`` and ``✓ [3/9]`` are indistinguishable. Every progress
+surface must carry the short delegation id.
+"""
+import types
+
+import pytest
+
+import tools.delegate_tool as dt
+from tools.delegate_tool import _batch_prefix, _build_child_progress_callback, format_batch_tag
+
+
+def test_format_batch_tag_shortens_delegation_handle():
+    assert format_batch_tag("deleg_6a664903") == "6a66"
+    assert format_batch_tag("deleg_") == ""
+    assert format_batch_tag(None) == ""
+    assert format_batch_tag("") == ""
+
+
+@pytest.mark.parametrize(
+    "deleg, idx, count, expected",
+    [
+        ("deleg_6a664903", 2, 9, "[6a66 3/9] "),
+        (None, 2, 9, "[3/9] "),
+        ("deleg_6a664903", 0, 1, "[6a66] "),
+        (None, 0, 1, ""),
+    ],
+)
+def test_batch_prefix_shapes(deleg, idx, count, expected):
+    assert _batch_prefix(deleg, idx, count) == expected
+
+
+class _Spinner:
+    def __init__(self):
+        self.lines = []
+
+    def print_above(self, line):
+        self.lines.append(line)
+
+    def update_text(self, text):
+        self.lines.append(f"<spin>{text}")
+
+
+def test_child_tree_lines_and_relayed_events_carry_batch_tag():
+    relayed = []
+    parent = types.SimpleNamespace(
+        _delegate_spinner=_Spinner(),
+        tool_progress_callback=lambda et, name=None, preview=None, args=None, **kw: relayed.append((et, kw)),
+    )
+    ref = {}
+    cb = _build_child_progress_callback(2, "triage cluster", parent, 9, subagent_id="sa-2", session_ref=ref)
+    # Stamped by delegate_task AFTER the callback is built — must be picked up lazily.
+    ref["delegation_id"] = "deleg_6a664903"
+    ref["session_id"] = "child-sess"
+
+    cb("subagent.start")
+    cb("tool.started", "terminal", "ls")
+
+    tree = parent._delegate_spinner.lines
+    assert tree[0].startswith(" [6a66 3/9] ├─ 🔀 triage cluster")
+    assert tree[1].startswith(" [6a66 3/9] ├─ ")
+    assert all(kw.get("delegation_id") == "deleg_6a664903" for _, kw in relayed)
+    assert all(kw.get("child_session_id") == "child-sess" for _, kw in relayed)
+
+
+def test_child_tree_prefix_without_batch_id_is_unchanged():
+    parent = types.SimpleNamespace(_delegate_spinner=_Spinner(), tool_progress_callback=None)
+    cb = _build_child_progress_callback(0, "solo goal", parent, 3, session_ref={})
+    cb("subagent.start")
+    assert parent._delegate_spinner.lines[0].startswith(" [1/3] ├─ 🔀 solo goal")
+
+
+def test_batch_completion_lines_are_attributable_across_two_batches(monkeypatch, tmp_path):
+    """Two interleaved batches: every ✓ line names its own batch tag, and the
+    tag equals the delegation_id the dispatch returns."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    (tmp_path / ".hermes").mkdir()
+    lines = []
+    parent = types.SimpleNamespace(
+        session_id="root", model="m", tool_progress_callback=None, _delegate_spinner=None,
+        _safe_print=lambda line: lines.append(line),
+    )
+    monkeypatch.setattr(
+        dt, "_run_single_child",
+        lambda task_index, goal, child=None, parent_agent=None, **kw: {
+            "task_index": task_index, "status": "completed", "summary": "ok",
+            "error": None, "api_calls": 1, "duration_seconds": 1,
+        },
+    )
+    monkeypatch.setattr(dt, "_build_child_preserving_parent_tools",
+                        lambda **kw: types.SimpleNamespace(tool_progress_callback=None))
+    monkeypatch.setattr(dt, "_resolve_delegation_credentials", lambda *a, **k: {
+        "model": "m", "provider": "openrouter", "base_url": "https://x/v1",
+        "api_key": "k", "api_mode": "chat_completions"})
+
+    import re
+
+    for n in (3, 9):
+        res = dt.delegate_task(
+            tasks=[{"goal": f"batch of {n}: worker task number {i}"} for i in range(n)],
+            parent_agent=parent,
+        )
+        assert "error" not in str(res)[:20], res
+    headers = [re.match(r"\s*🔀 \[([0-9a-f]{4})\] delegating (\d+) tasks", l) for l in lines]
+    headers = [m for m in headers if m]
+    assert [int(m.group(2)) for m in headers] == [3, 9]
+    tags = [m.group(1) for m in headers]
+    assert len(set(tags)) == 2
+
+    done = [l for l in lines if "✓ [" in l]
+    assert len(done) == 12
+    assert sum(1 for l in done if f"✓ [{tags[0]} " in l and "/3]" in l) == 3
+    assert sum(1 for l in done if f"✓ [{tags[1]} " in l and "/9]" in l) == 9
diff --git a/tests/tools/test_delegate_timeout_cleanup.py b/tests/tools/test_delegate_timeout_cleanup.py
new file mode 100644
index 0000000000..2c16d91e73
--- /dev/null
+++ b/tests/tools/test_delegate_timeout_cleanup.py
@@ -0,0 +1,90 @@
+"""Regression coverage for timed-out delegation teardown."""
+
+from __future__ import annotations
+
+import threading
+from types import SimpleNamespace
+
+from tools import delegate_tool
+
+
+class _SlowUnwindingChild:
+    def __init__(self) -> None:
+        self.tool_progress_callback = None
+        self._credential_pool = None
+        self._delegate_saved_tool_names = []
+        self._delegate_role = "leaf"
+        self._delegate_depth = 1
+        self._subagent_id = None
+        self.model = "test-model"
+        self.session_prompt_tokens = 0
+        self.session_completion_tokens = 0
+        self.session_estimated_cost_usd = 0.0
+        self.session_cost_status = "unknown"
+        self.started = threading.Event()
+        self.interrupted = threading.Event()
+        self.unwinding = threading.Event()
+        self.allow_finish = threading.Event()
+        self.finished = threading.Event()
+        self.closed = threading.Event()
+        self.close_while_running = False
+
+    def run_conversation(self, **_kwargs):
+        self.started.set()
+        assert self.interrupted.wait(timeout=1)
+        # Model the real child turn's finally path: it still performs session
+        # activity/SQLite cleanup after the parent requests interruption.
+        self.unwinding.set()
+        assert self.allow_finish.wait(timeout=2)
+        self.finished.set()
+        return {
+            "final_response": "",
+            "completed": False,
+            "interrupted": True,
+            "api_calls": 1,
+            "messages": [],
+        }
+
+    def hard_interrupt(self, _reason=None):
+        self.interrupted.set()
+
+    def get_activity_summary(self):
+        return {"api_call_count": 1}
+
+    def close(self):
+        if not self.finished.is_set():
+            self.close_while_running = True
+        self.closed.set()
+
+
+def test_timeout_does_not_close_child_while_worker_is_unwinding(monkeypatch):
+    child = _SlowUnwindingChild()
+    parent = SimpleNamespace(
+        session_id="parent-timeout-test",
+        _current_task_id=None,
+        _active_children=[child],
+        _active_children_lock=threading.Lock(),
+    )
+    monkeypatch.setattr(delegate_tool, "_get_child_timeout", lambda: 0.5)
+    monkeypatch.setattr(delegate_tool, "_get_worktree_isolation", lambda: False)
+
+    result = delegate_tool._run_single_child(
+        task_index=0,
+        goal="exercise timeout teardown",
+        child=child,
+        parent_agent=parent,
+    )
+
+    assert result["status"] == "timeout"
+    assert child.unwinding.wait(timeout=1)
+    try:
+        assert not child.closed.is_set(), (
+            "timed-out child.close() ran before its conversation thread unwound"
+        )
+    finally:
+        child.allow_finish.set()
+    assert child.finished.wait(timeout=1)
+    assert child.closed.wait(timeout=1)
+    assert not child.close_while_running, (
+        "timed-out child.close() raced its still-running conversation thread"
+    )
diff --git a/tests/tools/test_desktop_tools_diet.py b/tests/tools/test_desktop_tools_diet.py
index 4329662b78..6ab8d20a88 100644
--- a/tests/tools/test_desktop_tools_diet.py
+++ b/tests/tools/test_desktop_tools_diet.py
@@ -26,14 +26,24 @@ class TestConsolidatedToolsets(unittest.TestCase):
         self.assertEqual(proj, ["desktop_project"])
 
     def test_registry_serves_only_new_names(self):
-        from model_tools import get_tool_definitions
+        """Post-#97979 the GUI surface defers by default, so assemble with
+        the legacy everything-eager override (defer: []) — the contract
+        pinned here is the RENAME (new names only, dead names gone), not
+        the deferral policy."""
+        from unittest.mock import patch as _patch
 
-        names = {
-            t["function"]["name"]
-            for t in get_tool_definitions(
-                quiet_mode=True, enabled_toolsets=["desktop_ui", "project"]
-            )
-        }
+        from model_tools import get_tool_definitions
+        from tools.tool_search import ToolSearchConfig
+
+        legacy = ToolSearchConfig.from_raw({"enabled": "on", "defer": []})
+        with _patch("tools.tool_search.load_config_readonly", return_value=legacy), \
+             _patch("tools.tool_search.load_config", return_value=legacy):
+            names = {
+                t["function"]["name"]
+                for t in get_tool_definitions(
+                    quiet_mode=True, enabled_toolsets=["desktop_ui", "project"]
+                )
+            }
         self.assertIn("desktop_preview", names)
         self.assertIn("desktop_project", names)
         for dead in (
diff --git a/tests/tools/test_docker_config_migrate.py b/tests/tools/test_docker_config_migrate.py
index 5a8ec0cd8c..4472f92198 100644
--- a/tests/tools/test_docker_config_migrate.py
+++ b/tests/tools/test_docker_config_migrate.py
@@ -63,9 +63,10 @@ def test_docker_config_migrate_backs_up_and_migrates_legacy_config(tmp_path: Pat
     assert "Migrating config schema 12 ->" in proc.stdout
     raw = yaml.safe_load(config_path.read_text(encoding="utf-8"))
     assert raw["_config_version"] == DEFAULT_CONFIG["_config_version"]
-    # v24→25 lowers the old default model_catalog TTL; v32→33 folds
+    # v24→25 lowers the old default model_catalog TTL to 1h, v39→40 drops
+    # that default so ttl_minutes (20) applies; v32→33 folds
     # max_async_children into max_concurrent_children.
-    assert raw["model_catalog"]["ttl_hours"] == 1
+    assert "ttl_hours" not in raw["model_catalog"]
     assert raw["delegation"] == {"max_concurrent_children": 8}
     assert list(tmp_path.glob("config.yaml.bak-*"))
     assert list(tmp_path.glob(".env.bak-*"))
diff --git a/tests/tools/test_lazy_deps.py b/tests/tools/test_lazy_deps.py
index 74838a69a3..c62324be6b 100644
--- a/tests/tools/test_lazy_deps.py
+++ b/tests/tools/test_lazy_deps.py
@@ -483,3 +483,120 @@ class TestInstallSpecs:
         result = ld.install_specs(["honcho-ai==2.2.0"])
         assert result.ok is False
         assert "disk on fire" in result.stderr
+
+
+# ---------------------------------------------------------------------------
+# Post-install bytecode warm (#100461)
+# ---------------------------------------------------------------------------
+
+
+class TestWarmInstalledBytecode:
+    """A pip/uv install leaves ``.py`` sources with no ``__pycache__``.
+
+    Whoever imports next pays the whole compile, and for a lazily installed
+    backend that is the foreground of a user request. These tests pin that
+    the installer pays it instead.
+    """
+
+    @staticmethod
+    def _package(tmp_path):
+        pkg = tmp_path / "zzzfakepkg"
+        pkg.mkdir()
+        (pkg / "__init__.py").write_text("VALUE = 1\n", encoding="utf-8")
+        (pkg / "mod.py").write_text("def f():\n    return 2\n", encoding="utf-8")
+        return pkg
+
+    def test_compiles_the_installed_package(self, tmp_path, monkeypatch):
+        pkg = self._package(tmp_path)
+        monkeypatch.setattr(ld, "_installed_dist_roots", lambda spec, target: {pkg})
+
+        assert not list(pkg.rglob("*.pyc"))
+        ld._warm_installed_bytecode(("zzzfake==1.0",), None)
+        assert len(list(pkg.rglob("*.pyc"))) == 2
+
+    def test_honors_dont_write_bytecode(self, tmp_path, monkeypatch):
+        pkg = self._package(tmp_path)
+        monkeypatch.setattr(ld, "_installed_dist_roots", lambda spec, target: {pkg})
+        monkeypatch.setattr(ld.sys, "dont_write_bytecode", True)
+
+        ld._warm_installed_bytecode(("zzzfake==1.0",), None)
+        assert not list(pkg.rglob("*.pyc"))
+
+    def test_compile_failure_never_propagates(self, tmp_path, monkeypatch):
+        # An unwritable tree (read-only mount, --target on a sealed image)
+        # must not turn a successful install into a failed one.
+        def boom(spec, target):
+            raise OSError("read-only file system")
+        monkeypatch.setattr(ld, "_installed_dist_roots", boom)
+
+        ld._warm_installed_bytecode(("zzzfake==1.0",), None)  # no exception
+
+    def test_dist_roots_resolve_from_metadata_not_the_spec_name(self):
+        # The import name is read off the distribution's own file list, so
+        # specs whose package name differs from their module name still warm.
+        roots = ld._installed_dist_roots("pytest>=8", None)
+        assert roots, "pytest is a test dependency and must resolve"
+        assert all(r.is_dir() for r in roots)
+        assert any(list(r.glob("*.py")) for r in roots)
+
+    def test_unknown_distribution_resolves_to_nothing(self):
+        assert ld._installed_dist_roots("zzz-not-installed==9.9", None) == set()
+
+    def test_dist_roots_exclude_metadata_dirs(self):
+        # ``*.dist-info`` owns RECORD/METADATA/licenses, never importable
+        # code — compiling it is wasted work on every install.
+        roots = ld._installed_dist_roots("pytest>=8", None)
+        assert roots
+        assert not any(r.name.endswith((".dist-info", ".egg-info")) for r in roots)
+
+
+class TestInstallWarmsBytecode:
+    """The warm runs on install success, and only on success."""
+
+    @staticmethod
+    def _install(monkeypatch, returncode):
+        calls = []
+        cmds = []
+        monkeypatch.setattr(ld, "_lazy_install_target", lambda: None)
+        monkeypatch.setattr(ld.shutil, "which", lambda name: "uv" if name == "uv" else None)
+        monkeypatch.setattr(
+            "hermes_cli.managed_uv.resolve_uv", lambda *a, **kw: "uv", raising=False
+        )
+
+        class _Completed:
+            def __init__(self):
+                self.returncode = returncode
+                self.stdout = "out"
+                self.stderr = "err"
+
+        def fake_run(cmd, *a, **kw):
+            cmds.append(list(cmd))
+            return _Completed()
+
+        monkeypatch.setattr(ld.subprocess, "run", fake_run)
+        monkeypatch.setattr(
+            ld, "_warm_installed_bytecode",
+            lambda specs, target: calls.append((specs, target)),
+        )
+        result = ld._venv_pip_install(("zzzfake==1.0",))
+        return result, calls, cmds
+
+    def test_success_warms_once_with_the_installed_specs(self, monkeypatch):
+        result, calls, _ = self._install(monkeypatch, 0)
+        assert result.success is True
+        assert calls == [(("zzzfake==1.0",), None)]
+
+    def test_failed_install_does_not_warm(self, monkeypatch):
+        result, calls, _ = self._install(monkeypatch, 1)
+        assert result.success is False
+        assert calls == []
+
+    def test_uv_tier_compiles_bytecode_for_the_whole_install(self, monkeypatch):
+        # uv does not write __pycache__ unless asked (pip does). The flag
+        # covers transitive deps too, which the per-spec warm never sees.
+        _, _, cmds = self._install(monkeypatch, 0)
+        uv_cmds = [c for c in cmds if c[:3] == ["uv", "pip", "install"]]
+        assert len(uv_cmds) == 1
+        cmd = uv_cmds[0]
+        assert "--compile-bytecode" in cmd
+        assert cmd.index("--compile-bytecode") < cmd.index("zzzfake==1.0")
diff --git a/tests/tools/test_mcp_capability_gating.py b/tests/tools/test_mcp_capability_gating.py
index 5facbd24e4..25dd7084aa 100644
--- a/tests/tools/test_mcp_capability_gating.py
+++ b/tests/tools/test_mcp_capability_gating.py
@@ -295,4 +295,54 @@ class TestKeepaliveProbeFallback:
 
         assert task._ping_unsupported is False
 
+    async def test_silent_ping_drop_falls_back_to_list_tools(self):
+        """Regression for #97245: a server that silently drops ping (no
+        response at all) produces a TimeoutError. If list_tools succeeds,
+        the transport is alive — latch _ping_unsupported and return
+        normally instead of reconnect-looping."""
+        task = MCPServerTask("test")
+        task.initialize_result = _caps(tools=SimpleNamespace())
+        task.session = SimpleNamespace(
+            send_ping=AsyncMock(side_effect=asyncio.TimeoutError()),
+            list_tools=AsyncMock(return_value=SimpleNamespace(tools=[])),
+        )
+
+        # Should NOT raise — the server is alive.
+        await task._keepalive_probe()
+
+        task.session.send_ping.assert_awaited_once()
+        task.session.list_tools.assert_awaited_once()
+        assert task._ping_unsupported is True
+
+    async def test_silent_ping_drop_both_fail_propagates(self):
+        """When both ping AND list_tools time out, it is a genuine liveness
+        failure — propagate so the caller reconnects."""
+        task = MCPServerTask("test")
+        task.initialize_result = _caps(tools=SimpleNamespace())
+        task.session = SimpleNamespace(
+            send_ping=AsyncMock(side_effect=asyncio.TimeoutError()),
+            list_tools=AsyncMock(side_effect=asyncio.TimeoutError()),
+        )
+
+        with pytest.raises((TimeoutError, asyncio.TimeoutError)):
+            await task._keepalive_probe()
+
+        assert task._ping_unsupported is False
+
+    async def test_silent_ping_drop_no_tools_propagates(self):
+        """A server that has no tools capability and times out on ping has no
+        fallback probe — the timeout must propagate immediately."""
+        task = MCPServerTask("test")
+        task.initialize_result = _caps(prompts=SimpleNamespace())  # no tools
+        task.session = SimpleNamespace(
+            send_ping=AsyncMock(side_effect=asyncio.TimeoutError()),
+            list_tools=AsyncMock(),
+        )
+
+        with pytest.raises((TimeoutError, asyncio.TimeoutError)):
+            await task._keepalive_probe()
+
+        # list_tools must not be called — no tools capability advertised.
+        task.session.list_tools.assert_not_called()
+        assert task._ping_unsupported is False
 
diff --git a/tests/tools/test_mcp_lazy_start.py b/tests/tools/test_mcp_lazy_start.py
index 85312c0fc2..dedb3de115 100644
--- a/tests/tools/test_mcp_lazy_start.py
+++ b/tests/tools/test_mcp_lazy_start.py
@@ -285,7 +285,7 @@ class TestLazyFirstUseConnect:
              patch.object(registry, "deregister") as mock_dereg:
             assert mcp._ensure_lazy_server_connected("playwright") is True
 
-        mock_dereg.assert_called_once_with("mcp_playwright_tool_x")
+        mock_dereg.assert_called_once_with("mcp_playwright_tool_x", scope=None)
 
     def test_lazy_connect_failure_records_cooldown(self):
         mcp._lazy_server_configs["playwright"] = {"command": "npx", "lazy": True}
diff --git a/tests/tools/test_mcp_stability.py b/tests/tools/test_mcp_stability.py
index f3a5591ebb..e1261bdda7 100644
--- a/tests/tools/test_mcp_stability.py
+++ b/tests/tools/test_mcp_stability.py
@@ -66,6 +66,36 @@ class TestStdioPidTracking:
         for pid in result:
             assert isinstance(pid, int)
 
+    def test_snapshot_sees_child_spawned_from_another_thread(self):
+        """/proc/<pid>/task/<tid>/children is per-thread; the MCP subprocess
+        is spawned from the background loop thread, so a main-thread-only
+        read misses it and every dead-child fast-fail / respawn / killpg
+        path silently no-ops."""
+        import subprocess
+        import sys as _sys
+        import threading
+
+        from tools.mcp_tool import _snapshot_child_pids
+
+        procs = []
+        started = threading.Event()
+        release = threading.Event()
+
+        def _spawn():
+            procs.append(subprocess.Popen([_sys.executable, "-c", "import time; time.sleep(30)"]))
+            started.set()
+            release.wait(10)  # keep the spawning thread alive while we snapshot
+
+        t = threading.Thread(target=_spawn, daemon=True)
+        t.start()
+        assert started.wait(10)
+        try:
+            assert procs[0].pid in _snapshot_child_pids()
+        finally:
+            release.set()
+            procs[0].kill()
+            procs[0].wait(5)
+
 
     def test_kill_orphaned_handles_dead_pids(self):
         """_kill_orphaned_mcp_children gracefully handles already-dead PIDs."""
diff --git a/tests/tools/test_mcp_stdio_children_dead.py b/tests/tools/test_mcp_stdio_children_dead.py
index 09398d5958..23ec4a8077 100644
--- a/tests/tools/test_mcp_stdio_children_dead.py
+++ b/tests/tools/test_mcp_stdio_children_dead.py
@@ -92,3 +92,36 @@ def test_watcher_resolves_when_all_children_are_dead():
             )
 
     asyncio.run(_run())
+
+
+def test_watch_ok_probe_does_not_create_unawaited_coroutine():
+    """The fast-fail gate must inspect the watcher, not call it (#96044).
+
+    The old probe — inspect.isawaitable(_watch_children()) — created a
+    fresh coroutine per stdio tool call and never awaited it, emitting
+    'coroutine ... was never awaited' RuntimeWarnings under -W error and
+    churning the GC. Pin that the shipped source no longer calls the
+    watcher during the probe.
+    """
+    import inspect as _inspect
+
+    import tools.mcp_tool as mcp_mod
+
+    src = _inspect.getsource(mcp_mod)
+    assert "isawaitable(_watch_children())" not in src
+    assert "iscoroutinefunction(_watch_children)" in src
+
+
+def test_watch_ok_semantics_mock_vs_real():
+    """MagicMock watchers stay on the plain-await path; real async defs
+    (and AsyncMock) qualify for the fast-fail race — same split the old
+    isawaitable(call) probe produced, without the coroutine leak."""
+    import inspect as _inspect
+    from unittest.mock import AsyncMock, MagicMock
+
+    async def _real_watcher():  # what the real method looks like
+        pass
+
+    assert _inspect.iscoroutinefunction(_real_watcher) is True
+    assert _inspect.iscoroutinefunction(AsyncMock()) is True
+    assert _inspect.iscoroutinefunction(MagicMock()) is False
diff --git a/tests/tools/test_mcp_stdio_fastfail_reconnect.py b/tests/tools/test_mcp_stdio_fastfail_reconnect.py
index 80ae511981..7b9a934a52 100644
--- a/tests/tools/test_mcp_stdio_fastfail_reconnect.py
+++ b/tests/tools/test_mcp_stdio_fastfail_reconnect.py
@@ -1,16 +1,23 @@
-"""Regression tests for stdio fast-fail reconnect signaling (#95626 salvage).
+"""Regression tests for dead stdio subprocess recovery (#95626 salvage).
 
 The #81995 fast-fail gate detects a dead stdio subprocess but the transport
 failure never cleared ``server.session``, so the transport-down reconnect path
 (which only fires when the session is gone/not-ready) never ran. The call
 failed fast — correctly — but nothing asked the server task to respawn the
-subprocess, so every subsequent call kept failing until the idle keepalive
-probe eventually noticed. Both fast-fail sites must signal a reconnect:
+subprocess (#95626 added the reconnect signal).
 
-- pre-call gate (children already dead when the call arrives): return a clean
-  "reconnecting" tool error and set ``_reconnect_event``;
-- mid-call watcher race (children die while the RPC is in flight): raise the
-  fast-fail TimeoutError and set ``_reconnect_event``.
+Signalling alone still lost the call: a gateway restart kills every MCP stdio
+child, and the first call from a surviving agent session (or a cron run
+spanning the restart) failed in 0.00s while the subprocess was respawned
+seconds later. Both fast-fail sites now respawn AND retry once:
+
+- pre-call gate (children already dead when the call arrives);
+- mid-call watcher race (children die while the RPC is in flight).
+
+Both must recover transparently, and both must stop after ONE retry so a
+server that keeps dying parks via run()'s rapid-drop budget instead of
+hot-cycling respawns forever. The error text must never claim a timeout —
+that wording is what misdirected the original investigation.
 """
 
 import asyncio
@@ -23,10 +30,26 @@ import pytest
 pytest.importorskip("mcp")
 
 
+def _success_result():
+    result = MagicMock()
+    result.is_error = False
+    block = MagicMock()
+    block.text = "ok"
+    result.content = [block]
+    result.structured_content = None
+    result.meta = None
+    return result
+
+
 def _install_stub_server(mcp_tool_module, name: str, call_tool_impl,
-                         *, children_dead):
+                         *, children_dead, on_reconnect=None):
     """Fake MCP server with real-bool stdio liveness and a countable
-    reconnect event (mirrors tests/tools/test_mcp_circuit_breaker.py)."""
+    reconnect event (mirrors tests/tools/test_mcp_circuit_breaker.py).
+
+    ``on_reconnect`` runs on the MCP loop thread when the reconnect event is
+    set — the hook tests use to simulate the server task respawning the
+    subprocess and publishing a fresh session.
+    """
     server = MagicMock()
     server.name = name
     session = MagicMock()
@@ -42,6 +65,8 @@ def _install_stub_server(mcp_tool_module, name: str, call_tool_impl,
 
         def set(self):
             self.set_calls += 1
+            if on_reconnect is not None:
+                on_reconnect(server)
 
     server._reconnect_event = _ReconnectAdapter()
     server._ready = ready_flag
@@ -64,63 +89,171 @@ def _cleanup(mcp_tool_module, name: str) -> None:
         mcp_tool_module._server_breaker_opened_at.pop(name, None)
 
 
-def test_precall_dead_children_signal_reconnect(monkeypatch, tmp_path):
-    """Dead-at-call-time subprocess → clean reconnecting error + reconnect
-    signal, instead of a bare fast-fail that leaves the server dead."""
+def test_precall_dead_children_respawn_and_retry(monkeypatch, tmp_path):
+    """Dead-at-call-time subprocess (the gateway-restart case): respawn,
+    retry once, and hand the model a normal result — no error at all."""
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     from tools import mcp_tool
     from tools.mcp_tool import _make_tool_handler
 
     called = {"n": 0}
+    alive = {"v": False}
 
     async def _call_tool(*a, **kw):
         called["n"] += 1
-        return MagicMock(is_error=False, content=[])
+        return _success_result()
+
+    def _respawn(server):
+        # What the server task does after a gateway restart: fresh child,
+        # fresh session object, _ready re-armed.
+        alive["v"] = True
+        new_session = MagicMock()
+        new_session.call_tool = _call_tool
+        server.session = new_session
+        server._ready.set()
 
     server = _install_stub_server(
-        mcp_tool, "srv-dead", _call_tool, children_dead=lambda: True
+        mcp_tool, "srv-dead", _call_tool,
+        children_dead=lambda: not alive["v"],
+        on_reconnect=_respawn,
     )
     mcp_tool._ensure_mcp_loop()
     try:
         handler = _make_tool_handler("srv-dead", "tool1", 10.0)
-        result = handler({})
-        parsed = json.loads(result)
-        assert "error" in parsed, parsed
-        assert "reconnect" in parsed["error"].lower(), parsed
+        parsed = json.loads(handler({}))
+        assert "error" not in parsed, parsed
+        assert parsed["result"] == "ok", parsed
         assert server._reconnect_event.set_calls == 1
-        assert called["n"] == 0, "RPC must not be attempted on a dead transport"
-        # The error payload flows through the handler's JSON parse, which
-        # bumps the breaker exactly once (no double-bump at the gate).
-        assert mcp_tool._server_error_counts.get("srv-dead", 0) == 1
+        assert called["n"] == 1, "exactly one RPC — the retry after respawn"
+        assert mcp_tool._server_error_counts.get("srv-dead", 0) == 0
     finally:
         _cleanup(mcp_tool, "srv-dead")
 
 
-def test_midcall_child_exit_signals_reconnect(monkeypatch, tmp_path):
-    """Subprocess dies while the RPC is in flight → fast-fail error AND a
-    reconnect signal so the next call lands on a respawned transport."""
+def test_midcall_child_exit_respawn_and_retry(monkeypatch, tmp_path):
+    """Subprocess dies while the RPC is in flight → respawn and retry once,
+    so the caller still gets its result."""
     monkeypatch.setenv("HERMES_HOME", str(tmp_path))
     from tools import mcp_tool
     from tools.mcp_tool import _make_tool_handler
 
+    alive = {"v": True}
+
     async def _hanging_call(*a, **kw):
         await asyncio.sleep(30)
 
-    server = _install_stub_server(
-        mcp_tool, "srv-midcall", _hanging_call, children_dead=lambda: False
-    )
+    async def _good_call(*a, **kw):
+        return _success_result()
 
     async def _watch_children():
-        return  # children die immediately → watcher resolves first
+        # Resolves immediately while the child is dead; never while alive.
+        while alive["v"]:
+            await asyncio.sleep(0.05)
 
+    def _respawn(server):
+        alive["v"] = True
+        new_session = MagicMock()
+        new_session.call_tool = _good_call
+        server.session = new_session
+        server._ready.set()
+
+    server = _install_stub_server(
+        mcp_tool, "srv-midcall", _hanging_call,
+        children_dead=lambda: not alive["v"],
+        on_reconnect=_respawn,
+    )
     server._watch_stdio_children = _watch_children
     mcp_tool._ensure_mcp_loop()
     try:
         handler = _make_tool_handler("srv-midcall", "tool1", 10.0)
-        result = handler({})
-        parsed = json.loads(result)
-        assert "error" in parsed, parsed
-        assert "exited mid-call" in parsed["error"], parsed
+        # The child dies once the RPC is in flight.
+        alive["v"] = False
+        parsed = json.loads(handler({}))
+        assert "error" not in parsed, parsed
+        assert parsed["result"] == "ok", parsed
         assert server._reconnect_event.set_calls == 1
     finally:
         _cleanup(mcp_tool, "srv-midcall")
+
+
+def test_dead_child_never_returning_is_not_reported_as_a_timeout(
+    monkeypatch, tmp_path,
+):
+    """No fresh session inside the respawn window → a clean error that says
+    the subprocess exited, never that something timed out (the
+    old "failing the call fast instead of waiting 300s" wording sent the
+    investigation into a healthy remote backend)."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    from tools import mcp_tool
+    from tools.mcp_tool import _make_tool_handler
+
+    monkeypatch.setattr(mcp_tool, "_STDIO_RESPAWN_WAIT_SEC", 1.0)
+    called = {"n": 0}
+
+    async def _call_tool(*a, **kw):
+        called["n"] += 1
+        return _success_result()
+
+    server = _install_stub_server(
+        mcp_tool, "srv-gone", _call_tool, children_dead=lambda: True,
+    )
+    mcp_tool._ensure_mcp_loop()
+    try:
+        handler = _make_tool_handler("srv-gone", "tool1", 300.0)
+        parsed = json.loads(handler({}))
+        assert "error" in parsed, parsed
+        message = parsed["error"]
+        assert "exited" in message, message
+        for forbidden in ("TimeoutError", "300s", "timed out"):
+            assert forbidden not in message, message
+        assert server._reconnect_event.set_calls == 1
+        assert called["n"] == 0, "RPC must not be attempted on a dead transport"
+        assert mcp_tool._server_error_counts.get("srv-gone", 0) == 1
+    finally:
+        _cleanup(mcp_tool, "srv-gone")
+
+
+def test_child_dying_again_after_respawn_does_not_hot_cycle(
+    monkeypatch, tmp_path,
+):
+    """A server whose child dies immediately after every respawn gets ONE
+    retry per call, not an endless respawn loop — run()'s rapid-drop budget
+    is what parks it, and this path must not fight that."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    from tools import mcp_tool
+    from tools.mcp_tool import _make_tool_handler
+
+    monkeypatch.setattr(mcp_tool, "_STDIO_RESPAWN_WAIT_SEC", 1.0)
+    called = {"n": 0}
+
+    async def _call_tool(*a, **kw):
+        called["n"] += 1
+        return _success_result()
+
+    def _respawn_then_die(server):
+        # Fresh session object (so the readiness wait succeeds) whose child
+        # is already dead again by the time the retry dispatches.
+        new_session = MagicMock()
+        new_session.call_tool = _call_tool
+        server.session = new_session
+        server._ready.set()
+
+    server = _install_stub_server(
+        mcp_tool, "srv-flap", _call_tool,
+        children_dead=lambda: True,
+        on_reconnect=_respawn_then_die,
+    )
+    mcp_tool._ensure_mcp_loop()
+    try:
+        handler = _make_tool_handler("srv-flap", "tool1", 10.0)
+        parsed = json.loads(handler({}))
+        assert "error" in parsed, parsed
+        assert "exited again" in parsed["error"], parsed
+        assert "do NOT retry" in parsed["error"], parsed
+        assert server._reconnect_event.set_calls == 1, (
+            "one respawn request per tool call — never a retry loop"
+        )
+        assert called["n"] == 0
+        assert mcp_tool._server_error_counts.get("srv-flap", 0) == 1
+    finally:
+        _cleanup(mcp_tool, "srv-flap")
diff --git a/tests/tools/test_modal_sandbox_fixes.py b/tests/tools/test_modal_sandbox_fixes.py
index 89878150dc..f261e2ae08 100644
--- a/tests/tools/test_modal_sandbox_fixes.py
+++ b/tests/tools/test_modal_sandbox_fixes.py
@@ -36,13 +36,22 @@ class TestToolResolution:
 
     def test_terminal_and_file_toolsets_resolve_all_tools(self):
         """enabled_toolsets=['terminal', 'file'] should produce 6 tools."""
+        from unittest.mock import patch as _patch
+
         from model_tools import get_tool_definitions
-        tools = get_tool_definitions(
-            enabled_toolsets=["terminal", "file"],
-            quiet_mode=True,
-        )
+        from tools.tool_search import ToolSearchConfig
+
+        # Pin the RESOLUTION contract independent of deferral policy —
+        # #97979 defers process_manage by default (legacy defer: [] override).
+        _legacy = ToolSearchConfig.from_raw({"enabled": "on", "defer": []})
+        with _patch("tools.tool_search.load_config", return_value=_legacy), \
+             _patch("tools.tool_search.load_config_readonly", return_value=_legacy):
+            tools = get_tool_definitions(
+                enabled_toolsets=["terminal", "file"],
+                quiet_mode=True,
+            )
         names = {t["function"]["name"] for t in tools}
-        expected = {"terminal", "process", "read_file", "write_file", "search_files", "patch"}
+        expected = {"terminal", "process_manage", "read_file", "write_file", "search_files", "patch"}
         assert expected == names, f"Expected {expected}, got {names}"
 
     def test_terminal_tool_present(self):
diff --git a/tests/tools/test_refresh_agent_mcp_tools.py b/tests/tools/test_refresh_agent_mcp_tools.py
index b1aa95e12f..ee88a58ff9 100644
--- a/tests/tools/test_refresh_agent_mcp_tools.py
+++ b/tests/tools/test_refresh_agent_mcp_tools.py
@@ -224,3 +224,116 @@ def test_wait_returns_instantly_when_no_discovery_thread(monkeypatch):
     t0 = time.time()
     mcp_startup.wait_for_mcp_discovery()
     assert time.time() - t0 < 0.2  # never blocks on the bound when nothing's pending
+
+
+# ---------------------------------------------------------------------------
+# preserve_prefix: the tool array is a cached request prefix (#100336)
+# ---------------------------------------------------------------------------
+
+
+def _registered(monkeypatch, names):
+    """Make the registry report exactly *names* as still registered."""
+    from tools import registry as registry_mod
+
+    entries = [types.SimpleNamespace(name=n) for n in names]
+    monkeypatch.setattr(
+        registry_mod.registry, "get_all_entries", lambda: entries, raising=False
+    )
+
+
+def _serve(monkeypatch, defs):
+    import model_tools
+
+    monkeypatch.setattr(model_tools, "get_tool_definitions", lambda **kw: list(defs))
+
+
+def test_preserve_prefix_carries_a_flapping_tool_forward(monkeypatch):
+    """A check_fn flip must not shrink a live session's tool prefix.
+
+    ``browser_navigate``'s availability probe fails this turn (headless box,
+    expired credential, docker blip) so ``get_tool_definitions`` omits it. The
+    tool is still *registered* — only its probe flapped — so the snapshot must
+    keep it, byte-for-byte, instead of forking the cached prefix.
+    """
+    agent = _agent(["read_file", "browser_navigate", "terminal"])
+    before = list(agent.tools)
+
+    _serve(monkeypatch, [_tool("read_file"), _tool("terminal")])
+    _registered(monkeypatch, ["read_file", "browser_navigate", "terminal"])
+
+    added = mcp_tool.refresh_agent_mcp_tools(agent, preserve_prefix=True)
+
+    assert added == set()
+    assert agent.tools == before
+    assert "browser_navigate" in agent.valid_tool_names
+
+
+def test_preserve_prefix_appends_late_arrivals_at_the_tail(monkeypatch):
+    """``get_definitions`` sorts by name, so a late tool can splice in at 0.
+
+    Under ``preserve_prefix`` the live order is authoritative and the new tool
+    extends the array, leaving every earlier byte where the provider cached it.
+    """
+    agent = _agent(["read_file", "terminal"])
+
+    # Sorted order would put the new tool first.
+    _serve(monkeypatch, [_tool("aaa_mcp_late"), _tool("read_file"), _tool("terminal")])
+    _registered(monkeypatch, ["aaa_mcp_late", "read_file", "terminal"])
+
+    added = mcp_tool.refresh_agent_mcp_tools(agent, preserve_prefix=True)
+
+    assert added == {"aaa_mcp_late"}
+    assert [t["function"]["name"] for t in agent.tools] == [
+        "read_file", "terminal", "aaa_mcp_late",
+    ]
+
+
+# ---------------------------------------------------------------------------
+# tools[] freeze: eviction rebuild + the /reload-mcp re-probe hatch
+# ---------------------------------------------------------------------------
+
+
+def test_eviction_rebuild_restores_the_sessions_saved_tool_order(monkeypatch):
+    """A fresh AIAgent for an EXISTING session must keep the saved tools[] pin.
+
+    Gateway agent-cache eviction rebuilds the agent; ``agent_init`` re-probes
+    every ``check_fn`` and ``browser_navigate``'s flips false. The persisted
+    name list stands in for the missing predecessor: the tool is carried
+    forward from the registry schema, byte-for-byte in its old slot.
+    """
+    from tools import registry as registry_mod
+
+    saved = ["read_file", "browser_navigate", "terminal"]
+    entries = {n: types.SimpleNamespace(name=n, schema=_tool(n)["function"]) for n in saved}
+    monkeypatch.setattr(registry_mod.registry, "get_all_entries", lambda: list(entries.values()), raising=False)
+    monkeypatch.setattr(registry_mod.registry, "get_entry", lambda name, **kw: entries.get(name), raising=False)
+
+    rebuilt = _agent(["read_file", "terminal"])  # probe flipped: browser_navigate gone
+    changed = mcp_tool.restore_agent_tool_prefix(rebuilt, saved)
+
+    assert changed is True
+    assert [t["function"]["name"] for t in rebuilt.tools] == saved
+    assert rebuilt.valid_tool_names == set(saved)
+
+
+def test_reprobe_tool_availability_drops_cached_check_fn_verdicts(monkeypatch):
+    """/reload-mcp is the explicit hatch: a cached False must be re-probed."""
+    from tools import registry as registry_mod
+    import model_tools
+
+    verdict = {"ok": False}
+
+    def probe():
+        return verdict["ok"]
+
+    monkeypatch.setattr(registry_mod, "check_fn_cache_scope", lambda: "test-scope")
+    assert registry_mod._check_fn_cached(probe) is False
+    verdict["ok"] = True
+    assert registry_mod._check_fn_cached(probe) is False  # TTL cache replays stale verdict
+    with model_tools._tool_defs_cache_lock:
+        model_tools._tool_defs_cache[("sentinel",)] = []
+
+    mcp_tool.reprobe_tool_availability()
+
+    assert registry_mod._check_fn_cached(probe) is True
+    assert ("sentinel",) not in model_tools._tool_defs_cache
diff --git a/tests/tools/test_removed_backend_migration.py b/tests/tools/test_removed_backend_migration.py
new file mode 100644
index 0000000000..d6f5f70b74
--- /dev/null
+++ b/tests/tools/test_removed_backend_migration.py
@@ -0,0 +1,98 @@
+"""Removed-backend migration warnings (registry added in #100540).
+
+A config still pointing at a backend registered in
+``tools.tool_backend_helpers.REMOVED_BACKENDS`` must fail loudly and
+specifically:
+
+1. startup — ``validate_config_structure`` emits a warning naming the
+   removal, instead of staying silent until the first tool call;
+2. tool call — ``selection_error`` explains the backend was removed,
+   instead of the generic "no registered provider has that name".
+
+The registry ships empty on main (the Tavily removal that motivated it,
+#99199, was reverted by the #99731 restore), so these tests inject a
+synthetic ``legacysearch`` entry — they pin the machinery, not any
+specific vendor's membership.
+"""
+
+import pytest
+
+import tools.tool_backend_helpers as tbh
+from hermes_cli.config import validate_config_structure
+from tools.tool_backend_helpers import removed_backend_note, selection_error
+
+_NOTE = "the LegacySearch backend was removed in v0.0.0 (alternatives: exa, parallel)"
+
+
+@pytest.fixture
+def legacy_removed(monkeypatch):
+    monkeypatch.setitem(tbh.REMOVED_BACKENDS, "web", {"legacysearch": _NOTE})
+
+
+class TestRemovedBackendNote:
+    def test_note_lookup_normalizes_quotes_and_case(self, legacy_removed):
+        assert removed_backend_note("web", "legacysearch") == _NOTE
+        assert removed_backend_note("web", "'LegacySearch'") == _NOTE
+        assert removed_backend_note("web", '  "LEGACYSEARCH" ') == _NOTE
+
+    def test_unknown_names_and_sections_return_none(self, legacy_removed):
+        assert removed_backend_note("web", "exa") is None
+        assert removed_backend_note("web", "") is None
+        assert removed_backend_note("stt", "legacysearch") is None
+
+    def test_registry_ships_without_live_backends(self):
+        # Restored/live backends must never sit in REMOVED_BACKENDS — the
+        # startup warning would fire on a working provider. Guards the
+        # #99731 restore against a stale tavily entry reappearing.
+        from agent.web_search_registry import get_provider
+
+        for name in tbh.REMOVED_BACKENDS.get("web", {}):
+            assert get_provider(name) is None, (
+                f"{name!r} is registered as removed but a live web provider "
+                "with that name exists"
+            )
+
+
+class TestSelectionErrorRemovedBackend:
+    def test_removed_backend_gets_specific_explanation(self, legacy_removed):
+        msg = selection_error("web", "'legacysearch'", "no registered web search provider has that name")
+        assert _NOTE in msg
+        # generic failure text replaced, not appended
+        assert "no registered web search provider" not in msg
+        # still ends with the uniform remediation contract
+        assert "Run 'hermes tools' to change it." in msg
+
+    def test_live_backend_keeps_caller_failure_text(self, legacy_removed):
+        msg = selection_error("web", "'exa'", "no registered web search provider has that name")
+        assert "no registered web search provider has that name" in msg
+        assert "removed" not in msg
+
+
+class TestStartupWarningForRemovedWebBackend:
+    @staticmethod
+    def _removed_issues(config):
+        return [
+            i for i in validate_config_structure(config)
+            if "removed" in i.message and "legacysearch" in i.message
+        ]
+
+    def test_stale_web_backend_warns_at_startup(self, legacy_removed):
+        issues = self._removed_issues({"web": {"backend": "legacysearch"}})
+        assert len(issues) == 1
+        assert issues[0].severity == "warning"
+        assert "hermes tools" in issues[0].hint
+
+    def test_per_capability_keys_are_checked(self, legacy_removed):
+        assert len(self._removed_issues({"web": {"search_backend": "legacysearch"}})) == 1
+        assert len(self._removed_issues({"web": {"extract_backend": "legacysearch"}})) == 1
+
+    def test_same_stale_value_warns_once(self, legacy_removed):
+        issues = self._removed_issues(
+            {"web": {"backend": "legacysearch", "search_backend": "legacysearch", "extract_backend": "legacysearch"}}
+        )
+        assert len(issues) == 1
+
+    def test_healthy_backend_produces_no_removed_warning(self, legacy_removed):
+        assert self._removed_issues({"web": {"backend": "exa"}}) == []
+        assert self._removed_issues({"web": {}}) == []
+        assert self._removed_issues({}) == []
diff --git a/tests/tools/test_terminal_scope_multiplex.py b/tests/tools/test_terminal_scope_multiplex.py
new file mode 100644
index 0000000000..fb48010b63
--- /dev/null
+++ b/tests/tools/test_terminal_scope_multiplex.py
@@ -0,0 +1,184 @@
+"""Per-turn terminal scope isolation under profile multiplexing (#68559 class).
+
+One multiplexed process serves several profiles, but terminal.* used to
+resolve through the process-global ``TERMINAL_*`` env vars bridged once at
+startup — so every routed profile inherited the launch profile's backend,
+cwd, docker mounts and shared-container key (#68559, #94200, #101132,
+#95470). ``tools.terminal_scope`` installs the routed profile's COMPLETE
+terminal policy as a ContextVar at each profile boundary; readers resolve
+ONLY from it (omitted key → defined default, never ``os.environ``) and an
+unresolvable policy fails closed.
+"""
+
+import json
+import os
+
+import pytest
+
+from tools.terminal_scope import (
+    TerminalPolicyRefusal,
+    TerminalPolicyUnavailable,
+    get_terminal_scope,
+    install_profile_terminal_scope,
+    reset_terminal_scope,
+    set_terminal_scope,
+    terminal_env,
+)
+
+_LAUNCH_CWD = "/home/launch-user/private"
+_LAUNCH_VOLUMES = '["/host/secret:/data:rw"]'
+
+
+@pytest.fixture(autouse=True)
+def _polluted_launch_env(monkeypatch, tmp_path):
+    """Launch profile A bridged a docker backend with sensitive policy into
+    the process env; every test proves a routed profile observes none of it."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path / ".hermes"))
+    monkeypatch.setenv("TERMINAL_ENV", "docker")
+    monkeypatch.setenv("TERMINAL_CWD", _LAUNCH_CWD)
+    monkeypatch.setenv("TERMINAL_DOCKER_VOLUMES", _LAUNCH_VOLUMES)
+    monkeypatch.setenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "alpha-shared")
+    monkeypatch.setenv("TERMINAL_SSH_HOST", "10.10.0.103")
+    monkeypatch.setattr("agent.secret_scope.build_profile_secret_scope", lambda _h: {})
+    monkeypatch.setattr("hermes_cli.env_loader.hydrate_profile_secret_sources", lambda _h: None)
+    import tools.terminal_tool as tt
+
+    monkeypatch.setattr(tt, "_terminal_config_bridge_attempted", True)
+    yield
+
+
+def _profile(tmp_path, name, config_yaml="", dotenv=""):
+    home = tmp_path / "profiles" / name
+    home.mkdir(parents=True)
+    if config_yaml:
+        (home / "config.yaml").write_text(config_yaml, encoding="utf-8")
+    if dotenv:
+        (home / ".env").write_text(dotenv, encoding="utf-8")
+    return home
+
+
+def test_no_scope_keeps_process_env_behavior():
+    """Single-process CLI/TUI (no scope bound) is byte-identical to before."""
+    assert terminal_env("TERMINAL_ENV") == "docker"
+    assert terminal_env("TERMINAL_SSH_HOST") == "10.10.0.103"
+
+
+def test_scoped_read_never_falls_through_to_process_env():
+    """Omitted key under a scope → defined default, NOT the ambient value."""
+    token = set_terminal_scope({"TERMINAL_ENV": "local"})
+    try:
+        assert terminal_env("TERMINAL_ENV") == "local"
+        assert terminal_env("TERMINAL_SSH_HOST") == ""
+        assert terminal_env("TERMINAL_DOCKER_VOLUMES", "[]") == "[]"
+        assert os.environ["TERMINAL_ENV"] == "docker"  # never mutated
+    finally:
+        reset_terminal_scope(token)
+
+
+@pytest.mark.parametrize(
+    "config_yaml,dotenv",
+    [
+        pytest.param("terminal:\n  backend: local\n  cwd: {cwd}\n", "", id="config-yaml"),
+        pytest.param("", "TERMINAL_ENV=local\nTERMINAL_CWD={cwd}\n", id="dotenv-only"),
+    ],
+)
+def test_routed_turn_reads_every_terminal_consumer_from_profile(
+    tmp_path, config_yaml, dotenv
+):
+    """Leak matrix through the REAL gateway boundary: a routed local profile
+    with its own cwd must be seen as such by every terminal.* consumer —
+    terminal_tool config, container key resolution, docker media translation,
+    file_tools/runtime_cwd cwd anchors, and the browser/env_probe backend
+    checks — with none of launch profile A's docker policy showing through."""
+    import gateway.run as gw
+    import tools.terminal_tool as tt
+    from agent import runtime_cwd
+    from gateway.platforms import base as gbase
+    from tools import browser_tool, env_probe, file_tools
+
+    b_cwd = tmp_path / "b-work"
+    b_cwd.mkdir()
+    home = _profile(
+        tmp_path, "bee",
+        config_yaml.format(cwd=b_cwd), dotenv.format(cwd=b_cwd),
+    )
+
+    with gw._profile_runtime_scope(home):
+        cfg = tt._get_env_config()
+        assert cfg["env_type"] == "local"
+        assert cfg["cwd"] == str(b_cwd)
+        assert cfg["docker_volumes"] == []
+        assert cfg["docker_shared_container_key"] == ""
+        assert tt._resolve_container_task_id(None) == "default"
+        assert gbase._parse_docker_volume_mounts() == []
+        assert not any(
+            "alpha-shared" in c for c in gbase._docker_sandbox_dir_candidates("agent:bee:x")
+        )
+        assert file_tools._configured_terminal_cwd() == str(b_cwd)
+        assert runtime_cwd.resolve_agent_cwd() == b_cwd
+        assert browser_tool._is_local_backend() is True
+        # env_probe bails out with "" for remote backends; a local profile
+        # must not be treated as remote just because the launch env is docker.
+        assert env_probe._resolve_terminal_backend() == "local"
+    assert get_terminal_scope() is None
+    # Process env untouched — the launch profile's own turns are unchanged.
+    assert os.environ["TERMINAL_DOCKER_VOLUMES"] == _LAUNCH_VOLUMES
+
+
+def test_profile_omitting_keys_gets_defaults_not_launch_values(tmp_path):
+    """#101132/#95470: a docker profile that does NOT set docker_volumes or
+    docker_shared_container_key must not inherit the launch profile's."""
+    import gateway.run as gw
+    import tools.terminal_tool as tt
+
+    home = _profile(tmp_path, "bee", "terminal:\n  backend: docker\n")
+    with gw._profile_runtime_scope(home):
+        cfg = tt._get_env_config()
+        assert cfg["env_type"] == "docker"
+        assert cfg["docker_volumes"] == []
+        assert cfg["docker_shared_container_key"] == ""
+        assert cfg["ssh_host"] == ""
+        assert cfg["cwd"] != _LAUNCH_CWD
+    assert json.loads(os.environ["TERMINAL_DOCKER_VOLUMES"])  # A unchanged
+
+
+def test_malformed_profile_config_refuses_execution(tmp_path):
+    """Unresolvable policy → refusal scope; terminal_tool refuses instead of
+    running under the launch process's ambient policy (fail closed)."""
+    from tools.terminal_tool import terminal_tool
+
+    home = _profile(tmp_path, "broken", "terminal: [unclosed\n")
+    token = install_profile_terminal_scope(home)
+    try:
+        assert isinstance(get_terminal_scope(), TerminalPolicyRefusal)
+        with pytest.raises(TerminalPolicyUnavailable):
+            terminal_env("TERMINAL_ENV")
+        result = terminal_tool(command="whoami")
+        assert "terminal policy unavailable" in result
+    finally:
+        reset_terminal_scope(token)
+
+
+def test_gateway_runtime_scope_resets_on_error(tmp_path):
+    import gateway.run as gw
+
+    home = _profile(tmp_path, "qa", "terminal:\n  backend: local\n")
+    with pytest.raises(RuntimeError):
+        with gw._profile_runtime_scope(home):
+            assert terminal_env("TERMINAL_ENV") == "local"
+            raise RuntimeError("turn blew up")
+    assert get_terminal_scope() is None
+
+
+def test_tui_and_cron_boundaries_bind_and_reset(tmp_path):
+    import tui_gateway.server as server
+    from tools.terminal_scope import install_and_reset_profile_terminal_scope
+
+    home = _profile(tmp_path, "dash", "terminal:\n  backend: local\n")
+    with server._session_profile_runtime_scope({"profile_home": str(home)}):
+        assert terminal_env("TERMINAL_ENV") == "local"
+        assert terminal_env("TERMINAL_SSH_HOST") == ""
+    assert get_terminal_scope() is None
+    with install_and_reset_profile_terminal_scope(home):  # cron fire helper
+        assert terminal_env("TERMINAL_ENV") == "local"
+    assert get_terminal_scope() is None
diff --git a/tests/tools/test_terminal_tool_requirements.py b/tests/tools/test_terminal_tool_requirements.py
index b87bca9da4..bdf85c9d04 100644
--- a/tests/tools/test_terminal_tool_requirements.py
+++ b/tests/tools/test_terminal_tool_requirements.py
@@ -360,3 +360,34 @@ class TestCheckFnTransientFailureSuppression:
 
         assert "terminal" not in names
         assert "execute_code" not in names
+
+
+class TestUnscopedSecretReadLogging:
+    """#100697: with multiplexing on, boot-time check_fns run before any
+    profile secret scope exists, so get_secret fails closed with
+    UnscopedSecretError. That expected signal must not be logged like a
+    crashed check_fn (WARNING + traceback); an unscoped read reported while
+    the scope was *resolved* is a genuinely lost scope and stays loud."""
+
+    def test_expected_fail_closed_probe_is_quiet_but_lost_scope_stays_loud(self, caplog):
+        import logging
+
+        import tools.registry as reg
+        from agent.secret_scope import get_secret, set_multiplex_active
+
+        def probe():
+            return bool(get_secret("REGISTRY_LOG_PROBE_TOKEN", ""))
+
+        set_multiplex_active(True)
+        try:
+            with caplog.at_level(logging.DEBUG, logger="tools.registry"):
+                assert reg._run_check_fn_uncached(probe, unresolved_scope=True) is False
+                boot = [r for r in caplog.records if r.name == "tools.registry"]
+                caplog.clear()
+                assert reg._run_check_fn_uncached(probe, unresolved_scope=False) is False
+                lost = [r for r in caplog.records if r.name == "tools.registry"]
+        finally:
+            set_multiplex_active(False)
+
+        assert boot and all(r.levelno == logging.DEBUG and r.exc_info is None for r in boot)
+        assert any(r.levelno >= logging.WARNING and r.exc_info for r in lost)
diff --git a/tests/tools/test_tip_tool.py b/tests/tools/test_tip_tool.py
index 7134b2799a..d8c9098a67 100644
--- a/tests/tools/test_tip_tool.py
+++ b/tests/tools/test_tip_tool.py
@@ -24,7 +24,7 @@ def emitted(monkeypatch):
 def test_lives_in_the_gui_surface_toolset(monkeypatch):
     """Scoped by toolset, not by the backend's env — see AGENTS.md."""
     monkeypatch.delenv("HERMES_DESKTOP", raising=False)
-    entry = registry.get_entry("tip")
+    entry = registry.get_entry("show_tip")
 
     assert entry is not None
     assert entry.toolset == "desktop_ui"
@@ -33,7 +33,7 @@ def test_lives_in_the_gui_surface_toolset(monkeypatch):
 def test_answers_to_the_appearance_switch():
     """Tips off has to mean the model never sees the tool. See
     tests/tools/test_display_toggles.py for the config end of it."""
-    entry = registry.get_entry("tip")
+    entry = registry.get_entry("show_tip")
 
     assert entry is not None
     assert entry.check_fn is tt.check_tips_enabled
diff --git a/tests/tools/test_tool_search.py b/tests/tools/test_tool_search.py
index 3e2c80e8ad..4a6b654d82 100644
--- a/tests/tools/test_tool_search.py
+++ b/tests/tools/test_tool_search.py
@@ -96,7 +96,30 @@ class TestClassification:
             assert not is_deferrable_tool_name(name), name
             assert name not in _HERMES_CORE_TOOLS
 
-    def test_gui_surface_alone_does_not_activate_the_bridge(self):
+    def test_gui_surface_defers_by_default(self):
+        """2026-08 core-deferral reversal: the curated defer set (GUI surface
+        included) hides behind the bridge BY DEFAULT. project tools not in
+        the defer set stay direct."""
+        from tools.registry import discover_builtin_tools
+        from tools.tool_search import ToolSearchConfig, assemble_tool_defs
+
+        discover_builtin_tools()
+        assembled = assemble_tool_defs(
+            [_td(name, f"GUI {name}") for name in
+             {"read_window_below", "apply_layout", "project_list"}],
+            context_length=200_000,
+            config=ToolSearchConfig.from_raw({"enabled": "on"}),
+        )
+        assert assembled.activated
+        names = {td["function"]["name"] for td in assembled.tool_defs}
+        assert "read_window_below" not in names
+        assert "apply_layout" not in names
+        # project_list is NOT in the curated defer set → stays direct.
+        assert "project_list" in names
+
+    def test_defer_override_restores_legacy_direct_gui(self):
+        """tools.tool_search.defer: [] restores the everything-eager legacy:
+        GUI tools alone no longer activate the bridge."""
         from tools.registry import discover_builtin_tools
         from tools.tool_search import ToolSearchConfig, assemble_tool_defs
 
@@ -105,14 +128,15 @@ class TestClassification:
         assembled = assemble_tool_defs(
             [_td(name, f"GUI {name}") for name in names],
             context_length=200_000,
-            config=ToolSearchConfig.from_raw({"enabled": "on"}),
+            config=ToolSearchConfig.from_raw({"enabled": "on", "defer": []}),
         )
         assert not assembled.activated
         assert {td["function"]["name"] for td in assembled.tool_defs} == names
 
-    def test_gui_surface_stays_direct_when_mcp_activates_the_bridge(self):
-        """MCP/plugin tools turn Tool Search on; the session's GUI tools stay
-        in the model-facing array so HUD can still name read_window_below."""
+    def test_core_working_set_never_defers_even_with_mcp_active(self):
+        """The bridge activates for MCP, but working-set core tools (terminal,
+        files, memory...) stay direct — the deferral set is the CURATED list,
+        not all of core."""
         from tools.registry import discover_builtin_tools, registry
         from tools.tool_search import (
             BRIDGE_TOOL_NAMES,
@@ -131,8 +155,8 @@ class TestClassification:
 
         assembled = assemble_tool_defs(
             [
-                _td("read_window_below", "Identify the window below"),
-                _td("apply_layout", "Apply a layout preset"),
+                _td("terminal", "Run a command"),
+                _td("memory", "Persistent memory"),
                 _td("computer_use", "Drive the OS"),
                 _td(mcp_name, "Deferred MCP capability"),
             ],
@@ -144,7 +168,38 @@ class TestClassification:
         assert assembled.activated
         assert mcp_name not in names
         assert BRIDGE_TOOL_NAMES <= names
-        assert {"read_window_below", "apply_layout", "computer_use"} <= names
+        assert {"terminal", "memory"} <= names
+        # computer_use IS in the curated defer set → behind the bridge.
+        assert "computer_use" not in names
+
+    def test_clarify_stays_eager_by_default(self):
+        """PR #97979 A/B verdict (288 runs, 3 model tiers): clarify deferred
+        collapsed structured ask-the-user usage 18/18 → 7/18 (gpt-terra 0/6);
+        models fell back to plain-text questions. The ask-the-user affordance
+        must stay ambient — clarify is NOT in the curated default defer set,
+        and assembles as a direct tool even when the bridge is active."""
+        from tools.registry import discover_builtin_tools
+        from tools.tool_search import (
+            _DEFAULT_DEFERRED_TOOLS,
+            ToolSearchConfig,
+            assemble_tool_defs,
+        )
+
+        assert "clarify" not in _DEFAULT_DEFERRED_TOOLS
+
+        discover_builtin_tools()
+        assembled = assemble_tool_defs(
+            [
+                _td("clarify", "Ask the user clarifying questions"),
+                _td("computer_use", "Drive the OS"),
+            ],
+            context_length=200_000,
+            config=ToolSearchConfig.from_raw({"enabled": "on"}),
+        )
+        assert assembled.activated  # computer_use still activates the bridge
+        names = {td["function"]["name"] for td in assembled.tool_defs}
+        assert "clarify" in names
+        assert "computer_use" not in names
 
     def test_unknown_tool_not_deferrable(self):
         """Defensive: a tool name we cannot resolve to a registry entry must
@@ -658,9 +713,24 @@ class TestDeferredCallSchemaProbe:
         registry.register(
             name=name,
             handler=_handler,
-            schema={"type": "function",
-                    "function": {"name": name, "description": f"desc {name}",
-                                 "parameters": params}},
+            schema={"name": name, "description": f"desc {name}",
+                    "parameters": params},
+            toolset=toolset,
+        )
+
+    @staticmethod
+    def _register_schema(name, toolset, params, calls):
+        from tools.registry import registry
+
+        def _handler(args, task_id=None, **kw):
+            calls.append(args)
+            return json.dumps({"ok": True, "args": args})
+
+        registry.register(
+            name=name,
+            handler=_handler,
+            schema={"name": name, "description": f"desc {name}",
+                    "parameters": params},
             toolset=toolset,
         )
 
@@ -696,3 +766,166 @@ class TestDeferredCallSchemaProbe:
         ))
         assert result.get("ok") is True
         assert result.get("doc") == "abc"
+
+    def test_invalid_enum_is_blocked_before_dispatch(self):
+        import model_tools
+
+        calls = []
+        name = "mcp_probe_enum_validation"
+        toolset = "mcp-probe-enum-validation"
+        self._register_schema(name, toolset, {
+            "type": "object",
+            "properties": {
+                "priority": {"type": "string", "enum": ["low", "high"]},
+            },
+            "required": ["priority"],
+        }, calls)
+
+        result = json.loads(model_tools.handle_function_call(
+            function_name="tool_call",
+            function_args={"name": name, "arguments": {"priority": "urgent"}},
+            enabled_toolsets=[toolset],
+        ))
+
+        assert calls == []
+        assert result["path"] == "arguments.priority"
+        assert result["constraint"] == "enum"
+        assert "NOT invoked" in result["error"]
+
+    @pytest.mark.parametrize(
+        ("suffix", "arguments", "expected_path", "expected_constraint"),
+        [
+            (
+                "nested_type",
+                {"options": {"count": "not-an-integer"}},
+                "arguments.options.count",
+                "type",
+            ),
+            (
+                "nested_required",
+                {"options": {}},
+                "arguments.options",
+                "required",
+            ),
+            (
+                "nested_extra",
+                {"options": {"count": 1, "extra": True}},
+                "arguments.options",
+                "additionalProperties",
+            ),
+        ],
+    )
+    def test_validator_reports_nested_constraint_path(
+        self, suffix, arguments, expected_path, expected_constraint,
+    ):
+        from tools.tool_search import validate_deferred_call_args
+
+        calls = []
+        name = f"mcp_probe_{suffix}"
+        self._register_schema(name, "mcp-probe-nested", {
+            "type": "object",
+            "properties": {
+                "options": {
+                    "type": "object",
+                    "properties": {"count": {"type": "integer"}},
+                    "required": ["count"],
+                    "additionalProperties": False,
+                },
+            },
+            "required": ["options"],
+        }, calls)
+
+        result = json.loads(validate_deferred_call_args(name, arguments))
+
+        assert result["path"] == expected_path
+        assert result["constraint"] == expected_constraint
+
+    def test_coercible_arguments_validate_then_dispatch_repaired(self):
+        import model_tools
+
+        calls = []
+        name = "mcp_probe_coercion_validation"
+        toolset = "mcp-probe-coercion-validation"
+        self._register_schema(name, toolset, {
+            "type": "object",
+            "properties": {"count": {"type": "integer"}},
+            "required": ["count"],
+        }, calls)
+
+        result = json.loads(model_tools.handle_function_call(
+            function_name="tool_call",
+            function_args={"name": name, "arguments": {"count": "42"}},
+            enabled_toolsets=[toolset],
+        ))
+
+        assert result["ok"] is True
+        assert calls == [{"count": 42}]
+
+    def test_nullable_extension_remains_accepted(self):
+        import model_tools
+
+        calls = []
+        name = "mcp_probe_nullable_validation"
+        toolset = "mcp-probe-nullable-validation"
+        self._register_schema(name, toolset, {
+            "type": "object",
+            "properties": {"value": {"type": "string", "nullable": True}},
+            "required": ["value"],
+        }, calls)
+
+        result = json.loads(model_tools.handle_function_call(
+            function_name="tool_call",
+            function_args={"name": name, "arguments": {"value": None}},
+            enabled_toolsets=[toolset],
+        ))
+
+        assert result["ok"] is True
+        assert calls == [{"value": None}]
+
+    def test_schema_normalization_preserves_literal_enum_objects(self):
+        from tools.tool_search import validate_deferred_call_args
+
+        calls = []
+        name = "mcp_probe_literal_enum_validation"
+        enum_value = {"nullable": True, "$ref": "literal-not-a-schema"}
+        self._register_schema(name, "mcp-probe-literal-enum", {
+            "type": "object",
+            "properties": {"value": {"enum": [enum_value]}},
+            "required": ["value"],
+        }, calls)
+
+        assert validate_deferred_call_args(name, {"value": enum_value}) is None
+
+    def test_malformed_schema_fails_open(self):
+        import model_tools
+
+        calls = []
+        name = "mcp_probe_malformed_validation"
+        toolset = "mcp-probe-malformed-validation"
+        self._register_schema(name, toolset, {
+            "type": "object",
+            "properties": {"value": {"type": "not-a-json-schema-type"}},
+        }, calls)
+
+        result = json.loads(model_tools.handle_function_call(
+            function_name="tool_call",
+            function_args={"name": name, "arguments": {"value": "kept"}},
+            enabled_toolsets=[toolset],
+        ))
+
+        assert result["ok"] is True
+        assert calls == [{"value": "kept"}]
+
+    def test_external_ref_fails_open_without_resolution(self):
+        from tools.tool_search import validate_deferred_call_args
+
+        calls = []
+        name = "mcp_probe_external_ref_validation"
+        self._register_schema(name, "mcp-probe-external-ref", {
+            "type": "object",
+            "properties": {
+                "payload": {"$ref": "https://example.invalid/schema.json"},
+            },
+        }, calls)
+
+        assert validate_deferred_call_args(name, {"payload": {"anything": True}}) is None
diff --git a/tests/tools/test_tour_tool.py b/tests/tools/test_tour_tool.py
index 1ab40e21ac..1cd2196cc3 100644
--- a/tests/tools/test_tour_tool.py
+++ b/tests/tools/test_tour_tool.py
@@ -14,7 +14,7 @@ def _run(**kwargs):
 def test_lives_in_the_gui_surface_toolset(monkeypatch):
     """Scoped by toolset, not by the backend's env — see AGENTS.md."""
     monkeypatch.delenv("HERMES_DESKTOP", raising=False)
-    entry = registry.get_entry("tour")
+    entry = registry.get_entry("gui_tour")
 
     assert entry is not None
     assert entry.toolset == "desktop_ui"
@@ -23,7 +23,7 @@ def test_lives_in_the_gui_surface_toolset(monkeypatch):
 def test_answers_to_the_appearance_switch():
     """Tours off has to mean the model never sees the tool. See
     tests/tools/test_display_toggles.py for the config end of it."""
-    entry = registry.get_entry("tour")
+    entry = registry.get_entry("gui_tour")
 
     assert entry is not None
     assert entry.check_fn is tt.check_tours_enabled
diff --git a/tests/tools/test_tts_lifecycle_leases.py b/tests/tools/test_tts_lifecycle_leases.py
new file mode 100644
index 0000000000..7558848f8e
--- /dev/null
+++ b/tests/tools/test_tts_lifecycle_leases.py
@@ -0,0 +1,305 @@
+"""TTS engine lifecycle driven by speech-output toggles (issue #100881).
+
+Local engines load lazily on first synthesis, so the first spoken reply after
+"read replies aloud" / voice conversation turns on pays the model load as dead
+air. The toggles now hold *leases*: acquiring warms the configured provider
+into the SAME cache slot synthesis reads; releasing the last lease unloads
+resident local models.
+"""
+
+from __future__ import annotations
+
+import threading
+
+import pytest
+
+from tools import tts_tool
+
+
+@pytest.fixture(autouse=True)
+def _clean_lifecycle(monkeypatch):
+    tts_tool._reset_tts_leases_for_tests()
+    for cache in tts_tool._LOCAL_TTS_MODEL_CACHES.values():
+        cache.clear()
+    yield
+    tts_tool._reset_tts_leases_for_tests()
+    for cache in tts_tool._LOCAL_TTS_MODEL_CACHES.values():
+        cache.clear()
+
+
+class _FakePiperVoice:
+    loads = 0
+    synthesized: list = []
+
+    @classmethod
+    def load(cls, model_path, use_cuda=False):
+        cls.loads += 1
+        inst = cls()
+        inst.model_path = model_path
+        return inst
+
+    def synthesize_wav(self, text, wav_file, syn_config=None):
+        type(self).synthesized.append(text)
+        wav_file.setnchannels(1)
+        wav_file.setsampwidth(2)
+        wav_file.setframerate(16000)
+        wav_file.writeframes(b"\x00\x00" * 160)
+
+
+@pytest.fixture
+def fake_piper(monkeypatch, tmp_path):
+    _FakePiperVoice.loads = 0
+    _FakePiperVoice.synthesized = []
+    monkeypatch.setattr(tts_tool, "_import_piper", lambda: _FakePiperVoice)
+    # Pretend the voice is already on disk so no download subprocess runs.
+    voices_dir = tmp_path / "voices"
+    voices_dir.mkdir()
+    (voices_dir / "en_US-test-medium.onnx").write_bytes(b"onnx")
+    (voices_dir / "en_US-test-medium.onnx.json").write_text("{}")
+    cfg = {"provider": "piper", "piper": {"voice": "en_US-test-medium", "voices_dir": str(voices_dir)}}
+    monkeypatch.setattr(tts_tool, "_load_tts_config", lambda: cfg)
+    return cfg
+
+
+# --------------------------------------------------------------------------
+# warm_tts_provider: warm-up populates the exact slot synthesis reads
+# --------------------------------------------------------------------------
+
+
+def test_warm_loads_piper_into_synthesis_cache(fake_piper, tmp_path):
+    result = tts_tool.warm_tts_provider(fake_piper)
+
+    assert result["warmed"] is True
+    assert result["action"] == "loaded"
+    assert result["provider"] == "piper"
+    assert _FakePiperVoice.loads == 1
+    assert len(tts_tool._piper_voice_cache) == 1
+
+    # The load that would have happened on the first reply is already done:
+    # synthesis reuses the warmed instance without loading again.
+    out = tts_tool._generate_piper_tts("hello", str(tmp_path / "out.wav"), fake_piper)
+    assert out.endswith(".wav")
+    assert _FakePiperVoice.loads == 1
+    assert _FakePiperVoice.synthesized == ["hello"]
+
+
+def test_warm_twice_is_a_cache_hit(fake_piper):
+    tts_tool.warm_tts_provider(fake_piper)
+    second = tts_tool.warm_tts_provider(fake_piper)
+
+    assert second["action"] == "cached"
+    assert _FakePiperVoice.loads == 1
+
+
+def test_warm_reads_configured_provider_when_none_given(fake_piper):
+    result = tts_tool.warm_tts_provider()
+    assert result["provider"] == "piper"
+    assert result["action"] == "loaded"
+
+
+def test_warm_never_raises_on_engine_failure(monkeypatch):
+    def _boom():
+        raise ImportError("No module named 'piper'")
+
+    monkeypatch.setattr(tts_tool, "_import_piper", _boom)
+    result = tts_tool.warm_tts_provider({"provider": "piper"})
+
+    assert result["warmed"] is False
+    assert result["action"] == "error"
+    assert "piper" in result["error"]
+    assert tts_tool._piper_voice_cache == {}
+
+
+def test_warm_is_noop_for_cloud_provider_without_lazy_sdk(monkeypatch):
+    result = tts_tool.warm_tts_provider({"provider": "openai"})
+    assert result == {"provider": "openai", "warmed": False, "action": "noop"}
+
+
+def test_warm_lazy_sdk_provider_reports_cached_when_installed(monkeypatch):
+    import types
+
+    fake = types.SimpleNamespace(
+        is_available=lambda feature: feature == "tts.edge",
+        ensure=lambda *a, **k: pytest.fail("ensure must not run when the SDK is present"),
+    )
+    monkeypatch.setitem(__import__("sys").modules, "tools.lazy_deps", fake)
+    result = tts_tool.warm_tts_provider({"provider": "edge"})
+    assert result["warmed"] is True
+    assert result["action"] == "cached"
+
+
+def test_warm_lazy_sdk_provider_installs_when_missing(monkeypatch):
+    import types
+
+    calls = []
+    fake = types.SimpleNamespace(
+        is_available=lambda feature: False,
+        ensure=lambda feature, prompt: calls.append((feature, prompt)),
+    )
+    monkeypatch.setitem(__import__("sys").modules, "tools.lazy_deps", fake)
+    result = tts_tool.warm_tts_provider({"provider": "edge"})
+    assert result["action"] == "installed"
+    assert calls == [("tts.edge", False)]
+
+
+# --------------------------------------------------------------------------
+# release_tts_provider
+# --------------------------------------------------------------------------
+
+
+def test_release_drops_every_local_cache(fake_piper):
+    tts_tool.warm_tts_provider(fake_piper)
+    tts_tool._kittentts_model_cache["m"] = object()
+
+    assert tts_tool.release_tts_provider() == {"released": 2}
+    assert tts_tool._piper_voice_cache == {}
+    assert tts_tool._kittentts_model_cache == {}
+
+
+def test_release_scoped_to_one_provider(fake_piper):
+    tts_tool.warm_tts_provider(fake_piper)
+    tts_tool._kittentts_model_cache["m"] = object()
+
+    assert tts_tool.release_tts_provider("kittentts") == {"released": 1}
+    assert len(tts_tool._piper_voice_cache) == 1
+
+
+def test_release_with_nothing_resident_is_zero():
+    assert tts_tool.release_tts_provider() == {"released": 0}
+
+
+# --------------------------------------------------------------------------
+# Leases: warm on acquire, unload only when the LAST holder releases
+# --------------------------------------------------------------------------
+
+
+def test_acquire_warms_and_counts(fake_piper):
+    result = tts_tool.acquire_tts_lease("desktop:read-aloud")
+    assert result["leases"] == 1
+    assert result["action"] == "loaded"
+    assert tts_tool.tts_lease_holders() == ["desktop:read-aloud"]
+
+
+def test_last_release_unloads_but_earlier_release_does_not(fake_piper):
+    tts_tool.acquire_tts_lease("desktop:read-aloud")
+    tts_tool.acquire_tts_lease("tui:voice-tts")
+    assert len(tts_tool._piper_voice_cache) == 1
+
+    # One surface turning speech off must not pull the model from under the
+    # other surface that still speaks through this process.
+    first = tts_tool.release_tts_lease("desktop:read-aloud")
+    assert first == {"leases": 1, "released": 0}
+    assert len(tts_tool._piper_voice_cache) == 1
+
+    last = tts_tool.release_tts_lease("tui:voice-tts")
+    assert last == {"leases": 0, "released": 1}
+    assert tts_tool._piper_voice_cache == {}
+
+
+def test_reacquire_is_idempotent_and_reheals_cache(fake_piper):
+    tts_tool.acquire_tts_lease("cli:voice-tts")
+    tts_tool.release_tts_provider()  # something else dropped the model
+    result = tts_tool.acquire_tts_lease("cli:voice-tts")
+
+    assert result["leases"] == 1
+    assert result["action"] == "loaded"
+    assert _FakePiperVoice.loads == 2
+
+
+def test_release_unknown_lease_is_noop(fake_piper):
+    tts_tool.acquire_tts_lease("a")
+    assert tts_tool.release_tts_lease("never-acquired") == {"leases": 1, "released": 0}
+    assert len(tts_tool._piper_voice_cache) == 1
+
+
+def test_acquire_failure_still_registers_lease(monkeypatch):
+    def _boom():
+        raise RuntimeError("engine missing")
+
+    monkeypatch.setattr(tts_tool, "_import_piper", _boom)
+    result = tts_tool.acquire_tts_lease("desktop:conversation", {"provider": "piper"})
+    assert result["action"] == "error"
+    assert result["leases"] == 1
+    assert tts_tool.tts_lease_holders() == ["desktop:conversation"]
+
+
+# --------------------------------------------------------------------------
+# Registry invariant: every local engine cache is release-able
+# --------------------------------------------------------------------------
+
+
+def test_every_local_warmer_has_a_registered_cache():
+    warmers = tts_tool._local_tts_warmers()
+    assert set(warmers) == set(tts_tool._LOCAL_TTS_MODEL_CACHES)
+    assert tts_tool._LOCAL_TTS_MODEL_CACHES["piper"] is tts_tool._piper_voice_cache
+    assert tts_tool._LOCAL_TTS_MODEL_CACHES["kittentts"] is tts_tool._kittentts_model_cache
+
+
+# --------------------------------------------------------------------------
+# User-declared providers get the same signal (plugin warm()/release(),
+# command warm_command/release_command) so a local TTS server can preload
+# and unload on the speech toggles.
+# --------------------------------------------------------------------------
+
+
+def test_plugin_provider_warm_and_release_follow_the_lease(monkeypatch):
+    from agent import tts_provider, tts_registry
+
+    calls: list = []
+
+    class _ServerBacked(tts_provider.TTSProvider):
+        @property
+        def name(self):
+            return "my-server"
+
+        def synthesize(self, text, output_path, **kw):
+            return output_path
+
+        def warm(self):
+            calls.append("warm")
+
+        def release(self):
+            calls.append("release")
+
+    tts_registry._reset_for_tests()
+    tts_registry.register_provider(_ServerBacked())
+    cfg = {"provider": "my-server"}
+    monkeypatch.setattr(tts_tool, "_load_tts_config", lambda: cfg)
+    monkeypatch.setattr("hermes_cli.plugins._ensure_plugins_discovered", lambda force=False: None)
+    try:
+        assert tts_tool.acquire_tts_lease("desktop:read-aloud", cfg)["action"] == "warmed"
+        tts_tool.acquire_tts_lease("tui:voice-tts", cfg)
+        tts_tool.release_tts_lease("desktop:read-aloud")
+        assert calls == ["warm", "warm"]  # still one holder — no release yet
+        tts_tool.release_tts_lease("tui:voice-tts")
+        assert calls == ["warm", "warm", "release"]
+    finally:
+        tts_registry._reset_for_tests()
+
+
+def test_command_provider_runs_warm_and_release_commands(monkeypatch):
+    ran: list = []
+    done = threading.Event()
+
+    def _fake_run(command, timeout, env_passthrough=None):
+        ran.append(command)
+        done.set()
+
+    monkeypatch.setattr(tts_tool, "_run_command_tts", _fake_run)
+    cfg = {
+        "provider": "srv",
+        "providers": {"srv": {
+            "command": "srv say {input_path} {output_path}",
+            "warm_command": "curl -s localhost:5002/load?model={model}",
+            "release_command": "curl -s localhost:5002/unload",
+            "model": "kokoro v1",
+        }},
+    }
+    monkeypatch.setattr(tts_tool, "_load_tts_config", lambda: cfg)
+
+    assert tts_tool.acquire_tts_lease("desktop:read-aloud", cfg)["action"] == "warmed"
+    assert done.wait(5)
+    done.clear()
+    tts_tool.release_tts_lease("desktop:read-aloud")
+    assert done.wait(5)
+    assert ran == ["curl -s localhost:5002/load?model='kokoro v1'", "curl -s localhost:5002/unload"]
diff --git a/tests/tools/test_tts_output_dir_profile_scope.py b/tests/tools/test_tts_output_dir_profile_scope.py
new file mode 100644
index 0000000000..264718e20d
--- /dev/null
+++ b/tests/tools/test_tts_output_dir_profile_scope.py
@@ -0,0 +1,60 @@
+"""Regression tests for profile-scoped TTS default output dir (#98749).
+
+``DEFAULT_OUTPUT_DIR`` was resolved once at import time, so long-lived
+multi-profile runtimes (dashboard console, TUI/Desktop backend, cron, kanban
+workers) kept writing synthesized audio into the launch profile's
+``cache/audio`` even while the request was scoped to a different profile via
+``HERMES_HOME`` or ``set_hermes_home_override()``. The call-time accessor
+``_default_output_dir()`` re-resolves from the live profile-scoped home;
+these pins keep the synthesis paths from re-freezing the launch profile.
+"""
+
+import importlib
+from pathlib import Path
+
+
+def _reload_tts_tool(import_home: Path, monkeypatch):
+    monkeypatch.setenv("HERMES_HOME", str(import_home))
+    import tools.tts_tool as tts_tool
+
+    return importlib.reload(tts_tool)
+
+
+def test_default_output_dir_follows_contextvar_profile_override(tmp_path, monkeypatch):
+    """The web server scopes profiles via set_hermes_home_override() rather
+    than mutating the process env; the accessor must follow that override."""
+    default_home = tmp_path / "default-home"
+    profile_home = tmp_path / "profiles" / "ramona"
+    default_home.mkdir(parents=True)
+    profile_home.mkdir(parents=True)
+
+    tts_tool = _reload_tts_tool(default_home, monkeypatch)
+
+    from hermes_constants import (
+        reset_hermes_home_override,
+        set_hermes_home_override,
+    )
+
+    token = set_hermes_home_override(str(profile_home))
+    try:
+        assert tts_tool._default_output_dir() == str(
+            profile_home / "cache" / "audio"
+        )
+    finally:
+        reset_hermes_home_override(token)
+
+    # Outside the override scope the launch home applies again.
+    assert tts_tool._default_output_dir() == str(default_home / "cache" / "audio")
+
+
+def test_explicit_default_output_dir_monkeypatch_still_wins(tmp_path, monkeypatch):
+    """Existing tests and external patchers can still override
+    tools.tts_tool.DEFAULT_OUTPUT_DIR directly."""
+    default_home = tmp_path / "default-home"
+    default_home.mkdir(parents=True)
+
+    tts_tool = _reload_tts_tool(default_home, monkeypatch)
+
+    monkeypatch.setattr(tts_tool, "DEFAULT_OUTPUT_DIR", "/custom/audio")
+
+    assert tts_tool._default_output_dir() == "/custom/audio"
diff --git a/tests/tools/test_web_keyless_fallback.py b/tests/tools/test_web_keyless_fallback.py
index 1721d3f98d..1de9fba14b 100644
--- a/tests/tools/test_web_keyless_fallback.py
+++ b/tests/tools/test_web_keyless_fallback.py
@@ -25,7 +25,7 @@ from plugins.web.parallel.provider import ParallelWebSearchProvider
 def _no_web_env(monkeypatch):
     """Blank every web credential and neutralize config lookups."""
     for var in (
-        "EXA_API_KEY", "PARALLEL_API_KEY", "KEENABLE_API_KEY",
+        "EXA_API_KEY", "PARALLEL_API_KEY", "KEENABLE_API_KEY", "TAVILY_API_KEY",
         "FIRECRAWL_API_KEY", "FIRECRAWL_API_URL", "BRAVE_SEARCH_API_KEY",
         "SEARXNG_URL", "TOOL_GATEWAY_USER_TOKEN",
     ):
@@ -289,7 +289,7 @@ class TestResolutionOrder:
 
     def test_keyless_ring_rotates_and_covers_all_vendors(self, fresh_registry, monkeypatch):
         monkeypatch.setattr(registry, "_read_config_key", lambda *p: None)
-        # The ring order always contains all five vendors, starting at the
+        # The ring order always contains all four vendors, starting at the
         # current cursor and wrapping.
         order = registry._keyless_preference()
         assert sorted(order) == sorted(keyless_mcp._KEYLESS_RING)
@@ -303,6 +303,15 @@ class TestResolutionOrder:
         assert keyless_mcp._ring_order("keenable")[0] == "keenable"
         assert keyless_mcp._ring_order("keenable")[0] == "keenable"
 
+    def test_tavily_is_not_a_ring_member(self):
+        """Tavily is opt-in keyless; zero-config rotation must not include it."""
+        from plugins.web import keyless_mcp
+
+        assert "tavily" not in keyless_mcp._KEYLESS_RING
+        assert "tavily" not in keyless_mcp._KEYLESS_SEARCHERS
+        assert "tavily" not in keyless_mcp._KEYLESS_EXTRACTORS
+        assert "tavily" not in registry._KEYLESS_PREFERENCE
+
     def test_registry_keyless_disabled_returns_none(self, fresh_registry, monkeypatch):
         monkeypatch.setattr(registry, "_read_config_key", lambda *p: None)
         monkeypatch.setattr(registry, "_keyless_tier_enabled", lambda: False)
diff --git a/tests/tools/test_web_tools_config.py b/tests/tools/test_web_tools_config.py
index 29c5f3b8cf..92f30ae57b 100644
--- a/tests/tools/test_web_tools_config.py
+++ b/tests/tools/test_web_tools_config.py
@@ -210,6 +210,7 @@ class TestBackendSelection:
         "TOOL_GATEWAY_SCHEME",
         "TOOL_GATEWAY_USER_TOKEN",
         "KEENABLE_API_KEY",
+        "TAVILY_API_KEY",
     )
 
     def setup_method(self):
@@ -254,7 +255,7 @@ class TestBackendSelection:
             assert _get_backend() == "exa"
 
     def test_fallback_exa_takes_priority_over_parallel(self):
-        """Direct-credential backends are tried in the order exa > parallel > keenable
+        """Direct-credential backends are tried in the order tavily > exa > parallel > keenable
         so an explicit Exa key wins when both Exa and Parallel are configured."""
         from tools.web_tools import _get_backend
         with patch("tools.web_tools._load_web_config", return_value={}), \
@@ -275,6 +276,27 @@ class TestBackendSelection:
              patch.dict(os.environ, {"EXA_API_KEY": "exa-test", "FIRECRAWL_API_KEY": "fc-test"}):
             assert _get_backend() == "exa"
 
+    def test_fallback_tavily_only_key(self):
+        """Only TAVILY_API_KEY set → 'tavily'."""
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test"}):
+            assert _get_backend() == "tavily"
+
+    def test_fallback_tavily_beats_firecrawl_direct(self):
+        """Tavily ranks above firecrawl in the explicit-credential block."""
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test", "FIRECRAWL_API_KEY": "fc-test"}):
+            assert _get_backend() == "tavily"
+
+    def test_fallback_tavily_beats_exa(self):
+        """Tavily ranks above Exa in the explicit-credential block."""
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test", "EXA_API_KEY": "exa-test"}):
+            assert _get_backend() == "tavily"
+
 
     def test_fallback_parallel_beats_firecrawl_direct(self):
         """Parallel + Firecrawl-direct → parallel (parallel is the higher-priority
@@ -342,6 +364,14 @@ class TestBackendSelection:
              patch.dict(os.environ, {"EXA_API_KEY": "exa-test"}):
             assert _get_backend() == "exa"
 
+    def test_managed_gateway_does_not_preempt_explicit_tavily(self):
+        """A Nous OAuth token must not beat an explicit TAVILY_API_KEY."""
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=True), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test"}):
+            assert _get_backend() == "tavily"
+
     def test_managed_gateway_only_falls_through_to_firecrawl(self):
         """When no explicit-credential backend is configured, a Nous-managed
         gateway token still selects firecrawl — the convenience path is
@@ -494,6 +524,7 @@ class TestCheckWebApiKey:
         "TOOL_GATEWAY_SCHEME",
         "TOOL_GATEWAY_USER_TOKEN",
         "KEENABLE_API_KEY",
+        "TAVILY_API_KEY",
     )
 
     def setup_method(self):
@@ -597,7 +628,9 @@ class TestCheckWebApiKey:
 def test_web_requires_env_includes_exa_key():
     from tools.web_tools import _web_requires_env
 
-    assert "EXA_API_KEY" in _web_requires_env()
+    env = _web_requires_env()
+    assert "EXA_API_KEY" in env
+    assert "TAVILY_API_KEY" in env
 
 
 class TestNonBuiltinProviderAvailability:
@@ -625,6 +658,7 @@ class TestNonBuiltinProviderAvailability:
         "TOOL_GATEWAY_SCHEME",
         "TOOL_GATEWAY_USER_TOKEN",
         "KEENABLE_API_KEY",
+        "TAVILY_API_KEY",
         "SEARXNG_URL",
         "BRAVE_SEARCH_API_KEY",
         "XAI_API_KEY",
@@ -765,6 +799,7 @@ class TestSiblingProvidersEnvResolution:
         ("plugins.web.exa.provider", "ExaWebSearchProvider", "EXA_API_KEY"),
         ("plugins.web.parallel.provider", "ParallelWebSearchProvider", "PARALLEL_API_KEY"),
         ("plugins.web.keenable.provider", "KeenableWebSearchProvider", "KEENABLE_API_KEY"),
+        ("plugins.web.tavily.provider", "TavilyWebSearchProvider", "TAVILY_API_KEY"),
         ("plugins.web.brave_free.provider", "BraveFreeWebSearchProvider", "BRAVE_SEARCH_API_KEY"),
     ]
 
@@ -811,6 +846,28 @@ class TestSiblingProvidersEnvResolution:
             assert headers["Authorization"] == "Bearer kn-from-dotenv"
             assert headers["X-Keenable-Title"] == "hermes-agent"
 
+    def test_tavily_request_reads_key_via_get_env_value(self, monkeypatch):
+        """Keyed Tavily must Bearer-auth with a key that lives only in .env."""
+        monkeypatch.delenv("TAVILY_API_KEY", raising=False)
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"results": []}
+        mock_response.text = "{}"
+
+        with patch(
+            "hermes_cli.config.get_env_value",
+            side_effect=lambda k: "tvly-from-dotenv" if k == "TAVILY_API_KEY" else None,
+        ), patch(
+            "plugins.web.tavily.provider.httpx.post", return_value=mock_response
+        ) as mock_post:
+            from plugins.web.tavily.provider import _tavily_request
+
+            _tavily_request("search", {"query": "q"})
+            headers = mock_post.call_args.kwargs["headers"]
+            assert headers["Authorization"] == "Bearer tvly-from-dotenv"
+            assert headers["X-Client-Name"] == "hermes-agent"
+            assert "X-Tavily-Access-Mode" not in headers
+
 
     def test_get_provider_env_unset_returns_empty(self, monkeypatch):
         monkeypatch.delenv("WSP_TEST_UNSET_KEY", raising=False)
diff --git a/tests/tools/test_web_tools_tavily.py b/tests/tools/test_web_tools_tavily.py
new file mode 100644
index 0000000000..b6fe37c59b
--- /dev/null
+++ b/tests/tools/test_web_tools_tavily.py
@@ -0,0 +1,317 @@
+"""Tests for Tavily web backend integration.
+
+Coverage:
+  _tavily_request() — keyed Bearer vs keyless header, attribution, error bodies.
+  _normalize_tavily_search_results() — search response normalization.
+  _normalize_tavily_documents() — extract response normalization, failed_results.
+  web_search_tool / web_extract_tool — Tavily dispatch paths.
+  auto-detect ranking — keyed paid-band; keyless only when Tavily is selected.
+"""
+
+import json
+import os
+import asyncio
+import pytest
+from unittest.mock import patch, MagicMock
+
+from tests.tools.conftest import register_all_web_providers
+
+
+def _ok_response(payload=None):
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_response.json.return_value = payload if payload is not None else {"results": []}
+    mock_response.text = json.dumps(mock_response.json.return_value)
+    return mock_response
+
+
+# ─── _tavily_request ─────────────────────────────────────────────────────────
+
+class TestTavilyRequest:
+    """Test suite for the _tavily_request helper."""
+
+    def test_keyless_when_no_api_key(self):
+        """No TAVILY_API_KEY → keyless header, no Authorization, no body key."""
+        mock_response = _ok_response()
+
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            with patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response) as mock_post:
+                from plugins.web.tavily.provider import _tavily_request
+                _tavily_request("search", {"query": "test"})
+
+                mock_post.assert_called_once()
+                headers = mock_post.call_args.kwargs["headers"]
+                payload = mock_post.call_args.kwargs["json"]
+                assert headers["X-Client-Name"] == "hermes-agent"
+                assert headers["X-Tavily-Access-Mode"] == "keyless"
+                assert "Authorization" not in headers
+                assert "api_key" not in payload
+                assert payload["query"] == "test"
+                assert "api.tavily.com/search" in mock_post.call_args.args[0]
+
+    def test_keyed_uses_bearer_not_body(self):
+        """TAVILY_API_KEY → Bearer auth, attribution, no body api_key."""
+        mock_response = _ok_response()
+
+        with patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test-key"}):
+            with patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response) as mock_post:
+                from plugins.web.tavily.provider import _tavily_request
+                _tavily_request("search", {"query": "hello"})
+
+                mock_post.assert_called_once()
+                headers = mock_post.call_args.kwargs["headers"]
+                payload = mock_post.call_args.kwargs["json"]
+                assert headers == {
+                    "X-Client-Name": "hermes-agent",
+                    "Authorization": "Bearer tvly-test-key",
+                }
+                assert "X-Tavily-Access-Mode" not in headers
+                assert "api_key" not in payload
+                assert payload["query"] == "hello"
+                assert "api.tavily.com/search" in mock_post.call_args.args[0]
+
+    def test_http_error_surfaces_response_body(self):
+        """Non-2xx responses raise ValueError with Tavily's response body."""
+        mock_response = MagicMock()
+        mock_response.status_code = 429
+        mock_response.text = "Rate limit hit. Sign up for a free API key at https://app.tavily.com"
+        mock_response.json.return_value = {}
+
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            with patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response):
+                from plugins.web.tavily.provider import _tavily_request
+                with pytest.raises(ValueError, match="Rate limit hit"):
+                    _tavily_request("search", {"query": "test"})
+
+
+# ─── _normalize_tavily_search_results ─────────────────────────────────────────
+
+class TestNormalizeTavilySearchResults:
+    """Test search result normalization."""
+
+    def test_basic_normalization(self):
+        from tools.web_tools import _normalize_tavily_search_results
+        raw = {
+            "results": [
+                {"title": "Python Docs", "url": "https://docs.python.org", "content": "Official docs", "score": 0.9},
+                {"title": "Tutorial", "url": "https://example.com", "content": "A tutorial", "score": 0.8},
+            ]
+        }
+        result = _normalize_tavily_search_results(raw)
+        assert result["success"] is True
+        web = result["data"]["web"]
+        assert len(web) == 2
+        assert web[0]["title"] == "Python Docs"
+        assert web[0]["url"] == "https://docs.python.org"
+        assert web[0]["description"] == "Official docs"
+        assert web[0]["position"] == 1
+        assert web[1]["position"] == 2
+
+
+    def test_missing_fields(self):
+        from tools.web_tools import _normalize_tavily_search_results
+        result = _normalize_tavily_search_results({"results": [{}]})
+        web = result["data"]["web"]
+        assert web[0]["title"] == ""
+        assert web[0]["url"] == ""
+        assert web[0]["description"] == ""
+
+
+# ─── _normalize_tavily_documents ──────────────────────────────────────────────
+
+class TestNormalizeTavilyDocuments:
+    """Test extract document normalization."""
+
+    def test_basic_document(self):
+        from tools.web_tools import _normalize_tavily_documents
+        raw = {
+            "results": [{
+                "url": "https://example.com",
+                "title": "Example",
+                "raw_content": "Full page content here",
+            }]
+        }
+        docs = _normalize_tavily_documents(raw)
+        assert len(docs) == 1
+        assert docs[0]["url"] == "https://example.com"
+        assert docs[0]["title"] == "Example"
+        assert docs[0]["content"] == "Full page content here"
+        assert docs[0]["raw_content"] == "Full page content here"
+        assert docs[0]["metadata"]["sourceURL"] == "https://example.com"
+
+
+    def test_fallback_url(self):
+        from tools.web_tools import _normalize_tavily_documents
+        raw = {"results": [{"content": "data"}]}
+        docs = _normalize_tavily_documents(raw, fallback_url="https://fallback.com")
+        assert docs[0]["url"] == "https://fallback.com"
+
+
+# ─── availability / auto-detect ───────────────────────────────────────────────
+
+class TestTavilyAvailability:
+    """Keyed Tavily stays in the paid band; keyless only when selected."""
+
+    def test_is_available_without_key(self):
+        from plugins.web.tavily.provider import TavilyWebSearchProvider
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert TavilyWebSearchProvider().is_available() is False
+
+    def test_is_backend_available_without_key(self):
+        from tools.web_tools import _is_backend_available
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _is_backend_available("tavily") is False
+
+    def test_is_backend_available_when_configured_without_key(self):
+        from tools.web_tools import _is_backend_available
+        with patch("tools.web_tools._load_web_config", return_value={"backend": "tavily"}), \
+             patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _is_backend_available("tavily") is True
+
+    def test_keyless_does_not_preempt_managed_firecrawl(self):
+        """No TAVILY_API_KEY + Nous gateway ready → firecrawl, not keyless tavily."""
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=True), \
+             patch("tools.web_tools._ddgs_package_importable", return_value=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _get_backend() == "firecrawl"
+
+    def test_keyless_does_not_preempt_ddgs(self):
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=False), \
+             patch("tools.web_tools._ddgs_package_importable", return_value=True):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _get_backend() == "ddgs"
+
+    def test_no_keys_defaults_to_firecrawl(self):
+        """Keyless tier disabled: zero-credential resolve hits the legacy
+        firecrawl sentinel. (With the tier on — the default — it resolves
+        to the Exa/Parallel keyless split; see test_web_keyless_fallback.py.)
+        """
+        from tools.web_tools import _get_backend
+        with patch("tools.web_tools._load_web_config", return_value={}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=False), \
+             patch("tools.web_tools._ddgs_package_importable", return_value=False), \
+             patch("tools.web_tools._list_registered_web_providers", return_value=[]), \
+             patch("agent.web_search_registry._keyless_tier_enabled", return_value=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _get_backend() == "firecrawl"
+
+    def test_explicit_search_backend_tavily_without_key(self):
+        """web.search_backend=tavily sticks even with no TAVILY_API_KEY."""
+        from tools.web_tools import _get_search_backend
+        with patch("tools.web_tools._load_web_config",
+                   return_value={"backend": "firecrawl", "search_backend": "tavily"}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=True):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert _get_search_backend() == "tavily"
+
+    def test_check_web_api_key_when_tavily_configured_without_key(self):
+        from tools.web_tools import check_web_api_key
+        with patch("tools.web_tools._load_web_config", return_value={"backend": "tavily"}), \
+             patch("tools.web_tools._is_tool_gateway_ready", return_value=False), \
+             patch("tools.web_tools.check_firecrawl_api_key", return_value=False), \
+             patch("tools.web_tools._ddgs_package_importable", return_value=False), \
+             patch("agent.web_search_registry.get_active_search_provider", return_value=None), \
+             patch("agent.web_search_registry.get_active_extract_provider", return_value=None):
+            os.environ.pop("TAVILY_API_KEY", None)
+            assert check_web_api_key() is True
+
+
+# ─── web_search_tool (Tavily dispatch) ────────────────────────────────────────
+
+class TestWebSearchTavily:
+    """Test web_search_tool dispatch to Tavily."""
+
+    _register_providers = staticmethod(register_all_web_providers)
+
+    @pytest.fixture(autouse=True)
+    def _populate_web_registry(self):
+        self._register_providers()
+        yield
+        from agent.web_search_registry import _reset_for_tests
+        _reset_for_tests()
+
+    def test_search_dispatches_to_tavily(self):
+        mock_response = _ok_response({
+            "results": [{"title": "Result", "url": "https://r.com", "content": "desc", "score": 0.9}]
+        })
+
+        with patch("tools.web_tools._get_backend", return_value="tavily"), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test"}), \
+             patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response), \
+             patch("tools.interrupt.is_interrupted", return_value=False):
+            from tools.web_tools import web_search_tool
+            result = json.loads(web_search_tool("test query", limit=3))
+            assert result["success"] is True
+            assert len(result["data"]["web"]) == 1
+            assert result["data"]["web"][0]["title"] == "Result"
+
+    def test_search_keyless_dispatch(self):
+        """Opt-in keyless Tavily hits Tavily's own endpoint, not the ring."""
+        mock_response = _ok_response({
+            "results": [{"title": "Result", "url": "https://r.com", "content": "desc"}]
+        })
+
+        with patch("tools.web_tools._get_backend", return_value="tavily"), \
+             patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response) as mock_post, \
+             patch("tools.interrupt.is_interrupted", return_value=False):
+            os.environ.pop("TAVILY_API_KEY", None)
+            from tools.web_tools import web_search_tool
+            result = json.loads(web_search_tool("test query"))
+            assert result["success"] is True
+            headers = mock_post.call_args.kwargs["headers"]
+            assert headers["X-Tavily-Access-Mode"] == "keyless"
+            assert headers["X-Client-Name"] == "hermes-agent"
+            assert "Authorization" not in headers
+            assert "api.tavily.com/search" in mock_post.call_args.args[0]
+
+    def test_tavily_is_not_in_keyless_ring(self):
+        from plugins.web.keyless_mcp import _KEYLESS_RING, _KEYLESS_SEARCHERS, _KEYLESS_EXTRACTORS
+        assert "tavily" not in _KEYLESS_RING
+        assert "tavily" not in _KEYLESS_SEARCHERS
+        assert "tavily" not in _KEYLESS_EXTRACTORS
+
+
+# ─── web_extract_tool (Tavily dispatch) ───────────────────────────────────────
+
+class TestWebExtractTavily:
+    """Test web_extract_tool dispatch to Tavily."""
+
+    _register_providers = staticmethod(register_all_web_providers)
+
+    @pytest.fixture(autouse=True)
+    def _populate_web_registry(self):
+        self._register_providers()
+        yield
+        from agent.web_search_registry import _reset_for_tests
+        _reset_for_tests()
+
+    def test_extract_dispatches_to_tavily(self):
+        mock_response = _ok_response({
+            "results": [{"url": "https://example.com", "raw_content": "Extracted content", "title": "Page"}]
+        })
+
+        async def _allow_ssrf(_url: str) -> bool:
+            return True
+
+        with patch("tools.web_tools._get_backend", return_value="tavily"), \
+             patch.dict(os.environ, {"TAVILY_API_KEY": "tvly-test"}), \
+             patch("plugins.web.tavily.provider.httpx.post", return_value=mock_response), \
+             patch("tools.web_tools.async_is_safe_url", _allow_ssrf):
+            from tools.web_tools import web_extract_tool
+            result = json.loads(asyncio.get_event_loop().run_until_complete(
+                web_extract_tool(["https://example.com"])
+            ))
+            assert "results" in result
+            assert len(result["results"]) == 1
+            assert result["results"][0]["url"] == "https://example.com"
+            assert "Extracted content" in result["results"][0]["content"]
diff --git a/tests/tui_gateway/test_bot_relay_methods.py b/tests/tui_gateway/test_bot_relay_methods.py
index fb6d357744..85b18d971a 100644
--- a/tests/tui_gateway/test_bot_relay_methods.py
+++ b/tests/tui_gateway/test_bot_relay_methods.py
@@ -106,6 +106,45 @@ def test_deliver_requires_params(home):
     assert "error" in err
 
 
+def test_deliver_lands_in_live_bot_chat_instead_of_subprocess(home, monkeypatch):
+    """#100523: a Desktop-owned Bot Chat receives the DM as a normal user turn.
+
+    With the target's Bot Chat live in this gateway, the subprocess transport
+    would be fenced out by the single-owner lease and drop the payload. The
+    handler must route through prompt.submit (the composer's choke point) and
+    never spawn the CLI.
+    """
+    spawned = []
+    submitted = []
+    monkeypatch.setattr("subprocess.run", lambda *a, **k: spawned.append(a) or None)
+    monkeypatch.setitem(
+        srv._methods, "prompt.submit", lambda rid, p: submitted.append(p) or srv._ok(rid, {"status": "streaming"})
+    )
+    monkeypatch.setattr(srv, "_profile_home", lambda name: home / "profiles" / name)
+    monkeypatch.setitem(
+        srv._sessions,
+        "live-ops",
+        {"profile_home": str(home / "profiles" / "ops"), "pending_title": "Bot Chat", "history": []},
+    )
+    out = _result(srv._methods["bot_relay.deliver"](1, {"profile": "ops", "message": "ping"}))
+    # queued=True is the invariant: a DM never interrupts a turn in flight.
+    assert submitted == [{"session_id": "live-ops", "text": "ping", "queued": True}]
+    assert not spawned
+    assert "reply" in out
+
+    # A live session titled anything else for the same profile does not qualify:
+    # the subprocess path runs exactly as before.
+    srv._sessions["live-ops"]["pending_title"] = "Scratch"
+    submitted.clear()
+
+    class _Proc:
+        returncode, stdout, stderr = 0, "pong", ""
+
+    monkeypatch.setattr("subprocess.run", lambda *a, **k: spawned.append(a) or _Proc())
+    out = _result(srv._methods["bot_relay.deliver"](2, {"profile": "ops", "message": "ping"}))
+    assert out["reply"] == "pong" and spawned and not submitted
+
+
 def test_reply_roundtrip_and_id_validation(home):
     envelope_id = "c" * 32
     _result(srv._methods["bot_relay.reply"](1, {"id": envelope_id, "reply": "hi"}))
diff --git a/tests/tui_gateway/test_change_watcher.py b/tests/tui_gateway/test_change_watcher.py
index 9c612c555f..1e0d297072 100644
--- a/tests/tui_gateway/test_change_watcher.py
+++ b/tests/tui_gateway/test_change_watcher.py
@@ -64,6 +64,23 @@ def test_state_db_move_broadcasts_sessions_changed(watcher_home):
     assert ("sessions.changed", {}) in events
 
 
+def test_served_profile_store_move_broadcasts_sessions_changed(watcher_home, monkeypatch):
+    """A backend serving a sibling profile must see that profile's state.db
+    move too — otherwise a routed profile's Bot Chat never refreshes (#99333)."""
+    home, events = watcher_home
+    bot_home = home / "profiles" / "bot"
+    bot_home.mkdir(parents=True)
+    monkeypatch.setattr(server, "_served_profile_homes", set())
+    monkeypatch.setattr("hermes_cli.profiles.get_profile_dir", lambda name: home / "profiles" / name)
+    assert server._profile_home("bot") == bot_home
+    server._broadcast_watched_changes(now=0.0)
+
+    (bot_home / "state.db").write_text("x")
+    server._broadcast_watched_changes(now=10.0)
+
+    assert ("sessions.changed", {}) in events
+
+
 def test_gateway_state_move_broadcasts_platforms_changed(watcher_home):
     home, events = watcher_home
     server._broadcast_watched_changes(now=0.0)
diff --git a/tests/tui_gateway/test_compute_host_late_compress_ack.py b/tests/tui_gateway/test_compute_host_late_compress_ack.py
new file mode 100644
index 0000000000..3458ddbd10
--- /dev/null
+++ b/tests/tui_gateway/test_compute_host_late_compress_ack.py
@@ -0,0 +1,235 @@
+"""Regression tests for #97948 symptom A (salvaged from #99630).
+
+A manual /compress on a compute-host session used to block its RPC waiter for
+a hard-coded 120s, return a 5019 timeout error, and then DROP the host's late
+``control.ack`` — so the rotated session_key / history_version / session_info
+never reached the gateway session and the desktop never refreshed.
+"""
+
+import queue
+import sys
+import threading
+import time
+import types
+
+import pytest
+
+from tui_gateway import server
+from tui_gateway.host_supervisor import HostSupervisor
+
+
+def _supervisor() -> tuple[HostSupervisor, list]:
+    sup = HostSupervisor(argv=[sys.executable, "-c", ""], autostart=False)
+    sent: list = []
+    sup._send_frame = lambda frame: sent.append(frame)
+    sup.start = lambda: None  # never spawn a child
+    return sup, sent
+
+
+def _session(**extra) -> dict:
+    return {
+        "agent": types.SimpleNamespace(),
+        "session_key": "old-session-key",
+        "history": [],
+        "history_lock": threading.Lock(),
+        "history_version": 3,
+        "running": False,
+        "attached_images": [],
+        "image_counter": 0,
+        "cols": 80,
+        "slash_worker": None,
+        "show_reasoning": False,
+        "tool_progress_mode": "all",
+        "_compute_host_active": True,
+        **extra,
+    }
+
+
+# ── HostSupervisor: late-ack registration ───────────────────────────────────
+
+
+def test_control_timeout_registers_one_shot_late_ack_handler():
+    sup, sent = _supervisor()
+    fired: list = []
+
+    with pytest.raises(queue.Empty):
+        sup.control("sid", route_name="session.compress", payload={"command": "/compress"},
+                    wait=True, timeout=0.05, on_late_ack=fired.append)
+
+    request_id = sent[0]["request_id"]
+    assert request_id not in sup._pending_controls
+    assert request_id in sup._late_control_handlers
+
+    late = {"type": "control.ack", "request_id": request_id, "result": {"status": "compressed"}}
+    sup._handle_host_frame(late)
+    assert fired == [late]
+    # One-shot: a duplicate ack for the same request is ignored.
+    sup._handle_host_frame(late)
+    assert fired == [late]
+    assert request_id not in sup._late_control_handlers
+
+
+def test_control_timeout_without_handler_still_drops_late_ack():
+    sup, sent = _supervisor()
+    with pytest.raises(queue.Empty):
+        sup.control("sid", route_name="session.compress", wait=True, timeout=0.05)
+    assert sup._late_control_handlers == {}
+    sup._handle_host_frame({"type": "control.ack", "request_id": sent[0]["request_id"]})
+
+
+def test_late_control_error_and_bare_error_frames_fire_handler():
+    sup, sent = _supervisor()
+    fired: list = []
+    for _ in range(2):
+        with pytest.raises(queue.Empty):
+            sup.control("sid", route_name="session.compress", wait=True, timeout=0.01,
+                        on_late_ack=fired.append)
+    rid_a, rid_b = sent[0]["request_id"], sent[1]["request_id"]
+    sup._handle_host_frame({"type": "control.error", "request_id": rid_a, "message": "boom"})
+    sup._handle_host_frame({"type": "error", "request_id": rid_b, "message": "bad frame"})
+    assert [f["request_id"] for f in fired] == [rid_a, rid_b]
+
+
+def test_late_ack_handlers_are_bounded_by_ttl_and_cap(monkeypatch):
+    from tui_gateway import host_supervisor as hs
+
+    monkeypatch.setattr(hs, "_LATE_CONTROL_MAX", 3)
+    sup, _sent = _supervisor()
+    for i in range(5):
+        sup._register_late_control_handler(f"r{i}", lambda _f: None)
+    assert len(sup._late_control_handlers) == 3
+    assert set(sup._late_control_handlers) == {"r2", "r3", "r4"}
+
+    # TTL: an old registration is dropped on the next registration.
+    monkeypatch.setattr(hs, "_LATE_CONTROL_TTL_SECS", 0.0)
+    time.sleep(0.01)
+    sup._register_late_control_handler("fresh", lambda _f: None)
+    assert set(sup._late_control_handlers) == {"fresh"}
+
+
+def test_host_crash_fails_outstanding_late_ack_handlers():
+    sup, sent = _supervisor()
+    fired: list = []
+    with pytest.raises(queue.Empty):
+        sup.control("sid", route_name="session.compress", wait=True, timeout=0.01,
+                    on_late_ack=fired.append)
+    sup._fail_pending_turns(reason="crash", message="compute host exited with code 1")
+    assert len(fired) == 1
+    assert fired[0]["type"] == "control.error"
+    assert fired[0]["request_id"] == sent[0]["request_id"]
+    assert sup._late_control_handlers == {}
+
+
+# ── session.compress RPC: pending answer + late adoption ────────────────────
+
+
+@pytest.fixture
+def compute_host_gateway(monkeypatch):
+    sup, sent = _supervisor()
+    emitted: list = []
+    monkeypatch.setattr(server, "_compute_host_supervisor", sup)
+    monkeypatch.setattr(server, "_emit", lambda event, sid, payload=None: emitted.append((event, sid, payload)))
+    monkeypatch.setattr(server, "_session_uses_compute_host", lambda _s, cfg=None: True)
+    monkeypatch.setattr(server, "_compute_host_compress_wait_seconds", lambda cfg=None: 0.05)
+    monkeypatch.setattr(server, "_session_info", lambda _agent, _session=None: {"model": "mirrored"})
+    session = _session()
+    server._sessions["sid"] = session
+    try:
+        yield sup, sent, emitted, session
+    finally:
+        server._sessions.pop("sid", None)
+
+
+def _late_ack(request_id: str) -> dict:
+    return {
+        "type": "control.ack",
+        "sid": "sid",
+        "request_id": request_id,
+        "route_name": "session.compress",
+        "result": {"status": "compressed", "removed": 12, "summary": {"headline": "Compressed 14 → 2"}},
+        "session_key": "rotated-session-key",
+        "history_version": 9,
+        "message_count": 2,
+        "session_info": {"model": "host-model", "usage": {"total": 111}},
+    }
+
+
+def test_session_compress_reports_pending_and_adopts_late_ack(compute_host_gateway):
+    sup, sent, emitted, session = compute_host_gateway
+
+    resp = server.handle_request({"id": "1", "method": "session.compress", "params": {"session_id": "sid"}})
+
+    assert "error" not in resp, resp
+    assert resp["result"]["status"] == "pending"
+    assert resp["result"]["turn_isolation"] is True
+    assert "background" in resp["result"]["message"]
+    assert sent[0]["route_name"] == "session.compress"
+    # Nothing adopted yet, the host is still working.
+    assert session["session_key"] == "old-session-key"
+    assert emitted == []
+
+    sup._handle_host_frame(_late_ack(sent[0]["request_id"]))
+
+    assert session["session_key"] == "rotated-session-key"
+    assert session["history_version"] == 9
+    assert session["_metadata_message_count"] == 2
+    assert session["_metadata_mirror"]["model"] == "host-model"
+    events = [(event, payload) for event, _sid, payload in emitted]
+    assert ("session.info", {"model": "mirrored"}) in events
+    assert ("status.update", {"kind": "compacted", "text": "✓ Context compression complete"}) in events
+
+
+def test_session_compress_late_control_error_surfaces_as_error_event(compute_host_gateway):
+    sup, sent, emitted, session = compute_host_gateway
+
+    resp = server.handle_request({"id": "1", "method": "session.compress", "params": {"session_id": "sid"}})
+    assert resp["result"]["status"] == "pending"
+
+    sup._handle_host_frame({"type": "control.error", "request_id": sent[0]["request_id"], "message": "provider down"})
+
+    assert session["session_key"] == "old-session-key"
+    assert ("error", "sid", {"message": "compression failed: provider down"}) in emitted
+
+
+def test_session_compress_late_ack_ignored_after_session_closed(compute_host_gateway):
+    sup, sent, emitted, session = compute_host_gateway
+    server.handle_request({"id": "1", "method": "session.compress", "params": {"session_id": "sid"}})
+    server._sessions.pop("sid")
+
+    sup._handle_host_frame(_late_ack(sent[0]["request_id"]))
+
+    assert session["session_key"] == "old-session-key"
+    assert emitted == []
+
+
+def test_slash_compress_route_reports_pending_and_adopts_late_ack(compute_host_gateway):
+    sup, sent, emitted, session = compute_host_gateway
+
+    resp = server.handle_request(
+        {"id": "1", "method": "slash.exec", "params": {"session_id": "sid", "command": "/compress"}}
+    )
+
+    assert "error" not in resp, resp
+    assert "compression still running in the background" in resp["result"]["output"]
+    assert sent[0]["route_name"] == "slash.compress"
+
+    sup._handle_host_frame({**_late_ack(sent[0]["request_id"]), "route_name": "slash.compress"})
+    assert session["session_key"] == "rotated-session-key"
+    assert any(event == "session.info" for event, _sid, _p in emitted)
+
+
+# ── wait budget follows compression.context_total_ceiling_seconds ───────────
+
+
+def test_compress_wait_budget_follows_config_ceiling():
+    assert server._compute_host_compress_wait_seconds({"compression": {}}) == 630.0
+    assert server._compute_host_compress_wait_seconds(
+        {"compression": {"context_total_ceiling_seconds": 200}}
+    ) == 230.0
+    # Never below the historical 120s floor, never above the RPC-safe cap.
+    assert server._compute_host_compress_wait_seconds(
+        {"compression": {"context_total_ceiling_seconds": 10, "context_timeout_seconds": 0}}
+    ) == 120.0
+    assert server._compute_host_compress_wait_seconds(
+        {"compression": {"context_total_ceiling_seconds": 99999}}
+    ) == server._COMPUTE_HOST_COMPRESS_WAIT_CAP_SECS
diff --git a/tests/tui_gateway/test_failed_agent_build_retry.py b/tests/tui_gateway/test_failed_agent_build_retry.py
new file mode 100644
index 0000000000..2d56849d20
--- /dev/null
+++ b/tests/tui_gateway/test_failed_agent_build_retry.py
@@ -0,0 +1,100 @@
+"""A failed agent build must not wedge the session.
+
+The first send with the local server off fails agent init and stores
+``agent_error`` with ``agent_ready`` set. Before the fix, prompt.submit's
+build kick was a no-op on that state (``agent_build_started`` stayed True),
+so every later send — including the error card's Retry — replayed the stored
+failure even after the server came back; only NEW sessions worked. The fix
+routes prompt.submit through ``_restart_completed_failed_agent_build`` first,
+which clears one completed failed generation and rebuilds with fresh
+provider resolution.
+
+These tests pin the restart helper's contract directly: it is the seam the
+prompt path now calls, and its answer decides retry-vs-replay.
+"""
+
+from __future__ import annotations
+
+import threading
+
+from tui_gateway import server
+
+
+def failed_session(tmp_path, sid: str) -> dict:
+    """A session record whose deferred agent build COMPLETED in failure."""
+    ready = threading.Event()
+    ready.set()
+    session = {
+        "agent": None,
+        "agent_ready": ready,
+        "agent_build_started": True,
+        "agent_error": "The local model server is turned off.",
+        "cwd": str(tmp_path),
+        "history": [],
+        "history_lock": threading.RLock(),
+        "profile_home": str(tmp_path),
+        "running": False,
+        "session_key": sid,
+    }
+    server._sessions[sid] = session
+    return session
+
+
+def test_restart_clears_failed_generation_and_rebuilds(tmp_path, monkeypatch):
+    sid = "wedged-session"
+    session = failed_session(tmp_path, sid)
+    failed_ready = session["agent_ready"]
+
+    rebuilt = []
+    monkeypatch.setattr(server, "_start_agent_build",
+                        lambda s, sess: rebuilt.append(s))
+
+    try:
+        assert server._restart_completed_failed_agent_build(
+            sid, session, failed_ready) is True
+
+        # The failed generation is gone: error cleared, fresh unset ready
+        # event, build flag dropped — the next build starts from zero.
+        assert session["agent_error"] is None
+        assert session["agent_ready"] is not failed_ready
+        assert not session["agent_ready"].is_set()
+        assert "agent_build_started" not in session
+        assert rebuilt == [sid]
+    finally:
+        server._sessions.pop(sid, None)
+
+
+def test_restart_declines_every_non_failure_state(tmp_path, monkeypatch):
+    """False (caller falls through to the normal build) when there is no
+    completed failure: healthy agent, build still in flight, or no error."""
+    sid = "healthy-session"
+    session = failed_session(tmp_path, sid)
+    monkeypatch.setattr(server, "_start_agent_build",
+                        lambda s, sess: None)
+
+    try:
+        # Build still in flight: ready not set.
+        in_flight = threading.Event()
+        session["agent_ready"] = in_flight
+        assert server._restart_completed_failed_agent_build(
+            sid, session, in_flight) is False
+
+        # No error recorded.
+        done = threading.Event()
+        done.set()
+        session["agent_ready"] = done
+        session["agent_error"] = None
+        assert server._restart_completed_failed_agent_build(
+            sid, session, done) is False
+
+        # Agent actually built.
+        session["agent_error"] = "stale text"
+        session["agent"] = object()
+        assert server._restart_completed_failed_agent_build(
+            sid, session, done) is False
+
+        # No ready event at all.
+        assert server._restart_completed_failed_agent_build(
+            sid, session, None) is False
+    finally:
+        server._sessions.pop(sid, None)
diff --git a/tests/tui_gateway/test_gui_surface_toolsets.py b/tests/tui_gateway/test_gui_surface_toolsets.py
index b22f04feb0..92463fe453 100644
--- a/tests/tui_gateway/test_gui_surface_toolsets.py
+++ b/tests/tui_gateway/test_gui_surface_toolsets.py
@@ -27,8 +27,8 @@ GUI_TOOLS = {
     "read_window_below",
     "react_to_message",
     "setup_mcp",
-    "tip",
-    "tour",
+    "show_tip",
+    "gui_tour",
 }
 
 
@@ -43,7 +43,13 @@ def no_desktop_env(monkeypatch):
 
 class TestDesktopUiToolset:
     def test_holds_exactly_the_gui_affordances(self):
-        assert set(resolve_toolset("desktop_ui")) == GUI_TOOLS
+        # apply_layout registers into desktop_ui via the registry (not the
+        # static toolsets.py list), so force discovery first — otherwise the
+        # result depends on which earlier test imported tool modules
+        # (pre-existing ordering flake, surfaced by the #97979 test sweep).
+        from tools.registry import discover_builtin_tools
+        discover_builtin_tools()
+        assert set(resolve_toolset("desktop_ui")) == GUI_TOOLS | {"apply_layout"}
 
     def test_stays_off_the_core_tool_list(self):
         """Core ships on every API call — a GUI-only tool must not be there."""
diff --git a/tests/tui_gateway/test_hosted_room_driver_runtime.py b/tests/tui_gateway/test_hosted_room_driver_runtime.py
index ef1cbbc9fe..9b22670151 100644
--- a/tests/tui_gateway/test_hosted_room_driver_runtime.py
+++ b/tests/tui_gateway/test_hosted_room_driver_runtime.py
@@ -492,7 +492,7 @@ def test_waiting_room_does_not_block_an_independent_local_room(tmp_path: Path):
     assert state.get_task(db, identities[0])["status"] == "running"
     _wait_for(lambda: len(runtime.status()["current_tasks"]) == 1)
     assert len(runtime.status()["current_tasks"]) == 1
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_rotated_bounded_scheduler_eventually_runs_later_room(tmp_path: Path):
@@ -537,7 +537,7 @@ def test_rotated_bounded_scheduler_eventually_runs_later_room(tmp_path: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_queued_task_routes_profile_and_credentials_without_overrides(db: Path):
@@ -548,7 +548,7 @@ def test_queued_task_routes_profile_and_credentials_without_overrides(db: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     create = next(params for method, params in rpc.calls if method == "create")
     submit = next(params for method, params in rpc.calls if method == "submit")
@@ -580,7 +580,7 @@ def test_worker_settles_without_any_client_transport(db: Path):
 
     assert runtime.status()["running"] is True
     assert runtime.status()["cycles"] >= 1
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_policy_hooks_prepare_and_publish_terminal_idempotently(db: Path):
@@ -601,7 +601,7 @@ def test_policy_hooks_prepare_and_publish_terminal_idempotently(db: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert prepared
     assert published == [(ROOM_ID, identity.task_id, "settled")]
@@ -630,7 +630,7 @@ def test_transport_resolver_selects_member_transport_without_forking_state(
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert resolutions
     assert all(binding == BINDING for binding, _, _ in resolutions)
@@ -766,7 +766,7 @@ def test_waiting_room_does_not_block_an_independent_room(tmp_path: Path):
     assert waiting.submitted.wait(1.0)
     _wait_for(lambda: state.get_task(db, identities[1])["status"] == "settled")
     assert state.get_task(db, identities[0])["status"] == "running"
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_bounded_scheduler_eventually_runs_later_room(tmp_path: Path):
@@ -812,7 +812,7 @@ def test_bounded_scheduler_eventually_runs_later_room(tmp_path: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_existing_canonical_session_is_resumed_not_duplicated(db: Path):
@@ -824,7 +824,7 @@ def test_existing_canonical_session_is_resumed_not_duplicated(db: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert not [call for call in rpc.calls if call[0] == "create"]
     resume = next(params for method, params in rpc.calls if method == "resume")
@@ -962,13 +962,13 @@ def test_oversized_terminal_reply_is_bounded_without_waiting_for_deadline(db: Pa
     runtime = _runtime(db, rpc, turn_timeout_seconds=30)
 
     runtime.start()
-    assert rpc.submitted.wait(timeout=1.0)
+    assert rpc.submitted.wait(timeout=5.0)
     rpc.complete(
         identity.task_id,
         content="é" * (MAX_TERMINAL_TEXT_BYTES + 100),
     )
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     result = state.get_task(db, identity)["result"]
     assert result["truncated"] is True
@@ -1052,7 +1052,7 @@ def test_turn_deadline_stops_exact_attempt_and_publishes_durable_failure(db: Pat
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "failed")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     failed = state.get_task(db, identity)
     assert failed["result"] == {
@@ -1119,7 +1119,7 @@ def test_deadline_releases_worker_capacity_for_later_room(tmp_path: Path):
     runtime.start()
     _wait_for(lambda: state.get_task(db, identities[0])["status"] == "failed")
     _wait_for(lambda: state.get_task(db, identities[1])["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert state.get_task(db, identities[0])["result"]["reason_code"] == (
         "turn_deadline_exceeded"
@@ -1190,7 +1190,7 @@ def test_retry_ignores_late_receipt_from_prior_execution_generation(db: Path):
     runtime.start()
     assert rpc.submitted.wait(1.0)
     time.sleep(0.04)
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     task = state.get_task(db, identity)
     assert task["status"] == "running"
@@ -1222,7 +1222,7 @@ def test_active_recovered_turn_is_never_resubmitted(db: Path):
 
     runtime.start()
     time.sleep(0.08)
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert state.get_task(db, identity)["status"] == "running"
     assert not [call for call in rpc.calls if call[0] == "submit"]
@@ -1435,7 +1435,7 @@ def test_ambiguous_recovery_remains_indeterminate(db: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "indeterminate")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert not [call for call in rpc.calls if call[0] == "submit"]
 
@@ -1570,7 +1570,7 @@ def test_post_submit_observation_failure_preserves_recoverable_outcome(db: Path)
     rpc.complete(identity.task_id, content="Recovered after a transient read.")
     runtime.wakeup()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     task = state.get_task(db, identity)
     assert task["result"]["text"] == "Recovered after a transient read."
@@ -1595,7 +1595,7 @@ def test_cancellation_is_persisted_before_interrupt_and_fences_late_result(
     rpc.complete(identity.task_id, content="Too late.")
     runtime.wakeup()
     time.sleep(0.05)
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert cancelled["status"] == "cancelled"
     assert observed_status == ["stopping"]
@@ -1628,7 +1628,7 @@ def test_transient_remote_stop_failure_stays_pending_and_retries(db: Path):
     runtime.wakeup()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "cancelled")
     assert attempts >= 2
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
     assert state.get_task(db, identity)["status"] == "cancelled"
 
 
@@ -1777,7 +1777,7 @@ def test_completion_wins_a_race_with_unacknowledged_stop(db: Path):
 
     assert result["status"] == "settled"
     assert result["result"]["text"] == "Already done."
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_restart_harvests_completion_before_retrying_durable_stop(db: Path):
@@ -1836,7 +1836,7 @@ def test_restart_harvests_completion_before_retrying_durable_stop(db: Path):
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     settled = state.get_task(db, identity)
     assert stopping["status"] == "stopping"
@@ -1974,7 +1974,7 @@ def test_pending_local_approval_is_reported_with_safe_choices(db: Path):
     assert member == PROFILE
     assert action["request_id"] == "approval-1"
     assert action["approval"]["choices"] == ["once", "deny"]
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_cancel_never_interrupts_a_newer_task_in_the_same_session(db: Path):
@@ -2001,7 +2001,7 @@ def test_cancel_never_interrupts_a_newer_task_in_the_same_session(db: Path):
     assert all(params["expected_task_id"] == identity.task_id for params in skipped)
     assert rpc.states[session_id]["active"] is True
     assert rpc.states[session_id]["task_id"] == "task-2"
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
 
 def test_status_reports_room_blocked_on_unresolved_indeterminate_task(db: Path):
@@ -2031,7 +2031,7 @@ def test_status_reports_room_blocked_on_unresolved_indeterminate_task(db: Path):
 
     runtime.start()
     _wait_for(lambda: ROOM_ID in runtime.status()["blocked_rooms"])
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert state.get_task(db, identity)["status"] == "indeterminate"
 
@@ -2040,7 +2040,11 @@ def test_authority_loss_stops_terminal_commit(db: Path):
     identity = _identity()
     _admit(db, identity)
     rpc = FakeSessionRPC(auto_complete=False)
-    runtime = _runtime(db, rpc, lease_ttl_seconds=0.1)
+    # Generous lease TTL: this test is about AUTHORITY loss. A short TTL let
+    # a loaded CI runner expire the lease before the authority change was
+    # observed, so last_error flipped to "driver lease is stale or expired"
+    # (flaky main run 33455779041).
+    runtime = _runtime(db, rpc, lease_ttl_seconds=30.0)
 
     runtime.start()
     assert rpc.submitted.wait(1.0)
@@ -2056,7 +2060,7 @@ def test_authority_loss_stops_terminal_commit(db: Path):
     rpc.complete(identity.task_id)
     runtime.wakeup()
     _wait_for(lambda: runtime.status()["last_error"] is not None)
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert state.get_task(db, identity)["status"] == "running"
     assert "authority changed" in runtime.status()["last_error"]
@@ -2071,7 +2075,7 @@ def test_profile_turn_lock_covers_resolve_submit_and_terminal_observation(db: Pa
 
     runtime.start()
     _wait_for(lambda: state.get_task(db, identity)["status"] == "settled")
-    assert runtime.stop(timeout=1.0)
+    assert runtime.stop(timeout=5.0)
 
     assert locks.events == [("lock-enter", PROFILE), ("lock-exit", PROFILE)]
     methods = [method for method, _params in rpc.calls]
diff --git a/tests/tui_gateway/test_hud_surface_note.py b/tests/tui_gateway/test_hud_surface_note.py
index cfb201e2d1..029664b351 100644
--- a/tests/tui_gateway/test_hud_surface_note.py
+++ b/tests/tui_gateway/test_hud_surface_note.py
@@ -117,7 +117,12 @@ class TestTurnRouting:
 
         assert assembled.activated
         assert mcp_name not in names
-        assert server._hud_surface_note(_session(tools=names, client_surface="hud")) == (
+        # Production computes the note from agent.valid_tool_names — the
+        # GRANTED set — not from the visible post-assembly schemas. Under
+        # #97979 the HUD kit (read_window_below, computer_use) is deferred
+        # behind the bridge yet still granted/callable, so the note must
+        # survive assembly unchanged.
+        assert server._hud_surface_note(_session(tools=FULL_KIT, client_surface="hud")) == (
             hud_surface_note(FULL_KIT)
         )
 
diff --git a/tests/tui_gateway/test_projects_rpc.py b/tests/tui_gateway/test_projects_rpc.py
index 1cd5a320c2..f2faa74262 100644
--- a/tests/tui_gateway/test_projects_rpc.py
+++ b/tests/tui_gateway/test_projects_rpc.py
@@ -763,11 +763,13 @@ def test_projects_reads_are_scoped_to_the_requested_profile(monkeypatch, tmp_pat
     assert coder_tree["projects"][0]["sessionCount"] == 1
     assert launch_tree["scoped_session_ids"] == ["launch-session"]
     assert coder_tree["scoped_session_ids"] == ["coder-session"]
+    assert [s["profile"] for s in coder_tree["projects"][0]["previewSessions"]] == ["coder"]
 
     assert coder_sessions["project"]["id"] == coder_project["id"]
     assert coder_sessions["project"]["sessionCount"] == 1
     lane = coder_sessions["project"]["repos"][0]["groups"][0]
     assert [s["id"] for s in lane["sessions"]] == ["coder-session"]
+    assert [s["profile"] for s in lane["sessions"]] == ["coder"]
 
 
 def test_projects_tree_is_scoped_to_the_requested_profile(monkeypatch, tmp_path):
diff --git a/tests/tui_gateway/test_protocol.py b/tests/tui_gateway/test_protocol.py
index 774f70437d..5412f333a8 100644
--- a/tests/tui_gateway/test_protocol.py
+++ b/tests/tui_gateway/test_protocol.py
@@ -806,6 +806,122 @@ def test_session_resume_rejects_runaway_transcript_before_history_load(
     assert "safe resume limit is 20000" in response["error"]["message"]
 
 
+def test_session_resume_deferred_and_omitted_paths_guard_the_tip_only(server, monkeypatch):
+    """A deep compression lineage behind a small tip must open on Desktop.
+
+    Desktop's cold resume sends ``defer_history`` + ``omit_messages`` and pages
+    the transcript over REST, so the process only ever holds the tip segment.
+    Counting the whole lineage there returned 4130 for the healthiest sessions
+    (85 compaction segments / ~29k rows / ~700-row tip: Bot Chat stuck on
+    "Waking up…"). The guard must count what each path loads.
+    """
+    calls = []
+
+    class _DB:
+        def get_session(self, sid):
+            return {"id": sid, "message_count": 28_730}
+
+        def get_session_by_title(self, _title):
+            return None
+
+        def resolve_resume_session_id(self, sid):
+            return sid
+
+        def assert_resume_safe(self, sid, max_messages=None, *, tip_only=False):
+            calls.append(tip_only)
+            if not tip_only:
+                from hermes_state import SessionResumeTooLargeError
+
+                raise SessionResumeTooLargeError(20_001, 20_000)
+            return 666
+
+        def reopen_session(self, _sid):
+            raise RuntimeError("stop before history load")
+
+    monkeypatch.setattr(server, "_get_db", lambda: _DB())
+    monkeypatch.setattr(server, "_enable_gateway_prompts", lambda: None)
+
+    for params in (
+        {"defer_history": True, "omit_messages": True, "source": "desktop"},
+        {"omit_messages": True},
+        {"lazy": True},
+    ):
+        calls.clear()
+        response = server.handle_request(
+            {
+                "id": "r-tip",
+                "method": "session.resume",
+                "params": {"session_id": "deep-lineage", **params},
+            }
+        )
+        err = response.get("error") or {}
+        assert err.get("code") != 4130, params
+        assert calls == [True], params
+
+    # The non-deferred, non-omitted resume materializes the full lineage in
+    # memory, so it keeps the lineage-wide bound.
+    calls.clear()
+    response = server.handle_request(
+        {"id": "r-full", "method": "session.resume", "params": {"session_id": "deep-lineage"}}
+    )
+    assert response["error"]["code"] == 4130
+    assert calls == [False]
+
+
+def test_deferred_hydration_falls_back_to_tip_when_lineage_exceeds_limit(server, monkeypatch):
+    """The hydration worker never loads a lineage the guard would refuse."""
+    import threading
+
+    from hermes_state import SessionResumeTooLargeError
+
+    tip = [{"role": "user", "content": "tip"}]
+    reads = []
+
+    class _DB:
+        def reopen_session(self, _sid):
+            return True
+
+        def assert_resume_safe(self, sid, max_messages=None, *, tip_only=False):
+            if not tip_only:
+                raise SessionResumeTooLargeError(20_001, 20_000)
+            return 1
+
+        def get_resume_conversations(self, _sid):
+            reads.append("lineage")
+            raise AssertionError("must not materialize the runaway lineage")
+
+        def get_ancestor_display_prefix(self, _sid):
+            reads.append("prefix")
+            raise AssertionError("must not materialize the runaway lineage")
+
+        def get_messages_as_conversation(self, sid, **kwargs):
+            reads.append(("tip", kwargs.get("repair_alternation")))
+            return list(tip)
+
+    built = threading.Event()
+    monkeypatch.setattr(server, "_start_agent_build", lambda _sid, _session: built.set())
+    monkeypatch.setattr(server, "_maybe_schedule_auto_continue", lambda *_a, **_k: None)
+
+    session = server._deferred_session_record(
+        "deep-lineage", cols=80, cwd="/tmp", history=[], lease=None
+    )
+    session["resume_history_ready"] = threading.Event()
+    session["resume_hydrating"] = True
+    session["resume_message_count"] = 28_730
+    server._sessions["hyd"] = session
+    try:
+        server._schedule_resume_hydration("hyd", "deep-lineage", _DB())
+        assert session["resume_history_ready"].wait(timeout=5)
+        assert built.wait(timeout=5)
+        assert session.get("resume_history_error") is None
+        assert session["history"] == tip
+        assert session["display_history_prefix"] == []
+        assert session["resume_message_count"] == 1
+        assert reads == [("tip", True)]
+    finally:
+        server._sessions.pop("hyd", None)
+
+
 def test_session_resume_guard_failure_fails_open(server, monkeypatch):
     """A transient guard error must not block resume (fail open, log only)."""
     reopened = []
diff --git a/tests/tui_gateway/test_resume_live_profile_scope.py b/tests/tui_gateway/test_resume_live_profile_scope.py
new file mode 100644
index 0000000000..f6fd13d84c
--- /dev/null
+++ b/tests/tui_gateway/test_resume_live_profile_scope.py
@@ -0,0 +1,108 @@
+"""``session.resume`` reuses a live session only within the requested profile.
+
+The live registry is keyed by bare stored session id, and stored ids are
+timestamp-based, so the same id can legitimately be live under profile A while
+profile B's store also holds it. The resume fast path (and the post-build
+re-check / ``_claim_or_reuse_live``) used to hand profile B's resume profile
+A's runtime — the turn then ran with A's persona and wrote A's memory
+(#100029). Pinned here:
+
+* resume with profile B never reuses profile A's live session of the same id;
+* the launch profile (no ``profile``) still matches live records that carry
+  no ``profile_home`` — the pre-existing single-profile contract.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from tui_gateway import server
+
+
+class _DB:
+    """Minimal ``SessionDB`` stand-in: every profile store knows ``s1``."""
+
+    def __init__(self, db_path=None, **_kwargs):
+        self.db_path = db_path
+
+    def close(self):
+        pass
+
+    def get_session(self, target):
+        return {"id": "s1", "cwd": ""} if target == "s1" else None
+
+    def get_session_by_title(self, _target):
+        return None
+
+    def resolve_resume_session_id(self, target):
+        return target
+
+    def reopen_session(self, _target):
+        pass
+
+    def get_resume_conversations(self, _target):
+        return ([], [])
+
+    def get_ancestor_display_prefix(self, _target):
+        return []
+
+    def get_messages_as_conversation(self, _target, **_kwargs):
+        return []
+
+
+@pytest.fixture()
+def homes(monkeypatch, tmp_path):
+    homes = {name: tmp_path / name for name in ("a", "b")}
+    for home in homes.values():
+        home.mkdir()
+    monkeypatch.setattr("hermes_state.get_shared_session_db", _DB)
+    monkeypatch.setattr(server, "_get_db", lambda: _DB())
+    monkeypatch.setattr(server, "_profile_home", lambda p: homes.get(p) if p else None)
+    monkeypatch.setattr(server, "_profile_configured_cwd", lambda _home: str(tmp_path))
+    monkeypatch.setattr(server, "_enable_gateway_prompts", lambda: None)
+    monkeypatch.setattr(server, "_schedule_agent_build", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_schedule_session_cap_enforcement", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_maybe_schedule_auto_continue", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_default_session_cwd", lambda *a, **k: str(tmp_path))
+    monkeypatch.setattr(server, "_child_run_active", lambda _key: False)
+    monkeypatch.setattr(
+        server, "_live_session_payload", lambda sid, session, **_k: {"session_id": sid}
+    )
+    known = set(server._sessions)
+    yield homes
+    with server._sessions_lock:
+        for sid in [s for s in server._sessions if s not in known]:
+            server._sessions.pop(sid, None)
+
+
+def _resume(**params):
+    return server.handle_request({"id": "1", "method": "session.resume", "params": params})
+
+
+def _register_live(sid: str, profile_home) -> dict:
+    record = {"session_key": "s1", "history": [], "last_active": 0.0}
+    if profile_home is not None:
+        record["profile_home"] = str(profile_home)
+    with server._sessions_lock:
+        server._sessions[sid] = record
+    return record
+
+
+def test_resume_with_other_profile_never_reuses_live_session(homes):
+    _register_live("live-a", homes["a"])
+
+    same = _resume(session_id="s1", profile="a", source="desktop")
+    assert same["result"]["session_id"] == "live-a"
+
+    other = _resume(session_id="s1", profile="b", source="desktop")
+    new_sid = other["result"]["session_id"]
+    assert new_sid != "live-a"
+    assert server._sessions[new_sid]["profile_home"] == str(homes["b"])
+
+
+def test_launch_profile_still_matches_records_without_profile_home(homes):
+    _register_live("live-launch", None)
+    _register_live("live-a", homes["a"])
+
+    assert _resume(session_id="s1", source="desktop")["result"]["session_id"] == "live-launch"
+    assert _resume(session_id="s1", profile="a", source="desktop")["result"]["session_id"] == "live-a"
diff --git a/tests/tui_gateway/test_session_resume_db_ownership.py b/tests/tui_gateway/test_session_resume_db_ownership.py
index 29f050ec30..3e4aa9cbfb 100644
--- a/tests/tui_gateway/test_session_resume_db_ownership.py
+++ b/tests/tui_gateway/test_session_resume_db_ownership.py
@@ -98,7 +98,7 @@ def profile_dbs(monkeypatch, tmp_path):
     # The handler builds nothing on the paths under test; keep it hermetic and
     # off the real agent/secret/HERMES_HOME machinery.
     monkeypatch.setattr(server, "_enable_gateway_prompts", lambda: None)
-    monkeypatch.setattr(server, "_find_live_session_by_key", lambda _key: None)
+    monkeypatch.setattr(server, "_find_live_session_by_key", lambda _key, *_a: None)
     monkeypatch.setattr(server, "_schedule_agent_build", lambda *a, **k: None)
     monkeypatch.setattr(server, "_schedule_session_cap_enforcement", lambda *a, **k: None)
     monkeypatch.setattr(server, "_maybe_schedule_auto_continue", lambda *a, **k: None)
@@ -196,7 +196,7 @@ def test_resume_closes_profile_db_on_live_session_fast_path(profile_dbs, monkeyp
     monkeypatch.setattr(
         server,
         "_find_live_session_by_key",
-        lambda _key: ("live-sid", live_session),
+        lambda _key, *_a: ("live-sid", live_session),
     )
     monkeypatch.setattr(
         server,
diff --git a/tests/tui_gateway/test_turn_finished_failure_cause.py b/tests/tui_gateway/test_turn_finished_failure_cause.py
new file mode 100644
index 0000000000..307b89a020
--- /dev/null
+++ b/tests/tui_gateway/test_turn_finished_failure_cause.py
@@ -0,0 +1,385 @@
+"""A failed TUI turn must say why in its own record (#89117).
+
+#89117 is a report made entirely of two log lines::
+
+    tui_turn finished: ui_session=0dfcee58 status=error error_retained=True duration=0.9s
+    tui_turn finished: ui_session=093285e9 status=error error_retained=True duration=0.9s
+
+That is the whole evidence, and it is not enough to act on: a provider 4xx, a
+budget wall, a billing block and a crashed finalizer all produce exactly those
+characters. The bookend was added by #86865 to trace compression rotations, so
+it carries identities and a coarse status by design — but it is also the *only*
+record the returned-error path writes. A sub-second failure almost always takes
+that path (the provider rejected the request before any work happened), so the
+quietest failures are precisely the ones with nothing to read. The exception
+path at least prints ``[gateway-turn] <Type>: <msg>`` to stderr.
+
+These tests pin the cause into the record on both failure paths, and pin the
+content discipline #86865 established while doing it: prompts are never logged,
+and the provider's message is redacted and length-capped, because a 4xx body
+can quote the request that produced it.
+"""
+
+from __future__ import annotations
+
+import logging
+import threading
+import types
+
+import pytest
+
+from tui_gateway import server
+
+
+class _InlineThread:
+    """Run the turn synchronously so tests observe its final state."""
+
+    def __init__(self, target=None, daemon=None, args=(), kwargs=None):
+        self._target = target
+        self._args = args
+        self._kwargs = kwargs or {}
+
+    def start(self):
+        if self._target is not None:
+            self._target(*self._args, **self._kwargs)
+
+    def is_alive(self):
+        return False
+
+    def join(self, timeout=None):
+        return None
+
+
+def _session(agent=None, **extra):
+    return {
+        "agent": agent if agent is not None else types.SimpleNamespace(),
+        "session_key": "gw-session-key",
+        "history": [],
+        "history_lock": threading.Lock(),
+        "history_version": 0,
+        "running": True,
+        "attached_images": [],
+        "image_counter": 0,
+        "cols": 80,
+        "slash_worker": None,
+        "show_reasoning": False,
+        "tool_progress_mode": "all",
+        "inflight_turn": None,
+        **extra,
+    }
+
+
+@pytest.fixture()
+def turn_env(monkeypatch, tmp_path):
+    """Neutralize the turn pipeline's environment-heavy side paths."""
+    monkeypatch.setattr(server.threading, "Thread", _InlineThread)
+    monkeypatch.setattr(server, "_emit", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_wire_callbacks", lambda sid: None)
+    monkeypatch.setattr(server, "_sync_agent_model_with_config", lambda sid, session: None)
+    monkeypatch.setattr(server, "_session_cwd", lambda session: str(tmp_path))
+    monkeypatch.setattr(server, "_register_session_cwd", lambda session: None)
+    monkeypatch.setattr(server, "_tts_stream_begin", lambda: None)
+    monkeypatch.setattr(server, "_sync_session_key_after_compress", lambda *a, **k: None)
+    monkeypatch.setattr(server, "_get_usage", lambda agent: {})
+
+
+def _finished(caplog):
+    records = [r for r in caplog.records if "tui turn finished" in r.getMessage()]
+    assert len(records) == 1, f"expected exactly one bookend, got {len(records)}"
+    return records[0].getMessage()
+
+
+def _run(session, prompt="go"):
+    server._run_prompt_submit("rid", "ui-sid", session, prompt)
+
+
+def _agent_returning(result):
+    return types.SimpleNamespace(
+        session_id="agent-sid-1",
+        run_conversation=lambda *a, **k: result,
+        clear_interrupt=lambda: None,
+    )
+
+
+class TestTheReportedRecordNowNamesItsCause:
+
+    def test_returned_error_carries_the_provider_message(self, turn_env, caplog):
+        """The reporter's exact line shape, with the missing half filled in."""
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": "Error code: 402 - {'error': {'message': 'insufficient credits'}}",
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert "status=error" in msg
+        assert "error_retained=True" in msg
+        assert "insufficient credits" in msg, (
+            "a record that says only status=error is what #89117 is about"
+        )
+
+    def test_structured_failure_reason_is_logged_when_present(self, turn_env, caplog):
+        """The billing wall already ships a machine-readable reason; use it.
+
+        ``failure_reason`` is the field the client renders a billing-specific
+        recovery surface from, so it is the one field guaranteed to be stable
+        enough to grep a log for across releases.
+        """
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": "payment required",
+            "failure_reason": "billing_wall",
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        assert "failure_reason=billing_wall" in _finished(caplog)
+
+    def test_exception_path_carries_the_exception(self, turn_env, caplog):
+        """The other failure path, so one grep covers both."""
+        def _boom(*a, **k):
+            raise RuntimeError("connection reset mid-stream")
+
+        session = _session(agent=types.SimpleNamespace(
+            session_id="agent-sid-1",
+            run_conversation=_boom,
+            clear_interrupt=lambda: None,
+        ))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert "status=error" in msg
+        assert "failure_reason=RuntimeError" in msg
+        assert "connection reset mid-stream" in msg
+
+    def test_successful_turn_stays_exactly_as_it_was(self, turn_env, caplog):
+        """No cost to the common case: a clean turn gains no new fields."""
+        session = _session(agent=_agent_returning({"final_response": "done"}))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert "status=complete" in msg
+        assert "cause=" not in msg
+        assert "failure_reason=" not in msg
+
+
+class TestContentDiscipline:
+    """#86865's rule — the record logs identities, never content."""
+
+    SECRETISH_PROMPT = "please rotate QDRANT_API_KEY=hunter2-super-secret now"
+
+    def test_prompt_is_never_logged_even_when_the_turn_fails(self, turn_env, caplog):
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": "provider rejected the request",
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session, self.SECRETISH_PROMPT)
+
+        msg = _finished(caplog)
+        assert "hunter2" not in msg
+        assert "QDRANT_API_KEY" not in msg
+
+    def test_secrets_echoed_back_by_the_provider_are_redacted(self, turn_env, caplog):
+        """The load-bearing safety test.
+
+        A 4xx body frequently quotes the request. Without redaction, adding the
+        cause to a log record would take a header the user never chose to log
+        and write it to disk — turning a diagnostics improvement into a secret
+        leak. This is why the cause goes through ``redact_sensitive_text`` and
+        not ``str()``.
+        """
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": (
+                "400 from provider; request headers were "
+                "Authorization: Bearer sk-proj-abcdefghijklmnopqrstuvwxyz0123456789"
+            ),
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert "sk-proj-abcdefghijklmnopqrstuvwxyz0123456789" not in msg
+        # The diagnostic value survives the redaction — this is the point.
+        assert "400 from provider" in msg
+
+    SENTINEL = "the marmalade inventory for Q3 was discontinued in March"
+
+    def test_a_prompt_the_provider_quotes_back_does_not_reach_the_record(
+        self, turn_env, caplog
+    ):
+        """Secret redaction is not prompt omission, and this is the difference.
+
+        A provider that rejects a request routinely quotes it back. The quoted
+        material is the user's own prose: it matches no credential pattern, so
+        ``redact_sensitive_text`` passes it through untouched, and adding the
+        cause to this record would newly persist user content that #86865
+        deliberately kept out of it. The sentinel here is deliberately benign
+        for that reason: nothing about it looks like a secret.
+        """
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": (
+                "400 Bad Request from provider: messages[0].content was "
+                "rejected: '" + self.SENTINEL + "'"
+            ),
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session, "Summarise this: " + self.SENTINEL)
+
+        msg = _finished(caplog)
+        assert self.SENTINEL not in msg
+        assert "marmalade" not in msg
+        assert "<prompt>" in msg, "the removal should be visible, not silent"
+        # The whole point of the cause survives the removal.
+        assert "400 Bad Request from provider" in msg
+
+    def test_a_provider_message_that_shares_nothing_is_untouched(
+        self, turn_env, caplog
+    ):
+        """The echo strip must not eat diagnostics that merely sit near a prompt."""
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": "429 rate limited; retry after 30s",
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session, "Summarise this: " + self.SENTINEL)
+
+        msg = _finished(caplog)
+        assert "429 rate limited; retry after 30s" in msg
+        assert "<prompt>" not in msg
+
+    def test_a_huge_provider_body_cannot_flood_the_log(self, turn_env, caplog):
+        """An HTML error page or a full request echo is a log-volume problem."""
+        session = _session(agent=_agent_returning({
+            "final_response": "",
+            "error": "upstream said: " + ("x" * 9000),
+            "failed": True,
+        }))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert len(msg) < 700
+        assert "upstream said" in msg
+        assert "…" in msg, "truncation should be visible, not silent"
+
+    def test_a_multiline_traceback_stays_one_record(self, turn_env, caplog):
+        """One accepted prompt, one finished record — including its cause.
+
+        A cause spanning lines would break every log pipeline that treats the
+        bookend as a single greppable line, which is the only reason it is
+        useful for an intermittent bug like this one.
+        """
+        def _boom(*a, **k):
+            raise RuntimeError("first line\nsecond line\n\tthird")
+
+        session = _session(agent=types.SimpleNamespace(
+            session_id="agent-sid-1",
+            run_conversation=_boom,
+            clear_interrupt=lambda: None,
+        ))
+
+        with caplog.at_level(logging.INFO, logger="tui_gateway.server"):
+            _run(session)
+
+        msg = _finished(caplog)
+        assert "\n" not in msg
+        assert "first line second line third" in msg
+
+
+class TestDetailHelperDirectly:
+    """``_turn_failure_detail`` in isolation — the branches the paths can't reach."""
+
+    def test_nothing_to_say_produces_nothing(self):
+        assert server._turn_failure_detail("", None) == ""
+        assert server._turn_failure_detail(None) == ""
+
+    def test_fragment_carries_its_own_leading_space(self):
+        """The bookend appends it unconditionally, so it must self-format."""
+        out = server._turn_failure_detail("boom")
+        assert out.startswith(" ")
+
+    def test_an_exception_with_no_message_still_names_its_type(self):
+        assert "KeyError" in server._turn_failure_detail(KeyError())
+
+    def test_the_prompt_argument_is_optional(self):
+        """Callers without a prompt in scope still get the secret contract."""
+        out = server._turn_failure_detail("Bearer sk-proj-supersecretvalue1234")
+        assert "supersecretvalue1234" not in out
+
+    def test_a_broken_redactor_fails_closed(self, monkeypatch):
+        """If redaction cannot run, the raw message must not reach the log.
+
+        Failing open here would be worse than logging nothing: the whole reason
+        the cause is safe to log is that it went through the redactor.
+        """
+        import agent.redact
+
+        def _explode(*a, **k):
+            raise RuntimeError("redactor unavailable")
+
+        monkeypatch.setattr(agent.redact, "redact_sensitive_text", _explode)
+
+        out = server._turn_failure_detail("Bearer sk-proj-supersecretvalue")
+        assert "supersecretvalue" not in out
+        assert "unredactable" in out
+
+
+class TestPromptEchoStripping:
+    """``_strip_prompt_echo`` in isolation: the boundaries of the guarantee."""
+
+    def test_an_overlap_below_the_window_is_not_an_echo(self):
+        """Short shared phrases are coincidence, and eating them costs detail."""
+        out = server._strip_prompt_echo("400: invalid model", "invalid model")
+        assert out == "400: invalid model"
+
+    def test_a_json_escaped_echo_is_stripped_too(self):
+        """A provider handing back its own request body often hands it escaped."""
+        prompt = "please summarise the Q3 marmalade inventory memo for me"
+        message = 'upstream body: {"messages": [{"content": "' + prompt + '"}]}'
+        out = server._strip_prompt_echo(message, prompt)
+        assert "marmalade" not in out
+        assert "<prompt>" in out
+
+    def test_an_echo_is_removed_before_the_length_cap_applies(self):
+        """A quote must not survive by starting inside the kept prefix."""
+        prompt = "the confidential merger memorandum for the northern division"
+        error = ("x" * 200) + " echoed request: " + prompt
+        out = server._turn_failure_detail(error, None, prompt)
+        assert "merger memorandum" not in out
+        assert "confidential" not in out
+
+    def test_a_prompt_shorter_than_the_window_cannot_blank_the_message(self):
+        """A one-word prompt must not turn every message into <prompt>."""
+        out = server._strip_prompt_echo("provider said no", "hi")
+        assert out == "provider said no"
+
+    def test_whitespace_shape_does_not_hide_an_echo(self):
+        """Both sides are collapsed, so a re-wrapped quote still matches."""
+        prompt = "the marmalade inventory for Q3 was discontinued in March"
+        error = (
+            "rejected:    the marmalade inventory\n"
+            " for Q3 was discontinued in March"
+        )
+        out = server._turn_failure_detail(error, None, prompt)
+        assert "marmalade" not in out
diff --git a/tools/annotate_preview_tool.py b/tools/annotate_preview_tool.py
index eebe33ed5f..1b709d0134 100644
--- a/tools/annotate_preview_tool.py
+++ b/tools/annotate_preview_tool.py
@@ -89,7 +89,7 @@ def annotate_preview_tool(
 ANNOTATE_PREVIEW_SCHEMA = {
     "name": "annotate_preview",
     "description": (
-        "Leave a LASTING mark on the preview-pane page (drive_preview's own "
+        "Highlight elements on the preview-pane page, lastingly (drive_preview's own "
         "marks fade; annotations stay until removed) — point at findings, "
         "flag what you're about to change, keep your place. Use the refs "
         "from drive_preview action='elements'. add: outline one element "
diff --git a/tools/bot_mode_dm.py b/tools/bot_mode_dm.py
index 77da3d5015..cde6eec992 100644
--- a/tools/bot_mode_dm.py
+++ b/tools/bot_mode_dm.py
@@ -609,6 +609,17 @@ def _run_delivery(argv: list[str], dm_file: str, *, stdin_file: bool) -> int:
                     )
             # Re-emit the transport's streams: stdout is the reply text the
             # completion notification carries back to the sending agent.
+            if proc.returncode != 0 and "already has a live owner" in (proc.stderr or ""):
+                # #100523: the target's Bot Chat is held live by another
+                # surface (Desktop). The turn never ran, so tell the sender
+                # plainly instead of leaking a raw lease error + exit code.
+                who = argv[argv.index("-p") + 1] if "-p" in argv[:-1] else "the teammate"
+                print(json.dumps({
+                    "error": f"Delivery failed: @{who}'s Bot Chat is open on another "
+                             "surface right now, so your message was NOT delivered. Try again later.",
+                    "reason": "target_busy",
+                }))
+                return 1
             if proc.stdout:
                 sys.stdout.write(proc.stdout)
                 sys.stdout.flush()
diff --git a/tools/bot_relay.py b/tools/bot_relay.py
index 08c6d3b044..bc74a5952e 100644
--- a/tools/bot_relay.py
+++ b/tools/bot_relay.py
@@ -524,7 +524,10 @@ def waiter_command(root: Path | str, envelope: dict) -> str:
         "        print('Reply from ' + label + ':')\n"
         "        print(d.get('reply') or '(empty reply)')\n"
         "        sys.exit(0)\n"
-        "    time.sleep(2)\n"
+        # 250ms cadence: the reply file is written once by the target
+        # gateway's deliver path; a 2s sleep here added up to 2s of dead
+        # air to every cross-machine reply for no benefit (stat is cheap).
+        "    time.sleep(0.25)\n"
         f"print('No reply from ' + label + ' within {REPLY_WAIT_SECONDS}s. The message may "
         "still be delivered when the Desktop reconnects; do not resend blindly.')\n"
         "sys.exit(1)\n"
diff --git a/tools/browser_tool.py b/tools/browser_tool.py
index 87337b0c19..ada55426d2 100644
--- a/tools/browser_tool.py
+++ b/tools/browser_tool.py
@@ -50,6 +50,7 @@ Usage:
 """
 
 import atexit
+import contextlib
 import functools
 import json
 import logging
@@ -72,6 +73,8 @@ from hermes_constants import (
     get_hermes_home_override,
     hermes_home_key,
     node_tool_runnable,
+    reset_hermes_home_override,
+    set_hermes_home_override,
 )
 from utils import env_int, is_truthy_value
 from hermes_cli.config import DEFAULT_CONFIG, cfg_get
@@ -1032,7 +1035,11 @@ def _is_local_backend() -> bool:
         return False
     # When terminal runs in a container, browser on host can access
     # internal networks the terminal can't → treat as non-local.
-    terminal_backend = os.getenv("TERMINAL_ENV", "local").strip().lower()
+    # Scope-aware: under gateway multiplexing the routed profile's backend
+    # lives in the per-turn terminal scope, not the process env (#68559).
+    from tools.terminal_scope import terminal_env
+
+    terminal_backend = terminal_env("TERMINAL_ENV", "local").strip().lower()
     return terminal_backend in ("local", "")
 
 
@@ -2191,6 +2198,16 @@ BROWSER_ORPHAN_GRACE_SECONDS = max(3600, BROWSER_SESSION_INACTIVITY_TIMEOUT * 20
 
 # Track last activity time per session
 _session_last_activity: Dict[str, float] = {}
+# Owner Hermes home per session (#86402).  The inactivity janitor is one
+# process-global thread started by whichever profile first opens a browser,
+# so it has no profile scope of its own; under multiplexing every cleanup
+# must re-enter the *owning* profile's scope (copy_context at spawn would pin
+# the first profile's secrets onto every other profile's teardown).
+_session_owner_homes: Dict[str, str] = {}
+# Consecutive janitor cleanup failures per session; after
+# MAX_INACTIVITY_CLEANUP_FAILURES the session is force-reaped (#100738).
+_cleanup_failures: Dict[str, int] = {}
+MAX_INACTIVITY_CLEANUP_FAILURES = 3
 
 # Session keys flagged suspect after a command timeout (#72205 / #85125 3b).
 # Written by _BrowserSessionBackend.mark_suspect (cheap, lock-free — a single
@@ -2334,6 +2351,8 @@ def _emergency_cleanup_all_sessions():
             with _cleanup_lock:
                 _active_sessions.clear()
                 _session_last_activity.clear()
+                _session_owner_homes.clear()
+                _cleanup_failures.clear()
                 _recording_sessions.clear()
 
     # Lightpanda servers (Browser Use mode) are processes we spawned; the
@@ -2368,6 +2387,41 @@ atexit.register(_emergency_cleanup_all_sessions)
 # Inactivity Cleanup Functions
 # =============================================================================
 
+@contextlib.contextmanager
+def _session_owner_scope(task_id: str):
+    """Run under the Hermes home + secret scope that owns ``task_id``'s
+    browser session (recorded by ``_update_session_activity``).
+
+    No-op when no owner was recorded.  Mirrors
+    ``gateway.run._profile_runtime_scope`` — the janitor thread is
+    process-global, so each session's teardown must re-enter its OWN
+    profile's scope rather than inherit whichever profile spawned the
+    thread; never falls through to ``os.environ``.
+    """
+    owner_home = _session_owner_homes.get(task_id)
+    if owner_home is None:
+        yield
+        return
+
+    from agent.secret_scope import (
+        build_profile_secret_scope,
+        reset_secret_scope,
+        set_secret_scope,
+    )
+    from hermes_cli.env_loader import hydrate_profile_secret_sources
+
+    home_token = set_hermes_home_override(owner_home)
+    try:
+        hydrate_profile_secret_sources(Path(owner_home))
+        secret_token = set_secret_scope(build_profile_secret_scope(Path(owner_home)))
+        try:
+            yield
+        finally:
+            reset_secret_scope(secret_token)
+    finally:
+        reset_hermes_home_override(home_token)
+
+
 def _cleanup_inactive_browser_sessions():
     """
     Clean up browser sessions that have been inactive for longer than the timeout.
@@ -2375,6 +2429,11 @@ def _cleanup_inactive_browser_sessions():
     This function is called periodically by the background cleanup thread to
     automatically close sessions that haven't been used recently, preventing
     orphaned sessions (local or Browserbase) from accumulating.
+
+    Each session is torn down under its owner profile's scope (#86402).  A
+    session whose cleanup keeps failing is force-reaped after
+    ``MAX_INACTIVITY_CLEANUP_FAILURES`` attempts instead of retrying forever
+    (#100738); only a successful cleanup clears its failure count.
     """
     current_time = time.time()
     sessions_to_cleanup = []
@@ -2385,15 +2444,33 @@ def _cleanup_inactive_browser_sessions():
                 sessions_to_cleanup.append(task_id)
 
     for task_id in sessions_to_cleanup:
+        elapsed = int(current_time - _session_last_activity.get(task_id, current_time))
+        logger.info("Cleaning up inactive session for task: %s (inactive for %ss)", task_id, elapsed)
         try:
-            elapsed = int(current_time - _session_last_activity.get(task_id, current_time))
-            logger.info("Cleaning up inactive session for task: %s (inactive for %ss)", task_id, elapsed)
-            cleanup_browser(task_id)
+            with _session_owner_scope(task_id):
+                cleanup_browser(task_id)
             with _cleanup_lock:
-                if task_id in _session_last_activity:
-                    del _session_last_activity[task_id]
+                _session_last_activity.pop(task_id, None)
+                _session_owner_homes.pop(task_id, None)
+                _cleanup_failures.pop(task_id, None)
         except Exception as e:
-            logger.warning("Error cleaning up inactive session %s: %s", task_id, e)
+            with _cleanup_lock:
+                failures = _cleanup_failures[task_id] = _cleanup_failures.get(task_id, 0) + 1
+            if failures < MAX_INACTIVITY_CLEANUP_FAILURES:
+                logger.warning("Error cleaning up inactive session %s (attempt %d/%d): %s",
+                               task_id, failures, MAX_INACTIVITY_CLEANUP_FAILURES, e)
+                continue
+            logger.error("Browser cleanup failed %d times for inactive session %s; "
+                         "force-reaping: %s", failures, task_id, e)
+            try:
+                with _session_owner_scope(task_id):
+                    _force_reap_browser_session(task_id)
+            except Exception as reap_exc:
+                logger.error("Force-reap of browser session %s failed: %s", task_id, reap_exc)
+            finally:
+                with _cleanup_lock:
+                    _session_owner_homes.pop(task_id, None)
+                    _cleanup_failures.pop(task_id, None)
 
 
 def _write_owner_pid(socket_dir: str, session_name: str) -> None:
@@ -2774,9 +2851,16 @@ def _stop_browser_cleanup_thread():
 
 
 def _update_session_activity(task_id: str):
-    """Update the last activity timestamp for a session."""
+    """Update the last activity timestamp for a session.
+
+    Also records the owning Hermes home on first sight so the process-global
+    janitor can tear the session down under its owner's scope (#86402).  An
+    activity touch deliberately does NOT reset ``_cleanup_failures`` — only a
+    successful cleanup does.
+    """
     with _cleanup_lock:
         _session_last_activity[task_id] = time.time()
+        _session_owner_homes.setdefault(task_id, str(get_hermes_home()))
 
 
 # Register cleanup thread stop on exit
@@ -5844,6 +5928,91 @@ def cleanup_browser(task_id: Optional[str] = None) -> None:
         _last_active_session_key.pop(bare_task_id, None)
 
 
+def _release_session_resources(task_id: str, session_info: Dict[str, Any]) -> None:
+    """Untrack ``task_id``, close its cloud provider session, kill its daemon.
+
+    The unconditional tail of ``_cleanup_single_browser_session``; also the
+    whole of the janitor's force-reap path (#100738), which skips the polite
+    agent-browser/Camofox ``close`` that kept failing but must still release
+    the cloud session and the local Chromium.
+    """
+    bb_session_id = session_info.get("bb_session_id", "unknown")
+    # Now remove from tracking under lock
+    with _cleanup_lock:
+        _active_sessions.pop(task_id, None)
+        _session_last_activity.pop(task_id, None)
+        _session_owner_homes.pop(task_id, None)
+        _cleanup_failures.pop(task_id, None)
+
+    # Cloud mode: close the cloud browser session via provider API.
+    # Local sidecars have bb_session_id=None so this no-ops for them.
+    if bb_session_id:
+        provider = _get_cloud_provider()
+        if provider is not None:
+            try:
+                provider.close_session(bb_session_id)
+            except Exception as e:
+                logger.warning("Could not close cloud browser session: %s", e)
+
+    # Kill the daemon process and clean up socket directory
+    session_name = session_info.get("session_name", "")
+    if session_name:
+        socket_dir = os.path.join(_socket_safe_tmpdir(), f"agent-browser-{session_name}")
+        if os.path.exists(socket_dir):
+            # agent-browser writes {session}.pid in the socket dir
+            pid_file = os.path.join(socket_dir, f"{session_name}.pid")
+            if os.path.isfile(pid_file):
+                try:
+                    from tools.process_registry import ProcessRegistry
+                    daemon_pid = int(Path(pid_file).read_text(encoding="utf-8").strip())
+                    # The .pid file lives in a world-writable temp dir and
+                    # PIDs recycle: verify this really is our daemon for
+                    # this session before tree-killing, and pin the
+                    # identity with a start-time fingerprint so the kill
+                    # refuses if the PID is swapped between check and kill.
+                    if _verify_reapable_browser_daemon(
+                            daemon_pid, socket_dir, session_name):
+                        from gateway.status import get_process_start_time
+                        daemon_start = get_process_start_time(daemon_pid)
+                        if daemon_start is not None:
+                            ProcessRegistry._terminate_host_pid(
+                                daemon_pid, daemon_start)
+                            logger.debug("Killed daemon pid %s for %s", daemon_pid, session_name)
+                        else:
+                            logger.debug(
+                                "Skipped daemon kill for %s: no start-time "
+                                "fingerprint for pid %s", session_name, daemon_pid)
+                    else:
+                        logger.debug(
+                            "Skipped daemon kill for %s: pid %s failed identity "
+                            "verification", session_name, daemon_pid)
+                except (ProcessLookupError, ValueError, PermissionError, OSError):
+                    logger.debug("Could not kill daemon pid for %s (already dead or inaccessible)", session_name)
+            shutil.rmtree(socket_dir, ignore_errors=True)
+
+
+def _force_reap_browser_session(task_id: str) -> None:
+    """Janitor last resort after repeated cleanup failures (#100738).
+
+    Skips the ``close`` round-trips that keep failing and goes straight to
+    ``_release_session_resources`` (cloud close + daemon kill + untrack).
+    """
+    _stop_cdp_supervisor(task_id)
+    with _cleanup_lock:
+        session_info = _active_sessions.get(task_id)
+        _session_last_activity.pop(task_id, None)
+        _recording_sessions.discard(task_id)
+    if session_info:
+        _release_session_resources(task_id, session_info)
+    # Same ownership-binding drop as cleanup_browser().
+    if _is_local_sidecar_key(task_id):
+        bare_task_id = task_id[: -len(_LOCAL_SUFFIX)]
+        if _last_active_session_key.get(bare_task_id) == task_id:
+            _last_active_session_key.pop(bare_task_id, None)
+    else:
+        _last_active_session_key.pop(task_id, None)
+
+
 def _cleanup_single_browser_session(task_id: str) -> None:
     """Internal: reap a single browser session by its exact session key."""
     # Stop the CDP supervisor for this task FIRST so we close our WebSocket
@@ -5904,56 +6073,7 @@ def _cleanup_single_browser_session(task_id: str) -> None:
             except Exception as e:
                 logger.warning("agent-browser close failed for task %s: %s", task_id, e)
 
-        # Now remove from tracking under lock
-        with _cleanup_lock:
-            _active_sessions.pop(task_id, None)
-            _session_last_activity.pop(task_id, None)
-
-        # Cloud mode: close the cloud browser session via provider API.
-        # Local sidecars have bb_session_id=None so this no-ops for them.
-        if bb_session_id:
-            provider = _get_cloud_provider()
-            if provider is not None:
-                try:
-                    provider.close_session(bb_session_id)
-                except Exception as e:
-                    logger.warning("Could not close cloud browser session: %s", e)
-
-        # Kill the daemon process and clean up socket directory
-        session_name = session_info.get("session_name", "")
-        if session_name:
-            socket_dir = os.path.join(_socket_safe_tmpdir(), f"agent-browser-{session_name}")
-            if os.path.exists(socket_dir):
-                # agent-browser writes {session}.pid in the socket dir
-                pid_file = os.path.join(socket_dir, f"{session_name}.pid")
-                if os.path.isfile(pid_file):
-                    try:
-                        from tools.process_registry import ProcessRegistry
-                        daemon_pid = int(Path(pid_file).read_text(encoding="utf-8").strip())
-                        # The .pid file lives in a world-writable temp dir and
-                        # PIDs recycle: verify this really is our daemon for
-                        # this session before tree-killing, and pin the
-                        # identity with a start-time fingerprint so the kill
-                        # refuses if the PID is swapped between check and kill.
-                        if _verify_reapable_browser_daemon(
-                                daemon_pid, socket_dir, session_name):
-                            from gateway.status import get_process_start_time
-                            daemon_start = get_process_start_time(daemon_pid)
-                            if daemon_start is not None:
-                                ProcessRegistry._terminate_host_pid(
-                                    daemon_pid, daemon_start)
-                                logger.debug("Killed daemon pid %s for %s", daemon_pid, session_name)
-                            else:
-                                logger.debug(
-                                    "Skipped daemon kill for %s: no start-time "
-                                    "fingerprint for pid %s", session_name, daemon_pid)
-                        else:
-                            logger.debug(
-                                "Skipped daemon kill for %s: pid %s failed identity "
-                                "verification", session_name, daemon_pid)
-                    except (ProcessLookupError, ValueError, PermissionError, OSError):
-                        logger.debug("Could not kill daemon pid for %s (already dead or inaccessible)", session_name)
-                shutil.rmtree(socket_dir, ignore_errors=True)
+        _release_session_resources(task_id, session_info)
 
         logger.debug("Removed task %s from active sessions", task_id)
     else:
diff --git a/tools/close_terminal_tool.py b/tools/close_terminal_tool.py
index 24277f44da..4ae8088fbd 100644
--- a/tools/close_terminal_tool.py
+++ b/tools/close_terminal_tool.py
@@ -30,7 +30,7 @@ def close_terminal_tool(process_id: str) -> str:
 CLOSE_TERMINAL_SCHEMA = {
     "name": "close_terminal",
     "description": (
-        "Close the read-only terminal tab for one of your background processes in "
+        "Hide a background process's terminal tab (process keeps running) in "
         "the Hermes desktop GUI (the tabs mirroring terminal(background=true) runs). "
         "This does NOT kill the process — it only drops the tab/view; the output "
         "keeps buffering and the user can reopen it from the status stack. Use it "
diff --git a/tools/code_execution_tool.py b/tools/code_execution_tool.py
index 44b5188c5d..470f956732 100644
--- a/tools/code_execution_tool.py
+++ b/tools/code_execution_tool.py
@@ -1553,6 +1553,21 @@ def execute_code(
             "Use normal tool calls (terminal, read_file, write_file, ...) instead."
         )
 
+    # Fail closed under a terminal-policy refusal scope (#68559): the routed
+    # profile's terminal policy could not be resolved and execute_code runs on
+    # the configured terminal backend — refuse rather than inheriting the
+    # launch process's ambient policy.
+    try:
+        from tools.terminal_scope import enforce_no_refusal
+
+        enforce_no_refusal()
+    except Exception as refusal:
+        return tool_error(
+            f"execute_code refused: {refusal} "
+            "(profile terminal policy unresolved; fix the profile's "
+            "config.yaml / .env and retry)"
+        )
+
     if not code or not code.strip():
         return tool_error(
             "No code provided. execute_code requires a non-empty 'code' "
@@ -2282,7 +2297,9 @@ def _resolve_child_cwd(mode: str, staging_dir: str, task_id: str = "") -> str:
             session_cwd = None
         if session_cwd and os.path.isdir(session_cwd):
             return session_cwd
-    raw = os.environ.get("TERMINAL_CWD", "").strip()
+    from agent.runtime_cwd import scope_terminal_cwd
+
+    raw = scope_terminal_cwd().strip()
     if raw:
         expanded = os.path.expanduser(raw)
         if os.path.isdir(expanded):
diff --git a/tools/cronjob_tools.py b/tools/cronjob_tools.py
index bc9df41bbf..cdcdc6cea5 100644
--- a/tools/cronjob_tools.py
+++ b/tools/cronjob_tools.py
@@ -770,6 +770,7 @@ def _format_job(job: Dict[str, Any]) -> Dict[str, Any]:
         "last_run_at": job.get("last_run_at"),
         "last_status": job.get("last_status"),
         "last_delivery_error": job.get("last_delivery_error"),
+        "last_delivery_unverified": job.get("last_delivery_unverified"),
         "last_fire_error": job.get("last_fire_error"),
         "enabled": job.get("enabled", True),
         # Derive from enabled so half-paused records never render as paused.
@@ -920,6 +921,30 @@ def _forward_relay_fronted_run(
     )
 
 
+def _manual_run_delivery_note(deliver: str, refreshed: Dict[str, Any]) -> str:
+    """Parenthetical delivery note for a manual run's completion summary.
+
+    Follows the refreshed job record (#83993): ``run_one_job`` writes
+    ``last_delivery_error`` via ``mark_job_run`` when the post-run delivery
+    (telegram/discord/…) failed, and the summary must not claim success over
+    that record — the calling agent relays this line to the user. Local jobs
+    never deliver; an empty/missing error keeps the legacy wording
+    byte-for-byte.
+    """
+    # Falsy deliver ("", stored JSON null) means no delivery target — the
+    # fire-time path normalizes it to "local" (no delivery, output persisted
+    # in last_output, no delivery error), so it must read as saved-locally,
+    # not as a delivered remote target. Whitespace-only values are NOT folded
+    # in here: they keep falling through to the error check, where the
+    # fire-time "no delivery target resolved" error gets surfaced.
+    if not deliver or deliver == "local":
+        return " (output saved locally only)"
+    err = str(refreshed.get("last_delivery_error") or "").strip()
+    if not err:
+        return " (output was delivered there by the job itself)"
+    return f" (⚠ delivery FAILED: {err[:200]})"
+
+
 def _execute_job_now(
     job: Dict[str, Any], extra_prompt: Optional[str] = None
 ) -> Dict[str, Any]:
@@ -1100,11 +1125,21 @@ def _run_claimed_job(
             _registered = False
             release_running_job(job_id)
         refreshed = get_job(job_id) or {}
-        ok = refreshed.get("last_status") == "ok"
+        last_status = refreshed.get("last_status")
+        # "delivery_failed" (#83993): the agent run itself succeeded but the
+        # output never reached the user. That is NOT a success for the caller
+        # — the calling agent relays this result — so report it as failed
+        # and surface the delivery error, which lives in last_delivery_error
+        # (last_error is None for these runs, and a bare success=False with
+        # error=None reads as an unexplained failure).
+        ok = last_status == "ok"
+        run_error = refreshed.get("last_error")
+        if last_status == "delivery_failed" and not run_error:
+            run_error = refreshed.get("last_delivery_error")
         return {
             "claimed": True,
             "success": bool(processed and ok),
-            "error": refreshed.get("last_error"),
+            "error": run_error,
         }
 
     except Exception as e:
@@ -1334,7 +1369,14 @@ def _try_dispatch_background_run(
         max_async = 3
 
     started_at = time.time()
-    deliver = job.get("deliver", "local")
+    # Canonicalize with the scheduler's own normalizer so the summary states
+    # the same target fire time will use: falsy ("", stored JSON null) reads
+    # "local", legacy list-form deliver flattens to its comma string. Read
+    # from the claimed snapshot — the owner-bearing record the run actually
+    # executes — not the pre-claim `job` the tool loaded.
+    from cron.scheduler import _normalize_deliver_value
+
+    deliver = _normalize_deliver_value(claimed_job.get("deliver", "local"))
 
     def _runner() -> Dict[str, Any]:
         res = _run_claimed_job(claimed_job, extra_prompt=extra_prompt)
@@ -1345,11 +1387,7 @@ def _try_dispatch_background_run(
             f"Result: {'ok' if res.get('success') else 'FAILED'}"
             + (f" — {res.get('error')}" if res.get("error") else ""),
             f"Delivery target: {deliver}"
-            + (
-                " (output was delivered there by the job itself)"
-                if deliver != "local"
-                else " (output saved locally only)"
-            ),
+            + _manual_run_delivery_note(deliver, refreshed),
         ]
         if refreshed.get("next_run_at"):
             lines.append(f"Next scheduled run: {refreshed['next_run_at']}")
@@ -1482,6 +1520,7 @@ def cronjob(
     monitor_script: Optional[str] = None,
     monitor_url: Optional[str] = None,
     reasoning_effort: Optional[str] = None,
+    failure_deliver: Optional[Union[str, List[str]]] = None,
     task_id: str = None,
     session_id: Optional[str] = None,
 ) -> str:
@@ -1540,6 +1579,12 @@ def cronjob(
             # bot-chat deliver targets are machine-local: named profiles must
             # exist here, and a bad name should fail the CREATE, not the run.
             bot_chat_error = _validate_bot_chat_deliver(_normalize_deliver_param(deliver))
+            if bot_chat_error:
+                return tool_error(bot_chat_error, success=False)
+            # failure_deliver shares deliver's grammar and validators (NS-788).
+            bot_chat_error = _validate_bot_chat_deliver(
+                _normalize_deliver_param(failure_deliver)
+            )
             if bot_chat_error:
                 return tool_error(bot_chat_error, success=False)
 
@@ -1598,6 +1643,9 @@ def cronjob(
                     # dispatch below: models do not make model-config
                     # decisions (standing policy).
                     reasoning_effort=reasoning_effort,
+                    failure_deliver=_resolve_cron_context_deliver(
+                        _normalize_deliver_param(failure_deliver)
+                    ),
                 )
             except CronSchedulerRegistrationError as exc:
                 _partial = exc.to_dict()
@@ -1800,6 +1848,19 @@ def cronjob(
                 updates["deliver"] = _resolve_cron_context_deliver(
                     _normalize_deliver_param(deliver)
                 )
+            if failure_deliver is not None:
+                # '' clears the override (job falls back to deliver on
+                # failures); non-empty values share deliver's validation
+                # AND its cron-context origin resolution (a job created
+                # from inside a cron run must never store literal
+                # 'origin' — same rule as deliver).
+                _norm_fd = _normalize_deliver_param(failure_deliver)
+                if _norm_fd:
+                    bot_chat_error = _validate_bot_chat_deliver(_norm_fd)
+                    if bot_chat_error:
+                        return tool_error(bot_chat_error, success=False)
+                    _norm_fd = _resolve_cron_context_deliver(_norm_fd)
+                updates["failure_deliver"] = _norm_fd
             if skills is not None or skill is not None:
                 canonical_skills = _canonical_skills(skill, skills)
                 updates["skills"] = canonical_skills
@@ -1953,7 +2014,7 @@ def cronjob(
 
 
 CRONJOB_SCHEMA = {
-    "name": "cronjob",
+    "name": "cronjob_manage",
     "description": """Manage scheduled cron jobs: action='create' schedules a job from a prompt and/or skills; 'list' inspects jobs; 'update'/'pause'/'resume'/'remove' manage one by job_id (always list first — never guess job IDs); 'run' fires a job immediately in the BACKGROUND (returns a handle at once, outcome re-enters the conversation when done — do not wait or poll; optional 'prompt' adds transient context for that fire only).
 
 Jobs run in a fresh session with no current-chat context, so prompts must be self-contained, and the agent's FINAL RESPONSE is what gets delivered — cron runs are autonomous and cannot ask questions. Prefer updating an existing job over creating near-duplicates.""",
@@ -1989,6 +2050,10 @@ Jobs run in a fresh session with no current-chat context, so prompts must be sel
                 "type": "string",
                 "description": "Where the job's output is POSTED as a one-way message (the job itself always runs in a fresh session with no chat context). Omit to address the chat/topic this job was created from. Otherwise: 'local' (save only, no delivery), 'all' (every connected home channel, resolved at fire time), 'bot-chat' or 'bot-chat:<profile>' (inject into a Bot Chat as a real message), or platform:chat_id:thread_id (e.g. 'telegram:-1001234567890:17585'). Comma-combine like 'origin,all'."
             },
+            "failure_deliver": {
+                "type": "string",
+                "description": "Optional override target for FAILURE notices only (same grammar as deliver). When set, engine failure/interruption notices go here instead of the deliver target; 'local' suppresses them entirely (state still recorded in cron list/run history). Use for jobs delivering into shared channels where failure noise is unwanted. Omit = failures follow deliver (default). On update, '' clears."
+            },
             "skills": {
                 "type": "array",
                 "items": {"type": "string"},
@@ -2079,6 +2144,7 @@ def _cronjob_handler(args, **kw):
         name=args.get("name"),
         repeat=args.get("repeat"),
         deliver=args.get("deliver"),
+        failure_deliver=args.get("failure_deliver"),
         include_disabled=args.get("include_disabled", True),
         skill=args.get("skill"),
         skills=args.get("skills"),
@@ -2103,7 +2169,7 @@ def _cronjob_handler(args, **kw):
 
 
 registry.register(
-    name="cronjob",
+    name="cronjob_manage",
     toolset="cronjob",
     schema=CRONJOB_SCHEMA,
     handler=_cronjob_handler,
diff --git a/tools/daemon_pool.py b/tools/daemon_pool.py
index 2fb5a61d0a..33e99c5143 100644
--- a/tools/daemon_pool.py
+++ b/tools/daemon_pool.py
@@ -16,8 +16,16 @@ exit hook insists on joining.
   - the interpreter's non-daemon thread join at shutdown skips them.
 
 Semantics are otherwise identical (initializer/initargs, work queue,
-idle-thread reuse).  Use it for any pool whose work is best-effort or
-independently interruptible and must never hold the process open:
+idle-thread reuse), plus context propagation: ``submit`` snapshots the
+submitting context with ``copy_context()`` and runs each work item inside
+it.  Stdlib ``ThreadPoolExecutor`` only does this from Python 3.14; on the
+3.11-3.13 runtimes Hermes ships, a bare pool worker starts with an EMPTY
+Context and silently drops contextvar-based state (profile secret scope,
+HERMES_HOME override) — under the multiplexed gateway a credential read in
+such a worker fails closed with ``UnscopedSecretError``.  Propagating by
+default makes every consumer safe even when it forgets
+``propagate_context_to_thread``.  Use it for any pool whose work is
+best-effort or independently interruptible and must never hold the process open:
 concurrent tool execution, background memory sync, catalog fan-out,
 subagent timeout wrappers.  Do NOT use it for work that must complete
 before exit (durable writes) — those belong on foreground threads with
@@ -30,6 +38,7 @@ import threading
 import weakref
 from concurrent.futures import ThreadPoolExecutor
 from concurrent.futures.thread import _worker
+from contextvars import copy_context
 
 __all__ = ["DaemonThreadPoolExecutor"]
 
@@ -37,6 +46,25 @@ __all__ = ["DaemonThreadPoolExecutor"]
 class DaemonThreadPoolExecutor(ThreadPoolExecutor):
     """ThreadPoolExecutor variant whose workers do not block process exit."""
 
+    def submit(self, fn, /, *args, **kwargs):
+        """Submit a callable, propagating the caller's contextvars.
+
+        Python 3.14's ``ThreadPoolExecutor`` snapshots the submitting
+        context with ``copy_context()`` and runs each work item inside it;
+        3.11-3.13 (the runtimes Hermes ships) do not, so a pool worker
+        starts with an empty Context and loses the multiplexed profile
+        secret scope / HERMES_HOME override.  Do it here unconditionally so
+        the daemon pool behaves identically on every runtime; on 3.14+ the
+        inner ``ctx.run`` re-applies the same immutable context and is a
+        no-op.
+        """
+        ctx = copy_context()
+
+        def _run_with_context(*call_args, **call_kwargs):
+            return ctx.run(fn, *call_args, **call_kwargs)
+
+        return super().submit(_run_with_context, *args, **kwargs)
+
     def _adjust_thread_count(self) -> None:
         # Mirrors CPython's implementation (3.8–3.13) with two changes:
         # daemon=True and no _threads_queues registration.
diff --git a/tools/delegate_tool.py b/tools/delegate_tool.py
index 5b8f645fda..1313f3e6d4 100644
--- a/tools/delegate_tool.py
+++ b/tools/delegate_tool.py
@@ -53,7 +53,7 @@ DELEGATE_BLOCKED_TOOLS = frozenset(
         "clarify",  # no user interaction
         "memory",  # no writes to shared MEMORY.md
         "send_message",  # no cross-platform side effects
-        "cronjob",  # no scheduling more work in the parent's name
+        "cronjob_manage",  # no scheduling more work in the parent's name
     ]
 )
 
@@ -1402,6 +1402,31 @@ def _blocked_toolsets_for_role(role: str) -> List[str]:
     )
 
 
+def format_batch_tag(delegation_id: Optional[str]) -> str:
+    """Short human tag identifying which delegation batch a line belongs to.
+
+    ``deleg_6a664903`` → ``6a66``. Several batches (a parent's fan-out plus
+    a child's nested fan-out, or two concurrent tools) print interleaved
+    ``[n/N]`` progress lines to the same console; without a batch tag a
+    ``✓ [3/3]`` and a ``✓ [3/9]`` are indistinguishable. Empty string when
+    no id is known so callers can concatenate unconditionally.
+    """
+    if not isinstance(delegation_id, str) or not delegation_id:
+        return ""
+    short = delegation_id.split("_", 1)[-1][:4]
+    return f"{short}" if short else ""
+
+
+def _batch_prefix(delegation_id: Optional[str], task_index: int, task_count: int) -> str:
+    """``[6a66 3/9] `` for batch children, ``[6a66] `` for a lone child,
+    ``[3/9] `` / ``""`` when the batch id is unknown."""
+    tag = format_batch_tag(delegation_id)
+    if task_count > 1:
+        inner = f"{tag} {task_index + 1}/{task_count}" if tag else f"{task_index + 1}/{task_count}"
+        return f"[{inner}] "
+    return f"[{tag}] " if tag else ""
+
+
 def _emit_parent_console(parent_agent, line: str) -> None:
     """Emit a human-readable progress line to the parent's console.
 
@@ -1454,8 +1479,14 @@ def _build_child_progress_callback(
     if not spinner and not parent_cb:
         return None  # No display → no callback → zero behavior change
 
-    # Show 1-indexed prefix only in batch mode (multiple tasks)
-    prefix = f"[{task_index + 1}] " if task_count > 1 else ""
+    # Show 1-indexed prefix only in batch mode (multiple tasks). The batch tag
+    # (short delegation id) is resolved lazily from session_ref because the
+    # callback is built before delegate_task stamps ``_delegation_id`` on the
+    # child; delegate_task drops the id into the same shared ref.
+    def _prefix() -> str:
+        deleg = session_ref.get("delegation_id") if session_ref else None
+        return _batch_prefix(deleg, task_index, task_count)
+
     goal_label = (goal or "").strip()
 
     # Gateway: batch tool names, flush periodically
@@ -1484,6 +1515,8 @@ def _build_child_progress_callback(
         # event lets UIs open/inspect the subagent's session directly.
         if session_ref and session_ref.get("session_id"):
             kw["child_session_id"] = str(session_ref["session_id"])
+        if session_ref and session_ref.get("delegation_id"):
+            kw["delegation_id"] = str(session_ref["delegation_id"])
         kw["tool_count"] = _tool_count[0]
         return kw
 
@@ -1510,7 +1543,7 @@ def _build_child_progress_callback(
                     (goal_label[:55] + "...") if len(goal_label) > 55 else goal_label
                 )
                 try:
-                    spinner.print_above(f" {prefix}├─ 🔀 {short}")
+                    spinner.print_above(f" {_prefix()}├─ 🔀 {short}")
                 except Exception as e:
                     logger.debug("Spinner print_above failed: %s", e)
             _relay("subagent.start", preview=preview or goal_label or "", **kwargs)
@@ -1529,7 +1562,7 @@ def _build_child_progress_callback(
                     duration_seconds=kwargs.get("duration_seconds"),
                 )
                 try:
-                    spinner.print_above(f" {prefix}├─ {_fail_line}")
+                    spinner.print_above(f" {_prefix()}├─ {_fail_line}")
                 except Exception as e:
                     logger.debug("Spinner print_above failed: %s", e)
             _relay("subagent.complete", preview=preview, **kwargs)
@@ -1563,7 +1596,7 @@ def _build_child_progress_callback(
             if spinner:
                 short = (text[:55] + "...") if len(text) > 55 else text
                 try:
-                    spinner.print_above(f' {prefix}├─ 💭 "{short}"')
+                    spinner.print_above(f' {_prefix()}├─ 💭 "{short}"')
                 except Exception as e:
                     logger.debug("Spinner print_above failed: %s", e)
             _relay("subagent.thinking", preview=text)
@@ -1583,12 +1616,12 @@ def _build_child_progress_callback(
             summary_text = tool_name or preview or ""
             if spinner and summary_text:
                 try:
-                    spinner.print_above(f" {prefix}├─ 🔀 {summary_text}")
+                    spinner.print_above(f" {_prefix()}├─ 🔀 {summary_text}")
                 except Exception as e:
                     logger.debug("Spinner print_above failed: %s", e)
             if parent_cb:
                 try:
-                    parent_cb("subagent_progress", f"{prefix}{summary_text}")
+                    parent_cb("subagent_progress", f"{_prefix()}{summary_text}")
                 except Exception as e:
                     logger.debug("Parent callback relay failed: %s", e)
             return
@@ -1610,7 +1643,7 @@ def _build_child_progress_callback(
             from agent.display import get_tool_emoji
 
             emoji = get_tool_emoji(tool_name or "")
-            line = f" {prefix}├─ {emoji} {tool_name}"
+            line = f" {_prefix()}├─ {emoji} {tool_name}"
             if short:
                 line += f'  "{short}"'
             try:
@@ -1623,14 +1656,14 @@ def _build_child_progress_callback(
             _batch.append(tool_name or "")
             if len(_batch) >= _BATCH_SIZE:
                 summary = ", ".join(_batch)
-                _relay("subagent.progress", preview=f"🔀 {prefix}{summary}")
+                _relay("subagent.progress", preview=f"🔀 {_prefix()}{summary}")
                 _batch.clear()
 
     def _flush():
         """Flush remaining batched tool names to gateway on completion."""
         if parent_cb and _batch:
             summary = ", ".join(_batch)
-            _relay("subagent.progress", preview=f"🔀 {prefix}{summary}")
+            _relay("subagent.progress", preview=f"🔀 {_prefix()}{summary}")
             _batch.clear()
 
     _callback._flush = _flush
@@ -2138,6 +2171,9 @@ def _build_child_agent(
     # Now the child exists, its session id can ride on every relayed event
     # (including the spawn_requested below — first emit happens after this).
     child_session_ref["session_id"] = getattr(child, "session_id", "") or ""
+    # Same shared ref receives the batch id once delegate_task stamps it, so
+    # the display prefix and relayed events can tag which batch this is.
+    child._progress_identity_ref = child_session_ref
     # Set delegation depth so children can't spawn grandchildren
     child._delegate_depth = child_depth
     # Stash the post-degrade role for introspection (leaf if the
@@ -2603,6 +2639,12 @@ def _run_single_child(
     parent-visible truncation flag stays truthful for all of the above.
     """
     child_start = time.monotonic()
+    # A timed-out Future may still be unwinding on its daemon worker. Closing
+    # the child from this owner thread before that Future settles races every
+    # resource the conversation's finally path still touches (notably its
+    # owned SessionDB). The timeout branch flips this when close ownership is
+    # handed to a Future done-callback instead.
+    _child_close_deferred = False
 
     # Get the progress callback from the child agent
     child_progress_cb = getattr(child, "tool_progress_callback", None)
@@ -3080,6 +3122,63 @@ def _run_single_child(
                     f"{_late_pending_steer}]"
                 )
             _attach_worktree(_error_entry)
+            if is_timeout and not _child_future.done():
+                # request_hard_interrupt() is cooperative: the worker still
+                # executes run_conversation's finally path before its Future
+                # becomes done. child.close() tears down that same agent's
+                # clients, messages, and owned SQLite handle, so calling it in
+                # our outer finally while the worker is alive can close SQLite
+                # underneath its final activity write. Future callbacks run
+                # only after the worker has fully returned (or raised), which
+                # is the first safe close boundary.
+                def _close_after_timed_out_worker(_done_future) -> None:
+                    try:
+                        close = getattr(child, "close", None)
+                        if callable(close):
+                            close()
+                    except Exception:
+                        logger.debug(
+                            "Failed to close timed-out child after worker exit",
+                            exc_info=True,
+                        )
+
+                _child_future.add_done_callback(_close_after_timed_out_worker)
+                _child_close_deferred = True
+
+                # Bounded drain (#94248 native half): the deferred close above
+                # only fires once the abandoned worker unwinds, but that worker
+                # is typically parked inside an in-flight OpenSSL read (Codex /
+                # httpx). Never hard-close that transport from this thread —
+                # releasing FDs under a live SSL read is the #29507/#70773
+                # native-corruption family. Instead shutdown() the child's
+                # pooled sockets, which is FD-safe from any thread and settles
+                # the blocked read with EOF/EPIPE so the worker can unwind and
+                # trigger the deferred close. One immediate sweep plus one
+                # delayed re-sweep (covers a fresh connection opened between
+                # the interrupt and the first sweep); a worker that still
+                # doesn't settle keeps its resources until process exit rather
+                # than risking a cross-thread FD release.
+                _drain = getattr(child, "_drain_transports_after_abandonment", None)
+                if callable(_drain):
+                    def _drain_once(phase: str) -> None:
+                        try:
+                            _drain(reason=f"delegate_timeout_{phase}")
+                        except Exception:
+                            logger.debug(
+                                "Timed-out child transport drain (%s) failed",
+                                phase,
+                                exc_info=True,
+                            )
+
+                    _drain_once("immediate")
+
+                    def _drain_resweep() -> None:
+                        if not _child_future.done():
+                            _drain_once("resweep")
+
+                    _resweep_timer = threading.Timer(5.0, _drain_resweep)
+                    _resweep_timer.daemon = True
+                    _resweep_timer.start()
             return _error_entry
         finally:
             # Shut down executor without waiting — if the child thread
@@ -3554,11 +3653,13 @@ def _run_single_child(
         # Close tool resources (terminal sandboxes, browser daemons,
         # background processes, httpx clients) so subagent subprocesses
         # don't outlive the delegation.
-        try:
-            if hasattr(child, "close"):
-                child.close()
-        except Exception:
-            logger.debug("Failed to close child agent after delegation")
+        if not _child_close_deferred:
+            try:
+                close = getattr(child, "close", None)
+                if callable(close):
+                    close()
+            except Exception:
+                logger.debug("Failed to close child agent after delegation")
 
         # The AIAgent turn boundary normally closes the child scope itself. This
         # fallback covers failures before that boundary starts, but must not pop
@@ -4026,6 +4127,18 @@ def delegate_task(
     live_deleg_id, live_writers, live_paths = create_live_transcripts(
         task_list, context, model=creds.get("model"), provider=creds.get("provider")
     )
+    # Announce the batch tag once so the later ``[tag n/N]`` completion lines
+    # (and any nested batch's lines interleaving with them) are attributable.
+    if n_tasks > 1 and live_deleg_id:
+        _hdr = f"🔀 [{format_batch_tag(live_deleg_id)}] delegating {n_tasks} tasks"
+        _hdr_spinner = getattr(parent_agent, "_delegate_spinner", None)
+        if _hdr_spinner:
+            try:
+                _hdr_spinner.print_above(f"  {_hdr}")
+            except Exception:
+                _emit_parent_console(parent_agent, f"  {_hdr}")
+        else:
+            _emit_parent_console(parent_agent, f"  {_hdr}")
 
     # Capture the ORIGINATING session's wake target BEFORE any child agent is
     # constructed: _build_child_agent() -> AIAgent() -> agent_init calls
@@ -4114,6 +4227,9 @@ def delegate_task(
         # attribution (child-started background processes report under it).
         if live_deleg_id:
             setattr(child, "_delegation_id", live_deleg_id)
+            _ident_ref = getattr(child, "_progress_identity_ref", None)
+            if isinstance(_ident_ref, dict):
+                _ident_ref["delegation_id"] = live_deleg_id
         children.append((i, t, child))
 
     def _execute_and_aggregate(*, honor_parent_interrupt: bool = True) -> dict:
@@ -4249,7 +4365,9 @@ def delegate_task(
                         status = entry.get("status", "?")
                         icon = "✓" if status == "completed" else "✗"
                         remaining = n_tasks - completed_count
-                        completion_line = f"{icon} [{idx+1}/{n_tasks}] {label}  ({dur}s)"
+                        _tag = format_batch_tag(live_deleg_id)
+                        _slot = f"{_tag} {idx+1}/{n_tasks}" if _tag else f"{idx+1}/{n_tasks}"
+                        completion_line = f"{icon} [{_slot}] {label}  ({dur}s)"
                         # Failed/errored/timed-out children: say WHY on the
                         # same line, cleaned to one short human-readable
                         # fragment — a bare ✗ reads as "silently dropped".
@@ -4271,7 +4389,7 @@ def delegate_task(
                         if spinner_ref and remaining > 0:
                             try:
                                 spinner_ref.update_text(
-                                    f"🔀 {remaining} task{'s' if remaining != 1 else ''} remaining"
+                                    f"🔀 {'[' + _tag + '] ' if _tag else ''}{remaining} task{'s' if remaining != 1 else ''} remaining"
                                 )
                             except Exception as e:
                                 logger.debug("Spinner update_text failed: %s", e)
diff --git a/tools/env_probe.py b/tools/env_probe.py
index 32b8f6e6b6..d1eaf08c12 100644
--- a/tools/env_probe.py
+++ b/tools/env_probe.py
@@ -198,18 +198,23 @@ def _pip_python_version() -> Optional[str]:
     return None
 
 
+def _resolve_terminal_backend() -> str:
+    """Scope-aware terminal backend name (``local`` when unresolvable)."""
+    try:
+        from tools.terminal_scope import terminal_env
+
+        return (terminal_env("TERMINAL_ENV") or "local").strip().lower()
+    except Exception:  # never let policy resolution break prompt building
+        logger.debug("terminal backend resolution failed", exc_info=True)
+        return "local"
+
+
 def _build_probe_line() -> str:
     """Build the one-liner.  Returns "" when nothing notable is detected.
 
     Emit only when SOMETHING is off — the goal is to save the model from
     hitting an avoidable wall, not to narrate a healthy environment.
     """
-    # Bail out if a remote terminal backend is configured; the host's
-    # Python state isn't where the agent's tools run.
-    backend = (os.getenv("TERMINAL_ENV") or "local").strip().lower()
-    if backend in _REMOTE_BACKENDS or _plugin_backend_is_remote(backend):
-        return ""
-
     py3_ver = _python_version_of("python3")
     py_ver = _python_version_of("python")  # for systems with a `python` alias
     py3_has_pip = _has_pip_module("python3") if py3_ver else False
@@ -305,6 +310,15 @@ def get_environment_probe_line(*, force_refresh: bool = False) -> str:
             _PROBE_GEN += 1
             _WAIT_ALREADY_TIMED_OUT = False
 
+    # Resolve the backend HERE, in the caller's context: under gateway
+    # multiplexing the routed profile's backend lives in the per-turn terminal
+    # scope, which the bare probe worker thread does not inherit (#68559). A
+    # remote backend answers "" without consulting the cache — the cached line
+    # describes the HOST toolchain, not where that profile's tools run.
+    backend = _resolve_terminal_backend()
+    if backend in _REMOTE_BACKENDS or _plugin_backend_is_remote(backend):
+        return ""
+
     if _PROBE_DONE.is_set():
         return _CACHED_LINE or ""
 
diff --git a/tools/file_tools.py b/tools/file_tools.py
index ddcb060301..a2a55236f3 100644
--- a/tools/file_tools.py
+++ b/tools/file_tools.py
@@ -256,7 +256,11 @@ def _configured_terminal_cwd() -> str | None:
     relative to, which is exactly the ambiguity that misroutes worktree edits.
     Only an absolute, sentinel-free value is honored.
     """
-    return _sentinel_free_abs_cwd(os.environ.get("TERMINAL_CWD"))
+    # Scope-aware: under gateway multiplexing the routed profile's cwd lives in
+    # the per-turn terminal scope, not the process env (#68559).
+    from agent.runtime_cwd import scope_terminal_cwd
+
+    return _sentinel_free_abs_cwd(scope_terminal_cwd() or None)
 
 
 def _registered_task_cwd_override(task_id: str = "default") -> str | None:
diff --git a/tools/kanban_tools.py b/tools/kanban_tools.py
index d49b53a221..dd1db3ed3d 100644
--- a/tools/kanban_tools.py
+++ b/tools/kanban_tools.py
@@ -251,10 +251,16 @@ def _goal_judge_available() -> bool:
     return client is not None and bool(model)
 
 
-def _goal_mode_handoff_rejection(task, evidence: str) -> Optional[str]:
-    """Return a rejection reason when a goal-mode terminal handoff is premature."""
+def _goal_mode_handoff_rejection(task, evidence: str):
+    """Return ``(verdict, reason_or_None)`` for a goal-mode terminal handoff.
+
+    ``{"done", None}`` means the judge allows the handoff; anything else is
+    a rejection whose verdict disambiguates the guidance the caller gives
+    the worker (``continue`` = not done yet, ``blocked`` = judged
+    unachievable — see #100954).
+    """
     if not task or not task.goal_mode or not _goal_judge_available():
-        return None
+        return ("done", None)
     verdict = "done"
     reason = ""
     try:
@@ -270,7 +276,7 @@ def _goal_mode_handoff_rejection(task, evidence: str) -> Optional[str]:
             judge_exc,
             exc_info=True,
         )
-    return reason if verdict != "done" else None
+    return (verdict, None if verdict == "done" else reason)
 
 
 # ---------------------------------------------------------------------------
@@ -752,10 +758,18 @@ def _handle_complete(args: dict, **kw) -> str:
             # Only enforce when a judge is actually reachable — see
             # _goal_judge_available for why an unavailable judge fails open.
             task = kb.get_task(conn, tid)
-            rejection = _goal_mode_handoff_rejection(
+            gate_verdict, rejection = _goal_mode_handoff_rejection(
                 task,
                 (summary or result or "").strip(),
             )
+            if gate_verdict == "blocked":
+                return tool_error(
+                    f"Goal completion rejected: judge ruled the goal "
+                    f"unachievable — {rejection}. The task will NOT complete "
+                    f"silently. Either re-scope the task with kanban_edit, "
+                    f"or record the block with kanban_block and hand the "
+                    f"decision to a human / reviewer."
+                )
             if rejection is not None:
                 return tool_error(
                     f"Goal completion rejected by judge: {rejection}. "
@@ -937,7 +951,13 @@ def _handle_request_review(args: dict, **kw) -> str:
         kb, conn = _connect(board=board)
         try:
             task = kb.get_task(conn, tid)
-            rejection = _goal_mode_handoff_rejection(task, summary)
+            gate_verdict, rejection = _goal_mode_handoff_rejection(task, summary)
+            if gate_verdict == "blocked":
+                return tool_error(
+                    f"Goal review handoff rejected: judge ruled the goal "
+                    f"unachievable — {rejection}. Record the block with "
+                    f"kanban_block instead of requesting review."
+                )
             if rejection is not None:
                 return tool_error(
                     f"Goal review handoff rejected by judge: {rejection}. "
diff --git a/tools/lazy_deps.py b/tools/lazy_deps.py
index 64d4f2ec31..f990f340eb 100644
--- a/tools/lazy_deps.py
+++ b/tools/lazy_deps.py
@@ -699,6 +699,84 @@ def _core_constraints_file() -> Optional[Path]:
         return None
 
 
+def _installed_dist_roots(spec: str, target: Optional[Path]) -> set[Path]:
+    """Return the package directories a freshly installed *spec* owns.
+
+    Resolved from the distribution's own file list rather than guessing the
+    import name from the spec — ``python-telegram-bot`` ships ``telegram``,
+    ``firecrawl-anydoc`` ships ``anydoc``, and several specs ship more than
+    one top-level package.
+    """
+    name = _pkg_name_from_spec(spec)
+    try:
+        import importlib.metadata as _md
+
+        if target is not None:
+            dists = list(_md.distributions(name=name, path=[str(target)]))
+            dist = dists[0] if dists else None
+        else:
+            dist = _md.distribution(name)
+    except Exception:
+        return set()
+    if dist is None:
+        return set()
+
+    roots: set[Path] = set()
+    try:
+        for entry in dist.files or ():
+            parts = entry.parts
+            if not parts or parts[0].startswith(".") or parts[0] == "__pycache__":
+                continue
+            # Metadata dirs (``foo-1.0.dist-info``, legacy ``.egg-info``) own
+            # no importable code; compiling them is wasted work.
+            if parts[0].endswith((".dist-info", ".egg-info")):
+                continue
+            root = Path(dist.locate_file(parts[0]))
+            if root.is_dir():
+                roots.add(root)
+    except Exception:
+        return set()
+    return roots
+
+
+def _warm_installed_bytecode(specs: tuple[str, ...], target: Optional[Path]) -> None:
+    """Byte-compile what we just installed, so no user request has to.
+
+    A pip/uv install writes ``.py`` sources and no ``__pycache__`` — and an
+    install of the *same* version still deletes the cache the old copy had.
+    Whoever imports the package next pays the whole compile: for
+    ``anthropic==0.87.0`` (541 modules) on cpython-3.12.13 that measured
+    2.2-2.7s cold against 0.7-1.0s warm, and 10.5s cold under concurrent
+    load.  That bill lands wherever the first import happens, and
+    for a lazily-installed backend that is the foreground of a user request
+    (#100461) — with nothing printed while it runs, so it reads as a hang.
+    Worse, N per-profile daemons cold-starting together each pay it in full
+    before any of them has written the cache.
+
+    Paying it here instead is strictly better: the caller is already waiting
+    on an installer and can see why.  Best-effort — a compile failure never
+    invalidates an install that succeeded.
+    """
+    if sys.dont_write_bytecode:
+        return
+    try:
+        import compileall
+    except Exception:  # pragma: no cover — stdlib, but never break an install
+        return
+
+    for spec in specs:
+        try:
+            roots = _installed_dist_roots(spec, target)
+        except Exception as exc:
+            logger.debug("Bytecode warm skipped for %s: %s", spec, exc)
+            continue
+        for root in roots:
+            try:
+                compileall.compile_dir(str(root), quiet=2, force=False, workers=1)
+            except Exception as exc:
+                logger.debug("Bytecode warm skipped for %s: %s", root, exc)
+
+
 def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _InstallResult:
     """Install ``specs`` using the uv → pip → ensurepip ladder.
 
@@ -756,8 +834,15 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
             uv_bin = shutil.which("uv")
         if uv_bin:
             try:
+                # --compile-bytecode: uv does NOT write __pycache__ by default
+                # (pip does), so without it the first `import <backend>` in
+                # the foreground of a user request recompiles every module of
+                # the backend *and* its transitive deps (#100461). This covers
+                # the whole install; _warm_installed_bytecode below is the
+                # belt-and-braces pass for the spec's own roots on any tier.
                 r = subprocess.run(
-                    [uv_bin, "pip", "install", *target_args, *constraint_args, *specs],
+                    [uv_bin, "pip", "install", "--compile-bytecode",
+                     *target_args, *constraint_args, *specs],
                     capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=timeout, env=uv_env,
                     stdin=subprocess.DEVNULL,
                     creationflags=windows_hide_flags(),
@@ -765,6 +850,7 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
                 if r.returncode == 0:
                     if target is not None:
                         _activate_target_on_syspath(target)
+                    _warm_installed_bytecode(specs, target)
                     return _InstallResult(True, r.stdout or "", r.stderr or "")
                 logger.debug("uv pip install failed: %s", r.stderr)
                 # A resolver failure is authoritative. Falling through to pip
@@ -810,8 +896,10 @@ def _venv_pip_install(specs: tuple[str, ...], *, timeout: int = 300) -> _Install
                 stdin=subprocess.DEVNULL,
                 creationflags=windows_hide_flags(),
             )
-            if r.returncode == 0 and target is not None:
-                _activate_target_on_syspath(target)
+            if r.returncode == 0:
+                if target is not None:
+                    _activate_target_on_syspath(target)
+                _warm_installed_bytecode(specs, target)
             return _InstallResult(r.returncode == 0, r.stdout or "", r.stderr or "")
         except subprocess.TimeoutExpired as e:
             return _InstallResult(False, "", f"pip install timed out: {e}")
diff --git a/tools/mcp_tool.py b/tools/mcp_tool.py
index ffcdff532d..01e7d9b3db 100644
--- a/tools/mcp_tool.py
+++ b/tools/mcp_tool.py
@@ -588,6 +588,13 @@ _MAX_BACKOFF_SECONDS = 60
 # can ever reach the circuit-breaker half-open probe or _signal_reconnect.
 _PARKED_RETRY_INTERVAL = 300     # seconds between parked self-probes
 _RECYCLED_RECONNECT_TIMEOUT = 15.0
+# How long a tool call waits for a respawned stdio child after its subprocess
+# was found dead — a gateway restart kills every MCP stdio child,
+# and the next call from a still-live session would otherwise fail for no real
+# reason). Bounded: when the wait elapses the call reports the dead transport
+# instead of looping, so a genuinely broken server still parks via the
+# rapid-drop budget in run() rather than hot-cycling respawns.
+_STDIO_RESPAWN_WAIT_SEC = 15.0
 # Jitter applied to reconnect backoff sleeps. Without it, every server that
 # lost the same backend retries in lockstep (thundering herd) and log lines
 # from N servers land in synchronized bursts.
@@ -2800,7 +2807,7 @@ class MCPServerTask:
                 # is currently owned by another server.
                 if registry.get_toolset_for_tool(tool_name) != toolset_name:
                     continue
-                registry.deregister(tool_name)
+                registry.deregister(tool_name, scope=_server_registry_scope(self.name))
                 _forget_mcp_tool_server(tool_name)
 
             # 3. Re-register with the fresh list. The helper may skip names that
@@ -2818,7 +2825,7 @@ class MCPServerTask:
             for tool_name in old_tool_names - registered_name_set:
                 if registry.get_toolset_for_tool(tool_name) != toolset_name:
                     continue
-                registry.deregister(tool_name)
+                registry.deregister(tool_name, scope=_server_registry_scope(self.name))
                 _forget_mcp_tool_server(tool_name)
             self._registered_tool_names = registered_names
 
@@ -2864,21 +2871,44 @@ class MCPServerTask:
                 await asyncio.wait_for(self.session.send_ping(), timeout=30.0)
                 return
             except Exception as exc:
-                # Only a "method not found" means ping is unsupported. Any
-                # other error (timeout, closed transport, session expired) is
-                # a real liveness failure — propagate so we reconnect.
-                if not _is_method_not_found_error(exc):
+                if _is_method_not_found_error(exc):
+                    # Structural -32601 or "Unknown method" — ping is
+                    # definitively unsupported.
+                    if not self._advertises_tools():
+                        raise
+                    self._ping_unsupported = True
+                    logger.info(
+                        "MCP server '%s': does not implement the optional "
+                        "'ping' utility (-32601); using 'list_tools' for "
+                        "keepalive on this connection.",
+                        self.name,
+                    )
+                elif isinstance(exc, (TimeoutError, asyncio.TimeoutError)) and self._advertises_tools():
+                    # A server that silently drops ping (no response at all)
+                    # produces a TimeoutError indistinguishable from a dead
+                    # transport. Before declaring it dead, try list_tools as
+                    # a confirmation probe (#97245). If the transport is
+                    # genuinely broken, list_tools will also fail and we
+                    # propagate that failure.
+                    try:
+                        await asyncio.wait_for(self.session.list_tools(), timeout=30.0)
+                    except Exception:
+                        # Both probes failed — genuine liveness failure.
+                        raise exc from None
+                    # Transport alive, ping just isn't answered. Latch the
+                    # fallback so subsequent keepalives skip the 30s wait.
+                    self._ping_unsupported = True
+                    logger.info(
+                        "MCP server '%s': ping timed out but list_tools "
+                        "succeeded — server silently drops ping; using "
+                        "'list_tools' for keepalive on this connection.",
+                        self.name,
+                    )
+                    return
+                else:
+                    # Any other error (closed transport, session expired,
+                    # etc.) is a real liveness failure — propagate.
                     raise
-                if not self._advertises_tools():
-                    # No ping, no tools → no cheaper probe to fall back to.
-                    raise
-                self._ping_unsupported = True
-                logger.info(
-                    "MCP server '%s': does not implement the optional 'ping' "
-                    "utility (-32601); using 'list_tools' for keepalive on "
-                    "this connection.",
-                    self.name,
-                )
 
         # Fallback probe for servers without ping support.
         await asyncio.wait_for(self.session.list_tools(), timeout=30.0)
@@ -4451,7 +4481,7 @@ class MCPServerTask:
         from tools.registry import registry
 
         for tool_name in list(getattr(self, "_registered_tool_names", [])):
-            registry.deregister(tool_name)
+            registry.deregister(tool_name, scope=_server_registry_scope(self.name))
             _forget_mcp_tool_server(tool_name)
         self._registered_tool_names = []
 
@@ -4479,6 +4509,10 @@ class MCPServerTask:
 # ---------------------------------------------------------------------------
 
 _servers: Dict[str, MCPServerTask] = {}
+# Profile registry scope that owns each live connection (None outside
+# multiplex). A multiplexed /reload-mcp tears down only its own profile's
+# servers; process shutdown still takes everything.
+_server_scope_keys: Dict[str, Optional[str]] = {}
 _server_connecting: set[str] = set()
 _server_connect_errors: Dict[str, str] = {}
 # Lazy MCP startup (#56832): servers whose tools were registered from the
@@ -5234,6 +5268,123 @@ def _handle_session_expired_and_retry(
     return None
 
 
+class _StdioChildExited(RuntimeError):
+    """A server's stdio subprocess was gone when (or while) a call ran.
+
+    Deliberately NOT a TimeoutError: nothing timed out — the child was
+    already dead, usually because a gateway restart killed every MCP stdio
+    subprocess out from under a still-live agent session. The old wording
+    ("failing the call fast instead of waiting 300s") sent an investigation
+    into the remote server for an afternoon; the server was healthy.
+
+    Handled by :func:`_handle_stdio_child_exited_and_retry`, which respawns
+    and retries the call once before any error reaches the model.
+    """
+
+
+def _handle_stdio_child_exited_and_retry(
+    server_name: str,
+    exc: Exception,
+    retry_call,
+    op_description: str,
+):
+    """Respawn a dead stdio child and retry the call once.
+
+    A gateway restart kills every MCP stdio subprocess. An agent session that
+    outlives the restart still holds the dead child, so its next tool call
+    used to fail in 0.00s — before anything reached the network — while the
+    subprocess was respawned seconds later. Cron runs spanning a restart lost
+    tool calls this way, silently.
+
+    Why retrying here cannot hot-cycle respawns: this function never spawns
+    anything. It sets ``_reconnect_event`` (one signal, same as before) and
+    waits for the server task to publish a fresh session. Spawn frequency
+    stays governed entirely by ``run()``'s rapid-drop budget, which parks a
+    transport that keeps dropping without proving healthy (#62212). The retry
+    is single-shot: a child that dies again immediately reports and stops,
+    so a genuinely broken server converges on the park instead of looping.
+
+    Returns:
+        A JSON string when this was a dead-stdio failure (retry result, or a
+        clean error), or ``None`` when ``exc`` is something else and the
+        caller should use its generic error path.
+    """
+    if not isinstance(exc, _StdioChildExited):
+        return None
+
+    with _lock:
+        srv = _servers.get(server_name)
+
+    reconnected = False
+    if srv is not None and hasattr(srv, "_reconnect_event"):
+        logger.info(
+            "MCP server '%s': %s found the stdio subprocess dead (%s); "
+            "respawning and retrying once.",
+            server_name, op_description, exc,
+        )
+        loop = _mcp_loop
+        if loop is not None and loop.is_running():
+            reconnected = _signal_reconnect_and_wait(
+                server_name,
+                srv,
+                op_description=op_description,
+                timeout=_STDIO_RESPAWN_WAIT_SEC,
+            )
+        else:
+            # No MCP loop to wait on (non-async adapters, tests) — still ask
+            # for the respawn so the next call lands on a live transport.
+            _signal_reconnect(srv)
+
+    if reconnected:
+        try:
+            result = retry_call()
+        except _StdioChildExited as retry_exc:
+            # Respawned and died again straight away: this is a broken
+            # server, not a restart artifact. Stop here — run()'s budget
+            # takes it to the park.
+            logger.warning(
+                "MCP server '%s': %s stdio subprocess exited again right "
+                "after respawn (%s); not retrying further.",
+                server_name, op_description, retry_exc,
+            )
+            _bump_server_error(server_name)
+            return tool_error(
+                f"MCP server '{server_name}' respawned its stdio subprocess "
+                f"and it exited again immediately. The server is not "
+                f"starting cleanly — do NOT retry this tool; ask the user to "
+                f"check the server's command and its stderr log."
+            )
+        except Exception as retry_exc:
+            logger.warning(
+                "MCP %s/%s retry after stdio respawn failed: %s",
+                server_name, op_description, retry_exc,
+            )
+            _bump_server_error(server_name)
+            return tool_error(_sanitize_error(
+                f"MCP call failed after respawning the stdio subprocess for "
+                f"'{server_name}': {type(retry_exc).__name__}: "
+                f"{_exc_str(retry_exc)}"
+            ))
+        try:
+            parsed = json.loads(result)
+            if "error" not in parsed:
+                _reset_server_error(server_name)
+            else:
+                _bump_server_error(server_name)
+        except (json.JSONDecodeError, TypeError):
+            _reset_server_error(server_name)
+        return result
+
+    _bump_server_error(server_name)
+    return tool_error(
+        f"MCP server '{server_name}' stdio subprocess had exited (this is "
+        f"not a timeout — the call never reached the server). A respawn was "
+        f"requested but no fresh session came back within "
+        f"{_STDIO_RESPAWN_WAIT_SEC:.0f}s. Wait a few seconds before retrying; "
+        f"if it keeps failing the server is not starting and needs the user."
+    )
+
+
 # Exact raw server names whose ``supports_parallel_tool_calls`` config is True.
 # Raw identity matters: distinct names such as ``foo-bar`` and ``foo_bar`` both
 # sanitize to ``foo_bar`` but must not share policy.
@@ -5253,6 +5404,36 @@ _mcp_thread: Optional[threading.Thread] = None
 # _parallel_safe_servers, _mcp_tool_server_names, and _stdio_pids.
 _lock = threading.Lock()
 
+
+def _mcp_registry_scope() -> Optional[str]:
+    """Registry scope owning MCP registrations made from the current context.
+
+    Under a profile multiplexer each profile's MCP tools live in that
+    profile's registry overlay (the same overlay its plugins use) so two
+    profiles' servers never share one process-global slot. Single-profile
+    processes keep MCP tools process-global (``None``).
+    """
+    from agent.secret_scope import is_multiplex_active
+
+    if not is_multiplex_active():
+        return None
+    from tools.registry import registry
+
+    return registry.current_scope_key()
+
+
+def _server_registry_scope(name: str) -> Optional[str]:
+    """Scope owning server *name*'s tools: recorded at connect, else current.
+
+    Teardown paths run on the MCP loop (process exit, reconnect exhaustion),
+    which does not carry the discovering profile's context, so the scope
+    captured when the server was adopted into ``_servers`` is authoritative.
+    """
+    if name in _server_scope_keys:
+        return _server_scope_keys[name]
+    return _mcp_registry_scope()
+
+
 # ---------------------------------------------------------------------------
 # Cross-process MCP discovery guard
 # ---------------------------------------------------------------------------
@@ -5410,11 +5591,26 @@ def _snapshot_child_pids() -> set:
     """
     my_pid = os.getpid()
 
-    # Linux: read from /proc
+    # Linux: read from /proc. ``/proc/<pid>/task/<tid>/children`` is
+    # per-THREAD — a child forked from thread T is listed only under T's
+    # task dir. stdio_client() spawns from the background MCP loop thread,
+    # so reading only the main thread's file (``task/<pid>/children``)
+    # returned an empty set on every Linux install and left
+    # ``_stdio_child_pids`` / ``_stdio_pids`` empty: the #81995 dead-child
+    # fast-fail, the #96452 respawn signal, and the killpg shutdown sweep
+    # never saw the subprocess. Union the children of every task instead.
     try:
-        children_path = f"/proc/{my_pid}/task/{my_pid}/children"
-        with open(children_path, encoding="utf-8") as f:
-            return {int(p) for p in f.read().split() if p.strip()}
+        task_dir = f"/proc/{my_pid}/task"
+        tids = os.listdir(task_dir)
+        found: set = set()
+        for tid in tids:
+            try:
+                with open(f"{task_dir}/{tid}/children", encoding="utf-8") as f:
+                    found.update(int(p) for p in f.read().split() if p.strip())
+            except (FileNotFoundError, OSError, ValueError):
+                # Thread exited between listdir and open — skip it.
+                continue
+        return found
     except (FileNotFoundError, OSError, ValueError):
         pass
 
@@ -5969,7 +6165,7 @@ def _ensure_lazy_server_connected(server_name: str) -> bool:
         from tools.registry import registry
 
         for tool_name in phantom_names:
-            registry.deregister(tool_name)
+            registry.deregister(tool_name, scope=_server_registry_scope(server_name))
             _forget_mcp_tool_server(tool_name)
         logger.info(
             "MCP server '%s': deregistered %d phantom cached tool(s) not "
@@ -6166,27 +6362,19 @@ def _make_tool_handler(server_name: str, tool_name: str, tool_timeout: float):
                         and _stdio_dead_result
                     ):
                         # Dead children but stale server.session, so the
-                        # transport-down path above never fired — signal the
-                        # server task to respawn and return a clean
-                        # reconnecting error. No explicit _bump_server_error:
-                        # the error return flows through the handler's JSON
-                        # parse, which already bumps once.
-                        if _signal_reconnect(server):
-                            return tool_error(
-                                f"MCP server '{server_name}' stdio subprocess is "
-                                f"dead and reconnect was requested. Do NOT retry "
-                                f"immediately — give it a few seconds to respawn."
-                            )
-                        raise TimeoutError(
-                            f"MCP stdio subprocess for '{server_name}' has "
-                            f"exited; failing the call fast instead of "
-                            f"waiting {float(tool_timeout):.0f}s"
+                        # transport-down path above never fired. Hand this to
+                        # the handler's respawn-and-retry path —
+                        # it is not a timeout, and a gateway restart that
+                        # killed the child must not cost the caller a call.
+                        raise _StdioChildExited(
+                            f"MCP stdio subprocess for '{server_name}' had "
+                            f"already exited when the call was dispatched"
                         )
                     _call_coro = server.session.call_tool(tool_name, arguments=args)
                     _watch_children = getattr(server, "_watch_stdio_children", None)
                     _watch_ok = (
                         _watch_children is not None
-                        and inspect.isawaitable(_watch_children())
+                        and inspect.iscoroutinefunction(_watch_children)
                         and asyncio.iscoroutine(_call_coro)
                     )
                     if not _watch_ok:
@@ -6216,16 +6404,13 @@ def _make_tool_handler(server_name: str, tool_name: str, tool_timeout: float):
                                 # Same stale-session problem as the pre-call
                                 # gate above: the subprocess died mid-call but
                                 # nothing clears server.session, so without a
-                                # reconnect signal the server would stay dead
-                                # until the idle keepalive probe notices.
-                                _signal_reconnect(server)
-                                raise TimeoutError(
-                                    f"MCP stdio subprocess for '{server_name}' "
-                                    f"exited mid-call; failing the call fast "
-                                    f"instead of waiting "
-                                    f"{float(tool_timeout):.0f}s; reconnect "
-                                    f"requested — give it a few seconds to "
-                                    f"respawn before retrying"
+                                # reconnect the server would stay dead until
+                                # the idle keepalive probe notices. The
+                                # handler's respawn-and-retry path owns the
+                                # reconnect signal.
+                                raise _StdioChildExited(
+                                    f"MCP stdio subprocess for "
+                                    f"'{server_name}' exited mid-call"
                                 )
                             result = await rpc_task
                         finally:
@@ -6385,6 +6570,16 @@ def _make_tool_handler(server_name: str, tool_name: str, tool_timeout: float):
         except InterruptedError:
             return _interrupted_call_result()
         except Exception as exc:
+            # Dead stdio child: respawn and retry once before any
+            # error reaches the model — a gateway restart kills every MCP
+            # subprocess, and the call it lands on is not really a failure.
+            recovered = _handle_stdio_child_exited_and_retry(
+                server_name, exc, _call_once,
+                f"tools/call {tool_name}",
+            )
+            if recovered is not None:
+                return recovered
+
             # Auth-specific recovery path: consult the manager, signal
             # reconnect if viable, retry once. Returns None to fall
             # through for non-auth exceptions.
@@ -7362,6 +7557,7 @@ def _register_server_tools(name: str, server: MCPServerTask, config: dict) -> Li
             check_fn=candidate["check_fn"],
             is_async=False,
             description=candidate["schema"]["description"],
+            scope=_server_registry_scope(name),
         )
 
         # The pre-check above is advisory only. Multiple servers connect in
@@ -7519,6 +7715,7 @@ def _register_from_cache_sync(name: str, config: dict, entry: dict) -> List[str]
             check_fn=check_fn,
             is_async=False,
             description=schema["description"],
+            scope=_mcp_registry_scope(),
         )
         if registry.get_toolset_for_tool(registry_name) != toolset_name:
             continue
@@ -7552,6 +7749,7 @@ def _register_from_cache_sync(name: str, config: dict, entry: dict) -> List[str]
             check_fn=check_fn,
             is_async=False,
             description=schema.get("description") or "",
+            scope=_mcp_registry_scope(),
         )
         if registry.get_toolset_for_tool(util_name) != toolset_name:
             continue
@@ -7609,6 +7807,7 @@ async def _discover_and_register_server(name: str, config: dict) -> List[str]:
             # self-probe, so adopt it into the registry for shutdown/revival.
             with _lock:
                 _servers[name] = server
+                _server_scope_keys[name] = _mcp_registry_scope()
         elif server is not None:
             await server.shutdown()
         raise
@@ -7619,6 +7818,7 @@ async def _discover_and_register_server(name: str, config: dict) -> List[str]:
         _server_connecting.discard(name)
         _server_connect_errors.pop(name, None)
         _servers[name] = server
+        _server_scope_keys[name] = _mcp_registry_scope()
 
     registered_names = _register_server_tools(name, server, config)
     server._registered_tool_names = list(registered_names)
@@ -8144,6 +8344,7 @@ def refresh_agent_mcp_tools(
     disabled_override=None,
     quiet_mode: bool = True,
     content_aware: bool = False,
+    preserve_prefix: bool = False,
 ) -> set:
     """Re-derive an already-built agent's tool snapshot from the live registry.
 
@@ -8172,6 +8373,22 @@ def refresh_agent_mcp_tools(
     under ``_agent_tools_lock`` so a concurrent reader never sees a
     cross-attribute half-swap.
 
+    ``preserve_prefix`` is for the callers that rebuild inside a live
+    conversation (the between-turns prologue).  There the tool array is a
+    cached request prefix: every provider that renders ``tools`` ahead of the
+    messages re-prefills the entire history behind any byte that moves.  A
+    plain rebuild moves two kinds of bytes — it drops a tool whose ``check_fn``
+    merely flapped (a headless browser probe, an expired credential, a docker
+    blip), and it splices a late-landing tool into sorted position, which can
+    be index 0.  With ``preserve_prefix`` the live order is authoritative:
+    existing tools keep their slot (schemas still refresh), a tool that is
+    still *registered* but momentarily unavailable is carried forward, a tool
+    that genuinely left the registry is still dropped, and new tools are
+    appended at the tail so the prefix only ever grows.  Carrying an
+    unavailable tool forward changes nothing about dispatch — ``check_fn``
+    gates exposure at snapshot time, never invocation, and every handler
+    already owns its own unavailability error.
+
     Returns the set of newly-added tool names (empty when nothing changed), so
     callers can decide whether to notify the user / re-emit session info.  The
     caller owns the prompt-cache contract: this helper does NOT check turn state,
@@ -8227,6 +8444,18 @@ def refresh_agent_mcp_tools(
     # this rebuild actually appended (matching agent_init's dedup-aware add).
     staged_engine_names = _reinject_post_build_tools(agent, new_defs, new_names)
 
+    # Snapshot registry membership OUTSIDE ``_agent_tools_lock`` — it is the
+    # only input ``preserve_prefix`` needs beyond the two tool lists, and
+    # taking ``registry._lock`` under the tools lock would be the first place
+    # in the process to nest those two.
+    registered_names: set = set()
+    if preserve_prefix:
+        try:
+            registered_names = {entry.name for entry in registry.get_all_entries()}
+        except Exception:  # noqa: BLE001
+            # Fail open to the plain rebuild rather than pinning a stale list.
+            preserve_prefix = False
+
     # Single atomic read-diff-publish so the returned ``added`` is consistent
     # with what was actually published, even under concurrent callers, and a
     # stale (older-generation) rebuild can't overwrite a newer published one.
@@ -8240,10 +8469,12 @@ def refresh_agent_mcp_tools(
         if snapshot_generation < published_gen:
             # A newer snapshot already won; our set is stale — drop it.
             return set()
-        current = {
-            t["function"]["name"]
-            for t in (getattr(agent, "tools", None) or [])
-        }
+        current_defs = list(getattr(agent, "tools", None) or [])
+        current = {t["function"]["name"] for t in current_defs}
+        if preserve_prefix:
+            new_defs, new_names = _merge_preserving_prefix(
+                current_defs, new_defs, registered_names,
+            )
         if new_names == current:
             # Same NAME set. For MCP-reload callers that is "no change" —
             # leave the live snapshot untouched (no churn). Content-aware
@@ -8278,7 +8509,117 @@ def refresh_agent_mcp_tools(
             engine_names.clear()
             engine_names.update(staged_engine_names)
         agent._tool_snapshot_generation = max(published_gen, snapshot_generation)
-        return new_names - current
+        added = new_names - current
+    # Every published snapshot re-pins the session's tool order so a later
+    # rebuild-for-existing-session (gateway agent-cache eviction) restores
+    # exactly these names — see ``restore_agent_tool_prefix``.
+    persist_agent_tool_names(agent)
+    return added
+
+
+def reprobe_tool_availability() -> None:
+    """Explicit ``/reload-mcp`` hatch out of the tools[] freeze.
+
+    Availability-gated tools (``check_fn``: Docker, HASS_TOKEN, OAuth…) are
+    frozen for the life of a session; a credential or daemon that appears
+    mid-session is only picked up when the user consciously asks. Drop the
+    ``check_fn`` verdict cache AND the ``get_tool_definitions`` memo (keyed on
+    registry generation, so it would otherwise replay the stale verdicts).
+    """
+    from model_tools import _clear_tool_defs_cache
+    from tools.registry import invalidate_check_fn_cache
+
+    invalidate_check_fn_cache()
+    _clear_tool_defs_cache()
+
+
+def persist_agent_tool_names(agent) -> None:
+    """Best-effort: write ``agent.tools`` names to the session row (freeze pin)."""
+    db = getattr(agent, "_session_db", None)
+    session_id = getattr(agent, "session_id", None)
+    if not db or not session_id:
+        return
+    try:
+        db.update_session_tool_names(
+            session_id,
+            [t["function"]["name"] for t in (getattr(agent, "tools", None) or [])],
+        )
+    except Exception:  # noqa: BLE001
+        logger.debug("tool_names persist skipped", exc_info=True)
+
+
+def restore_agent_tool_prefix(agent, saved_names: list) -> bool:
+    """Fold a freshly built agent's ``tools`` onto the session's saved order.
+
+    Closes the second door on the tools[] freeze: the gateway rebuilds a NEW
+    ``AIAgent`` for an existing session after agent-cache eviction, and
+    ``agent_init`` re-derives ``agent.tools`` from live ``check_fn`` probes
+    with no predecessor to preserve. The saved name list stands in for that
+    predecessor: a saved tool that is still registered but failed its probe
+    this time is carried forward from the registry's schema, a deregistered
+    one is dropped, and genuinely new tools append at the tail — the same
+    ``_merge_preserving_prefix`` rule the between-turns refresh uses.
+    Returns True when the snapshot was changed.
+    """
+    if not saved_names:
+        return False
+    from tools.registry import registry
+
+    fresh_defs = list(getattr(agent, "tools", None) or [])
+    fresh = {t["function"]["name"]: t for t in fresh_defs}
+    saved_defs = []
+    for name in saved_names:
+        entry_def = fresh.get(name)
+        if entry_def is None:
+            entry = registry.get_entry(name)
+            if entry is None:
+                continue
+            entry_def = {"type": "function", "function": {**entry.schema, "name": entry.name}}
+        saved_defs.append(entry_def)
+    registered_names = {entry.name for entry in registry.get_all_entries()}
+    merged, merged_names = _merge_preserving_prefix(saved_defs, fresh_defs, registered_names)
+    with _agent_tools_lock:
+        if merged == fresh_defs:
+            return False
+        agent.tools = merged
+        agent.valid_tool_names = merged_names
+    if [t["function"]["name"] for t in merged] != list(saved_names):
+        persist_agent_tool_names(agent)
+    return True
+
+
+def _merge_preserving_prefix(
+    current_defs: list, new_defs: list, registered_names: set,
+) -> tuple[list, set]:
+    """Fold a fresh tool snapshot into a live one without moving existing bytes.
+
+    The live tool array is a cached request prefix, so the merge is ordered by
+    ``current_defs``, not by the fresh list:
+
+    * a name in both keeps its slot and takes the fresh schema (dynamic
+      overrides — delegate_task limits, execute_code stubs — still land);
+    * a name only in the live list is carried forward when it is still
+      registered (its ``check_fn`` flapped) and dropped when it is not (the
+      MCP server or plugin genuinely went away);
+    * a name only in the fresh list is appended at the tail, so a late-landing
+      MCP tool extends the prefix instead of splicing into sorted position.
+    """
+    fresh = {}
+    for entry in new_defs:
+        name = (entry.get("function") or {}).get("name", "")
+        if name:
+            fresh[name] = entry
+
+    merged = []
+    for entry in current_defs:
+        name = (entry.get("function") or {}).get("name", "")
+        replacement = fresh.pop(name, None)
+        if replacement is not None:
+            merged.append(replacement)
+        elif name and name in registered_names:
+            merged.append(entry)
+    merged.extend(fresh.values())
+    return merged, {(t.get("function") or {}).get("name", "") for t in merged}
 
 
 def _reinject_post_build_tools(agent, tools_list: list, name_set: set) -> set:
@@ -8350,15 +8691,24 @@ def _reinject_post_build_tools(agent, tools_list: list, name_set: set) -> set:
     return staged_engine_names
 
 
-def shutdown_mcp_servers():
-    """Close all MCP server connections and stop the background loop.
+def shutdown_mcp_servers(*, scope: Optional[str] = None):
+    """Close MCP server connections and stop the background loop.
 
     Each server Task is signalled to exit its ``async with`` block so that
     the anyio cancel-scope cleanup happens in the same Task that opened it.
     All servers are shut down in parallel via ``asyncio.gather``.
+
+    ``scope`` (a registry scope key) restricts teardown to the servers one
+    multiplexed profile owns — its ``/reload-mcp`` must not kill the other
+    profiles' connections — and leaves the shared loop running when anything
+    else is still connected. Without it every server goes, as before.
     """
     with _lock:
-        servers_snapshot = list(_servers.values())
+        selected = [
+            name for name in _servers
+            if scope is None or _server_scope_keys.get(name) == scope
+        ]
+        servers_snapshot = [_servers[name] for name in selected]
 
     # Fast path: nothing to shut down. The connect-cooldown maps can still
     # be populated here — a server that failed to connect is never recorded
@@ -8370,7 +8720,7 @@ def shutdown_mcp_servers():
         with _lock:
             _server_connect_retry_after.clear()
             _server_connect_failures.clear()
-        _stop_mcp_loop()
+        _stop_mcp_loop(only_if_idle=scope is not None)
         return
 
     async def _shutdown():
@@ -8384,7 +8734,9 @@ def shutdown_mcp_servers():
                     "Error closing MCP server '%s': %s", server.name, result,
                 )
         with _lock:
-            _servers.clear()
+            for name in selected:
+                _servers.pop(name, None)
+                _server_scope_keys.pop(name, None)
             # Drop connect-retry cooldowns too: a full shutdown/restart
             # should re-attempt every server immediately, not honour a
             # stale per-server backoff from before the restart (#50394).
@@ -8414,7 +8766,7 @@ def shutdown_mcp_servers():
         _server_connect_retry_after.clear()
         _server_connect_failures.clear()
 
-    _stop_mcp_loop()
+    _stop_mcp_loop(only_if_idle=scope is not None)
 
 
 def _kill_orphaned_mcp_children(
diff --git a/tools/preview_tool.py b/tools/preview_tool.py
index 2c2181a39e..e3890c02d3 100644
--- a/tools/preview_tool.py
+++ b/tools/preview_tool.py
@@ -50,7 +50,7 @@ def _handle_preview(args, **kw):
 PREVIEW_SCHEMA = {
     "name": "desktop_preview",
     "description": (
-        "The preview pane beside the chat in the Hermes desktop app. open: show "
+        "Open, close, or read the preview pane beside the chat. open: show "
         "a web URL (bare domains fine), a localhost dev server, or a file path "
         "(HTML renders live) — opens for the current window only. close: dismiss "
         "the whole pane, or one tab via url. read: what the pane currently shows "
diff --git a/tools/process_registry.py b/tools/process_registry.py
index 2c785027ac..a2314ee47e 100644
--- a/tools/process_registry.py
+++ b/tools/process_registry.py
@@ -3366,13 +3366,14 @@ def format_process_notification(evt: dict) -> "str | None":
 from tools.registry import registry, tool_error
 
 PROCESS_SCHEMA = {
-    "name": "process",
+    "name": "process_manage",
     # Dieted (#95681): the action enum names the verbs; the description
     # keeps only non-obvious semantics. write-vs-submit is the tool's one
     # real trap (a lone \n on a Windows PTY is not a line terminator) —
     # that teaching gains emphasis rather than losing it.
     "description": (
-        "Manage background processes started with terminal(background=true). "
+        "Poll, wait on, or kill background terminal processes (from "
+        "terminal(background=true)). "
         "poll: status + new output. log: full output, paged. wait: block "
         "until exit or timeout (partial output on timeout). write vs "
         "submit: submit appends Enter — use it to answer prompts; write "
@@ -3487,7 +3488,7 @@ def _handle_process(args, **kw):
 
 
 registry.register(
-    name="process",
+    name="process_manage",
     toolset="terminal",
     schema=PROCESS_SCHEMA,
     handler=_handle_process,
diff --git a/tools/project_tools.py b/tools/project_tools.py
index dc4642a0ba..e7ff1fc90b 100644
--- a/tools/project_tools.py
+++ b/tools/project_tools.py
@@ -160,7 +160,7 @@ registry.register(
     schema={
         "name": "desktop_project",
         "description": (
-            "Desktop Projects (named workspaces). create: make one and switch "
+            "Create or switch desktop Projects (named workspaces). create: one and switch "
             "this chat into it — pass path to anchor it to a repo/folder (the "
             "chat's workspace moves there, the sidebar follows). switch: move "
             "this chat into an existing project by name/slug/id — the "
diff --git a/tools/registry.py b/tools/registry.py
index bf6d52f2ee..921f188667 100644
--- a/tools/registry.py
+++ b/tools/registry.py
@@ -348,8 +348,33 @@ def check_fn_cache_scope() -> Optional[str]:
 
 def _run_check_fn_uncached(fn: Callable, *, unresolved_scope: bool = False) -> bool:
     """Run an availability check without cache/grace handling."""
+    from agent.secret_scope import UnscopedSecretError
+
     try:
         return bool(fn())
+    except UnscopedSecretError:
+        if unresolved_scope:
+            # Expected fail-closed probe: with multiplexing on, boot-time
+            # check_fns run before any profile secret scope exists, so
+            # get_secret raises by design. The tool re-probes on the first
+            # scoped turn — log without a traceback so this cannot be
+            # mistaken for a crashed check_fn (#100697).
+            logger.debug(
+                "check_fn %s hit the multiplex fail-closed path with no "
+                "profile secret scope active; dependent tools re-probe on "
+                "the first scoped turn",
+                getattr(fn, "__qualname__", fn),
+            )
+            return False
+        # The scope resolved but the read still failed closed: a genuinely
+        # lost scope. Keep the loud crash-style report.
+        logger.warning(
+            "check_fn %s raised UnscopedSecretError while the profile cache "
+            "scope was resolved; dependent tools will be unavailable this turn",
+            getattr(fn, "__qualname__", fn),
+            exc_info=True,
+        )
+        return False
     except Exception:
         detail = " while profile cache scope was unresolved" if unresolved_scope else ""
         logger.warning(
@@ -881,13 +906,18 @@ class ToolRegistry:
                 self._toolset_checks[toolset] = check_fn
             self._generation += 1
 
-    def deregister(self, name: str) -> None:
+    def deregister(self, name: str, *, scope: Optional[str] = None) -> None:
         """Remove a tool from the registry.
 
         Also cleans up the toolset check if no other tools remain in the
         same toolset.  Used by MCP dynamic tool discovery to nuke-and-repave
         when a server sends ``notifications/tools/list_changed``.
 
+        ``scope`` selects a profile overlay explicitly (multiplexed MCP tools
+        live in the owning profile's overlay). Plugin callers keep their own
+        scope and may not name another one; non-plugin callers without
+        ``scope`` keep the historical process-global target.
+
         Gated by the same operator opt-in policy ``register(override=True)``
         enforces. Without this, a plugin could bypass that gate entirely by
         deregistering a tool it doesn't own and then calling plain
@@ -905,14 +935,21 @@ class ToolRegistry:
                 if caller_owner is not None
                 else None
             )
+            if caller_owner is not None and scope is not None and scope != caller_scope:
+                raise PermissionError(
+                    f"Plugin module {caller_mod!r} cannot deregister tools "
+                    "outside its own profile scope."
+                )
+            if scope is None:
+                scope = caller_scope
             target = (
-                self._scoped_tools.get(caller_scope, {})
-                if caller_scope is not None
+                self._scoped_tools.get(scope, {})
+                if scope is not None
                 else self._tools
             )
             entry = target.get(name)
-            if entry is None and caller_scope is not None:
-                if name in self._tools:
+            if entry is None and scope is not None:
+                if caller_owner is not None and name in self._tools:
                     raise PermissionError(
                         f"Scoped plugin module {caller_mod!r} cannot deregister "
                         f"process-global tool {name!r}; register a scoped "
@@ -952,13 +989,13 @@ class ToolRegistry:
                         f"opt-in (allow_tool_override)."
                     )
             del target[name]
-            if caller_scope is not None and not target:
-                self._scoped_tools.pop(caller_scope, None)
+            if scope is not None and not target:
+                self._scoped_tools.pop(scope, None)
             # Drop the toolset check and aliases if this was the last tool in
             # that toolset.
             toolset_still_exists = any(
                 e.toolset == entry.toolset
-                for e in self._merged_tools(caller_scope).values()
+                for e in self._merged_tools(scope).values()
             )
             if not toolset_still_exists:
                 self._toolset_checks.pop(entry.toolset, None)
diff --git a/tools/session_search_tool.py b/tools/session_search_tool.py
index 865e7f7e6c..f2daafeaf1 100644
--- a/tools/session_search_tool.py
+++ b/tools/session_search_tool.py
@@ -1146,7 +1146,7 @@ def check_session_search_requirements() -> bool:
 SESSION_SEARCH_SCHEMA = {
     "name": "session_search",
     "description": (
-        "Search past Hermes sessions (FTS5 over the local session DB), or read/"
+        "Recall past conversations: search or read old Hermes sessions (FTS5), or "
         "scroll inside one. Four shapes, picked by args: `query` = discovery "
         "(top-N matching sessions, top result fully hydrated); `session_id` + "
         "`around_message_id` = scroll (window of messages around an anchor); "
diff --git a/tools/terminal_scope.py b/tools/terminal_scope.py
new file mode 100644
index 0000000000..da79538ab7
--- /dev/null
+++ b/tools/terminal_scope.py
@@ -0,0 +1,298 @@
+"""Per-turn terminal scope: profile-scoped TERMINAL_* policy.
+
+The multiplexing gateway (and the unified dashboard/TUI, and cron) serve
+several Hermes profiles from one process. Terminal settings were historically
+mirrored into the process-global ``os.environ`` (first writer wins), so the
+first profile to touch the terminal after startup pinned its backend — and
+every other setting — onto all later turns: a ``local`` profile silently
+executing inside another profile's docker sandbox, or the reverse (a sandbox
+escape). Mirrors the isolation seam that ``agent/secret_scope.py`` provides
+for credentials: a ContextVar holds the active profile's COMPLETE effective
+``TERMINAL_*`` policy, installed at each in-process profile boundary.
+
+Two contracts distinguish this from a plain override dict:
+
+- **Authoritative projection.** While a scope is bound, ``terminal_env``
+  resolves ONLY from that policy (built from defined defaults + the profile's
+  ``.env`` + its ``config.yaml`` explicit keys). Omitted keys resolve to the
+  defined default — never to ambient ``os.environ`` — so a routed profile can
+  neither inherit nor be escaped onto the launch process's mounts, SSH
+  targets, or resource policy (#68559).
+- **Fail closed.** If the profile's policy cannot be resolved (unreadable or
+  malformed ``.env``/``config.yaml``), the install raises
+  :class:`TerminalPolicyUnavailable` and callers must install a *refusal*
+  scope; terminal execution under a refusal scope is rejected outright
+  rather than falling back to ambient authority.
+"""
+
+from __future__ import annotations
+
+import logging
+from contextlib import contextmanager
+from contextvars import ContextVar, Token
+from pathlib import Path
+from typing import Any, Dict, Iterator, Optional
+
+logger = logging.getLogger(__name__)
+
+# ``None`` = no scope bound in this context; readers use the historical
+# process-env behavior (single-process CLI/TUI, unaffected surfaces).
+# A dict = the active profile's complete effective terminal policy.
+# A TerminalPolicyRefusal = resolution failed; terminal execution must refuse.
+_terminal_scope_var: ContextVar = ContextVar("hermes_terminal_scope", default=None)
+
+
+class TerminalPolicyUnavailable(Exception):
+    """The routed profile's terminal policy could not be resolved.
+
+    Raised when the profile's ``.env`` or ``config.yaml`` exists but cannot be
+    read/parsed. Callers must install the returned refusal scope instead of
+    continuing without a scope — executing under ambient process authority is
+    exactly the leak this module exists to close.
+    """
+
+
+class TerminalPolicyRefusal(Dict[str, str]):
+    """Marker scope installed when policy resolution failed.
+
+    An (empty) dict subclass so existing dict-typed checks keep working, with
+    a flag that makes ``terminal_env`` raise before any value is served.
+    """
+
+    refused = True
+
+    def __init__(self, reason: str) -> None:
+        super().__init__()
+        self.reason = reason
+
+
+def set_terminal_scope(mapping: Optional[Dict[str, str]]) -> Token:
+    """Install *mapping* as the current context's terminal policy."""
+    return _terminal_scope_var.set(mapping)
+
+
+def install_refusal_scope(reason: str) -> Token:
+    """Install a refusal scope after :class:`TerminalPolicyUnavailable`.
+
+    Terminal execution under this scope is rejected (fail closed) instead of
+    running under the launch process's ambient policy.
+    """
+    return _terminal_scope_var.set(TerminalPolicyRefusal(reason))
+
+
+def reset_terminal_scope(token: Token) -> None:
+    _terminal_scope_var.reset(token)
+
+
+def get_terminal_scope() -> Optional[Dict[str, str]]:
+    """The active scope mapping/refusal, or ``None`` when no scope is bound."""
+    return _terminal_scope_var.get()
+
+
+@contextmanager
+def terminal_scope(mapping: Optional[Dict[str, str]]) -> Iterator[None]:
+    """Context manager form of set/reset_terminal_scope."""
+    token = set_terminal_scope(mapping)
+    try:
+        yield
+    finally:
+        reset_terminal_scope(token)
+
+
+def terminal_env(name: str, default: str = "") -> str:
+    """Authoritative read of a ``TERMINAL_*`` variable.
+
+    - No scope bound: process env, then *default* (historical single-process
+      behavior — CLI/TUI surfaces that never route profiles are unchanged).
+    - Refusal scope bound: raise — policy is unavailable and execution must
+      fail closed, not fall back to ambient authority.
+    - Policy scope bound: resolve ONLY from the policy; a missing key yields
+      the *default* (which callers derive from defined defaults), never
+      ``os.environ``.
+    """
+    scope = _terminal_scope_var.get()
+    if scope is None:
+        import os
+
+        return os.environ.get(name, default)
+    if isinstance(scope, TerminalPolicyRefusal):
+        raise TerminalPolicyUnavailable(
+            f"terminal policy unavailable for this profile: {scope.reason}"
+        )
+    value = scope.get(name)
+    if value is not None:
+        return str(value)
+    return default
+
+
+def build_profile_terminal_scope(hermes_home: "Any") -> Dict[str, str]:
+    """Build the COMPLETE effective ``TERMINAL_*`` policy for a profile home.
+
+    Projection order: defined defaults (``DEFAULT_CONFIG['terminal']``) ← the
+    profile's ``.env`` TERMINAL_* selections ← its ``config.yaml`` explicit
+    ``terminal:`` keys. The result is total: every key the terminal stack can
+    ask for resolves from this mapping, so a bound scope never widens back to
+    ambient process authority. Raises :class:`TerminalPolicyUnavailable` when
+    either file exists but cannot be read/parsed (fail closed).
+    """
+    home = Path(hermes_home)
+
+    from hermes_cli.config_defaults import DEFAULT_CONFIG
+
+    defaults = DEFAULT_CONFIG.get("terminal") if isinstance(
+        DEFAULT_CONFIG, dict) else None
+    defaults = dict(defaults) if isinstance(defaults, dict) else {}
+    # Terminal keys whose env mirror exists but whose config default lives in
+    # the consuming tool rather than DEFAULT_CONFIG. These are the documented
+    # tool-level defaults (tools/terminal_tool.py); without them the
+    # projection would not be total and reads could observe nothing (which is
+    # correct) OR fall back ambiently (which is not).
+    defaults.setdefault("cwd", ".")           # per-surface placeholder
+    defaults.setdefault("ssh_host", "")       # remote backends: unset = none
+    defaults.setdefault("ssh_user", "")
+    defaults.setdefault("ssh_port", 22)
+    defaults.setdefault("ssh_key", "")
+    defaults.setdefault("docker_orphan_reaper", True)
+    defaults.setdefault("docker_persist_across_processes", True)
+    defaults.setdefault("sandbox_dir", "")    # tool derives HERMES_HOME path
+    defaults.setdefault("lifetime_seconds", 300)
+    defaults.setdefault("docker_shared_container_key", "")
+    defaults.setdefault("home_mode", "auto")
+
+    scope: Dict[str, str] = {}
+
+    def _apply(cfg_key: str, value: Any) -> None:
+        if value is None:
+            return
+        # cwd placeholders (".", "auto", "cwd") are resolved per-surface
+        # later; they are not a policy value.
+        if cfg_key == "cwd" and str(value).strip() in {".", "auto", "cwd"}:
+            return
+        from hermes_cli.config import TERMINAL_CONFIG_ENV_MAP
+
+        env_var = TERMINAL_CONFIG_ENV_MAP.get(cfg_key)
+        if env_var:
+            scope[env_var] = str(value)
+
+    # 1) Defined defaults — the total baseline.
+    for cfg_key, value in defaults.items():
+        _apply(cfg_key, value)
+
+    # 2) The profile's .env TERMINAL_* selections. Fail closed on unreadable
+    #    files (missing file = no selections, fine).
+    env_path = home / ".env"
+    if env_path.exists():
+        # Pre-flight readability: load_env_file swallows OSError/UnicodeError
+        # by design (secret scope fails soft), but an unreadable profile .env
+        # is a policy-resolution failure here and must fail closed.
+        try:
+            env_path.read_bytes()
+        except Exception as exc:
+            raise TerminalPolicyUnavailable(
+                f"cannot read {env_path}: {exc}"
+            ) from exc
+        from agent.secret_scope import load_env_file
+
+        selections = load_env_file(env_path)
+        for key, value in selections.items():
+            if key.startswith("TERMINAL_"):
+                scope[key] = str(value)
+
+    # 3) The profile's config.yaml explicit terminal keys. Read through the
+    #    HERMES_HOME override so the profile's own file is consulted; a
+    #    present-but-unparseable file fails closed (matches the gateway's
+    #    _warn_config_parse_failure posture of refusing to guess policy).
+    from hermes_constants import (
+        get_hermes_home_override,
+        reset_hermes_home_override,
+        set_hermes_home_override,
+    )
+
+    override_token = None
+    if get_hermes_home_override() != str(home):
+        override_token = set_hermes_home_override(home)
+    try:
+        config_path = home / "config.yaml"
+        if config_path.exists():
+            # Parse the profile's file directly rather than through
+            # read_raw_config(): that helper collapses "missing" and
+            # "unparseable" into the same {} result. Here the file's existence
+            # is already established, so {} can only mean a parse failure —
+            # which must fail closed rather than silently projecting defaults.
+            from hermes_cli.config import fast_safe_load
+
+            try:
+                with open(config_path, encoding="utf-8") as f:
+                    raw = fast_safe_load(f)
+            except Exception as exc:
+                raise TerminalPolicyUnavailable(
+                    f"cannot parse {config_path}: {exc}"
+                ) from exc
+            raw_terminal = raw.get("terminal") if isinstance(raw, dict) else None
+            if isinstance(raw_terminal, dict):
+                for cfg_key, value in raw_terminal.items():
+                    _apply(cfg_key, value)
+    except TerminalPolicyUnavailable:
+        raise
+    except Exception as exc:
+        raise TerminalPolicyUnavailable(
+            f"cannot resolve terminal config in {home}: {exc}"
+        ) from exc
+    finally:
+        if override_token is not None:
+            reset_hermes_home_override(override_token)
+
+    return scope
+
+
+def install_profile_terminal_scope(hermes_home: "Any") -> Token:
+    """Build AND install a profile's policy in one call.
+
+    The single entry point for every profile boundary (gateway turn, TUI/
+    dashboard turn, cron fire). On resolution failure this installs the
+    refusal scope instead of raising — the turn continues only in the sense
+    that terminal tools will refuse execution with the typed reason; it never
+    falls back to ambient process policy.
+
+    Returns the token for ``reset_terminal_scope``.
+    """
+    try:
+        return set_terminal_scope(build_profile_terminal_scope(hermes_home))
+    except TerminalPolicyUnavailable as exc:
+        logger.warning("terminal policy unavailable: %s", exc)
+        return install_refusal_scope(str(exc))
+
+
+def enforce_no_refusal() -> None:
+    """Raise when the active scope is a refusal scope (fail closed).
+
+    Execution paths (terminal tool, execute_code) call this before spawning
+    anything: under a refusal scope the profile's terminal policy could not be
+    resolved, and running with the launch process's ambient policy is exactly
+    the authority leak this module closes (#68559 requires refusal, not
+    fallback). Non-scoped and policy-scoped contexts pass silently.
+    """
+    scope = _terminal_scope_var.get()
+    if isinstance(scope, TerminalPolicyRefusal):
+        raise TerminalPolicyUnavailable(
+            f"terminal policy unavailable for this profile: {scope.reason}"
+        )
+
+
+@contextmanager
+def install_and_reset_profile_terminal_scope(
+    hermes_home: "Any",
+) -> Iterator[None]:
+    """Install the profile's terminal policy for a bounded turn/fire.
+
+    Single call for every in-process profile boundary (gateway turn,
+    dashboard/TUI turn, cron fire): builds the complete effective policy and
+    resets it on exit. Resolution failure installs the refusal scope for the
+    same duration — terminal execution inside the block raises (fail closed)
+    instead of inheriting the launch process's ambient policy. Never raises.
+    """
+    token = install_profile_terminal_scope(hermes_home)
+    try:
+        yield
+    finally:
+        reset_terminal_scope(token)
diff --git a/tools/terminal_tool.py b/tools/terminal_tool.py
index 689fcf156c..4b16c7f0bd 100644
--- a/tools/terminal_tool.py
+++ b/tools/terminal_tool.py
@@ -839,7 +839,7 @@ def _sudo_nopasswd_works() -> bool:
     cache) so an expired sudo timestamp cannot make a later command silently
     block waiting for a password.
     """
-    terminal_env = os.getenv("TERMINAL_ENV", "local").strip().lower() or "local"
+    terminal_env = _tenv("TERMINAL_ENV", "local").strip().lower() or "local"
     if terminal_env != "local":
         return False
 
@@ -1195,7 +1195,7 @@ def _maybe_reap_docker_orphans(container_config: Dict[str, Any]) -> None:
     # ``container_config`` only carries container_* keys, so read
     # lifetime_seconds from the env var the rest of the module uses.
     try:
-        lifetime = int(os.getenv("TERMINAL_LIFETIME_SECONDS", "300"))
+        lifetime = int(_tenv("TERMINAL_LIFETIME_SECONDS", "300"))
     except (TypeError, ValueError):
         lifetime = 300
     lifetime = max(60, lifetime)
@@ -1384,12 +1384,12 @@ def _session_isolation_enabled() -> bool:
       attach one live VM and delete it out from under each other).
     """
     _ensure_terminal_env_bridged()
-    env_type = os.getenv("TERMINAL_ENV", "local")
+    env_type = _tenv("TERMINAL_ENV", "local")
     if env_type != "docker" and not _plugin_env_flag(
         env_type, "session_isolated_when_nonpersistent"
     ):
         return False
-    return os.getenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() not in {"true", "1", "yes"}
+    return _tenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() not in {"true", "1", "yes"}
 
 
 def _docker_session_isolation_enabled() -> bool:
@@ -1399,7 +1399,7 @@ def _docker_session_isolation_enabled() -> bool:
     selection, session-scoped container teardown) key off it; those must
     not fire for other backends.
     """
-    if os.getenv("TERMINAL_ENV", "local") != "docker":
+    if _tenv("TERMINAL_ENV", "local") != "docker":
         return False
     return _session_isolation_enabled()
 
@@ -1419,9 +1419,9 @@ def _docker_persistent_profile_scoped() -> bool:
     keep the session-scoped cache key that fixed the original leak.
     """
     _ensure_terminal_env_bridged()
-    if os.getenv("TERMINAL_ENV", "local") != "docker":
+    if _tenv("TERMINAL_ENV", "local") != "docker":
         return False
-    return os.getenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() in {"true", "1", "yes"}
+    return _tenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() in {"true", "1", "yes"}
 
 
 def _current_session_profile() -> str:
@@ -1515,7 +1515,7 @@ def _resolve_container_task_id(task_id: Optional[str]) -> str:
             # Explicit opt-in: trusted profiles configuring the same
             # terminal.docker_shared_container_key share ONE container/cache
             # slot (and sandbox dir) regardless of profile name (#84671).
-            shared = os.getenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
+            shared = _tenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
             if shared:
                 return f"shared:{shared}"
             profile = _current_session_profile() or "default"
@@ -1528,7 +1528,7 @@ def _resolve_container_task_id(task_id: Optional[str]) -> str:
     # sessions land in "shared:<key>" — splitting the very container the
     # setting exists to unify.
     if _docker_persistent_profile_scoped():
-        shared = os.getenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
+        shared = _tenv("TERMINAL_DOCKER_SHARED_CONTAINER_KEY", "").strip()
         if shared:
             return f"shared:{shared}"
     return "default"
@@ -1607,6 +1607,10 @@ def _parse_env_var(name: str, default: str, converter: Any = int, type_label: st
     causes an unhandled ValueError that kills every terminal command.
     """
     raw = os.getenv(name, default)
+    if name.startswith("TERMINAL_"):
+        # Scope-aware: under gateway multiplexing the active profile's
+        # per-turn scope overrides the process env.
+        raw = _tenv(name, default)
     try:
         return converter(raw)
     except (ValueError, json.JSONDecodeError):
@@ -1632,7 +1636,7 @@ def _safe_getcwd() -> str:
     try:
         return os.getcwd()
     except (FileNotFoundError, PermissionError):
-        return os.getenv("TERMINAL_CWD") or os.path.expanduser("~")
+        return _tenv("TERMINAL_CWD") or os.path.expanduser("~")
 
 
 # Path prefixes that identify a *host* working directory which cannot exist
@@ -1703,6 +1707,20 @@ def _is_unusable_container_cwd(cwd: str) -> bool:
     return False
 
 
+def _tenv(name: str, default: str = "") -> str:
+    """Scope-aware read of a ``TERMINAL_*`` variable.
+
+    Every terminal setting read in this module must go through this helper:
+    under gateway multiplexing the active profile's terminal config arrives
+    via a per-turn scope (``tools.terminal_scope``), and a raw ``os.getenv``
+    would read whatever profile's config a previous turn pinned into the
+    process env (the cross-profile backend leak fixed here).
+    """
+    from tools.terminal_scope import terminal_env
+
+    return terminal_env(name, default)
+
+
 # One-shot guard for the config-fallback bridge below.  Purely an
 # optimization: after the first attempt either TERMINAL_ENV is set (bridge
 # succeeded — merged config always carries terminal.backend) or the import
@@ -1728,7 +1746,17 @@ def _ensure_terminal_env_bridged() -> None:
     be stale from ``hermes setup``). Environment values for omitted terminal
     keys are preserved. When no terminal section exists, exported/.env values
     keep working unchanged.
+
+    A per-turn terminal scope (multiplexed gateway / profile-scoped cron)
+    suppresses this bridge entirely: the scope holds the active profile's
+    authoritative values and reads fall through ``_tenv`` — writing them into
+    the process-global ``os.environ`` would re-create the first-writer-wins
+    cross-profile leak the scope exists to fix.
     """
+    from tools.terminal_scope import get_terminal_scope
+
+    if get_terminal_scope() is not None:
+        return
     global _terminal_config_bridge_attempted
     if _terminal_config_bridge_attempted:
         return
@@ -1762,9 +1790,9 @@ def _get_env_config() -> Dict[str, Any]:
     # Default image with Python and Node.js for maximum compatibility
     default_image = "nikolaik/python-nodejs:python3.11-nodejs20"
     _ensure_terminal_env_bridged()
-    env_type = os.getenv("TERMINAL_ENV", "local")
+    env_type = _tenv("TERMINAL_ENV", "local")
     
-    mount_docker_cwd = os.getenv("TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE", "false").lower() in {"true", "1", "yes"}
+    mount_docker_cwd = _tenv("TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACE", "false").lower() in {"true", "1", "yes"}
     container_backend = _is_container_backend(env_type)
     docker_backend = env_type == "docker"
 
@@ -1786,7 +1814,7 @@ def _get_env_config() -> Dict[str, Any]:
         docker_volumes = _parse_env_var("TERMINAL_DOCKER_VOLUMES", "[]", json.loads, "valid JSON")
         docker_env = _parse_env_var("TERMINAL_DOCKER_ENV", "{}", json.loads, "valid JSON")
         docker_extra_args = _parse_env_var("TERMINAL_DOCKER_EXTRA_ARGS", "[]", json.loads, "valid JSON")
-        docker_shm_size = os.getenv("TERMINAL_DOCKER_SHM_SIZE", "1g")
+        docker_shm_size = _tenv("TERMINAL_DOCKER_SHM_SIZE", "1g")
     else:
         docker_forward_env = []
         docker_volumes = []
@@ -1810,13 +1838,13 @@ def _get_env_config() -> Dict[str, Any]:
     # If Docker cwd passthrough is explicitly enabled, remap the host path to
     # /workspace and track the original host path separately. Otherwise keep the
     # normal sandbox behavior and discard host paths.
-    cwd = os.getenv("TERMINAL_CWD", default_cwd)
+    cwd = _tenv("TERMINAL_CWD", default_cwd)
     from hermes_cli.config import _is_ssh_remote_tilde_cwd
     if cwd and not _is_ssh_remote_tilde_cwd(env_type, cwd):
         cwd = os.path.expanduser(cwd)
     host_cwd = None
     if env_type == "docker" and mount_docker_cwd:
-        docker_cwd_source = os.getenv("TERMINAL_CWD") or _safe_getcwd()
+        docker_cwd_source = _tenv("TERMINAL_CWD") or _safe_getcwd()
         candidate = os.path.abspath(os.path.expanduser(docker_cwd_source))
         if (
             any(candidate.startswith(p) for p in _HOST_CWD_PREFIXES)
@@ -1834,41 +1862,41 @@ def _get_env_config() -> Dict[str, Any]:
 
     return {
         "env_type": env_type,
-        "modal_mode": coerce_modal_mode(os.getenv("TERMINAL_MODAL_MODE", "auto")),
-        "docker_image": os.getenv("TERMINAL_DOCKER_IMAGE", default_image),
+        "modal_mode": coerce_modal_mode(_tenv("TERMINAL_MODAL_MODE", "auto")),
+        "docker_image": _tenv("TERMINAL_DOCKER_IMAGE", default_image),
         "docker_forward_env": docker_forward_env,
-        "singularity_image": os.getenv("TERMINAL_SINGULARITY_IMAGE", f"docker://{default_image}"),
-        "modal_image": os.getenv("TERMINAL_MODAL_IMAGE", default_image),
-        "daytona_image": os.getenv("TERMINAL_DAYTONA_IMAGE", default_image),
-        "vercel_runtime": os.getenv("TERMINAL_VERCEL_RUNTIME", "").strip(),
+        "singularity_image": _tenv("TERMINAL_SINGULARITY_IMAGE", f"docker://{default_image}"),
+        "modal_image": _tenv("TERMINAL_MODAL_IMAGE", default_image),
+        "daytona_image": _tenv("TERMINAL_DAYTONA_IMAGE", default_image),
+        "vercel_runtime": _tenv("TERMINAL_VERCEL_RUNTIME", "").strip(),
         "cwd": cwd,
         "host_cwd": host_cwd,
         "docker_mount_cwd_to_workspace": mount_docker_cwd,
         "timeout": _parse_env_var("TERMINAL_TIMEOUT", "180"),
         "lifetime_seconds": _parse_env_var("TERMINAL_LIFETIME_SECONDS", "300"),
         # SSH-specific config
-        "ssh_host": os.getenv("TERMINAL_SSH_HOST", ""),
-        "ssh_user": os.getenv("TERMINAL_SSH_USER", ""),
+        "ssh_host": _tenv("TERMINAL_SSH_HOST", ""),
+        "ssh_user": _tenv("TERMINAL_SSH_USER", ""),
         "ssh_port": _parse_env_var("TERMINAL_SSH_PORT", "22"),
-        "ssh_key": os.getenv("TERMINAL_SSH_KEY", ""),
+        "ssh_key": _tenv("TERMINAL_SSH_KEY", ""),
         # Persistent shell: SSH defaults to the config-level persistent_shell
         # setting (true by default for non-local backends); local is always opt-in.
         # Per-backend env vars override if explicitly set.
-        "ssh_persistent": os.getenv(
+        "ssh_persistent": _tenv(
             "TERMINAL_SSH_PERSISTENT",
-            os.getenv("TERMINAL_PERSISTENT_SHELL", "true"),
+            _tenv("TERMINAL_PERSISTENT_SHELL", "true"),
         ).lower() in {"true", "1", "yes"},
-        "local_persistent": os.getenv("TERMINAL_LOCAL_PERSISTENT", "false").lower() in {"true", "1", "yes"},
+        "local_persistent": _tenv("TERMINAL_LOCAL_PERSISTENT", "false").lower() in {"true", "1", "yes"},
         # Container resource config (applies to docker, singularity, modal,
         # daytona, and vercel_sandbox -- ignored for local/ssh)
         "container_cpu": container_cpu,
         "container_memory": container_memory,     # MB (default 5GB)
         "container_disk": container_disk,        # MB (default 50GB)
-        "container_persistent": os.getenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() in {"true", "1", "yes"},
+        "container_persistent": _tenv("TERMINAL_CONTAINER_PERSISTENT", "true").lower() in {"true", "1", "yes"},
         "docker_volumes": docker_volumes,
         "docker_env": docker_env,
-        "docker_run_as_host_user": os.getenv("TERMINAL_DOCKER_RUN_AS_HOST_USER", "false").lower() in {"true", "1", "yes"},
-        "docker_network": os.getenv("TERMINAL_DOCKER_NETWORK", "true").lower() in {"true", "1", "yes"},
+        "docker_run_as_host_user": _tenv("TERMINAL_DOCKER_RUN_AS_HOST_USER", "false").lower() in {"true", "1", "yes"},
+        "docker_network": _tenv("TERMINAL_DOCKER_NETWORK", "true").lower() in {"true", "1", "yes"},
         "docker_extra_args": docker_extra_args,
         "docker_shm_size": docker_shm_size,
         # Cross-process container reuse (issue #20561).  The docs claim
@@ -1877,17 +1905,17 @@ def _get_env_config() -> Dict[str, Any]:
         # attaching to it instead of always starting a fresh one.  Set to
         # ``false`` for hard per-process isolation (no reuse, container is
         # removed on exit).
-        "docker_persist_across_processes": os.getenv(
+        "docker_persist_across_processes": _tenv(
             "TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSES", "true"
         ).lower() in {"true", "1", "yes"},
-        "docker_shared_container_key": os.getenv(
+        "docker_shared_container_key": _tenv(
             "TERMINAL_DOCKER_SHARED_CONTAINER_KEY", ""
         ).strip(),
         # Startup orphan reaper for hermes-tagged containers left behind by
         # crashed / SIGKILL'd previous processes that bypassed atexit.
         # Conservative: only sweeps Exited containers older than 2× the
         # idle-reap window AND scoped to the current profile. Issue #20561.
-        "docker_orphan_reaper": os.getenv(
+        "docker_orphan_reaper": _tenv(
             "TERMINAL_DOCKER_ORPHAN_REAPER", "true"
         ).lower() in {"true", "1", "yes"},
     }
@@ -2877,6 +2905,15 @@ def terminal_tool(
         config = _get_env_config()
         env_type = "local" if _host_local else config["env_type"]
 
+        # Fail closed under a refusal scope (#68559): the routed profile's
+        # terminal policy could not be resolved, so executing with the launch
+        # process's ambient policy is forbidden — refuse with a typed,
+        # model-actionable error instead.
+        if not _host_local:
+            from tools.terminal_scope import enforce_no_refusal
+
+            enforce_no_refusal()
+
         # Use task_id for environment isolation. By default all subagent
         # task_ids collapse back to "default" so the top-level agent and
         # every delegate_task child share one container; only task_ids with
@@ -3868,7 +3905,7 @@ def terminal_tool(
         #   warn (default) — return a structured degraded result the model
         #                    can act on (reason + retry hint, no traceback).
         #   fail           — preserve the historical error+traceback result.
-        degraded_mode = os.getenv("TERMINAL_DEGRADED_MODE", "warn").strip().lower()
+        degraded_mode = _tenv("TERMINAL_DEGRADED_MODE", "warn").strip().lower()
         if degraded_mode == "fail":
             import traceback
             tb_str = traceback.format_exc()
@@ -4089,18 +4126,18 @@ if __name__ == "__main__":
     default_img = "nikolaik/python-nodejs:python3.11-nodejs20"
     print(
         "  TERMINAL_ENV: "
-        f"{os.getenv('TERMINAL_ENV', 'local')} "
+        f"{_tenv('TERMINAL_ENV', 'local')} "
         "(local/docker/singularity/modal/daytona/vercel_sandbox/ssh)"
     )
-    print(f"  TERMINAL_DOCKER_IMAGE: {os.getenv('TERMINAL_DOCKER_IMAGE', default_img)}")
-    print(f"  TERMINAL_SINGULARITY_IMAGE: {os.getenv('TERMINAL_SINGULARITY_IMAGE', f'docker://{default_img}')}")
-    print(f"  TERMINAL_MODAL_IMAGE: {os.getenv('TERMINAL_MODAL_IMAGE', default_img)}")
-    print(f"  TERMINAL_DAYTONA_IMAGE: {os.getenv('TERMINAL_DAYTONA_IMAGE', default_img)}")
-    print(f"  TERMINAL_CWD: {os.getenv('TERMINAL_CWD', _safe_getcwd())}")
+    print(f"  TERMINAL_DOCKER_IMAGE: {_tenv('TERMINAL_DOCKER_IMAGE', default_img)}")
+    print(f"  TERMINAL_SINGULARITY_IMAGE: {_tenv('TERMINAL_SINGULARITY_IMAGE', f'docker://{default_img}')}")
+    print(f"  TERMINAL_MODAL_IMAGE: {_tenv('TERMINAL_MODAL_IMAGE', default_img)}")
+    print(f"  TERMINAL_DAYTONA_IMAGE: {_tenv('TERMINAL_DAYTONA_IMAGE', default_img)}")
+    print(f"  TERMINAL_CWD: {_tenv('TERMINAL_CWD', _safe_getcwd())}")
     from hermes_constants import display_hermes_home as _dhh
-    print(f"  TERMINAL_SANDBOX_DIR: {os.getenv('TERMINAL_SANDBOX_DIR', f'{_dhh()}/sandboxes')}")
-    print(f"  TERMINAL_TIMEOUT: {os.getenv('TERMINAL_TIMEOUT', '60')}")
-    print(f"  TERMINAL_LIFETIME_SECONDS: {os.getenv('TERMINAL_LIFETIME_SECONDS', '300')}")
+    print(f"  TERMINAL_SANDBOX_DIR: {_tenv('TERMINAL_SANDBOX_DIR', f'{_dhh()}/sandboxes')}")
+    print(f"  TERMINAL_TIMEOUT: {_tenv('TERMINAL_TIMEOUT', '60')}")
+    print(f"  TERMINAL_LIFETIME_SECONDS: {_tenv('TERMINAL_LIFETIME_SECONDS', '300')}")
 
 
 # ---------------------------------------------------------------------------
diff --git a/tools/tip_tool.py b/tools/tip_tool.py
index 57bd72e508..293c10185c 100644
--- a/tools/tip_tool.py
+++ b/tools/tip_tool.py
@@ -59,7 +59,7 @@ def tip_tool(text: str, selector: str, title: str = "", side: str = "") -> str:
 
 
 TIP_SCHEMA = {
-    "name": "tip",
+    "name": "show_tip",
     "description": (
         "Point at one thing in the desktop UI with a small arrow bubble (no "
         "dimming, no tour chrome) — for when a sentence is clearer with a "
@@ -100,7 +100,7 @@ def check_tips_enabled() -> bool:
 
 
 registry.register(
-    name="tip",
+    name="show_tip",
     toolset="desktop_ui",
     schema=TIP_SCHEMA,
     handler=lambda args, **kw: tip_tool(
diff --git a/tools/todo_tool.py b/tools/todo_tool.py
index bd487c974e..11056736a4 100644
--- a/tools/todo_tool.py
+++ b/tools/todo_tool.py
@@ -378,12 +378,12 @@ def check_todo_requirements() -> bool:
 # static tool schema (cached, never changes mid-conversation).
 
 TODO_SCHEMA = {
-    "name": "todo",
+    "name": "todo_list",
     # Dieted (#95681): the item shape and merge semantics live ONLY in the
     # parameter schema below — the description teaches behavior, not
     # structure the params already define.
     "description": (
-        "Manage your task list for the current session. Use for complex tasks "
+        "Track a task list for multi-step work (3+ steps). Use for complex tasks "
         "with 3+ steps or when the user provides multiple tasks. "
         "For 'all N items' tasks, enumerate every instance as its own checklist "
         "item so none are silently dropped. "
@@ -440,7 +440,7 @@ TODO_SCHEMA = {
 from tools.registry import registry, tool_error
 
 registry.register(
-    name="todo",
+    name="todo_list",
     toolset="todo",
     schema=TODO_SCHEMA,
     handler=lambda args, **kw: todo_tool(
diff --git a/tools/tool_backend_helpers.py b/tools/tool_backend_helpers.py
index 0096c72fdf..7582d877ac 100644
--- a/tools/tool_backend_helpers.py
+++ b/tools/tool_backend_helpers.py
@@ -5,7 +5,7 @@ from __future__ import annotations
 import logging
 import os
 from pathlib import Path
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 
 from utils import is_truthy_value
 
@@ -402,8 +402,36 @@ def selection_exists(section: str) -> bool:
     return any(str(raw.get(key) or "").strip() for key in extra)
 
 
+# Backends that once shipped in-tree but were removed. A config that still
+# points at one otherwise fails silently at the FIRST tool call with a
+# generic "no registered provider has that name" — no migration, no startup
+# notice (reported after the Tavily removal in #99199). Both the startup
+# config check (hermes_cli.config.validate_config_structure) and
+# selection_error() consult this map so the user learns what actually
+# happened and what to do. Declared data, one policy — add future removals
+# here, never as one-off string checks at call sites.
+REMOVED_BACKENDS: Dict[str, Dict[str, str]] = {
+    # Currently empty: the Tavily removal (#99199) that introduced this
+    # registry was reverted by the #99731 restore. Future backend removals
+    # add an entry here, e.g.
+    #   "web": {"<name>": "the <Name> backend was removed in vX.Y.Z (...)"},
+}
+
+
+def removed_backend_note(section: str, name: str) -> Optional[str]:
+    """Explanation for a backend that used to ship in-tree, or None.
+
+    ``name`` tolerates the quoted form callers pass to selection_error().
+    """
+    normalized = (name or "").strip().strip("'\"").lower()
+    return REMOVED_BACKENDS.get(section, {}).get(normalized)
+
+
 def selection_error(section: str, selection_name: str, failure: str) -> str:
     """The uniform honest-error contract for a selected-but-broken provider."""
+    note = removed_backend_note(section, selection_name)
+    if note:
+        failure = note
     return (
         f"{section} is configured to use {selection_name} (set via hermes "
         f"tools), but {failure}. Run 'hermes tools' to change it."
diff --git a/tools/tool_search.py b/tools/tool_search.py
index 66f1b198c5..b509be2350 100644
--- a/tools/tool_search.py
+++ b/tools/tool_search.py
@@ -42,6 +42,7 @@ for the full rationale):
 
 from __future__ import annotations
 
+import copy
 import functools
 import json
 import logging
@@ -57,6 +58,8 @@ from tools.registry import tool_error
 
 logger = logging.getLogger("tools.tool_search")
 
+_SCHEMA_LITERAL_KEYS = frozenset({"const", "default", "enum", "example", "examples"})
+
 
 # Bridge tool names. These names are reserved and may not collide with a
 # user/plugin/MCP tool — registration of any tool with these names is
@@ -110,6 +113,14 @@ class ToolSearchConfig:
     # Absolute cap on the embedded listing, regardless of context size.
     # Effective budget = min(listing_max_tokens, threshold_pct% of context).
     listing_max_tokens: int = 4000
+    # Core/GUI tool names deferred behind the bridge. None = use the curated
+    # default (_DEFAULT_DEFERRED_TOOLS); an explicit list from config
+    # replaces the default wholesale ([] = defer no core tools — legacy).
+    defer_tools: Optional[frozenset] = None
+
+    @property
+    def effective_defer_tools(self) -> frozenset:
+        return _DEFAULT_DEFERRED_TOOLS if self.defer_tools is None else self.defer_tools
 
     @classmethod
     def from_raw(cls, raw: Any) -> "ToolSearchConfig":
@@ -159,6 +170,14 @@ class ToolSearchConfig:
             listing = "auto"
         listing_max_tokens = max(200, min(60000, _safe_int(raw.get("listing_max_tokens"), 4000)))
 
+        defer_raw = raw.get("defer")
+        if isinstance(defer_raw, (list, tuple, set)):
+            defer_tools = frozenset(
+                str(n).strip() for n in defer_raw if str(n).strip()
+            )
+        else:
+            defer_tools = None  # curated default
+
         return cls(
             enabled=enabled,
             threshold_pct=threshold_pct,
@@ -166,6 +185,7 @@ class ToolSearchConfig:
             max_search_limit=max_search_limit,
             listing=listing,
             listing_max_tokens=listing_max_tokens,
+            defer_tools=defer_tools,
         )
 
 
@@ -230,21 +250,54 @@ def _core_tool_names() -> frozenset[str]:
 
 
 # Session-gated GUI toolsets. Off ``_HERMES_CORE_TOOLS`` so non-GUI clients
-# never pay their schema; once a session enables them they stay direct.
+# never pay their schema; once a session enables them they stay direct
+# UNLESS the deferral list (below) names them.
 _DIRECT_SURFACE_TOOLSETS = frozenset({"desktop_ui", "project"})
 
+# Core-tool deferral (2026-08, maintainer-directed): the curated set of
+# event-triggered tools that hide behind the bridge BY DEFAULT. These are
+# tools a session reaches for when something specific happens (user asks
+# for a tour / a cron job / a screenshot / a clarification), not tools in
+# the every-turn working set — so a catalog stub is enough to find them.
+# Config override: ``tools.tool_search.defer`` (list of tool names);
+# ``[]`` restores the legacy everything-eager behavior, any other list
+# replaces this default wholesale. Names here are POST-rename.
+#
+# ``clarify`` was in the original curated set but was pulled back to eager
+# after the maintainer A/B (PR #97979, 288 runs × 3 model tiers): with the
+# schema visible models used structured clarify 18/18 on ambiguous tasks;
+# deferred, usage collapsed to 7/18 (gpt-terra 0/6) — models fell back to
+# plain-text questions, losing the structured-choice UX and costing an
+# extra user round-trip. The ask-the-user affordance has to be ambient to
+# fire; a catalog stub is not enough. (~250 tok to keep it eager.)
+_DEFAULT_DEFERRED_TOOLS = frozenset({
+    "computer_use", "session_search", "image_generate",
+    "todo_list", "process_manage", "cronjob_manage",
+    # Desktop GUI surface (desktop_ui + project toolsets)
+    "drive_preview", "gui_tour", "desktop_preview", "annotate_preview",
+    "show_tip", "setup_mcp", "desktop_project", "close_terminal",
+    "apply_layout", "read_terminal", "read_window_below", "focus_pane",
+})
 
-def is_deferrable_tool_name(name: str) -> bool:
+
+def is_deferrable_tool_name(name: str, defer_tools: Optional[frozenset] = None) -> bool:
     """Return True if a tool with this name is *eligible* for deferral.
 
-    A tool is deferrable iff it is registered with an MCP toolset prefix
-    OR it is neither in ``_HERMES_CORE_TOOLS`` nor a session-gated GUI
-    surface toolset. Core and direct surface tools are never deferred even
-    when their toolset is technically plugin-provided (this protects
-    against accidental shadowing).
+    A tool is deferrable iff:
+    * it is named in ``defer_tools`` (the maintainer-curated core-deferral
+      set, or the user's ``tools.tool_search.defer`` override) — this is
+      the 2026-08 revision of the old "core never defers" rule: core tools
+      in the WORKING set (terminal, files, memory, ...) still never defer,
+      but the curated event-triggered set (computer_use, the GUI
+      surface, ...) hides behind the bridge by default; OR
+    * it is registered with an MCP toolset prefix; OR
+    * it is neither in ``_HERMES_CORE_TOOLS`` nor a session-gated GUI
+      surface toolset (plugin tools).
     """
     if name in BRIDGE_TOOL_NAMES:
         return False
+    if defer_tools is not None and name in defer_tools:
+        return True
     if name in _core_tool_names():
         return False
     # Check registry toolset for MCP prefix.
@@ -265,6 +318,7 @@ def is_deferrable_tool_name(name: str) -> bool:
 
 def _describe_classification(
     name: str,
+    defer_tools: Optional[frozenset] = None,
 ) -> Literal["available", "not_found", "not_deferrable"]:
     """Classify a describe name without treating unknown names as errors."""
     try:
@@ -274,6 +328,8 @@ def _describe_classification(
         return "not_found"
     if entry is None:
         return "not_found"
+    if defer_tools is not None and name in defer_tools:
+        return "available"
     if (
         name in BRIDGE_TOOL_NAMES
         or name in _core_tool_names()
@@ -283,12 +339,15 @@ def _describe_classification(
     return "available"
 
 
-def classify_tools(tool_defs: List[Dict[str, Any]]) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
+def classify_tools(
+    tool_defs: List[Dict[str, Any]],
+    defer_tools: Optional[frozenset] = None,
+) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
     """Split a tool-defs list into (visible, deferrable).
 
-    ``visible`` retains every tool that must stay in the model-facing array:
-    every core tool, every session-gated GUI surface tool, plus any tool we
-    can't classify. ``deferrable`` is the candidate set for catalog entry.
+    ``visible`` retains every tool that must stay in the model-facing array.
+    ``deferrable`` is the candidate set for catalog entry — MCP/plugin tools
+    plus any core/GUI tool named in ``defer_tools``.
     """
     visible: List[Dict[str, Any]] = []
     deferrable: List[Dict[str, Any]] = []
@@ -299,7 +358,7 @@ def classify_tools(tool_defs: List[Dict[str, Any]]) -> Tuple[List[Dict[str, Any]
             # Should never happen — bridge tools are added after classification —
             # but be defensive.
             continue
-        if is_deferrable_tool_name(name):
+        if is_deferrable_tool_name(name, defer_tools):
             deferrable.append(td)
         else:
             visible.append(td)
@@ -927,7 +986,7 @@ def assemble_tool_defs(
     incoming = [td for td in tool_defs
                 if (td.get("function") or {}).get("name") not in BRIDGE_TOOL_NAMES]
 
-    visible, deferrable = classify_tools(incoming)
+    visible, deferrable = classify_tools(incoming, config.effective_defer_tools)
     if not deferrable:
         return AssemblyResult(tool_defs=incoming, activated=False)
 
@@ -1078,7 +1137,9 @@ def dispatch_tool_search(args: Dict[str, Any],
     else:
         limit = max(1, min(config.max_search_limit, _safe_int(raw_limit, config.search_default_limit)))
 
-    _, deferrable = classify_tools(current_tool_defs)
+    _, deferrable = classify_tools(
+        current_tool_defs, load_config_readonly().effective_defer_tools
+    )
     catalog = build_catalog(deferrable)
 
     results: List[Dict[str, Any]] = []
@@ -1151,7 +1212,9 @@ def dispatch_tool_describe(args: Dict[str, Any],
             "Retry with fewer names per call."
         )
 
-    _, deferrable = classify_tools(current_tool_defs)
+    _, deferrable = classify_tools(
+        current_tool_defs, load_config_readonly().effective_defer_tools
+    )
     by_name: Dict[str, Dict[str, Any]] = {}
     for td in deferrable:
         fn = td.get("function") or {}
@@ -1168,7 +1231,9 @@ def dispatch_tool_describe(args: Dict[str, Any],
                 "description": fn.get("description", ""),
                 "parameters": fn.get("parameters", {}),
             }
-        elif _describe_classification(name) == "not_deferrable":
+        elif _describe_classification(
+            name, load_config_readonly().effective_defer_tools
+        ) == "not_deferrable":
             errors[name] = (
                 f"'{name}' is not a deferrable tool. If you see it in the tools list "
                 "already, call it directly; otherwise check the spelling against tool_search."
@@ -1198,15 +1263,93 @@ def scoped_deferrable_names(tool_defs: List[Dict[str, Any]]) -> frozenset[str]:
     an out-of-scope tool via the bridge.
     """
     names: set[str] = set()
+    defer_tools = load_config_readonly().effective_defer_tools
     for td in tool_defs:
         name = (td.get("function") or {}).get("name", "")
-        if name and is_deferrable_tool_name(name):
+        if name and is_deferrable_tool_name(name, defer_tools):
             names.add(name)
     return frozenset(names)
 
 
+def _schema_for_local_validation(node: Any) -> Any:
+    """Return a JSON-Schema-compatible copy that honors ``nullable: true``.
+
+    Some MCP/plugin schemas use OpenAPI's ``nullable`` extension instead of a
+    JSON Schema null union.  Hermes' normal coercion path accepts that shape;
+    mirror it here so local validation never rejects a value dispatch would
+    intentionally accept.
+    """
+    if isinstance(node, list):
+        return [_schema_for_local_validation(item) for item in node]
+    if not isinstance(node, dict):
+        return node
+
+    normalized = {}
+    for key, value in node.items():
+        if key == "nullable":
+            continue
+        # These keywords contain instance data, not nested schemas. An enum
+        # value such as {"nullable": true} must remain byte-for-byte data.
+        normalized[key] = (
+            copy.deepcopy(value)
+            if key in _SCHEMA_LITERAL_KEYS
+            else _schema_for_local_validation(value)
+        )
+    if node.get("nullable") is not True:
+        return normalized
+
+    schema_type = normalized.get("type")
+    if isinstance(schema_type, str):
+        if schema_type != "null":
+            normalized["type"] = [schema_type, "null"]
+        return normalized
+    if isinstance(schema_type, list):
+        if "null" not in schema_type:
+            normalized["type"] = [*schema_type, "null"]
+        return normalized
+
+    # ``nullable`` alongside a $ref/combinator has no ``type`` to extend.
+    # Wrap the original constraint so local references keep resolving from the
+    # parameters schema's root while null remains an explicit alternative.
+    return {"anyOf": [normalized, {"type": "null"}]}
+
+
+def _schema_has_external_ref(node: Any) -> bool:
+    """Return whether *node* contains a non-local ``$ref``.
+
+    Local validation must never turn a tool call into an implicit network
+    fetch.  Schemas with remote/file references remain the underlying tool's
+    responsibility and therefore follow the existing fail-open contract.
+    """
+    if isinstance(node, list):
+        return any(_schema_has_external_ref(item) for item in node)
+    if not isinstance(node, dict):
+        return False
+    ref = node.get("$ref")
+    if isinstance(ref, str) and not ref.startswith("#"):
+        return True
+    return any(
+        _schema_has_external_ref(value)
+        for key, value in node.items()
+        if key not in _SCHEMA_LITERAL_KEYS
+    )
+
+
+def _validation_path(error: Any) -> str:
+    """Format a jsonschema error path as a compact argument path."""
+    path = "arguments"
+    for part in getattr(error, "absolute_path", ()):
+        if isinstance(part, int):
+            path += f"[{part}]"
+        elif isinstance(part, str) and re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", part):
+            path += f".{part}"
+        else:
+            path += f"[{json.dumps(part, ensure_ascii=False)}]"
+    return path
+
+
 def validate_deferred_call_args(name: str, args: Dict[str, Any]) -> Optional[str]:
-    """Probe-validate ``tool_call`` arguments against the deferred tool's schema.
+    """Validate ``tool_call`` arguments against the deferred tool's schema.
 
     A deferred tool's parameter schema is invisible to the model until it
     calls ``tool_describe`` — so models routinely invoke deferred tools
@@ -1215,17 +1358,16 @@ def validate_deferred_call_args(name: str, args: Dict[str, Any]) -> Optional[str
     that tells the model nothing about what the tool expects, and cheap
     models loop on it until the iteration budget dies.
 
-    Port of the describe-first probe-validation fix from nearai/ironclaw#5149:
-    when required arguments are missing, return the tool's parameter schema
-    instead of dispatching blind — the model repairs the call in one
-    round-trip. Valid calls (and any call we can't confidently validate)
-    dispatch untouched, so this can never block a legitimate invocation.
+    Keep the original describe-first required-field probe from
+    nearai/ironclaw#5149, then run the same schema-guided coercion used by
+    normal dispatch and validate the repaired copy.  This restores the
+    concrete-schema checks that the provider cannot perform through the
+    generic ``arguments: object`` bridge.
 
-    Only *key absence* of schema-``required`` fields counts as invalid.
-    No type checking, no null rejection — nullable/typed edge cases are the
-    tool's own business, and ``coerce_tool_args`` already handles type repair
-    downstream. Returns a JSON error string when invalid, ``None`` when the
-    call should dispatch.
+    Missing/malformed schemas, unavailable validators, and external references
+    fail open so validation cannot make a previously callable tool unavailable.
+    Returns a JSON error string when invalid, ``None`` when the call should
+    dispatch through the existing middleware/hook/approval pipeline.
     """
     try:
         from tools.registry import registry as _registry
@@ -1239,14 +1381,68 @@ def validate_deferred_call_args(name: str, args: Dict[str, Any]) -> Optional[str
         if not isinstance(params, dict):
             return None
         required = params.get("required")
-        if not isinstance(required, list) or not required:
+        if isinstance(required, list) and required:
+            missing = [r for r in required if isinstance(r, str) and r not in args]
+            if missing:
+                return tool_error(
+                    f"tool_call to '{name}' is missing required argument(s): "
+                    f"{', '.join(missing)}. The tool was NOT invoked.",
+                    path="arguments",
+                    constraint="required",
+                    parameters=params,
+                    hint=(
+                        "Retry tool_call with 'arguments' matching the parameters "
+                        "schema above."
+                    ),
+                )
+
+        validation_schema = _schema_for_local_validation(params)
+        if _schema_has_external_ref(validation_schema):
+            logger.debug(
+                "Skipping local deferred-argument validation for %s: external $ref",
+                name,
+            )
             return None
-        missing = [r for r in required if isinstance(r, str) and r not in args]
-        if not missing:
+
+        # Validate the same repaired shape normal dispatch will receive. Work on
+        # a copy because coerce_tool_args may normalize values in place; actual
+        # dispatch performs the canonical coercion again after this probe.
+        candidate_args = dict(args)
+        try:
+            from model_tools import coerce_tool_args
+            candidate_args = coerce_tool_args(name, candidate_args)
+        except Exception:
+            logger.debug("Deferred-argument coercion failed for %s", name, exc_info=True)
+            candidate_args = dict(args)
+
+        try:
+            from jsonschema.exceptions import best_match
+            from jsonschema.validators import validator_for
+        except ImportError:
+            logger.debug(
+                "jsonschema unavailable; keeping required-only validation for %s",
+                name,
+            )
             return None
+
+        validator_cls = validator_for(validation_schema)
+        validator_cls.check_schema(validation_schema)
+        validation_error = best_match(
+            validator_cls(validation_schema).iter_errors(candidate_args)
+        )
+        if validation_error is None:
+            return None
+
+        path = _validation_path(validation_error)
+        constraint = str(getattr(validation_error, "validator", None) or "schema")
+        detail = re.sub(r"\s+", " ", str(validation_error.message)).strip()
+        if len(detail) > 600:
+            detail = detail[:597] + "..."
         return tool_error(
-            f"tool_call to '{name}' is missing required argument(s): "
-            f"{', '.join(missing)}. The tool was NOT invoked.",
+            f"tool_call to '{name}' failed argument validation at {path} "
+            f"({constraint}): {detail}. The tool was NOT invoked.",
+            path=path,
+            constraint=constraint,
             parameters=params,
             hint=(
                 "Retry tool_call with 'arguments' matching the parameters "
@@ -1283,7 +1479,7 @@ def resolve_underlying_call(args: Dict[str, Any]) -> Tuple[Optional[str], Dict[s
             return None, {}, f"tool_call 'arguments' is not valid JSON: {e}"
     if not isinstance(raw_args, dict):
         return None, {}, "tool_call 'arguments' must be an object"
-    if not is_deferrable_tool_name(name):
+    if not is_deferrable_tool_name(name, load_config_readonly().effective_defer_tools):
         return None, {}, (
             f"'{name}' is not a deferrable tool. If it appears in the model-facing tools "
             "list already, call it directly instead of via tool_call."
diff --git a/tools/tour_tool.py b/tools/tour_tool.py
index 5f6b204a57..88cde969c8 100644
--- a/tools/tour_tool.py
+++ b/tools/tour_tool.py
@@ -129,7 +129,7 @@ _STEP_SCHEMA = {
 }
 
 TOUR_SCHEMA = {
-    "name": "tour",
+    "name": "gui_tour",
     # Dieted (#95681): targets-first flow + stable-selector preference kept
     # (pre-effect: skipping them means guessed selectors on re-rendering UI).
     "description": (
@@ -189,7 +189,7 @@ def check_tours_enabled() -> bool:
 
 
 registry.register(
-    name="tour",
+    name="gui_tour",
     toolset="desktop_ui",
     schema=TOUR_SCHEMA,
     handler=lambda args, **kw: tour_tool(
diff --git a/tools/tts_tool.py b/tools/tts_tool.py
index 3aa4875922..70e0a4af70 100644
--- a/tools/tts_tool.py
+++ b/tools/tts_tool.py
@@ -266,6 +266,26 @@ def _get_default_output_dir() -> str:
     return str(get_hermes_dir("cache/audio", "audio_cache"))
 
 DEFAULT_OUTPUT_DIR = _get_default_output_dir()
+_DEFAULT_OUTPUT_DIR_AT_IMPORT = DEFAULT_OUTPUT_DIR
+
+def _default_output_dir() -> str:
+    """Return the active profile's audio output dir at call time.
+
+    Same bug class as skills_tool (f8723c478) and skills_sync (#65828):
+    long-lived multi-profile runtimes (dashboard console, TUI/Desktop backend,
+    cron, kanban workers) import this module once under the launch
+    HERMES_HOME and later scope requests to a different profile via
+    ``hermes_constants.set_hermes_home_override()`` — a frozen module
+    constant keeps writing synthesized audio into the launch profile's
+    cache instead of the active profile's (#98749). Keep the legacy
+    ``DEFAULT_OUTPUT_DIR`` module attribute for tests and external patchers;
+    when it has not been patched, re-resolve from the live profile-scoped
+    HERMES_HOME on every call.
+    """
+    configured = DEFAULT_OUTPUT_DIR
+    if configured != _DEFAULT_OUTPUT_DIR_AT_IMPORT:
+        return configured
+    return _get_default_output_dir()
 
 # ---------------------------------------------------------------------------
 # Per-provider input-character limits (from official provider docs).
@@ -2893,10 +2913,240 @@ def _tts_cache_get_or_load(cache: Dict[str, Any], key: str, load: Callable[[], A
     return value
 
 
+# ===========================================================================
+# Local-engine lifecycle: warm-up / release driven by TTS-output toggles
+# ===========================================================================
+#
+# Local engines (Piper, KittenTTS) load their model lazily on the first
+# synthesis call, so the first spoken reply after a user turns on "read
+# replies aloud" / a voice conversation pays the whole load (plus a voice
+# download on a fresh install) as dead air before the first word. And once
+# loaded, the model stays resident for the process lifetime even after every
+# TTS-output toggle is off again.
+#
+# The toggles ARE the intent signal. Every surface that flips speech output
+# on holds a *lease* here (warming the configured engine as a side effect);
+# flipping it off releases the lease, and when the last lease is gone the
+# local model caches are dropped. Lease-counting instead of a bare
+# on/off keeps one surface's "off" from unloading a model another surface
+# (TUI /voice tts, desktop read-aloud, desktop conversation) still needs —
+# they share this process's caches.
+#
+# Cloud providers have no resident model; warming them is a no-op beyond
+# making sure the lazily-installed SDK is importable (edge-tts), which is
+# also first-use latency users see as silence.
+
+# Provider name → local model cache it populates. The single registry both
+# warm_tts_provider() and the release path consult — a new local engine adds
+# one row here (at its cache declaration) plus a loader in
+# _local_tts_warmers() and gets warm/release for free.
+_LOCAL_TTS_MODEL_CACHES: Dict[str, Dict[str, Any]] = {}
+
+
+def _local_tts_warmers() -> Dict[str, Callable[[Dict[str, Any]], Any]]:
+    # Resolved lazily: the loader functions are defined later in this module.
+    return {
+        "piper": lambda cfg: _load_piper_voice_for_config(cfg)[0],
+        "kittentts": lambda cfg: _load_kittentts_model_for_config(cfg)[0],
+    }
+
+
+def _lazy_sdk_feature_for_provider(provider: str) -> Optional[str]:
+    """tools.lazy_deps feature key for providers whose SDK installs on first use."""
+    return {
+        "edge": "tts.edge",
+        "elevenlabs": "tts.elevenlabs",
+        "mistral": "tts.mistral",
+    }.get(provider)
+
+
+_tts_lease_lock = threading.Lock()
+_tts_leases: set = set()
+
+
+def _signal_user_tts_provider(name: str, tts_config: Dict[str, Any], hook: str) -> Optional[str]:
+    """Forward a lease ``hook`` (``"warm"`` / ``"release"``) to a user-declared provider.
+
+    Command providers run their optional ``warm_command`` / ``release_command``
+    (same template/env/timeout rules as ``command``; output discarded) on a
+    background thread so a toggle never waits on a model server. Plugin
+    providers get :meth:`TTSProvider.warm` / :meth:`TTSProvider.release`.
+    Best-effort: failures are logged at debug. Returns the action taken.
+    """
+    if not name or name in BUILTIN_TTS_PROVIDERS:
+        return None
+    cfg = _get_named_provider_config(tts_config, name)
+    try:
+        if _is_command_provider_config(cfg):
+            template = str(cfg.get(f"{hook}_command") or "").strip()
+            if not template:
+                return None
+            command = _render_command_tts_template(template, {
+                "voice": str(cfg.get("voice", "")),
+                "model": str(cfg.get("model", "")),
+                "speed": str(cfg.get("speed", tts_config.get("speed", ""))),
+            })
+
+            def _run() -> None:
+                try:
+                    _run_command_tts(command, _get_command_tts_timeout(cfg),
+                                     env_passthrough=_command_provider_env_passthrough(cfg))
+                except Exception as exc:  # noqa: BLE001 — best-effort hook
+                    logger.debug("[TTS] %s_command for %s failed: %s", hook, name, exc)
+
+            threading.Thread(target=_run, name=f"tts-{hook}-{name}", daemon=True).start()
+            return hook
+        from agent.tts_registry import get_provider
+        from hermes_cli.plugins import _ensure_plugins_discovered
+
+        _ensure_plugins_discovered()
+        plugin_provider = get_provider(name)
+        if plugin_provider is None:
+            return None
+        getattr(plugin_provider, hook)()
+        return hook
+    except Exception as exc:  # noqa: BLE001 — best-effort hook
+        logger.debug("[TTS] %s hook for %s failed: %s", hook, name, exc)
+        return "error"
+
+
+def warm_tts_provider(
+    tts_config: Optional[Dict[str, Any]] = None,
+    provider: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Pre-load the configured TTS provider so the next synthesis starts hot.
+
+    * Local engines (Piper, KittenTTS): resolve the configured voice/model
+      exactly as synthesis would (including first-use voice download) and
+      load it into the same LRU cache slot synthesis reads.
+    * Lazily-installed cloud SDKs (edge-tts, ElevenLabs, Mistral): make sure
+      the SDK is importable, installing it if lazy installs are allowed.
+    * User-declared providers: command providers run ``warm_command`` when
+      set; plugin providers get :meth:`TTSProvider.warm`.
+    * Everything else: nothing to warm — reported as ``action: "noop"``.
+
+    Never raises; the result dict carries ``warmed`` / ``action`` / ``error``
+    so callers on a toggle path can log and move on. Blocking — callers on a
+    UI thread should run it in the background.
+    """
+    if tts_config is None:
+        tts_config = _load_tts_config()
+    name = (provider or _get_provider(tts_config) or "").lower().strip()
+    result: Dict[str, Any] = {"provider": name, "warmed": False, "action": "noop"}
+
+    warmer = _local_tts_warmers().get(name)
+    if warmer is not None:
+        cache = _LOCAL_TTS_MODEL_CACHES.get(name)
+        before = len(cache) if cache is not None else 0
+        started = time.monotonic()
+        try:
+            warmer(tts_config)
+        except Exception as exc:  # engine missing, download failed, bad voice…
+            logger.warning("[TTS] warm-up for %s failed: %s", name, exc)
+            result.update(action="error", error=str(exc))
+            return result
+        after = len(cache) if cache is not None else 0
+        result.update(
+            warmed=True,
+            action="loaded" if after > before else "cached",
+            elapsed_ms=int((time.monotonic() - started) * 1000),
+        )
+        logger.info("[TTS] warm-up %s: %s in %dms", name, result["action"], result["elapsed_ms"])
+        return result
+
+    signalled = _signal_user_tts_provider(name, tts_config, "warm")
+    if signalled is not None:
+        result.update(warmed=signalled != "error", action="warmed" if signalled != "error" else "error")
+        return result
+
+    feature = _lazy_sdk_feature_for_provider(name)
+    if feature is not None:
+        try:
+            from tools.lazy_deps import ensure, is_available
+
+            if is_available(feature):
+                result.update(warmed=True, action="cached")
+            else:
+                ensure(feature, prompt=False)
+                result.update(warmed=True, action="installed")
+        except Exception as exc:
+            logger.debug("[TTS] SDK warm-up for %s skipped: %s", name, exc)
+            result.update(action="error", error=str(exc))
+    return result
+
+
+def release_tts_provider(provider: Optional[str] = None) -> Dict[str, Any]:
+    """Drop resident local TTS models so their memory is returned.
+
+    With ``provider`` given, only that engine's cache is cleared; otherwise
+    every local engine cache is and the configured user-declared provider
+    (plugin ``release()`` / command ``release_command``) is signalled.
+    Cloud providers hold nothing to release.
+    Returns ``{"released": <number of model instances dropped>}``. The next
+    synthesis simply reloads (or a warm-up does it ahead of time).
+    """
+    name = (provider or "").lower().strip()
+    if not name:
+        tts_config = _load_tts_config()
+        _signal_user_tts_provider(_get_provider(tts_config), tts_config, "release")
+    released = 0
+    for cache_name, cache in _LOCAL_TTS_MODEL_CACHES.items():
+        if name and cache_name != name:
+            continue
+        released += len(cache)
+        cache.clear()
+    if released:
+        logger.info("[TTS] released %d resident local model(s)", released)
+    return {"released": released}
+
+
+def acquire_tts_lease(lease: str, tts_config: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+    """Register ``lease`` as a live TTS-output consumer and warm the provider.
+
+    ``lease`` names the surface/toggle (e.g. ``"desktop:read-aloud"``,
+    ``"tui:voice-tts"``). Re-acquiring an existing lease is idempotent (still
+    re-warms — cheap on a cache hit, and heals a cache cleared elsewhere).
+    """
+    with _tts_lease_lock:
+        _tts_leases.add(lease)
+        holders = len(_tts_leases)
+    result = warm_tts_provider(tts_config)
+    result["leases"] = holders
+    return result
+
+
+def release_tts_lease(lease: str) -> Dict[str, Any]:
+    """Drop ``lease``; when it was the last one, unload resident local models.
+
+    Releasing a lease that was never acquired is a no-op (still reports the
+    live holder count) so surfaces can call it unconditionally on their
+    "off" path.
+    """
+    with _tts_lease_lock:
+        _tts_leases.discard(lease)
+        holders = len(_tts_leases)
+        result: Dict[str, Any] = {"leases": holders, "released": 0}
+        if holders == 0:
+            result["released"] = release_tts_provider()["released"]
+    return result
+
+
+def tts_lease_holders() -> List[str]:
+    """Snapshot of live lease names (diagnostics / tests)."""
+    with _tts_lease_lock:
+        return sorted(_tts_leases)
+
+
+def _reset_tts_leases_for_tests() -> None:
+    with _tts_lease_lock:
+        _tts_leases.clear()
+
+
 # Module-level cache for Piper voice instances. Voices are keyed on their
 # absolute .onnx model path so switching voices doesn't invalidate older
 # cached voices.
 _piper_voice_cache: Dict[str, Any] = {}
+_LOCAL_TTS_MODEL_CACHES["piper"] = _piper_voice_cache
 
 
 def _check_piper_available() -> bool:
@@ -2973,15 +3223,16 @@ def _resolve_piper_voice_path(voice: str, download_dir: Path) -> str:
     return str(cached)
 
 
-def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any]) -> str:
-    """Generate speech using the local Piper engine.
+def _load_piper_voice_for_config(tts_config: Dict[str, Any]) -> Tuple[Any, Dict[str, Any]]:
+    """Resolve + load (or fetch from cache) the Piper voice ``tts_config`` selects.
 
-    Loads the voice model once per process (cached by absolute path) and
-    writes a WAV file. Caller is responsible for converting to MP3/Opus
-    via ffmpeg when a different output format is required.
+    Shared by synthesis and :func:`warm_tts_provider` so a warm-up populates
+    exactly the cache slot the next synthesis call will hit — same voice
+    resolution, same download-on-first-use, same cache key.
+
+    Returns ``(voice, piper_config)``.
     """
     PiperVoice = _import_piper()
-    import wave
 
     piper_config = tts_config.get("piper") or {} if isinstance(tts_config, dict) else {}
     voice_name = piper_config.get("voice") or DEFAULT_PIPER_VOICE
@@ -2991,15 +3242,6 @@ def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any])
 
     model_path = _resolve_piper_voice_path(voice_name, download_dir)
 
-    # Tolerant speaker_id parse: drop bad input (non-int strings, lists, dicts)
-    # to 0 (Piper's own default). Booleans are rejected outright — True/False
-    # would silently coerce to 1/0 and hide a config mistake.
-    _raw_speaker = piper_config.get("speaker_id", 0)
-    if isinstance(_raw_speaker, bool) or not isinstance(_raw_speaker, int):
-        speaker_id = 0
-    else:
-        speaker_id = _raw_speaker
-
     # speaker_id is applied per-call via syn_config.speaker_id — the same
     # PiperVoice instance serves all speakers, so it stays out of the cache
     # key. Multi-speaker workflows share one model load.
@@ -3012,6 +3254,28 @@ def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any])
         return v
 
     voice = _tts_cache_get_or_load(_piper_voice_cache, cache_key, _load_piper_voice)
+    return voice, piper_config
+
+
+def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any]) -> str:
+    """Generate speech using the local Piper engine.
+
+    Loads the voice model once per process (cached by absolute path) and
+    writes a WAV file. Caller is responsible for converting to MP3/Opus
+    via ffmpeg when a different output format is required.
+    """
+    import wave
+
+    voice, piper_config = _load_piper_voice_for_config(tts_config)
+
+    # Tolerant speaker_id parse: drop bad input (non-int strings, lists, dicts)
+    # to 0 (Piper's own default). Booleans are rejected outright — True/False
+    # would silently coerce to 1/0 and hide a config mistake.
+    _raw_speaker = piper_config.get("speaker_id", 0)
+    if isinstance(_raw_speaker, bool) or not isinstance(_raw_speaker, int):
+        speaker_id = 0
+    else:
+        speaker_id = _raw_speaker
 
     # Optional synthesis knobs — only pass a SynthesisConfig when at least
     # one advanced knob is configured, so we don't depend on a newer Piper
@@ -3079,6 +3343,28 @@ def _generate_piper_tts(text: str, output_path: str, tts_config: Dict[str, Any])
 
 # Module-level cache for KittenTTS model instance
 _kittentts_model_cache: Dict[str, Any] = {}
+_LOCAL_TTS_MODEL_CACHES["kittentts"] = _kittentts_model_cache
+
+
+def _load_kittentts_model_for_config(tts_config: Dict[str, Any]) -> Tuple[Any, Dict[str, Any]]:
+    """Load (or fetch from cache) the KittenTTS model ``tts_config`` selects.
+
+    Shared by synthesis and :func:`warm_tts_provider` — same model name,
+    same cache key. Returns ``(model, kittentts_config)``.
+    """
+    KittenTTS = _import_kittentts()
+    kt_config = tts_config.get("kittentts", {}) if isinstance(tts_config, dict) else {}
+    kt_config = kt_config or {}
+    model_name = kt_config.get("model", DEFAULT_KITTENTTS_MODEL)
+
+    def _load_kittentts_model():
+        logger.info("[KittenTTS] Loading model: %s", model_name)
+        m = KittenTTS(model_name)
+        logger.info("[KittenTTS] Model loaded successfully")
+        return m
+
+    model = _tts_cache_get_or_load(_kittentts_model_cache, model_name, _load_kittentts_model)
+    return model, kt_config
 
 
 def _generate_kittentts(text: str, output_path: str, tts_config: Dict[str, Any]) -> str:
@@ -3095,22 +3381,11 @@ def _generate_kittentts(text: str, output_path: str, tts_config: Dict[str, Any])
     Returns:
         Path to the saved audio file.
     """
-    KittenTTS = _import_kittentts()
-    kt_config = tts_config.get("kittentts", {})
-    model_name = kt_config.get("model", DEFAULT_KITTENTTS_MODEL)
+    model, kt_config = _load_kittentts_model_for_config(tts_config)
     voice = kt_config.get("voice", DEFAULT_KITTENTTS_VOICE)
     speed = kt_config.get("speed", 1.0)
     clean_text = kt_config.get("clean_text", True)
 
-    # Use cached model instance if available
-    def _load_kittentts_model():
-        logger.info("[KittenTTS] Loading model: %s", model_name)
-        m = KittenTTS(model_name)
-        logger.info("[KittenTTS] Model loaded successfully")
-        return m
-
-    model = _tts_cache_get_or_load(_kittentts_model_cache, model_name, _load_kittentts_model)
-
     # Generate audio (returns numpy array at 24kHz)
     audio = model.generate(text, voice=voice, speed=speed, clean_text=clean_text)
 
@@ -3243,7 +3518,7 @@ def _text_to_speech_single(
             }, ensure_ascii=False)
     else:
         timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S_%f")
-        out_dir = Path(DEFAULT_OUTPUT_DIR)
+        out_dir = Path(_default_output_dir())
         out_dir.mkdir(parents=True, exist_ok=True)
         if command_provider_config is not None:
             fmt = _get_command_tts_output_format(command_provider_config)
@@ -3601,7 +3876,7 @@ def text_to_speech_tool(
             }, ensure_ascii=False)
     else:
         timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S_%f")
-        out_dir = Path(DEFAULT_OUTPUT_DIR)
+        out_dir = Path(_default_output_dir())
         out_dir.mkdir(parents=True, exist_ok=True)
         if command_provider_config is not None:
             fmt = _get_command_tts_output_format(command_provider_config)
@@ -4484,7 +4759,7 @@ if __name__ == "__main__":
     print(f"  MiniMax:    {minimax_status}")
     print(f"  Piper:      {'installed' if _check_piper_available() else 'not installed (pip install piper-tts)'}")
     print(f"  ffmpeg:     {'✅ found' if _has_ffmpeg() else '❌ not found (needed for Telegram Opus)'}")
-    print(f"\n  Output dir: {DEFAULT_OUTPUT_DIR}")
+    print(f"\n  Output dir: {_default_output_dir()}")
 
     provider = _get_provider(config)
     print(f"  Configured provider: {provider}")
diff --git a/tools/url_safety.py b/tools/url_safety.py
index e9b230ac68..6442fe4bf5 100644
--- a/tools/url_safety.py
+++ b/tools/url_safety.py
@@ -21,7 +21,7 @@ Limitations:
     connects to the validated IP while preserving Host/SNI semantics.
   - Redirect-based bypass is mitigated by httpx event hooks that re-validate
     each redirect target in vision_tools, gateway platform adapters, and
-    media cache helpers. Web tools use third-party SDKs (Firecrawl/Exa)
+    media cache helpers. Web tools use third-party SDKs (Firecrawl/Tavily)
     where redirect handling is on their servers.
 """
 
diff --git a/tools/vision_tools.py b/tools/vision_tools.py
index 337bc24d77..f6c1852182 100644
--- a/tools/vision_tools.py
+++ b/tools/vision_tools.py
@@ -290,6 +290,30 @@ _ANTHROPIC_SUPPORTED_MEDIA_TYPES = frozenset(
 )
 
 
+def _supported_media_types() -> frozenset:
+    """Formats the ACTIVE main model's server can decode.
+
+    Cloud providers take everything in _ANTHROPIC_SUPPORTED_MEDIA_TYPES.
+    The managed llama-server decodes with stb_image — no WebP — and an
+    undecodable image part fails SILENTLY (no error; the model never sees
+    an image and confabulates). Narrow the set so normalization converts
+    those formats to PNG before they enter the request or history."""
+    try:
+        from agent.auxiliary_client import _runtime_main_value
+        from hermes_cli.local_runtime.capabilities import (
+            ACCEPTED_IMAGE_MIMES,
+            is_managed_provider,
+        )
+
+        if is_managed_provider(
+                str(_runtime_main_value("provider") or ""),
+                str(_runtime_main_value("base_url") or "")):
+            return ACCEPTED_IMAGE_MIMES
+    except Exception:  # noqa: BLE001 — best-effort narrowing only
+        pass
+    return _ANTHROPIC_SUPPORTED_MEDIA_TYPES
+
+
 def _rasterize_svg_to_png(svg_path: Path, out_path: Path) -> bool:
     """Best-effort SVG → PNG rasterization. Returns True on success.
 
@@ -353,7 +377,7 @@ def _normalize_to_supported_image(
     the image is base64-embedded into conversation history, so an unsupported
     media_type can never reach the provider and wedge the session.
     """
-    if detected_mime in _ANTHROPIC_SUPPORTED_MEDIA_TYPES:
+    if detected_mime in _supported_media_types():
         return image_path, detected_mime, None
 
     out_dir = get_hermes_dir("cache/vision", "temp_vision_images")
diff --git a/tools/web_tools.py b/tools/web_tools.py
index 93b8e5e9d0..ab59f4cf20 100644
--- a/tools/web_tools.py
+++ b/tools/web_tools.py
@@ -15,6 +15,7 @@ Backend compatibility:
 - Exa: https://exa.ai (search, extract)
 - Firecrawl: https://docs.firecrawl.dev/introduction (search, extract; direct or derived firecrawl-gateway.<domain> for Nous Subscribers)
 - Parallel: https://docs.parallel.ai (search, extract)
+- Tavily: https://tavily.com (search, extract; keyed or opt-in keyless)
 
 LLM Processing:
 - Uses OpenRouter API with Gemini 3 Flash Preview for intelligent content extraction
@@ -57,6 +58,13 @@ from plugins.web.firecrawl.provider import (
     _is_tool_gateway_ready,
     check_firecrawl_api_key,
 )
+# Tavily helpers re-exported for backward-compat with existing unit tests
+# (tests/tools/test_web_tools_tavily.py imports these names directly).
+from plugins.web.tavily.provider import (  # noqa: F401 — backward-compat names
+    _normalize_tavily_documents,
+    _normalize_tavily_search_results,
+    _tavily_request,
+)
 # Parallel + Exa clients re-exported for backward-compat with existing
 # unit tests (tests/tools/test_web_tools_config.py imports _get_parallel_client
 # / _get_async_parallel_client / _get_exa_client directly).
@@ -161,7 +169,7 @@ def _load_web_config() -> dict:
 # WebSearchProvider. Keep the two sets aligned by hand: if xai ever ships as
 # a registered provider, drop it here so the registry path takes over.
 _LEGACY_WEB_BACKENDS = frozenset(
-    {"parallel", "firecrawl", "exa", "searxng", "brave-free", "ddgs", "xai", "keenable"}
+    {"parallel", "firecrawl", "tavily", "exa", "searxng", "brave-free", "ddgs", "xai", "keenable"}
 )
 
 
@@ -244,13 +252,14 @@ def _get_backend() -> str:
         return "firecrawl"
 
     # Never-configured install — pick the highest-priority available
-    # backend. Explicit user credentials (EXA_API_KEY etc.)
+    # backend. Explicit user credentials (TAVILY_API_KEY etc.)
     # beat the managed-tool-gateway probe so a deliberate setup is not
     # pre-empted by a Nous OAuth token whose subscription tier may not
     # actually grant web-search access (the gateway then fails at runtime
     # with "no subscription" and the tool returns an error to the agent
     # without falling back). Free-tier backends trail the paid ones.
     backend_candidates = (
+        ("tavily", _has_env("TAVILY_API_KEY")),
         ("exa", _has_env("EXA_API_KEY")),
         ("parallel", _has_env("PARALLEL_API_KEY")),
         ("keenable", _has_env("KEENABLE_API_KEY")),
@@ -350,6 +359,13 @@ def _get_capability_backend(capability: str) -> str:
     return _get_backend()
 
 
+def _tavily_explicitly_configured() -> bool:
+    cfg = _load_web_config()
+    return any(
+        (cfg.get(key) or "").lower().strip() == "tavily"
+        for key in ("backend", "search_backend", "extract_backend")
+    )
+
 
 def _is_backend_available(backend: str) -> bool:
     """Return True when the selected backend is currently usable.
@@ -376,6 +392,8 @@ def _is_backend_available(backend: str) -> bool:
         return _has_env("KEENABLE_API_KEY")
     if backend == "firecrawl":
         return check_firecrawl_api_key()
+    if backend == "tavily":
+        return _has_env("TAVILY_API_KEY") or _tavily_explicitly_configured()
     if backend == "searxng":
         return _has_env("SEARXNG_URL")
     if backend == "brave-free":
@@ -585,6 +603,7 @@ def _web_requires_env() -> list[str]:
     return [
         "EXA_API_KEY",
         "PARALLEL_API_KEY",
+        "TAVILY_API_KEY",
         "KEENABLE_API_KEY",
         "FIRECRAWL_API_KEY",
         "FIRECRAWL_API_URL",
@@ -595,10 +614,11 @@ def _web_requires_env() -> list[str]:
     ]
 
 
-# ─── Parallel / Firecrawl helpers — moved into plugins ───────────────────────
+# ─── Parallel / Tavily / Firecrawl helpers — moved into plugins ──────────────
 # After PR #25182, the per-vendor client construction, request helpers, and
 # response normalizers all live in plugins.web.<vendor>.provider:
 #   - parallel: plugins/web/parallel/provider.py
+#   - tavily:   plugins/web/tavily/provider.py
 #   - firecrawl: plugins/web/firecrawl/provider.py
 # The names from the firecrawl plugin (Firecrawl proxy, _get_firecrawl_client,
 # _to_plain_object, _normalize_result_list, _extract_web_search_results,
@@ -790,7 +810,7 @@ def _ensure_web_plugins_loaded() -> None:
     """Idempotently trigger plugin discovery so the web registry is populated.
 
     Every bundled web provider (brave-free, ddgs, searxng, exa, parallel,
-    firecrawl, keenable) registers itself via ``plugins/web/<vendor>/__init__.py``
+    tavily, firecrawl, keenable) registers itself via ``plugins/web/<vendor>/__init__.py``
     during plugin discovery. Tool dispatch can be reached from contexts that
     haven't already triggered discovery — subprocess agent runs, delegate
     children, standalone scripts, certain test paths — and without it the
@@ -871,9 +891,9 @@ def web_search_tool(query: str, limit: int = 5) -> str:
         if is_interrupted():
             return tool_error("Interrupted", success=False)
 
-        # Dispatch through the web search registry. All 7 providers
-        # (brave-free, ddgs, searxng, exa, parallel, firecrawl, keenable)
-        # now live as plugins; the dispatcher is just a registry lookup +
+        # Dispatch through the web search registry. All bundled providers
+        # (brave-free, ddgs, searxng, exa, parallel, tavily, firecrawl,
+        # keenable) now live as plugins; the dispatcher is just a registry lookup +
         # delegation. Sync only — every provider's search() is sync.
         _ensure_web_plugins_loaded()
         from agent.web_search_registry import (
@@ -1034,7 +1054,7 @@ async def web_extract_tool(
     Extract content from specific web pages using available extraction API backend.
 
     Returns clean page content (markdown/text) with NO LLM summarization. The
-    extract backends (Firecrawl, Exa, Parallel, Keenable) already return clean,
+    extract backends (Firecrawl, Tavily, Exa, Parallel, Keenable) already return clean,
     boilerplate-stripped content, so we return it directly and fast. Pages over
     ``char_limit`` are head+tail truncated with an explicit footer; the full
     text is stored under cache/web and the footer tells the model how to
@@ -1142,10 +1162,10 @@ async def web_extract_tool(
         else:
             backend = _get_extract_backend()
 
-            # All seven providers (brave-free, ddgs, searxng, exa, parallel,
-            # firecrawl, keenable) now live as plugins. The dispatcher is a
+            # All bundled providers (brave-free, ddgs, searxng, exa, parallel,
+            # tavily, firecrawl, keenable) now live as plugins. The dispatcher is a
             # registry lookup + delegation. Some providers' extract() is
-            # async (parallel, firecrawl), others sync (exa, keenable) — we
+            # async (parallel, firecrawl), others sync (exa, tavily, keenable) — we
             # detect coroutine functions and await; sync functions run
             # inline (the policy gate, SSRF re-check, etc. live inside the
             # provider itself for the firecrawl per-URL loop).
@@ -1172,7 +1192,7 @@ async def web_extract_tool(
                                 f"{provider.display_name} is a search-only "
                                 "backend and cannot extract URL content. "
                                 "Set web.extract_backend to firecrawl, "
-                                "keenable, exa, or parallel."
+                                "tavily, keenable, exa, or parallel."
                             ),
                         },
                         ensure_ascii=False,
@@ -1235,7 +1255,7 @@ async def web_extract_tool(
                             "error": (
                                 "No web extract provider configured. "
                                 "Set web.extract_backend to firecrawl, "
-                                "keenable, exa, or parallel."
+                                "tavily, keenable, exa, or parallel."
                             ),
                         },
                         ensure_ascii=False,
@@ -1284,7 +1304,7 @@ async def web_extract_tool(
                 )
 
                 # Async-or-sync dispatch: parallel + firecrawl have async
-                # extract(); exa + keenable are sync.
+                # extract(); exa + tavily + keenable are sync.
                 import inspect
                 _extract_rescued = False
                 try:
@@ -1568,6 +1588,11 @@ if __name__ == "__main__":
             print("   Using Exa API (https://exa.ai)")
         elif backend == "parallel":
             print("   Using Parallel API (https://parallel.ai)")
+        elif backend == "tavily":
+            if _has_env("TAVILY_API_KEY"):
+                print("   Using Tavily API (https://tavily.com)")
+            else:
+                print("   Using Tavily keyless (https://docs.tavily.com/documentation/keyless)")
         elif backend == "searxng":
             print(f"   Using SearXNG (search only): {_env_value('SEARXNG_URL')}")
         elif backend == "brave-free":
@@ -1585,7 +1610,7 @@ if __name__ == "__main__":
     else:
         print("❌ No web search backend configured")
         print(
-            "Set EXA_API_KEY, PARALLEL_API_KEY, KEENABLE_API_KEY, FIRECRAWL_API_KEY, FIRECRAWL_API_URL"
+            "Set EXA_API_KEY, PARALLEL_API_KEY, TAVILY_API_KEY, KEENABLE_API_KEY, FIRECRAWL_API_KEY, FIRECRAWL_API_URL"
             f"{_firecrawl_backend_help_suffix()}"
         )
 
diff --git a/toolsets.py b/toolsets.py
index d205c0c02e..a40d803538 100644
--- a/toolsets.py
+++ b/toolsets.py
@@ -32,7 +32,7 @@ _HERMES_CORE_TOOLS = [
     # Web
     "web_search", "web_extract",
     # Terminal + process management
-    "terminal", "process",
+    "terminal", "process_manage",
     # NOTE: the desktop GUI affordances (read_terminal, open_preview, …) are
     # deliberately NOT here, for the same reason as the `project` tools below:
     # they only work where a GUI renderer can answer them. They live in the
@@ -56,7 +56,7 @@ _HERMES_CORE_TOOLS = [
     # Text-to-speech
     "text_to_speech",
     # Planning & memory
-    "todo", "memory",
+    "todo_list", "memory",
     # NOTE: the desktop Project tools (project_list/create/switch) are
     # deliberately NOT here. They only make sense where a GUI can follow the
     # move, so they live in the `project` toolset and are enabled solely by the
@@ -69,7 +69,7 @@ _HERMES_CORE_TOOLS = [
     # Code execution + delegation
     "execute_code", "delegate_task",
     # Cronjob management
-    "cronjob",
+    "cronjob_manage",
     # Home Assistant smart home control (gated on HASS_TOKEN via check_fn)
     "ha_list_entities", "ha_get_state", "ha_list_services", "ha_call_service",
     # Kanban multi-agent coordination — only in schema when the agent is
@@ -169,7 +169,7 @@ TOOLSETS = {
 
     "terminal": {
         "description": "Terminal/command execution and process management tools",
-        "tools": ["terminal", "process"],
+        "tools": ["terminal", "process_manage"],
         "includes": []
     },
     
@@ -193,7 +193,7 @@ TOOLSETS = {
     
     "cronjob": {
         "description": "Cronjob management tool - create, list, update, pause, resume, remove, and trigger scheduled tasks",
-        "tools": ["cronjob"],
+        "tools": ["cronjob_manage"],
         "includes": []
     },
     
@@ -212,7 +212,7 @@ TOOLSETS = {
     
     "todo": {
         "description": "Task planning and tracking for multi-step work",
-        "tools": ["todo"],
+        "tools": ["todo_list"],
         "includes": []
     },
     
@@ -262,7 +262,7 @@ TOOLSETS = {
             "desktop_preview", "drive_preview", "annotate_preview",
             "read_window_below",
             "focus_pane", "react_to_message",
-            "setup_mcp", "tour", "tip",
+            "setup_mcp", "gui_tour", "show_tip",
         ],
         "includes": []
     },
@@ -369,7 +369,7 @@ TOOLSETS = {
     
     "debugging": {
         "description": "Debugging and troubleshooting toolkit",
-        "tools": ["terminal", "process"],
+        "tools": ["terminal", "process_manage"],
         "includes": ["web", "file"]  # For searching error messages and solutions, and file operations
     },
     
@@ -392,7 +392,7 @@ TOOLSETS = {
         "description": "Coding-focused toolset: files, terminal, search, web docs, skills, todo, delegate, vision, browser",
         "tools": [
             "web_search", "web_extract",
-            "terminal", "process",
+            "terminal", "process_manage",
             "read_file", "write_file", "patch", "search_files",
             "vision_analyze",
             "skills_list", "skill_view", "skill_manage",
@@ -401,7 +401,7 @@ TOOLSETS = {
             "browser_press", "browser_get_images",
             "browser_vision", "browser_console", "browser_cdp", "browser_dialog",
             "browser_exec",
-            "todo", "memory",
+            "todo_list", "memory",
             "session_search", "clarify",
             "execute_code", "delegate_task",
         ],
@@ -425,7 +425,7 @@ TOOLSETS = {
         "description": "Editor integration (VS Code, Zed, JetBrains) — coding-focused tools without messaging, audio, or clarify UI",
         "tools": [
             "web_search", "web_extract",
-            "terminal", "process",
+            "terminal", "process_manage",
             "read_file", "write_file", "patch", "search_files",
             "vision_analyze",
             "skills_list", "skill_view", "skill_manage",
@@ -434,7 +434,7 @@ TOOLSETS = {
             "browser_press", "browser_get_images",
             "browser_vision", "browser_console", "browser_cdp", "browser_dialog",
             "browser_exec",
-            "todo", "memory",
+            "todo_list", "memory",
             "session_search",
             "execute_code", "delegate_task",
         ],
@@ -447,7 +447,7 @@ TOOLSETS = {
             # Web
             "web_search", "web_extract",
             # Terminal + process management
-            "terminal", "process",
+            "terminal", "process_manage",
             # File manipulation
             "read_file", "write_file", "patch", "search_files",
             # Vision + image generation
@@ -461,13 +461,13 @@ TOOLSETS = {
             "browser_vision", "browser_console", "browser_cdp", "browser_dialog",
             "browser_exec",
             # Planning & memory
-            "todo", "memory",
+            "todo_list", "memory",
             # Session history search
             "session_search",
             # Code execution + delegation
             "execute_code", "delegate_task",
             # Cronjob management
-            "cronjob",
+            "cronjob_manage",
             # Home Assistant smart home control (gated on HASS_TOKEN via check_fn)
             "ha_list_entities", "ha_get_state", "ha_list_services", "ha_call_service",
 
diff --git a/tui_gateway/host_supervisor.py b/tui_gateway/host_supervisor.py
index 0b826e4abe..9f8a7bd4a6 100644
--- a/tui_gateway/host_supervisor.py
+++ b/tui_gateway/host_supervisor.py
@@ -47,6 +47,11 @@ MUTATOR_ROUTE_TABLE: dict[str, str] = {
 _REGISTRY_NAME = "dashboard-compute-host.json"
 _RESPAWN_WINDOW_SECS = 300.0
 _SHUTDOWN_TIMEOUT_SECS = 10.0
+# Late control-ack handlers (#97948): a compress that outlives its RPC waiter
+# can legitimately run for the full compression ceiling plus a stall-fallback
+# retry, so keep registrations around well past that — but bounded.
+_LATE_CONTROL_TTL_SECS = 1800.0
+_LATE_CONTROL_MAX = 64
 
 
 def append_log_record(path: str | Path, record: str) -> None:
@@ -167,6 +172,11 @@ class HostSupervisor:
         self._restart_times: list[float] = []
         self._pending_turns: dict[str, tuple[str, Callable[[dict], None] | None]] = {}
         self._pending_controls: dict[str, queue.Queue[dict]] = {}
+        # request_id -> (registered_at, handler) for control waiters that timed
+        # out but whose host work is still running (#97948). The host emits
+        # its control.ack whenever it finishes; without this the ack matched
+        # no queue and was silently dropped.
+        self._late_control_handlers: dict[str, tuple[float, Callable[[dict], None]]] = {}
         self._stderr_tail: list[str] = []
         self._last_progress_counter = 0
 
@@ -307,7 +317,17 @@ class HostSupervisor:
         payload: dict[str, Any] | None = None,
         wait: bool = True,
         timeout: float = 30.0,
+        on_late_ack: Callable[[dict], None] | None = None,
     ) -> dict:
+        """Send a control frame; with ``wait`` block up to ``timeout`` for its ack.
+
+        ``on_late_ack`` (only meaningful with ``wait``) keeps the request
+        adoptable after the waiter gives up: when the host's ``control.ack`` /
+        ``control.error`` / ``error`` for this ``request_id`` eventually
+        arrives, the handler fires once instead of the frame being dropped.
+        Registrations are bounded by ``_LATE_CONTROL_TTL_SECS`` /
+        ``_LATE_CONTROL_MAX``.
+        """
         if route_name not in MUTATOR_ROUTE_TABLE:
             raise ValueError(f"unclassified host mutator route: {route_name}")
         self.start()
@@ -327,10 +347,47 @@ class HostSupervisor:
             return {"status": "sent", "request_id": request_id}
         try:
             return q.get(timeout=timeout)
+        except queue.Empty:
+            if on_late_ack is not None:
+                self._register_late_control_handler(request_id, on_late_ack)
+            raise
         finally:
             with self._lock:
                 self._pending_controls.pop(request_id, None)
 
+    def _register_late_control_handler(self, request_id: str, handler: Callable[[dict], None]) -> None:
+        now = time.monotonic()
+        with self._lock:
+            expired = [
+                rid
+                for rid, (registered_at, _cb) in self._late_control_handlers.items()
+                if now - registered_at > _LATE_CONTROL_TTL_SECS
+            ]
+            for rid in expired:
+                self._late_control_handlers.pop(rid, None)
+            while len(self._late_control_handlers) >= _LATE_CONTROL_MAX:
+                oldest = min(self._late_control_handlers, key=lambda rid: self._late_control_handlers[rid][0])
+                self._late_control_handlers.pop(oldest, None)
+            self._late_control_handlers[request_id] = (now, handler)
+
+    def _deliver_control_frame(self, request_id: str, frame: dict[str, Any]) -> None:
+        with self._lock:
+            q = self._pending_controls.get(request_id)
+            late = None if q is not None else self._late_control_handlers.pop(request_id, None)
+        if q is not None:
+            try:
+                q.put_nowait(frame)
+            except queue.Full:
+                pass
+            return
+        if late is None:
+            return
+        _registered_at, handler = late
+        try:
+            handler(frame)
+        except Exception:
+            logger.exception("compute host late control ack handler failed (request_id=%s)", request_id)
+
     def _spawn_locked(self, *, reason: str) -> None:
         if self._stopped_respawning:
             raise RuntimeError("compute host respawn disabled after crash loop")
@@ -452,24 +509,10 @@ class HostSupervisor:
             self._complete_turn(frame)
             return
         if ftype in {"control.ack", "control.error", "respond.ack", "respond.error", "interrupt.ack", "reload_mcp.ack", "shutdown.ack"}:
-            request_id = str(frame.get("request_id") or "")
-            with self._lock:
-                q = self._pending_controls.get(request_id)
-            if q is not None:
-                try:
-                    q.put_nowait(frame)
-                except queue.Full:
-                    pass
+            self._deliver_control_frame(str(frame.get("request_id") or ""), frame)
             return
         if ftype == "error" and frame.get("request_id"):
-            request_id = str(frame.get("request_id") or "")
-            with self._lock:
-                q = self._pending_controls.get(request_id)
-            if q is not None:
-                try:
-                    q.put_nowait(frame)
-                except queue.Full:
-                    pass
+            self._deliver_control_frame(str(frame.get("request_id") or ""), frame)
 
     def _complete_turn(self, frame: dict[str, Any]) -> None:
         request_id = str(frame.get("request_id") or "")
@@ -524,6 +567,17 @@ class HostSupervisor:
                     cb(frame)
                 except Exception:
                     logger.exception("compute host error callback failed")
+        # A crashed host will never emit the late acks the timed-out control
+        # waiters are still expecting; fail them the same way so the client's
+        # "still running in the background" notice does not hang forever.
+        with self._lock:
+            late = self._late_control_handlers
+            self._late_control_handlers = {}
+        for request_id, (_registered_at, handler) in late.items():
+            try:
+                handler({"type": "control.error", "request_id": request_id, "reason": reason, "message": message})
+            except Exception:
+                logger.exception("compute host late control error handler failed")
 
     def _maybe_respawn_after_crash(self) -> None:
         now = time.monotonic()
diff --git a/tui_gateway/methods_bot_relay.py b/tui_gateway/methods_bot_relay.py
index 992bbc1704..5044518759 100644
--- a/tui_gateway/methods_bot_relay.py
+++ b/tui_gateway/methods_bot_relay.py
@@ -109,6 +109,41 @@ def _(rid, params: dict) -> dict:
         if resolved not in known:
             return _err(rid, 4092, f"no profile '{profile}' on this gateway")
 
+        # #100523: when THIS gateway already hosts the target's Bot Chat live
+        # (the Desktop has it open), the subprocess transport is fenced out by
+        # the single-owner lease ("already has a live owner") and the payload
+        # is dropped. Land the DM in the live session as a normal user turn
+        # via prompt.submit instead — same choke point the composer uses, so
+        # role alternation, persistence and streaming all behave as a typed
+        # message would. (Nested per method_ctx rebinding.)
+        def _live_bot_chat_sid(profile_name: str) -> str:
+            from tools.bot_mode_probe import BOT_CHAT_TITLE
+
+            live_home = _profile_home(profile_name)
+            want_home = str(live_home) if live_home is not None else None
+            for live_sid, record in list(_sessions.items()):
+                if not isinstance(record, dict):
+                    continue
+                if (record.get("profile_home") or None) != want_home:
+                    continue
+                key = _session_lookup_key(record, fallback=live_sid)
+                if _session_live_title(record, key) == BOT_CHAT_TITLE:
+                    return live_sid
+            return ""
+
+        live_sid = _live_bot_chat_sid(resolved)
+        if live_sid:
+            # queued=True: a teammate's DM runs as the NEXT turn. It must never
+            # interrupt or steer a turn already in flight (the default busy
+            # mode does); hundreds of arrivals simply queue in arrival order.
+            submitted = _methods["prompt.submit"](rid, {"session_id": live_sid, "text": message, "queued": True})
+            if "error" in submitted:
+                return submitted
+            return _ok(
+                rid,
+                {"reply": f"Delivered into @{resolved}'s open Bot Chat; the reply will appear there."},
+            )
+
         fd, tmp = tempfile.mkstemp(prefix="hermes-relay-dm-", suffix=".txt", text=True)
         try:
             with os.fdopen(fd, "w", encoding="utf-8") as f:
diff --git a/tui_gateway/methods_config.py b/tui_gateway/methods_config.py
index 916abfc182..d0ffb2396e 100644
--- a/tui_gateway/methods_config.py
+++ b/tui_gateway/methods_config.py
@@ -123,6 +123,9 @@ def _(rid, params: dict) -> dict:
     Lanes carry no session rows here; drill-in uses ``projects.project_sessions``.
     """
     try:
+        from tui_gateway.project_tree import stamp_profile
+        from tui_gateway.server import _response_profile_name
+
         with _profile_db(params) as db:
             if db is None:
                 return _ok(
@@ -136,6 +139,9 @@ def _(rid, params: dict) -> dict:
                 session_limit=int(params.get("session_limit") or 2000),
                 include_discovered=True,
             )
+            stamp_profile(
+                tree["projects"], _response_profile_name(params.get("profile"))
+            )
             return _ok(
                 rid,
                 {
@@ -155,6 +161,9 @@ def _(rid, params: dict) -> dict:
     built from the same authoritative grouping as ``projects.tree`` so ids and
     membership match exactly. Used when the user enters a project."""
     try:
+        from tui_gateway.project_tree import stamp_profile
+        from tui_gateway.server import _response_profile_name
+
         project_id = str(params.get("project_id") or "")
         if not project_id:
             return _err(rid, 5063, "project_id required")
@@ -172,6 +181,9 @@ def _(rid, params: dict) -> dict:
                 session_limit=int(params.get("session_limit") or 5000),
                 include_discovered=False,
             )
+            stamp_profile(
+                tree["projects"], _response_profile_name(params.get("profile"))
+            )
             proj = next((p for p in tree["projects"] if p["id"] == project_id), None)
             return _ok(rid, {"project": proj})
     except Exception as e:
@@ -377,12 +389,49 @@ def _(rid, params: dict) -> dict:
     return _err(rid, 4002, f"unknown config key: {key}")
 
 
+def _readiness_profile_scope(params: dict):
+    """Resolve the optional ``profile`` param of the setup readiness RPCs.
+
+    Returns ``(profile, scope)`` where ``scope`` is a context manager binding
+    that profile's HERMES_HOME and ``.env`` secret scope (ContextVars, so
+    concurrent checks for different profiles stay isolated). The launch
+    profile / no param yields ``("", nullcontext())``. A profile unknown to
+    this host raises ``FileNotFoundError`` — a readiness check must never
+    quietly answer for the launch profile instead (#94071).
+    """
+    import contextlib
+
+    profile = str(params.get("profile") or "").strip() if isinstance(params, dict) else ""
+    if not profile:
+        return "", contextlib.nullcontext()
+    from hermes_cli import profiles as profiles_mod
+    from tui_gateway import server as _server
+
+    if not profiles_mod.profile_exists(profile):
+        raise FileNotFoundError(f"Profile '{profile}' does not exist on this backend.")
+    home = _server._profile_home(profile)
+    if home is None:
+        return profile, contextlib.nullcontext()
+    return profile, _server._session_profile_runtime_scope({"profile_home": str(home)})
+
+
 @method("setup.status")
 def _(rid, params: dict) -> dict:
+    """Loose provider check; ``profile`` (optional) scopes it to that profile's home."""
     try:
         from hermes_cli.main import _has_any_provider_configured
+        from tui_gateway.methods_config import _readiness_profile_scope
 
-        return _ok(rid, {"provider_configured": bool(_has_any_provider_configured())})
+        try:
+            profile, scope = _readiness_profile_scope(params)
+        except FileNotFoundError as e:
+            return _ok(rid, {"ok": False, "profile": params.get("profile"), "error": str(e)})
+        with scope:
+            configured = bool(_has_any_provider_configured(strict_profile_scope=bool(profile)))
+        payload = {"provider_configured": configured}
+        if profile:
+            payload["profile"] = profile
+        return _ok(rid, payload)
     except Exception as e:
         return _err(rid, 5016, str(e))
 
@@ -397,15 +446,27 @@ def _(rid, params: dict) -> dict:
     uses on session creation. It returns ok=False with the auth error message
     when the user's configured model cannot actually be served, so UIs can
     surface onboarding before the user submits a doomed prompt.
+
+    ``profile`` (optional): answer for THAT profile's home on this host — its
+    config.yaml model pin and its ``.env`` — instead of the launch profile's
+    (#94071). A profile unknown to this backend answers ``ok=False`` rather
+    than reporting the launch profile's readiness.
     """
     try:
         from hermes_cli.runtime_provider import resolve_runtime_provider
         from hermes_cli.auth import has_usable_secret
         from hermes_cli.main import _has_any_provider_configured
+        from tui_gateway.methods_config import _readiness_profile_scope
 
         requested = str(params.get("provider") or "").strip() or None
-        runtime = resolve_runtime_provider(requested=requested)
-        provider_configured = bool(_has_any_provider_configured())
+        try:
+            profile, scope = _readiness_profile_scope(params)
+        except FileNotFoundError as e:
+            return _ok(rid, {"ok": False, "profile": params.get("profile"), "error": str(e)})
+        with scope:
+            runtime = resolve_runtime_provider(requested=requested)
+            provider_configured = bool(_has_any_provider_configured(strict_profile_scope=bool(profile)))
+        scoped = {"profile": profile} if profile else {}
         provider = runtime.get("provider") or "provider"
         source = str(runtime.get("source") or "")
         if (
@@ -425,6 +486,7 @@ def _(rid, params: dict) -> dict:
                     "model": runtime.get("model"),
                     "source": source,
                     "error": "No Hermes provider is configured.",
+                    **scoped,
                 },
             )
 
@@ -446,6 +508,7 @@ def _(rid, params: dict) -> dict:
                     "model": runtime.get("model"),
                     "source": runtime.get("source"),
                     "error": f"No usable credentials found for {provider}.",
+                    **scoped,
                 },
             )
 
@@ -456,6 +519,7 @@ def _(rid, params: dict) -> dict:
                 "provider": runtime.get("provider"),
                 "model": runtime.get("model"),
                 "source": runtime.get("source"),
+                **scoped,
             },
         )
     except Exception as e:
diff --git a/tui_gateway/methods_profiles.py b/tui_gateway/methods_profiles.py
index db894586bf..3cc757d3b5 100644
--- a/tui_gateway/methods_profiles.py
+++ b/tui_gateway/methods_profiles.py
@@ -467,6 +467,15 @@ def _(rid, params: dict) -> dict:
                     os.chmod(str(dst_auth), 0o600)
                 except OSError:
                     pass
+                # Mirroring must not fork single-use OAuth grants (Anthropic /
+                # Codex / xAI): the first profile to refresh strands every
+                # sibling (#100339). API keys stay; OAuth rows are dropped
+                # and read from the root grant via the pool fallback.
+                try:
+                    from hermes_cli.auth import strip_cloned_single_use_oauth_grants
+                    strip_cloned_single_use_oauth_grants(path)
+                except Exception:
+                    pass
                 mirrored["auth"] = True
         except Exception:
             pass
diff --git a/tui_gateway/methods_prompt.py b/tui_gateway/methods_prompt.py
index ee411eb7a0..7ac4dbdaf2 100644
--- a/tui_gateway/methods_prompt.py
+++ b/tui_gateway/methods_prompt.py
@@ -987,7 +987,18 @@ def _(rid, params: dict) -> dict:
             5071,
             f"session storage could not be written: {exc}",
         )
-    _start_agent_build(sid, session)
+    # A completed FAILED build must not wedge the session: the error frame
+    # says retryable, so a new send (or the error card's Retry) rebuilds the
+    # agent with fresh provider resolution instead of replaying the cached
+    # failure forever. Before this, only a model switch reset the failed
+    # generation — a session that failed once (local server off) kept
+    # erroring after the server came back, while new sessions worked. Falls
+    # through to the normal build when there is no completed failure to
+    # clear.
+    if not _restart_completed_failed_agent_build(
+        sid, session, session.get("agent_ready")
+    ):
+        _start_agent_build(sid, session)
 
     def run_after_agent_ready() -> None:
         # Patient wait (#63078): the user's message is already the accepted
diff --git a/tui_gateway/methods_session.py b/tui_gateway/methods_session.py
index 1711f36a10..2b1d0d10fe 100644
--- a/tui_gateway/methods_session.py
+++ b/tui_gateway/methods_session.py
@@ -119,6 +119,82 @@ def _(rid, params: dict) -> dict:
     # behind for every launch the user never typed into. The row is now created
     # lazily on the first prompt (see _ensure_session_db_row + prompt.submit),
     # and the AIAgent's own INSERT-OR-IGNORE persists it on the first turn too.
+    #
+    # EXCEPTION — seeded branch children (#93959): a desktop branch carries
+    # parent_session_id AND a seeded transcript, which is explicit user intent,
+    # not an abandoned draft. The row MUST exist immediately: the renderer's
+    # post-create resume re-fetches the child through REST + defer_history
+    # hydration, both of which read the DB — an unpersisted child 404s, the
+    # fail-latch then refuses to bind a "transcript-less" session, and the user
+    # sees an infinite spinner whose optimistic row vanishes on restart.
+    # Persisting up front also means a restart keeps the branch (both reports
+    # lost it) and the title lands in the parent's lineage instead of falling
+    # back to a message-preview name. Title mirrors the TUI /branch naming.
+    if parent_session_id and history:
+        try:
+            with _session_db(_sessions[sid]) as db:
+                if db is not None:
+                    parent_key = parent_session_id
+                    current = db.get_session_title(parent_key) or "branch"
+                    branch_title = (
+                        db.get_next_title_in_lineage(current)
+                        if hasattr(db, "get_next_title_in_lineage")
+                        else f"{current} (branch)"
+                    )
+                    db.create_session(
+                        key,
+                        source=source,
+                        model=_resolve_model(),
+                        model_config={"_branched_from": parent_key},
+                        parent_session_id=parent_key,
+                        cwd=_sessions[sid]["cwd"],
+                        profile_name=(
+                            Path(profile_home).name if profile_home else None
+                        ),
+                    )
+                    # Compensation guard (#93959 review): if the transcript
+                    # copy or title write fails AFTER the row committed, the
+                    # durable-but-empty row would defeat the lazy first-prompt
+                    # fallback (_ensure_session_db_row is INSERT OR IGNORE —
+                    # the row exists, so the seed never lands and the renderer
+                    # fail-latches on a "transcript-less" session again).
+                    # Roll back just this child so the seed path can retry
+                    # cleanly on first submit.
+                    try:
+                        db.append_messages_batch(
+                            key,
+                            [
+                                {"role": m.get("role", "user"), "content": m.get("content")}
+                                for m in history
+                            ],
+                            chunk_rows=500,
+                        )
+                        db.set_session_title(key, branch_title)
+                    except Exception as exc:
+                        from hermes_state import is_disk_full_error
+
+                        if is_disk_full_error(exc):
+                            raise
+                        try:
+                            db.delete_session(key)
+                        except Exception:
+                            logger.debug(
+                                "branch seed compensation delete failed for %s",
+                                key,
+                                exc_info=True,
+                            )
+                        raise
+                    _sessions[sid]["pending_title"] = None
+        except Exception:
+            # Persistence is best-effort here: a failed write must not break
+            # session.create itself — the lazy first-prompt path remains as the
+            # fallback, exactly as for plain drafts.
+            logger.warning(
+                "seeded-branch persistence failed for %s; falling back to "
+                "lazy row creation",
+                key,
+                exc_info=True,
+            )
 
     # Return the lightweight session immediately so Ink can paint the composer
     # + skeleton panel, then build the real AIAgent just after this response is
@@ -583,20 +659,37 @@ def _(rid, params: dict) -> dict:
         # (see _todo_state_from_history) — no extra transcript read here.
 
         # Every interactive resume path materializes the model history, even when
-        # omit_messages suppresses the response copy. Count the complete lineage
-        # before any reopen/history read so a runaway transcript cannot exhaust
-        # the dashboard. The metadata fallback keeps lightweight test/adaptor DBs
-        # that predate the shared SessionDB guard compatible. The limit resolves
-        # from config (sessions.max_resume_messages, 0 disables).
+        # omit_messages suppresses the response copy. Count what THIS path will
+        # actually load before any reopen/history read so a runaway transcript
+        # cannot exhaust the dashboard. Only the non-deferred, non-omitted
+        # resume reads the whole compression lineage (ancestors → tip) into
+        # memory; the deferred Desktop resume (display transcript paged over
+        # REST), the omit_messages resume, and the lazy watch resume all load
+        # the TIP segment only — guarding those against the full-lineage count
+        # rejected exactly the well-compressed conversations compaction is
+        # meant to produce (85 segments / ~29k lineage rows / ~700-row tip →
+        # 4130 and a Bot Chat stuck on "Waking up…"). The metadata fallback
+        # keeps lightweight test/adaptor DBs that predate the shared SessionDB
+        # guard compatible. The limit resolves from config
+        # (sessions.max_resume_messages, 0 disables).
         from hermes_state import (
             SessionResumeTooLargeError,
             resolved_max_resume_messages,
         )
 
+        eager_build = is_truthy_value(params.get("eager_build", False))
+        guard_tip_only = (
+            is_truthy_value(params.get("lazy", False))
+            or omit_messages
+            or (defer_history and not eager_build)
+        )
         safety_check = getattr(db, "assert_resume_safe", None)
         try:
             if callable(safety_check):
-                safety_check(target)
+                if guard_tip_only:
+                    safety_check(target, tip_only=True)
+                else:
+                    safety_check(target)
             else:
                 resume_limit = resolved_max_resume_messages()
                 stored_message_count = int(found.get("message_count") or 0)
@@ -659,9 +752,11 @@ def _(rid, params: dict) -> dict:
                 _cancel_ws_orphan_reap(sid)
                 return _ok(rid, _reuse_live_payload(sid, session))
 
-        # Fast path: if the session is already live, reuse it under the lock.
+        # Fast path: if the session is already live IN THIS PROFILE, reuse it
+        # under the lock. Never another profile's runtime of the same stored id
+        # — that ran profile B's turn on profile A's agent/memory (#100029).
         with _session_resume_lock:
-            live = _find_live_session_by_key(target)
+            live = _find_live_session_by_key(target, profile_home)
         if live is not None:
             return _reuse_live_response(*live)
 
@@ -984,7 +1079,7 @@ def _(rid, params: dict) -> dict:
         # live session while we were building. Re-check under the lock; if it won,
         # discard our just-built agent and reuse theirs (no worker/poller wired yet).
         with _session_resume_lock:
-            live = _find_live_session_by_key(target)
+            live = _find_live_session_by_key(target, profile_home)
             if live is not None:
                 try:
                     if hasattr(agent, "close"):
@@ -1614,7 +1709,8 @@ def _(rid, params: dict) -> dict:
     except (ValueError, KeyError):
         return _err(rid, 4024, f"unknown platform '{platform_name}'")
     try:
-        gw_config = load_gateway_config()
+        with _session_profile_runtime_scope(session):
+            gw_config = load_gateway_config()
     except Exception as e:
         return _err(rid, 5021, f"could not load gateway config: {e}")
     pcfg = gw_config.platforms.get(platform)
@@ -2913,13 +3009,37 @@ def _(rid, params: dict) -> dict:
         sid = str(params.get("session_id") or "")
         focus_topic = str(params.get("focus_topic", "") or "").strip()
         command = "/compress" + (f" {focus_topic}" if focus_topic else "")
+        _late_session = session
+
+        def _on_late_ack(late: dict, _sid=sid) -> None:
+            _adopt_late_compute_host_compress_ack(_sid, _late_session, late, route_name="session.compress")
+
         try:
             ack = _send_compute_host_control(
                 sid,
                 route_name="session.compress",
                 command=command,
                 wait=True,
-                timeout=120.0,
+                # Follows compression.context_total_ceiling_seconds instead of
+                # a fixed 120s: the host legitimately runs that long (#97948).
+                timeout=_compute_host_compress_wait_seconds(),
+                on_late_ack=_on_late_ack,
+            )
+        except queue.Empty:
+            # The waiter gave up but the host is still compressing; the late
+            # ack handler adopts the rotated session and pushes session.info
+            # when it lands. Not an error — the old 5019 made Desktop/TUI
+            # report a timeout while compression later succeeded silently.
+            return _ok(
+                rid,
+                {
+                    "status": "pending",
+                    "turn_isolation": True,
+                    "message": (
+                        "compression still running in the background; "
+                        "the transcript will refresh when it finishes"
+                    ),
+                },
             )
         except Exception as exc:
             return _err(rid, 5019, f"compute-host compress failed: {exc}")
diff --git a/tui_gateway/methods_tools.py b/tui_gateway/methods_tools.py
index 7d72f7e37b..e217ae5bc3 100644
--- a/tui_gateway/methods_tools.py
+++ b/tui_gateway/methods_tools.py
@@ -133,7 +133,7 @@ def _(rid, params: dict) -> dict:
                 return _err(rid, 5019, f"compute-host reload_mcp failed: {exc}")
             return _ok(rid, {"status": "reloaded", "turn_isolation": True, "host_ack": ack})
 
-        from tools.mcp_tool import shutdown_mcp_servers, discover_mcp_tools
+        from tools.mcp_tool import shutdown_mcp_servers, discover_mcp_tools, reprobe_tool_availability
 
         def _refresh_session_agent() -> None:
             """Rebuild THIS session's cached tool snapshot from the live
@@ -184,6 +184,7 @@ def _(rid, params: dict) -> dict:
             loaded = _compute_mcp_rev()
             for _ in range(_MCP_RELOAD_MAX_PASSES):
                 shutdown_mcp_servers()
+                reprobe_tool_availability()
                 discover_mcp_tools()
                 after = _compute_mcp_rev()
                 if after == loaded:
@@ -1057,12 +1058,31 @@ def _(rid, params: dict) -> dict:
         sid = params.get("session_id", "")
         if _session_uses_compute_host(session):
             command = f"/{name}" + (f" {arg}" if arg else "")
+            _late_session = session
+
+            def _on_late_ack(late: dict, _sid=sid) -> None:
+                _adopt_late_compute_host_compress_ack(_sid, _late_session, late, route_name="slash.compress")
+
             try:
                 ack = _send_compute_host_control(
                     sid,
                     route_name="slash.compress",
                     command=command,
                     wait=True,
+                    timeout=_compute_host_compress_wait_seconds(),
+                    on_late_ack=_on_late_ack,
+                )
+            except queue.Empty:
+                return _ok(
+                    rid,
+                    {
+                        "type": "exec",
+                        "status": "pending",
+                        "output": (
+                            "compression still running in the background; "
+                            "the transcript will refresh when it finishes"
+                        ),
+                    },
                 )
             except Exception as exc:
                 return _err(rid, 5019, f"compute-host slash.compress failed: {exc}")
diff --git a/tui_gateway/project_tree.py b/tui_gateway/project_tree.py
index 4f2d1eaaae..0b4310ddaa 100644
--- a/tui_gateway/project_tree.py
+++ b/tui_gateway/project_tree.py
@@ -63,6 +63,21 @@ NO_PROJECT_LABEL = "Home"
 _MAX_SIBLING_PROBES = 4
 
 
+def stamp_profile(projects: list[dict], profile: str) -> None:
+    """Make every session row self-describing for cross-profile routing.
+
+    A scoped project tree is built from one profile's state.db, so the request
+    scope is authoritative even for legacy rows whose ``profile_name`` is NULL.
+    """
+    for project in projects:
+        for session in project.get("previewSessions") or []:
+            session["profile"] = profile
+        for repo in project.get("repos") or []:
+            for group in repo.get("groups") or []:
+                for session in group.get("sessions") or []:
+                    session["profile"] = profile
+
+
 def _branch_lane_id(repo_root: str, branch: str = "") -> str:
     """The one definition of a main-checkout lane id (must match the desktop)."""
     return f"{repo_root}::branch::{(branch or '').strip()}"
diff --git a/tui_gateway/server.py b/tui_gateway/server.py
index 8eed4f00e4..e2eee50d36 100644
--- a/tui_gateway/server.py
+++ b/tui_gateway/server.py
@@ -205,6 +205,40 @@ def _resolve_ws_orphan_reap_grace() -> float:
 
 
 _WS_ORPHAN_REAP_GRACE_S = _resolve_ws_orphan_reap_grace()
+
+
+def _resolve_ws_orphan_activity_stale() -> float:
+    """Resolve the detached-turn activity staleness threshold (seconds).
+
+    A detached RUNNING turn is only interrupted by the WS-orphan reaper once
+    its activity clock has been idle at least this long (#98028/#100325);
+    while the turn keeps producing (API waits, stream tokens, tool
+    heartbeats all stamp the clock) it runs to completion detached.
+    Config-driven via ``dashboard.ws_orphan_activity_stale_s``; the
+    ``HERMES_TUI_WS_ORPHAN_ACTIVITY_STALE_S`` env var is an internal
+    override. Defaults to 600s, matching the turn-liveness watchdog's idle
+    bound (``agent.turn_liveness.timeout_s``) so "wedged" means the same
+    thing on both paths. ``0`` disables the gate (pre-#98028 behavior:
+    interrupt at grace regardless of activity).
+    """
+    raw = os.environ.get("HERMES_TUI_WS_ORPHAN_ACTIVITY_STALE_S")
+    if raw is None or not str(raw).strip():
+        try:
+            from hermes_cli.config import load_config
+
+            raw = (load_config().get("dashboard") or {}).get(
+                "ws_orphan_activity_stale_s"
+            )
+        except Exception:
+            raw = None
+    try:
+        stale = float(raw) if raw is not None else 600.0
+    except (ValueError, TypeError):
+        stale = 600.0
+    return max(0.0, stale)
+
+
+_WS_ORPHAN_ACTIVITY_STALE_S = _resolve_ws_orphan_activity_stale()
 _WS_ORPHAN_INTERRUPT_REAP_POLL_S = 1.0
 # Total budget for the interrupt-then-reap poll chain. If an interrupted turn
 # never settles (agent thread hung in a syscall, supervisor lost), each 1s poll
@@ -1393,6 +1427,34 @@ def _cancel_ws_orphan_reap(sid: str) -> None:
             pass
 
 
+def _ws_orphan_turn_activity_is_fresh(session: dict) -> bool:
+    """Whether a detached RUNNING turn's activity clock is still fresh.
+
+    Reuses the agent's existing activity summary (``_touch_activity`` is
+    stamped by API waits, stream tokens, and tool heartbeats — the same
+    clock the turn-liveness watchdog samples; see agent/turn_liveness.py).
+    Fresh means the WS-orphan reaper must NOT interrupt the turn yet
+    (#98028/#100325): deliberate client absence (closed laptop, backgrounded
+    mobile app, desktop update/relaunch) keeps healthy work running detached.
+
+    Conservative fallbacks preserve the wedged-turn safety net: a disabled
+    threshold (<= 0), a missing/opaque agent, an unreadable summary, or a
+    never-stamped clock all report NOT fresh, i.e. eligible for the
+    interrupt-at-grace path exactly as before.
+    """
+    if _WS_ORPHAN_ACTIVITY_STALE_S <= 0:
+        return False
+    agent = session.get("agent")
+    summary_fn = getattr(agent, "get_activity_summary", None)
+    if not callable(summary_fn):
+        return False
+    try:
+        elapsed = summary_fn().get("seconds_since_activity")
+        return elapsed is not None and float(elapsed) < _WS_ORPHAN_ACTIVITY_STALE_S
+    except Exception:
+        return False
+
+
 def _schedule_ws_orphan_reap(sid: str, *, delay_s: float | None = None) -> None:
     """After a grace window, reap session ``sid`` iff it's still orphaned.
 
@@ -1429,30 +1491,47 @@ def _schedule_ws_orphan_reap(sid: str, *, delay_s: float | None = None) -> None:
             if _session_has_active_delegations(sid, current):
                 reschedule_delay = _WS_ORPHAN_REAP_GRACE_S
             elif current.get("running"):
-                # Mid-turn detached sessions must never drop the single
-                # Timer (#85578): after the reconnect grace the turn is
-                # interrupted once, then the reap keeps polling until the
-                # normal turn-finalization path settles.
-                polls = int(current.get("_client_gone_interrupt_polls") or 0) + 1
-                current["_client_gone_interrupt_polls"] = polls
-                if polls > _WS_ORPHAN_INTERRUPT_REAP_MAX_POLLS:
-                    # The interrupted turn never settled inside the budget —
-                    # force-reap rather than parking the session + a timer
-                    # chain forever. Loud by design: this only fires when a
-                    # turn is genuinely stuck past interrupt.
-                    logger.error(
-                        "client_gone sid=%s: turn did not settle after %d "
-                        "interrupt polls (%.0fs) — force-reaping detached "
-                        "session",
-                        sid, polls - 1,
-                        (polls - 1) * _WS_ORPHAN_INTERRUPT_REAP_POLL_S,
+                if not current.get(
+                    "_client_gone_interrupt_requested"
+                ) and _ws_orphan_turn_activity_is_fresh(current):
+                    # Client-absent but actively producing (#98028/#100325):
+                    # the turn keeps running detached (the sentinel transport
+                    # already buffers emits) and the reaper re-checks each
+                    # grace interval. Only a turn whose activity clock has
+                    # gone stale — genuinely wedged, the case the interrupt
+                    # was added for — falls through to the interrupt below.
+                    logger.debug(
+                        "client_gone sid=%s action=defer (turn activity "
+                        "fresh; stale threshold %.0fs)",
+                        sid,
+                        _WS_ORPHAN_ACTIVITY_STALE_S,
                     )
-                    session = _pop_session_by_id(sid)
+                    reschedule_delay = _WS_ORPHAN_REAP_GRACE_S
                 else:
-                    if not current.get("_client_gone_interrupt_requested"):
-                        current["_client_gone_interrupt_requested"] = True
-                        interrupt_session = current
-                    reschedule_delay = _WS_ORPHAN_INTERRUPT_REAP_POLL_S
+                    # Mid-turn detached sessions must never drop the single
+                    # Timer (#85578): after the reconnect grace the turn is
+                    # interrupted once, then the reap keeps polling until the
+                    # normal turn-finalization path settles.
+                    polls = int(current.get("_client_gone_interrupt_polls") or 0) + 1
+                    current["_client_gone_interrupt_polls"] = polls
+                    if polls > _WS_ORPHAN_INTERRUPT_REAP_MAX_POLLS:
+                        # The interrupted turn never settled inside the budget
+                        # — force-reap rather than parking the session + a
+                        # timer chain forever. Loud by design: this only fires
+                        # when a turn is genuinely stuck past interrupt.
+                        logger.error(
+                            "client_gone sid=%s: turn did not settle after %d "
+                            "interrupt polls (%.0fs) — force-reaping detached "
+                            "session",
+                            sid, polls - 1,
+                            (polls - 1) * _WS_ORPHAN_INTERRUPT_REAP_POLL_S,
+                        )
+                        session = _pop_session_by_id(sid)
+                    else:
+                        if not current.get("_client_gone_interrupt_requested"):
+                            current["_client_gone_interrupt_requested"] = True
+                            interrupt_session = current
+                        reschedule_delay = _WS_ORPHAN_INTERRUPT_REAP_POLL_S
             else:
                 session = _pop_session_by_id(sid)
 
@@ -2378,7 +2457,18 @@ def _profile_home(profile: str | None) -> Path | None:
     # Already the launch profile? No override needed.
     if home.resolve() == Path(_hermes_home).resolve():
         return None
-    return home if (home / "state.db").exists() or home.exists() else None
+    if (home / "state.db").exists() or home.exists():
+        # Remember every sibling home this backend was asked to serve so the
+        # change watcher stats its store too (#99333 class).
+        _served_profile_homes.add(home)
+        return home
+    return None
+
+
+# Profile homes served by this process besides the launch home — the only
+# extra stores the sessions watcher must probe. Empty on single-profile
+# installs, so their watcher stays byte-identical (two stats per tick).
+_served_profile_homes: set[Path] = set()
 
 
 def _profile_scoped(handler):
@@ -2577,6 +2667,11 @@ def _broadcast_global_event(event: str, payload: dict | None = None) -> None:
 
 _compute_host_supervisor = None
 _compute_host_supervisor_lock = threading.Lock()
+# Hard cap on how long session.compress blocks its RPC waiting for the compute
+# host (#97948). Must stay below the desktop's SESSION_COMPRESS_TIMEOUT_MS
+# (660s) so the client receives the `pending` answer instead of its own
+# timeout error; the late-ack path covers anything slower.
+_COMPUTE_HOST_COMPRESS_WAIT_CAP_SECS = 630.0
 
 
 def _inside_compute_host_child() -> bool:
@@ -2852,6 +2947,7 @@ def _send_compute_host_control(
     payload: dict | None = None,
     wait: bool = True,
     timeout: float = 30.0,
+    on_late_ack=None,
 ) -> dict:
     frame = dict(payload or {})
     frame.setdefault("type", "control")
@@ -2862,9 +2958,68 @@ def _send_compute_host_control(
         payload=frame,
         wait=wait,
         timeout=timeout,
+        on_late_ack=on_late_ack,
     )
 
 
+def _compute_host_compress_wait_seconds(cfg: dict | None = None) -> float:
+    """RPC wait budget for a compute-host compress control (#97948).
+
+    Manual compression legitimately runs up to the configured
+    ``compression.context_total_ceiling_seconds`` (default 600s), so a fixed
+    120s waiter reported a false timeout while the host kept working. Follow
+    the ceiling with a little slack, but cap the blocking wait so it stays
+    below the desktop's own RPC timeout; anything longer is adopted through
+    the late-ack path instead of failing.
+    """
+    from agent.conversation_compression import resolve_context_compression_timeouts
+
+    try:
+        compression_cfg = (cfg if cfg is not None else _load_cfg()).get("compression", {})
+    except Exception:
+        compression_cfg = {}
+    _idle, ceiling = resolve_context_compression_timeouts(
+        compression_cfg if isinstance(compression_cfg, dict) else {}
+    )
+    return float(min(max(ceiling + 30.0, 120.0), _COMPUTE_HOST_COMPRESS_WAIT_CAP_SECS))
+
+
+def _announce_compute_host_compress_done(sid: str, session: dict, ack: dict) -> None:
+    """Mirror a compute-host compress ack and push the client-visible edges.
+
+    Emits the same ``session.info`` the in-process /compress path does plus
+    the ``compacted`` status edge, so a client whose own RPC wait already
+    expired still learns the transcript changed.
+    """
+    _apply_compute_host_metadata_mirror(session, ack)
+    try:
+        info = _session_info(session.get("agent"), session)
+    except TypeError:
+        info = _session_info(session.get("agent"))
+    _emit("session.info", sid, info)
+    _status_update(sid, "compacted", "✓ Context compression complete")
+
+
+def _adopt_late_compute_host_compress_ack(sid: str, session: dict, ack: dict, *, route_name: str) -> None:
+    """Adopt a compute-host compress ack that arrived after its RPC waiter gave up.
+
+    The RPC already answered ``status: pending``; this is the only place the
+    rotated session_key / history_version / session_info mirror can land, and
+    the only signal the client gets that the transcript changed. A late
+    ``control.error`` surfaces through the existing ``error`` event path.
+    """
+    with _sessions_lock:
+        live = _sessions.get(sid)
+    if live is not session:
+        return
+    if not isinstance(ack, dict) or ack.get("type") in {"control.error", "error"}:
+        message = str((ack or {}).get("message") or f"compute-host {route_name} failed")
+        _emit("error", sid, {"message": f"compression failed: {message}"})
+        _status_update(sid, "ready")
+        return
+    _announce_compute_host_compress_done(sid, session, ack)
+
+
 def _approval_request_payload(data: dict | None) -> dict:
     """Build the client-safe representation of a pending approval."""
     payload = dict(data or {})
@@ -3271,6 +3426,7 @@ def _start_agent_build(sid: str, session: dict) -> None:
         notify_registered = False
         home_token = None
         secret_token = None
+        build_terminal_token = None
         session_db = None
         owns_db = False
         profile_home = current.get("profile_home")
@@ -3297,6 +3453,21 @@ def _start_agent_build(sid: str, session: dict) -> None:
                     secret_token = set_secret_scope(build_profile_secret_scope(Path(profile_home)))
                 except Exception:
                     pass
+                # Bind the profile's COMPLETE terminal policy for the agent
+                # build (fail-closed: malformed policy → refusal scope) so
+                # _make_agent's terminal probing / cwd hints resolve the
+                # routed profile, never the launch process (#98581 class).
+                try:
+                    from tools.terminal_scope import (
+                        install_profile_terminal_scope,
+                        reset_terminal_scope,
+                    )
+
+                    build_terminal_token = install_profile_terminal_scope(
+                        Path(profile_home)
+                    )
+                except Exception:
+                    build_terminal_token = None
                 # DEDICATED handle — ours until _transfer_db_to_agent hands
                 # it to the built agent in the finally below. Every path
                 # that leaves this build without that transfer (the except
@@ -3448,6 +3619,13 @@ def _start_agent_build(sid: str, session: dict) -> None:
                     reset_secret_scope(secret_token)
                 except Exception:
                     pass
+            if build_terminal_token is not None:
+                try:
+                    from tools.terminal_scope import reset_terminal_scope
+
+                    reset_terminal_scope(build_terminal_token)
+                except Exception:
+                    pass
             # _attach_worker already closed the worker if this session was
             # reaped mid-build; only the late notify registration can still
             # leak (session.close unregistered before _build registered it).
@@ -5036,15 +5214,17 @@ def _sessions_sig():
     """Newest mtime across state.db and its WAL — the cross-process change
     signal. Messaging-gateway turns and cron runs are written by OTHER
     processes that never touch this gateway's transports; the shared SQLite
-    file is the one thing they all move (#58671)."""
-    home = _watcher_home()
+    file is the one thing they all move (#58671). A backend serving several
+    profiles owns one store per profile, so every served sibling home is
+    probed too — otherwise a routed profile's Bot Chat never refreshes."""
     sig = None
-    for name in ("state.db", "state.db-wal"):
-        try:
-            mtime = (home / name).stat().st_mtime_ns
-        except OSError:
-            continue
-        sig = mtime if sig is None else max(sig, mtime)
+    for root in (_watcher_home(), *_served_profile_homes):
+        for name in ("state.db", "state.db-wal"):
+            try:
+                mtime = (root / name).stat().st_mtime_ns
+            except OSError:
+                continue
+            sig = mtime if sig is None else max(sig, mtime)
     return sig
 
 
@@ -5969,6 +6149,8 @@ def _load_service_tier() -> str | None:
         return None
     if raw in {"fast", "priority", "on"}:
         return "priority"
+    if raw in {"auto", "cold"}:
+        return raw
     return None
 
 
@@ -6311,9 +6493,20 @@ def _session_profile_runtime_scope(session: dict):
         return
     home_token = set_hermes_home_override(profile_home)
     secret_token = set_secret_scope(build_profile_secret_scope(Path(profile_home)))
+    # Same authoritative terminal policy the gateway binds per turn (#68559):
+    # a docker-configured dashboard profile must never resolve the launch
+    # process's pinned env. Failure → refusal scope (fail closed).
+    from tools.terminal_scope import (
+        install_profile_terminal_scope as _install_term_scope,
+    )
+
+    terminal_token = _install_term_scope(Path(profile_home))
     try:
         yield
     finally:
+        from tools.terminal_scope import reset_terminal_scope
+
+        reset_terminal_scope(terminal_token)
         reset_secret_scope(secret_token)
         reset_hermes_home_override(home_token)
 
@@ -7891,7 +8084,7 @@ def _todo_state_from_history(history) -> dict | None:
             if not isinstance(msg, dict):
                 continue
             for call in msg.get("tool_calls") or []:
-                if (call.get("function") or {}).get("name") == "todo":
+                if (call.get("function") or {}).get("name") in ("todo_list", "todo"):
                     cid = call.get("id")
                     if cid:
                         todo_call_ids.add(cid)
@@ -7976,7 +8169,7 @@ def _on_tool_complete(sid: str, tool_call_id: str, name: str, args: dict, result
         if result_text:
             payload["result_text"] = result_text
     todo_state = None
-    if name == "todo":
+    if name in ("todo_list", "todo"):  # legacy alias: pre-rename replays
         todo_state = _normalize_todo_state(payload.get("result"))
         if todo_state is not None:
             payload.update(todo_state)
@@ -8002,7 +8195,7 @@ def _on_tool_complete(sid: str, tool_call_id: str, name: str, args: dict, result
         _tool_progress_enabled(sid)
         or payload.get("inline_diff")
         or _tool_lifecycle_required_for_ui(name)
-        or name == "todo"
+        or name in ("todo_list", "todo")
     ):
         _emit("tool.complete", sid, payload)
     # Task state is application data, not optional tool-progress chrome. A
@@ -8115,6 +8308,8 @@ def _on_tool_progress(
             payload["parent_id"] = str(_kwargs["parent_id"])
         if _kwargs.get("child_session_id"):
             payload["child_session_id"] = str(_kwargs["child_session_id"])
+        if _kwargs.get("delegation_id"):
+            payload["delegation_id"] = str(_kwargs["delegation_id"])
         if _kwargs.get("depth") is not None:
             payload["depth"] = int(_kwargs["depth"])
         if _kwargs.get("model"):
@@ -9898,6 +10093,128 @@ def _fail_inflight_turn(
     session["inflight_turn"] = turn
 
 
+_TURN_FAILURE_DETAIL_LIMIT = 240
+# Shortest run of the submitted prompt that counts as the provider quoting it
+# back. Long enough that shared boilerplate ("Invalid request for model ") does
+# not trip it, short enough to catch a quoted sentence.
+_TURN_PROMPT_ECHO_WINDOW = 24
+# Ceiling on the prompt we shingle. An @-expanded prompt can carry a whole
+# file; the failure path must stay cheap.
+_TURN_PROMPT_ECHO_MAX_PROMPT = 65536
+
+
+def _strip_prompt_echo(message: str, prompt: Any) -> str:
+    """Blank runs of the submitted prompt that ``message`` quotes back.
+
+    Secret redaction and prompt omission are different contracts, and only the
+    first one is pattern-based. A provider 4xx that echoes the request carries
+    ordinary private prose -- a paragraph about a person, a pasted file from an
+    ``@`` reference -- that matches no credential pattern and would otherwise
+    reach the log intact. This closes that path directly: anything the message
+    shares with the prompt for ``_TURN_PROMPT_ECHO_WINDOW`` characters or more
+    becomes ``<prompt>``.
+
+    Shingle-set matching, not a diff: cost is linear in both strings, which
+    matters because this runs on every failed turn and an ``@`` reference can
+    make the prompt arbitrarily long. The JSON-escaped form of the prompt is
+    shingled too, since a provider that hands back its own request body often
+    hands it back escaped.
+
+    Verbatim echo is what this stops. A paraphrase, a re-encoding (base64, a
+    different unicode normalization) or a summary of the prompt would survive,
+    so this is a floor and not a proof; the guarantee it does give is that the
+    prompt cannot reach the record by being quoted.
+    """
+    if not message or not prompt:
+        return message
+    needle = " ".join(str(prompt).split())[:_TURN_PROMPT_ECHO_MAX_PROMPT]
+    window = _TURN_PROMPT_ECHO_WINDOW
+    if len(needle) < window or len(message) < window:
+        return message
+    shingles = {needle[i:i + window] for i in range(len(needle) - window + 1)}
+    try:
+        escaped = json.dumps(needle)[1:-1]
+    except Exception:
+        escaped = ""
+    if escaped and escaped != needle:
+        shingles.update(
+            escaped[i:i + window] for i in range(len(escaped) - window + 1)
+        )
+    out: list[str] = []
+    i = 0
+    n = len(message)
+    while i <= n - window:
+        if message[i:i + window] in shingles:
+            j = i + window
+            while j < n and message[j - window + 1:j + 1] in shingles:
+                j += 1
+            out.append("<prompt>")
+            i = j
+        else:
+            out.append(message[i])
+            i += 1
+    out.append(message[i:])
+    return "".join(out)
+
+
+def _turn_failure_detail(error: Any, reason: Any = None, prompt: Any = None) -> str:
+    """Render why a turn failed, for the ``tui turn finished`` bookend.
+
+    Returns ``""`` when there is nothing to say, otherwise a fragment that
+    already carries its own leading space, so the caller can append it to the
+    record unconditionally.
+
+    #86865 added the bookend to trace compression rotations, so it logs
+    identities and a coarse ``status`` and deliberately logs no content.
+    #89117 is what the missing cause costs: a report consisting of two lines
+    reading ``status=error error_retained=True duration=0.9s`` with no way to
+    tell a provider 4xx from a budget wall from a crashed finalizer. The
+    returned-error path -- the one a 0.9 s failure almost always takes --
+    emits no other log line at all; only the exception path prints to stderr,
+    which is why the quiet failures are the ones that get filed.
+
+    Content discipline follows #86865's, and it takes two separate steps
+    because it is two separate contracts. ``redact_sensitive_text`` removes
+    credentials, which are pattern-shaped. It does nothing about a 4xx body
+    that quotes the request back, because ordinary private prose is not
+    pattern-shaped -- so ``_strip_prompt_echo`` removes that separately, using
+    the submitted ``prompt`` itself as the thing to look for. The invariant the
+    two of them keep is: this record may gain failure classification and
+    provider detail, and may not newly persist the user's own content.
+
+    ``prompt`` is optional so the helper stays callable from a path that has no
+    prompt in scope, but the turn paths always pass it; without it, only the
+    secret contract is enforced.
+    """
+    reason_text = str(reason or "").strip()
+    message = str(error or "").strip()
+    if isinstance(error, BaseException):
+        message = message or type(error).__name__
+    if not message and not reason_text:
+        return ""
+    try:
+        from agent.redact import redact_sensitive_text
+
+        message = redact_sensitive_text(message, force=True)
+    except Exception:
+        # A redactor that cannot run must not be able to leak the raw
+        # message into the log by failing open.
+        message = "<unredactable>"
+    message = " ".join(message.split())
+    # After the collapse, so both sides are compared in the same shape, and
+    # before the truncation, so a quote that starts inside the kept prefix
+    # cannot survive by being cut mid-run.
+    message = _strip_prompt_echo(message, prompt)
+    if len(message) > _TURN_FAILURE_DETAIL_LIMIT:
+        message = message[:_TURN_FAILURE_DETAIL_LIMIT] + "\u2026"
+    out = ""
+    if reason_text:
+        out += " failure_reason=%s" % " ".join(reason_text.split())
+    if message:
+        out += " cause=%r" % message
+    return out
+
+
 # ── Auto-continue: resume a turn killed by a process/machine death ────
 #
 # A turn that concludes — success, handled error, interrupt — clears its
@@ -10661,14 +10978,33 @@ def _deferred_session_record(
     }
 
 
+_ANY_PROFILE = object()  # default: match a live session regardless of profile
+
+
+def _live_profile_matches(session: dict, profile_home) -> bool:
+    """True when ``session`` belongs to ``profile_home`` (None = launch profile).
+
+    Same string compare as session.resume's ``_find_live_unpersisted``: a
+    record with no ``profile_home`` is the launch profile's. ``_ANY_PROFILE``
+    disables the check for callers that have no profile to scope by.
+    """
+    if profile_home is _ANY_PROFILE:
+        return True
+    want = str(profile_home) if profile_home else None
+    return (session.get("profile_home") or None) == want
+
+
 def _claim_or_reuse_live(
     sid: str, session_key: str, record: dict, lease
 ) -> tuple[str, dict] | None:
     """Register ``record`` as the live session for ``session_key`` under the
     resume lock, or — if a concurrent resume already won — release ``lease`` and
     return the winner for the caller to reuse."""
+    # The record carries the home this resume resolved; a live runtime of the
+    # same stored id under ANOTHER profile is not a winner to reuse (#100029).
+    profile_home = record.get("profile_home")
     with _session_resume_lock:
-        live = _find_live_session_by_key(session_key)
+        live = _find_live_session_by_key(session_key, profile_home)
         if live is not None:
             if lease is not None:
                 lease.release()
@@ -10686,7 +11022,7 @@ def _claim_or_reuse_live(
         # those quietly so the reap doesn't later broadcast session.reclaimed
         # for a session the client just re-resumed (auto-re-resume storm).
         _cancel_ws_orphan_reap(sid)
-        stale = _claim_parked_runtimes(session_key, keep_sid=sid)
+        stale = _claim_parked_runtimes(session_key, keep_sid=sid, profile_home=profile_home)
     # Slow finalization work stays OUTSIDE _session_resume_lock (see
     # _pop_session_by_id) — the stale records are already claimed above.
     _finalize_superseded_runtimes(stale)
@@ -10694,7 +11030,7 @@ def _claim_or_reuse_live(
 
 
 def _claim_parked_runtimes(
-    session_key: str, *, keep_sid: str
+    session_key: str, *, keep_sid: str, profile_home=_ANY_PROFILE
 ) -> list[tuple[str, dict]]:
     """Claim sentinel-parked stale runtimes of ``session_key`` for supersession.
 
@@ -10713,6 +11049,7 @@ def _claim_parked_runtimes(
             if old_sid != keep_sid
             and not old.get("_finalized")
             and _session_lookup_key(old, fallback=old_sid) == session_key
+            and _live_profile_matches(old, profile_home)
             and old.get("transport") is _detached_ws_transport
         ]
     for old_sid, _old in candidates:
@@ -10772,8 +11109,39 @@ def _schedule_resume_hydration(
                 {"phase": "history", "status": "loading"},
             )
             db.reopen_session(stored_id)
-            raw_history, display_history = db.get_resume_conversations(stored_id)
-            prefix = db.get_ancestor_display_prefix(stored_id)
+            from hermes_state import SessionResumeTooLargeError
+
+            # The deferred resume is guarded tip-only (session.resume): the
+            # display transcript is REST-paginated, so the ancestor prefix is
+            # an in-memory convenience (rewind ordinal translation, branch
+            # snapshots), not a requirement. Materialize the full lineage only
+            # while it fits sessions.max_resume_messages; past that, hydrate
+            # the tip alone instead of loading the runaway lineage the guard
+            # exists to keep out of memory (the omit_messages resume already
+            # runs with an empty prefix, so this is an existing shape).
+            prefix_fits = True
+            guard = getattr(db, "assert_resume_safe", None)
+            if callable(guard):
+                try:
+                    guard(stored_id)
+                except SessionResumeTooLargeError as exc:
+                    prefix_fits = False
+                    logger.info(
+                        "resume %s: compression lineage exceeds the resume "
+                        "limit (%s); hydrating the tip segment only",
+                        stored_id, exc,
+                    )
+                except Exception:
+                    logger.debug("resume lineage guard failed; loading full lineage", exc_info=True)
+            if prefix_fits:
+                raw_history, display_history = db.get_resume_conversations(stored_id)
+                prefix = db.get_ancestor_display_prefix(stored_id)
+            else:
+                raw_history = db.get_messages_as_conversation(
+                    stored_id, repair_alternation=True, include_row_ids=True
+                )
+                display_history = raw_history
+                prefix = []
             history = sanitize_replay_history(raw_history)
 
             if _sessions.get(sid) is not session:
@@ -10910,11 +11278,19 @@ def _session_lookup_key(session: dict, *, fallback: str = "") -> str:
     )
 
 
-def _find_live_session_by_key(session_key: str) -> tuple[str, dict] | None:
+def _find_live_session_by_key(
+    session_key: str, profile_home=_ANY_PROFILE
+) -> tuple[str, dict] | None:
+    # Stored session ids are timestamp-based and can legitimately exist in more
+    # than one profile's store, so a bare-id match can hand profile B's resume
+    # profile A's live runtime (#100029). Profile-aware callers pass the home
+    # they resolved; the match must then be on (profile_home, session_key).
     for sid, session in list(_sessions.items()):
         if session.get("_finalized"):
             continue
-        if _session_lookup_key(session, fallback=sid) == session_key:
+        if _session_lookup_key(session, fallback=sid) == session_key and _live_profile_matches(
+            session, profile_home
+        ):
             return sid, session
     return None
 
@@ -12878,6 +13254,16 @@ def _run_prompt_submit(
         # True once a failed turn's snapshot was retained for resume replay —
         # tells the finally below to skip the normal inflight clear.
         turn_error_retained = False
+        # One-line cause for the "tui turn finished" bookend below. The record
+        # fires from a `finally`, where neither `result` nor the caught
+        # exception is reliably in scope, so both failure paths stash their
+        # cause here on the way past.
+        turn_error_detail = ""
+        # What this turn actually submitted, kept only so the cause can be
+        # checked for quoting it back (see _strip_prompt_echo). Bound here
+        # rather than read from the turn body because the exception path can
+        # fire before the prompt is resolved.
+        turn_prompt_text = ""
         # Durable crash marker: written before the turn runs, retired the
         # moment its outcome reaches the client (see _retire_turn_marker).
         # Any concluded turn — success, handled error, interrupt — retires
@@ -12915,6 +13301,20 @@ def _run_prompt_submit(
             if _profile_home_str:
                 home_token = set_hermes_home_override(_profile_home_str)
                 secret_token = set_secret_scope(build_profile_secret_scope(Path(_profile_home_str)))
+                # Fourth profile seam: bind the session profile's COMPLETE
+                # terminal policy for this turn (dashboard/TUI analogue of the
+                # gateway's per-turn scope). #98581's unified-desktop
+                # reproduction ran a docker-configured profile on the host
+                # because terminal_tool read the launch process's pinned env.
+                # Failure installs a refusal scope → terminal tools raise
+                # (fail closed) instead of inheriting ambient policy.
+                from tools.terminal_scope import (
+                    install_profile_terminal_scope as _install_term_scope,
+                )
+
+                _terminal_scope_token = _install_term_scope(Path(_profile_home_str))
+            else:
+                _terminal_scope_token = None
             # The sudo password callback is thread-local (tools.terminal_tool
             # _callback_tls), so wiring it on the build thread doesn't reach this
             # turn thread — terminal sudo prompts would fall through to /dev/tty
@@ -12984,6 +13384,11 @@ def _run_prompt_submit(
                     return
                 prompt = ctx.message
 
+            # After @-expansion on purpose: an injected file's contents are
+            # exactly the kind of private material a provider echo would carry
+            # back, and they are not in `text`.
+            turn_prompt_text = prompt if isinstance(prompt, str) else ""
+
             # Decide image routing per-turn based on active provider/model.
             # "native" → pass pixels to the main model as OpenAI-style content
             # parts (adapters translate for Anthropic/Gemini/Bedrock/etc.).
@@ -13397,6 +13802,11 @@ def _run_prompt_submit(
                         error_surface=_error_surface,
                     )
                     turn_error_retained = True
+                    turn_error_detail = _turn_failure_detail(
+                        (result.get("error") if isinstance(result, dict) else raw),
+                        (result.get("failure_reason") if isinstance(result, dict) else None),
+                        turn_prompt_text,
+                    )
                 else:
                     _clear_inflight_turn(session)
             if status == "error":
@@ -13625,6 +14035,9 @@ def _run_prompt_submit(
                     retire_marker=terminal_receipt_committed,
                 )
                 turn_error_retained = True
+                turn_error_detail = _turn_failure_detail(
+                    e, type(e).__name__, turn_prompt_text
+                )
             except Exception as emit_exc:
                 print(
                     f"[gateway-turn] terminal error emit failed: "
@@ -13679,6 +14092,10 @@ def _run_prompt_submit(
                 reset_hermes_home_override(home_token)
             if secret_token is not None:
                 reset_secret_scope(secret_token)
+            if _terminal_scope_token is not None:
+                from tools.terminal_scope import reset_terminal_scope
+
+                reset_terminal_scope(_terminal_scope_token)
             _clear_session_context(session_tokens)
             _current_runtime_session_record.reset(runtime_session_token)
             reset_transport(transport_token)
@@ -13700,7 +14117,8 @@ def _run_prompt_submit(
             # without reaching this finally.
             logger.info(
                 "tui turn finished: ui_session=%s session_key=%s "
-                "agent_session_id=%s status=%s error_retained=%s duration=%.1fs",
+                "agent_session_id=%s status=%s error_retained=%s duration=%.1fs"
+                "%s",
                 sid,
                 session.get("session_key") or "",
                 getattr(agent, "session_id", "") or "",
@@ -13715,6 +14133,7 @@ def _run_prompt_submit(
                 else ("error" if turn_error_retained else "complete"),
                 turn_error_retained,
                 time.monotonic() - _turn_started_monotonic,
+                turn_error_detail,
             )
             # Backstop for turns that never reached a terminal frame (the
             # frame paths retire the marker as they emit).
@@ -14320,19 +14739,20 @@ def _(rid, params: dict) -> dict:
         raw = str(value or "").strip().lower()
         agent = session.get("agent") if session else None
         if agent is not None:
-            current_fast = getattr(agent, "service_tier", None) == "priority"
+            current_tier = getattr(agent, "service_tier", None)
         elif session is not None and session.get("create_service_tier_override") is not None:
             # Pre-build session with a pinned tier (desktop draft pick or an
             # earlier session-scoped toggle) — report/toggle from the pin, not
             # the global default.
-            current_fast = session["create_service_tier_override"] == "priority"
+            current_tier = session["create_service_tier_override"] or None
         else:
-            current_fast = _load_service_tier() == "priority"
+            current_tier = _load_service_tier()
+        current_fast = current_tier == "priority"
 
         if raw in {"status"}:
             return _ok(
                 rid,
-                {"key": key, "value": "fast" if current_fast else "normal"},
+                {"key": key, "value": {"priority": "fast", None: "normal"}.get(current_tier, current_tier)},
             )
 
         if raw in {"", "toggle"}:
@@ -14341,6 +14761,8 @@ def _(rid, params: dict) -> dict:
             nv = "fast"
         elif raw in {"normal", "off"}:
             nv = "normal"
+        elif raw in {"auto", "cold"}:
+            nv = raw
         else:
             return _err(rid, 4002, f"unknown fast mode: {value}")
 
@@ -14366,7 +14788,11 @@ def _(rid, params: dict) -> dict:
                     4002,
                     "fast mode is not available without a selected model",
                 )
-            overrides = resolve_fast_mode_overrides(target_model)
+            overrides = resolve_fast_mode_overrides(
+                target_model,
+                provider=getattr(agent, "provider", None),
+                base_url=getattr(agent, "base_url", None),
+            )
             if overrides is None:
                 return _err(
                     rid,
@@ -14383,13 +14809,11 @@ def _(rid, params: dict) -> dict:
             # build ("switch one session, switches everywhere"). Pin the
             # create override so lazily-built sessions and rebuilds (/new,
             # deferred resume) keep the choice; "" pins normal explicitly.
-            session["create_service_tier_override"] = (
-                "priority" if nv == "fast" else ""
-            )
+            session["create_service_tier_override"] = {"fast": "priority", "normal": ""}.get(nv, nv)
         else:
             _write_config_key("agent.service_tier", nv)
         if agent is not None:
-            agent.service_tier = "priority" if nv == "fast" else None
+            agent.service_tier = {"fast": "priority", "normal": None}.get(nv, nv)
             current_overrides = dict(getattr(agent, "request_overrides", {}) or {})
             current_overrides.pop("service_tier", None)
             current_overrides.pop("speed", None)
@@ -15388,6 +15812,7 @@ def _project_tree_row(r: dict) -> dict:
     return {
         "id": r.get("id"),
         "_lineage_root_id": r.get("_lineage_root_id"),
+        "_lineage_ids": r.get("_lineage_ids"),
         # The sidebar nests branch/fork sessions under their parent
         # (flattenSessionsWithBranches keys on this); without it, lane rows can't
         # draw the └─ connector the flat Recents list shows.
@@ -16449,13 +16874,28 @@ def _mirror_slash_side_effects(sid: str, session: dict, command: str) -> str:
     _MUTATES_WHILE_RUNNING = {"model", "personality", "prompt", "compress"}
     if _session_uses_compute_host(session) and name in _MUTATES_WHILE_RUNNING:
         route_name = f"slash.{name}"
+        is_compress = name == "compress"
+        _late_session = session
+
+        def _on_late_ack(late: dict, _sid=sid) -> None:
+            _adopt_late_compute_host_compress_ack(_sid, _late_session, late, route_name=route_name)
+
         try:
             ack = _send_compute_host_control(
                 sid,
                 route_name=route_name,
                 command=command,
                 wait=True,
+                **(
+                    {"timeout": _compute_host_compress_wait_seconds(), "on_late_ack": _on_late_ack}
+                    if is_compress
+                    else {}
+                ),
             )
+        except queue.Empty:
+            if is_compress:
+                return "compression still running in the background; the transcript will refresh when it finishes"
+            return f"compute-host {route_name} failed: timed out"
         except Exception as exc:
             return f"compute-host {route_name} failed: {exc}"
         if ack.get("type") in {"control.error", "error"}:
@@ -16558,6 +16998,8 @@ def _mirror_slash_side_effects(sid: str, session: dict, command: str) -> str:
                 agent.service_tier = "priority"
             elif mode in {"normal", "off"}:
                 agent.service_tier = None
+            elif mode in {"auto", "cold"}:
+                agent.service_tier = mode
             _emit("session.info", sid, _session_info(agent, session))
         elif name == "reload-mcp" and agent and hasattr(agent, "reload_mcp_tools"):
             agent.reload_mcp_tools()
@@ -16623,6 +17065,30 @@ def _voice_tts_enabled() -> bool:
     return os.environ.get("HERMES_VOICE_TTS", "").strip() == "1"
 
 
+def _tts_lease_async(lease: str, active: bool) -> None:
+    """Acquire/release a TTS engine lease off the RPC thread.
+
+    Speech-output toggles are the signal that TTS is about to be needed (or
+    no longer is). Acquiring warms the configured provider — for local
+    engines that is a model load, possibly a voice download — so it must not
+    block the toggle's RPC reply. Release is cheap but rides the same thread
+    for symmetry. Best-effort: a failure here never affects the toggle.
+    """
+
+    def _run():
+        try:
+            from tools.tts_tool import acquire_tts_lease, release_tts_lease
+
+            if active:
+                acquire_tts_lease(lease)
+            else:
+                release_tts_lease(lease)
+        except Exception as e:
+            logger.debug("voice: tts lease %s active=%s failed: %s", lease, active, e)
+
+    threading.Thread(target=_run, name=f"tts-lease-{lease}", daemon=True).start()
+
+
 def _any_session_running() -> bool:
     """True while any session's agent turn is in flight.
 
@@ -17472,6 +17938,12 @@ def _(rid, params: dict) -> dict:
             except Exception:
                 stop_hint = ""
 
+            # Voice mode with speech output already on (voice.auto_tts /
+            # prior /voice tts) means replies will be spoken — warm the
+            # engine now rather than on the first reply.
+            if _voice_tts_enabled():
+                _tts_lease_async("tui:voice-tts", True)
+
         if not enabled:
             # Disabling the mode must tear the continuous loop down; the
             # loop holds the microphone and would otherwise keep running.
@@ -17488,6 +17960,7 @@ def _(rid, params: dict) -> dict:
             # and silence any in-flight streaming speech.
             os.environ["HERMES_VOICE_TTS"] = "0"
             _tts_stream_stop(user_barge=False)
+            _tts_lease_async("tui:voice-tts", False)
 
         return _ok(
             rid,
@@ -17507,6 +17980,10 @@ def _(rid, params: dict) -> dict:
         os.environ["HERMES_VOICE_TTS"] = "1" if new_value else "0"
         if not new_value:
             _tts_stream_stop(user_barge=False)
+        # The TTS toggle is the "speech is about to be needed" signal: on →
+        # pre-load the configured engine so the first reply starts hot; off →
+        # release the lease (last holder gone = resident local model freed).
+        _tts_lease_async("tui:voice-tts", new_value)
         # Include ``record_key`` on every branch so a /voice tts toggle
         # doesn't reset the TUI's cached shortcut to the default when a
         # user has a custom binding configured (Copilot review, round 2
diff --git a/tui_gateway/ws.py b/tui_gateway/ws.py
index 988733a9b1..145aa70b69 100644
--- a/tui_gateway/ws.py
+++ b/tui_gateway/ws.py
@@ -37,6 +37,30 @@ from tui_gateway.event_replay import replay_epoch
 
 _log = logging.getLogger(__name__)
 
+# Scale-to-zero: tell the (separate) gateway process that a dashboard/desktop/
+# TUI client is attached, via the mtime of a marker file it reads in its idle
+# predicate. Clients ping every 15s; one mtime write per 5s per process is
+# plenty and keeps the volume quiet. See gateway/scale_to_zero.py.
+_DASHBOARD_CLIENT_TOUCH_MIN_INTERVAL_S = 5.0
+_dashboard_client_touched_at = 0.0
+_dashboard_client_touch_lock = threading.Lock()
+
+
+def _note_dashboard_client_activity(*, force: bool = False) -> None:
+    """Refresh the dashboard-client liveness marker (throttled, best-effort)."""
+    global _dashboard_client_touched_at
+    now = time.monotonic()
+    with _dashboard_client_touch_lock:
+        if not force and now - _dashboard_client_touched_at < _DASHBOARD_CLIENT_TOUCH_MIN_INTERVAL_S:
+            return
+        _dashboard_client_touched_at = now
+    try:
+        from gateway.scale_to_zero import touch_dashboard_client_heartbeat
+
+        touch_dashboard_client_heartbeat()
+    except Exception:  # noqa: BLE001 - liveness garnish must never break the WS
+        _log.debug("dashboard client heartbeat touch failed", exc_info=True)
+
 # Max seconds a pool-dispatched handler will block waiting for the event loop
 # to flush a WS frame before we mark the transport dead. Protects handler
 # threads from a wedged socket.
@@ -346,6 +370,9 @@ async def handle_ws(
         else:
             await ws.accept()
         disconnect_reason = "connected"
+        # A client is attached from the moment the upgrade is accepted — mark it
+        # before the (possibly slow) ready/skin setup so scale-to-zero sees it.
+        _note_dashboard_client_activity(force=True)
         # Push small streamed frames out immediately instead of letting Nagle
         # batch them — keeps the live token cadence intact for GUI clients.
         _disable_nagle(ws)
@@ -420,6 +447,7 @@ async def handle_ws(
         while True:
             try:
                 raw = await ws.receive_text()
+                _note_dashboard_client_activity()
             except _WebSocketDisconnect as exc:
                 disconnect_reason = (
                     "client_disconnect("
diff --git a/ui-tui/src/__tests__/createSlashHandler.test.ts b/ui-tui/src/__tests__/createSlashHandler.test.ts
index 6afd025587..67f2609f91 100644
--- a/ui-tui/src/__tests__/createSlashHandler.test.ts
+++ b/ui-tui/src/__tests__/createSlashHandler.test.ts
@@ -1072,6 +1072,43 @@ describe('createSlashHandler', () => {
     expect(ctx.transcript.sys).toHaveBeenCalledWith('no active session — nothing to rollback')
   })
 
+  // A pasted PR thread / diff / log reaches a skill command as its argument.
+  // parseSlashCommand used to split the whole line on `\s+` and rejoin with a
+  // single space, so every line break was gone before the skill ran — and the
+  // fallback command.dispatch carried that flattened text.
+  it('carries a multi-line argument to the backend without flattening it', async () => {
+    patchUiState({ sid: 'sid-abc' })
+
+    const arg = 'line one\nline two\n\n  indented tail'
+
+    const ctx = buildCtx({
+      gateway: {
+        gw: {
+          getLogTail: vi.fn(() => ''),
+          kill: vi.fn(),
+          request: vi.fn((method: string) =>
+            method === 'slash.exec' ? Promise.reject(new Error('skill command')) : Promise.resolve({})
+          )
+        },
+        rpc: vi.fn(() => Promise.resolve({}))
+      }
+    })
+
+    createSlashHandler(ctx)(`/pr-triage ${arg}`)
+
+    expect(ctx.gateway.gw.request).toHaveBeenCalledWith('slash.exec', {
+      command: `pr-triage ${arg}`,
+      session_id: 'sid-abc'
+    })
+    await vi.waitFor(() => {
+      expect(ctx.gateway.gw.request).toHaveBeenCalledWith('command.dispatch', {
+        arg,
+        name: 'pr-triage',
+        session_id: 'sid-abc'
+      })
+    })
+  })
+
   it('/title <name> uses session.title RPC and bypasses slash.exec', async () => {
     patchUiState({ sid: 'sid-abc' })
     const rpc = vi.fn(() => Promise.resolve({ pending: false, title: 'my title' }))
diff --git a/ui-tui/src/__tests__/queueSubmission.test.ts b/ui-tui/src/__tests__/queueSubmission.test.ts
index 149811fad6..62f43366b3 100644
--- a/ui-tui/src/__tests__/queueSubmission.test.ts
+++ b/ui-tui/src/__tests__/queueSubmission.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import type { ComposerToken } from '../app/interfaces.js'
-import { expandPasteTokens, queueItemFromSlash } from '../app/useSubmission.js'
+import { expandPasteTokens, prepareSlashSubmission, queueItemFromSlash } from '../app/useSubmission.js'
 import { imageToken } from '../domain/attachments.js'
 
 describe('/queue collapsed paste submission', () => {
@@ -29,3 +29,30 @@ describe('/queue collapsed paste submission', () => {
     expect(expandPasteTokens([paste, image])(`${paste.label} and ${image.label}`)).toBe(`one\ntwo and ${image.label}`)
   })
 })
+
+describe('prepareSlashSubmission', () => {
+  const label = '[[ Done — verified.. [412 lines] .. already on it. ]]'
+  const text = 'Done — verified through the real resolver\nline two\nline three'
+  const tokens: ComposerToken[] = [{ kind: 'paste', label, text }]
+
+  // The reported bug: `/pr-triage <paste>` dispatched the LABEL, so the skill
+  // received "[412 lines]" as its argument and the agent reported the paste as
+  // truncated. The command has to carry the full text; only the transcript
+  // stays collapsed.
+  it('dispatches the full paste while the transcript keeps the collapsed label', () => {
+    expect(prepareSlashSubmission(`/pr-triage ${label}`, tokens)).toEqual({
+      command: `/pr-triage ${text}`,
+      display: `/pr-triage ${label}`
+    })
+  })
+
+  it('leaves image tokens as labels — the gateway already holds the file', () => {
+    const image: ComposerToken = { kind: 'image', index: 1, label: imageToken(1), path: '/tmp/shot.png' }
+
+    expect(prepareSlashSubmission(`/pr-triage ${image.label}`, [image]).command).toBe(`/pr-triage ${image.label}`)
+  })
+
+  it('is a no-op on a token-free command', () => {
+    expect(prepareSlashSubmission('/model opus', [])).toEqual({ command: '/model opus', display: '/model opus' })
+  })
+})
diff --git a/ui-tui/src/__tests__/slashParity.test.ts b/ui-tui/src/__tests__/slashParity.test.ts
index f54fa629a6..c76be8efca 100644
--- a/ui-tui/src/__tests__/slashParity.test.ts
+++ b/ui-tui/src/__tests__/slashParity.test.ts
@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
 
 import { findSlashCommand, SLASH_COMMANDS } from '../app/slash/registry.js'
+import { parseSlashCommand } from '../domain/slash.js'
 
 type CommandRoute = 'fallback' | 'local' | 'native'
 
@@ -122,3 +123,29 @@ describe('slash parity matrix', () => {
     expect(cmd!.name).toBe('queue')
   })
 })
+
+describe('parseSlashCommand argument fidelity', () => {
+  it('keeps a multi-line argument byte-for-byte', () => {
+    const arg = 'first line\nsecond line\n\n  indented tail'
+
+    expect(parseSlashCommand(`/pr-triage ${arg}`)).toEqual({
+      arg,
+      cmd: `/pr-triage ${arg}`,
+      name: 'pr-triage'
+    })
+  })
+
+  it('preserves runs of spaces inside the argument', () => {
+    expect(parseSlashCommand('/goal ship   it').arg).toBe('ship   it')
+  })
+
+  it('still splits the command name off a single separator', () => {
+    expect(parseSlashCommand('/cron add daily')).toEqual({
+      arg: 'add daily',
+      cmd: '/cron add daily',
+      name: 'cron'
+    })
+    expect(parseSlashCommand('/exit')).toEqual({ arg: '', cmd: '/exit', name: 'exit' })
+    expect(parseSlashCommand('/exit ')).toEqual({ arg: '', cmd: '/exit ', name: 'exit' })
+  })
+})
diff --git a/ui-tui/src/app/createGatewayEventHandler.ts b/ui-tui/src/app/createGatewayEventHandler.ts
index 33f8096bd0..9e24da7517 100644
--- a/ui-tui/src/app/createGatewayEventHandler.ts
+++ b/ui-tui/src/app/createGatewayEventHandler.ts
@@ -420,7 +420,16 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
 
   const { rpc } = ctx.gateway
   const { STARTUP_RESUME_ID, newSession, recoverSidRef, resumeById, setCatalog } = ctx.session
-  const { bellOnComplete, stdout, sys } = ctx.system
+  const { bellOnComplete, bellOnPrompt, stdout, sys } = ctx.system
+
+  // display.bell_on_prompt — BEL whenever a blocking prompt modal opens
+  // (same mechanism as bell_on_complete; works over SSH, triggers tmux bell-action).
+  const ringPromptBell = () => {
+    if (bellOnPrompt && stdout?.isTTY) {
+      stdout.write('\x07')
+    }
+  }
+
   const { appendMessage, panel, setHistoryItems } = ctx.transcript
   const { setInput } = ctx.composer
   const { submitLiteralRef, submitRef } = ctx.submission
@@ -1250,6 +1259,7 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
               }
         })
         setStatus('waiting for input…')
+        ringPromptBell()
 
         return
       }
@@ -1269,6 +1279,7 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
           }
         })
         setStatus('approval needed')
+        ringPromptBell()
 
         return
       }
@@ -1276,6 +1287,7 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
       case 'sudo.request':
         patchOverlayState({ sudo: { requestId: ev.payload.request_id } })
         setStatus('sudo password needed')
+        ringPromptBell()
 
         return
 
@@ -1284,6 +1296,7 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
           secret: { envVar: ev.payload.env_var, prompt: ev.payload.prompt, requestId: ev.payload.request_id }
         })
         setStatus('secret input needed')
+        ringPromptBell()
 
         return
 
diff --git a/ui-tui/src/app/interfaces.ts b/ui-tui/src/app/interfaces.ts
index 0f4b9cb6ac..1aecedd70b 100644
--- a/ui-tui/src/app/interfaces.ts
+++ b/ui-tui/src/app/interfaces.ts
@@ -498,6 +498,7 @@ export interface GatewayEventHandlerContext {
   }
   system: {
     bellOnComplete: boolean
+    bellOnPrompt?: boolean
     stdout?: NodeJS.WriteStream
     sys: (text: string) => void
   }
diff --git a/ui-tui/src/app/turnController.ts b/ui-tui/src/app/turnController.ts
index ac7f5ca541..f6a1c53ef3 100644
--- a/ui-tui/src/app/turnController.ts
+++ b/ui-tui/src/app/turnController.ts
@@ -1040,6 +1040,7 @@ class TurnController {
       }
 
       const base: SubagentProgress = existing ?? {
+        delegationId: p.delegation_id,
         depth: p.depth ?? 0,
         goal: p.goal,
         id,
@@ -1071,6 +1072,7 @@ class TurnController {
         ...base,
         apiCalls: p.api_calls ?? base.apiCalls,
         costUsd: p.cost_usd ?? base.costUsd,
+        delegationId: p.delegation_id ?? base.delegationId,
         depth: p.depth ?? base.depth,
         filesRead: p.files_read ?? base.filesRead,
         filesWritten: p.files_written ?? base.filesWritten,
diff --git a/ui-tui/src/app/useConfigSync.ts b/ui-tui/src/app/useConfigSync.ts
index 32e5b4f462..2f3f31dca3 100644
--- a/ui-tui/src/app/useConfigSync.ts
+++ b/ui-tui/src/app/useConfigSync.ts
@@ -253,10 +253,11 @@ const _pasteCollapseCharsFromConfig = (cfg: ConfigFullResponse | null): number =
 export async function hydrateFullConfig(
   gw: GatewayClient,
   setBell: (v: boolean) => void,
-  setVoiceRecordKey?: (v: ParsedVoiceRecordKey) => void
+  setVoiceRecordKey?: (v: ParsedVoiceRecordKey) => void,
+  setBellOnPrompt?: (v: boolean) => void
 ): Promise<ConfigFullResponse | null> {
   const cfg = await quietRpc<ConfigFullResponse>(gw, 'config.get', { key: 'full' })
-  applyDisplay(cfg, setBell, setVoiceRecordKey)
+  applyDisplay(cfg, setBell, setVoiceRecordKey, setBellOnPrompt)
 
   return cfg
 }
@@ -264,13 +265,16 @@ export async function hydrateFullConfig(
 export const applyDisplay = (
   cfg: ConfigFullResponse | null,
   setBell: (v: boolean) => void,
-  setVoiceRecordKey?: (v: ParsedVoiceRecordKey) => void
+  setVoiceRecordKey?: (v: ParsedVoiceRecordKey) => void,
+  setBellOnPrompt?: (v: boolean) => void
 ) => {
   const d = cfg?.config?.display ?? {}
   const approvals = cfg?.config?.approvals
 
   setBell(!!d.bell_on_complete)
 
+  setBellOnPrompt?.(!!d.bell_on_prompt)
+
   applyConfiguredTuiTheme(d.tui_theme)
 
   // Only push the voice record key when the RPC actually returned a
@@ -314,6 +318,7 @@ export const applyDisplay = (
 export function useConfigSync({
   gw,
   setBellOnComplete,
+  setBellOnPrompt,
   setVoiceEnabled,
   setVoiceRecordKey,
   sid
@@ -339,8 +344,8 @@ export function useConfigSync({
       // mcp_rev) look like an MCP change and fire a needless reload.mcp.
       mcpRevRef.current.accepted = String(r?.mcp_rev ?? '')
     })
-    void hydrateFullConfig(gw, setBellOnComplete, setVoiceRecordKey)
-  }, [gw, setBellOnComplete, setVoiceEnabled, setVoiceRecordKey, sid])
+    void hydrateFullConfig(gw, setBellOnComplete, setVoiceRecordKey, setBellOnPrompt)
+  }, [gw, setBellOnComplete, setBellOnPrompt, setVoiceEnabled, setVoiceRecordKey, sid])
 
   useEffect(() => {
     if (!sid) {
@@ -387,17 +392,18 @@ export function useConfigSync({
           )
         }
 
-        void hydrateFullConfig(gw, setBellOnComplete, setVoiceRecordKey)
+        void hydrateFullConfig(gw, setBellOnComplete, setVoiceRecordKey, setBellOnPrompt)
       })
     }, MTIME_POLL_MS)
 
     return () => clearInterval(id)
-  }, [gw, setBellOnComplete, setVoiceRecordKey, sid])
+  }, [gw, setBellOnComplete, setBellOnPrompt, setVoiceRecordKey, sid])
 }
 
 export interface UseConfigSyncOptions {
   gw: GatewayClient
   setBellOnComplete: (v: boolean) => void
+  setBellOnPrompt?: (v: boolean) => void
   setVoiceEnabled: (v: boolean) => void
   setVoiceRecordKey?: (v: ParsedVoiceRecordKey) => void
   sid: null | string
diff --git a/ui-tui/src/app/useMainApp.ts b/ui-tui/src/app/useMainApp.ts
index 4a794fc29b..7d57382644 100644
--- a/ui-tui/src/app/useMainApp.ts
+++ b/ui-tui/src/app/useMainApp.ts
@@ -207,6 +207,7 @@ export function useMainApp(gw: GatewayClient) {
   // Bumped by the gateway `reaction` event (core-detected affection).
   const goodVibesTick = useStore($goodVibesTick)
   const [bellOnComplete, setBellOnComplete] = useState(false)
+  const [bellOnPrompt, setBellOnPrompt] = useState(false)
 
   const ui = useStore($uiState)
   const overlay = useStore($overlayState)
@@ -578,7 +579,7 @@ export function useMainApp(gw: GatewayClient) {
     }
   }, [ui.busy, turnStartedAt])
 
-  useConfigSync({ gw, setBellOnComplete, setVoiceEnabled, setVoiceRecordKey, sid: ui.sid })
+  useConfigSync({ gw, setBellOnComplete, setBellOnPrompt, setVoiceEnabled, setVoiceRecordKey, sid: ui.sid })
   useBatteryPoll(gw)
 
   useEffect(() => {
@@ -857,7 +858,7 @@ export function useMainApp(gw: GatewayClient) {
           setCatalog
         },
         submission: { submitLiteralRef, submitRef },
-        system: { bellOnComplete, stdout, sys },
+        system: { bellOnComplete, bellOnPrompt, stdout, sys },
         transcript: { appendMessage, panel, setHistoryItems },
         voice: {
           setProcessing: setVoiceProcessing,
@@ -869,6 +870,7 @@ export function useMainApp(gw: GatewayClient) {
     [
       appendMessage,
       bellOnComplete,
+      bellOnPrompt,
       composerActions.setInput,
       gateway,
       panel,
diff --git a/ui-tui/src/app/useSubmission.ts b/ui-tui/src/app/useSubmission.ts
index 0a7ef55bad..57ce9f60f9 100644
--- a/ui-tui/src/app/useSubmission.ts
+++ b/ui-tui/src/app/useSubmission.ts
@@ -40,6 +40,24 @@ export const prepareSubmission = (display: string, tokens: ComposerToken[]) => (
   text: expandTokens(tokens)(display)
 })
 
+/**
+ * Split a slash submission into the two things it has to be at once.
+ *
+ * A slash command's argument is ordinary user text, so a collapsed paste in it
+ * must resolve BEFORE the command runs — otherwise `/pr-triage [[ … [412 lines]
+ * … ]]` hands the skill the label and the agent faithfully reports that the
+ * paste is truncated. The transcript still shows the compact form, because a
+ * 412-line paste inlined into the scrollback is exactly what collapsing it was
+ * for.
+ *
+ * Image tokens stay as labels: the gateway already holds those files in
+ * `attached_images` and splices them in at submit.
+ */
+export const prepareSlashSubmission = (display: string, tokens: ComposerToken[]) => ({
+  command: expandPasteTokens(tokens)(display),
+  display
+})
+
 export const shouldInterpolateSubmission = (display: string) => hasInterpolation(display)
 
 export function useSubmission(opts: UseSubmissionOptions) {
@@ -245,22 +263,23 @@ export function useSubmission(opts: UseSubmissionOptions) {
       const submissionTokens = [...composerRefs.tokensRef.current]
       const submission = prepareSubmission(full, submissionTokens)
       const toHistory = submission.text
-      const queuePayload = expandPasteTokens(submissionTokens)(full)
 
       if (looksLikeSlashCommand(full)) {
-        appendMessage({ kind: 'slash', role: 'system', text: full })
+        const slash = prepareSlashSubmission(full, submissionTokens)
+
+        appendMessage({ kind: 'slash', role: 'system', text: slash.display })
         composerActions.pushHistory(toHistory)
 
         const parsed = parseSlashCommand(full)
 
         const queued =
-          parsed.name === 'queue' || parsed.name === 'q' ? queueItemFromSlash(full, queuePayload) : undefined
+          parsed.name === 'queue' || parsed.name === 'q' ? queueItemFromSlash(slash.display, slash.command) : undefined
 
         if (queued) {
           composerActions.enqueue(queued.text, queued.display)
           sys(`queued: "${queued.display.slice(0, 50)}${queued.display.length > 50 ? '…' : ''}"`)
         } else {
-          slashRef.current(full)
+          slashRef.current(slash.command)
         }
 
         composerActions.clearIn()
diff --git a/ui-tui/src/components/thinking.tsx b/ui-tui/src/components/thinking.tsx
index d3225bee6a..da484a0fa6 100644
--- a/ui-tui/src/components/thinking.tsx
+++ b/ui-tui/src/components/thinking.tsx
@@ -332,7 +332,16 @@ function SubagentAccordion({
         ? 'warn'
         : 'dim'
 
-  const prefix = item.taskCount > 1 ? `[${item.index + 1}/${item.taskCount}] ` : ''
+  // `[6a66 3/9]` when the gateway tags the batch; `[3/9]` on older gateways.
+  const batchTag = item.delegationId?.split('_').at(-1)?.slice(0, 4)
+
+  const prefix =
+    item.taskCount > 1
+      ? `[${batchTag ? `${batchTag} ` : ''}${item.index + 1}/${item.taskCount}] `
+      : batchTag
+        ? `[${batchTag}] `
+        : ''
+
   const goalLabel = item.goal || `Subagent ${item.index + 1}`
   const title = `${prefix}${open ? goalLabel : compactPreview(goalLabel, 60)}`
   const summary = compactPreview((item.summary || '').replace(/\s+/g, ' ').trim(), 72)
diff --git a/ui-tui/src/domain/slash.ts b/ui-tui/src/domain/slash.ts
index 1f1b12847d..3b24d1e7a3 100644
--- a/ui-tui/src/domain/slash.ts
+++ b/ui-tui/src/domain/slash.ts
@@ -47,10 +47,17 @@ export const inlineSlashTrigger = (text: string): { query: string; start: number
   return { query, start: text.length - query.length - 1 }
 }
 
-export const parseSlashCommand = (cmd: string) => {
-  const [name = '', ...rest] = cmd.slice(1).split(/\s+/)
+// Only the separator between the command name and its argument is whitespace
+// the parser owns. Everything after it is the user's text and survives
+// verbatim: splitting the whole line on `\s+` and rejoining with a space
+// flattened every pasted diff, log, or PR thread into one run-on line before
+// the command ever saw it.
+const SLASH_PARTS_RE = /^(\S*)\s*([\s\S]*)$/
 
-  return { arg: rest.join(' '), cmd, name: name.toLowerCase() }
+export const parseSlashCommand = (cmd: string) => {
+  const [, name = '', arg = ''] = SLASH_PARTS_RE.exec(cmd.slice(1)) ?? []
+
+  return { arg, cmd, name: name.toLowerCase() }
 }
 
 /**
diff --git a/ui-tui/src/gatewayTypes.ts b/ui-tui/src/gatewayTypes.ts
index bc08637c14..b2c2fd5955 100644
--- a/ui-tui/src/gatewayTypes.ts
+++ b/ui-tui/src/gatewayTypes.ts
@@ -79,6 +79,7 @@ export type CommandDispatchResponse =
 export interface ConfigDisplayConfig {
   battery?: boolean
   bell_on_complete?: boolean
+  bell_on_prompt?: boolean
   busy_input_mode?: string
   details_mode?: string
   /** Focus view (/focus) — display-only reduced-output mode. */
@@ -543,6 +544,9 @@ export interface RollbackRestoreResponse {
 export interface SubagentEventPayload {
   api_calls?: number
   cost_usd?: number
+  /** Batch (delegation) id this subagent belongs to — distinguishes
+   *  interleaved `[n/N]` progress from concurrent or nested fan-outs. */
+  delegation_id?: string
   depth?: number
   duration_seconds?: number
   files_read?: string[]
diff --git a/ui-tui/src/types.ts b/ui-tui/src/types.ts
index 1803402bb5..1b016da56f 100644
--- a/ui-tui/src/types.ts
+++ b/ui-tui/src/types.ts
@@ -25,6 +25,9 @@ export type SubagentStatus = 'completed' | 'error' | 'failed' | 'interrupted' |
 export interface SubagentProgress {
   apiCalls?: number
   costUsd?: number
+  /** Batch (delegation) id — tags `[n/N]` rows so concurrent/nested fan-outs
+   *  are distinguishable. Absent on older gateways. */
+  delegationId?: string
   depth: number
   durationSeconds?: number
   filesRead?: string[]
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
index f02841275b..783d3b6bc5 100644
--- a/web/src/lib/api.ts
+++ b/web/src/lib/api.ts
@@ -1948,6 +1948,9 @@ export interface SessionInfo {
   output_tokens: number;
   preview: string | null;
   parent_session_id?: string | null;
+  /** Owning profile stamped by the list/detail endpoints (the store the row
+   * was read from). Absent on search-endpoint rows, which carry no stamp. */
+  profile?: string;
 }
 
 export interface SessionLatestDescendantResponse {
diff --git a/web/src/lib/cron-job.test.ts b/web/src/lib/cron-job.test.ts
index 172f7f939e..25420d0a3a 100644
--- a/web/src/lib/cron-job.test.ts
+++ b/web/src/lib/cron-job.test.ts
@@ -4,6 +4,7 @@ import {
   buildCronJobPayload,
   cronJobHasExecutionContent,
   cronJobFormFromJob,
+  cronLastResult,
   splitCronList,
   type CronJobFormState,
 } from "./cron-job";
@@ -153,3 +154,49 @@ describe("cronJobFormFromJob", () => {
     });
   });
 });
+
+describe("cronLastResult", () => {
+  it("renders nothing for a job that never ran", () => {
+    expect(cronLastResult({ last_status: null })).toBeNull();
+    expect(cronLastResult({ last_status: "" })).toBeNull();
+  });
+
+  it("is green for ok with no detail", () => {
+    expect(cronLastResult({ last_status: "ok", last_error: null })).toEqual({
+      status: "ok",
+      tone: "success",
+      detail: null,
+    });
+  });
+
+  it("is amber for delivery_failed and explains it from last_delivery_error", () => {
+    // The agent run succeeded (last_error is null for these runs); the reason
+    // lives in last_delivery_error. Must never render as green or as "unknown".
+    expect(
+      cronLastResult({
+        last_status: "delivery_failed",
+        last_error: null,
+        last_delivery_error: "telegram: 502 Bad Gateway",
+      }),
+    ).toEqual({
+      status: "delivery_failed",
+      tone: "warning",
+      detail: "telegram: 502 Bad Gateway",
+    });
+  });
+
+  it("is red for error and any unrecognised literal", () => {
+    expect(cronLastResult({ last_status: "error", last_error: "boom" })).toEqual({
+      status: "error",
+      tone: "destructive",
+      detail: "boom",
+    });
+    expect(cronLastResult({ last_status: "something_new" })?.tone).toBe("destructive");
+  });
+
+  it("is amber for blocked_config (preflight refused to burn a run)", () => {
+    expect(
+      cronLastResult({ last_status: "blocked_config", last_error: "missing API key" }),
+    ).toEqual({ status: "blocked_config", tone: "warning", detail: "missing API key" });
+  });
+});
diff --git a/web/src/lib/cron-job.ts b/web/src/lib/cron-job.ts
index ab8e834582..de4fa9fc47 100644
--- a/web/src/lib/cron-job.ts
+++ b/web/src/lib/cron-job.ts
@@ -102,3 +102,39 @@ export function cronJobFormFromJob(job: CronJob): CronJobFormState {
     workdir: asString(job.workdir),
   };
 }
+
+/** How a job's `last_status` should render. The scheduler writes a small,
+ *  closed set of literals; every literal maps to an explicit tone here so a
+ *  new status can never fall through to a neutral "unknown"-looking badge.
+ *  In particular `delivery_failed` (agent run succeeded, output never reached
+ *  the target) is amber, not green and not the same red as a run error, and
+ *  its detail lives in `last_delivery_error` (last_error is null for it). */
+export type CronLastResultTone = "success" | "warning" | "destructive";
+
+export interface CronLastResult {
+  status: string;
+  tone: CronLastResultTone;
+  /** Human detail to show next to the badge; null when nothing to add. */
+  detail: string | null;
+}
+
+const CRON_LAST_RESULT_TONE: Record<string, CronLastResultTone> = {
+  ok: "success",
+  delivery_failed: "warning",
+  blocked_config: "warning",
+  error: "destructive",
+};
+
+export function cronLastResult(
+  job: Pick<CronJob, "last_status" | "last_error" | "last_delivery_error">,
+): CronLastResult | null {
+  const status = asString(job.last_status).trim();
+  if (!status) return null;
+  const tone = CRON_LAST_RESULT_TONE[status] ?? "destructive";
+  if (status === "ok") return { status, tone, detail: null };
+  const detail =
+    status === "delivery_failed"
+      ? asString(job.last_delivery_error).trim() || asString(job.last_error).trim()
+      : asString(job.last_error).trim() || asString(job.last_delivery_error).trim();
+  return { status, tone, detail: detail || null };
+}
diff --git a/web/src/pages/CronPage.tsx b/web/src/pages/CronPage.tsx
index b501d5675f..a29a192dc2 100644
--- a/web/src/pages/CronPage.tsx
+++ b/web/src/pages/CronPage.tsx
@@ -22,6 +22,7 @@ import {
   buildCronJobPayload,
   cronJobHasExecutionContent,
   cronJobFormFromJob,
+  cronLastResult,
   type CronJobFormState,
 } from "@/lib/cron-job";
 import { DeleteConfirmDialog } from "@/components/DeleteConfirmDialog";
@@ -1100,6 +1101,7 @@ export default function CronPage() {
           const toolsets = Array.isArray(job.enabled_toolsets)
             ? job.enabled_toolsets.filter(Boolean)
             : [];
+          const lastResult = cronLastResult(job);
 
           return (
             <Card key={jobKey}>
@@ -1112,6 +1114,15 @@ export default function CronPage() {
                     <Badge tone={STATUS_TONE[state] ?? "secondary"}>
                       {state}
                     </Badge>
+                    {lastResult && lastResult.status !== "ok" && (
+                      <Badge
+                        tone={lastResult.tone}
+                        title={lastResult.detail ?? undefined}
+                        data-testid="cron-last-result"
+                      >
+                        {lastResult.status}
+                      </Badge>
+                    )}
                     <Badge tone="outline">{profileLabel(profile)}</Badge>
                     {deliver && deliver !== "local" && (
                       <Badge tone="outline">{deliver}</Badge>
diff --git a/web/src/pages/SessionsPage.test.tsx b/web/src/pages/SessionsPage.test.tsx
new file mode 100644
index 0000000000..a621835544
--- /dev/null
+++ b/web/src/pages/SessionsPage.test.tsx
@@ -0,0 +1,154 @@
+// @vitest-environment jsdom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { MemoryRouter } from "react-router";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const apiMocks = vi.hoisted(() => ({
+  getSessions: vi.fn(),
+  getSessionMessages: vi.fn(),
+  getEmptySessionsCount: vi.fn(),
+  getStatus: vi.fn(),
+  searchSessions: vi.fn(),
+  importSessions: vi.fn(),
+  exportSessionUrl: vi.fn(),
+  renameSession: vi.fn(),
+  pruneSessions: vi.fn(),
+  deleteSession: vi.fn(),
+  deleteEmptySessions: vi.fn(),
+  bulkDeleteSessions: vi.fn(),
+  getProfiles: vi.fn(),
+  getActiveProfile: vi.fn(),
+  getSessionStats: vi.fn(),
+}));
+
+vi.mock("@/lib/api", () => ({
+  api: apiMocks,
+  // ProfileProvider mirrors its selection into the api module.
+  setManagementProfile: vi.fn(),
+  getManagementProfile: vi.fn(() => ""),
+}));
+vi.mock("@/components/PlatformsCard", () => ({ PlatformsCard: () => null }));
+vi.mock("@/components/Markdown", () => ({ Markdown: () => null }));
+
+let container: HTMLDivElement;
+let root: Root;
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+async function waitFor(cond: () => boolean, timeoutMs = 5000) {
+  const start = Date.now();
+  while (!cond()) {
+    if (Date.now() - start > timeoutMs) throw new Error("waitFor: condition never became true");
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    });
+  }
+}
+
+function click(el: Element | null) {
+  if (!el) throw new Error("element not rendered");
+  el.dispatchEvent(new MouseEvent("click", { bubbles: true, cancelable: true }));
+}
+
+const button = (label: string) => document.querySelector(`button[aria-label="${label}"]`);
+
+async function renderSessionsPage(rows: Record<string, unknown>[]) {
+  // Page list uses limit 20; the overview tab's recent-cards fetch uses 50 —
+  // keep the overview empty so the list view (with row actions) renders.
+  apiMocks.getSessions.mockImplementation(async (limit: number) => ({
+    sessions: limit >= 50 ? [] : rows,
+    total: limit >= 50 ? 0 : rows.length,
+    limit,
+    offset: 0,
+  }));
+  const [{ default: SessionsPage }, { I18nProvider }, { SystemActionsProvider }, { ProfileProvider }, { PageHeaderProvider }] =
+    await Promise.all([
+      import("./SessionsPage"),
+      import("@/i18n"),
+      import("@/contexts/SystemActions"),
+      import("@/contexts/ProfileProvider"),
+      import("@/contexts/PageHeaderProvider"),
+    ]);
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+  await act(async () =>
+    root.render(
+      <I18nProvider>
+        <MemoryRouter>
+          <SystemActionsProvider>
+            <ProfileProvider>
+              <PageHeaderProvider pluginTabs={[]}>
+                <SessionsPage />
+              </PageHeaderProvider>
+            </ProfileProvider>
+          </SystemActionsProvider>
+        </MemoryRouter>
+      </I18nProvider>,
+    ),
+  );
+  await waitFor(() => Boolean(button("Delete session")));
+}
+
+beforeEach(() => {
+  for (const fn of Object.values(apiMocks)) fn.mockReset();
+  apiMocks.getStatus.mockResolvedValue({});
+  apiMocks.getEmptySessionsCount.mockResolvedValue({ count: 0 });
+  apiMocks.getProfiles.mockResolvedValue({ profiles: [] });
+  // active === current keeps the management profile "" — the precondition
+  // under which an unstamped request hits the process's own store.
+  apiMocks.getActiveProfile.mockResolvedValue({ current: "default", active: "default" });
+  apiMocks.getSessionStats.mockResolvedValue({ by_source: {} });
+  apiMocks.getSessionMessages.mockResolvedValue({ messages: [] });
+  apiMocks.deleteSession.mockResolvedValue({ ok: true });
+  apiMocks.renameSession.mockResolvedValue({ ok: true, title: "Renamed" });
+  apiMocks.exportSessionUrl.mockReturnValue("/api/sessions/x/export");
+  vi.stubGlobal("fetch", vi.fn(async () => ({ ok: false, status: 500 })));
+  vi.stubGlobal("ResizeObserver", class { disconnect() {} observe() {} unobserve() {} });
+  // gsap ticks through rAF; a synchronous callback recurses to death.
+  vi.stubGlobal("requestAnimationFrame", (cb: FrameRequestCallback) => setTimeout(() => cb(0), 0) as unknown as number);
+  vi.stubGlobal("cancelAnimationFrame", (id: number) => clearTimeout(id));
+  vi.stubGlobal("matchMedia", () => ({ addEventListener() {}, matches: false, media: "", removeEventListener() {} }));
+  sessionStorage.clear();
+});
+
+afterEach(async () => {
+  await act(async () => root?.unmount());
+  container?.remove();
+  vi.unstubAllGlobals();
+});
+
+describe("SessionsPage per-row profile routing (#99387)", () => {
+  it("sends every per-row request to the row's owning profile, not the management default", async () => {
+    await renderSessionsPage([
+      { id: "sid-guanli", profile: "guanli", source: "cli", model: null, title: "Managed", started_at: 1, ended_at: null,
+        last_active: 1, is_active: false, message_count: 2, tool_call_count: 0, input_tokens: 1, output_tokens: 1, preview: "hi" },
+    ]);
+
+    // expand → transcript read
+    await act(async () => click(button("Delete session")!.closest("div.cursor-pointer")));
+    await waitFor(() => apiMocks.getSessionMessages.mock.calls.length > 0);
+    expect(apiMocks.getSessionMessages).toHaveBeenCalledWith("sid-guanli", "guanli");
+
+    await act(async () => click(button("Export session")));
+    expect(apiMocks.exportSessionUrl).toHaveBeenCalledWith("sid-guanli", "guanli");
+
+    await act(async () => click(button("Rename session")));
+    const input = document.querySelector<HTMLInputElement>('input[placeholder="Session title"]');
+    if (!input) throw new Error("rename input not rendered");
+    await act(async () => {
+      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")!.set!.call(input, "Renamed");
+      input.dispatchEvent(new Event("input", { bubbles: true }));
+    });
+    await act(async () => click(button("Save title")));
+    expect(apiMocks.renameSession).toHaveBeenCalledWith("sid-guanli", "Renamed", "guanli");
+
+    await act(async () => click(button("Delete session")));
+    await waitFor(() => Boolean(document.querySelector('[role="alertdialog"]')));
+    const confirm = Array.from(document.querySelectorAll('[role="alertdialog"] button')).find(
+      (b) => b.textContent?.trim() === "Delete",
+    );
+    await act(async () => click(confirm ?? null));
+    expect(apiMocks.deleteSession).toHaveBeenCalledWith("sid-guanli", "guanli");
+  });
+});
diff --git a/web/src/pages/SessionsPage.tsx b/web/src/pages/SessionsPage.tsx
index 09140f9e41..8115cd5742 100644
--- a/web/src/pages/SessionsPage.tsx
+++ b/web/src/pages/SessionsPage.tsx
@@ -487,7 +487,7 @@ function SessionRow({
     if (!isExpanded || messages !== null) return;
     let cancelled = false;
     api
-      .getSessionMessages(session.id)
+      .getSessionMessages(session.id, session.profile)
       .then((resp) => {
         if (!cancelled) setMessages(resp.messages);
       })
@@ -497,7 +497,7 @@ function SessionRow({
     return () => {
       cancelled = true;
     };
-  }, [isExpanded, session.id, messages]);
+  }, [isExpanded, session.id, session.profile, messages]);
 
   const sourceKey = session.source?.split(":")[0];
   const sourceInfo = (session.source
@@ -1274,11 +1274,22 @@ export default function SessionsPage() {
     };
   }, [search, sessionQueryOptions]);
 
+  // The profile a listed row was read from — the store that owns it. Every
+  // per-row request (delete, rename, export, messages) must go there, not to
+  // the global management profile, which lags the row (it stays "" while the
+  // sticky active profile equals the dashboard process's own, so the request
+  // hits the process store — a delete then "succeeds" as already_absent).
+  // Search rows carry no stamp: undefined falls back to the management profile.
+  const rowProfile = useCallback(
+    (id: string) => sessions.find((s) => s.id === id)?.profile,
+    [sessions],
+  );
+
   const sessionDelete = useConfirmDelete({
     onDelete: useCallback(
       async (id: string) => {
         try {
-          await api.deleteSession(id);
+          await api.deleteSession(id, rowProfile(id));
           setSessions((prev) => prev.filter((s) => s.id !== id));
           setTotal((prev) => prev - 1);
           if (expandedId === id) setExpandedId(null);
@@ -1304,6 +1315,7 @@ export default function SessionsPage() {
       [
         expandedId,
         refreshEmptyCount,
+        rowProfile,
         showToast,
         loadStats,
         t.sessions.sessionDeleted,
@@ -1373,7 +1385,13 @@ export default function SessionsPage() {
     }
     setDeletingSelected(true);
     try {
-      const resp = await api.bulkDeleteSessions(ids);
+      // The selection comes from one listed page, so its rows share one
+      // owning profile; a mixed selection falls back to the management profile.
+      const owners = new Set(ids.map(rowProfile));
+      const resp = await api.bulkDeleteSessions(
+        ids,
+        owners.size === 1 ? [...owners][0] : undefined,
+      );
       showToast(
         t.sessions.selectedSessionsDeleted.replace(
           "{count}",
@@ -1404,6 +1422,7 @@ export default function SessionsPage() {
     loadSessions,
     page,
     refreshEmptyCount,
+    rowProfile,
     selectedIds,
     showToast,
     t.sessions.failedToDeleteSelected,
@@ -1449,7 +1468,7 @@ export default function SessionsPage() {
   const handleRename = useCallback(
     async (id: string, title: string) => {
       try {
-        await api.renameSession(id, title);
+        await api.renameSession(id, title, rowProfile(id));
         setSessions((prev) =>
           prev.map((s) => (s.id === id ? { ...s, title } : s)),
         );
@@ -1462,13 +1481,13 @@ export default function SessionsPage() {
         showToast("Failed to rename session", "error");
       }
     },
-    [showToast, loadStats],
+    [rowProfile, showToast, loadStats],
   );
 
   const handleExport = useCallback(
     async (id: string) => {
       try {
-        const res = await fetch(api.exportSessionUrl(id), {
+        const res = await fetch(api.exportSessionUrl(id, rowProfile(id)), {
           credentials: "include",
           headers: {
             "X-Hermes-Session-Token":
@@ -1488,7 +1507,7 @@ export default function SessionsPage() {
         showToast("Failed to export session", "error");
       }
     },
-    [showToast],
+    [rowProfile, showToast],
   );
 
   const handlePrune = useCallback(async () => {
diff --git a/website/docs/developer-guide/adding-platform-adapters.md b/website/docs/developer-guide/adding-platform-adapters.md
index 870c6608dd..9572c684a5 100644
--- a/website/docs/developer-guide/adding-platform-adapters.md
+++ b/website/docs/developer-guide/adding-platform-adapters.md
@@ -637,7 +637,7 @@ Three touchpoints:
 
 Six touchpoints:
 
-1. **`_create_adapter()`** — Add an `elif platform == Platform.NEWPLAT:` branch
+1. **`_instantiate_adapter()`** — Add an `elif platform == Platform.NEWPLAT:` branch. The `_create_adapter()` wrapper binds every successful adapter to its gateway runner.
 2. **`_is_user_authorized()` allowed_users map** — `Platform.NEWPLAT: "NEWPLAT_ALLOWED_USERS"`
 3. **`_is_user_authorized()` allow_all map** — `Platform.NEWPLAT: "NEWPLAT_ALLOW_ALL_USERS"`
 4. **Early env check `_any_allowlist` tuple** — Add `"NEWPLAT_ALLOWED_USERS"`
diff --git a/website/docs/developer-guide/context-compression-and-caching.md b/website/docs/developer-guide/context-compression-and-caching.md
index 2234289af4..223b802797 100644
--- a/website/docs/developer-guide/context-compression-and-caching.md
+++ b/website/docs/developer-guide/context-compression-and-caching.md
@@ -73,6 +73,21 @@ Located in `agent/context_compressor.py`. This is the **primary compression
 system** that runs inside the agent's tool loop with access to accurate,
 API-reported token counts.
 
+#### Failure cooldown and provider-proven overflow
+
+A failed or stalled summary attempt arms a per-session **failure cooldown**
+(escalating 60s → 300s → 900s, persisted in `state.db`). While it is armed,
+ordinary threshold-triggered compaction is deferred so a broken summary backend
+does not re-fire every turn. Two paths run a real attempt anyway:
+
+- Manual `/compress` (`force=True`) — clears the cooldown and retries.
+- **Provider-proven overflow** — when the provider itself rejects the request
+  with a context-length error, the recovery pass ignores the cooldown for one
+  bounded attempt (`max_compression_attempts`) without clearing it. Deferring
+  here would wedge the session: every turn would bounce off the provider and
+  the next failure would extend the ladder (#100661). If that attempt fails,
+  the cooldown is recorded normally.
+
 
 ## Configuration
 
diff --git a/website/docs/developer-guide/cron-internals.md b/website/docs/developer-guide/cron-internals.md
index 427692eb92..968af066cd 100644
--- a/website/docs/developer-guide/cron-internals.md
+++ b/website/docs/developer-guide/cron-internals.md
@@ -63,6 +63,20 @@ Jobs are stored in `~/.hermes/cron/jobs.json` with atomic write semantics (write
 }
 ```
 
+### `last_status` literals
+
+`last_status` is a closed set written only by `cron.jobs.mark_job_run`. Every
+renderer (`hermes cron list`/`doctor`, the `cronjob` tool, the web dashboard
+badge, the Desktop routine inspector) maps each literal explicitly — a consumer
+must never test `== "ok"` for "the user got their result":
+
+| Literal | Meaning | Detail field |
+|---------|---------|--------------|
+| `ok` | Agent run succeeded and (if targeted) delivery was confirmed | — |
+| `error` | Agent run failed | `last_error` |
+| `delivery_failed` | Agent run succeeded, but the output never reached its target | `last_delivery_error` (`last_error` is `null`) |
+| `blocked_config` | Pre-dispatch validation refused to burn a run | `last_error` |
+
 ### Job Lifecycle States
 
 | State | Meaning |
diff --git a/website/docs/developer-guide/gateway-internals.md b/website/docs/developer-guide/gateway-internals.md
index 30c8cb9e1f..a96c3d930d 100644
--- a/website/docs/developer-guide/gateway-internals.md
+++ b/website/docs/developer-guide/gateway-internals.md
@@ -191,6 +191,8 @@ Adapters implement a common interface:
 
 Adapters that connect with unique credentials call `acquire_scoped_lock()` in `connect()` and `release_scoped_lock()` in `disconnect()`. This prevents two profiles from using the same bot token simultaneously.
 
+A lock conflict is emitted as `{scope}_lock` with `retryable=True` so a **mid-run** reconnect can recover once the other holder exits. At **startup**, though, a live foreign holder is a configuration conflict: `gateway/restart.py::is_global_startup_conflict()` recognizes the `*_lock` / `lock_conflict` code families and the startup router parks the platform `fatal` instead of retry-queueing it. With nothing else connected the gateway exits `78` (`EX_CONFIG`, `gateway_state=startup_failed`) so the supervisor stops restarting it; alongside a genuinely transient peer failure the gateway stays alive and only the peer retries.
+
 ## Delivery Path
 
 Outgoing deliveries (`gateway/delivery.py`) handle:
diff --git a/website/docs/developer-guide/image-gen-provider-plugin.md b/website/docs/developer-guide/image-gen-provider-plugin.md
index 44b5090295..a42aa3c974 100644
--- a/website/docs/developer-guide/image-gen-provider-plugin.md
+++ b/website/docs/developer-guide/image-gen-provider-plugin.md
@@ -6,7 +6,7 @@ description: "How to build an image-generation backend plugin for Hermes Agent"
 
 # Building an Image Generation Provider Plugin
 
-Image-gen provider plugins register a backend that services every `image_generate` tool call — DALL·E, gpt-image, Grok, Flux, Imagen, Stable Diffusion, fal, Replicate, a local ComfyUI rig, anything. Built-in providers (OpenAI, OpenAI-Codex, xAI, FAL, Krea, DeepInfra, OpenRouter) all ship as plugins. You can add a new one, or override a bundled one, by dropping a directory into `plugins/image_gen/<name>/`.
+Image-gen provider plugins register a backend that services every `image_generate` tool call — DALL·E, gpt-image, Grok, Flux, Imagen, Stable Diffusion, fal, Replicate, a local ComfyUI rig, anything. Built-in providers (OpenAI, OpenAI-Codex, xAI, FAL, Krea, DeepInfra, OpenRouter, Meta Model API) all ship as plugins. You can add a new one, or override a bundled one, by dropping a directory into `plugins/image_gen/<name>/`.
 
 :::tip
 Image-gen is one of several **backend plugins** Hermes supports. The others (with more specialized ABCs) are [Memory Provider Plugins](/developer-guide/memory-provider-plugin), [Context Engine Plugins](/developer-guide/context-engine-plugin), and [Model Provider Plugins](/developer-guide/model-provider-plugin). General tool/hook/CLI plugins live in [Build a Hermes Plugin](/developer-guide/plugins).
diff --git a/website/docs/developer-guide/session-storage.md b/website/docs/developer-guide/session-storage.md
index 0ff701d7f3..0f80accfde 100644
--- a/website/docs/developer-guide/session-storage.md
+++ b/website/docs/developer-guide/session-storage.md
@@ -21,9 +21,15 @@ Source file: `hermes_state.py`
 ├── gateway_routing       — Gateway routing metadata
 ├── compression_locks     — Cross-process compression locking
 ├── async_delegations     — Async delegation bookkeeping
+├── delivery_obligations  — Gateway outbox (owed replies); created lazily by gateway/delivery_ledger.py
 └── schema_version        — Single-row table tracking migration state
 ```
 
+`hermes sessions recover` copies the row-bearing tables above into the
+recovered database (FTS indexes and `schema_version` are regenerated), including
+the lazily-created `delivery_obligations` ledger when the source has one — its
+row count is verified like `sessions`/`messages`.
+
 Key design decisions:
 - **WAL mode** for concurrent readers + one writer (gateway multi-platform)
 - **FTS5 virtual table** for fast text search across all session messages
diff --git a/website/docs/developer-guide/web-search-provider-plugin.md b/website/docs/developer-guide/web-search-provider-plugin.md
index 98bd98f174..257df89548 100644
--- a/website/docs/developer-guide/web-search-provider-plugin.md
+++ b/website/docs/developer-guide/web-search-provider-plugin.md
@@ -6,7 +6,7 @@ description: "How to build a web-search/extract/crawl backend plugin for Hermes
 
 # Building a Web Search Provider Plugin
 
-Web-search provider plugins register a backend that services `web_search`, `web_extract`, and (optionally) deep-crawl tool calls. Built-in providers — Firecrawl, SearXNG, Exa, Parallel, Keenable, Brave Search (free tier), xAI, and DDGS — all ship as plugins under `plugins/web/<name>/`. You can add a new one, or override a bundled one, by dropping a directory next to them.
+Web-search provider plugins register a backend that services `web_search`, `web_extract`, and (optionally) deep-crawl tool calls. Built-in providers — Firecrawl, SearXNG, Tavily, Exa, Parallel, Keenable, Brave Search (free tier), xAI, and DDGS — all ship as plugins under `plugins/web/<name>/`. You can add a new one, or override a bundled one, by dropping a directory next to them.
 
 :::tip
 Web search is one of several **backend plugins** Hermes supports. The others (with their own ABCs) are [Image Generation Provider Plugins](/developer-guide/image-gen-provider-plugin), [Video Generation Provider Plugins](/developer-guide/video-gen-provider-plugin), [Memory Provider Plugins](/developer-guide/memory-provider-plugin), [Context Engine Plugins](/developer-guide/context-engine-plugin), and [Model Provider Plugins](/developer-guide/model-provider-plugin). General tool/hook/CLI plugins live in [Build a Hermes Plugin](/developer-guide/plugins).
@@ -157,7 +157,7 @@ Full contract in `agent/web_search_provider.py`. Methods you may override:
 | `search(query, limit)` | conditional | raises | Required when `supports_search()` returns `True` |
 | `extract(urls, **kwargs)` | conditional | raises | Required when `supports_extract()` returns `True` |
 
-Providers can advertise multiple capabilities from a single class — Firecrawl, Keenable, Exa, and Parallel all implement both search and extract. Brave Search and DDGS are search-only; SearXNG is search-only with a documented "pair me with an extract provider" workflow.
+Providers can advertise multiple capabilities from a single class — Firecrawl, Tavily, Keenable, Exa, and Parallel all implement both search and extract. Brave Search and DDGS are search-only; SearXNG is search-only with a documented "pair me with an extract provider" workflow.
 
 ## Response shape
 
diff --git a/website/docs/getting-started/termux.md b/website/docs/getting-started/termux.md
index 6b31efb30c..df94ba9570 100644
--- a/website/docs/getting-started/termux.md
+++ b/website/docs/getting-started/termux.md
@@ -110,6 +110,22 @@ pkg install -y git python clang rust make pkg-config libffi openssl nodejs ripgr
 Why these packages?
 
 - `python` — runtime + venv support
+
+:::warning Supported Python range
+Hermes requires **Python >=3.11,&lt;3.14**. Current Termux ships `python`
+3.14.x, which is outside that range — the installer detects this, and will
+automatically try the [Termux User Repository (TUR)](https://github.com/termux-user-repository/tur)
+for a supported interpreter. For a manual install, get one yourself:
+
+```bash
+pkg install tur-repo
+pkg install python3.13
+```
+
+Then use `python3.13` in place of `python` in the commands below
+(e.g. `python3.13 -m venv venv`).
+:::
+
 - `git` — clone/update the repo
 - `clang`, `rust`, `make`, `pkg-config`, `libffi`, `openssl` — needed to build a few Python dependencies on Android
 - `nodejs` — optional Node runtime for experiments beyond the tested core path
diff --git a/website/docs/getting-started/updating.md b/website/docs/getting-started/updating.md
index 5ae1f14787..8c20bc1558 100644
--- a/website/docs/getting-started/updating.md
+++ b/website/docs/getting-started/updating.md
@@ -29,7 +29,8 @@ When you run `hermes update`, the following steps occur:
 3. **Post-pull syntax validation + auto-rollback** — after the pull, Hermes compiles the nine critical files every `hermes` invocation imports at startup. If any fails to parse (e.g. an orphan merge-conflict marker, an accidentally truncated file), Hermes runs `git reset --hard <pre-pull-sha>` to roll the install back so your shell stays bootable. Re-run `hermes update` once the upstream fix lands.
 4. **Dependency install** — runs `uv pip install -e ".[all]"` to pick up new or changed dependencies
 5. **Config migration** — detects new config options added since your version and prompts you to set them
-6. **Gateway auto-restart** — running gateways are refreshed after the update completes so the new code takes effect immediately. Service-managed gateways (systemd on Linux, launchd on macOS) are restarted through the service manager. Manual gateways are relaunched automatically when Hermes can map the running PID back to a profile. Manually-launched `hermes serve` / `hermes dashboard` backends (for example a network-bound serve powering a remote Desktop) are handled the same way: each backend records its bind address in the install's spawn ledger at startup, so the update stops it before the code swap and relaunches it afterward on the **same host and port** — a remote Desktop pointed at that endpoint reconnects instead of stranding. Backends owned by a running Desktop app are left to the app's own respawn.
+6. **Desktop rebuild (stage-and-swap)** — if the Hermes Desktop app was built from this checkout, it is rebuilt so the GUI matches the new code. The rebuild packs into a temporary staging directory next to `apps/desktop/release/`, verifies the staged app, and only then renames it over the previous build. A rebuild that fails at any point — corrupt Electron download, missing dependency, disk full — leaves the previous app untouched and launchable; the update reports `⚠ Update partially complete` and `hermes desktop` retries the rebuild.
+7. **Gateway auto-restart** — running gateways are refreshed after the update completes so the new code takes effect immediately. Service-managed gateways (systemd on Linux, launchd on macOS) are restarted through the service manager. Manual gateways are relaunched automatically when Hermes can map the running PID back to a profile. Manually-launched `hermes serve` / `hermes dashboard` backends (for example a network-bound serve powering a remote Desktop) are handled the same way: each backend records its bind address in the install's spawn ledger at startup, so the update stops it before the code swap and relaunches it afterward on the **same host and port** — a remote Desktop pointed at that endpoint reconnects instead of stranding. Backends owned by a running Desktop app are left to the app's own respawn.
 
 ### Updating against a non-default branch: `--branch`
 
diff --git a/website/docs/guides/automate-with-cron.md b/website/docs/guides/automate-with-cron.md
index 20bb490207..c73d9b39ea 100644
--- a/website/docs/guides/automate-with-cron.md
+++ b/website/docs/guides/automate-with-cron.md
@@ -74,6 +74,10 @@ Set up the cron job:
 For cron monitoring jobs, instruct the agent to respond with only `[SILENT]` when nothing changed. Cron delivery treats `[SILENT]` as the quiet marker, so you only get notified when something actually happens — no spam on quiet hours.
 :::
 
+:::tip Keeping failure notices out of shared channels
+`[SILENT]` only applies to successful runs — when a job hard-fails, the engine posts a `⚠️ Cron 'X' failed…` notice to the job's delivery target. For jobs that deliver into busy shared channels, set `--failure-deliver local` to suppress those notices entirely (run state stays visible in `hermes cron list` and run history), or point failures at an ops channel with `--failure-deliver slack:C_OPS`. Same grammar as `--deliver`; omit it and failures follow `--deliver` as before.
+:::
+
 ---
 
 ## Pattern 2: Weekly Report
diff --git a/website/docs/guides/local-llm-on-mac.md b/website/docs/guides/local-llm-on-mac.md
index a0a3a200bd..f35e8ef2cf 100644
--- a/website/docs/guides/local-llm-on-mac.md
+++ b/website/docs/guides/local-llm-on-mac.md
@@ -6,6 +6,14 @@ description: "Set up a local OpenAI-compatible LLM server on macOS with llama.cp
 
 # Run Local LLMs on Mac
 
+:::tip Desktop users: there's a one-click path
+On the Hermes desktop app, **Settings → Providers → Local Models** installs
+and manages a local llama.cpp server for you — model downloads, memory
+fitting, and context sizing included. See [Local Models](/user-guide/local-models).
+This guide is for manual setup: MLX, custom builds, or servers you want to
+run yourself.
+:::
+
 This guide walks you through running a local LLM server on macOS with an OpenAI-compatible API. You get full privacy, zero API costs, and surprisingly good performance on Apple Silicon.
 
 We cover two backends:
diff --git a/website/docs/guides/local-ollama-setup.md b/website/docs/guides/local-ollama-setup.md
index 5136cf5f71..2bb4b7cc31 100644
--- a/website/docs/guides/local-ollama-setup.md
+++ b/website/docs/guides/local-ollama-setup.md
@@ -6,6 +6,14 @@ description: "Step-by-step guide to running Hermes Agent entirely on your own ma
 
 # Run Hermes Locally with Ollama — Zero API Cost
 
+:::tip Desktop users: there's a one-click path
+On the Hermes desktop app, **Settings → Providers → Local Models** installs
+and manages a local llama.cpp server for you — model downloads, memory
+fitting, and context sizing included. See [Local Models](/user-guide/local-models).
+This guide is for manual setup: Ollama specifically, CLI-first workflows,
+or servers you want to run yourself.
+:::
+
 ## The Problem
 
 Cloud LLM APIs charge per token. A heavy coding session can cost $5–20. For personal projects, learning, or privacy-sensitive work, that adds up — and you're sending every conversation to a third party.
diff --git a/website/docs/integrations/index.md b/website/docs/integrations/index.md
index 51555976ee..37bac9d8bf 100644
--- a/website/docs/integrations/index.md
+++ b/website/docs/integrations/index.md
@@ -42,7 +42,7 @@ Quick setup example:
 
 ```yaml
 web:
-  backend: firecrawl    # firecrawl | searxng | brave-free | ddgs | keenable | exa | parallel | xai
+  backend: firecrawl    # firecrawl | searxng | brave-free | ddgs | tavily | keenable | exa | parallel | xai
 ```
 
 If `web.backend` is not set, the backend is auto-detected from whichever API key is available. Self-hosted Firecrawl is also supported via `FIRECRAWL_API_URL`.
diff --git a/website/docs/integrations/providers.md b/website/docs/integrations/providers.md
index 0d4569accd..5ede871815 100644
--- a/website/docs/integrations/providers.md
+++ b/website/docs/integrations/providers.md
@@ -36,8 +36,8 @@ You need at least one way to connect to an LLM. Use `hermes model` to switch pro
 | **xAI (Grok) — Responses API** | `XAI_API_KEY` in `~/.hermes/.env` (provider: `xai`) |
 | **xAI Grok OAuth (SuperGrok)** | `hermes model` → "xAI Grok OAuth (SuperGrok / Premium+)" — browser login, no API key. See [guide](../guides/xai-grok-oauth.md) |
 | **Qwen Cloud (Alibaba DashScope)** | `DASHSCOPE_API_KEY` in `~/.hermes/.env` (provider: `alibaba`; mainland-China endpoint: `alibaba-cn`) |
-| **Alibaba Cloud (Coding Plan)** | `ALIBABA_CODING_PLAN_API_KEY` (falls back to `DASHSCOPE_API_KEY`) (provider: `alibaba-coding-plan`, alias: `alibaba_coding`; mainland-China endpoint: `alibaba-coding-plan-cn`) — separate billing SKU, different endpoint |
-| **Alibaba Cloud (Token Plan)** | `ALIBABA_TOKEN_PLAN_API_KEY` in `~/.hermes/.env` (provider: `alibaba-token-plan`; mainland-China endpoint: `alibaba-token-plan-cn`) — Model Studio flat-token tier |
+| **Alibaba Cloud (Coding Plan)** | `ALIBABA_CODING_PLAN_API_KEY` (falls back to `DASHSCOPE_API_KEY`) (provider: `alibaba-coding-plan`, alias: `alibaba_coding`; mainland-China endpoint: `alibaba-coding-plan-cn` with `ALIBABA_CODING_PLAN_CN_API_KEY`, falling back to the shared keys) — separate billing SKU, different endpoint |
+| **Alibaba Cloud (Token Plan)** | `ALIBABA_TOKEN_PLAN_API_KEY` in `~/.hermes/.env` (provider: `alibaba-token-plan`; mainland-China endpoint: `alibaba-token-plan-cn` with `ALIBABA_TOKEN_PLAN_CN_API_KEY`, falling back to the shared key) — Model Studio flat-token tier |
 | **Kilo Code** | `KILOCODE_API_KEY` in `~/.hermes/.env` (provider: `kilocode`) |
 | **Xiaomi MiMo** | `XIAOMI_API_KEY` in `~/.hermes/.env` (provider: `xiaomi`, aliases: `mimo`, `xiaomi-mimo`) |
 | **Tencent TokenHub** | `TOKENHUB_API_KEY` in `~/.hermes/.env` (provider: `tencent-tokenhub`, aliases: `tencent`, `tokenhub`, `tencentmaas`) |
@@ -503,6 +503,8 @@ hermes chat --provider alibaba_coding --model qwen3-coder-plus
 
 `alibaba_coding` uses the same `DASHSCOPE_API_KEY` your `alibaba` entry already uses — no separate key needed, just a different routing target. Before this provider was registered, users who set `provider: alibaba_coding` in `config.yaml` silently fell through to OpenRouter routing.
 
+For the mainland-China endpoint (`alibaba-coding-plan-cn`, `https://coding.dashscope.aliyuncs.com/v1`) set `ALIBABA_CODING_PLAN_CN_API_KEY`. The CN provider still falls back to `ALIBABA_CODING_PLAN_API_KEY` / `DASHSCOPE_API_KEY`, but with only the shared key set the `/model` picker lists just the international row — set the CN key (or `provider: alibaba-coding-plan-cn` in `config.yaml`) to surface the CN one. The same applies to `alibaba-token-plan-cn` with `ALIBABA_TOKEN_PLAN_CN_API_KEY`.
+
 ### MiniMax (OAuth)
 
 MiniMax-M2.7 via browser OAuth login — no API key needed. Pick **MiniMax (OAuth)** in `hermes model`, sign in through the browser, and Hermes persists the access + refresh tokens. Uses the Anthropic Messages-compatible endpoint (`/anthropic`) under the hood.
diff --git a/website/docs/reference/environment-variables.md b/website/docs/reference/environment-variables.md
index 8fb15ecadc..82f7983f96 100644
--- a/website/docs/reference/environment-variables.md
+++ b/website/docs/reference/environment-variables.md
@@ -83,10 +83,12 @@ Hermes reads environment variables from the process environment and, for user-ma
 | `DASHSCOPE_API_KEY` | Qwen Cloud (Alibaba DashScope) API key for Qwen models ([modelstudio.console.alibabacloud.com](https://modelstudio.console.alibabacloud.com/)) |
 | `DASHSCOPE_BASE_URL` | Custom DashScope base URL (default: `https://dashscope-intl.aliyuncs.com/compatible-mode/v1`; use `https://dashscope.aliyuncs.com/compatible-mode/v1` for mainland-China region) |
 | `DASHSCOPE_CN_BASE_URL` | Override the `alibaba-cn` mainland-China DashScope base URL |
-| `ALIBABA_CODING_PLAN_API_KEY` | Qwen Coding Plan API key (`alibaba-coding-plan` / `alibaba-coding-plan-cn` providers) |
+| `ALIBABA_CODING_PLAN_API_KEY` | Qwen Coding Plan API key (`alibaba-coding-plan`; also a fallback for `alibaba-coding-plan-cn`) |
+| `ALIBABA_CODING_PLAN_CN_API_KEY` | Qwen Coding Plan API key for the mainland-China `alibaba-coding-plan-cn` provider (checked before the shared key, so only the CN row lights up) |
 | `ALIBABA_CODING_PLAN_BASE_URL` | Override the Qwen Coding Plan base URL (international) |
 | `ALIBABA_CODING_PLAN_CN_BASE_URL` | Override the Qwen Coding Plan base URL (mainland China) |
-| `ALIBABA_TOKEN_PLAN_API_KEY` | Alibaba Model Studio Token Plan API key (`alibaba-token-plan` / `alibaba-token-plan-cn` providers) |
+| `ALIBABA_TOKEN_PLAN_API_KEY` | Alibaba Model Studio Token Plan API key (`alibaba-token-plan`; also a fallback for `alibaba-token-plan-cn`) |
+| `ALIBABA_TOKEN_PLAN_CN_API_KEY` | Token Plan API key for the mainland-China `alibaba-token-plan-cn` provider (checked before the shared key) |
 | `ALIBABA_TOKEN_PLAN_BASE_URL` | Override the Token Plan base URL (international) |
 | `ALIBABA_TOKEN_PLAN_CN_BASE_URL` | Override the Token Plan base URL (mainland China) |
 | `DEEPSEEK_API_KEY` | DeepSeek API key for direct DeepSeek access ([platform.deepseek.com](https://platform.deepseek.com/api_keys)) |
@@ -151,6 +153,8 @@ For native Anthropic auth, Hermes prefers Claude Code's own credential files whe
 | `PARALLEL_API_KEY` | AI-native web search ([parallel.ai](https://parallel.ai/)) |
 | `FIRECRAWL_API_KEY` | Web scraping and cloud browser ([firecrawl.dev](https://firecrawl.dev/)) |
 | `FIRECRAWL_API_URL` | Custom Firecrawl API endpoint for self-hosted instances (optional) |
+| `TAVILY_API_KEY` | Optional Tavily API key for higher search/extract limits. After selecting Tavily as the web backend, keyless access works without it ([app.tavily.com](https://app.tavily.com/home), [keyless docs](https://docs.tavily.com/documentation/keyless)) |
+| `TAVILY_BASE_URL` | Override the Tavily API endpoint. Useful for corporate proxies and self-hosted Tavily-compatible search backends. Same pattern as `GROQ_BASE_URL`. |
 | `SEARXNG_URL` | SearXNG instance URL for free self-hosted web search — no API key required ([searxng.github.io](https://searxng.github.io/searxng/)) |
 | `EXA_API_KEY` | Exa API key for AI-native web search and contents ([exa.ai](https://exa.ai/)) |
 | `BRAVE_SEARCH_API_KEY` | Brave Search API subscription token for web search (free tier available) ([brave.com/search/api](https://brave.com/search/api/)) |
diff --git a/website/docs/reference/faq.md b/website/docs/reference/faq.md
index fc199a509b..7dfc0d3ebd 100644
--- a/website/docs/reference/faq.md
+++ b/website/docs/reference/faq.md
@@ -319,6 +319,8 @@ If this happens on the first long conversation, Hermes may have the wrong contex
 
 Look at the CLI startup line — it shows the detected context length (e.g., `📊 Context limit: 128000 tokens`). You can also check with `/usage` during a session.
 
+**Local servers (llama.cpp, Ollama) that go silent instead of erroring:** when a provider rejects a request as too large, Hermes compacts the conversation and rebuilds the request. Hermes re-measures the *complete* rebuilt request (system prompt + tool schemas + messages) before retrying, and runs further bounded compaction passes if it is still over the threshold. If the request still cannot fit, the turn ends with `Context length exceeded: compression could not reduce the rebuilt request below the safe threshold` rather than sending an oversized request that llama.cpp would silently truncate (`stop processing: n_tokens = 65535, truncated = 1` in the server log). If you hit that message, the fix is almost always the configured `context_length` above: make it match the server's actual `-c` / `--ctx-size`.
+
 To fix context detection, set it explicitly:
 
 ```yaml
diff --git a/website/docs/reference/model-catalog.md b/website/docs/reference/model-catalog.md
index 4769a720c8..b26a1399f0 100644
--- a/website/docs/reference/model-catalog.md
+++ b/website/docs/reference/model-catalog.md
@@ -59,6 +59,7 @@ Field notes:
 | When | What happens |
 |---|---|
 | `/model` or `hermes model` | Fetches if disk cache is stale, else uses cache |
+| Gateway running | Background refresh every `ttl_minutes` (default 20), so the picker never lags the published manifest by more than one window |
 | Disk cache fresh (< TTL) | No network hit |
 | Network failure with cache | Silent fallback to cache, one log line |
 | Network failure, no cache | Silent fallback to in-repo snapshot |
@@ -72,11 +73,11 @@ Cache location: `~/.hermes/cache/model_catalog.json`.
 model_catalog:
   enabled: true
   url: https://hermes-agent.nousresearch.com/docs/api/model-catalog.json
-  ttl_hours: 1
+  ttl_minutes: 20
   providers: {}
 ```
 
-Set `enabled: false` to disable remote fetch entirely and always use the in-repo snapshot.
+Set `enabled: false` to disable remote fetch entirely and always use the in-repo snapshot (this also disables the gateway's background refresh). `ttl_minutes` sets both the cache lifetime and the gateway refresh cadence; the legacy `ttl_hours` key is still honoured if you set it explicitly.
 
 ### Per-provider override URLs
 
diff --git a/website/docs/reference/slash-commands.md b/website/docs/reference/slash-commands.md
index 5405230994..0bcdcb52cb 100644
--- a/website/docs/reference/slash-commands.md
+++ b/website/docs/reference/slash-commands.md
@@ -76,12 +76,12 @@ Type `/` in the CLI to open the autocomplete menu. Built-in commands are case-in
 | Command | Description |
 |---------|-------------|
 | `/config` | Show current configuration |
-| `/model [model-name]` | Show or change the current model. Supports: `/model claude-sonnet-4`, `/model provider:model` (switch providers), `/model custom:model` (custom endpoint), `/model custom:name:model` (named custom provider), `/model custom` (auto-detect from endpoint), and user-defined aliases (`/model fav`, `/model grok` — see [Custom model aliases](#custom-model-aliases)). Flags: `--global` persists the change to config.yaml; `--session` forces session-only; `--once` applies to the next turn only; `--refresh` re-fetches the provider's model list; `--provider <name>` switches backend (session-only unless `--global`). A plain `/model <name>` is session-only unless `model.persist_switch_by_default: true` is set. **Interactive picker:** running `/model` with no arguments opens the provider→model picker; on the model list you can **type to fuzzy-filter** the models (e.g. type `grok` to narrow to matching models), Backspace to trim the filter, Esc to clear it (or close the picker). Selection always resolves to one concrete model — the filter only narrows the list, it never guesses. **Note:** `/model` can only switch between already-configured providers. To add a new provider, exit the session and run `hermes model` from your terminal. **Cost note:** switching models mid-conversation resets the prompt cache — the cache key includes the model, so your next turn re-reads the entire conversation at full input price instead of the ~75%-discounted cached rate. Expected and unavoidable, but worth knowing on long sessions. |
+| `/model [model-name]` | Show or change the current model. Supports: `/model claude-sonnet-4`, `/model provider:model` (switch providers), `/model custom:model` (custom endpoint), `/model custom:name:model` (named custom provider), `/model custom` (auto-detect from endpoint), and user-defined aliases (`/model fav`, `/model grok` — see [Custom model aliases](#custom-model-aliases)). Flags: `--global` persists the change to config.yaml; `--session` forces session-only; `--once` applies to the next turn only; `--refresh` re-fetches the provider's model list; `--provider <name>` switches backend (session-only unless `--global`). A plain `/model <name>` is session-only unless `model.persist_switch_by_default: true` is set — except when no `model.default`/`model.provider` is configured yet, in which case the first pick persists so the profile gets a real default. The same rule governs the desktop composer picker. **Interactive picker:** running `/model` with no arguments opens the provider→model picker; on the model list you can **type to fuzzy-filter** the models (e.g. type `grok` to narrow to matching models), Backspace to trim the filter, Esc to clear it (or close the picker). Selection always resolves to one concrete model — the filter only narrows the list, it never guesses. **Note:** `/model` can only switch between already-configured providers. To add a new provider, exit the session and run `hermes model` from your terminal. **Cost note:** switching models mid-conversation resets the prompt cache — the cache key includes the model, so your next turn re-reads the entire conversation at full input price instead of the ~75%-discounted cached rate. Expected and unavoidable, but worth knowing on long sessions. |
 | `/codex-runtime [auto\|codex_app_server\|on\|off]` | Toggle the optional [Codex app-server runtime](../user-guide/features/codex-app-server-runtime) for OpenAI/Codex models. `auto` (default) uses Hermes' standard chat completions; `codex_app_server` hands turns to a `codex app-server` subprocess for native shell, apply_patch, ChatGPT subscription auth, and migrated Codex plugins. Effective on next session. |
 | `/personality` | Set a predefined personality. `/personality none` (or `default` / `neutral`) clears the overlay and returns to base behavior. |
 | `/verbose` | Cycle tool progress display: off → new → all → verbose. Can be [enabled for messaging](#notes) via config. |
 | `/focus [on\|off\|status]` | Toggle **focus view** — a display-only reduced-output mode showing just your prompt and the final response. Composes with `/verbose`: turning it on snaps tool progress to `off` and remembers your previous mode, and `/focus off` restores it. Each turn ends with a dim recovery line (`⋯ 7 tool lines hidden · /focus off to show`) and a persistent `◉ focus` badge sits in the status bar so you always know you're in the reduced view. Nothing is sent differently to the model — detail is hidden, never discarded. |
-| `/fast [normal\|fast\|status]` | Toggle fast mode — OpenAI Priority Processing / Anthropic Fast Mode. Options: `normal`, `fast`, `status`. |
+| `/fast [normal\|fast\|auto\|cold\|status]` | Fast mode — OpenAI Priority Processing / Anthropic Fast Mode. `fast` = every request; `auto` = only requests in the first `agent.fast_auto_seconds` (default 60s) of each turn; `cold` = that same window on the first turn of a session only. Default `normal` (off). See [Fast mode](../user-guide/configuration.md#fast-mode). |
 | `/reasoning [level\|show\|hide\|full\|clamp] [--global]` | Manage reasoning effort and display. Levels include `none` / `minimal` / `low` / `medium` / `high` / `xhigh` / `max` / `ultra`. `show` / `hide` (or `on` / `off`) toggle reasoning display; `full` and `clamp` adjust how reasoning is shown. `--global` persists effort to config. |
 | `/skin` | Show or change the display skin/theme |
 | `/export [profile] [-o out.tar.gz]` | **CLI only.** Pack a profile into a shareable `.tar.gz` — skills, memory, persona, crons, plugins, settings, and (from the desktop) themes and layout. Credentials (`auth.json`, `.env`) are stripped. Defaults to the active profile and `<name>.tar.gz` in the current directory. Same archive as `hermes profile export`; for a versioned, updatable share use a [profile distribution](../user-guide/profile-distributions.md) instead. |
@@ -115,7 +115,7 @@ Type `/` in the CLI to open the autocomplete menu. Built-in commands are case-in
 | `/blueprint [name] [slot=value ...]` (alias: `/bp`) | Set up an automation from a blueprint template. Bare `/blueprint` lists the catalog; `/blueprint <name>` starts a guided slot-filling flow on the next agent turn; `/blueprint <name> slot=value ...` creates the job directly. |
 | `/curator` | Background skill maintenance — `status`, `run`, `pin`, `archive`. See [Curator](/user-guide/features/curator). |
 | `/kanban <action>` | Drive the multi-profile, multi-project collaboration board without leaving chat. Full `hermes kanban` surface is available: `/kanban list`, `/kanban show t_abc`, `/kanban create "title" --assignee X`, `/kanban comment t_abc "text"`, `/kanban unblock t_abc`, `/kanban dispatch`, etc. Multi-board support included: `/kanban boards list`, `/kanban boards create <slug>`, `/kanban boards switch <slug>`, `/kanban --board <slug> <action>`. See [Kanban slash command](/user-guide/features/kanban#kanban-slash-command). |
-| `/reload-mcp` (alias: `/reload_mcp`) | Reload MCP servers from config.yaml |
+| `/reload-mcp` (alias: `/reload_mcp`) | Reload MCP servers from config.yaml and re-probe tool availability (credentials/daemons that appeared mid-session) |
 | `/reload-skills` (alias: `/reload_skills`) | Re-scan `~/.hermes/skills/` for newly installed or removed skills |
 | `/reload` | Reload `.env` variables into the running session (picks up new API keys without restarting) |
 | `/plugins` | List installed plugins and their status |
@@ -179,7 +179,7 @@ String-only prompt shortcuts are not supported as quick commands. Put longer reu
 
 ### Custom model aliases
 
-Define your own short names for models you use often, then reach them with `/model <alias>` in the CLI or any messaging platform. Aliases work identically in both, on session-only (default) and `--global` switches.
+Define your own short names for models you use often, then reach them with `/model <alias>` in a running session, `hermes chat --model <alias>` at startup, or any messaging platform. Aliases work identically in these paths, on session-only (default) and `--global` switches.
 
 Two config formats are supported:
 
@@ -246,7 +246,7 @@ The messaging gateway supports the following built-in commands inside Telegram,
 | `/model [provider:model]` | Show or change the model. Supports provider switches (`/model zai:glm-5`), custom endpoints (`/model custom:model`), named custom providers (`/model custom:local:qwen`), auto-detect (`/model custom`), and user-defined aliases (`/model fav`, `/model grok` — see [Custom model aliases](#custom-model-aliases)). Use `--global` to persist the change to config.yaml. **Note:** `/model` can only switch between already-configured providers. To add a new provider or set up API keys, use `hermes model` from your terminal (outside the chat session). **Cost note:** a mid-session model switch resets the prompt cache (the cache key includes the model), so the next message re-reads the whole conversation at full input price. |
 | `/codex-runtime [auto\|codex_app_server\|on\|off]` | Toggle the optional [Codex app-server runtime](../user-guide/features/codex-app-server-runtime). Persists to `model.openai_runtime` in config.yaml and evicts the cached agent so the next message picks up the new runtime. Effective on next session. |
 | `/personality [name]` | Set a personality overlay for the session. `/personality none` (or `default` / `neutral`) clears it. |
-| `/fast [normal\|fast\|status]` | Toggle fast mode — OpenAI Priority Processing / Anthropic Fast Mode. |
+| `/fast [normal\|fast\|auto\|cold\|status]` | Fast mode — OpenAI Priority Processing / Anthropic Fast Mode. `auto`/`cold` open a bounded fast window per turn / per session. |
 | `/retry` | Retry the last message. |
 | `/undo` | Remove the last exchange. |
 | `/sethome` (alias: `/set-home`) | Mark the current chat as the platform home channel for deliveries. |
@@ -291,7 +291,7 @@ The messaging gateway supports the following built-in commands inside Telegram,
 | `/skills [pending\|approve\|reject\|diff\|approval]` | Review pending **skill** writes staged by the write-approval gate (`skills.write_approval`). Shows a one-line gist per staged write; `/skills diff <id>` is truncated for chat — read the full diff on the CLI or in `~/.hermes/pending/skills/<id>.json`. Only appears when the gate is on (or staged writes remain); search/install stay CLI-only. |
 | `/kanban <action>` | Drive the multi-profile, multi-project collaboration board from chat — identical argument surface to the CLI. Bypasses the running-agent guard, so `/kanban unblock t_abc`, `/kanban comment t_abc "…"`, `/kanban list --mine`, `/kanban boards switch <slug>`, etc. work mid-turn. `/kanban create …` auto-subscribes the originating chat to the new task's terminal events. See [Kanban slash command](/user-guide/features/kanban#kanban-slash-command). |
 | `/platform <list\|pause\|resume> [name]` | Operate a running gateway platform right from chat. `/platform list` shows every adapter and its state (running, paused-by-breaker, manually-paused); `/platform pause <name>` stops dispatching new messages to that adapter without unloading it; `/platform resume <name>` re-enables it and clears a tripped circuit breaker once the upstream is healthy. |
-| `/reload-mcp` (alias: `/reload_mcp`) | Reload MCP servers from config. |
+| `/reload-mcp` (alias: `/reload_mcp`) | Reload MCP servers from config and re-probe tool availability. |
 | `/verbose` | Cycle tool progress display. **Off by default on messaging** — enable with `display.tool_progress_command: true` in `config.yaml`. |
 | `/yolo` | Toggle YOLO mode — skip all dangerous command approval prompts. |
 | `/commands [page]` | Browse all commands and skills (paginated). |
diff --git a/website/docs/reference/tools-reference.md b/website/docs/reference/tools-reference.md
index 3a3c725c68..1775066553 100644
--- a/website/docs/reference/tools-reference.md
+++ b/website/docs/reference/tools-reference.md
@@ -320,8 +320,8 @@ The single `video_generate` tool covers both modalities — pass `image_url` to
 
 | Tool | Description | Requires environment |
 |------|-------------|----------------------|
-| `web_search` | Search the web for information. Returns up to 5 results by default with titles, URLs, and descriptions. Accepts an optional `limit` (1-100, default 5). The query is passed through to the configured backend, so operators such as `site:domain`, `filetype:pdf`, `intitle:word`, `-term`, and `"exact phrase"` may work when the backend supports them. | EXA_API_KEY or PARALLEL_API_KEY or FIRECRAWL_API_KEY or KEENABLE_API_KEY |
-| `web_extract` | Extract content from web page URLs. Returns clean page content in markdown/text (no LLM summarization — fast). Also works with PDF URLs (arxiv papers, documents) — pass the PDF link directly. Pages within the char budget (default 15000) return whole; larger pages return a head+tail window with a footer pointing at the full text saved on disk. Max 5 URLs per call. | EXA_API_KEY or PARALLEL_API_KEY or FIRECRAWL_API_KEY or KEENABLE_API_KEY |
+| `web_search` | Search the web for information. Returns up to 5 results by default with titles, URLs, and descriptions. Accepts an optional `limit` (1-100, default 5). The query is passed through to the configured backend, so operators such as `site:domain`, `filetype:pdf`, `intitle:word`, `-term`, and `"exact phrase"` may work when the backend supports them. | EXA_API_KEY or PARALLEL_API_KEY or FIRECRAWL_API_KEY or TAVILY_API_KEY or KEENABLE_API_KEY |
+| `web_extract` | Extract content from web page URLs. Returns clean page content in markdown/text (no LLM summarization — fast). Also works with PDF URLs (arxiv papers, documents) — pass the PDF link directly. Pages within the char budget (default 15000) return whole; larger pages return a head+tail window with a footer pointing at the full text saved on disk. Max 5 URLs per call. | EXA_API_KEY or PARALLEL_API_KEY or FIRECRAWL_API_KEY or TAVILY_API_KEY or KEENABLE_API_KEY |
 
 ## `x_search` toolset
 
diff --git a/website/docs/user-guide/bot-mode.md b/website/docs/user-guide/bot-mode.md
index 0e50502a3f..b529b7daa0 100644
--- a/website/docs/user-guide/bot-mode.md
+++ b/website/docs/user-guide/bot-mode.md
@@ -17,7 +17,7 @@ There is no new primitive to learn: a Bot **is** a Hermes profile — isolated c
 
 The roster shows one row per agent profile: avatar, latest-message preview, and timestamp.
 
-- **Click a Bot** to land in its chat — every Bot has a canonical, persistent **Bot Chat** conversation that is created (and pinned) the moment the Bot is born.
+- **Click a Bot** to land in its chat — every Bot has a canonical, persistent **Bot Chat** conversation that is created (and pinned) the moment the Bot is born. A row click always opens that Bot Chat (the same conversation the row previews), even when you have other tabs open for the Bot; those tabs stay open beside it. In the tab strip the Bot Chat is captioned with the Bot's name, so two open Bots are told apart at a glance.
 - **Active now** — a presence strip above the roster shows every Bot currently working: the gateway-busy profile plus any Bot that wrote within the last 90 seconds. Each chip opens that Bot's chat. The strip never reorders the roster and disappears when the fleet is idle.
 - **Search** filters the roster as you type.
 - **Hide a Bot** — right-click a row → **Hide Bot** to take a Bot you don't use out of the roster and the Active-now strip. Hiding is display-only: @mentions still resolve, group-chat memberships are untouched, and routines keep running. Once at least one Bot is hidden, an **eye toggle** appears in the pane header — click it to reveal hidden Bots dimmed in place, then right-click → **Unhide Bot** to bring one back. Hidden Bots never toast, but they accumulate unread activity silently and the eye badges a dot so you know something happened. Hidden state is saved in the Bot's profile metadata, so it follows the Bot to every desktop connected to that backend.
@@ -26,6 +26,17 @@ The roster shows one row per agent profile: avatar, latest-message preview, and
 Typing `/new` (or `/reset`) inside a Bot's canonical chat would fork the relationship into a scratch session — the one thing Bot Mode promises never happens. The composer reroutes it to `/compact` instead: fresh working context, same conversation. Regular sessions on the same profile keep full `/new` freedom.
 :::
 
+### Organize bots into sections
+
+Sections are folders you make yourself — **Clients**, **Team**, whatever fits — as a second axis beside the automatic per-gateway grouping. With no sections created the roster is the plain list it always was.
+
+- **Create one** from the pane's **+** menu → **New section**, or right-click a Bot → **Move to section** → **New section…** (that files the Bot into it as you create it).
+- **File a Bot** by dragging its row onto a section — the target highlights while you hover, and **Esc** cancels the drag — or right-click → **Move to section** and pick one. **Remove from section** puts it back in **Unassigned**.
+- **Rename, reorder, or delete** a section from its heading's right-click menu (or the **⋯** that appears on hover); double-click a heading to rename. Headings fold like the gateway headings do.
+- **Deleting a section never deletes Bots** — they return to **Unassigned**, and the toast offers **Undo**. No confirmation is asked.
+
+Membership is stored in each Bot's profile metadata (`ui_meta`), so a Bot's section follows it to every desktop connected to that backend. When the roster shows more than one gateway, sections nest inside each gateway's bucket.
+
 ## Creating a Bot
 
 Hit **New Agent** in the roster. The quick path is three fields — **Name**, **Title**, **Description** — and the Bot exists in seconds, introducing itself as the first message of its new Bot Chat.
diff --git a/website/docs/user-guide/configuration.md b/website/docs/user-guide/configuration.md
index 7e087add37..154f21f03b 100644
--- a/website/docs/user-guide/configuration.md
+++ b/website/docs/user-guide/configuration.md
@@ -136,6 +136,8 @@ delegation:
 
 Multiple references in a single value work: `url: "${HOST}:${PORT}"`. If a referenced variable is not set, the placeholder is kept verbatim (`${UNDEFINED_VAR}` stays as-is) and a warning is logged. Bare `$VAR` is not expanded.
 
+Under a [multiplexed multi-profile gateway](/user-guide/multi-profile-gateways), references in a profile's `config.yaml` resolve against **that profile's** `.env` (its secret scope), not the shared process environment — a `${MATRIX_ACCESS_TOKEN}` in profile B stays unresolved unless B defines the variable itself. Single-profile runs are unchanged.
+
 Cursor-style SecretRef syntax is also accepted: `${env:VAR_NAME}` resolves exactly like `${VAR_NAME}` (the `env:` prefix is stripped), so MCP or provider snippets copied from Cursor / Claude configs work unchanged in both `config.yaml` and the `mcp_servers` block. Other SecretRef sources (`${file:...}`, `${vault:...}`, `${bitwarden:...}`) are **not** resolved inline — external secret backends inject their values into the environment at startup via the `secrets:` block, so reference them as `${env:NAME}` instead; unknown prefixes warn once and stay verbatim.
 
 For AI provider setup (OpenRouter, Anthropic, Copilot, custom endpoints, self-hosted LLMs, fallback models, etc.), see [AI Providers](/integrations/providers).
@@ -909,7 +911,7 @@ Older configs with `compression.summary_model`, `compression.summary_provider`,
 
 `hygiene_total_ceiling_seconds` (default `600`) bounds the total wait even while tokens are still moving, so a degenerate trickle stream can't hold a turn hostage indefinitely. It is clamped to at least `hygiene_timeout_seconds`.
 
-`hygiene_max_turn_hold_seconds` (default `10`) is the gateway's **turn-hold budget** — the maximum wall-clock the incoming message is held waiting on hygiene compression before the gateway stops waiting and proceeds on the uncompressed transcript. It exists because `hygiene_total_ceiling_seconds` alone can leave the wire silent for far longer than a chat transport's idle-timeout: a summary model that keeps streaming tokens keeps resetting the inactivity slice, so without a turn-hold budget the wait can stretch toward the ceiling while zero bytes reach the user — Telegram (and similar transports) then drop the connection and the turn appears frozen. Capping the turn's wait at this budget (well under the typical ~30s transport idle-timeout) guarantees the message is answered promptly; the compression worker keeps running detached and its commit is fenced (`CompressionCommitFence`), so when it eventually finishes it cannot overwrite the turns appended after the wait was abandoned. Raise it if your summary model routinely needs longer and your transport tolerates it; lower it for snappier recovery on very slow backends.
+`hygiene_max_turn_hold_seconds` (default `10`) is the gateway's **turn-hold budget** — the maximum wall-clock the incoming message is held waiting on hygiene compression before the gateway stops waiting and proceeds on the uncompressed transcript. It exists because `hygiene_total_ceiling_seconds` alone can leave the wire silent for far longer than a chat transport's idle-timeout: a summary model that keeps streaming tokens keeps resetting the inactivity slice, so without a turn-hold budget the wait can stretch toward the ceiling while zero bytes reach the user — Telegram (and similar transports) then drop the connection and the turn appears frozen. Capping the turn's wait at this budget (well under the typical ~30s transport idle-timeout) guarantees the message is answered promptly. **The compression is not lost when the budget expires**: the worker keeps running detached and — when its commit is watermark-fenced (the normal case with a session DB) — it keeps its commit admission, so the finished summary is adopted at the next safe boundary and turns appended after the wait was abandoned survive verbatim as concurrent tail. This matters especially for **thinking/reasoning summary models** (DeepSeek, QwQ, etc.) whose reasoning phase alone can exceed the budget: their summaries land one turn late instead of never. If the commit cannot be safely fenced, the late result is discarded (`CompressionCommitFence`) and it cannot overwrite newer turns. Raise the budget if you'd rather have compression apply within the same turn and your transport tolerates the wait; lower it for snappier recovery on very slow backends.
 
 `hygiene_failure_cooldown_seconds` controls that per-session cooldown after a hygiene compression timeout or abort. During the cooldown, the gateway skips repeated hygiene attempts for the same oversized session so every incoming message does not block on the same broken auxiliary backend. `/compress`, `/reset`, or a healthy later turn can still recover the session.
 
@@ -917,7 +919,7 @@ The value is the **first rung** of an escalating ladder, not a fixed interval: c
 
 `context_timeout_seconds` (default `120`) is the same **inactivity budget** for in-agent `compress_context` — the conversation loop, preflight compaction, and manual `/compress` — so a hung summary model cannot stall a session indefinitely. Streamed summary tokens extend the wait; only a silent worker is cut off. On timeout Hermes retries the summary once against the first entry of `auxiliary.compression.fallback_chain` (using that entry's own `timeout` when it declares one) — a stalled route never raises, so the auxiliary client's own fallback handling cannot see it. Only if that attempt also fails, or no fallback chain is configured, does Hermes skip compaction, keep the existing messages, and warn the user. Set to `0` to disable. Gateway session hygiene keeps its own `hygiene_timeout_seconds` path and is not double-wrapped.
 
-`context_total_ceiling_seconds` (default `600`) bounds the in-agent **pre-commit** wait (summary / stream phase) even while tokens are still moving. It is clamped to at least `context_timeout_seconds`. The exact guarantee: **the summary phase is bounded by this ceiling; the commit phase is logged and surfaced if it exceeds it.** Once the worker has entered the compression commit fence and SessionDB mutation is in flight, the commit is never abandoned mid-flight — that would risk transcript divergence — but the wait is no longer silent: if the commit runs past the ceiling, Hermes logs the overrun (WARNING, escalating to ERROR on repeat), sends a one-shot warning through the user-visible warning channel, and keeps waiting in bounded increments until the commit completes.
+`context_total_ceiling_seconds` (default `600`) bounds the in-agent **pre-commit** wait (summary / stream phase) even while tokens are still moving. It is clamped to at least `context_timeout_seconds`. The exact guarantee: **the summary phase is bounded by this ceiling; the commit phase is logged and surfaced if it exceeds it.** Once the worker has entered the compression commit fence and SessionDB mutation is in flight, the commit is never abandoned mid-flight — that would risk transcript divergence — but the wait is no longer silent: if the commit runs past the ceiling, Hermes logs the overrun (WARNING, escalating to ERROR on repeat), sends a one-shot warning through the user-visible warning channel, and keeps waiting in bounded increments until the commit completes. When the ceiling expires during the summary phase, the summary model's stream is closed at that same instant on every auxiliary wire (chat.completions, Codex Responses, Anthropic Messages) — an abandoned summary is not billed to completion on a connection nobody is waiting for, and its session lease is freed for the next attempt.
 
 `protect_first_n` controls how many **non-system** head messages are pinned across every compaction. Default `3` — the opening user/assistant exchange survives every summarizer pass so the original goal stays visible. On long-running rolling-compaction sessions where the opening turn is no longer relevant, set `protect_first_n: 0` to pin nothing but the system prompt + summary + tail. The system prompt itself is always preserved regardless of this setting.
 
@@ -1152,7 +1154,18 @@ The **stale stream detection** kills connections that receive SSE keep-alive pin
 
 The **stale non-stream detection** kills non-streaming calls that produce no response for too long. By default Hermes disables this on local endpoints to avoid false positives during long prefills. If you explicitly set `providers.<id>.stale_timeout_seconds`, `providers.<id>.models.<model>.stale_timeout_seconds`, or `HERMES_API_CALL_STALE_TIMEOUT`, that explicit value is honored even on local endpoints.
 
-This budget bounds every non-streaming call, including the ones cron jobs and delegated subagents run inline. A provider that accepts a request and then goes silent — connection held open, no bytes, no error — is aborted at the stale timeout and retried, rather than hanging until the much longer socket read timeout (or, for an unattended cron run, until something external kills the process).
+This budget bounds every non-streaming call. A provider that accepts a request and then goes silent — connection held open, no bytes, no error — is aborted at the stale timeout and retried, rather than hanging until the much longer socket read timeout (or, for an unattended cron run, until something external kills the process).
+
+Cron jobs and delegated subagents stream too. They run the request inline on their own thread (the interrupt worker other sessions use wedges inside the gateway's nested thread pools), but the wire request is still `stream: true`, so the **stale stream detection** budget above governs them — every token counts as liveness, so a reasoning model that thinks for minutes is not mistaken for a hung provider, and edge proxies that kill silent connections keep seeing bytes.
+
+### Disabling API streaming
+
+`model.streaming: false` forces non-streaming requests for the whole session — parent and subagents alike. It is an escape hatch for self-hosted OpenAI-compatible servers whose *streaming* tool-call path is broken (for example vLLM with `--tool-call-parser qwen3_xml` plus a reasoning parser can leak tool-call markup into plain text and return zero `tool_calls`, so delegated tasks silently no-op). Default is `true`; leave it unless you hit that class of bug, since non-streaming calls lose the liveness properties described above. This is separate from `display.streaming`, which only controls token rendering in the terminal.
+
+```yaml
+model:
+  streaming: false
+```
 
 ## Context Pressure Warnings
 
@@ -1690,6 +1703,27 @@ There is no `hermes config set` support for `reasoning_overrides` keys — edit
 
 The override applies automatically everywhere: CLI startup, messaging gateway, Desktop/TUI, cron jobs, `/model` mid-session switches, and fallback model activation.
 
+## Fast Mode
+
+Fast mode asks the provider for faster output at a premium price: OpenAI [Priority Processing](https://openai.com/api-priority-processing/) (`service_tier: priority`), xAI Priority Processing on Grok 4.6, and Anthropic [Fast Mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode) (`speed: fast`, Opus 4.8 / Opus 5 only). It is **off by default**.
+
+```yaml
+agent:
+  service_tier: ""          # "" / normal | fast | auto | cold
+  fast_auto_seconds: 60     # window for auto / cold
+```
+
+| Mode | When fast params are sent | Use it for |
+|------|---------------------------|------------|
+| `normal` (default, `""`) | Never | Cheapest; standard latency |
+| `fast` | Every request | Long interactive sessions where you always want speed |
+| `auto` | Requests in the first `fast_auto_seconds` of **every** turn | Snappy first reply; long tool loops fall back to standard pricing |
+| `cold` | Same window, but only on the **first turn** of a session (no prior history) | Fast onboarding reply, standard pricing afterwards |
+
+`/fast normal|fast|auto|cold` switches the mode for the session; add `--global` to persist to `config.yaml`. `/fast` alone shows the current mode.
+
+**Cost note:** both providers bill fast requests at a multiplier on standard rates (Anthropic: $10 / $50 per MTok in/out on Opus 4.8 and Opus 5), stacking with prompt-cache pricing. `auto`/`cold` bound that premium to the window only. Fast params are only sent to the first-party endpoint that supports them (`api.openai.com` / Codex subscription, `api.anthropic.com`, `api.x.ai`); OpenRouter, Nous Portal, Copilot, Azure, Bedrock, and custom `base_url` routes never receive them in any mode. Only the per-request parameter changes between requests — the system prompt, tools, and messages stay byte-identical, so the prompt cache survives the window boundary.
+
 ## Tool-Use Enforcement
 
 Some models occasionally describe intended actions as text instead of making tool calls ("I would run the tests..." instead of actually calling the terminal). Tool-use enforcement injects system prompt guidance that steers the model back to actually calling tools.
@@ -1754,14 +1788,15 @@ The gate is independent of `tool_use_enforcement` — either can be on without t
 
 ## Tool-Loop Guardrails
 
-Hermes detects when the agent is stuck in an unproductive tool-calling loop — the same tool call failing repeatedly, the same tool failing over and over, or an idempotent call returning the same result with no progress. By default it injects a **warning** into the tool result so the model self-corrects; it does not hard-stop, since a person watching the CLI/TUI can intervene.
+Hermes detects when the agent is stuck in an unproductive tool-calling loop — the same tool call failing repeatedly, the same tool failing over and over, or an idempotent call returning the same result with no progress. By default it injects a **warning** into the tool result so the model self-corrects. Interactive CLI, TUI, Desktop, and ACP sessions remain warning-only because a person can intervene; unattended gateway and cron sessions enable hard stops by default.
 
-For unattended gateway / server deployments, enable hard stops so a stuck agent is circuit-broken instead of burning the iteration budget:
+The platform-aware default can be disabled for an unattended deployment, or hard stops can be explicitly enabled on every platform:
 
 ```yaml
 tool_loop_guardrails:
   warnings_enabled: true       # inject warnings into tool results (default: true)
   hard_stop_enabled: false     # also BLOCK the call past the hard-stop threshold (default: false)
+  non_interactive_hard_stop_enabled: true  # default hard stops for gateway/cron
   warn_after:
     exact_failure: 2           # identical failing call repeated N times
     same_tool_failure: 3       # same tool failing N times (different args)
@@ -1775,7 +1810,13 @@ tool_loop_guardrails:
     max_subagents: 50          # max subagents spawned per turn (0 = unlimited)
 ```
 
-`hard_stop_enabled` defaults to `false` because interactive sessions have a human in the loop. In unattended deployments (gateway, cron, kanban workers) set it to `true` so repeated failures are blocked rather than only warned. See also [Docker / unattended deployments](docker.md).
+`hard_stop_enabled` explicitly enables hard stops on every platform. When it remains `false`, `non_interactive_hard_stop_enabled` still enables them for unattended gateway/cron-style platforms while preserving warning-only behavior for CLI, TUI, Desktop, ACP, subagents, and `api_server` runs (supervised task loops with a live parent or client). Set `non_interactive_hard_stop_enabled: false` to opt an unattended deployment out. See also [Docker / unattended deployments](docker.md).
+
+Hard stops are designed to catch **replays** — the same call, unchanged, with nothing happening in between — not legitimate iteration:
+
+- **Edit → re-run is never a loop.** Any successful mutating call (`write_file`, `patch`, a green `terminal`/`execute_code`, a browser action, a job/message/cron mutation) marks progress for every failing call still being counted. The next identical retry (re-running a red test after a fix, re-snapshotting after a click) starts a fresh streak instead of accumulating toward a block.
+- **Distinct red commands are diagnosis, not a loop.** For tools whose non-zero exit is ordinary output (`terminal`, `execute_code`, process pollers, `browser_navigate`, `web_extract`) the `same_tool_failure` threshold only warns and never halts. Only an exact-args replay with no intervening change, or an identical-result streak, can stop them.
+- **A halt ends the turn, not the session.** The agent replies with which guardrail fired and why; replying "continue" resumes with fresh per-turn counters.
 
 ### Per-turn runaway-loop caps
 
@@ -1787,7 +1828,7 @@ This mirrors Claude Code's per-session WebSearch and subagent caps (v2.1.212), w
 
 ### Runtime anti-stall guards
 
-Complementing the failure-based guardrails above, `agent.stall_guards` (default `true`) enables two conservative runtime guards against wasted turns. First, an **identical-call loop breaker**: when the same tool is called 3+ consecutive times with identical arguments *and* returns an identical result, a short one-line notice is appended to that tool result telling the model not to repeat the call — it never blocks the call, and legitimately-repeatable pollers (`process`, `*_get_result`, `*_poll`) are exempt. Second, a **continue-intent recovery**: when the model ends a turn with no tool calls but its short reply trails off announcing an action ("Let me now update the file…"), Hermes re-prompts it to act via the same bounded continuation mechanism used for intent-ack recovery (max 2 re-prompts per turn). Both are cache-safe (notices are added at result construction, never retroactively) and can be disabled together:
+Complementing the failure-based guardrails above, `agent.stall_guards` (default `true`) enables two conservative runtime guards against wasted turns. First, an **identical-call loop breaker**: when the same tool is called 3+ consecutive times with identical arguments *and* returns an identical result, a short one-line notice is appended to that tool result telling the model not to repeat the call — in warning-only sessions it never blocks the call, and legitimately-repeatable pollers (`process`, `*_get_result`, `*_poll`) are exempt. When hard stops are active (explicit `hard_stop_enabled`, or an unattended gateway/cron platform), the same streak also becomes a hard stop once it reaches `hard_stop_after.idempotent_no_progress` consecutive identical calls — for **any** tool, not just the read-only ones the `idempotent_no_progress` guardrail tracks — so a model replaying the same successful `terminal` or `skill_view` call is halted instead of running out the iteration budget (`identical_call_streak_halt`). Second, a **continue-intent recovery**: when the model ends a turn with no tool calls but its short reply trails off announcing an action ("Let me now update the file…"), Hermes re-prompts it to act via the same bounded continuation mechanism used for intent-ack recovery (max 2 re-prompts per turn). Both are cache-safe (notices are added at result construction, never retroactively) and can be disabled together:
 
 ```yaml
 agent:
@@ -1870,6 +1911,11 @@ display:
   cli_multiline_shortcuts: true  # CLI: Ctrl+J, \ + Enter, and supported Shift+Enter insert newlines (false = legacy c-j submit fallback)
   resume_display: full    # full (show previous messages on resume) | minimal (one-liner only)
   bell_on_complete: false # Play terminal bell when agent finishes (great for long tasks)
+  bell_on_prompt: false   # Play terminal bell when a blocking prompt opens (clarify, approval, sudo password, secret capture) — works over SSH
+  # Both bell flags also emit an OSC 9 desktop notification (Ghostty, iTerm2, Kitty, WezTerm raise an OS
+  # notification; other terminals ignore it) and, inside Warp (TERM_PROGRAM=WarpTerminal with the CLI-agent
+  # protocol advertised), a warp://cli-agent OSC 777 event (`stop` on completion, `permission_request` on
+  # blocking prompts) so Warp's tab status and notification mailbox track Hermes. No extra keys needed.
   show_reasoning: true    # Show model reasoning/thinking above each response (default: true; toggle with /reasoning show|hide)
   streaming: false        # Stream tokens to terminal as they arrive (real-time output)
   show_cost: false        # Show estimated $ cost in the CLI status bar
@@ -2053,6 +2099,8 @@ display:
       tool_progress: 'off'    # quiet in shared Slack workspace
 ```
 
+From the CLI, use the canonical path — `hermes config set display.platforms.telegram.streaming false`. The shorthand `hermes config set platforms.telegram.streaming false` is accepted too: because per-platform *display* settings (`streaming`, `show_reasoning`, `tool_progress`, …) are only ever read from `display.platforms`, `config set`/`get`/`unset` redirect that shorthand to the canonical key and print a note. Connection keys under the top-level `platforms.<name>` block (`token`, `enabled`, `reply_to_mode`, `extra`) are not redirected.
+
 Platforms without an override fall back to the global `tool_progress` value. Valid platform keys: `telegram`, `discord`, `slack`, `signal`, `whatsapp`, `matrix`, `mattermost`, `email`, `sms`, `homeassistant`, `dingtalk`, `feishu`, `wecom`, `weixin`, `bluebubbles`, `qqbot`. The legacy `display.tool_progress_overrides` key still loads for backward compatibility but is deprecated and migrated into `display.platforms` on first load.
 
 Signal is listed as a valid platform key because the setting can be saved per platform, but the current Signal adapter cannot edit sent messages and does not render tool-progress bubbles. Keep Signal `tool_progress` set to `off`; use the CLI or an editing-capable messaging platform if you need to watch each tool call live.
@@ -2353,7 +2401,7 @@ The `web_search` and `web_extract` tools support five backend providers. Configu
 
 ```yaml
 web:
-  backend: firecrawl    # firecrawl | searxng | parallel | keenable | exa
+  backend: firecrawl    # firecrawl | searxng | parallel | tavily | keenable | exa
 
   # Or use per-capability keys to mix providers (e.g. free search + paid extract):
   search_backend: "searxng"
@@ -2382,9 +2430,10 @@ web:
 | **Firecrawl** (default) | `FIRECRAWL_API_KEY` | ✔ | ✔ |
 | **SearXNG** | `SEARXNG_URL` | ✔ | — |
 | **Parallel** | `PARALLEL_API_KEY` (optional — keyless free tier) | ✔ | ✔ |
+| **Tavily** | `TAVILY_API_KEY` (optional — keyless when selected) | ✔ | ✔ |
 | **Exa** | `EXA_API_KEY` (optional — keyless free tier) | ✔ | ✔ |
 
-**Backend selection:** The runtime always uses the stored `web.backend` selection (set via `hermes tools`; `nous` routes through the managed Tool Gateway). Only if no web backend has ever been selected is one auto-detected from available API keys: if only `SEARXNG_URL` is set, SearXNG is used; if only `EXA_API_KEY` is set, Exa; if only `PARALLEL_API_KEY` is set, Parallel; if only `KEENABLE_API_KEY` is set, Keenable. With **no selection and no credentials at all**, requests rotate round-robin across the keyless free-tier ring (Exa / Parallel / Firecrawl / Keenable) with automatic next-in-line failover on rate limits — see the [Web Search guide](/user-guide/features/web-search) for details. Once a selection exists, adding a key to `.env` does not change the route. Selecting Firecrawl or Keenable in `hermes tools` also works without a key.
+**Backend selection:** The runtime always uses the stored `web.backend` selection (set via `hermes tools`; `nous` routes through the managed Tool Gateway). Only if no web backend has ever been selected is one auto-detected from available API keys: if only `SEARXNG_URL` is set, SearXNG is used; if only `EXA_API_KEY` is set, Exa; if only `TAVILY_API_KEY` is set, Tavily; if only `PARALLEL_API_KEY` is set, Parallel; if only `KEENABLE_API_KEY` is set, Keenable. With **no selection and no credentials at all**, requests rotate round-robin across the keyless free-tier ring (Exa / Parallel / Firecrawl / Keenable) with automatic next-in-line failover on rate limits — see the [Web Search guide](/user-guide/features/web-search) for details. Once a selection exists, adding a key to `.env` does not change the route. Selecting Tavily, Firecrawl, or Keenable in `hermes tools` also works without a key.
 
 **SearXNG** is a free, self-hosted, privacy-respecting metasearch engine that queries 70+ search engines. No API key needed — just set `SEARXNG_URL` to your instance (e.g., `http://localhost:8080`). SearXNG is search-only; `web_extract` requires a separate extract provider (set `web.extract_backend`). See the [Web Search setup guide](/user-guide/features/web-search) for Docker setup instructions.
 
@@ -2716,6 +2765,7 @@ dashboard:
   ws_ping_interval: 20.0      # Non-loopback WebSocket keepalive ping interval (seconds)
   ws_ping_timeout: 20.0       # Non-loopback WebSocket keepalive pong timeout (seconds)
   ws_orphan_reap_grace_s: 20.0 # Grace before a WS-detached session is reaped (seconds)
+  ws_orphan_activity_stale_s: 600.0 # Activity idle bound before a detached RUNNING turn is interrupted (seconds)
   startup_orphan_sweep: true  # Close session rows orphaned by a dead gateway process at boot
 ```
 
@@ -2726,4 +2776,5 @@ dashboard:
 - `oauth` / `basic_auth` / `drain_auth` — auth provider config read by the bundled dashboard-auth plugins. The drain secret itself is **not** set here; it's provisioned via the `HERMES_DASHBOARD_DRAIN_SECRET` env var. See [Web Dashboard](/user-guide/features/web-dashboard) for full auth setup.
 - `ws_ping_interval` / `ws_ping_timeout` — WebSocket keepalive tuning for non-loopback binds (loopback connections never ping). Raise these on high-latency links (Tailscale, distant SSH tunnels) where the 20 s defaults can manufacture spurious 1006 disconnects.
 - `ws_orphan_reap_grace_s` — how long a WS-detached session waits before the orphan reaper collects it. Raise alongside the keepalive values if clients reconnect slowly. (`HERMES_TUI_WS_ORPHAN_REAP_GRACE_S` remains as an internal override.)
+- `ws_orphan_activity_stale_s` (default `600`) — how long a detached **running** turn's activity clock (the same clock the `agent.turn_liveness` watchdog samples: API waits, stream tokens, tool heartbeats) must be idle before the orphan reaper interrupts it. A client-absent turn that is still actively producing keeps running to completion detached — closing the laptop, backgrounding the mobile app, or a desktop update no longer cancels healthy long turns; only a genuinely wedged turn is interrupted. Set `0` to interrupt at the grace window regardless of activity (old behavior).
 - `startup_orphan_sweep` (default `true`) — the WS-orphan reap timer above is in-process, so a gateway restart (update, crash, systemd) before it fires leaves the session row open forever — phantom "active" work in `/resume` and dashboards. On every gateway boot — both the stdio TUI (`entry.main`) and the desktop/dashboard WebSocket sidecar (`handle_ws`) — rows with source `tui` / `desktop` / `subagent` whose start time **and** newest message are both older than the session TTL (`HERMES_TUI_SESSION_TTL_S`, default 6 hours) are closed with `end_reason: startup_orphan_reap`. Messaging-platform sessions (Telegram, Discord, …) are never touched, live in-memory sessions (a client that already resumed) are excluded, and swept sessions remain resumable.
diff --git a/website/docs/user-guide/configuring-models.md b/website/docs/user-guide/configuring-models.md
index 4c5b750291..e67e85d5c3 100644
--- a/website/docs/user-guide/configuring-models.md
+++ b/website/docs/user-guide/configuring-models.md
@@ -9,7 +9,7 @@ Hermes uses two kinds of model slots:
 - **Main model** — what the agent thinks with. Every user message, every tool-call loop, every streamed response goes through this model.
 - **Auxiliary models** — smaller side-jobs the agent offloads. Context compression, vision (image analysis), web-page summarization, approval scoring, MCP tool routing, session-title generation, and skill search. Each has its own slot and can be overridden independently.
 
-This page covers configuring both from the dashboard. If you prefer config files or the CLI, jump to [Alternative methods](#alternative-methods) at the bottom.
+This page covers configuring both from the dashboard. If you prefer config files or the CLI, jump to [Alternative methods](#alternative-methods) at the bottom. To run models on your own machine instead of a cloud provider, see [Local Models](/user-guide/local-models).
 
 :::tip Fastest path: Nous Portal
 [Nous Portal](/user-guide/features/tool-gateway) provides 300+ models under one subscription. On a fresh install, run `hermes setup --portal` to log in and set Nous as your provider in one command. Inspect what's wired up with `hermes portal info`.
@@ -286,7 +286,7 @@ A one-turn switch breaks the provider's prompt-cache prefix twice (switching out
 
 ### Custom aliases
 
-Define your own short names for models you reach for often, then use `/model <alias>` in the CLI or any messaging platform. There are two equivalent formats — pick whichever fits your workflow.
+Define your own short names for models you reach for often, then use `/model <alias>` in a running session or `hermes chat --model <alias>` at startup. There are two equivalent formats — pick whichever fits your workflow.
 
 **Canonical (top-level `model_aliases:`)** — full control over provider + base_url:
 
diff --git a/website/docs/user-guide/desktop.md b/website/docs/user-guide/desktop.md
index 1cfeb02ac6..87a4e6f419 100644
--- a/website/docs/user-guide/desktop.md
+++ b/website/docs/user-guide/desktop.md
@@ -55,7 +55,8 @@ The bar along the bottom of the chat shows live session state and exposes quick
 
 - **Per-session YOLO toggle** — flip YOLO on or off for just this session (matching the TUI). YOLO bypasses the dangerous-command approval prompts, so know what you're turning off — see [Security → YOLO Mode](./security.md#yolo-mode).
 - **Context-usage meter** — a live "% full" meter of the session's context window. Click it to open the **Context Usage** popover with a token breakdown by category (system prompt, tool definitions, skills, memory, rules, MCP, subagent definitions, and the conversation itself) so you can see exactly what's eating the window before compression kicks in.
-- **Customizable items** — right-click the status bar (**Show in status bar**) to choose what appears: the context meter, workspace, model, approvals, turn/session timers, terminal, Command Center, backend version, and more — or hide the bar entirely (**Cmd/Ctrl+Shift+S** toggles it).
+- **Cache hit rate and tokens per second** — off by default; turn them on from the right-click menu. Cache hit rate is the share of this session's prompt tokens served from the provider's prompt cache (cached tokens cost less, so higher is cheaper — you can watch a session get cheaper as it warms up). Tokens per second is output throughput averaged over the last 10 model calls. Both update live during a turn.
+- **Customizable items** — right-click the status bar (**Show in status bar**) to choose what appears: the context meter, cache hit rate, tokens per second, workspace, model, approvals, turn/session timers, terminal, Command Center, backend version, and more — or hide the bar entirely (**Cmd/Ctrl+Shift+S** toggles it).
 
 Chatting against a Hermes instance on another machine instead of the bundled local backend? See [Connecting to a remote backend](#connecting-to-a-remote-backend) below — and for the full picture of how the remote-hosted dashboard connection works (the auth gate, the `/api/ws` chat socket, and WebSocket close-code triage), see [Web Dashboard → Connecting Hermes Desktop to a remote backend](./features/web-dashboard.md#connecting-hermes-desktop-to-a-remote-backend).
 
@@ -80,7 +81,7 @@ Changing any of these values invalidates only that profile's disk-discovery cach
 
 The model picker lives in the **composer**, just left of the microphone. Click it to switch the model, reasoning effort, and fast mode from one dropdown.
 
-- **The composer picker is sticky UI state and never touches your default.** It's remembered locally (per device) and **follows** across new chats and restarts instead of snapping back to the default — pick a model once and the next `Cmd/Ctrl+N` opens on it. With a live chat, switching models scopes the change to that **current chat**; either way the selection rides along when the session is created/switched and is **never** written to the profile default. (Switching [profiles](#sessions--profiles) reseeds to that profile's own default.)
+- **The composer picker is sticky UI state and never touches your default.** It's remembered locally (per device) and **follows** across new chats and restarts instead of snapping back to the default — pick a model once and the next `Cmd/Ctrl+N` opens on it. With a live chat, switching models scopes the change to that **current chat**; either way the selection rides along when the session is created/switched and is **never** written to the profile default — with one exception: on a fresh profile that has no `model.default`/`model.provider` configured yet, the first pick is persisted so the app has a real default instead of falling through to a stray API-key env var on restart. Persistence follows the same rule as `/model` (`model.persist_switch_by_default`); use **Settings → Model** to change the default deliberately. (Switching [profiles](#sessions--profiles) reseeds to that profile's own default.)
 - **Set the default in Settings → Model.** That "main" model is your **per-profile global default** — it's what new chats, crons, subagents, and auxiliary tasks start from, and it's the only place that writes it. Each [profile](#sessions--profiles) keeps its own default.
 - **Per-model effort/fast presets.** Each model remembers its own reasoning effort and fast-mode choice in the desktop app, re-applied to the session whenever you pick that model. These presets are a desktop convenience and don't change crons or subagents.
 - **Mid-chat switches reset the prompt cache.** Switching the model inside a live chat means the next message re-reads the whole conversation at full input price (provider prompt caches are keyed to the model). Fine occasionally; on a long chat, a fresh chat on the new model is often cheaper than bouncing back and forth.
@@ -157,11 +158,12 @@ That bridges to `ELECTRON_OZONE_PLATFORM_HINT` at launch (an explicit env var st
 
 Manage providers, models, tools, and credentials from a real UI instead of editing YAML. First-run onboarding gets you to your first message in seconds. The settings panes cover providers/keys, model selection, toolset configuration, MCP servers, the gateway, and session management.
 
-- **Providers settings pane** — a dedicated place to manage inference providers, with an Accounts / API-keys UX for signing in and storing credentials per provider.
+- **Providers settings pane** — a dedicated place to manage inference providers, with an Accounts / API-keys UX for signing in and storing credentials per provider. Its **Local Models** view installs and manages an on-device llama.cpp runtime — see [Local Models](/user-guide/local-models).
 - **Every provider and model in the menus** — the GUI surfaces the full provider list and every model that `hermes model` knows about, so you pick from the same catalog the CLI sees rather than a curated subset.
 - **xAI Grok OAuth** — Grok is a first-class OAuth provider in the launcher; sign in through the browser flow like the other OAuth providers.
 - **Tool-backend installs from the GUI** — run a tool backend's post-setup install steps directly from the app instead of dropping to a terminal.
 - **Terminal font picker** — choose an installed font in **Settings → Appearance**. Nerd Fonts such as `MesloLGS NF` render Powerlevel10k separators and icons in both interactive and agent terminals; the setting is saved per profile.
+- **Reopen Last Chat on Launch** — by default the app picks up where you left off on cold start. Turn it off in **Settings → Appearance** (or set `display.resume_last_session: false` in `config.yaml`) to always begin with a fresh chat. Deep links and explicit destinations are never overridden either way.
 - **Auxiliary-model warning** — if you switch the main model to a new provider while auxiliary tasks (titling, summarization, and similar helpers) are still pinned to another provider, the app warns you so you don't unknowingly split work across two providers.
 - **VS Code Marketplace themes** — beyond the built-in theme presets, the appearance settings include a live VS Code Marketplace search: pick any color theme and the app downloads, converts, and installs it as a desktop theme. The same importer is available from the command palette (*Install theme*), and imported themes can be removed again from the appearance settings.
 - **Keep computer awake** — **Settings → Advanced → Keep computer awake** stops the machine from sleeping so long or overnight agent runs keep going (the display can still dim). This is a per-computer setting.
diff --git a/website/docs/user-guide/docker.md b/website/docs/user-guide/docker.md
index da737a4b17..dbdb77cb21 100644
--- a/website/docs/user-guide/docker.md
+++ b/website/docs/user-guide/docker.md
@@ -71,14 +71,11 @@ See the [Where the logs go](#where-the-logs-go) section below for the full routi
 :::
 
 :::note Tool-loop hard stops for unattended gateways
-The `tool_loop_guardrails.hard_stop_enabled` setting defaults to `false`, which is reasonable for interactive CLI and TUI sessions where a person can see repeated tool-call warnings. In unattended gateway or server deployments, warnings alone may not stop an agent that gets stuck in a repeated tool-call loop. Operators who want circuit-breaker behavior should explicitly enable hard stops in the profile's `config.yaml`:
+Unattended gateway and cron sessions enable tool-loop hard stops by default through `non_interactive_hard_stop_enabled`. Interactive CLI, TUI, Desktop, and ACP sessions remain warning-only. To opt an unattended deployment out in the profile's `config.yaml`:
 
 ```yaml
 tool_loop_guardrails:
-  hard_stop_enabled: true
-  hard_stop_after:
-    exact_failure: 5
-    idempotent_no_progress: 5
+  non_interactive_hard_stop_enabled: false
 ```
 :::
 
diff --git a/website/docs/user-guide/features/api-server.md b/website/docs/user-guide/features/api-server.md
index 47c0373613..36b6e1c7c0 100644
--- a/website/docs/user-guide/features/api-server.md
+++ b/website/docs/user-guide/features/api-server.md
@@ -477,8 +477,9 @@ When the agent delegates work to background subagents, the stream also carries
 `subagent.start` and `subagent.complete` lifecycle events, so clients can
 observe delegation outcomes — including timeouts and failures — instead of the
 run going silent while a child works. The `subagent.complete` payload carries
-the child's status, summary, duration, token/cost figures, and a
-`child_session_id` for correlation; free-text fields pass forced secret
+the child's status, summary, duration, token/cost figures, a
+`child_session_id` for correlation, and the `delegation_id` of the batch it
+belongs to (so concurrent or nested fan-outs stay distinguishable); free-text fields pass forced secret
 redaction before leaving the process. Per-tool child events
 (`subagent.tool`, progress ticks) are intentionally **not** forwarded — they
 are high-volume UI noise; use the per-child live transcript files for
@@ -628,6 +629,10 @@ to the routed profile**:
 - Unprefixed routes and `/p/default/...` keep using the default profile's key.
 - A named profile with no `API_SERVER_KEY` of its own fails closed — its
   prefix is unreachable until you set one.
+- Runs are per-profile scoped: `/v1/runs/{run_id}` and its `events`, `stop`,
+  `steer`, and `approval` routes only answer for the profile that created
+  the run (including runs started via `/api/sessions/{id}/chat/stream`);
+  another profile's run id returns `404`, never `403`.
 
 :::warning Breaking change (July 2026)
 Before this fix, a valid default-profile key was accepted on any
diff --git a/website/docs/user-guide/features/cron.md b/website/docs/user-guide/features/cron.md
index 410237b6f5..e9a24600c1 100644
--- a/website/docs/user-guide/features/cron.md
+++ b/website/docs/user-guide/features/cron.md
@@ -440,6 +440,19 @@ When scheduling jobs, you specify where the output goes:
 
 The agent's final response is automatically delivered to the configured `deliver:` target — the agent does not send messages itself, so there is nothing to call in the cron prompt.
 
+### Delivery failures are a distinct status
+
+Execution and delivery are tracked separately. When the agent run succeeds but
+the output never reaches the target (platform 5xx, rate limit, stale session,
+adapter returned no positive evidence of a send), the job records
+`last_status: delivery_failed` — never a plain `ok` — with the reason in
+`last_delivery_error`. `hermes cron list` shows it in yellow as
+`delivery_failed: <reason>`, `hermes cron doctor` reports it as a delivery
+issue, and a manual `cronjob run` reports `success: false` with the delivery
+error. A delivery failure does not count toward the job's `failure_streak`
+(the agent did its job); the next fully successful run returns the status to
+`ok`.
+
 ### Bot Chat delivery (`bot-chat`)
 
 `bot-chat` delivers the output **into a profile's canonical "Bot Chat" session as a real message**. Unlike every other target — where the recipient is a human reading a channel — the recipient here is the bot itself: it receives the output as an incoming message, acts on anything that needs action, and responds in its chat. Use it when scheduled output should be *processed*, not just posted.
@@ -489,6 +502,43 @@ cron:
   wrap_response: false
 ```
 
+### Push notifications (`cron.delivery.notify`)
+
+Cron output is a *final* delivery, not a progress message, so by default it is
+sent with the platform's notification flag set — on Telegram this means the
+brief triggers a push even when the adapter's notification mode is `important`
+(which otherwise sends with `disable_notification=true`, and users report the
+silent brief as "never delivered"). To restore silent deliveries:
+
+```yaml
+# ~/.hermes/config.yaml
+cron:
+  delivery:
+    notify: false   # default: true
+```
+
+The flag rides both the text send and any media attachments, so a run never
+pushes for one and stays silent for the other.
+
+### Delivery confirmation and the `UNVERIFIED` state
+
+A live-adapter delivery is logged as delivered only on positive evidence from
+the adapter: an explicit `success` that is not a filtered drop
+(`delivered: false`), plus a `message_id` or `raw_response`. A result carrying
+`success` but neither piece of evidence — the shape Slack, Matrix and
+Mattermost adapters return — is still accepted (it is not proof of failure),
+but the run is recorded on the job as `last_delivery_unverified` and surfaces
+in `hermes cron list`:
+
+```
+⚠ Delivery UNVERIFIED: adapter acked slack:C0123456 without message_id/raw_response
+```
+
+and in `hermes cron doctor` as `last delivery unverified (...)`. The marker is
+cleared by the next run that delivers with evidence. An empty payload (no text
+and no media) is never handed to an adapter; it fails closed and is reported in
+`last_delivery_error` instead of being logged as delivered.
+
 ### Continuable jobs (reply to a cron delivery)
 
 By default a cron delivery is fire-and-forget: the message is sent, but it does
diff --git a/website/docs/user-guide/features/goals.md b/website/docs/user-guide/features/goals.md
index b4a9f31585..d187dd9bef 100644
--- a/website/docs/user-guide/features/goals.md
+++ b/website/docs/user-guide/features/goals.md
@@ -49,7 +49,7 @@ What you'll see:
 
 1. **Goal accepted** — `⊙ Goal set (20-turn budget): <your goal>`
 2. **Turn 1 runs** — Hermes starts working as if you'd sent the goal as a normal message.
-3. **Judge runs** — after the turn, the judge model decides `done` or `continue`.
+3. **Judge runs** — after the turn, the judge model decides `done`, `continue`, or `blocked`.
 4. **Loop fires if needed** — if `continue`, you'll see `↻ Continuing toward goal (1/20): <judge's reason>` and Hermes takes the next step automatically.
 5. **Terminates** — eventually you see either `✓ Goal achieved: <reason>` or `⏸ Goal paused — N/20 turns used`.
 
@@ -140,7 +140,7 @@ A completion contract makes the judge stricter, but the judge is still an LLM re
 How it works, each turn:
 
 1. **Gates run before the judge.** If any gate fails, the judge is *not called* — a red gate is deterministic evidence the goal isn't done. The gate's exit code and output tail (last ~3 KB) become the continuation prompt, so the agent iterates against the actual failure instead of a vibe.
-2. **All gates pass → normal judging.** The LLM judge then decides done/continue/wait exactly as before.
+2. **All gates pass → normal judging.** The LLM judge then decides done/blocked/continue/wait exactly as before.
 3. **Unchanged workspace → no re-run.** If a gate failed and nothing changed in the workspace since (tracked via a git fingerprint of HEAD + working-tree status), the gate is not re-run — the recorded failure is replayed and the attempt count advances. A stuck agent can't burn wall-clock re-running an identical red suite. Outside a git repo, gates simply always re-run.
 4. **Retries are bounded.** Each gate defaults to 3 retries and a 5-minute timeout. When a gate exhausts its retries the goal auto-pauses (like the turn budget) with a message telling you to fix it manually, remove the gate, or `/goal resume`.
 
@@ -179,9 +179,9 @@ After every turn, Hermes calls an auxiliary model with:
 
 - The standing goal text
 - The agent's most recent final response (last ~4 KB of text)
-- A system prompt telling the judge to reply with strict one-line JSON: `{"verdict": "done" | "continue" | "wait", "reason": "<one-sentence rationale>"}` (wait verdicts add `wait_on_session` / `wait_on_pid` / `wait_for_seconds`; the legacy `{"done": <bool>, "reason": "..."}` shape is still accepted)
+- A system prompt telling the judge to reply with strict one-line JSON: `{"verdict": "done" | "blocked" | "continue" | "wait", "reason": "<one-sentence rationale>"}` (wait verdicts add `wait_on_session` / `wait_on_pid` / `wait_for_seconds`; the legacy `{"done": <bool>, "reason": "..."}` shape is still accepted)
 
-The judge is deliberately conservative: it marks a goal `done` only when the response **explicitly** confirms the goal is complete, when the final deliverable is clearly produced, or when the goal is unachievable/blocked (treated as DONE with a block reason so we don't burn budget on impossible tasks).
+The judge is deliberately conservative: it marks a goal `done` only when the response **explicitly** confirms the goal is complete, when the final deliverable is clearly produced. A goal the agent explains is **unachievable** (impossible, out of scope, needs user input) gets a `blocked` verdict instead — never `done`: the goal **pauses** with the judge's reason (`🚫 Goal judged unachievable — paused`), so you can re-scope it with `/goal <text>` or override with `/goal resume` rather than burning budget or having an impossible task waved through as complete.
 
 ### Fail-open semantics
 
diff --git a/website/docs/user-guide/features/hooks.md b/website/docs/user-guide/features/hooks.md
index 8ef9e7b180..e30b3b0d39 100644
--- a/website/docs/user-guide/features/hooks.md
+++ b/website/docs/user-guide/features/hooks.md
@@ -1876,11 +1876,12 @@ Secrets: prefer `secret_env` (the name of an environment variable, typically set
 
 ### Wire format
 
-Each firing POSTs a JSON body with the same top-level shape as shell hooks' stdin, plus delivery metadata:
+Each firing POSTs a JSON body with the same top-level shape as shell hooks' stdin, plus delivery metadata. `profile` names the Hermes profile that emitted the event (`"default"` outside profiles), so receivers behind a multiplexed gateway can tell profiles apart:
 
 ```json
 {
   "hook_event_name": "on_session_end",
+  "profile": "default",
   "tool_name": null,
   "tool_input": null,
   "session_id": "sess_abc123",
diff --git a/website/docs/user-guide/features/image-generation.md b/website/docs/user-guide/features/image-generation.md
index 33c4abc747..f9ad545524 100644
--- a/website/docs/user-guide/features/image-generation.md
+++ b/website/docs/user-guide/features/image-generation.md
@@ -104,6 +104,28 @@ image_gen:
 
 The `fal-ai/gpt-image-1.5` and `fal-ai/gpt-image-2` request quality is pinned to `medium` (~$0.034–$0.06/image at 1024×1024). We don't expose the `low` / `high` tiers as a user-facing option so that Nous Portal billing stays predictable across all users — the cost spread between tiers is 3–22×. If you want a cheaper option, pick Klein 9B or Z-Image Turbo; if you want higher quality, use Nano Banana Pro or Recraft V4 Pro.
 
+### Meta Model API: Muse Image
+
+With `image_gen.provider: meta-ai`, images are generated through the
+[Meta Model API](https://api.meta.ai) (`https://api.meta.ai/v1`), the same
+OpenAI-compatible endpoint that serves the Muse Spark chat models. It is the
+image-gen companion to the bundled `meta-ai` chat provider.
+
+| Model | Speed | Strengths | Price |
+|---|---|---|---|
+| `muse-image-1.0` *(default)* | ~10s | Meta Model API image generation | $0.01/image |
+
+```yaml
+image_gen:
+  provider: meta-ai
+  model: muse-image-1.0
+```
+
+Auth reuses the same env vars as the Meta chat provider — `MODEL_API_KEY`
+(Meta's documented name), with `META_API_KEY` / `META_MODEL_API_KEY` accepted
+as aliases. Set `META_BASE_URL` to point at a proxy or alternate host. Text-to-image
+only for now; responses are saved to `$HERMES_HOME/cache/images/`.
+
 ## Usage
 
 The agent-facing schema is intentionally minimal — the model picks up whatever you've configured:
diff --git a/website/docs/user-guide/features/kanban.md b/website/docs/user-guide/features/kanban.md
index fccda51c1b..084a36f3f8 100644
--- a/website/docs/user-guide/features/kanban.md
+++ b/website/docs/user-guide/features/kanban.md
@@ -512,7 +512,7 @@ def register(ctx):
 
 ### Goal-mode cards (`--goal`)
 
-By default each worker gets **one shot** at its card — do the work, call `kanban_complete`/`kanban_block`, exit. Pass `--goal` (CLI) or `goal_mode=True` (the `kanban_create` tool / dashboard) to instead run that worker in a **goal loop**, the same Ralph-style engine behind the `/goal` slash command: after every turn an auxiliary judge checks the worker's output against the card's title + body (treated as the acceptance criteria), and if the work isn't done — and the turn budget remains — the worker keeps going **in the same session** until the judge agrees, the worker terminates the task itself, or the budget runs out (which **blocks** the card for human review rather than exiting silently).
+By default each worker gets **one shot** at its card — do the work, call `kanban_complete`/`kanban_block`, exit. Pass `--goal` (CLI) or `goal_mode=True` (the `kanban_create` tool / dashboard) to instead run that worker in a **goal loop**, the same Ralph-style engine behind the `/goal` slash command: after every turn an auxiliary judge checks the worker's output against the card's title + body (treated as the acceptance criteria), and if the work isn't done — and the turn budget remains — the worker keeps going **in the same session** until the judge agrees, the worker terminates the task itself, or the budget runs out (which **blocks** the card for human review rather than exiting silently). If the judge rules the goal **unachievable** as written, the card is blocked immediately with the judge's reason — an impossible card is never marked done, and `kanban complete` / `kanban request-review` on such a card are rejected with a pointer to `kanban block` or re-scoping.
 
 ```bash
 hermes kanban create "Translate the docs site to French" \
@@ -614,7 +614,7 @@ Config knobs (all under `kanban:` in `~/.hermes/config.yaml`):
 | `orchestrator_profile` | `""` | Profile assigned to the root/orchestration task after decomposition. Empty = fall back to active default profile. |
 | `default_assignee` | `""` | Where a child task lands when the LLM picks an unknown profile. Empty = fall back to active default. |
 | `auto_subscribe_on_create` | `true` | When `kanban_create` runs inside a persistent gateway/TUI session, terminal events resume that originating agent with a synthetic status turn. Set to `false` for passive completion or to require explicit `kanban_notify-subscribe` calls. Independent of `auto_decompose`. |
-| `done_sub_retention_days` | `30` | Notify subscriptions survive `done` (reopen-safe) and are removed on `archived`. The notifier GC purges subscriptions whose task has been `done` with no new events for this many days, bounding sub-table growth on boards that never archive. `0` disables the sweep. |
+| `done_sub_retention_days` | `30` | Notify subscriptions survive `done` (reopen-safe) and are removed on `archived`. The notifier GC purges subscriptions whose task has been `done` or `blocked` with no new events for this many days, bounding sub-table growth on boards that never archive. `0` disables the sweep. |
 
 And the two auxiliary LLM slots:
 
@@ -887,7 +887,7 @@ bot> ✓ t_9fc1a3 completed by transcriber
      transcribed 42 minutes, saved to podcast/2026-05-04.md
 ```
 
-Subscriptions survive a task reaching `done` — completion is reversible (a reviewer or controller can reopen a done task), so the origin session keeps getting notified through reopen cycles. They auto-remove on `archived` (the irreversible end state). On boards that never archive, a GC sweep purges subscriptions for tasks that have sat in `done` with no new activity for `kanban.done_sub_retention_days` days (default 30; set 0 to disable), so stale rows don't accumulate forever. If you script a create with `--json` (machine output) the auto-subscribe is skipped — the assumption is that scripted callers want to manage subscriptions explicitly via `/kanban notify-subscribe`.
+Subscriptions survive a task reaching `done` — completion is reversible (a reviewer or controller can reopen a done task), so the origin session keeps getting notified through reopen cycles. They auto-remove on `archived` (the irreversible end state). On boards that never archive, a GC sweep purges subscriptions for tasks that have sat in `done` or `blocked` with no new activity for `kanban.done_sub_retention_days` days (default 30; set 0 to disable), so stale rows don't accumulate forever. If you script a create with `--json` (machine output) the auto-subscribe is skipped — the assumption is that scripted callers want to manage subscriptions explicitly via `/kanban notify-subscribe`.
 
 A chat-originated auto-subscribe is created in `notify+wake` mode: on a terminal event the destination agent both receives the passive message **and** takes a real turn, so it can read the board context and reply in its own voice. See [Delivery modes](#delivery-modes) below.
 
diff --git a/website/docs/user-guide/features/loops.md b/website/docs/user-guide/features/loops.md
index dfd0acb589..ad52195c3e 100644
--- a/website/docs/user-guide/features/loops.md
+++ b/website/docs/user-guide/features/loops.md
@@ -61,7 +61,7 @@ A loop ends when any of these fires:
 |---|---|
 | The agent decides it's done | The wakeup prompt teaches the agent to end its reply with `LOOP_COMPLETE` on its own line when the task is finished or moot. |
 | A run cap | `--times N` — stop after N wakeups. |
-| An evidence-based condition | `--until <condition>` — after each wakeup, the same auxiliary judge that powers `/goal` checks the reply against your condition (fail-open: a broken judge never wedges the loop). |
+| An evidence-based condition | `--until <condition>` — after each wakeup, the same auxiliary judge that powers `/goal` checks the reply against your condition. If the judge rules the condition unachievable, the loop **pauses** with the reason instead of re-firing until the tick budget (fail-open: a broken judge never wedges the loop). |
 | You | `/loop stop` (or `/loop pause` to keep it around). |
 | The backstop budget | `loops.max_ticks` (default 100) pauses the loop so an unattended session can't burn tokens forever. `0` = unlimited. |
 
diff --git a/website/docs/user-guide/features/mcp.md b/website/docs/user-guide/features/mcp.md
index 3d2e82a85f..a3fe5f0802 100644
--- a/website/docs/user-guide/features/mcp.md
+++ b/website/docs/user-guide/features/mcp.md
@@ -644,7 +644,7 @@ If you change MCP config, use:
 /reload-mcp
 ```
 
-This reloads MCP servers from config and refreshes the available tool list. For runtime tool changes pushed by the server itself, see [Dynamic Tool Discovery](#dynamic-tool-discovery) above.
+This reloads MCP servers from config and refreshes the available tool list. It is also the explicit way to re-probe availability-gated tools (Docker, `HASS_TOKEN`, OAuth…): a session's tool set is otherwise frozen, so a credential or daemon that appears mid-session is only picked up on `/reload-mcp`, `/new`, or context compaction. For runtime tool changes pushed by the server itself, see [Dynamic Tool Discovery](#dynamic-tool-discovery) above.
 
 ### Toolsets
 
diff --git a/website/docs/user-guide/features/memory.md b/website/docs/user-guide/features/memory.md
index b8c79dbc77..0c03f4e8cb 100644
--- a/website/docs/user-guide/features/memory.md
+++ b/website/docs/user-guide/features/memory.md
@@ -369,6 +369,38 @@ and tools not listed here remain denied. Keep the list narrow and prefer tools
 that stage a proposal for human review rather than applying external or
 destructive changes directly. The default is an empty list.
 
+### Local models: reviews wait for an idle GPU (`defer`)
+
+On a cloud provider the review finishes in seconds and runs alongside
+whatever you do next. When the review's runtime is the **managed local
+llama-server** (Settings → Local models), the same fork occupies the GPU your
+next prompt needs — for minutes on a large model — and sending a new prompt
+cancels it, discarding the learning. So on the managed local runtime, reviews
+are **deferred by default**: queued at turn end and executed once the machine
+has been quiet for a short settle window. Nothing about the review itself
+changes — same model, same full-transcript replay, same writes — only the
+execution moment moves.
+
+```yaml
+auxiliary:
+  background_review:
+    defer: auto            # auto (default) | never
+    defer_max_age_s: 1800  # run a queued review anyway after this long
+```
+
+| Value | Behaviour |
+|-------|-----------|
+| `auto` (default) | Reviews whose runtime resolves to the managed local server are queued and run at idle; every other runtime (cloud, external servers) spawns immediately as before. |
+| `never` | Old behavior everywhere: spawn immediately at turn end, even on the managed local GPU. |
+
+Queued reviews coalesce per session (a newer turn's snapshot replaces the
+older one — the review replays the whole conversation, so nothing is lost),
+a review preempted by a new prompt is re-queued instead of discarded, and a
+review that has waited longer than `defer_max_age_s` runs even if the machine
+never goes idle. Explicit `/refine` always runs immediately. The queue is
+in-memory: reviews still pending when the app exits are dropped, same as an
+in-flight fork would have been.
+
 ## Controlling skill writes (`skills.write_approval`)
 
 Skills use the same on/off gate, but the review UX differs because a
diff --git a/website/docs/user-guide/features/tool-search.md b/website/docs/user-guide/features/tool-search.md
index 8264594632..f64e59caf1 100644
--- a/website/docs/user-guide/features/tool-search.md
+++ b/website/docs/user-guide/features/tool-search.md
@@ -156,6 +156,12 @@ to any progressive-disclosure design, not specific to this implementation:
   result enters the conversation history (so it does get cached on
   subsequent turns) but it never benefits from the system-prompt cache
   prefix.
+- **No provider-native validation for deferred schemas.** `tool_describe`
+  lets the model read a deferred tool's schema, but the provider still sees
+  only the generic `tool_call.arguments` object. Hermes therefore coerces and
+  validates the underlying arguments locally before dispatch; the concrete
+  tool or MCP server remains responsible for schemas Hermes cannot safely
+  validate, such as malformed schemas or external references.
 - **Model-quality dependence.** Tool Search assumes the model can write a
   reasonable search query for the tool it wants. Smaller models do this
   less well; the published Anthropic numbers (49% → 74% on Opus 4 with
diff --git a/website/docs/user-guide/features/tts.md b/website/docs/user-guide/features/tts.md
index 3fbfce34b6..e2ae021a81 100644
--- a/website/docs/user-guide/features/tts.md
+++ b/website/docs/user-guide/features/tts.md
@@ -256,6 +256,19 @@ tts:
 
 **Advanced knobs** (`tts.piper.length_scale` / `noise_scale` / `noise_w_scale` / `volume` / `normalize_audio`, `use_cuda`) correspond 1:1 to Piper's `SynthesisConfig`. They're ignored on older `piper-tts` versions.
 
+### Warm-up and unload via speech toggles (local engines)
+
+Local engines (Piper, KittenTTS) load their model lazily, so without help the *first* spoken reply after you turn speech on pays the whole model load — and on a fresh install the voice download — as silence before the first word. Hermes treats the speech-output toggles as the signal that TTS is about to be needed:
+
+- **Desktop** — turning on **Read replies aloud**, or starting a **voice conversation**, pre-loads the configured engine in the background right away. Turning both off again unloads the resident model (a Piper voice is tens of MB; KittenTTS up to ~80MB) so it isn't parked in RAM for nothing.
+- **CLI / TUI** — `/voice tts` (and `/voice on` when `voice.auto_tts` is set) do the same; `/voice off` releases.
+
+Each toggle holds a *lease* on the engine; the model is only unloaded when the last lease across surfaces is released, so switching off read-aloud in one Desktop window never pulls the voice out from under a conversation running in another. For cloud providers there is no model to hold — the toggle only makes sure a lazily-installed SDK (edge-tts, ElevenLabs, Mistral) is present. Warm-up is best-effort: if the engine can't load, the toggle still succeeds and the first reply falls back to loading on demand as before.
+
+The Desktop calls `POST /api/audio/tts-lease` with `{"lease": "<name>", "active": true|false}`; other frontends can use the same endpoint.
+
+The same lease also reaches user-declared providers, so a self-hosted TTS server can preload and unload its model on the toggles: a [command provider](#custom-command-providers) runs its optional `warm_command` / `release_command`, and a [Python plugin provider](#python-plugin-providers) gets `warm()` / `release()`.
+
 ### Custom command providers
 
 If a TTS engine you want isn't natively supported (VoxCPM, MLX-Kokoro, XTTS CLI, a voice-cloning script, anything else that exposes a CLI), you can wire it in as a **command-type provider** without writing any Python. Hermes writes the input text to a temp UTF-8 file, runs your shell command, and reads the audio file the command produced.
@@ -348,6 +361,7 @@ Use `{{` and `}}` for literal braces.
 | `voice_compatible` | `false` | When `true`, Hermes converts MP3/WAV output to Opus/OGG via ffmpeg so Telegram renders a voice bubble.      |
 | `max_text_length`  | `5000`  | Maximum input characters per command invocation; longer text is split into ordered chunks.                  |
 | `voice` / `model`  | empty   | Passed to the command as placeholder values only.                                                           |
+| `warm_command` / `release_command` | unset | Shell commands run when a surface toggles speech output on / when the last lease across surfaces is released — e.g. `curl -s localhost:5002/load?model={model}` to preload a local TTS server, and its `unload` counterpart. Best-effort and non-blocking: run in the background with the same `timeout`, `env_passthrough` and `{voice}` / `{model}` / `{speed}` placeholders as `command`; output is discarded and failures are only logged at debug. |
 
 #### Behavior notes
 
@@ -437,6 +451,7 @@ Override these on your provider class for richer integration:
 - `get_setup_schema()` → return `{name, badge, tag, env_vars: [{key, prompt, url}]}` to power the picker row in `hermes tools` / `hermes setup`. Without this, the plugin still works but its row in the picker is minimal.
 - `stream(text, *, voice, model, format, **extra)` → iterator yielding audio bytes for streaming delivery (default raises `NotImplementedError`).
 - `voice_compatible` property → set `True` if your output is Opus-compatible and the gateway should deliver it as a voice bubble (default `False` = regular audio attachment).
+- `warm()` / `release()` → called when a surface toggles speech output on / when the last lease across surfaces is released, while your provider is the configured `tts.provider` — preload or unload a local model server here. Both default to no-ops; exceptions are logged at debug and never fail the toggle.
 
 See `agent/tts_provider.py` for the full ABC including docstrings.
 
diff --git a/website/docs/user-guide/features/web-dashboard.md b/website/docs/user-guide/features/web-dashboard.md
index 17eb492b49..e3a8bbff75 100644
--- a/website/docs/user-guide/features/web-dashboard.md
+++ b/website/docs/user-guide/features/web-dashboard.md
@@ -235,7 +235,7 @@ Config changes take effect on the next agent session or gateway restart. The web
 Manage the `.env` file where API keys and credentials are stored. Keys are grouped by category:
 
 - **LLM Providers** — OpenRouter, Anthropic, OpenAI, DeepSeek, etc.
-- **Tool API Keys** — Browserbase, Firecrawl, Keenable, ElevenLabs, etc.
+- **Tool API Keys** — Browserbase, Firecrawl, Tavily, Keenable, ElevenLabs, etc.
 - **Messaging Platforms** — Telegram, Discord, Slack bot tokens, etc.
 - **Agent Settings** — non-secret env vars like `API_SERVER_ENABLED`
 
diff --git a/website/docs/user-guide/features/web-search.md b/website/docs/user-guide/features/web-search.md
index 44911dc5ab..100c6e50e8 100644
--- a/website/docs/user-guide/features/web-search.md
+++ b/website/docs/user-guide/features/web-search.md
@@ -24,10 +24,11 @@ Both are configured through a single backend selection. Providers are chosen via
 | **DDGS (DuckDuckGo)** | — (no key) | ✔ | — | ✔ Free |
 | **Exa** | `EXA_API_KEY` (optional) | ✔ | ✔ | ✔ Keyless ring member · 1 000 searches/mo with key |
 | **Parallel** | `PARALLEL_API_KEY` (optional) | ✔ | ✔ | ✔ Keyless ring member · paid with key |
+| **Tavily** | `TAVILY_API_KEY` (optional) | ✔ | ✔ | ✔ Opt-in keyless when selected |
 | **Keenable** | `KEENABLE_API_KEY` (optional) | ✔ | ✔ | ✔ Keyless ring member · paid with key |
 | **xAI (Grok)** | `XAI_API_KEY` or `hermes auth add xai-oauth` | ✔ | — | Paid (SuperGrok or per-token) |
 
-Brave Search, DDGS, and xAI are **search-only** — pair any of them with Firecrawl/Keenable/Exa/Parallel when you also need `web_extract`. DDGS uses the [`ddgs` Python package](https://pypi.org/project/ddgs/) under the hood; if it isn't already installed, run `pip install ddgs` (or let Hermes lazy-install it on first use). xAI runs Grok's server-side `web_search` tool on the Responses API — results are LLM-generated rather than index-backed, so titles, descriptions, and URL choice are all model output (see the [trust-model caveat](#xai-grok) below).
+Brave Search, DDGS, and xAI are **search-only** — pair any of them with Firecrawl/Tavily/Keenable/Exa/Parallel when you also need `web_extract`. DDGS uses the [`ddgs` Python package](https://pypi.org/project/ddgs/) under the hood; if it isn't already installed, run `pip install ddgs` (or let Hermes lazy-install it on first use). xAI runs Grok's server-side `web_search` tool on the Responses API — results are LLM-generated rather than index-backed, so titles, descriptions, and URL choice are all model output (see the [trust-model caveat](#xai-grok) below).
 
 **Per-capability split:** you can use different providers for search and extract independently — for example SearXNG (free) for search and Firecrawl for extract. See [Per-capability configuration](#per-capability-configuration) below.
 
@@ -266,13 +267,27 @@ SearXNG handles search; you need a separate provider for `web_extract`. Use the
 # ~/.hermes/config.yaml
 web:
   search_backend: "searxng"
-  extract_backend: "firecrawl"   # or keenable, exa, parallel
+  extract_backend: "firecrawl"   # or tavily, keenable, exa, parallel
 ```
 
 With this config, Hermes uses SearXNG for all search queries and Firecrawl for URL extraction — combining free search with high-quality extraction.
 
 ---
 
+### Tavily
+
+AI-optimised search and extract. Select Tavily in `hermes tools` (or set `web.backend: tavily`) to use it **keyless** with no account (rate-limited). Set an API key when you want higher limits.
+
+```bash
+# optional — skip this for keyless access after selecting Tavily
+# ~/.hermes/.env
+TAVILY_API_KEY=tvly-your-key-here
+```
+
+Get a key at [app.tavily.com](https://app.tavily.com/home). See [Tavily keyless](https://docs.tavily.com/documentation/keyless).
+
+---
+
 ### Exa
 
 Neural search with semantic understanding. Good for research and finding conceptually related content.
@@ -338,10 +353,10 @@ web:
     timeout: 90                  # seconds (default)
 ```
 
-**Search-only** — pair with Firecrawl / Keenable / Exa / Parallel if you also need `web_extract`. On 401 the provider performs a single forced OAuth-token refresh and retries (covers mid-window revocation and opaque tokens the proactive expiry check can't decode); env-var credentials skip the retry.
+**Search-only** — pair with Firecrawl / Tavily / Keenable / Exa / Parallel if you also need `web_extract`. On 401 the provider performs a single forced OAuth-token refresh and retries (covers mid-window revocation and opaque tokens the proactive expiry check can't decode); env-var credentials skip the retry.
 
 :::caution Trust model
-Unlike index-backed providers (Brave, Keenable, Exa) which return verbatim search-engine results, xAI is an LLM choosing which URLs to surface and writing the titles and descriptions itself. The *content* of the query influences the output, so a maliciously crafted query (e.g. injected via untrusted upstream input the agent picked up) can in principle steer Grok into emitting attacker-chosen URLs. Treat returned URLs the same way you'd treat any model-generated link — validate before fetching, especially if the query came from untrusted input.
+Unlike index-backed providers (Brave, Tavily, Exa) which return verbatim search-engine results, xAI is an LLM choosing which URLs to surface and writing the titles and descriptions itself. The *content* of the query influences the output, so a maliciously crafted query (e.g. injected via untrusted upstream input the agent picked up) can in principle steer Grok into emitting attacker-chosen URLs. Treat returned URLs the same way you'd treat any model-generated link — validate before fetching, especially if the query came from untrusted input.
 :::
 
 ---
@@ -355,7 +370,7 @@ Set one provider for all web capabilities:
 ```yaml
 # ~/.hermes/config.yaml
 web:
-  backend: "searxng"   # firecrawl | searxng | brave-free | ddgs | keenable | exa | parallel | xai
+  backend: "searxng"   # firecrawl | searxng | brave-free | ddgs | tavily | keenable | exa | parallel | xai
 ```
 
 ### Per-capability configuration
@@ -382,6 +397,7 @@ If no backend has **ever** been selected (no `web.backend` / per-capability key
 
 | Credential present | Auto-selected backend |
 |--------------------|-----------------------|
+| `TAVILY_API_KEY` | tavily |
 | `EXA_API_KEY` | exa |
 | `PARALLEL_API_KEY` | parallel |
 | `FIRECRAWL_API_KEY` or `FIRECRAWL_API_URL` (or the Nous Tool Gateway is ready) | firecrawl |
@@ -438,7 +454,7 @@ SearXNG cannot extract URL content. Set `web.extract_backend` to a provider that
 ```yaml
 web:
   search_backend: "searxng"
-  extract_backend: "firecrawl"  # or keenable / exa / parallel
+  extract_backend: "firecrawl"  # or tavily / keenable / exa / parallel
 ```
 
 ### SearXNG returns 0 results
diff --git a/website/docs/user-guide/local-models.md b/website/docs/user-guide/local-models.md
new file mode 100644
index 0000000000..8919bd875e
--- /dev/null
+++ b/website/docs/user-guide/local-models.md
@@ -0,0 +1,134 @@
+---
+sidebar_position: 4
+title: Local Models
+description: Run models entirely on your own machine — no account, no API key, nothing leaves your computer.
+---
+
+# Local Models
+
+Hermes can run open models entirely on your own machine. It downloads and
+manages the inference engine (llama.cpp), picks the right build of each
+model for your hardware, and handles memory so you never configure context
+sizes, GPU layers, or quantization. You pick a model; Hermes does the rest.
+
+Nothing leaves your computer: no account, no API key, and no network access
+after a model is downloaded.
+
+## Getting started
+
+1. Open **Settings → Providers → Local Models** (or choose **Run models
+   locally** during onboarding).
+2. Click **Install runtime**. Hermes downloads the official llama.cpp
+   build for your hardware (a few hundred MB), verifies it, and keeps it
+   updated.
+3. Pick a model from the catalog and click **Download**.
+4. Click **Use**. New chats now run on the local model.
+
+That's the whole flow. The server starts and stops with Hermes, restarts
+survive app restarts, and switching back to a cloud provider is one click
+in the model picker.
+
+## How Hermes picks what to download
+
+Every model in the catalog is priced against **your machine** before you
+download anything. Each row shows:
+
+- **Memory fit** — green (*Fits your GPU*: runs entirely in GPU memory),
+  amber (*Uses system RAM*: works, but slower), or red (*Too big for this
+  machine*).
+- **Context** — the window the model starts with and the maximum it can
+  grow to.
+- The download size of the build selected for your hardware.
+
+Models ship in several quality grades (quantizations). Hermes picks the
+highest-quality build that runs fully on your GPU; machines with less
+memory get a more compact build of the same model with the same
+guarantees. Below 4-bit the quality loss is too severe, so Hermes never
+offers builds smaller than that — a machine that can't run the 4-bit
+build spilled to system RAM simply can't run that model.
+
+Models that don't fit stay visible with the reason, so you always know
+what a hardware upgrade would unlock.
+
+## How memory management works
+
+Local models live or die by memory placement, so Hermes manages it
+end-to-end and exposes no knobs:
+
+- **Models start at a context window that fully fits your GPU** and grow
+  toward their native maximum as your conversation needs more room. You
+  may see "Context window grown" in the status feed during long sessions
+  — that's the window expanding, not an error.
+- **Every recommended model gets at least a 64K context window.** When a
+  model is larger than your GPU's memory, Hermes deliberately places the
+  overflow in system RAM in the order that hurts least (expert weights
+  first, never the attention cache), trading some speed to protect the
+  context guarantee.
+- **Conversation compression only kicks in at the model's maximum
+  window** — growth always comes first.
+- Idle models are unloaded after 15 minutes to free GPU memory; they
+  reload automatically on the next message.
+
+## The status bar
+
+Right-click the status bar and enable **System resources** to see live GPU
+utilization, GPU memory, and RAM while local models run. The context meter
+always reflects the window the model is actually running with.
+
+## Finding more models
+
+The catalog is a curated starting point, not a boundary. The **Find more
+models** section on the same page searches all of Hugging Face:
+
+- Results show download counts and a per-file fit check sized to your
+  machine, so you know before downloading whether a build runs fully on
+  your GPU.
+- Anything you download behaves exactly like a catalog model — Hermes
+  reads the model file itself to pick its context window and memory
+  placement. The only difference: community models don't carry our
+  "validated" testing badge.
+- Already have a `.gguf` file on disk? **Add model file** links it into
+  your library without copying it (the original stays where it is), and
+  it's usable immediately.
+
+## Using your own llama-server
+
+If a llama-server is already running on your machine, Hermes detects it
+and uses it instead of starting its own. Point a custom endpoint at any
+OpenAI-compatible server for full manual control — the managed runtime is
+a default, not a requirement. For manual setups (Ollama, MLX, custom
+builds, headless CLI machines), see
+[Run Hermes Locally with Ollama](/guides/local-ollama-setup) and
+[Run Local LLMs on Mac](/guides/local-llm-on-mac).
+
+## Configuration
+
+The managed runtime is controlled by the `local_runtime` section of
+`config.yaml`. The desktop UI writes these values for you; they're
+documented for CLI and headless use:
+
+```yaml
+local_runtime:
+  enabled: false     # true = start the managed server with Hermes.
+                     # The desktop "Use" button sets this automatically.
+  backend: auto      # auto | cuda | metal | vulkan | hip | cpu
+  tag: b10362        # pinned llama.cpp release; Hermes updates it with
+                     # each release after re-validation
+```
+
+Models and runtime builds live under the Hermes home directory
+(`models/` and `runtimes/llamacpp/`). Selecting a local model as your
+main model uses the standard `model.provider: llamacpp` +
+`model.default` settings — the same shape as every other provider.
+
+## Requirements and limits
+
+- **Windows and Linux:** NVIDIA GPU (CUDA) or CPU. **macOS:** Apple
+  Silicon (Metal). Vulkan builds serve AMD GPUs.
+- A GPU with 8 GB+ of memory runs the small catalog models comfortably;
+  16 GB+ runs the 27–35B models at high quality.
+- Model downloads are byte-size checked against the catalog during the
+  transfer; an incomplete download is deleted and reported, never
+  half-used. (Only the runtime engine zips are SHA-256 verified.)
+- Deleting a model removes every file it staged, including vision
+  adapters and speculative-decoding companions.
diff --git a/website/docs/user-guide/messaging/email.md b/website/docs/user-guide/messaging/email.md
index eabde5da49..71f932d6e9 100644
--- a/website/docs/user-guide/messaging/email.md
+++ b/website/docs/user-guide/messaging/email.md
@@ -48,6 +48,31 @@ Most email providers support IMAP/SMTP. Check your provider's documentation for:
 - SMTP host and port (usually port 587 with STARTTLS)
 - Whether app passwords are required
 
+### Proton Mail Bridge / local relays
+
+Proton Mail Bridge (and similar local relays such as a self-hosted MTA) listen on
+loopback with **STARTTLS** and a self-signed certificate, so the defaults
+(implicit TLS on IMAP 993, verified certificates) won't connect. Override the
+transport in `~/.hermes/config.yaml`:
+
+```yaml
+platforms:
+  email:
+    enabled: true
+    extra:
+      imap_host: 127.0.0.1
+      imap_security: starttls     # tls (default) | starttls | plain
+      imap_tls_verify: false      # Bridge uses a self-signed cert
+      smtp_host: 127.0.0.1
+      smtp_security: starttls     # default: tls on port 465, starttls otherwise
+      smtp_tls_verify: false
+```
+
+and set `EMAIL_IMAP_PORT=1143` / `EMAIL_SMTP_PORT=1025` alongside your Bridge
+credentials in `~/.hermes/.env`. Unknown `*_security` values log a warning and
+fall back to the secure default. Only disable `*_tls_verify` for loopback hosts —
+Hermes logs a warning when verification is off for any other host.
+
 ---
 
 ## Step 1: Configure Hermes
diff --git a/website/docs/user-guide/messaging/google_chat.md b/website/docs/user-guide/messaging/google_chat.md
index e613331a4d..e47e5a495a 100644
--- a/website/docs/user-guide/messaging/google_chat.md
+++ b/website/docs/user-guide/messaging/google_chat.md
@@ -166,6 +166,15 @@ GOOGLE_CHAT_MAX_BYTES=16777216                  # 16 MiB — cap on in-flight me
 The project ID also falls back to `GOOGLE_CLOUD_PROJECT`, and the SA path falls
 back to `GOOGLE_APPLICATION_CREDENTIALS` — use whichever convention you prefer.
 
+Under a [multi-profile gateway](../multi-profile-gateways.md), every
+`GOOGLE_CHAT_*` setting is read from the routed profile's own `.env`; a
+secondary profile never inherits the default profile's project, subscription,
+or service account. If a profile has no SA configured while the process
+environment carries one for another profile, the adapter refuses to fall back
+to Application Default Credentials (which would authenticate as that other
+profile) and logs an explicit error instead — put
+`GOOGLE_CHAT_SERVICE_ACCOUNT_JSON` in that profile's `.env`.
+
 Install the Google Chat adapter dependencies through its maintained installer.
 It applies the same pinned security floors used by the runtime checks:
 
diff --git a/website/docs/user-guide/messaging/index.md b/website/docs/user-guide/messaging/index.md
index a0aaf6b5e4..72fc4288eb 100644
--- a/website/docs/user-guide/messaging/index.md
+++ b/website/docs/user-guide/messaging/index.md
@@ -673,6 +673,54 @@ Once the gateway is running, use the `/platform` slash command from any connecte
 
 See also the broader status summary command [`/platforms`](../../reference/slash-commands.md#info).
 
+### Disabling a platform whose credentials are still in `.env`
+
+`platforms.<name>.enabled: false` in `~/.hermes/config.yaml` is authoritative.
+Credentials for that platform left in the environment (`TELEGRAM_BOT_TOKEN`,
+`WEIXIN_TOKEN`, `HASS_TOKEN`, `EMAIL_*`, `TWILIO_ACCOUNT_SID`, ...) are still
+wired into the platform's config so send-only tooling keeps working, but they
+no longer start the adapter:
+
+```yaml title="~/.hermes/config.yaml"
+platforms:
+  weixin:
+    enabled: false   # wins over WEIXIN_TOKEN in .env
+```
+
+Earlier releases let the mere presence of credentials re-enable twelve
+platforms (Weixin, WhatsApp Cloud, Home Assistant, Email, SMS, DingTalk, Feishu,
+WeCom, WeCom callback, BlueBubbles, QQ Bot, Yuanbao) regardless of that key. If
+you relied on that, the gateway now logs one WARNING per affected platform at
+startup so it does not just go dark:
+
+```
+Platform 'weixin' is explicitly disabled by platforms.weixin.enabled: false in config.yaml,
+so the credentials found in the environment (WEIXIN_TOKEN, WEIXIN_ACCOUNT_ID) will NOT start
+its adapter. Environment credentials no longer override an explicit disable. Remove the key
+or set platforms.weixin.enabled: true to turn it back on.
+```
+
+Omitting the `enabled` key entirely keeps the env-only behaviour: credentials
+present → adapter starts.
+
+### Ignoring an inherited proxy (`gateway.trust_env`)
+
+By default every platform adapter honors `HTTP_PROXY` / `HTTPS_PROXY` /
+`NO_PROXY` (and `SSL_CERT_FILE`) from the gateway's environment, and
+auto-detects the macOS system proxy. A gateway started by a Windows Scheduled
+Task or a service manager can inherit a proxy the interactive shell never
+sees — a local Clash/V2Ray listener that isn't running yet — and log
+`Cannot connect to host 127.0.0.1:7890` on every poll. Turn the inherited
+proxy off for all adapters at once:
+
+```yaml title="~/.hermes/config.yaml"
+gateway:
+  trust_env: false
+```
+
+Explicit per-platform proxy variables (`DISCORD_PROXY`, `TELEGRAM_PROXY`,
+`MATRIX_PROXY`, ...) are still honored. Restart the gateway after changing it.
+
 ### Automatic circuit breaker
 
 Each adapter is wrapped in a circuit breaker. Repeated retryable failures (network blips, rate-limit replies, 5xx upstream responses, websocket disconnects) cause the breaker to trip — the adapter is auto-paused, an operator notification is sent to the home channel of another live platform when one is configured, and a structured log line is emitted.
diff --git a/website/docs/user-guide/messaging/slack.md b/website/docs/user-guide/messaging/slack.md
index 4bc66f5a30..6a0a396571 100644
--- a/website/docs/user-guide/messaging/slack.md
+++ b/website/docs/user-guide/messaging/slack.md
@@ -472,6 +472,7 @@ platforms:
 | `platforms.slack.extra.suggested_prompts` | `[]` | Up to four `{title, message}` prompts for Agent/Assistant DM entry points; accepts either a list or `{title, prompts}`. |
 | `platforms.slack.extra.assistant_thread_titles` | `true` | When `true`, names Agent/Assistant DM threads from the first user message. |
 | `platforms.slack.extra.allow_bots` | `"none"` | Controls messages from other Slack bots: `"none"` ignores them, `"mentions"` accepts a bot message only when **that message itself** @mentions Hermes, and `"all"` accepts all of them. Use `"mentions"` for the safest bot-to-bot collaboration mode. See [Accepting messages from other bots](#accepting-messages-from-other-bots-allow_bots). |
+| `platforms.slack.extra.api_human_users` | `[]` | Slack user IDs whose **Web-API (user-token) posts count as human**. Such posts carry the posting `app_id` and no `client_msg_id`, so by default they are dropped as app traffic; allowlist your own front-end's users here instead of `allow_bots: all`. See [Treating your own app's user-token posts as human](#treating-your-own-apps-user-token-posts-as-human-api_human_users). |
 | `platforms.slack.extra.cron_continuable_surface` | `"thread"` | Delivery surface for [continuable cron jobs](../features/cron.md#flat-in-channel-continuation-slack). `"thread"` opens a dedicated thread per delivery (default); `"in_channel"` delivers flat into the channel timeline. Pair `in_channel` with `reply_in_thread: false` (and `require_mention: false`) so a plain channel reply continues the job. |
 
 The equivalent environment variable is `SLACK_ALLOW_BOTS=none|mentions|all`.
@@ -701,6 +702,38 @@ How `mentions` mode gates:
 
 For strict multi-bot deployments, pair with `require_mention: true` and `strict_mention: true` — see the smoke-check profile below.
 
+### Treating your own app's user-token posts as human (`api_human_users`)
+
+A message posted through the Web API with a **user token** (`xoxp-`) is
+authored by a real person, but it arrives with the posting `app_id` and no
+`client_msg_id` — the same signature Hermes uses to recognise app posts — so it
+is dropped as bot traffic. This blocks a common pattern: a custom front-end (an
+internal dashboard, a mobile shell, a kiosk) that sends messages to Hermes *as*
+the logged-in user.
+
+`allow_bots: all` would let those posts through, but it opens the door to every
+bot in the channel and weakens the loop protections. Instead, allowlist just
+the people who use your front-end:
+
+```yaml
+platforms:
+  slack:
+    extra:
+      api_human_users: ["U0AAAAAAA", "U0BBBBBBB"]
+```
+
+The equivalent environment variable is `SLACK_API_HUMAN_USERS` (comma-separated).
+
+Scope and safety:
+
+- The allowlist is **users only**. There is deliberately no app-ID variant: a
+  modern bot token (`xoxb-`) posts with the same `user` + `app_id` shape, so
+  trusting an app would also admit its own bot posts and defeat the loop guard.
+- Events carrying `bot_id` or `subtype: bot_message`, or no `user` at all, are
+  always treated as bot posts regardless of the allowlist.
+- The rest of the pipeline is unchanged: mention gating, `allowed_channels`,
+  and `SLACK_ALLOWED_USERS` still apply to the (now human) sender.
+
 ### Reaction Triggers (`reaction_triggers`)
 
 By default, emoji reactions are acknowledged and dropped — a 👍 on a bot
diff --git a/website/docs/user-guide/messaging/telegram.md b/website/docs/user-guide/messaging/telegram.md
index cd651d7df5..2becfab4ca 100644
--- a/website/docs/user-guide/messaging/telegram.md
+++ b/website/docs/user-guide/messaging/telegram.md
@@ -848,29 +848,31 @@ Shows the current topic's binding: session title, session ID, and hints for `/ne
 
 ### Under the hood
 
-- Activation persists to `telegram_dm_topic_mode(chat_id, user_id, enabled, ...)` in `state.db`
-- Each topic binding persists to `telegram_dm_topic_bindings(chat_id, thread_id, session_id, ...)` with `ON DELETE CASCADE` on `session_id` — pruning a session automatically clears its topic binding
-- The topic-mode SQLite migration is **opt-in**: it runs on the first `/topic` call, never on gateway startup. Until a user runs `/topic` in this profile, `state.db` is unchanged
-- Each inbound DM message looks up its `(chat_id, thread_id)` binding. If present, the lookup routes the message to the bound session via `SessionStore.switch_session()` so the session-key-to-session-id mapping stays consistent on disk
+- Activation persists to `telegram_dm_topic_mode(profile_name, chat_id, user_id, enabled, ...)` in `state.db`. Primary key is `(profile_name, chat_id)` so multiplexed / profile-routed bots sharing one `state.db` do not clobber each other when the same Telegram user DMs multiple bots (private `chat_id` is the user id and is identical across bots).
+- Each topic binding persists to `telegram_dm_topic_bindings(profile_name, chat_id, thread_id, session_id, ...)` with PK `(profile_name, chat_id, thread_id)` and `ON DELETE CASCADE` on `session_id` — pruning a session automatically clears its topic binding
+- The topic-mode SQLite migration is **opt-in**: it runs on the first `/topic` call, never on gateway startup. Until a user runs `/topic` in this profile, `state.db` is unchanged. Schema v3 adds `profile_name`; legacy rows migrate into the `default` namespace only
+- Each inbound DM message looks up its `(profile_name, chat_id, thread_id)` binding using the **routed** profile (`source.profile`, not the process-global active profile). If present, the lookup routes the message to the bound session via `SessionStore.switch_session()` so the session-key-to-session-id mapping stays consistent on disk
 - `/new` inside a topic rewrites the binding row to point at the new session ID, so the next message stays on the fresh session
 - Topics declared in `extra.dm_topics` are **never auto-renamed** — the operator-chosen name is preserved even when multi-session mode is enabled
 - Set `extra.disable_topic_auto_rename: true` to turn off auto-rename for **all** topics in the chat (ad-hoc topics created via Threaded Mode included)
 - The General (pinned top) topic in a forum-enabled DM is treated as the root lobby, regardless of whether Telegram delivers its messages with `message_thread_id=1` or with no thread_id
-- Root-lobby reminders are rate-limited to one message per 30 seconds per chat — a user who forgets topic mode is on and types ten prompts in the root won't get ten replies
-- BotFather setup screenshots are rate-limited to one send per 5 minutes per chat — repeated `/topic` attempts while Threads Settings are still disabled won't re-upload the same image
+- Root-lobby reminders are rate-limited to one message per 30 seconds per **(profile, chat)** — a user who forgets topic mode is on and types ten prompts in the root won't get ten replies, and two multiplexed profiles sharing a chat id do not suppress each other's reminders
+- BotFather setup screenshots are rate-limited to one send per 5 minutes per **(profile, chat)** — repeated `/topic` attempts while Threads Settings are still disabled won't re-upload the same image
 - `/bg <prompt>` started inside a topic delivers its result back to the same topic; background sessions don't trigger auto-rename of the owning topic
 - `/topic` itself is gated by the bot's user authorization check — unauthorized DMs get a refusal instead of activation
 
 ### Disabling multi-session mode
 
-Send `/topic off` in the root DM. Hermes flips the row off, clears the chat's `(thread_id → session_id)` bindings, and the root DM reverts to a normal Hermes chat. Existing topics in Telegram aren't deleted — they just stop being gated as independent sessions. Re-run `/topic` later to turn it back on.
+Send `/topic off` in the root DM. Hermes flips the row off for **this profile's** namespace, clears that profile's `(thread_id → session_id)` bindings for the chat, and the root DM reverts to a normal Hermes chat. Existing topics in Telegram aren't deleted — they just stop being gated as independent sessions. Re-run `/topic` later to turn it back on.
 
-If you need to clean up by hand (e.g. a bulk reset across many chats), remove the rows directly:
+If you need to clean up by hand (e.g. a bulk reset across many chats), scope rows by `profile_name` (use `default` for single-profile installs):
 
 ```bash
 sqlite3 ~/.hermes/state.db \
-  "UPDATE telegram_dm_topic_mode SET enabled = 0 WHERE chat_id = '<your_chat_id>'; \
-   DELETE FROM telegram_dm_topic_bindings WHERE chat_id = '<your_chat_id>';"
+  "UPDATE telegram_dm_topic_mode SET enabled = 0
+     WHERE profile_name = 'default' AND chat_id = '<your_chat_id>';
+   DELETE FROM telegram_dm_topic_bindings
+     WHERE profile_name = 'default' AND chat_id = '<your_chat_id>';"
 ```
 
 ### Downgrading Hermes
diff --git a/website/docs/user-guide/multi-profile-gateways.md b/website/docs/user-guide/multi-profile-gateways.md
index 7feddd069a..9825f4d047 100644
--- a/website/docs/user-guide/multi-profile-gateways.md
+++ b/website/docs/user-guide/multi-profile-gateways.md
@@ -157,7 +157,7 @@ configure them only on the default profile.
 
 Port-binding platforms covered by this rule: `webhook`, `api_server`,
 `msgraph_webhook`, `feishu`, `wecom_callback`, `bluebubbles`, `sms`,
-`whatsapp_cloud`, `line`. Configure any of these **only on the default profile**;
+`whatsapp_cloud`, `line`, `teams`. Configure any of these **only on the default profile**;
 every profile is reachable through its `/p/<profile>/` prefix.
 
 Authentication follows the profile named in the URL. Unprefixed endpoints keep
@@ -213,7 +213,13 @@ keep working.
 Per-profile `.env` credential isolation is preserved and, if anything,
 stricter: a profile's keys are resolved from its own scope and are never unioned
 into a shared environment (this also means subprocesses like MCP servers and
-Kanban workers only ever see their own profile's secrets). Kanban,
+Kanban workers only ever see their own profile's secrets). Terminal settings
+(`terminal.backend`, `terminal.cwd`, `terminal.docker_volumes`,
+`terminal.docker_shared_container_key`, SSH targets, …) are likewise resolved
+per profile on every routed turn: a profile that omits a terminal key gets the
+documented default, never the launch profile's value, and a profile whose
+`config.yaml`/`.env` cannot be parsed has terminal execution refused rather than
+run under another profile's sandbox policy. Kanban,
 profile-scoped skills/memory/SOUL, and model routing all behave per-profile
 exactly as they do with separate gateways.
 
@@ -272,6 +278,12 @@ gateway:
       platform: telegram
       chat_id: "-1001234567890"
       profile: tg-profile
+
+    # A WhatsApp DM — write the phone number; JID and LID forms also match
+    - name: owner-whatsapp
+      platform: whatsapp
+      chat_id: "15551234567"
+      profile: owner
 ```
 
 Routes are matched most-specific-first (`thread_id` > `chat_id` > `guild_id`),
@@ -281,6 +293,18 @@ no route stay on the default/active profile. The routed profile gets the full
 per-profile isolation described above (config, skills, memory, credentials,
 session namespace). Routing works on every platform adapter, not just Discord.
 
+On WhatsApp and WhatsApp Cloud, a `chat_id` route matches across user-identity
+forms: a bare phone number (`15551234567`), a JID
+(`15551234567@s.whatsapp.net`), and a LID (`…@lid`) all refer to the same
+person once the bridge has paired them (the same canonicalization session keys
+and adapter allowlists already use). You can put the phone number in
+`profile_routes` and inbound DMs still match whether WhatsApp delivers a JID or
+a LID. Without a LID mapping yet, the number form still matches a JID (the
+suffix is stripped) but cannot resolve an unknown LID — that inbound falls
+through to the default profile until the mapping appears. Group chats
+(`…@g.us`) are not sender identities and still match exactly. Telegram numeric
+ids are unchanged.
+
 `profile_routes` requires `gateway.multiplex_profiles: true`; with
 multiplexing off the routes are ignored. If an explicit route matches but its
 target profile is not installed or is outside `multiplex_profile_allowlist`,
@@ -288,6 +312,12 @@ the gateway rejects that ingress and logs the route and target. It does not run
 the default profile. Traffic that matches no route keeps the historical
 default-profile behavior.
 
+Cron jobs owned by a routed profile deliver through the shared bot too, but
+only to targets an enabled route with a `chat_id`/`thread_id` maps to that
+profile — a routed profile's job targeting an unrouted chat (or a chat routed
+to another profile) is never sent through the shared bot. Guild-only routes do
+not qualify a cron target; add a `chat_id` route for the delivery channel.
+
 ## Start, stop, or restart all gateways at once
 
 The CLI ships with single-profile lifecycle commands. To act across every
diff --git a/website/docs/user-guide/profiles.md b/website/docs/user-guide/profiles.md
index ae4ad7055f..ca3349defd 100644
--- a/website/docs/user-guide/profiles.md
+++ b/website/docs/user-guide/profiles.md
@@ -64,6 +64,10 @@ hermes profile create backup --clone-all
 
 Copies **everything** — config, API keys, personality, all memories, skills, cron jobs, plugins. A complete working snapshot. Per-profile history is excluded (session history, `state.db`, `backups/`, `state-snapshots/`, `checkpoints/`) — these belong to the source profile and can reach tens of GB. For a full backup including history, use `hermes profile export` or `hermes backup` instead.
 
+:::note OAuth logins are shared, not copied
+Anthropic (Claude Pro/Max), OpenAI Codex, and xAI OAuth logins use **single-use refresh tokens** — a copy of one is not a second credential, it is the same credential with two owners, and the first profile to refresh it revokes it for every other copy. `--clone-all` (and the dashboard's credential mirroring) therefore drops those OAuth rows from the clone. The new profile keeps reading the login from the root `~/.hermes/auth.json`, and a token refresh performed inside any profile is written back to root, so all profiles stay signed in. Static API keys are copied as usual. To give a profile its own separate OAuth login, run `hermes -p <name> auth add <provider>` inside it.
+:::
+
 ### Clone from a specific profile
 
 ```bash
diff --git a/website/docs/user-guide/sessions.md b/website/docs/user-guide/sessions.md
index af18e5c5ba..67fa40e093 100644
--- a/website/docs/user-guide/sessions.md
+++ b/website/docs/user-guide/sessions.md
@@ -869,24 +869,69 @@ Key tables in `state.db`:
 
 - Gateway sessions auto-reset based on the configured reset policy
 - Before reset, the agent saves memories and skills from the expiring session
-- Opt-in auto-pruning: when `sessions.auto_prune` is `true`, ended sessions inactive for `sessions.retention_days` (default 90) are pruned at CLI/gateway startup
-- After a prune that actually removed rows, `state.db` is `VACUUM`ed to reclaim disk space when at least `sessions.min_vacuum_interval_days` (default 30) have elapsed since the last successful `VACUUM` (SQLite does not shrink the file on plain DELETE)
+- Auto-pruning (**on by default** since #54189): when `sessions.auto_prune` is `true`, ended sessions inactive for `sessions.retention_days` (default 90) are pruned at CLI/gateway/cron startup
+- After a prune that actually removed rows, `state.db` is `VACUUM`ed to reclaim disk space only when **both** gates pass: at least `sessions.min_vacuum_interval_days` (default 30) have elapsed since the last successful `VACUUM`, **and** more than 25% of the file's pages are reclaimable (`PRAGMA freelist_count / page_count`). A dense database never pays for a full rewrite to reclaim a few MB (SQLite does not shrink the file on plain DELETE)
 - Pruning runs at most once per `sessions.min_interval_hours` (default 24); the last-run timestamp is tracked inside `state.db` itself so it's shared across every Hermes process in the same `HERMES_HOME`
 
-Default is **off** — session history is valuable for `session_search` recall, and silently deleting it could surprise users. Enable in `~/.hermes/config.yaml`:
+Without pruning, `state.db` grows without bound — multi-GB files within weeks were reported on gateway + cron installs. If you would rather keep every ended session forever (the pre-#54189 behavior), turn it off in `~/.hermes/config.yaml`:
 
 ```yaml
 sessions:
-  auto_prune: true          # opt in — default is false
+  auto_prune: false         # default is true — set false to keep all history
   retention_days: 90        # keep ended sessions active within this window
   vacuum_after_prune: true  # reclaim disk space after a pruning sweep
   min_vacuum_interval_days: 30 # don't rewrite the DB more often than this
   min_interval_hours: 24    # don't re-run the sweep more often than this
 ```
 
-Active sessions are never auto-pruned, regardless of age. Ended sessions are
-aged from their latest message, so a long-lived conversation used recently is
-not deleted merely because it began before the retention window.
+Existing installs that already set any of these keys explicitly keep their
+values; only unset keys pick up the new defaults.
+
+Only **ended** sessions are ever deleted. Active sessions are never auto-pruned,
+regardless of age. Ended sessions are aged from their latest message, so a
+long-lived conversation used recently is not deleted merely because it began
+before the retention window.
+
+**Stale open sessions from automation.** Some producers — cron jobs, kanban
+workers, subagents, one-shot CLI runs — can die without ever marking their
+session ended, and pruning only deletes *ended* rows. To keep those from
+accumulating forever, each auto-prune pass also *closes* open sessions from
+those state-owned sources (`cli`, `cron`, `kanban`, `acp`, `api_server`,
+`subagent`, `tool`) whose last activity is older than `retention_days`
+(`end_reason: startup_orphan_reap`). Closing is non-destructive — the
+session stays resumable — and the row is aged from its close, so it is only
+deleted by a *later* pass after a further full retention window. Messaging
+platform sessions (Telegram, Discord, …), TUI/desktop sessions, pinned
+sessions, and sessions with a live turn or compression in progress are
+never closed by this sweep.
+
+### Oversized-Transcript Guards
+
+Two limits stop a runaway transcript from being loaded into memory all at once
+(both default to `20000` active messages; `0` disables the guard):
+
+```yaml
+sessions:
+  max_resume_messages: 20000   # interactive resume (CLI / TUI / Desktop)
+  max_export_messages: 20000   # one-shot in-memory export of a single session
+```
+
+`max_resume_messages` bounds **what the resume actually loads**, not the whole
+history of the conversation:
+
+- A plain interactive resume (CLI `--resume`, the TUI) materializes the full
+  compression lineage — every compacted segment plus the live tip — so it is
+  bounded across the lineage.
+- Desktop's cold resume pages the transcript over REST and only holds the live
+  tip segment in memory, so it is bounded by the tip alone. A long-lived chat
+  that has been compacted many times (dozens of segments, tens of thousands of
+  archived rows behind a small tip) is exactly what compression is meant to
+  produce and opens normally; its footer message count reflects the stored
+  lineage, not the live prompt.
+
+When a resume is refused the client receives error code `4130` with the count
+and the scope it was measured against (`across its lineage` or
+`in its tip segment`). `hermes sessions export` still works for such sessions.
 
 ### Manual Cleanup
 
diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/developer-guide/adding-platform-adapters.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/developer-guide/adding-platform-adapters.md
index 43bd0b49fe..b52870e848 100644
--- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/developer-guide/adding-platform-adapters.md
+++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/developer-guide/adding-platform-adapters.md
@@ -537,9 +537,9 @@ await self.handle_message(event)
 
 ### 4. Gateway Runner（`gateway/run.py`）
 
-五个接触点：
+六个接触点：
 
-1. **`_create_adapter()`** — 添加 `elif platform == Platform.NEWPLAT:` 分支
+1. **`_instantiate_adapter()`** — 添加 `elif platform == Platform.NEWPLAT:` 分支。`_create_adapter()` 包装器会将每个成功创建的适配器绑定到其网关运行器。
 2. **`_is_user_authorized()` allowed_users 映射** — `Platform.NEWPLAT: "NEWPLAT_ALLOWED_USERS"`
 3. **`_is_user_authorized()` allow_all 映射** — `Platform.NEWPLAT: "NEWPLAT_ALLOW_ALL_USERS"`
 4. **早期环境检查 `_any_allowlist` 元组** — 添加 `"NEWPLAT_ALLOWED_USERS"`
diff --git a/website/static/api/model-catalog.json b/website/static/api/model-catalog.json
index 8f483fc539..df049f7a88 100644
--- a/website/static/api/model-catalog.json
+++ b/website/static/api/model-catalog.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-08-29T02:38:32Z",
+  "updated_at": "2026-09-01T18:20:04Z",
   "metadata": {
     "source": "hermes-agent repo",
     "docs": "https://hermes-agent.nousresearch.com/docs/reference/model-catalog"
@@ -12,6 +12,10 @@
         "note": "Descriptions drive picker badges. Live /api/v1/models filters curated ids by tool-calling support and free pricing. The entry labeled \"default\": true is the model Hermes silently lands on when the user never picked one."
       },
       "models": [
+        {
+          "id": "anthropic/claude-fable-5.1",
+          "description": ""
+        },
         {
           "id": "anthropic/claude-fable-5",
           "description": ""
@@ -209,6 +213,9 @@
         "note": "Free-tier gating is determined live via Portal pricing (partition_nous_models_by_tier), not this manifest. The entry labeled \"default\": true is the model Hermes silently lands on when the user never picked one."
       },
       "models": [
+        {
+          "id": "anthropic/claude-fable-5.1"
+        },
         {
           "id": "anthropic/claude-fable-5"
         },